From e488cf4cd3f06195ff2fcc9d9f56e24b20ade9b5 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Fri, 24 Jul 2026 14:40:19 +0800
Subject: [PATCH 01/50] feat(qualitygate): enforce six-layer package dependency
 boundaries

Add a data-driven architecture layering test that builds the full import
graph (go list -json -tags authsidecar) and evaluates six rules:

- extension must not depend on internal (transitive; keeps it extractable
  as a standalone SDK module)
- events must not depend on shortcuts (transitive)
- shortcuts must not directly import auth/keychain/credential/client/vfs
  (direct; must go through the shortcuts/common RuntimeContext gate)
- cmd subpackages must not import shortcuts (assembly point + cmd/auth only)
- errs must stay a leaf
- internal must not depend on cmd/shortcuts/events

Pre-existing violations are seeded into layering-edges.txt (37 rows). The
test rejects any unseeded violation (new debt) and any stale row (removed
debt), and CI locks the effective row count to only ever decrease. Removes
the tautological circular-dependency check from arch-audit.yml, since Go
already forbids import cycles at compile time.
---
 .github/workflows/arch-audit.yml              |  13 -
 .github/workflows/ci.yml                      |  14 +
 .../qualitygate/deptest/layering-edges.txt    |  40 ++
 internal/qualitygate/deptest/layering_test.go | 508 ++++++++++++++++++
 4 files changed, 562 insertions(+), 13 deletions(-)
 create mode 100644 internal/qualitygate/deptest/layering-edges.txt
 create mode 100644 internal/qualitygate/deptest/layering_test.go

diff --git a/.github/workflows/arch-audit.yml b/.github/workflows/arch-audit.yml
index 3db50f6057..691dca4964 100644
--- a/.github/workflows/arch-audit.yml
+++ b/.github/workflows/arch-audit.yml
@@ -62,19 +62,6 @@ jobs:
           go list -m -u all 2>/dev/null | grep '\[' >> report.md || echo "All dependencies up to date" >> report.md
           echo '```' >> report.md
 
-      - name: Circular dependency check
-        run: |
-          echo "## Circular Dependencies" >> report.md
-          go list -f '{{.ImportPath}} {{join .Imports " "}}' ./... | \
-            go run golang.org/x/tools/cmd/digraph@v0.31.0 scc 2>&1 | tee cycles.txt
-          if [ -s cycles.txt ]; then
-            echo '```' >> report.md
-            cat cycles.txt >> report.md
-            echo '```' >> report.md
-          else
-            echo "No circular dependencies detected." >> report.md
-          fi
-
       - name: E2E coverage gaps
         run: |
           echo "## E2E Coverage Gaps" >> report.md
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9d79d3d182..d4c4382109 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -119,6 +119,20 @@ jobs:
         env:
           QUALITY_GATE_CHANGED_FROM: ${{ github.event.pull_request.base.sha || github.event.before || 'origin/main' }}
         run: echo "QUALITY_GATE_CHANGED_FROM=$(bash scripts/resolve-changed-from.sh)" >> "$GITHUB_ENV"
+      - name: Enforce layering ratchet
+        run: |
+          ratchet_file=internal/qualitygate/deptest/layering-edges.txt
+          initial_count=39
+          if git cat-file -e "$QUALITY_GATE_CHANGED_FROM:$ratchet_file" 2>/dev/null; then
+            base_count=$(git show "$QUALITY_GATE_CHANGED_FROM:$ratchet_file" | grep -vcE '^\s*(#|$)' || true)
+          else
+            base_count=$initial_count
+          fi
+          current_count=$(grep -vcE '^\s*(#|$)' "$ratchet_file" || true)
+          if [ "$current_count" -gt "$base_count" ]; then
+            echo "::error::Layering ratchet grew from $base_count to $current_count effective rows. Fix the dependency instead of adding a row."
+            exit 1
+          fi
       - name: Run golangci-lint
         run: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6 run --new-from-rev="$QUALITY_GATE_CHANGED_FROM"
       - name: Run source-contract lint guards (lintcheck)
diff --git a/internal/qualitygate/deptest/layering-edges.txt b/internal/qualitygate/deptest/layering-edges.txt
new file mode 100644
index 0000000000..dae04f1df0
--- /dev/null
+++ b/internal/qualitygate/deptest/layering-edges.txt
@@ -0,0 +1,40 @@
+# from	denied	owner	reason	added_at
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/charcheck	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/core	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/envvars	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/i18n	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/keychain	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/validate	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/vfs	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/vfs/localfileio	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/charcheck	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/core	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/envvars	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/i18n	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/keychain	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/validate	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/vfs	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/vfs/localfileio	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/transport/sidecar	github.com/larksuite/cli/internal/envvars	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/events/im	github.com/larksuite/cli/shortcuts/im/convert_lib	arch-migration	events->shortcuts inversion via convert_lib	2026-07-24
+github.com/larksuite/cli/events/im	github.com/larksuite/cli/shortcuts/common	arch-migration	events->shortcuts inversion via convert_lib	2026-07-24
+github.com/larksuite/cli/events	github.com/larksuite/cli/shortcuts/common	arch-migration	events register aggregates events/im (transitive)	2026-07-24
+github.com/larksuite/cli/events	github.com/larksuite/cli/shortcuts/im/convert_lib	arch-migration	events register aggregates events/im (transitive)	2026-07-24
+github.com/larksuite/cli/shortcuts/im	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/mail	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/minutes	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/vc	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/keychain	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/drive	github.com/larksuite/cli/internal/credential	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/im	github.com/larksuite/cli/internal/credential	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/minutes	github.com/larksuite/cli/internal/credential	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/vc	github.com/larksuite/cli/internal/credential	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/drive	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/im	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/mail	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/markdown	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/task	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/vfs	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/event	github.com/larksuite/cli/internal/vfs	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/mail	github.com/larksuite/cli/internal/vfs	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
new file mode 100644
index 0000000000..d8dd53a714
--- /dev/null
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -0,0 +1,508 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package deptest
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"sort"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/larksuite/cli/internal/vfs"
+)
+
+const modulePath = "github.com/larksuite/cli"
+
+// Mode selects whether a rule checks direct or transitive dependencies.
+type Mode int
+
+const (
+	// Direct checks package imports.
+	Direct Mode = iota
+	// Transitive checks the complete dependency set.
+	Transitive
+)
+
+// Rule defines one package-layer dependency restriction.
+type Rule struct {
+	Name       string
+	Mode       Mode
+	FromPrefix string
+	Denied     []string
+	ExceptFrom []string
+	SkipFrom   []string
+}
+
+var rules = []Rule{
+	{
+		Name:       "extension-zero-internal",
+		Mode:       Transitive,
+		FromPrefix: modulePath + "/extension",
+		Denied:     []string{modulePath + "/internal/"},
+		SkipFrom:   []string{"/examples/"},
+	},
+	{
+		Name:       "events-no-shortcuts",
+		Mode:       Transitive,
+		FromPrefix: modulePath + "/events",
+		Denied:     []string{modulePath + "/shortcuts/"},
+	},
+	{
+		Name:       "shortcuts-runtime-gate",
+		Mode:       Direct,
+		FromPrefix: modulePath + "/shortcuts",
+		Denied: []string{
+			modulePath + "/internal/auth",
+			modulePath + "/internal/keychain",
+			modulePath + "/internal/credential",
+			modulePath + "/internal/client",
+			modulePath + "/internal/vfs",
+		},
+		ExceptFrom: []string{
+			modulePath + "/shortcuts/common",
+			modulePath + "/shortcuts/apps/gitcred",
+		},
+	},
+	{
+		Name:       "cmd-assembly-only",
+		Mode:       Direct,
+		FromPrefix: modulePath + "/cmd",
+		Denied:     []string{modulePath + "/shortcuts"},
+		ExceptFrom: []string{
+			modulePath + "/cmd",
+			modulePath + "/cmd/auth",
+		},
+	},
+	{
+		Name:       "errs-leaf",
+		Mode:       Direct,
+		FromPrefix: modulePath + "/errs",
+		Denied:     []string{modulePath + "/"},
+	},
+	{
+		Name:       "internal-no-upper",
+		Mode:       Direct,
+		FromPrefix: modulePath + "/internal",
+		Denied: []string{
+			modulePath + "/cmd",
+			modulePath + "/shortcuts",
+			modulePath + "/events",
+		},
+		ExceptFrom: []string{
+			modulePath + "/internal/qualitygate/cmd/manifest-export",
+		},
+	},
+}
+
+type listedPackage struct {
+	ImportPath string
+	Imports    []string
+	Deps       []string
+}
+
+type layeringEdge struct {
+	From   string
+	Denied string
+}
+
+type layeringViolation struct {
+	layeringEdge
+	Rule string
+}
+
+type seededLayeringEdge struct {
+	layeringEdge
+	Owner   string
+	Reason  string
+	AddedAt time.Time
+	Line    int
+}
+
+func TestPackageLayering(t *testing.T) {
+	root := repoRoot(t)
+	packages := goListPackageGraph(t, root)
+	seeded := readLayeringEdges(t, filepath.Join(root, "internal/qualitygate/deptest/layering-edges.txt"))
+	seededByEdge := indexSeededLayeringEdges(t, seeded)
+
+	actualByRule := make(map[string][]layeringViolation, len(rules))
+	actualEdges := make(map[layeringEdge]struct{})
+	for _, rule := range rules {
+		violations := evaluateLayeringRule(packages, rule)
+		actualByRule[rule.Name] = violations
+		for _, violation := range violations {
+			actualEdges[violation.layeringEdge] = struct{}{}
+		}
+	}
+
+	for _, rule := range rules {
+		t.Run(rule.Name, func(t *testing.T) {
+			for _, violation := range actualByRule[rule.Name] {
+				if _, ok := seededByEdge[violation.layeringEdge]; ok {
+					continue
+				}
+				t.Errorf(
+					"new layering violation: from=%s denied=%s rule=%s; use the approved dependency gate or fix the dependency; do not add rows to layering-edges.txt",
+					violation.From,
+					violation.Denied,
+					violation.Rule,
+				)
+			}
+		})
+	}
+
+	t.Run("stale-layering-edges", func(t *testing.T) {
+		for _, edge := range seeded {
+			if _, ok := actualEdges[edge.layeringEdge]; ok {
+				continue
+			}
+			t.Errorf(
+				"stale layering edge: from=%s denied=%s line=%d; this violation has been removed; delete this row from layering-edges.txt",
+				edge.From,
+				edge.Denied,
+				edge.Line,
+			)
+		}
+	})
+}
+
+func TestParseLayeringEdges(t *testing.T) {
+	t.Run("valid-rows", func(t *testing.T) {
+		input := strings.NewReader(
+			"# from\tdenied\towner\treason\tadded_at\n" +
+				"\n" +
+				"example.com/from\texample.com/denied\towner\tlegacy dependency\t2026-07-24\r\n",
+		)
+		edges, err := parseLayeringEdges(input)
+		if err != nil {
+			t.Fatalf("parseLayeringEdges returned an error: %v", err)
+		}
+		if len(edges) != 1 {
+			t.Fatalf("parseLayeringEdges returned %d rows, want 1", len(edges))
+		}
+		edge := edges[0]
+		if edge.From != "example.com/from" || edge.Denied != "example.com/denied" {
+			t.Fatalf("parseLayeringEdges returned unexpected edge: %+v", edge)
+		}
+		if edge.Owner != "owner" || edge.Reason != "legacy dependency" {
+			t.Fatalf("parseLayeringEdges returned unexpected metadata: %+v", edge)
+		}
+		if got := edge.AddedAt.Format(time.DateOnly); got != "2026-07-24" {
+			t.Fatalf("parseLayeringEdges returned added_at %q, want 2026-07-24", got)
+		}
+		if edge.Line != 3 {
+			t.Fatalf("parseLayeringEdges returned line %d, want 3", edge.Line)
+		}
+	})
+
+	tests := []struct {
+		name  string
+		input string
+	}{
+		{
+			name:  "wrong-field-count",
+			input: "from\tdenied\towner\treason\n",
+		},
+		{
+			name:  "blank-field",
+			input: "from\tdenied\t\treason\t2026-07-24\n",
+		},
+		{
+			name:  "invalid-date",
+			input: "from\tdenied\towner\treason\t2026-02-30\n",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := parseLayeringEdges(strings.NewReader(tt.input))
+			if err == nil {
+				t.Fatal("parseLayeringEdges returned nil error for a malformed row")
+			}
+			if !strings.Contains(err.Error(), "line 1") {
+				t.Fatalf("parseLayeringEdges error %q does not identify line 1", err)
+			}
+		})
+	}
+}
+
+func TestMatchesPackagePrefix(t *testing.T) {
+	tests := []struct {
+		name       string
+		prefix     string
+		importPath string
+		want       bool
+	}{
+		{
+			name:       "exact-package",
+			prefix:     modulePath + "/errs",
+			importPath: modulePath + "/errs",
+			want:       true,
+		},
+		{
+			name:       "child-package",
+			prefix:     modulePath + "/internal/vfs",
+			importPath: modulePath + "/internal/vfs/localfileio",
+			want:       true,
+		},
+		{
+			name:       "trailing-slash-prefix",
+			prefix:     modulePath + "/internal/",
+			importPath: modulePath + "/internal/vfs",
+			want:       true,
+		},
+		{
+			name:       "adjacent-package-name",
+			prefix:     modulePath + "/errs",
+			importPath: modulePath + "/errclass",
+			want:       false,
+		},
+		{
+			name:       "unrelated-package",
+			prefix:     modulePath + "/events/",
+			importPath: modulePath + "/shortcuts/im",
+			want:       false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := matchesPackagePrefix(tt.prefix, tt.importPath); got != tt.want {
+				t.Fatalf(
+					"matchesPackagePrefix(%q, %q) = %t, want %t",
+					tt.prefix,
+					tt.importPath,
+					got,
+					tt.want,
+				)
+			}
+		})
+	}
+}
+
+func TestEvaluateLayeringRuleUsesExactExceptions(t *testing.T) {
+	rule := Rule{
+		Name:       "exact-exception",
+		Mode:       Direct,
+		FromPrefix: modulePath + "/cmd",
+		Denied:     []string{modulePath + "/shortcuts"},
+		ExceptFrom: []string{modulePath + "/cmd"},
+	}
+	packages := []listedPackage{
+		{
+			ImportPath: modulePath + "/cmd",
+			Imports:    []string{modulePath + "/shortcuts"},
+		},
+		{
+			ImportPath: modulePath + "/cmd/service",
+			Imports:    []string{modulePath + "/shortcuts"},
+		},
+	}
+
+	violations := evaluateLayeringRule(packages, rule)
+	if len(violations) != 1 {
+		t.Fatalf("evaluateLayeringRule returned %d violations, want 1", len(violations))
+	}
+	if got := violations[0].From; got != modulePath+"/cmd/service" {
+		t.Fatalf("evaluateLayeringRule returned source %q, want %q", got, modulePath+"/cmd/service")
+	}
+}
+
+func goListPackageGraph(t *testing.T, root string) []listedPackage {
+	t.Helper()
+	args := []string{"list", "-json", "-tags", "authsidecar", "./..."}
+	cmd := exec.Command("go", args...)
+	cmd.Dir = root
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("go %s failed: %v\n%s", strings.Join(args, " "), err, out)
+	}
+
+	decoder := json.NewDecoder(bytes.NewReader(out))
+	var packages []listedPackage
+	for {
+		var pkg listedPackage
+		err := decoder.Decode(&pkg)
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			t.Fatalf("decode go list output: %v", err)
+		}
+		packages = append(packages, pkg)
+	}
+	return packages
+}
+
+func evaluateLayeringRule(packages []listedPackage, rule Rule) []layeringViolation {
+	var violations []layeringViolation
+	for _, pkg := range packages {
+		if !matchesPackagePrefix(rule.FromPrefix, pkg.ImportPath) {
+			continue
+		}
+		if slices.Contains(rule.ExceptFrom, pkg.ImportPath) {
+			continue
+		}
+		if containsAny(pkg.ImportPath, rule.SkipFrom) {
+			continue
+		}
+
+		dependencies := pkg.Imports
+		if rule.Mode == Transitive {
+			dependencies = pkg.Deps
+		}
+		for _, dependency := range dependencies {
+			if !matchesAnyPackagePrefix(rule.Denied, dependency) {
+				continue
+			}
+			violations = append(violations, layeringViolation{
+				layeringEdge: layeringEdge{
+					From:   pkg.ImportPath,
+					Denied: dependency,
+				},
+				Rule: rule.Name,
+			})
+		}
+	}
+	sort.Slice(violations, func(i, j int) bool {
+		if violations[i].From != violations[j].From {
+			return violations[i].From < violations[j].From
+		}
+		return violations[i].Denied < violations[j].Denied
+	})
+	return violations
+}
+
+func matchesPackagePrefix(prefix, importPath string) bool {
+	if importPath == prefix {
+		return true
+	}
+	if !strings.HasPrefix(importPath, prefix) {
+		return false
+	}
+	return strings.HasSuffix(prefix, "/") || importPath[len(prefix)] == '/'
+}
+
+func matchesAnyPackagePrefix(prefixes []string, importPath string) bool {
+	for _, prefix := range prefixes {
+		if matchesPackagePrefix(prefix, importPath) {
+			return true
+		}
+	}
+	return false
+}
+
+func containsAny(value string, substrings []string) bool {
+	for _, substring := range substrings {
+		if strings.Contains(value, substring) {
+			return true
+		}
+	}
+	return false
+}
+
+func readLayeringEdges(t *testing.T, path string) []seededLayeringEdge {
+	t.Helper()
+	file, err := vfs.Open(path)
+	if err != nil {
+		t.Fatalf("open layering edges: %v", err)
+	}
+	defer func() {
+		if err := file.Close(); err != nil {
+			t.Errorf("close layering edges: %v", err)
+		}
+	}()
+
+	edges, err := parseLayeringEdges(file)
+	if err != nil {
+		t.Fatalf("parse layering edges: %v", err)
+	}
+	return edges
+}
+
+func parseLayeringEdges(r io.Reader) ([]seededLayeringEdge, error) {
+	scanner := bufio.NewScanner(r)
+	var edges []seededLayeringEdge
+	var problems []string
+	for line := 1; scanner.Scan(); line++ {
+		text := strings.TrimRight(scanner.Text(), "\r")
+		if skipLayeringEdgeLine(text) {
+			continue
+		}
+		parts := strings.Split(text, "\t")
+		if len(parts) != 5 {
+			problems = append(problems, malformedLayeringEdge(line))
+			continue
+		}
+		for i := range parts {
+			parts[i] = strings.TrimSpace(parts[i])
+		}
+		addedAt, dateErr := time.Parse(time.DateOnly, parts[4])
+		if hasBlank(parts...) || dateErr != nil {
+			problems = append(problems, malformedLayeringEdge(line))
+			continue
+		}
+		edges = append(edges, seededLayeringEdge{
+			layeringEdge: layeringEdge{
+				From:   parts[0],
+				Denied: parts[1],
+			},
+			Owner:   parts[2],
+			Reason:  parts[3],
+			AddedAt: addedAt,
+			Line:    line,
+		})
+	}
+	if err := scanner.Err(); err != nil {
+		problems = append(problems, "failed to scan layering edges: "+err.Error())
+	}
+	if len(problems) > 0 {
+		return nil, fmt.Errorf("%s", strings.Join(problems, "\n"))
+	}
+	return edges, nil
+}
+
+func skipLayeringEdgeLine(text string) bool {
+	trimmed := strings.TrimSpace(text)
+	return trimmed == "" || strings.HasPrefix(trimmed, "#")
+}
+
+func hasBlank(values ...string) bool {
+	for _, value := range values {
+		if strings.TrimSpace(value) == "" {
+			return true
+		}
+	}
+	return false
+}
+
+func malformedLayeringEdge(line int) string {
+	return fmt.Sprintf(
+		"line %d: layering edge row must have five tab-separated non-empty fields with added_at in YYYY-MM-DD format",
+		line,
+	)
+}
+
+func indexSeededLayeringEdges(t *testing.T, edges []seededLayeringEdge) map[layeringEdge]seededLayeringEdge {
+	t.Helper()
+	indexed := make(map[layeringEdge]seededLayeringEdge, len(edges))
+	for _, edge := range edges {
+		if previous, ok := indexed[edge.layeringEdge]; ok {
+			t.Fatalf(
+				"duplicate layering edge at lines %d and %d: from=%s denied=%s",
+				previous.Line,
+				edge.Line,
+				edge.From,
+				edge.Denied,
+			)
+		}
+		indexed[edge.layeringEdge] = edge
+	}
+	return indexed
+}

From acd50f25fa9a4db67a4f0c81217cba3a4120559f Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Fri, 24 Jul 2026 15:41:51 +0800
Subject: [PATCH 02/50] fix(qualitygate): harden layering ratchet enforcement

---
 .github/workflows/ci.yml                      |  14 +-
 Makefile                                      |   1 +
 .../qualitygate/deptest/layering-edges.txt    |   2 -
 internal/qualitygate/deptest/layering_test.go | 393 +++++++++++++++++-
 scripts/check-layering-ratchet.sh             | 118 ++++++
 scripts/check-layering-ratchet.test.sh        | 220 ++++++++++
 scripts/ci-workflow.test.sh                   |  15 +
 7 files changed, 731 insertions(+), 32 deletions(-)
 create mode 100644 scripts/check-layering-ratchet.sh
 create mode 100644 scripts/check-layering-ratchet.test.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d4c4382109..a9856b4011 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -120,19 +120,7 @@ jobs:
           QUALITY_GATE_CHANGED_FROM: ${{ github.event.pull_request.base.sha || github.event.before || 'origin/main' }}
         run: echo "QUALITY_GATE_CHANGED_FROM=$(bash scripts/resolve-changed-from.sh)" >> "$GITHUB_ENV"
       - name: Enforce layering ratchet
-        run: |
-          ratchet_file=internal/qualitygate/deptest/layering-edges.txt
-          initial_count=39
-          if git cat-file -e "$QUALITY_GATE_CHANGED_FROM:$ratchet_file" 2>/dev/null; then
-            base_count=$(git show "$QUALITY_GATE_CHANGED_FROM:$ratchet_file" | grep -vcE '^\s*(#|$)' || true)
-          else
-            base_count=$initial_count
-          fi
-          current_count=$(grep -vcE '^\s*(#|$)' "$ratchet_file" || true)
-          if [ "$current_count" -gt "$base_count" ]; then
-            echo "::error::Layering ratchet grew from $base_count to $current_count effective rows. Fix the dependency instead of adding a row."
-            exit 1
-          fi
+        run: bash scripts/check-layering-ratchet.sh "$QUALITY_GATE_CHANGED_FROM"
       - name: Run golangci-lint
         run: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6 run --new-from-rev="$QUALITY_GATE_CHANGED_FROM"
       - name: Run source-contract lint guards (lintcheck)
diff --git a/Makefile b/Makefile
index a338519e3f..34888078b2 100644
--- a/Makefile
+++ b/Makefile
@@ -49,6 +49,7 @@ fmt-check:
 
 script-test:
 	bash scripts/resolve-changed-from.test.sh
+	bash scripts/check-layering-ratchet.test.sh
 	bash scripts/ci-workflow.test.sh
 	bash scripts/semantic-review-workflow.test.sh
 	$(NODE) --test scripts/e2e_domains.test.js scripts/fetch_e2e_tat.test.js scripts/install.test.js scripts/release-preflight.test.js scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js
diff --git a/internal/qualitygate/deptest/layering-edges.txt b/internal/qualitygate/deptest/layering-edges.txt
index dae04f1df0..10c8e36508 100644
--- a/internal/qualitygate/deptest/layering-edges.txt
+++ b/internal/qualitygate/deptest/layering-edges.txt
@@ -18,8 +18,6 @@ github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/i
 github.com/larksuite/cli/extension/transport/sidecar	github.com/larksuite/cli/internal/envvars	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
 github.com/larksuite/cli/events/im	github.com/larksuite/cli/shortcuts/im/convert_lib	arch-migration	events->shortcuts inversion via convert_lib	2026-07-24
 github.com/larksuite/cli/events/im	github.com/larksuite/cli/shortcuts/common	arch-migration	events->shortcuts inversion via convert_lib	2026-07-24
-github.com/larksuite/cli/events	github.com/larksuite/cli/shortcuts/common	arch-migration	events register aggregates events/im (transitive)	2026-07-24
-github.com/larksuite/cli/events	github.com/larksuite/cli/shortcuts/im/convert_lib	arch-migration	events register aggregates events/im (transitive)	2026-07-24
 github.com/larksuite/cli/shortcuts/im	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
 github.com/larksuite/cli/shortcuts/mail	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
 github.com/larksuite/cli/shortcuts/minutes	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index d8dd53a714..5052ed3253 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -9,8 +9,10 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"os"
 	"os/exec"
 	"path/filepath"
+	"reflect"
 	"slices"
 	"sort"
 	"strings"
@@ -46,20 +48,20 @@ var rules = []Rule{
 	{
 		Name:       "extension-zero-internal",
 		Mode:       Transitive,
-		FromPrefix: modulePath + "/extension",
+		FromPrefix: modulePath + "/extension/",
 		Denied:     []string{modulePath + "/internal/"},
 		SkipFrom:   []string{"/examples/"},
 	},
 	{
 		Name:       "events-no-shortcuts",
 		Mode:       Transitive,
-		FromPrefix: modulePath + "/events",
+		FromPrefix: modulePath + "/events/",
 		Denied:     []string{modulePath + "/shortcuts/"},
 	},
 	{
 		Name:       "shortcuts-runtime-gate",
 		Mode:       Direct,
-		FromPrefix: modulePath + "/shortcuts",
+		FromPrefix: modulePath + "/shortcuts/",
 		Denied: []string{
 			modulePath + "/internal/auth",
 			modulePath + "/internal/keychain",
@@ -91,7 +93,7 @@ var rules = []Rule{
 	{
 		Name:       "internal-no-upper",
 		Mode:       Direct,
-		FromPrefix: modulePath + "/internal",
+		FromPrefix: modulePath + "/internal/",
 		Denied: []string{
 			modulePath + "/cmd",
 			modulePath + "/shortcuts",
@@ -109,6 +111,17 @@ type listedPackage struct {
 	Deps       []string
 }
 
+type goListTarget struct {
+	GOOS   string
+	GOARCH string
+}
+
+var layeringBuildTargets = []goListTarget{
+	{GOOS: "linux", GOARCH: "amd64"},
+	{GOOS: "darwin", GOARCH: "amd64"},
+	{GOOS: "windows", GOARCH: "amd64"},
+}
+
 type layeringEdge struct {
 	From   string
 	Denied string
@@ -145,10 +158,7 @@ func TestPackageLayering(t *testing.T) {
 
 	for _, rule := range rules {
 		t.Run(rule.Name, func(t *testing.T) {
-			for _, violation := range actualByRule[rule.Name] {
-				if _, ok := seededByEdge[violation.layeringEdge]; ok {
-					continue
-				}
+			for _, violation := range findUnseededLayeringViolations(actualByRule[rule.Name], seededByEdge) {
 				t.Errorf(
 					"new layering violation: from=%s denied=%s rule=%s; use the approved dependency gate or fix the dependency; do not add rows to layering-edges.txt",
 					violation.From,
@@ -160,10 +170,7 @@ func TestPackageLayering(t *testing.T) {
 	}
 
 	t.Run("stale-layering-edges", func(t *testing.T) {
-		for _, edge := range seeded {
-			if _, ok := actualEdges[edge.layeringEdge]; ok {
-				continue
-			}
+		for _, edge := range findStaleLayeringEdges(seeded, actualEdges) {
 			t.Errorf(
 				"stale layering edge: from=%s denied=%s line=%d; this violation has been removed; delete this row from layering-edges.txt",
 				edge.From,
@@ -174,6 +181,37 @@ func TestPackageLayering(t *testing.T) {
 	})
 }
 
+func TestLayeringEdgeClassification(t *testing.T) {
+	known := layeringEdge{From: "example.com/from", Denied: "example.com/denied"}
+	added := layeringEdge{From: "example.com/new", Denied: "example.com/upper"}
+	removed := layeringEdge{From: "example.com/old", Denied: "example.com/legacy"}
+	seeded := []seededLayeringEdge{
+		{layeringEdge: known, Line: 1},
+		{layeringEdge: removed, Line: 2},
+	}
+	seededByEdge := map[layeringEdge]seededLayeringEdge{
+		known:   seeded[0],
+		removed: seeded[1],
+	}
+	actual := []layeringViolation{
+		{layeringEdge: known, Rule: "rule"},
+		{layeringEdge: added, Rule: "rule"},
+	}
+	actualEdges := map[layeringEdge]struct{}{
+		known: {},
+		added: {},
+	}
+
+	unseeded := findUnseededLayeringViolations(actual, seededByEdge)
+	if len(unseeded) != 1 || unseeded[0].layeringEdge != added {
+		t.Fatalf("findUnseededLayeringViolations returned %+v, want only %+v", unseeded, added)
+	}
+	stale := findStaleLayeringEdges(seeded, actualEdges)
+	if len(stale) != 1 || stale[0].layeringEdge != removed {
+		t.Fatalf("findStaleLayeringEdges returned %+v, want only %+v", stale, removed)
+	}
+}
+
 func TestParseLayeringEdges(t *testing.T) {
 	t.Run("valid-rows", func(t *testing.T) {
 		input := strings.NewReader(
@@ -314,30 +352,325 @@ func TestEvaluateLayeringRuleUsesExactExceptions(t *testing.T) {
 	}
 }
 
+func TestLayeringRuleContracts(t *testing.T) {
+	wantRules := []Rule{
+		{
+			Name:       "extension-zero-internal",
+			Mode:       Transitive,
+			FromPrefix: modulePath + "/extension/",
+			Denied:     []string{modulePath + "/internal/"},
+			SkipFrom:   []string{"/examples/"},
+		},
+		{
+			Name:       "events-no-shortcuts",
+			Mode:       Transitive,
+			FromPrefix: modulePath + "/events/",
+			Denied:     []string{modulePath + "/shortcuts/"},
+		},
+		{
+			Name:       "shortcuts-runtime-gate",
+			Mode:       Direct,
+			FromPrefix: modulePath + "/shortcuts/",
+			Denied: []string{
+				modulePath + "/internal/auth",
+				modulePath + "/internal/keychain",
+				modulePath + "/internal/credential",
+				modulePath + "/internal/client",
+				modulePath + "/internal/vfs",
+			},
+			ExceptFrom: []string{
+				modulePath + "/shortcuts/common",
+				modulePath + "/shortcuts/apps/gitcred",
+			},
+		},
+		{
+			Name:       "cmd-assembly-only",
+			Mode:       Direct,
+			FromPrefix: modulePath + "/cmd",
+			Denied:     []string{modulePath + "/shortcuts"},
+			ExceptFrom: []string{
+				modulePath + "/cmd",
+				modulePath + "/cmd/auth",
+			},
+		},
+		{
+			Name:       "errs-leaf",
+			Mode:       Direct,
+			FromPrefix: modulePath + "/errs",
+			Denied:     []string{modulePath + "/"},
+		},
+		{
+			Name:       "internal-no-upper",
+			Mode:       Direct,
+			FromPrefix: modulePath + "/internal/",
+			Denied: []string{
+				modulePath + "/cmd",
+				modulePath + "/shortcuts",
+				modulePath + "/events",
+			},
+			ExceptFrom: []string{
+				modulePath + "/internal/qualitygate/cmd/manifest-export",
+			},
+		},
+	}
+	if !reflect.DeepEqual(rules, wantRules) {
+		t.Fatalf("layering rules differ from the enforced contract:\ngot:  %#v\nwant: %#v", rules, wantRules)
+	}
+
+	tests := []struct {
+		name       string
+		ruleName   string
+		packages   []listedPackage
+		wantFrom   string
+		wantDenied string
+	}{
+		{
+			name:     "extension-transitive-denial-and-example-scope-out",
+			ruleName: "extension-zero-internal",
+			packages: []listedPackage{
+				{
+					ImportPath: modulePath + "/extension/sdk",
+					Deps:       []string{modulePath + "/internal/core"},
+				},
+				{
+					ImportPath: modulePath + "/extension/platform/examples/demo",
+					Deps:       []string{modulePath + "/internal/core"},
+				},
+			},
+			wantFrom:   modulePath + "/extension/sdk",
+			wantDenied: modulePath + "/internal/core",
+		},
+		{
+			name:     "events-transitive-denial",
+			ruleName: "events-no-shortcuts",
+			packages: []listedPackage{
+				{
+					ImportPath: modulePath + "/events/im",
+					Deps:       []string{modulePath + "/shortcuts/common"},
+				},
+				{
+					ImportPath: modulePath + "/events/calendar",
+					Deps:       []string{modulePath + "/internal/core"},
+				},
+			},
+			wantFrom:   modulePath + "/events/im",
+			wantDenied: modulePath + "/shortcuts/common",
+		},
+		{
+			name:     "shortcuts-direct-denial-and-exceptions",
+			ruleName: "shortcuts-runtime-gate",
+			packages: []listedPackage{
+				{
+					ImportPath: modulePath + "/shortcuts/im",
+					Imports:    []string{modulePath + "/internal/auth"},
+				},
+				{
+					ImportPath: modulePath + "/shortcuts/common",
+					Imports:    []string{modulePath + "/internal/auth"},
+				},
+				{
+					ImportPath: modulePath + "/shortcuts/apps/gitcred",
+					Imports:    []string{modulePath + "/internal/keychain"},
+				},
+			},
+			wantFrom:   modulePath + "/shortcuts/im",
+			wantDenied: modulePath + "/internal/auth",
+		},
+		{
+			name:     "cmd-direct-denial-and-assembly-exceptions",
+			ruleName: "cmd-assembly-only",
+			packages: []listedPackage{
+				{
+					ImportPath: modulePath + "/cmd/service",
+					Imports:    []string{modulePath + "/shortcuts/im"},
+				},
+				{
+					ImportPath: modulePath + "/cmd",
+					Imports:    []string{modulePath + "/shortcuts"},
+				},
+				{
+					ImportPath: modulePath + "/cmd/auth",
+					Imports:    []string{modulePath + "/shortcuts/auth"},
+				},
+			},
+			wantFrom:   modulePath + "/cmd/service",
+			wantDenied: modulePath + "/shortcuts/im",
+		},
+		{
+			name:     "errs-direct-denial",
+			ruleName: "errs-leaf",
+			packages: []listedPackage{
+				{
+					ImportPath: modulePath + "/errs",
+					Imports:    []string{modulePath + "/internal/core"},
+				},
+				{
+					ImportPath: modulePath + "/errclass",
+					Imports:    []string{modulePath + "/internal/core"},
+				},
+			},
+			wantFrom:   modulePath + "/errs",
+			wantDenied: modulePath + "/internal/core",
+		},
+		{
+			name:     "internal-direct-denial-and-collector-exception",
+			ruleName: "internal-no-upper",
+			packages: []listedPackage{
+				{
+					ImportPath: modulePath + "/internal/core",
+					Imports:    []string{modulePath + "/events/im"},
+				},
+				{
+					ImportPath: modulePath + "/internal/qualitygate/cmd/manifest-export",
+					Imports:    []string{modulePath + "/cmd"},
+				},
+			},
+			wantFrom:   modulePath + "/internal/core",
+			wantDenied: modulePath + "/events/im",
+		},
+	}
+
+	rulesByName := make(map[string]Rule, len(rules))
+	for _, rule := range rules {
+		rulesByName[rule.Name] = rule
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rule, ok := rulesByName[tt.ruleName]
+			if !ok {
+				t.Fatalf("missing rule %q", tt.ruleName)
+			}
+			violations := evaluateLayeringRule(tt.packages, rule)
+			if len(violations) != 1 {
+				t.Fatalf("evaluateLayeringRule returned %d violations, want 1: %+v", len(violations), violations)
+			}
+			if violations[0].From != tt.wantFrom || violations[0].Denied != tt.wantDenied {
+				t.Fatalf(
+					"evaluateLayeringRule returned edge (%q, %q), want (%q, %q)",
+					violations[0].From,
+					violations[0].Denied,
+					tt.wantFrom,
+					tt.wantDenied,
+				)
+			}
+		})
+	}
+}
+
+func TestLayeringBuildTargets(t *testing.T) {
+	want := []goListTarget{
+		{GOOS: "linux", GOARCH: "amd64"},
+		{GOOS: "darwin", GOARCH: "amd64"},
+		{GOOS: "windows", GOARCH: "amd64"},
+	}
+	if !reflect.DeepEqual(layeringBuildTargets, want) {
+		t.Fatalf("layering build targets = %#v, want %#v", layeringBuildTargets, want)
+	}
+}
+
+func TestDecodeAndMergeListedPackages(t *testing.T) {
+	input := strings.NewReader(
+		`{"ImportPath":"example.com/a","Imports":["example.com/b"],"Deps":["example.com/c"]}` + "\n" +
+			`{"ImportPath":"example.com/d","Imports":[],"Deps":[]}` + "\n",
+	)
+	packages, err := decodeListedPackages(input)
+	if err != nil {
+		t.Fatalf("decodeListedPackages returned an error: %v", err)
+	}
+	if len(packages) != 2 || packages[0].ImportPath != "example.com/a" || packages[1].ImportPath != "example.com/d" {
+		t.Fatalf("decodeListedPackages returned unexpected packages: %+v", packages)
+	}
+
+	got := mergeStrings([]string{"example.com/b", "example.com/c"}, []string{"example.com/a", "example.com/b"})
+	want := []string{"example.com/a", "example.com/b", "example.com/c"}
+	if !slices.Equal(got, want) {
+		t.Fatalf("mergeStrings returned %q, want %q", got, want)
+	}
+}
+
 func goListPackageGraph(t *testing.T, root string) []listedPackage {
+	t.Helper()
+	packagesByPath := make(map[string]listedPackage)
+	for _, target := range layeringBuildTargets {
+		for _, pkg := range goListPackages(t, root, target) {
+			merged := packagesByPath[pkg.ImportPath]
+			merged.ImportPath = pkg.ImportPath
+			merged.Imports = mergeStrings(merged.Imports, pkg.Imports)
+			merged.Deps = mergeStrings(merged.Deps, pkg.Deps)
+			packagesByPath[pkg.ImportPath] = merged
+		}
+	}
+
+	packages := make([]listedPackage, 0, len(packagesByPath))
+	for _, pkg := range packagesByPath {
+		packages = append(packages, pkg)
+	}
+	sort.Slice(packages, func(i, j int) bool {
+		return packages[i].ImportPath < packages[j].ImportPath
+	})
+	return packages
+}
+
+func goListPackages(t *testing.T, root string, target goListTarget) []listedPackage {
 	t.Helper()
 	args := []string{"list", "-json", "-tags", "authsidecar", "./..."}
 	cmd := exec.Command("go", args...)
 	cmd.Dir = root
+	cmd.Env = append(
+		os.Environ(),
+		"GOOS="+target.GOOS,
+		"GOARCH="+target.GOARCH,
+		"CGO_ENABLED=0",
+	)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
-		t.Fatalf("go %s failed: %v\n%s", strings.Join(args, " "), err, out)
+		t.Fatalf(
+			"GOOS=%s GOARCH=%s go %s failed: %v\n%s",
+			target.GOOS,
+			target.GOARCH,
+			strings.Join(args, " "),
+			err,
+			out,
+		)
+	}
+
+	packages, err := decodeListedPackages(bytes.NewReader(out))
+	if err != nil {
+		t.Fatalf("decode GOOS=%s GOARCH=%s go list output: %v", target.GOOS, target.GOARCH, err)
 	}
+	return packages
+}
 
-	decoder := json.NewDecoder(bytes.NewReader(out))
+func decodeListedPackages(r io.Reader) ([]listedPackage, error) {
+	decoder := json.NewDecoder(r)
 	var packages []listedPackage
 	for {
 		var pkg listedPackage
 		err := decoder.Decode(&pkg)
 		if err == io.EOF {
-			break
+			return packages, nil
 		}
 		if err != nil {
-			t.Fatalf("decode go list output: %v", err)
+			return nil, err
 		}
 		packages = append(packages, pkg)
 	}
-	return packages
+}
+
+func mergeStrings(left, right []string) []string {
+	values := make(map[string]struct{}, len(left)+len(right))
+	for _, value := range left {
+		values[value] = struct{}{}
+	}
+	for _, value := range right {
+		values[value] = struct{}{}
+	}
+	merged := make([]string, 0, len(values))
+	for value := range values {
+		merged = append(merged, value)
+	}
+	sort.Strings(merged)
+	return merged
 }
 
 func evaluateLayeringRule(packages []listedPackage, rule Rule) []layeringViolation {
@@ -407,6 +740,32 @@ func containsAny(value string, substrings []string) bool {
 	return false
 }
 
+func findUnseededLayeringViolations(
+	actual []layeringViolation,
+	seeded map[layeringEdge]seededLayeringEdge,
+) []layeringViolation {
+	var unseeded []layeringViolation
+	for _, violation := range actual {
+		if _, ok := seeded[violation.layeringEdge]; !ok {
+			unseeded = append(unseeded, violation)
+		}
+	}
+	return unseeded
+}
+
+func findStaleLayeringEdges(
+	seeded []seededLayeringEdge,
+	actual map[layeringEdge]struct{},
+) []seededLayeringEdge {
+	var stale []seededLayeringEdge
+	for _, edge := range seeded {
+		if _, ok := actual[edge.layeringEdge]; !ok {
+			stale = append(stale, edge)
+		}
+	}
+	return stale
+}
+
 func readLayeringEdges(t *testing.T, path string) []seededLayeringEdge {
 	t.Helper()
 	file, err := vfs.Open(path)
diff --git a/scripts/check-layering-ratchet.sh b/scripts/check-layering-ratchet.sh
new file mode 100644
index 0000000000..c8c28c5257
--- /dev/null
+++ b/scripts/check-layering-ratchet.sh
@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 Lark Technologies Pte. Ltd.
+# SPDX-License-Identifier: MIT
+
+set -euo pipefail
+
+if root="$(git rev-parse --show-toplevel 2>/dev/null)"; then
+  cd "$root"
+else
+  echo "Layering ratchet must run inside a Git worktree." >&2
+  exit 1
+fi
+
+base_revision="${1:-${QUALITY_GATE_CHANGED_FROM:-}}"
+ratchet_file="internal/qualitygate/deptest/layering-edges.txt"
+initial_count="${LAYERING_RATCHET_INITIAL_COUNT:-37}"
+initial_hash="${LAYERING_RATCHET_INITIAL_HASH:-cf61e4149cb4d539a1430f4a4266b91f972c253cedd300830c94e35dda1f0265}"
+
+if [[ -z "$base_revision" ]]; then
+  echo "Layering ratchet requires a base revision." >&2
+  exit 1
+fi
+if ! git cat-file -e "$base_revision^{commit}" 2>/dev/null; then
+  echo "Layering ratchet base revision does not exist: $base_revision" >&2
+  exit 1
+fi
+if [[ ! -f "$ratchet_file" ]]; then
+  echo "Layering ratchet file is missing: $ratchet_file" >&2
+  exit 1
+fi
+
+tmp_dir="$(mktemp -d "${TMPDIR:-/tmp}/layering-ratchet.XXXXXX")"
+base_file="$tmp_dir/base.txt"
+base_keys="$tmp_dir/base.keys"
+current_keys="$tmp_dir/current.keys"
+additions="$tmp_dir/additions.keys"
+
+cleanup_tmp() {
+  rm -f "$base_file" "$base_keys" "$current_keys" "$additions"
+  rmdir "$tmp_dir"
+}
+trap cleanup_tmp EXIT
+
+extract_keys() {
+  local source_file="$1"
+  local output_file="$2"
+  awk -F '\t' '
+    function trim(value) {
+      sub(/^[[:space:]]+/, "", value)
+      sub(/[[:space:]]+$/, "", value)
+      return value
+    }
+    {
+      content = trim($0)
+      if (content == "" || substr(content, 1, 1) == "#") {
+        next
+      }
+      if (NF != 5) {
+        printf "Malformed layering ratchet row at %s:%d: expected five tab-separated fields.\n", FILENAME, FNR > "/dev/stderr"
+        exit 2
+      }
+      from = trim($1)
+      denied = trim($2)
+      owner = trim($3)
+      reason = trim($4)
+      added_at = trim($5)
+      if (from == "" || denied == "" || owner == "" || reason == "" || added_at !~ /^[0-9]{4}-[0-9]{2}-[0-9]{2}$/) {
+        printf "Malformed layering ratchet row at %s:%d: fields must be non-empty and added_at must use YYYY-MM-DD.\n", FILENAME, FNR > "/dev/stderr"
+        exit 2
+      }
+      print from "\t" denied
+    }
+  ' "$source_file" | LC_ALL=C sort >"$output_file"
+
+  if [[ -n "$(uniq -d "$output_file")" ]]; then
+    echo "Layering ratchet contains duplicate (from, denied) keys: $source_file" >&2
+    uniq -d "$output_file" >&2
+    return 1
+  fi
+}
+
+hash_keys() {
+  local source_file="$1"
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$source_file" | awk '{ print $1 }'
+    return
+  fi
+  if command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "$source_file" | awk '{ print $1 }'
+    return
+  fi
+  echo "Layering ratchet requires sha256sum or shasum." >&2
+  return 1
+}
+
+extract_keys "$ratchet_file" "$current_keys"
+
+if ! git cat-file -e "$base_revision:$ratchet_file" 2>/dev/null; then
+  current_count="$(wc -l <"$current_keys" | tr -d '[:space:]')"
+  current_hash="$(hash_keys "$current_keys")"
+  if [[ "$current_count" != "$initial_count" || "$current_hash" != "$initial_hash" ]]; then
+    echo "::error::Layering ratchet bootstrap differs from the approved $initial_count-edge snapshot." >&2
+    exit 1
+  fi
+  exit 0
+fi
+
+git show "$base_revision:$ratchet_file" >"$base_file"
+extract_keys "$base_file" "$base_keys"
+LC_ALL=C comm -13 "$base_keys" "$current_keys" >"$additions"
+
+if [[ -s "$additions" ]]; then
+  echo "::error::Layering ratchet contains new (from, denied) keys. Fix the dependency instead of adding rows." >&2
+  while IFS=$'\t' read -r from denied; do
+    printf 'from=%s denied=%s\n' "$from" "$denied" >&2
+  done <"$additions"
+  exit 1
+fi
diff --git a/scripts/check-layering-ratchet.test.sh b/scripts/check-layering-ratchet.test.sh
new file mode 100644
index 0000000000..eae54fb11c
--- /dev/null
+++ b/scripts/check-layering-ratchet.test.sh
@@ -0,0 +1,220 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 Lark Technologies Pte. Ltd.
+# SPDX-License-Identifier: MIT
+
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+script="$repo_root/scripts/check-layering-ratchet.sh"
+ratchet_file="internal/qualitygate/deptest/layering-edges.txt"
+tmp="$(mktemp -d "${TMPDIR:-/tmp}/check-layering-ratchet-test.XXXXXX")"
+
+cleanup_tmp() {
+  rm -rf "$tmp"
+}
+trap cleanup_tmp EXIT
+
+row() {
+  printf '%s\t%s\towner\treason\t2026-07-24\n' "$1" "$2"
+}
+
+git_init() {
+  local dir="$1"
+  git init -q -b main "$dir"
+  git -C "$dir" config user.name test
+  git -C "$dir" config user.email test@example.com
+  mkdir -p "$dir/$(dirname "$ratchet_file")"
+}
+
+write_rows() {
+  local dir="$1"
+  shift
+  {
+    printf '# from\tdenied\towner\treason\tadded_at\n'
+    while (( $# > 0 )); do
+      row "$1" "$2"
+      shift 2
+    done
+  } >"$dir/$ratchet_file"
+}
+
+commit_ratchet() {
+  local dir="$1"
+  git -C "$dir" add "$ratchet_file"
+  git -C "$dir" commit -q -m "ratchet"
+}
+
+expect_pass() {
+  local dir="$1"
+  local base="$2"
+  if ! (cd "$dir" && bash "$script" "$base"); then
+    echo "Expected layering ratchet check to pass in $dir." >&2
+    return 1
+  fi
+}
+
+expect_fail() {
+  local dir="$1"
+  local base="$2"
+  if (cd "$dir" && bash "$script" "$base" >/dev/null 2>&1); then
+    echo "Expected layering ratchet check to fail in $dir." >&2
+    return 1
+  fi
+}
+
+hash_file() {
+  local source_file="$1"
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$source_file" | awk '{ print $1 }'
+  else
+    shasum -a 256 "$source_file" | awk '{ print $1 }'
+  fi
+}
+
+bootstrap_keys() {
+  local source_file="$1"
+  awk -F '\t' 'NF == 5 && $1 !~ /^[[:space:]]*#/ { print $1 "\t" $2 }' "$source_file" | LC_ALL=C sort
+}
+
+expect_bootstrap_pass() {
+  local dir="$1"
+  local base="$2"
+  local count="$3"
+  local hash="$4"
+  if ! (
+    cd "$dir"
+    LAYERING_RATCHET_INITIAL_COUNT="$count" \
+      LAYERING_RATCHET_INITIAL_HASH="$hash" \
+      bash "$script" "$base"
+  ); then
+    echo "Expected layering ratchet bootstrap check to pass in $dir." >&2
+    return 1
+  fi
+}
+
+expect_bootstrap_fail() {
+  local dir="$1"
+  local base="$2"
+  local count="$3"
+  local hash="$4"
+  if (
+    cd "$dir"
+    LAYERING_RATCHET_INITIAL_COUNT="$count" \
+      LAYERING_RATCHET_INITIAL_HASH="$hash" \
+      bash "$script" "$base" >/dev/null 2>&1
+  ); then
+    echo "Expected layering ratchet bootstrap check to fail in $dir." >&2
+    return 1
+  fi
+}
+
+test_unchanged_and_metadata_changes_pass() {
+  local dir="$tmp/unchanged"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a from/b denied/b
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  expect_pass "$dir" "$base"
+  sed -i.bak 's/\towner\treason\t/\tnew-owner\tnew-reason\t/' "$dir/$ratchet_file"
+  rm -f "$dir/$ratchet_file.bak"
+  expect_pass "$dir" "$base"
+}
+
+test_deletion_passes() {
+  local dir="$tmp/deletion"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a from/b denied/b
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  write_rows "$dir" from/a denied/a
+  expect_pass "$dir" "$base"
+}
+
+test_addition_fails() {
+  local dir="$tmp/addition"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  write_rows "$dir" from/a denied/a from/b denied/b
+  expect_fail "$dir" "$base"
+}
+
+test_equal_count_replacement_fails() {
+  local dir="$tmp/replacement"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a from/b denied/b
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  write_rows "$dir" from/a denied/a from/c denied/c
+  expect_fail "$dir" "$base"
+}
+
+test_malformed_and_missing_current_file_fail() {
+  local dir="$tmp/malformed"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  printf 'from/a\tdenied/a\towner\treason\n' >"$dir/$ratchet_file"
+  expect_fail "$dir" "$base"
+  rm -f "$dir/$ratchet_file"
+  expect_fail "$dir" "$base"
+}
+
+test_bootstrap_requires_the_approved_snapshot() {
+  local dir="$tmp/bootstrap"
+  git_init "$dir"
+  printf 'base\n' >"$dir/base.txt"
+  git -C "$dir" add base.txt
+  git -C "$dir" commit -q -m "base"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  local args=()
+  local index
+  for index in $(seq 1 37); do
+    args+=("from/$index" "denied/$index")
+  done
+  write_rows "$dir" "${args[@]}"
+  local keys_file="$dir/initial.keys"
+  bootstrap_keys "$dir/$ratchet_file" >"$keys_file"
+  local initial_hash
+  initial_hash="$(hash_file "$keys_file")"
+  expect_bootstrap_pass "$dir" "$base" 37 "$initial_hash"
+
+  args[72]="from/replacement"
+  write_rows "$dir" "${args[@]}"
+  expect_bootstrap_fail "$dir" "$base" 37 "$initial_hash"
+
+  args[72]="from/37"
+  args+=("from/38" "denied/38")
+  write_rows "$dir" "${args[@]}"
+  expect_bootstrap_fail "$dir" "$base" 37 "$initial_hash"
+}
+
+test_invalid_base_fails() {
+  local dir="$tmp/invalid-base"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a
+  commit_ratchet "$dir"
+  expect_fail "$dir" missing-revision
+}
+
+test_unchanged_and_metadata_changes_pass
+test_deletion_passes
+test_addition_fails
+test_equal_count_replacement_fails
+test_malformed_and_missing_current_file_fail
+test_bootstrap_requires_the_approved_snapshot
+test_invalid_base_fails
diff --git a/scripts/ci-workflow.test.sh b/scripts/ci-workflow.test.sh
index 6acdb0adc1..080376c0e2 100644
--- a/scripts/ci-workflow.test.sh
+++ b/scripts/ci-workflow.test.sh
@@ -170,6 +170,21 @@ if grep -Fq '${{ secrets.' <<<"$script_test_section"; then
   exit 1
 fi
 
+if ! grep -Fq 'bash scripts/check-layering-ratchet.sh "$QUALITY_GATE_CHANGED_FROM"' <<<"$lint_section"; then
+  echo "lint should enforce the layering ratchet with the tested key-set checker"
+  exit 1
+fi
+
+if grep -Fq "grep -vcE" <<<"$lint_section"; then
+  echo "lint should not enforce the layering ratchet by row count alone"
+  exit 1
+fi
+
+if grep -Fq "LAYERING_RATCHET_INITIAL_" <<<"$lint_section"; then
+  echo "lint must use the checked-in layering bootstrap snapshot"
+  exit 1
+fi
+
 if grep -Fq "metadata-gate:" "$workflow"; then
   echo "metadata-gate should not run alongside deterministic-gate because both would upload the same facts artifact"
   exit 1

From 1772afe22de7666c859ec6dfae881f3a81f672d8 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Fri, 24 Jul 2026 16:01:45 +0800
Subject: [PATCH 03/50] fix(qualitygate): cover release build graphs

Check all seven published GOOS and GOARCH combinations, and keep go list diagnostics separate from its JSON output for cold caches.\n\nMake the bootstrap snapshot immutable in CI, propagate shell failures explicitly, isolate sourced execution, and add deterministic regression tests for each contract.
---
 internal/qualitygate/deptest/layering_test.go |  84 ++++++++--
 scripts/check-layering-ratchet.sh             | 145 ++++++++++--------
 scripts/check-layering-ratchet.test.sh        |  77 +++++++---
 scripts/ci-workflow.test.sh                   |   4 +-
 4 files changed, 207 insertions(+), 103 deletions(-)

diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index 5052ed3253..d2889b94ad 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -116,10 +116,16 @@ type goListTarget struct {
 	GOARCH string
 }
 
+type commandFactory func(name string, args ...string) *exec.Cmd
+
 var layeringBuildTargets = []goListTarget{
 	{GOOS: "linux", GOARCH: "amd64"},
+	{GOOS: "linux", GOARCH: "arm64"},
+	{GOOS: "linux", GOARCH: "riscv64"},
 	{GOOS: "darwin", GOARCH: "amd64"},
+	{GOOS: "darwin", GOARCH: "arm64"},
 	{GOOS: "windows", GOARCH: "amd64"},
+	{GOOS: "windows", GOARCH: "arm64"},
 }
 
 type layeringEdge struct {
@@ -560,8 +566,12 @@ func TestLayeringRuleContracts(t *testing.T) {
 func TestLayeringBuildTargets(t *testing.T) {
 	want := []goListTarget{
 		{GOOS: "linux", GOARCH: "amd64"},
+		{GOOS: "linux", GOARCH: "arm64"},
+		{GOOS: "linux", GOARCH: "riscv64"},
 		{GOOS: "darwin", GOARCH: "amd64"},
+		{GOOS: "darwin", GOARCH: "arm64"},
 		{GOOS: "windows", GOARCH: "amd64"},
+		{GOOS: "windows", GOARCH: "arm64"},
 	}
 	if !reflect.DeepEqual(layeringBuildTargets, want) {
 		t.Fatalf("layering build targets = %#v, want %#v", layeringBuildTargets, want)
@@ -588,6 +598,33 @@ func TestDecodeAndMergeListedPackages(t *testing.T) {
 	}
 }
 
+func TestGoListPackagesSeparatesStderr(t *testing.T) {
+	target := goListTarget{GOOS: "linux", GOARCH: "amd64"}
+	packages, stderr, err := loadPackagesForTarget("", target, func(_ string, _ ...string) *exec.Cmd {
+		cmd := exec.Command(os.Args[0], "-test.run=^TestGoListCommandHelperProcess$")
+		cmd.Env = append(os.Environ(), "GO_LIST_COMMAND_HELPER=1")
+		return cmd
+	})
+	if err != nil {
+		t.Fatalf("loadPackagesForTarget returned an error: %v", err)
+	}
+	if stderr != "go: downloading example.com/module\n" {
+		t.Fatalf("loadPackagesForTarget stderr = %q, want module download diagnostic", stderr)
+	}
+	if len(packages) != 1 || packages[0].ImportPath != "example.com/package" {
+		t.Fatalf("loadPackagesForTarget returned unexpected packages: %+v", packages)
+	}
+}
+
+func TestGoListCommandHelperProcess(t *testing.T) {
+	if os.Getenv("GO_LIST_COMMAND_HELPER") != "1" {
+		return
+	}
+	fmt.Fprintln(os.Stdout, `{"ImportPath":"example.com/package","Imports":[],"Deps":[]}`)
+	fmt.Fprintln(os.Stderr, "go: downloading example.com/module")
+	os.Exit(0)
+}
+
 func goListPackageGraph(t *testing.T, root string) []listedPackage {
 	t.Helper()
 	packagesByPath := make(map[string]listedPackage)
@@ -613,32 +650,51 @@ func goListPackageGraph(t *testing.T, root string) []listedPackage {
 
 func goListPackages(t *testing.T, root string, target goListTarget) []listedPackage {
 	t.Helper()
+	packages, stderr, err := loadPackagesForTarget(root, target, exec.Command)
+	if err != nil {
+		t.Fatalf(
+			"GOOS=%s GOARCH=%s go list -json -tags authsidecar ./... failed: %v\n%s",
+			target.GOOS,
+			target.GOARCH,
+			err,
+			stderr,
+		)
+	}
+	return packages
+}
+
+func loadPackagesForTarget(
+	root string,
+	target goListTarget,
+	newCommand commandFactory,
+) ([]listedPackage, string, error) {
 	args := []string{"list", "-json", "-tags", "authsidecar", "./..."}
-	cmd := exec.Command("go", args...)
+	cmd := newCommand("go", args...)
 	cmd.Dir = root
+	env := cmd.Env
+	if env == nil {
+		env = os.Environ()
+	}
 	cmd.Env = append(
-		os.Environ(),
+		env,
 		"GOOS="+target.GOOS,
 		"GOARCH="+target.GOARCH,
 		"CGO_ENABLED=0",
 	)
-	out, err := cmd.CombinedOutput()
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+	err := cmd.Run()
 	if err != nil {
-		t.Fatalf(
-			"GOOS=%s GOARCH=%s go %s failed: %v\n%s",
-			target.GOOS,
-			target.GOARCH,
-			strings.Join(args, " "),
-			err,
-			out,
-		)
+		return nil, stderr.String(), err
 	}
 
-	packages, err := decodeListedPackages(bytes.NewReader(out))
+	packages, err := decodeListedPackages(&stdout)
 	if err != nil {
-		t.Fatalf("decode GOOS=%s GOARCH=%s go list output: %v", target.GOOS, target.GOARCH, err)
+		return nil, stderr.String(), fmt.Errorf("decode go list output: %w", err)
 	}
-	return packages
+	return packages, stderr.String(), nil
 }
 
 func decodeListedPackages(r io.Reader) ([]listedPackage, error) {
diff --git a/scripts/check-layering-ratchet.sh b/scripts/check-layering-ratchet.sh
index c8c28c5257..9cbc82a0f7 100644
--- a/scripts/check-layering-ratchet.sh
+++ b/scripts/check-layering-ratchet.sh
@@ -2,46 +2,7 @@
 # Copyright (c) 2026 Lark Technologies Pte. Ltd.
 # SPDX-License-Identifier: MIT
 
-set -euo pipefail
-
-if root="$(git rev-parse --show-toplevel 2>/dev/null)"; then
-  cd "$root"
-else
-  echo "Layering ratchet must run inside a Git worktree." >&2
-  exit 1
-fi
-
-base_revision="${1:-${QUALITY_GATE_CHANGED_FROM:-}}"
-ratchet_file="internal/qualitygate/deptest/layering-edges.txt"
-initial_count="${LAYERING_RATCHET_INITIAL_COUNT:-37}"
-initial_hash="${LAYERING_RATCHET_INITIAL_HASH:-cf61e4149cb4d539a1430f4a4266b91f972c253cedd300830c94e35dda1f0265}"
-
-if [[ -z "$base_revision" ]]; then
-  echo "Layering ratchet requires a base revision." >&2
-  exit 1
-fi
-if ! git cat-file -e "$base_revision^{commit}" 2>/dev/null; then
-  echo "Layering ratchet base revision does not exist: $base_revision" >&2
-  exit 1
-fi
-if [[ ! -f "$ratchet_file" ]]; then
-  echo "Layering ratchet file is missing: $ratchet_file" >&2
-  exit 1
-fi
-
-tmp_dir="$(mktemp -d "${TMPDIR:-/tmp}/layering-ratchet.XXXXXX")"
-base_file="$tmp_dir/base.txt"
-base_keys="$tmp_dir/base.keys"
-current_keys="$tmp_dir/current.keys"
-additions="$tmp_dir/additions.keys"
-
-cleanup_tmp() {
-  rm -f "$base_file" "$base_keys" "$current_keys" "$additions"
-  rmdir "$tmp_dir"
-}
-trap cleanup_tmp EXIT
-
-extract_keys() {
+layering_ratchet_extract_keys() {
   local source_file="$1"
   local output_file="$2"
   awk -F '\t' '
@@ -70,49 +31,105 @@ extract_keys() {
       }
       print from "\t" denied
     }
-  ' "$source_file" | LC_ALL=C sort >"$output_file"
+  ' "$source_file" | LC_ALL=C sort >"$output_file" || return
 
-  if [[ -n "$(uniq -d "$output_file")" ]]; then
+  local duplicates
+  duplicates="$(uniq -d "$output_file")" || return
+  if [[ -n "$duplicates" ]]; then
     echo "Layering ratchet contains duplicate (from, denied) keys: $source_file" >&2
-    uniq -d "$output_file" >&2
+    printf '%s\n' "$duplicates" >&2
     return 1
   fi
 }
 
-hash_keys() {
+layering_ratchet_hash_keys() {
   local source_file="$1"
   if command -v sha256sum >/dev/null 2>&1; then
-    sha256sum "$source_file" | awk '{ print $1 }'
+    sha256sum "$source_file" | awk '{ print $1 }' || return
     return
   fi
   if command -v shasum >/dev/null 2>&1; then
-    shasum -a 256 "$source_file" | awk '{ print $1 }'
+    shasum -a 256 "$source_file" | awk '{ print $1 }' || return
     return
   fi
   echo "Layering ratchet requires sha256sum or shasum." >&2
   return 1
 }
 
-extract_keys "$ratchet_file" "$current_keys"
+layering_ratchet_validate_bootstrap_snapshot() {
+  local current_keys="$1"
+  local expected_count="$2"
+  local expected_hash="$3"
+  local current_count
+  local current_hash
+  current_count="$(wc -l <"$current_keys" | tr -d '[:space:]')" || return
+  current_hash="$(layering_ratchet_hash_keys "$current_keys")" || return
+  if [[ "$current_count" != "$expected_count" || "$current_hash" != "$expected_hash" ]]; then
+    echo "::error::Layering ratchet bootstrap differs from the approved $expected_count-edge snapshot." >&2
+    return 1
+  fi
+}
+
+layering_ratchet_main() (
+  set -euo pipefail
 
-if ! git cat-file -e "$base_revision:$ratchet_file" 2>/dev/null; then
-  current_count="$(wc -l <"$current_keys" | tr -d '[:space:]')"
-  current_hash="$(hash_keys "$current_keys")"
-  if [[ "$current_count" != "$initial_count" || "$current_hash" != "$initial_hash" ]]; then
-    echo "::error::Layering ratchet bootstrap differs from the approved $initial_count-edge snapshot." >&2
-    exit 1
+  local ratchet_file="internal/qualitygate/deptest/layering-edges.txt"
+  if root="$(git rev-parse --show-toplevel 2>/dev/null)"; then
+    cd "$root" || return
+  else
+    echo "Layering ratchet must run inside a Git worktree." >&2
+    return 1
   fi
-  exit 0
-fi
 
-git show "$base_revision:$ratchet_file" >"$base_file"
-extract_keys "$base_file" "$base_keys"
-LC_ALL=C comm -13 "$base_keys" "$current_keys" >"$additions"
+  local base_revision="${1:-${QUALITY_GATE_CHANGED_FROM:-}}"
+  local approved_initial_count="${2:-37}"
+  local approved_initial_hash="${3:-cf61e4149cb4d539a1430f4a4266b91f972c253cedd300830c94e35dda1f0265}"
+  if [[ -z "$base_revision" ]]; then
+    echo "Layering ratchet requires a base revision." >&2
+    return 1
+  fi
+  if ! git cat-file -e "$base_revision^{commit}" 2>/dev/null; then
+    echo "Layering ratchet base revision does not exist: $base_revision" >&2
+    return 1
+  fi
+  if [[ ! -f "$ratchet_file" ]]; then
+    echo "Layering ratchet file is missing: $ratchet_file" >&2
+    return 1
+  fi
+
+  local tmp_dir
+  tmp_dir="$(mktemp -d "${TMPDIR:-/tmp}/layering-ratchet.XXXXXX")" || return
+  local base_file="$tmp_dir/base.txt"
+  local base_keys="$tmp_dir/base.keys"
+  local current_keys="$tmp_dir/current.keys"
+  local additions="$tmp_dir/additions.keys"
+
+  layering_ratchet_cleanup_current_run() {
+    rm -f "$base_file" "$base_keys" "$current_keys" "$additions"
+    rmdir "$tmp_dir"
+  }
+  trap layering_ratchet_cleanup_current_run EXIT
+
+  layering_ratchet_extract_keys "$ratchet_file" "$current_keys" || return
+
+  if ! git cat-file -e "$base_revision:$ratchet_file" 2>/dev/null; then
+    layering_ratchet_validate_bootstrap_snapshot "$current_keys" "$approved_initial_count" "$approved_initial_hash" || return
+    return
+  fi
+
+  git show "$base_revision:$ratchet_file" >"$base_file" || return
+  layering_ratchet_extract_keys "$base_file" "$base_keys" || return
+  LC_ALL=C comm -13 "$base_keys" "$current_keys" >"$additions" || return
+
+  if [[ -s "$additions" ]]; then
+    echo "::error::Layering ratchet contains new (from, denied) keys. Fix the dependency instead of adding rows." >&2
+    while IFS=$'\t' read -r from denied; do
+      printf 'from=%s denied=%s\n' "$from" "$denied" >&2
+    done <"$additions"
+    return 1
+  fi
+)
 
-if [[ -s "$additions" ]]; then
-  echo "::error::Layering ratchet contains new (from, denied) keys. Fix the dependency instead of adding rows." >&2
-  while IFS=$'\t' read -r from denied; do
-    printf 'from=%s denied=%s\n' "$from" "$denied" >&2
-  done <"$additions"
-  exit 1
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  layering_ratchet_main "${1:-${QUALITY_GATE_CHANGED_FROM:-}}"
 fi
diff --git a/scripts/check-layering-ratchet.test.sh b/scripts/check-layering-ratchet.test.sh
index eae54fb11c..39744b96b3 100644
--- a/scripts/check-layering-ratchet.test.sh
+++ b/scripts/check-layering-ratchet.test.sh
@@ -8,6 +8,7 @@ repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 script="$repo_root/scripts/check-layering-ratchet.sh"
 ratchet_file="internal/qualitygate/deptest/layering-edges.txt"
 tmp="$(mktemp -d "${TMPDIR:-/tmp}/check-layering-ratchet-test.XXXXXX")"
+source "$script"
 
 cleanup_tmp() {
   rm -rf "$tmp"
@@ -56,10 +57,16 @@ expect_pass() {
 expect_fail() {
   local dir="$1"
   local base="$2"
-  if (cd "$dir" && bash "$script" "$base" >/dev/null 2>&1); then
+  local expected="$3"
+  local output
+  if output="$(cd "$dir" && bash "$script" "$base" 2>&1)"; then
     echo "Expected layering ratchet check to fail in $dir." >&2
     return 1
   fi
+  if ! grep -Fq "$expected" <<<"$output"; then
+    printf 'Layering ratchet failure did not include %q:\n%s\n' "$expected" "$output" >&2
+    return 1
+  fi
 }
 
 hash_file() {
@@ -81,12 +88,7 @@ expect_bootstrap_pass() {
   local base="$2"
   local count="$3"
   local hash="$4"
-  if ! (
-    cd "$dir"
-    LAYERING_RATCHET_INITIAL_COUNT="$count" \
-      LAYERING_RATCHET_INITIAL_HASH="$hash" \
-      bash "$script" "$base"
-  ); then
+  if ! (cd "$dir" && layering_ratchet_main "$base" "$count" "$hash"); then
     echo "Expected layering ratchet bootstrap check to pass in $dir." >&2
     return 1
   fi
@@ -97,15 +99,30 @@ expect_bootstrap_fail() {
   local base="$2"
   local count="$3"
   local hash="$4"
-  if (
-    cd "$dir"
-    LAYERING_RATCHET_INITIAL_COUNT="$count" \
-      LAYERING_RATCHET_INITIAL_HASH="$hash" \
-      bash "$script" "$base" >/dev/null 2>&1
-  ); then
+  local output
+  if output="$(cd "$dir" && layering_ratchet_main "$base" "$count" "$hash" 2>&1)"; then
     echo "Expected layering ratchet bootstrap check to fail in $dir." >&2
     return 1
   fi
+  if ! grep -Fq "bootstrap differs from the approved" <<<"$output"; then
+    printf 'Unexpected layering ratchet bootstrap failure:\n%s\n' "$output" >&2
+    return 1
+  fi
+}
+
+expect_sourced_main_fail() {
+  local dir="$1"
+  local base="$2"
+  local expected="$3"
+  local output
+  if output="$(cd "$dir" && layering_ratchet_main "$base" 2>&1)"; then
+    echo "Expected sourced layering ratchet main to fail in $dir." >&2
+    return 1
+  fi
+  if ! grep -Fq "$expected" <<<"$output"; then
+    printf 'Sourced layering ratchet failure did not include %q:\n%s\n' "$expected" "$output" >&2
+    return 1
+  fi
 }
 
 test_unchanged_and_metadata_changes_pass() {
@@ -143,7 +160,7 @@ test_addition_fails() {
   base="$(git -C "$dir" rev-parse HEAD)"
 
   write_rows "$dir" from/a denied/a from/b denied/b
-  expect_fail "$dir" "$base"
+  expect_fail "$dir" "$base" "from=from/b denied=denied/b"
 }
 
 test_equal_count_replacement_fails() {
@@ -155,7 +172,7 @@ test_equal_count_replacement_fails() {
   base="$(git -C "$dir" rev-parse HEAD)"
 
   write_rows "$dir" from/a denied/a from/c denied/c
-  expect_fail "$dir" "$base"
+  expect_fail "$dir" "$base" "from=from/c denied=denied/c"
 }
 
 test_malformed_and_missing_current_file_fail() {
@@ -167,9 +184,22 @@ test_malformed_and_missing_current_file_fail() {
   base="$(git -C "$dir" rev-parse HEAD)"
 
   printf 'from/a\tdenied/a\towner\treason\n' >"$dir/$ratchet_file"
-  expect_fail "$dir" "$base"
+  expect_fail "$dir" "$base" "expected five tab-separated fields"
+  expect_sourced_main_fail "$dir" "$base" "expected five tab-separated fields"
   rm -f "$dir/$ratchet_file"
-  expect_fail "$dir" "$base"
+  expect_fail "$dir" "$base" "Layering ratchet file is missing"
+}
+
+test_duplicate_key_fails() {
+  local dir="$tmp/duplicate"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  write_rows "$dir" from/a denied/a from/a denied/a
+  expect_fail "$dir" "$base" "duplicate (from, denied) keys"
 }
 
 test_bootstrap_requires_the_approved_snapshot() {
@@ -189,18 +219,18 @@ test_bootstrap_requires_the_approved_snapshot() {
   write_rows "$dir" "${args[@]}"
   local keys_file="$dir/initial.keys"
   bootstrap_keys "$dir/$ratchet_file" >"$keys_file"
-  local initial_hash
-  initial_hash="$(hash_file "$keys_file")"
-  expect_bootstrap_pass "$dir" "$base" 37 "$initial_hash"
+  local expected_hash
+  expected_hash="$(hash_file "$keys_file")"
+  expect_bootstrap_pass "$dir" "$base" 37 "$expected_hash"
 
   args[72]="from/replacement"
   write_rows "$dir" "${args[@]}"
-  expect_bootstrap_fail "$dir" "$base" 37 "$initial_hash"
+  expect_bootstrap_fail "$dir" "$base" 37 "$expected_hash"
 
   args[72]="from/37"
   args+=("from/38" "denied/38")
   write_rows "$dir" "${args[@]}"
-  expect_bootstrap_fail "$dir" "$base" 37 "$initial_hash"
+  expect_bootstrap_fail "$dir" "$base" 37 "$expected_hash"
 }
 
 test_invalid_base_fails() {
@@ -208,7 +238,7 @@ test_invalid_base_fails() {
   git_init "$dir"
   write_rows "$dir" from/a denied/a
   commit_ratchet "$dir"
-  expect_fail "$dir" missing-revision
+  expect_fail "$dir" missing-revision "base revision does not exist"
 }
 
 test_unchanged_and_metadata_changes_pass
@@ -216,5 +246,6 @@ test_deletion_passes
 test_addition_fails
 test_equal_count_replacement_fails
 test_malformed_and_missing_current_file_fail
+test_duplicate_key_fails
 test_bootstrap_requires_the_approved_snapshot
 test_invalid_base_fails
diff --git a/scripts/ci-workflow.test.sh b/scripts/ci-workflow.test.sh
index 080376c0e2..b6856f887e 100644
--- a/scripts/ci-workflow.test.sh
+++ b/scripts/ci-workflow.test.sh
@@ -180,8 +180,8 @@ if grep -Fq "grep -vcE" <<<"$lint_section"; then
   exit 1
 fi
 
-if grep -Fq "LAYERING_RATCHET_INITIAL_" <<<"$lint_section"; then
-  echo "lint must use the checked-in layering bootstrap snapshot"
+if grep -Fq "LAYERING_RATCHET_INITIAL_" "$workflow"; then
+  echo "CI must use the immutable checked-in layering bootstrap snapshot"
   exit 1
 fi
 

From c09b0d5dd36941ad1fa273b014e0992b6e3b467b Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Fri, 24 Jul 2026 16:09:25 +0800
Subject: [PATCH 04/50] test(qualitygate): tolerate coverage helper diagnostics

---
 internal/qualitygate/deptest/layering_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index d2889b94ad..44ac2fa0fc 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -608,7 +608,7 @@ func TestGoListPackagesSeparatesStderr(t *testing.T) {
 	if err != nil {
 		t.Fatalf("loadPackagesForTarget returned an error: %v", err)
 	}
-	if stderr != "go: downloading example.com/module\n" {
+	if !strings.Contains(stderr, "go: downloading example.com/module\n") {
 		t.Fatalf("loadPackagesForTarget stderr = %q, want module download diagnostic", stderr)
 	}
 	if len(packages) != 1 || packages[0].ImportPath != "example.com/package" {

From f1ce88b48e9427550cca6846cbc0c40c22166ad8 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Fri, 24 Jul 2026 16:16:55 +0800
Subject: [PATCH 05/50] test(qualitygate): pin release target coverage

---
 internal/qualitygate/deptest/layering_test.go | 79 ++++++++++++++++++-
 1 file changed, 77 insertions(+), 2 deletions(-)

diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index 44ac2fa0fc..4c451d84bb 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -20,6 +20,7 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/internal/vfs"
+	"gopkg.in/yaml.v3"
 )
 
 const modulePath = "github.com/larksuite/cli"
@@ -112,12 +113,20 @@ type listedPackage struct {
 }
 
 type goListTarget struct {
-	GOOS   string
-	GOARCH string
+	GOOS   string `yaml:"goos"`
+	GOARCH string `yaml:"goarch"`
 }
 
 type commandFactory func(name string, args ...string) *exec.Cmd
 
+type goReleaserConfig struct {
+	Builds []struct {
+		GOOS   []string       `yaml:"goos"`
+		GOARCH []string       `yaml:"goarch"`
+		Ignore []goListTarget `yaml:"ignore"`
+	} `yaml:"builds"`
+}
+
 var layeringBuildTargets = []goListTarget{
 	{GOOS: "linux", GOARCH: "amd64"},
 	{GOOS: "linux", GOARCH: "arm64"},
@@ -578,6 +587,63 @@ func TestLayeringBuildTargets(t *testing.T) {
 	}
 }
 
+func TestLayeringBuildTargetsMatchGoReleaser(t *testing.T) {
+	root := repoRoot(t)
+	content, err := vfs.ReadFile(filepath.Join(root, ".goreleaser.yml"))
+	if err != nil {
+		t.Fatalf("read .goreleaser.yml: %v", err)
+	}
+
+	var config goReleaserConfig
+	if err := yaml.Unmarshal(content, &config); err != nil {
+		t.Fatalf("parse .goreleaser.yml: %v", err)
+	}
+	if len(config.Builds) == 0 {
+		t.Fatal(".goreleaser.yml has no builds")
+	}
+
+	output, err := exec.Command("go", "tool", "dist", "list").Output()
+	if err != nil {
+		t.Fatalf("go tool dist list: %v", err)
+	}
+	supported := make(map[string]struct{})
+	for _, target := range strings.Fields(string(output)) {
+		supported[target] = struct{}{}
+	}
+
+	want := make(map[string]struct{})
+	for _, build := range config.Builds {
+		ignored := make(map[string]struct{}, len(build.Ignore))
+		for _, target := range build.Ignore {
+			ignored[target.GOOS+"/"+target.GOARCH] = struct{}{}
+		}
+		for _, goos := range build.GOOS {
+			for _, goarch := range build.GOARCH {
+				target := goos + "/" + goarch
+				if _, ok := supported[target]; !ok {
+					continue
+				}
+				if _, ok := ignored[target]; ok {
+					continue
+				}
+				want[target] = struct{}{}
+			}
+		}
+	}
+
+	got := make(map[string]struct{}, len(layeringBuildTargets))
+	for _, target := range layeringBuildTargets {
+		key := target.GOOS + "/" + target.GOARCH
+		if _, duplicate := got[key]; duplicate {
+			t.Fatalf("layering build target %q is duplicated", key)
+		}
+		got[key] = struct{}{}
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("layering build targets = %v, want GoReleaser targets %v", sortedKeys(got), sortedKeys(want))
+	}
+}
+
 func TestDecodeAndMergeListedPackages(t *testing.T) {
 	input := strings.NewReader(
 		`{"ImportPath":"example.com/a","Imports":["example.com/b"],"Deps":["example.com/c"]}` + "\n" +
@@ -729,6 +795,15 @@ func mergeStrings(left, right []string) []string {
 	return merged
 }
 
+func sortedKeys(values map[string]struct{}) []string {
+	keys := make([]string, 0, len(values))
+	for key := range values {
+		keys = append(keys, key)
+	}
+	slices.Sort(keys)
+	return keys
+}
+
 func evaluateLayeringRule(packages []listedPackage, rule Rule) []layeringViolation {
 	var violations []layeringViolation
 	for _, pkg := range packages {

From 59b6393250dcfb2eca5b5dadcc50846ad66ff6ce Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Fri, 24 Jul 2026 16:24:30 +0800
Subject: [PATCH 06/50] test(qualitygate): fail closed on release target drift

---
 internal/qualitygate/deptest/layering_test.go | 297 ++++++++++++++++--
 1 file changed, 272 insertions(+), 25 deletions(-)

diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index 4c451d84bb..1a0ceb45bd 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -13,6 +13,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"reflect"
+	"regexp"
 	"slices"
 	"sort"
 	"strings"
@@ -120,11 +121,22 @@ type goListTarget struct {
 type commandFactory func(name string, args ...string) *exec.Cmd
 
 type goReleaserConfig struct {
-	Builds []struct {
-		GOOS   []string       `yaml:"goos"`
-		GOARCH []string       `yaml:"goarch"`
-		Ignore []goListTarget `yaml:"ignore"`
-	} `yaml:"builds"`
+	Builds []goReleaserBuild `yaml:"builds"`
+}
+
+type goReleaserBuild struct {
+	Builder string           `yaml:"builder"`
+	GOOS    []string         `yaml:"goos"`
+	GOARCH  []string         `yaml:"goarch"`
+	Targets []string         `yaml:"targets"`
+	Ignore  []map[string]any `yaml:"ignore"`
+	Skip    bool             `yaml:"skip"`
+}
+
+type distTarget struct {
+	GOOS       string
+	GOARCH     string
+	FirstClass bool
 }
 
 var layeringBuildTargets = []goListTarget{
@@ -602,32 +614,27 @@ func TestLayeringBuildTargetsMatchGoReleaser(t *testing.T) {
 		t.Fatal(".goreleaser.yml has no builds")
 	}
 
-	output, err := exec.Command("go", "tool", "dist", "list").Output()
+	output, err := exec.Command("go", "tool", "dist", "list", "-json").Output()
 	if err != nil {
 		t.Fatalf("go tool dist list: %v", err)
 	}
-	supported := make(map[string]struct{})
-	for _, target := range strings.Fields(string(output)) {
-		supported[target] = struct{}{}
+	var distTargets []distTarget
+	if err := json.Unmarshal(output, &distTargets); err != nil {
+		t.Fatalf("parse go tool dist list: %v", err)
+	}
+	supported := make(map[string]distTarget, len(distTargets))
+	for _, target := range distTargets {
+		supported[target.GOOS+"/"+target.GOARCH] = target
 	}
 
 	want := make(map[string]struct{})
-	for _, build := range config.Builds {
-		ignored := make(map[string]struct{}, len(build.Ignore))
-		for _, target := range build.Ignore {
-			ignored[target.GOOS+"/"+target.GOARCH] = struct{}{}
-		}
-		for _, goos := range build.GOOS {
-			for _, goarch := range build.GOARCH {
-				target := goos + "/" + goarch
-				if _, ok := supported[target]; !ok {
-					continue
-				}
-				if _, ok := ignored[target]; ok {
-					continue
-				}
-				want[target] = struct{}{}
-			}
+	for index, build := range config.Builds {
+		targets, err := goReleaserBuildTargets(build, supported)
+		if err != nil {
+			t.Fatalf(".goreleaser.yml build %d: %v", index, err)
+		}
+		for target := range targets {
+			want[target] = struct{}{}
 		}
 	}
 
@@ -644,6 +651,246 @@ func TestLayeringBuildTargetsMatchGoReleaser(t *testing.T) {
 	}
 }
 
+func TestReleaseGoVersionMatchesModule(t *testing.T) {
+	root := repoRoot(t)
+	moduleContent, err := vfs.ReadFile(filepath.Join(root, "go.mod"))
+	if err != nil {
+		t.Fatalf("read go.mod: %v", err)
+	}
+	releaseContent, err := vfs.ReadFile(filepath.Join(root, ".github", "workflows", "release.yml"))
+	if err != nil {
+		t.Fatalf("read release workflow: %v", err)
+	}
+
+	moduleVersion := findVersion(t, string(moduleContent), `(?m)^go\s+([0-9]+\.[0-9]+)(?:\.[0-9]+)?\s*$`, "go.mod")
+	releaseVersion := findVersion(
+		t,
+		string(releaseContent),
+		`(?m)^\s+go-version:\s*['"]?([0-9]+\.[0-9]+)(?:\.[0-9]+)?['"]?\s*$`,
+		"release workflow",
+	)
+	if releaseVersion != moduleVersion {
+		t.Fatalf("release Go version = %q, want module Go version %q", releaseVersion, moduleVersion)
+	}
+}
+
+func TestGoReleaserBuildTargets(t *testing.T) {
+	supported := map[string]distTarget{
+		"darwin/arm64":  {GOOS: "darwin", GOARCH: "arm64", FirstClass: true},
+		"freebsd/amd64": {GOOS: "freebsd", GOARCH: "amd64"},
+		"linux/amd64":   {GOOS: "linux", GOARCH: "amd64", FirstClass: true},
+		"windows/amd64": {GOOS: "windows", GOARCH: "amd64", FirstClass: true},
+		"windows/arm64": {GOOS: "windows", GOARCH: "arm64"},
+	}
+	tests := []struct {
+		name    string
+		build   goReleaserBuild
+		want    []string
+		wantErr bool
+	}{
+		{
+			name: "explicit targets override the matrix",
+			build: goReleaserBuild{
+				GOOS:    []string{"linux"},
+				GOARCH:  []string{"amd64"},
+				Targets: []string{"freebsd_amd64"},
+			},
+			want: []string{"freebsd/amd64"},
+		},
+		{
+			name: "target suffixes preserve the base platform",
+			build: goReleaserBuild{
+				Targets: []string{"linux_amd64_v1"},
+			},
+			want: []string{"linux/amd64"},
+		},
+		{
+			name: "first class selector expands from the toolchain",
+			build: goReleaserBuild{
+				Targets: []string{"go_first_class"},
+			},
+			want: []string{"darwin/arm64", "linux/amd64", "windows/amd64"},
+		},
+		{
+			name: "partial ignore matches every architecture",
+			build: goReleaserBuild{
+				GOOS:   []string{"windows"},
+				GOARCH: []string{"amd64", "arm64"},
+				Ignore: []map[string]any{{"goos": "windows"}},
+			},
+			want: []string{},
+		},
+		{
+			name: "skipped build has no targets",
+			build: goReleaserBuild{
+				Skip: true,
+			},
+			want: []string{},
+		},
+		{
+			name: "microarchitecture ignore fails closed",
+			build: goReleaserBuild{
+				GOOS:   []string{"linux"},
+				GOARCH: []string{"amd64"},
+				Ignore: []map[string]any{{"goamd64": "v1"}},
+			},
+			wantErr: true,
+		},
+		{
+			name: "fixed first class selector fails closed",
+			build: goReleaserBuild{
+				Targets: []string{"go_118_first_class"},
+			},
+			wantErr: true,
+		},
+		{
+			name: "non-Go builder fails closed",
+			build: goReleaserBuild{
+				Builder: "rust",
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := goReleaserBuildTargets(tt.build, supported)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatal("goReleaserBuildTargets returned no error")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("goReleaserBuildTargets returned an error: %v", err)
+			}
+			if keys := sortedKeys(got); !slices.Equal(keys, tt.want) {
+				t.Fatalf("goReleaserBuildTargets = %v, want %v", keys, tt.want)
+			}
+		})
+	}
+}
+
+func goReleaserBuildTargets(
+	build goReleaserBuild,
+	supported map[string]distTarget,
+) (map[string]struct{}, error) {
+	if build.Skip {
+		return map[string]struct{}{}, nil
+	}
+	if build.Builder != "" && build.Builder != "go" {
+		return nil, fmt.Errorf("unsupported builder %q", build.Builder)
+	}
+	if len(build.Targets) > 0 {
+		return explicitGoReleaserTargets(build.Targets, supported)
+	}
+
+	gooses := build.GOOS
+	if len(gooses) == 0 {
+		gooses = []string{"darwin", "linux", "windows"}
+	}
+	goarches := build.GOARCH
+	if len(goarches) == 0 {
+		goarches = []string{"386", "amd64", "arm64"}
+	}
+
+	targets := make(map[string]struct{})
+	for _, goos := range gooses {
+		for _, goarch := range goarches {
+			target := goos + "/" + goarch
+			if _, ok := supported[target]; !ok {
+				continue
+			}
+			ignored, err := goReleaserTargetIgnored(goos, goarch, build.Ignore)
+			if err != nil {
+				return nil, err
+			}
+			if !ignored {
+				targets[target] = struct{}{}
+			}
+		}
+	}
+	return targets, nil
+}
+
+func explicitGoReleaserTargets(
+	configured []string,
+	supported map[string]distTarget,
+) (map[string]struct{}, error) {
+	targets := make(map[string]struct{})
+	for _, configuredTarget := range configured {
+		if configuredTarget == "go_first_class" {
+			for key, target := range supported {
+				if target.FirstClass {
+					targets[key] = struct{}{}
+				}
+			}
+			continue
+		}
+		if configuredTarget == "go_118_first_class" {
+			return nil, fmt.Errorf("unsupported target selector %q", configuredTarget)
+		}
+		if strings.Contains(configuredTarget, "{{") {
+			return nil, fmt.Errorf("templated target %q is unsupported", configuredTarget)
+		}
+
+		parts := strings.Split(configuredTarget, "_")
+		if len(parts) < 2 {
+			return nil, fmt.Errorf("malformed target %q", configuredTarget)
+		}
+		target := parts[0] + "/" + parts[1]
+		if _, ok := supported[target]; !ok {
+			return nil, fmt.Errorf("unsupported Go target %q", configuredTarget)
+		}
+		targets[target] = struct{}{}
+	}
+	return targets, nil
+}
+
+func goReleaserTargetIgnored(goos, goarch string, ignored []map[string]any) (bool, error) {
+	for _, entry := range ignored {
+		for key := range entry {
+			if key != "goos" && key != "goarch" {
+				return false, fmt.Errorf("unsupported ignore selector %q", key)
+			}
+		}
+		ignoredGOOS, err := optionalString(entry, "goos")
+		if err != nil {
+			return false, err
+		}
+		ignoredGOARCH, err := optionalString(entry, "goarch")
+		if err != nil {
+			return false, err
+		}
+		if (ignoredGOOS == "" || ignoredGOOS == goos) &&
+			(ignoredGOARCH == "" || ignoredGOARCH == goarch) {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func optionalString(values map[string]any, key string) (string, error) {
+	value, ok := values[key]
+	if !ok {
+		return "", nil
+	}
+	text, ok := value.(string)
+	if !ok {
+		return "", fmt.Errorf("ignore selector %q must be a string", key)
+	}
+	return text, nil
+}
+
+func findVersion(t *testing.T, content, pattern, source string) string {
+	t.Helper()
+	match := regexp.MustCompile(pattern).FindStringSubmatch(content)
+	if len(match) != 2 {
+		t.Fatalf("find Go version in %s", source)
+	}
+	return match[1]
+}
+
 func TestDecodeAndMergeListedPackages(t *testing.T) {
 	input := strings.NewReader(
 		`{"ImportPath":"example.com/a","Imports":["example.com/b"],"Deps":["example.com/c"]}` + "\n" +

From cbe0fb12df42f2a927533522578ae482c3717991 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Fri, 24 Jul 2026 16:29:47 +0800
Subject: [PATCH 07/50] test(qualitygate): reject unsupported release variants

---
 internal/qualitygate/deptest/layering_test.go | 68 ++++++++++++++++---
 1 file changed, 59 insertions(+), 9 deletions(-)

diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index 1a0ceb45bd..0c582b6596 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -125,12 +125,22 @@ type goReleaserConfig struct {
 }
 
 type goReleaserBuild struct {
-	Builder string           `yaml:"builder"`
-	GOOS    []string         `yaml:"goos"`
-	GOARCH  []string         `yaml:"goarch"`
-	Targets []string         `yaml:"targets"`
-	Ignore  []map[string]any `yaml:"ignore"`
-	Skip    bool             `yaml:"skip"`
+	Builder   string           `yaml:"builder"`
+	GOOS      []string         `yaml:"goos"`
+	GOARCH    []string         `yaml:"goarch"`
+	GOARM     []any            `yaml:"goarm"`
+	GOAMD64   []any            `yaml:"goamd64"`
+	GOARM64   []any            `yaml:"goarm64"`
+	GOMIPS    []any            `yaml:"gomips"`
+	GOMIPS64  []any            `yaml:"gomips64"`
+	GO386     []any            `yaml:"go386"`
+	GOPPC64   []any            `yaml:"goppc64"`
+	GORISCV64 []any            `yaml:"goriscv64"`
+	Tool      string           `yaml:"tool"`
+	GoBinary  string           `yaml:"gobinary"`
+	Targets   []string         `yaml:"targets"`
+	Ignore    []map[string]any `yaml:"ignore"`
+	Skip      bool             `yaml:"skip"`
 }
 
 type distTarget struct {
@@ -698,11 +708,11 @@ func TestGoReleaserBuildTargets(t *testing.T) {
 			want: []string{"freebsd/amd64"},
 		},
 		{
-			name: "target suffixes preserve the base platform",
+			name: "target suffixes fail closed",
 			build: goReleaserBuild{
 				Targets: []string{"linux_amd64_v1"},
 			},
-			want: []string{"linux/amd64"},
+			wantErr: true,
 		},
 		{
 			name: "first class selector expands from the toolchain",
@@ -727,6 +737,15 @@ func TestGoReleaserBuildTargets(t *testing.T) {
 			},
 			want: []string{},
 		},
+		{
+			name: "microarchitecture matrix fails closed",
+			build: goReleaserBuild{
+				GOOS:    []string{"linux"},
+				GOARCH:  []string{"amd64"},
+				GOAMD64: []any{"v3"},
+			},
+			wantErr: true,
+		},
 		{
 			name: "microarchitecture ignore fails closed",
 			build: goReleaserBuild{
@@ -750,6 +769,20 @@ func TestGoReleaserBuildTargets(t *testing.T) {
 			},
 			wantErr: true,
 		},
+		{
+			name: "custom Go tool fails closed",
+			build: goReleaserBuild{
+				Tool: "go1.24.0",
+			},
+			wantErr: true,
+		},
+		{
+			name: "legacy custom Go binary fails closed",
+			build: goReleaserBuild{
+				GoBinary: "go1.24.0",
+			},
+			wantErr: true,
+		},
 	}
 
 	for _, tt := range tests {
@@ -781,6 +814,12 @@ func goReleaserBuildTargets(
 	if build.Builder != "" && build.Builder != "go" {
 		return nil, fmt.Errorf("unsupported builder %q", build.Builder)
 	}
+	if build.Tool != "" || build.GoBinary != "" {
+		return nil, fmt.Errorf("custom Go tools are unsupported")
+	}
+	if buildHasMicroarchitectureMatrix(build) {
+		return nil, fmt.Errorf("microarchitecture matrices are unsupported")
+	}
 	if len(build.Targets) > 0 {
 		return explicitGoReleaserTargets(build.Targets, supported)
 	}
@@ -835,7 +874,7 @@ func explicitGoReleaserTargets(
 		}
 
 		parts := strings.Split(configuredTarget, "_")
-		if len(parts) < 2 {
+		if len(parts) != 2 {
 			return nil, fmt.Errorf("malformed target %q", configuredTarget)
 		}
 		target := parts[0] + "/" + parts[1]
@@ -847,6 +886,17 @@ func explicitGoReleaserTargets(
 	return targets, nil
 }
 
+func buildHasMicroarchitectureMatrix(build goReleaserBuild) bool {
+	return len(build.GOARM) > 0 ||
+		len(build.GOAMD64) > 0 ||
+		len(build.GOARM64) > 0 ||
+		len(build.GOMIPS) > 0 ||
+		len(build.GOMIPS64) > 0 ||
+		len(build.GO386) > 0 ||
+		len(build.GOPPC64) > 0 ||
+		len(build.GORISCV64) > 0
+}
+
 func goReleaserTargetIgnored(goos, goarch string, ignored []map[string]any) (bool, error) {
 	for _, entry := range ignored {
 		for key := range entry {

From 7c2ca4e4651879a63701377f66e8df70cb8f3b5e Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Fri, 24 Jul 2026 16:34:22 +0800
Subject: [PATCH 08/50] test(qualitygate): cover default release graph

---
 internal/qualitygate/deptest/layering_test.go | 147 ++++++++++++++----
 1 file changed, 119 insertions(+), 28 deletions(-)

diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index 0c582b6596..98e2a5e6d4 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -138,15 +138,17 @@ type goReleaserBuild struct {
 	GORISCV64 []any            `yaml:"goriscv64"`
 	Tool      string           `yaml:"tool"`
 	GoBinary  string           `yaml:"gobinary"`
+	Tags      []string         `yaml:"tags"`
+	Flags     []string         `yaml:"flags"`
+	Env       []string         `yaml:"env"`
 	Targets   []string         `yaml:"targets"`
 	Ignore    []map[string]any `yaml:"ignore"`
 	Skip      bool             `yaml:"skip"`
 }
 
 type distTarget struct {
-	GOOS       string
-	GOARCH     string
-	FirstClass bool
+	GOOS   string
+	GOARCH string
 }
 
 var layeringBuildTargets = []goListTarget{
@@ -159,6 +161,8 @@ var layeringBuildTargets = []goListTarget{
 	{GOOS: "windows", GOARCH: "arm64"},
 }
 
+var layeringBuildTags = []string{"", "authsidecar"}
+
 type layeringEdge struct {
 	From   string
 	Denied string
@@ -609,6 +613,13 @@ func TestLayeringBuildTargets(t *testing.T) {
 	}
 }
 
+func TestLayeringBuildTags(t *testing.T) {
+	want := []string{"", "authsidecar"}
+	if !slices.Equal(layeringBuildTags, want) {
+		t.Fatalf("layering build tags = %q, want %q", layeringBuildTags, want)
+	}
+}
+
 func TestLayeringBuildTargetsMatchGoReleaser(t *testing.T) {
 	root := repoRoot(t)
 	content, err := vfs.ReadFile(filepath.Join(root, ".goreleaser.yml"))
@@ -686,10 +697,10 @@ func TestReleaseGoVersionMatchesModule(t *testing.T) {
 
 func TestGoReleaserBuildTargets(t *testing.T) {
 	supported := map[string]distTarget{
-		"darwin/arm64":  {GOOS: "darwin", GOARCH: "arm64", FirstClass: true},
+		"darwin/arm64":  {GOOS: "darwin", GOARCH: "arm64"},
 		"freebsd/amd64": {GOOS: "freebsd", GOARCH: "amd64"},
-		"linux/amd64":   {GOOS: "linux", GOARCH: "amd64", FirstClass: true},
-		"windows/amd64": {GOOS: "windows", GOARCH: "amd64", FirstClass: true},
+		"linux/amd64":   {GOOS: "linux", GOARCH: "amd64"},
+		"windows/amd64": {GOOS: "windows", GOARCH: "amd64"},
 		"windows/arm64": {GOOS: "windows", GOARCH: "arm64"},
 	}
 	tests := []struct {
@@ -715,11 +726,11 @@ func TestGoReleaserBuildTargets(t *testing.T) {
 			wantErr: true,
 		},
 		{
-			name: "first class selector expands from the toolchain",
+			name: "first class selector fails closed",
 			build: goReleaserBuild{
 				Targets: []string{"go_first_class"},
 			},
-			want: []string{"darwin/arm64", "linux/amd64", "windows/amd64"},
+			wantErr: true,
 		},
 		{
 			name: "partial ignore matches every architecture",
@@ -737,6 +748,14 @@ func TestGoReleaserBuildTargets(t *testing.T) {
 			},
 			want: []string{},
 		},
+		{
+			name: "arm target fails closed",
+			build: goReleaserBuild{
+				GOOS:   []string{"linux"},
+				GOARCH: []string{"arm"},
+			},
+			wantErr: true,
+		},
 		{
 			name: "microarchitecture matrix fails closed",
 			build: goReleaserBuild{
@@ -783,6 +802,34 @@ func TestGoReleaserBuildTargets(t *testing.T) {
 			},
 			wantErr: true,
 		},
+		{
+			name: "release build tags fail closed",
+			build: goReleaserBuild{
+				Tags: []string{"feature"},
+			},
+			wantErr: true,
+		},
+		{
+			name: "build flag tags fail closed",
+			build: goReleaserBuild{
+				Flags: []string{"-tags=feature"},
+			},
+			wantErr: true,
+		},
+		{
+			name: "environment build tags fail closed",
+			build: goReleaserBuild{
+				Env: []string{"GOFLAGS=-tags=feature"},
+			},
+			wantErr: true,
+		},
+		{
+			name: "enabled cgo fails closed",
+			build: goReleaserBuild{
+				Env: []string{"CGO_ENABLED=1"},
+			},
+			wantErr: true,
+		},
 	}
 
 	for _, tt := range tests {
@@ -817,6 +864,12 @@ func goReleaserBuildTargets(
 	if build.Tool != "" || build.GoBinary != "" {
 		return nil, fmt.Errorf("custom Go tools are unsupported")
 	}
+	if len(build.Tags) > 0 || buildFlagsSetTags(build.Flags) {
+		return nil, fmt.Errorf("release build tags are unsupported")
+	}
+	if err := validateGoReleaserBuildEnv(build.Env); err != nil {
+		return nil, err
+	}
 	if buildHasMicroarchitectureMatrix(build) {
 		return nil, fmt.Errorf("microarchitecture matrices are unsupported")
 	}
@@ -836,6 +889,9 @@ func goReleaserBuildTargets(
 	targets := make(map[string]struct{})
 	for _, goos := range gooses {
 		for _, goarch := range goarches {
+			if goarch == "arm" {
+				return nil, fmt.Errorf("GOARCH=arm requires explicit GOARM support")
+			}
 			target := goos + "/" + goarch
 			if _, ok := supported[target]; !ok {
 				continue
@@ -858,15 +914,7 @@ func explicitGoReleaserTargets(
 ) (map[string]struct{}, error) {
 	targets := make(map[string]struct{})
 	for _, configuredTarget := range configured {
-		if configuredTarget == "go_first_class" {
-			for key, target := range supported {
-				if target.FirstClass {
-					targets[key] = struct{}{}
-				}
-			}
-			continue
-		}
-		if configuredTarget == "go_118_first_class" {
+		if configuredTarget == "go_first_class" || configuredTarget == "go_118_first_class" {
 			return nil, fmt.Errorf("unsupported target selector %q", configuredTarget)
 		}
 		if strings.Contains(configuredTarget, "{{") {
@@ -877,6 +925,9 @@ func explicitGoReleaserTargets(
 		if len(parts) != 2 {
 			return nil, fmt.Errorf("malformed target %q", configuredTarget)
 		}
+		if parts[1] == "arm" {
+			return nil, fmt.Errorf("target %q requires explicit GOARM support", configuredTarget)
+		}
 		target := parts[0] + "/" + parts[1]
 		if _, ok := supported[target]; !ok {
 			return nil, fmt.Errorf("unsupported Go target %q", configuredTarget)
@@ -886,6 +937,38 @@ func explicitGoReleaserTargets(
 	return targets, nil
 }
 
+func buildFlagsSetTags(flags []string) bool {
+	for _, flag := range flags {
+		if flag == "-tags" || strings.HasPrefix(flag, "-tags=") {
+			return true
+		}
+	}
+	return false
+}
+
+func validateGoReleaserBuildEnv(env []string) error {
+	for _, entry := range env {
+		name, value, ok := strings.Cut(entry, "=")
+		if !ok {
+			continue
+		}
+		switch name {
+		case "CGO_ENABLED":
+			if value != "0" {
+				return fmt.Errorf("CGO_ENABLED=%s is unsupported", value)
+			}
+		case "GOFLAGS":
+			if strings.Contains(value, "-tags") {
+				return fmt.Errorf("GOFLAGS build tags are unsupported")
+			}
+		case "GOEXPERIMENT", "GOOS", "GOARCH", "GOARM", "GOAMD64", "GOARM64",
+			"GOMIPS", "GOMIPS64", "GO386", "GOPPC64", "GORISCV64":
+			return fmt.Errorf("build environment variable %q is unsupported", name)
+		}
+	}
+	return nil
+}
+
 func buildHasMicroarchitectureMatrix(build goReleaserBuild) bool {
 	return len(build.GOARM) > 0 ||
 		len(build.GOAMD64) > 0 ||
@@ -963,7 +1046,7 @@ func TestDecodeAndMergeListedPackages(t *testing.T) {
 
 func TestGoListPackagesSeparatesStderr(t *testing.T) {
 	target := goListTarget{GOOS: "linux", GOARCH: "amd64"}
-	packages, stderr, err := loadPackagesForTarget("", target, func(_ string, _ ...string) *exec.Cmd {
+	packages, stderr, err := loadPackagesForTarget("", target, "authsidecar", func(_ string, _ ...string) *exec.Cmd {
 		cmd := exec.Command(os.Args[0], "-test.run=^TestGoListCommandHelperProcess$")
 		cmd.Env = append(os.Environ(), "GO_LIST_COMMAND_HELPER=1")
 		return cmd
@@ -992,12 +1075,14 @@ func goListPackageGraph(t *testing.T, root string) []listedPackage {
 	t.Helper()
 	packagesByPath := make(map[string]listedPackage)
 	for _, target := range layeringBuildTargets {
-		for _, pkg := range goListPackages(t, root, target) {
-			merged := packagesByPath[pkg.ImportPath]
-			merged.ImportPath = pkg.ImportPath
-			merged.Imports = mergeStrings(merged.Imports, pkg.Imports)
-			merged.Deps = mergeStrings(merged.Deps, pkg.Deps)
-			packagesByPath[pkg.ImportPath] = merged
+		for _, tags := range layeringBuildTags {
+			for _, pkg := range goListPackages(t, root, target, tags) {
+				merged := packagesByPath[pkg.ImportPath]
+				merged.ImportPath = pkg.ImportPath
+				merged.Imports = mergeStrings(merged.Imports, pkg.Imports)
+				merged.Deps = mergeStrings(merged.Deps, pkg.Deps)
+				packagesByPath[pkg.ImportPath] = merged
+			}
 		}
 	}
 
@@ -1011,14 +1096,15 @@ func goListPackageGraph(t *testing.T, root string) []listedPackage {
 	return packages
 }
 
-func goListPackages(t *testing.T, root string, target goListTarget) []listedPackage {
+func goListPackages(t *testing.T, root string, target goListTarget, tags string) []listedPackage {
 	t.Helper()
-	packages, stderr, err := loadPackagesForTarget(root, target, exec.Command)
+	packages, stderr, err := loadPackagesForTarget(root, target, tags, exec.Command)
 	if err != nil {
 		t.Fatalf(
-			"GOOS=%s GOARCH=%s go list -json -tags authsidecar ./... failed: %v\n%s",
+			"GOOS=%s GOARCH=%s tags=%q go list -json ./... failed: %v\n%s",
 			target.GOOS,
 			target.GOARCH,
+			tags,
 			err,
 			stderr,
 		)
@@ -1029,9 +1115,14 @@ func goListPackages(t *testing.T, root string, target goListTarget) []listedPack
 func loadPackagesForTarget(
 	root string,
 	target goListTarget,
+	tags string,
 	newCommand commandFactory,
 ) ([]listedPackage, string, error) {
-	args := []string{"list", "-json", "-tags", "authsidecar", "./..."}
+	args := []string{"list", "-json"}
+	if tags != "" {
+		args = append(args, "-tags", tags)
+	}
+	args = append(args, "./...")
 	cmd := newCommand("go", args...)
 	cmd.Dir = root
 	env := cmd.Env

From abe0d09d4b8e589fc91160729890fb3a0b3aab1a Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Fri, 24 Jul 2026 17:05:33 +0800
Subject: [PATCH 09/50] fix(qualitygate): harden layering edge parsing and
 release-target checks

Layering edge parsing and graph coverage:
- Reject whitespace-padded exception fields instead of silently trimming
  them, so a padded row is a malformed row rather than a coerced identity;
  add a padded-field parse test.
- Fail loud when any release target/tag combination lists zero packages,
  which would otherwise let the layering graph silently under-cover.
- Document the build-tag scope (demo tags excluded), the SkipFrom substring
  semantics, and the toolchain-derived support set behind the drift check.

GoReleaser drift checks:
- Reject custom build commands and per-target overrides as unsupported.
- Detect --tags in addition to -tags when rejecting release build tags.
- Reject any GO* build environment variable (except CGO_ENABLED=0) through a
  single default branch instead of an explicit allowlist.
- Validate the GoReleaser global env block, and make the go-list stderr test
  table-driven across the default and authsidecar graphs.
---
 internal/qualitygate/deptest/layering_test.go | 137 +++++++++++++++---
 1 file changed, 113 insertions(+), 24 deletions(-)

diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index 98e2a5e6d4..4812b42742 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -42,8 +42,12 @@ type Rule struct {
 	Mode       Mode
 	FromPrefix string
 	Denied     []string
+	// ExceptFrom exempts import paths matched exactly.
 	ExceptFrom []string
-	SkipFrom   []string
+	// SkipFrom exempts any package whose import path contains one of these
+	// substrings (e.g. "/examples/" to skip demo code anywhere in the tree),
+	// deliberately looser than the prefix matching used for the other fields.
+	SkipFrom []string
 }
 
 var rules = []Rule{
@@ -121,6 +125,7 @@ type goListTarget struct {
 type commandFactory func(name string, args ...string) *exec.Cmd
 
 type goReleaserConfig struct {
+	Env    []string          `yaml:"env"`
 	Builds []goReleaserBuild `yaml:"builds"`
 }
 
@@ -141,6 +146,8 @@ type goReleaserBuild struct {
 	Tags      []string         `yaml:"tags"`
 	Flags     []string         `yaml:"flags"`
 	Env       []string         `yaml:"env"`
+	Command   string           `yaml:"command"`
+	Overrides yaml.Node        `yaml:"overrides"`
 	Targets   []string         `yaml:"targets"`
 	Ignore    []map[string]any `yaml:"ignore"`
 	Skip      bool             `yaml:"skip"`
@@ -161,6 +168,10 @@ var layeringBuildTargets = []goListTarget{
 	{GOOS: "windows", GOARCH: "arm64"},
 }
 
+// layeringBuildTags is the set of build tags whose import graphs are unioned
+// before evaluating the rules. Demo-only tags (authsidecar_demo,
+// authsidecar_multi_tenant_demo) are intentionally excluded: that code lives
+// under sidecar/server-demo*/ and never sits in a layer any rule governs.
 var layeringBuildTags = []string{"", "authsidecar"}
 
 type layeringEdge struct {
@@ -298,6 +309,10 @@ func TestParseLayeringEdges(t *testing.T) {
 			name:  "invalid-date",
 			input: "from\tdenied\towner\treason\t2026-02-30\n",
 		},
+		{
+			name:  "whitespace-padded-field",
+			input: "from\t denied \towner\treason\t2026-07-24\n",
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -634,7 +649,14 @@ func TestLayeringBuildTargetsMatchGoReleaser(t *testing.T) {
 	if len(config.Builds) == 0 {
 		t.Fatal(".goreleaser.yml has no builds")
 	}
+	if err := validateGoReleaserBuildEnv(config.Env); err != nil {
+		t.Fatalf(".goreleaser.yml global environment: %v", err)
+	}
 
+	// The supported set is derived from the toolchain running this test.
+	// TestReleaseGoVersionMatchesModule pins the release Go to the go.mod floor,
+	// so a runner older than the release toolchain (which could omit a
+	// release-buildable target and under-compute want) is caught there first.
 	output, err := exec.Command("go", "tool", "dist", "list", "-json").Output()
 	if err != nil {
 		t.Fatalf("go tool dist list: %v", err)
@@ -812,7 +834,7 @@ func TestGoReleaserBuildTargets(t *testing.T) {
 		{
 			name: "build flag tags fail closed",
 			build: goReleaserBuild{
-				Flags: []string{"-tags=feature"},
+				Flags: []string{"--tags=feature"},
 			},
 			wantErr: true,
 		},
@@ -823,6 +845,20 @@ func TestGoReleaserBuildTargets(t *testing.T) {
 			},
 			wantErr: true,
 		},
+		{
+			name: "custom build command fails closed",
+			build: goReleaserBuild{
+				Command: "test",
+			},
+			wantErr: true,
+		},
+		{
+			name: "target overrides fail closed",
+			build: goReleaserBuild{
+				Overrides: yaml.Node{Kind: yaml.MappingNode},
+			},
+			wantErr: true,
+		},
 		{
 			name: "enabled cgo fails closed",
 			build: goReleaserBuild{
@@ -864,6 +900,12 @@ func goReleaserBuildTargets(
 	if build.Tool != "" || build.GoBinary != "" {
 		return nil, fmt.Errorf("custom Go tools are unsupported")
 	}
+	if build.Command != "" && build.Command != "build" {
+		return nil, fmt.Errorf("unsupported Go command %q", build.Command)
+	}
+	if build.Overrides.Kind != 0 {
+		return nil, fmt.Errorf("target overrides are unsupported")
+	}
 	if len(build.Tags) > 0 || buildFlagsSetTags(build.Flags) {
 		return nil, fmt.Errorf("release build tags are unsupported")
 	}
@@ -939,7 +981,8 @@ func explicitGoReleaserTargets(
 
 func buildFlagsSetTags(flags []string) bool {
 	for _, flag := range flags {
-		if flag == "-tags" || strings.HasPrefix(flag, "-tags=") {
+		if flag == "-tags" || strings.HasPrefix(flag, "-tags=") ||
+			flag == "--tags" || strings.HasPrefix(flag, "--tags=") {
 			return true
 		}
 	}
@@ -957,12 +1000,10 @@ func validateGoReleaserBuildEnv(env []string) error {
 			if value != "0" {
 				return fmt.Errorf("CGO_ENABLED=%s is unsupported", value)
 			}
-		case "GOFLAGS":
-			if strings.Contains(value, "-tags") {
-				return fmt.Errorf("GOFLAGS build tags are unsupported")
+		default:
+			if !strings.HasPrefix(name, "GO") {
+				continue
 			}
-		case "GOEXPERIMENT", "GOOS", "GOARCH", "GOARM", "GOAMD64", "GOARM64",
-			"GOMIPS", "GOMIPS64", "GO386", "GOPPC64", "GORISCV64":
 			return fmt.Errorf("build environment variable %q is unsupported", name)
 		}
 	}
@@ -1046,19 +1087,45 @@ func TestDecodeAndMergeListedPackages(t *testing.T) {
 
 func TestGoListPackagesSeparatesStderr(t *testing.T) {
 	target := goListTarget{GOOS: "linux", GOARCH: "amd64"}
-	packages, stderr, err := loadPackagesForTarget("", target, "authsidecar", func(_ string, _ ...string) *exec.Cmd {
-		cmd := exec.Command(os.Args[0], "-test.run=^TestGoListCommandHelperProcess$")
-		cmd.Env = append(os.Environ(), "GO_LIST_COMMAND_HELPER=1")
-		return cmd
-	})
-	if err != nil {
-		t.Fatalf("loadPackagesForTarget returned an error: %v", err)
-	}
-	if !strings.Contains(stderr, "go: downloading example.com/module\n") {
-		t.Fatalf("loadPackagesForTarget stderr = %q, want module download diagnostic", stderr)
+	tests := []struct {
+		name     string
+		tags     string
+		wantArgs []string
+	}{
+		{
+			name:     "default graph",
+			wantArgs: []string{"list", "-json", "./..."},
+		},
+		{
+			name:     "authsidecar graph",
+			tags:     "authsidecar",
+			wantArgs: []string{"list", "-json", "-tags", "authsidecar", "./..."},
+		},
 	}
-	if len(packages) != 1 || packages[0].ImportPath != "example.com/package" {
-		t.Fatalf("loadPackagesForTarget returned unexpected packages: %+v", packages)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var gotName string
+			var gotArgs []string
+			packages, stderr, err := loadPackagesForTarget("", target, tt.tags, func(name string, args ...string) *exec.Cmd {
+				gotName = name
+				gotArgs = slices.Clone(args)
+				cmd := exec.Command(os.Args[0], "-test.run=^TestGoListCommandHelperProcess$")
+				cmd.Env = append(os.Environ(), "GO_LIST_COMMAND_HELPER=1")
+				return cmd
+			})
+			if err != nil {
+				t.Fatalf("loadPackagesForTarget returned an error: %v", err)
+			}
+			if gotName != "go" || !slices.Equal(gotArgs, tt.wantArgs) {
+				t.Fatalf("command = %q %q, want go %q", gotName, gotArgs, tt.wantArgs)
+			}
+			if !strings.Contains(stderr, "go: downloading example.com/module\n") {
+				t.Fatalf("loadPackagesForTarget stderr = %q, want module download diagnostic", stderr)
+			}
+			if len(packages) != 1 || packages[0].ImportPath != "example.com/package" {
+				t.Fatalf("loadPackagesForTarget returned unexpected packages: %+v", packages)
+			}
+		})
 	}
 }
 
@@ -1076,7 +1143,16 @@ func goListPackageGraph(t *testing.T, root string) []listedPackage {
 	packagesByPath := make(map[string]listedPackage)
 	for _, target := range layeringBuildTargets {
 		for _, tags := range layeringBuildTags {
-			for _, pkg := range goListPackages(t, root, target, tags) {
+			listed := goListPackages(t, root, target, tags)
+			if len(listed) == 0 {
+				t.Fatalf(
+					"GOOS=%s GOARCH=%s tags=%q go list -json ./... returned no packages; the layering graph would silently under-cover",
+					target.GOOS,
+					target.GOARCH,
+					tags,
+				)
+			}
+			for _, pkg := range listed {
 				merged := packagesByPath[pkg.ImportPath]
 				merged.ImportPath = pkg.ImportPath
 				merged.Imports = mergeStrings(merged.Imports, pkg.Imports)
@@ -1318,11 +1394,15 @@ func parseLayeringEdges(r io.Reader) ([]seededLayeringEdge, error) {
 			problems = append(problems, malformedLayeringEdge(line))
 			continue
 		}
-		for i := range parts {
-			parts[i] = strings.TrimSpace(parts[i])
+		// Reject rather than trim: an import path never carries surrounding
+		// whitespace, so a padded field is a malformed row, not one to
+		// silently normalize into a different identity.
+		if hasBlank(parts...) || hasSurroundingWhitespace(parts...) {
+			problems = append(problems, malformedLayeringEdge(line))
+			continue
 		}
 		addedAt, dateErr := time.Parse(time.DateOnly, parts[4])
-		if hasBlank(parts...) || dateErr != nil {
+		if dateErr != nil {
 			problems = append(problems, malformedLayeringEdge(line))
 			continue
 		}
@@ -1360,6 +1440,15 @@ func hasBlank(values ...string) bool {
 	return false
 }
 
+func hasSurroundingWhitespace(values ...string) bool {
+	for _, value := range values {
+		if value != strings.TrimSpace(value) {
+			return true
+		}
+	}
+	return false
+}
+
 func malformedLayeringEdge(line int) string {
 	return fmt.Sprintf(
 		"line %d: layering edge row must have five tab-separated non-empty fields with added_at in YYYY-MM-DD format",

From d48c218d0dc33cec0a463c1e53d6e0b80b7ee048 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Fri, 24 Jul 2026 17:49:33 +0800
Subject: [PATCH 10/50] fix: close layering quality gate gaps

---
 .../qualitygate/deptest/layering-edges.txt    |   2 +
 internal/qualitygate/deptest/layering_test.go | 154 ++++++++++++++++--
 scripts/check-layering-ratchet.sh             |  19 ++-
 scripts/check-layering-ratchet.test.sh        |  41 ++++-
 4 files changed, 189 insertions(+), 27 deletions(-)

diff --git a/internal/qualitygate/deptest/layering-edges.txt b/internal/qualitygate/deptest/layering-edges.txt
index 10c8e36508..5301b6aaa2 100644
--- a/internal/qualitygate/deptest/layering-edges.txt
+++ b/internal/qualitygate/deptest/layering-edges.txt
@@ -16,6 +16,8 @@ github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/i
 github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/vfs	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
 github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/vfs/localfileio	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
 github.com/larksuite/cli/extension/transport/sidecar	github.com/larksuite/cli/internal/envvars	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/events	github.com/larksuite/cli/shortcuts/im/convert_lib	arch-migration	events root aggregates the existing im conversion dependency	2026-07-24
+github.com/larksuite/cli/events	github.com/larksuite/cli/shortcuts/common	arch-migration	events root aggregates the existing im conversion dependency	2026-07-24
 github.com/larksuite/cli/events/im	github.com/larksuite/cli/shortcuts/im/convert_lib	arch-migration	events->shortcuts inversion via convert_lib	2026-07-24
 github.com/larksuite/cli/events/im	github.com/larksuite/cli/shortcuts/common	arch-migration	events->shortcuts inversion via convert_lib	2026-07-24
 github.com/larksuite/cli/shortcuts/im	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index 4812b42742..fa7ffda226 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -54,20 +54,20 @@ var rules = []Rule{
 	{
 		Name:       "extension-zero-internal",
 		Mode:       Transitive,
-		FromPrefix: modulePath + "/extension/",
-		Denied:     []string{modulePath + "/internal/"},
+		FromPrefix: modulePath + "/extension",
+		Denied:     []string{modulePath + "/internal"},
 		SkipFrom:   []string{"/examples/"},
 	},
 	{
 		Name:       "events-no-shortcuts",
 		Mode:       Transitive,
-		FromPrefix: modulePath + "/events/",
-		Denied:     []string{modulePath + "/shortcuts/"},
+		FromPrefix: modulePath + "/events",
+		Denied:     []string{modulePath + "/shortcuts"},
 	},
 	{
 		Name:       "shortcuts-runtime-gate",
 		Mode:       Direct,
-		FromPrefix: modulePath + "/shortcuts/",
+		FromPrefix: modulePath + "/shortcuts",
 		Denied: []string{
 			modulePath + "/internal/auth",
 			modulePath + "/internal/keychain",
@@ -99,7 +99,7 @@ var rules = []Rule{
 	{
 		Name:       "internal-no-upper",
 		Mode:       Direct,
-		FromPrefix: modulePath + "/internal/",
+		FromPrefix: modulePath + "/internal",
 		Denied: []string{
 			modulePath + "/cmd",
 			modulePath + "/shortcuts",
@@ -413,20 +413,20 @@ func TestLayeringRuleContracts(t *testing.T) {
 		{
 			Name:       "extension-zero-internal",
 			Mode:       Transitive,
-			FromPrefix: modulePath + "/extension/",
-			Denied:     []string{modulePath + "/internal/"},
+			FromPrefix: modulePath + "/extension",
+			Denied:     []string{modulePath + "/internal"},
 			SkipFrom:   []string{"/examples/"},
 		},
 		{
 			Name:       "events-no-shortcuts",
 			Mode:       Transitive,
-			FromPrefix: modulePath + "/events/",
-			Denied:     []string{modulePath + "/shortcuts/"},
+			FromPrefix: modulePath + "/events",
+			Denied:     []string{modulePath + "/shortcuts"},
 		},
 		{
 			Name:       "shortcuts-runtime-gate",
 			Mode:       Direct,
-			FromPrefix: modulePath + "/shortcuts/",
+			FromPrefix: modulePath + "/shortcuts",
 			Denied: []string{
 				modulePath + "/internal/auth",
 				modulePath + "/internal/keychain",
@@ -458,7 +458,7 @@ func TestLayeringRuleContracts(t *testing.T) {
 		{
 			Name:       "internal-no-upper",
 			Mode:       Direct,
-			FromPrefix: modulePath + "/internal/",
+			FromPrefix: modulePath + "/internal",
 			Denied: []string{
 				modulePath + "/cmd",
 				modulePath + "/shortcuts",
@@ -613,6 +613,78 @@ func TestLayeringRuleContracts(t *testing.T) {
 	}
 }
 
+func TestLayeringRulesCoverRootPackages(t *testing.T) {
+	tests := []struct {
+		name       string
+		ruleName   string
+		pkg        listedPackage
+		wantDenied string
+	}{
+		{
+			name:     "extension-root",
+			ruleName: "extension-zero-internal",
+			pkg: listedPackage{
+				ImportPath: modulePath + "/extension",
+				Deps:       []string{modulePath + "/internal"},
+			},
+			wantDenied: modulePath + "/internal",
+		},
+		{
+			name:     "events-root",
+			ruleName: "events-no-shortcuts",
+			pkg: listedPackage{
+				ImportPath: modulePath + "/events",
+				Deps:       []string{modulePath + "/shortcuts"},
+			},
+			wantDenied: modulePath + "/shortcuts",
+		},
+		{
+			name:     "shortcuts-root",
+			ruleName: "shortcuts-runtime-gate",
+			pkg: listedPackage{
+				ImportPath: modulePath + "/shortcuts",
+				Imports:    []string{modulePath + "/internal/client"},
+			},
+			wantDenied: modulePath + "/internal/client",
+		},
+		{
+			name:     "internal-root",
+			ruleName: "internal-no-upper",
+			pkg: listedPackage{
+				ImportPath: modulePath + "/internal",
+				Imports:    []string{modulePath + "/events"},
+			},
+			wantDenied: modulePath + "/events",
+		},
+	}
+
+	rulesByName := make(map[string]Rule, len(rules))
+	for _, rule := range rules {
+		rulesByName[rule.Name] = rule
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rule, ok := rulesByName[tt.ruleName]
+			if !ok {
+				t.Fatalf("missing rule %q", tt.ruleName)
+			}
+			violations := evaluateLayeringRule([]listedPackage{tt.pkg}, rule)
+			if len(violations) != 1 {
+				t.Fatalf("evaluateLayeringRule returned %d violations, want 1: %+v", len(violations), violations)
+			}
+			if violations[0].From != tt.pkg.ImportPath || violations[0].Denied != tt.wantDenied {
+				t.Fatalf(
+					"evaluateLayeringRule returned edge (%q, %q), want (%q, %q)",
+					violations[0].From,
+					violations[0].Denied,
+					tt.pkg.ImportPath,
+					tt.wantDenied,
+				)
+			}
+		})
+	}
+}
+
 func TestLayeringBuildTargets(t *testing.T) {
 	want := []goListTarget{
 		{GOOS: "linux", GOARCH: "amd64"},
@@ -845,6 +917,37 @@ func TestGoReleaserBuildTargets(t *testing.T) {
 			},
 			wantErr: true,
 		},
+		{
+			name: "templated build environment fails closed",
+			build: goReleaserBuild{
+				Env: []string{`{{- if eq .Os "linux" }}GOFLAGS=-tags=feature{{- end }}`},
+			},
+			wantErr: true,
+		},
+		{
+			name: "templated build flags fail closed",
+			build: goReleaserBuild{
+				Flags: []string{`{{- if eq .Os "linux" }}-tags=feature{{- end }}`},
+			},
+			wantErr: true,
+		},
+		{
+			name: "templated target matrix fails closed",
+			build: goReleaserBuild{
+				GOOS:   []string{`{{ .Env.GOOS }}`},
+				GOARCH: []string{"amd64"},
+			},
+			wantErr: true,
+		},
+		{
+			name: "templated ignore fails closed",
+			build: goReleaserBuild{
+				GOOS:   []string{"linux"},
+				GOARCH: []string{"amd64"},
+				Ignore: []map[string]any{{"goos": `{{ .Env.GOOS }}`}},
+			},
+			wantErr: true,
+		},
 		{
 			name: "custom build command fails closed",
 			build: goReleaserBuild{
@@ -906,6 +1009,12 @@ func goReleaserBuildTargets(
 	if build.Overrides.Kind != 0 {
 		return nil, fmt.Errorf("target overrides are unsupported")
 	}
+	if containsGoReleaserTemplate(build.GOOS) || containsGoReleaserTemplate(build.GOARCH) {
+		return nil, fmt.Errorf("templated release target matrices are unsupported")
+	}
+	if containsGoReleaserTemplate(build.Flags) {
+		return nil, fmt.Errorf("templated release build flags are unsupported")
+	}
 	if len(build.Tags) > 0 || buildFlagsSetTags(build.Flags) {
 		return nil, fmt.Errorf("release build tags are unsupported")
 	}
@@ -959,7 +1068,7 @@ func explicitGoReleaserTargets(
 		if configuredTarget == "go_first_class" || configuredTarget == "go_118_first_class" {
 			return nil, fmt.Errorf("unsupported target selector %q", configuredTarget)
 		}
-		if strings.Contains(configuredTarget, "{{") {
+		if hasGoReleaserTemplate(configuredTarget) {
 			return nil, fmt.Errorf("templated target %q is unsupported", configuredTarget)
 		}
 
@@ -989,8 +1098,24 @@ func buildFlagsSetTags(flags []string) bool {
 	return false
 }
 
+func containsGoReleaserTemplate(values []string) bool {
+	for _, value := range values {
+		if hasGoReleaserTemplate(value) {
+			return true
+		}
+	}
+	return false
+}
+
+func hasGoReleaserTemplate(value string) bool {
+	return strings.Contains(value, "{{") || strings.Contains(value, "}}")
+}
+
 func validateGoReleaserBuildEnv(env []string) error {
 	for _, entry := range env {
+		if hasGoReleaserTemplate(entry) {
+			return fmt.Errorf("templated build environment entries are unsupported")
+		}
 		name, value, ok := strings.Cut(entry, "=")
 		if !ok {
 			continue
@@ -1053,6 +1178,9 @@ func optionalString(values map[string]any, key string) (string, error) {
 	if !ok {
 		return "", fmt.Errorf("ignore selector %q must be a string", key)
 	}
+	if hasGoReleaserTemplate(text) {
+		return "", fmt.Errorf("templated ignore selector %q is unsupported", key)
+	}
 	return text, nil
 }
 
diff --git a/scripts/check-layering-ratchet.sh b/scripts/check-layering-ratchet.sh
index 9cbc82a0f7..ad76b2cabd 100644
--- a/scripts/check-layering-ratchet.sh
+++ b/scripts/check-layering-ratchet.sh
@@ -20,11 +20,16 @@ layering_ratchet_extract_keys() {
         printf "Malformed layering ratchet row at %s:%d: expected five tab-separated fields.\n", FILENAME, FNR > "/dev/stderr"
         exit 2
       }
-      from = trim($1)
-      denied = trim($2)
-      owner = trim($3)
-      reason = trim($4)
-      added_at = trim($5)
+      from = $1
+      denied = $2
+      owner = $3
+      reason = $4
+      added_at = $5
+      sub(/\r+$/, "", added_at)
+      if (from != trim(from) || denied != trim(denied) || owner != trim(owner) || reason != trim(reason) || added_at != trim(added_at)) {
+        printf "Malformed layering ratchet row at %s:%d: fields must not have surrounding whitespace.\n", FILENAME, FNR > "/dev/stderr"
+        exit 2
+      }
       if (from == "" || denied == "" || owner == "" || reason == "" || added_at !~ /^[0-9]{4}-[0-9]{2}-[0-9]{2}$/) {
         printf "Malformed layering ratchet row at %s:%d: fields must be non-empty and added_at must use YYYY-MM-DD.\n", FILENAME, FNR > "/dev/stderr"
         exit 2
@@ -82,8 +87,8 @@ layering_ratchet_main() (
   fi
 
   local base_revision="${1:-${QUALITY_GATE_CHANGED_FROM:-}}"
-  local approved_initial_count="${2:-37}"
-  local approved_initial_hash="${3:-cf61e4149cb4d539a1430f4a4266b91f972c253cedd300830c94e35dda1f0265}"
+  local approved_initial_count="${2:-39}"
+  local approved_initial_hash="${3:-5636d50d10b9de1e08dc9f06cd66671b3f438650fa5b7f28b95aa7d5a69a1c21}"
   if [[ -z "$base_revision" ]]; then
     echo "Layering ratchet requires a base revision." >&2
     return 1
diff --git a/scripts/check-layering-ratchet.test.sh b/scripts/check-layering-ratchet.test.sh
index 39744b96b3..08af81b3ac 100644
--- a/scripts/check-layering-ratchet.test.sh
+++ b/scripts/check-layering-ratchet.test.sh
@@ -190,6 +190,31 @@ test_malformed_and_missing_current_file_fail() {
   expect_fail "$dir" "$base" "Layering ratchet file is missing"
 }
 
+test_surrounding_whitespace_fails() {
+  local dir="$tmp/surrounding-whitespace"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  printf '# from\tdenied\towner\treason\tadded_at\nfrom/a\t denied/a \towner\treason\t2026-07-24\n' >"$dir/$ratchet_file"
+  expect_fail "$dir" "$base" "fields must not have surrounding whitespace"
+  expect_sourced_main_fail "$dir" "$base" "fields must not have surrounding whitespace"
+}
+
+test_crlf_rows_pass() {
+  local dir="$tmp/crlf"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  printf '# from\tdenied\towner\treason\tadded_at\r\nfrom/a\tdenied/a\towner\treason\t2026-07-24\r\n' >"$dir/$ratchet_file"
+  expect_pass "$dir" "$base"
+}
+
 test_duplicate_key_fails() {
   local dir="$tmp/duplicate"
   git_init "$dir"
@@ -213,7 +238,7 @@ test_bootstrap_requires_the_approved_snapshot() {
 
   local args=()
   local index
-  for index in $(seq 1 37); do
+  for index in $(seq 1 39); do
     args+=("from/$index" "denied/$index")
   done
   write_rows "$dir" "${args[@]}"
@@ -221,16 +246,16 @@ test_bootstrap_requires_the_approved_snapshot() {
   bootstrap_keys "$dir/$ratchet_file" >"$keys_file"
   local expected_hash
   expected_hash="$(hash_file "$keys_file")"
-  expect_bootstrap_pass "$dir" "$base" 37 "$expected_hash"
+  expect_bootstrap_pass "$dir" "$base" 39 "$expected_hash"
 
-  args[72]="from/replacement"
+  args[76]="from/replacement"
   write_rows "$dir" "${args[@]}"
-  expect_bootstrap_fail "$dir" "$base" 37 "$expected_hash"
+  expect_bootstrap_fail "$dir" "$base" 39 "$expected_hash"
 
-  args[72]="from/37"
-  args+=("from/38" "denied/38")
+  args[76]="from/39"
+  args+=("from/40" "denied/40")
   write_rows "$dir" "${args[@]}"
-  expect_bootstrap_fail "$dir" "$base" 37 "$expected_hash"
+  expect_bootstrap_fail "$dir" "$base" 39 "$expected_hash"
 }
 
 test_invalid_base_fails() {
@@ -246,6 +271,8 @@ test_deletion_passes
 test_addition_fails
 test_equal_count_replacement_fails
 test_malformed_and_missing_current_file_fail
+test_surrounding_whitespace_fails
+test_crlf_rows_pass
 test_duplicate_key_fails
 test_bootstrap_requires_the_approved_snapshot
 test_invalid_base_fails

From 820305536c68604364e235221bf2c01c08153afd Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Sat, 25 Jul 2026 12:18:26 +0800
Subject: [PATCH 11/50] fix(qualitygate): scope the examples exemption to
 wrapper mains

The extension rule skipped any package whose import path contained
"/examples/", which let the gate miss two things: a directory named
examples anywhere under extension escaped the rule outright, and the
sanctioned demos were exempt from every denial rather than only from the
internal packages they inherit through cmd.

- Drop SkipFrom (and containsAny) so no rule can exempt by directory name.
- Exempt the two wrapper-main demos from extension-zero-internal by exact
  import path. Their cmd import is the pattern they exist to demonstrate,
  and seeding those edges instead would wedge the ratchet: the edges track
  cmd's transitive set, so a new internal package under cmd would demand a
  new row that check-layering-ratchet.sh refuses by design.
- Add examples-surface-only: demos may consume cmd and extension/platform
  but must not directly import internal or shortcuts. Zero violations today.

layering-edges.txt stays at 39 rows, so the ratchet bootstrap snapshot
still matches.
---
 internal/qualitygate/deptest/layering_test.go | 99 +++++++++++++++----
 1 file changed, 79 insertions(+), 20 deletions(-)

diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index fa7ffda226..be9e5c957d 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -44,19 +44,46 @@ type Rule struct {
 	Denied     []string
 	// ExceptFrom exempts import paths matched exactly.
 	ExceptFrom []string
-	// SkipFrom exempts any package whose import path contains one of these
-	// substrings (e.g. "/examples/" to skip demo code anywhere in the tree),
-	// deliberately looser than the prefix matching used for the other fields.
-	SkipFrom []string
 }
 
+// examplesPrefix is the plugin-SDK example tree. Each subdirectory is a
+// standalone main package demonstrating the sanctioned wrapper-main pattern:
+// register a plugin from init, then hand the process to cmd.Execute. The
+// customer forks built by tests/plugin_e2e/harness.go have the same shape.
+const examplesPrefix = modulePath + "/extension/platform/examples"
+
 var rules = []Rule{
 	{
 		Name:       "extension-zero-internal",
 		Mode:       Transitive,
 		FromPrefix: modulePath + "/extension",
 		Denied:     []string{modulePath + "/internal"},
-		SkipFrom:   []string{"/examples/"},
+		// The wrapper-main demos import cmd deliberately — that fork is the
+		// thing they exist to show — so every internal package they reach is
+		// inherited through cmd rather than chosen by the demo. Exempting
+		// them by exact path (never by directory name) keeps two properties:
+		// a future examples/ subdirectory inherits no exemption, and
+		// examples-surface-only still stops a demo from reaching down on its
+		// own. Listing these edges in layering-edges.txt instead would also
+		// wedge the ratchet: they track cmd's transitive set, so any new
+		// internal package under cmd would demand a new row, which
+		// check-layering-ratchet.sh refuses by design.
+		ExceptFrom: []string{
+			examplesPrefix + "/audit-observer",
+			examplesPrefix + "/readonly-policy",
+		},
+	},
+	{
+		// Demos may consume the assembled CLI (cmd) and the public SDK
+		// (extension/platform); reaching past those into internals or
+		// business commands would teach plugin authors the wrong entry point.
+		Name:       "examples-surface-only",
+		Mode:       Direct,
+		FromPrefix: examplesPrefix,
+		Denied: []string{
+			modulePath + "/internal",
+			modulePath + "/shortcuts",
+		},
 	},
 	{
 		Name:       "events-no-shortcuts",
@@ -415,7 +442,19 @@ func TestLayeringRuleContracts(t *testing.T) {
 			Mode:       Transitive,
 			FromPrefix: modulePath + "/extension",
 			Denied:     []string{modulePath + "/internal"},
-			SkipFrom:   []string{"/examples/"},
+			ExceptFrom: []string{
+				examplesPrefix + "/audit-observer",
+				examplesPrefix + "/readonly-policy",
+			},
+		},
+		{
+			Name:       "examples-surface-only",
+			Mode:       Direct,
+			FromPrefix: examplesPrefix,
+			Denied: []string{
+				modulePath + "/internal",
+				modulePath + "/shortcuts",
+			},
 		},
 		{
 			Name:       "events-no-shortcuts",
@@ -481,7 +520,7 @@ func TestLayeringRuleContracts(t *testing.T) {
 		wantDenied string
 	}{
 		{
-			name:     "extension-transitive-denial-and-example-scope-out",
+			name:     "extension-transitive-denial-and-wrapper-main-exemption",
 			ruleName: "extension-zero-internal",
 			packages: []listedPackage{
 				{
@@ -489,13 +528,45 @@ func TestLayeringRuleContracts(t *testing.T) {
 					Deps:       []string{modulePath + "/internal/core"},
 				},
 				{
-					ImportPath: modulePath + "/extension/platform/examples/demo",
+					ImportPath: examplesPrefix + "/audit-observer",
 					Deps:       []string{modulePath + "/internal/core"},
 				},
 			},
 			wantFrom:   modulePath + "/extension/sdk",
 			wantDenied: modulePath + "/internal/core",
 		},
+		{
+			// The exemption is per exact path, so parking code in a new
+			// directory under examples/ buys no cover.
+			name:     "extension-still-covers-unlisted-example-directories",
+			ruleName: "extension-zero-internal",
+			packages: []listedPackage{
+				{
+					ImportPath: examplesPrefix + "/demo",
+					Deps:       []string{modulePath + "/internal/core"},
+				},
+			},
+			wantFrom:   examplesPrefix + "/demo",
+			wantDenied: modulePath + "/internal/core",
+		},
+		{
+			// cmd is the demo's whole point and stays legal; reaching past it
+			// into internals does not.
+			name:     "examples-may-wrap-cmd-but-not-reach-internals",
+			ruleName: "examples-surface-only",
+			packages: []listedPackage{
+				{
+					ImportPath: examplesPrefix + "/audit-observer",
+					Imports: []string{
+						modulePath + "/cmd",
+						modulePath + "/extension/platform",
+						modulePath + "/internal/keychain",
+					},
+				},
+			},
+			wantFrom:   examplesPrefix + "/audit-observer",
+			wantDenied: modulePath + "/internal/keychain",
+		},
 		{
 			name:     "events-transitive-denial",
 			ruleName: "events-no-shortcuts",
@@ -1405,9 +1476,6 @@ func evaluateLayeringRule(packages []listedPackage, rule Rule) []layeringViolati
 		if slices.Contains(rule.ExceptFrom, pkg.ImportPath) {
 			continue
 		}
-		if containsAny(pkg.ImportPath, rule.SkipFrom) {
-			continue
-		}
 
 		dependencies := pkg.Imports
 		if rule.Mode == Transitive {
@@ -1454,15 +1522,6 @@ func matchesAnyPackagePrefix(prefixes []string, importPath string) bool {
 	return false
 }
 
-func containsAny(value string, substrings []string) bool {
-	for _, substring := range substrings {
-		if strings.Contains(value, substring) {
-			return true
-		}
-	}
-	return false
-}
-
 func findUnseededLayeringViolations(
 	actual []layeringViolation,
 	seeded map[layeringEdge]seededLayeringEdge,

From 217f4e55670f78d57c781aab9d456a5e27f32dd9 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Sat, 25 Jul 2026 14:30:29 +0800
Subject: [PATCH 12/50] fix(qualitygate): pin the examples surface with an
 allowlist

examples-surface-only promised that demos may consume only the assembled CLI
and the public plugin SDK, but it enforced two denied prefixes instead, so
every tree nobody thought to deny was permitted. A demo importing `events`,
`errs` or a `cmd` subpackage passed the gate, and because
extension-zero-internal exempts these packages from the transitive check,
nothing examined what those imports dragged in either. The exemption was
therefore unbounded in what it covered, the same defect as the directory-name
skip it replaced.

- Add Rule.AllowedRepoDeps, which inverts the check: any dependency inside
  this module that is not listed is a violation. Standard library and
  third-party packages, including same-organisation modules that are not this
  one, stay outside the rule.
- Pin examples-surface-only to exactly `cmd` and `extension/platform`, so the
  rule name matches what it enforces and the inherited chain stays bounded by
  a direct surface of two packages.
- Cover the reproducers as contract cases: other repository trees, `cmd`
  subpackages, other `extension` subtrees, and the module root are rejected,
  while the two allowed packages plus non-module imports are not.

layering-edges.txt stays at 39 rows; the demos already import only the two
allowed packages.
---
 internal/qualitygate/deptest/layering_test.go | 107 ++++++++++++++++--
 1 file changed, 95 insertions(+), 12 deletions(-)

diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index be9e5c957d..2c27ef8d01 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -44,6 +44,13 @@ type Rule struct {
 	Denied     []string
 	// ExceptFrom exempts import paths matched exactly.
 	ExceptFrom []string
+	// AllowedRepoDeps inverts the check. When set, every dependency inside this
+	// module that is not listed here (matched exactly) is a violation and Denied
+	// is unused. Dependencies outside the module - standard library and
+	// third-party packages - are never considered. Prefer this over Denied
+	// whenever the rule name promises a surface rather than a blocklist, so the
+	// guarantee cannot drift as the repository grows new top-level trees.
+	AllowedRepoDeps []string
 }
 
 // examplesPrefix is the plugin-SDK example tree. Each subdirectory is a
@@ -74,15 +81,19 @@ var rules = []Rule{
 		},
 	},
 	{
-		// Demos may consume the assembled CLI (cmd) and the public SDK
-		// (extension/platform); reaching past those into internals or
-		// business commands would teach plugin authors the wrong entry point.
+		// Demos exist to show the wrapper-main pattern, so the assembled CLI and
+		// the public plugin SDK are the only repository packages they may reach
+		// for. This is an allowlist rather than a few denied prefixes because
+		// extension-zero-internal exempts these packages from the transitive
+		// check: pinning the direct surface is the only thing that keeps the
+		// inherited chain bounded, and a blocklist would silently permit every
+		// tree nobody thought to deny (events, errs, cmd subpackages).
 		Name:       "examples-surface-only",
 		Mode:       Direct,
 		FromPrefix: examplesPrefix,
-		Denied: []string{
-			modulePath + "/internal",
-			modulePath + "/shortcuts",
+		AllowedRepoDeps: []string{
+			modulePath + "/cmd",
+			modulePath + "/extension/platform",
 		},
 	},
 	{
@@ -451,9 +462,9 @@ func TestLayeringRuleContracts(t *testing.T) {
 			Name:       "examples-surface-only",
 			Mode:       Direct,
 			FromPrefix: examplesPrefix,
-			Denied: []string{
-				modulePath + "/internal",
-				modulePath + "/shortcuts",
+			AllowedRepoDeps: []string{
+				modulePath + "/cmd",
+				modulePath + "/extension/platform",
 			},
 		},
 		{
@@ -550,14 +561,17 @@ func TestLayeringRuleContracts(t *testing.T) {
 			wantDenied: modulePath + "/internal/core",
 		},
 		{
-			// cmd is the demo's whole point and stays legal; reaching past it
-			// into internals does not.
+			// cmd and the plugin SDK are the demo's whole point and stay legal.
+			// Standard library and third-party imports are outside the rule,
+			// including a same-organisation module that is not this one.
 			name:     "examples-may-wrap-cmd-but-not-reach-internals",
 			ruleName: "examples-surface-only",
 			packages: []listedPackage{
 				{
 					ImportPath: examplesPrefix + "/audit-observer",
 					Imports: []string{
+						"context",
+						"github.com/larksuite/oapi-sdk-go/v3",
 						modulePath + "/cmd",
 						modulePath + "/extension/platform",
 						modulePath + "/internal/keychain",
@@ -567,6 +581,57 @@ func TestLayeringRuleContracts(t *testing.T) {
 			wantFrom:   examplesPrefix + "/audit-observer",
 			wantDenied: modulePath + "/internal/keychain",
 		},
+		{
+			// The allowlist covers trees nobody thought to deny; a blocklist of
+			// internal and shortcuts would have let this through.
+			name:     "examples-reject-other-repository-trees",
+			ruleName: "examples-surface-only",
+			packages: []listedPackage{
+				{
+					ImportPath: examplesPrefix + "/audit-observer",
+					Imports:    []string{modulePath + "/cmd", modulePath + "/events"},
+				},
+			},
+			wantFrom:   examplesPrefix + "/audit-observer",
+			wantDenied: modulePath + "/events",
+		},
+		{
+			// Only the assembly root is public surface, not its subpackages.
+			name:     "examples-reject-cmd-subpackages",
+			ruleName: "examples-surface-only",
+			packages: []listedPackage{
+				{
+					ImportPath: examplesPrefix + "/audit-observer",
+					Imports:    []string{modulePath + "/cmd", modulePath + "/cmd/api"},
+				},
+			},
+			wantFrom:   examplesPrefix + "/audit-observer",
+			wantDenied: modulePath + "/cmd/api",
+		},
+		{
+			name:     "examples-reject-other-extension-subtrees",
+			ruleName: "examples-surface-only",
+			packages: []listedPackage{
+				{
+					ImportPath: examplesPrefix + "/audit-observer",
+					Imports:    []string{modulePath + "/extension/fileio"},
+				},
+			},
+			wantFrom:   examplesPrefix + "/audit-observer",
+			wantDenied: modulePath + "/extension/fileio",
+		},
+		{
+			name:     "examples-reject-the-module-root",
+			ruleName: "examples-surface-only",
+			packages: []listedPackage{
+				{
+					ImportPath: examplesPrefix + "/audit-observer",
+					Imports:    []string{modulePath},
+				},
+			},
+			wantFrom:   examplesPrefix + "/audit-observer",
+			wantDenied: modulePath,
+		},
 		{
 			name:     "events-transitive-denial",
 			ruleName: "events-no-shortcuts",
@@ -1482,7 +1547,7 @@ func evaluateLayeringRule(packages []listedPackage, rule Rule) []layeringViolati
 			dependencies = pkg.Deps
 		}
 		for _, dependency := range dependencies {
-			if !matchesAnyPackagePrefix(rule.Denied, dependency) {
+			if !ruleRejectsDependency(rule, dependency) {
 				continue
 			}
 			violations = append(violations, layeringViolation{
@@ -1503,6 +1568,24 @@ func evaluateLayeringRule(packages []listedPackage, rule Rule) []layeringViolati
 	return violations
 }
 
+// ruleRejectsDependency reports whether dependency breaks rule, reading the
+// allowlist when the rule declares one and the denied prefixes otherwise.
+func ruleRejectsDependency(rule Rule, dependency string) bool {
+	if len(rule.AllowedRepoDeps) == 0 {
+		return matchesAnyPackagePrefix(rule.Denied, dependency)
+	}
+	if !isRepoPackage(dependency) {
+		return false
+	}
+	return !slices.Contains(rule.AllowedRepoDeps, dependency)
+}
+
+// isRepoPackage reports whether importPath belongs to this module rather than
+// the standard library or a third-party dependency.
+func isRepoPackage(importPath string) bool {
+	return importPath == modulePath || matchesPackagePrefix(modulePath+"/", importPath)
+}
+
 func matchesPackagePrefix(prefix, importPath string) bool {
 	if importPath == prefix {
 		return true

From 8ba2431192f1474761ceee0f97373d0c0dd42518 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Sat, 25 Jul 2026 16:52:10 +0800
Subject: [PATCH 13/50] refactor(extension): remove internal package
 dependencies

---
 cmd/root_integration_test.go                  |  12 +-
 cmd/startup_brand.go                          |   4 +-
 envnames/envnames.go                          |  18 +++
 extension/credential/env/env.go               |  41 ++++---
 extension/credential/env/env_test.go          | 108 +++++++++---------
 extension/credential/sidecar/provider.go      |  35 +++---
 extension/credential/sidecar/provider_test.go |  44 +++----
 extension/transport/sidecar/interceptor.go    |  12 +-
 internal/cmdutil/factory_default_test.go      |  48 ++++----
 internal/cmdutil/factory_proxy_warn_test.go   |  12 +-
 internal/cmdutil/factory_test.go              |   4 +-
 internal/credential/integration_test.go       |  16 +--
 internal/envvars/envvars.go                   |  13 ---
 internal/envvars/read.go                      |   3 +-
 internal/envvars/read_test.go                 |  12 +-
 .../qualitygate/deptest/layering-edges.txt    |  17 ---
 main_noauthsidecar.go                         |   6 +-
 main_noauthsidecar_test.go                    |   6 +-
 sidecar/server-demo/handler_test.go           |  14 +--
 sidecar/server-demo/main.go                   |  14 +--
 .../server-multi-tenant-demo/handler_test.go  |   8 +-
 sidecar/server-multi-tenant-demo/main.go      |  14 +--
 22 files changed, 232 insertions(+), 229 deletions(-)
 create mode 100644 envnames/envnames.go

diff --git a/cmd/root_integration_test.go b/cmd/root_integration_test.go
index 11a6b24c84..096eac9a10 100644
--- a/cmd/root_integration_test.go
+++ b/cmd/root_integration_test.go
@@ -14,11 +14,11 @@ import (
 	"github.com/larksuite/cli/cmd/api"
 	"github.com/larksuite/cli/cmd/auth"
 	"github.com/larksuite/cli/cmd/service"
+	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/internal/apicatalog"
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/meta"
 	"github.com/larksuite/cli/internal/output"
@@ -157,11 +157,11 @@ func strictModeFixtureCatalog() apicatalog.Catalog {
 
 func newStrictModeDefaultFactory(t *testing.T, profile string, mode core.StrictMode) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer) {
 	t.Helper()
-	t.Setenv(envvars.CliAppID, "")
-	t.Setenv(envvars.CliAppSecret, "")
-	t.Setenv(envvars.CliUserAccessToken, "")
-	t.Setenv(envvars.CliTenantAccessToken, "")
-	t.Setenv(envvars.CliDefaultAs, "")
+	t.Setenv(envnames.CliAppID, "")
+	t.Setenv(envnames.CliAppSecret, "")
+	t.Setenv(envnames.CliUserAccessToken, "")
+	t.Setenv(envnames.CliTenantAccessToken, "")
+	t.Setenv(envnames.CliDefaultAs, "")
 
 	dir := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
diff --git a/cmd/startup_brand.go b/cmd/startup_brand.go
index de73ff9b22..80f3761275 100644
--- a/cmd/startup_brand.go
+++ b/cmd/startup_brand.go
@@ -6,8 +6,8 @@ package cmd
 import (
 	"os"
 
+	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/envvars"
 )
 
 // ResolveStartupBrand resolves the brand before the command tree is built, so
@@ -16,7 +16,7 @@ import (
 // environment, then the active profile's raw config entry — without touching
 // the keychain (no secrets are needed to know the brand).
 func ResolveStartupBrand(profile string) core.LarkBrand {
-	if raw := os.Getenv(envvars.CliBrand); raw != "" {
+	if raw := os.Getenv(envnames.CliBrand); raw != "" {
 		return core.ParseBrand(raw)
 	}
 	if cfg, err := core.LoadMultiAppConfig(); err == nil {
diff --git a/envnames/envnames.go b/envnames/envnames.go
new file mode 100644
index 0000000000..6734affc31
--- /dev/null
+++ b/envnames/envnames.go
@@ -0,0 +1,18 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+// Package envnames defines environment variable names shared by the CLI and
+// its public extension packages.
+package envnames
+
+const (
+	CliAppID             = "LARKSUITE_CLI_APP_ID"
+	CliAppSecret         = "LARKSUITE_CLI_APP_SECRET"
+	CliBrand             = "LARKSUITE_CLI_BRAND"
+	CliUserAccessToken   = "LARKSUITE_CLI_USER_ACCESS_TOKEN"
+	CliTenantAccessToken = "LARKSUITE_CLI_TENANT_ACCESS_TOKEN"
+	CliDefaultAs         = "LARKSUITE_CLI_DEFAULT_AS"
+	CliStrictMode        = "LARKSUITE_CLI_STRICT_MODE"
+	CliAuthProxy         = "LARKSUITE_CLI_AUTH_PROXY"
+	CliProxyKey          = "LARKSUITE_CLI_PROXY_KEY"
+)
diff --git a/extension/credential/env/env.go b/extension/credential/env/env.go
index 5458125689..9af1693c58 100644
--- a/extension/credential/env/env.go
+++ b/extension/credential/env/env.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"strings"
 
+	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/envvars"
 )
 
 // Provider resolves credentials from environment variables.
@@ -19,33 +19,33 @@ type Provider struct{}
 func (p *Provider) Name() string { return "env" }
 
 func (p *Provider) ResolveAccount(ctx context.Context) (*credential.Account, error) {
-	appID := os.Getenv(envvars.CliAppID)
-	appSecret := os.Getenv(envvars.CliAppSecret)
-	hasUAT := os.Getenv(envvars.CliUserAccessToken) != ""
-	hasTAT := os.Getenv(envvars.CliTenantAccessToken) != ""
+	appID := os.Getenv(envnames.CliAppID)
+	appSecret := os.Getenv(envnames.CliAppSecret)
+	hasUAT := os.Getenv(envnames.CliUserAccessToken) != ""
+	hasTAT := os.Getenv(envnames.CliTenantAccessToken) != ""
 	if appID == "" && appSecret == "" {
 		switch {
 		case hasUAT:
-			return nil, &credential.BlockError{Provider: "env", Reason: envvars.CliUserAccessToken + " is set but " + envvars.CliAppID + " is missing"}
+			return nil, &credential.BlockError{Provider: "env", Reason: envnames.CliUserAccessToken + " is set but " + envnames.CliAppID + " is missing"}
 		case hasTAT:
-			return nil, &credential.BlockError{Provider: "env", Reason: envvars.CliTenantAccessToken + " is set but " + envvars.CliAppID + " is missing"}
+			return nil, &credential.BlockError{Provider: "env", Reason: envnames.CliTenantAccessToken + " is set but " + envnames.CliAppID + " is missing"}
 		default:
 			return nil, nil
 		}
 	}
 	if appID == "" {
-		return nil, &credential.BlockError{Provider: "env", Reason: envvars.CliAppSecret + " is set but " + envvars.CliAppID + " is missing"}
+		return nil, &credential.BlockError{Provider: "env", Reason: envnames.CliAppSecret + " is set but " + envnames.CliAppID + " is missing"}
 	}
 	if appSecret == "" && !hasUAT && !hasTAT {
 		return nil, &credential.BlockError{
 			Provider: "env",
-			Reason:   envvars.CliAppID + " is set but no app secret or access token is available",
+			Reason:   envnames.CliAppID + " is set but no app secret or access token is available",
 		}
 	}
-	brand := credential.Brand(core.ParseBrand(os.Getenv(envvars.CliBrand)))
+	brand := parseBrand(os.Getenv(envnames.CliBrand))
 	acct := &credential.Account{AppID: appID, AppSecret: appSecret, Brand: brand}
 
-	switch id := credential.Identity(os.Getenv(envvars.CliDefaultAs)); id {
+	switch id := credential.Identity(os.Getenv(envnames.CliDefaultAs)); id {
 	case "", credential.IdentityAuto:
 		acct.DefaultAs = id
 	case credential.IdentityUser, credential.IdentityBot:
@@ -53,12 +53,12 @@ func (p *Provider) ResolveAccount(ctx context.Context) (*credential.Account, err
 	default:
 		return nil, &credential.BlockError{
 			Provider: "env",
-			Reason:   fmt.Sprintf("invalid %s %q (want user, bot, or auto)", envvars.CliDefaultAs, id),
+			Reason:   fmt.Sprintf("invalid %s %q (want user, bot, or auto)", envnames.CliDefaultAs, id),
 		}
 	}
 
 	// Explicit strict mode policy takes priority
-	switch strictMode := os.Getenv(envvars.CliStrictMode); strictMode {
+	switch strictMode := os.Getenv(envnames.CliStrictMode); strictMode {
 	case "bot":
 		acct.SupportedIdentities = credential.SupportsBot
 	case "user":
@@ -76,7 +76,7 @@ func (p *Provider) ResolveAccount(ctx context.Context) (*credential.Account, err
 	default:
 		return nil, &credential.BlockError{
 			Provider: "env",
-			Reason:   fmt.Sprintf("invalid %s %q (want bot, user, or off)", envvars.CliStrictMode, strictMode),
+			Reason:   fmt.Sprintf("invalid %s %q (want bot, user, or off)", envnames.CliStrictMode, strictMode),
 		}
 	}
 
@@ -96,9 +96,9 @@ func (p *Provider) ResolveToken(ctx context.Context, req credential.TokenSpec) (
 	var envKey string
 	switch req.Type {
 	case credential.TokenTypeUAT:
-		envKey = envvars.CliUserAccessToken
+		envKey = envnames.CliUserAccessToken
 	case credential.TokenTypeTAT:
-		envKey = envvars.CliTenantAccessToken
+		envKey = envnames.CliTenantAccessToken
 	default:
 		return nil, nil
 	}
@@ -109,6 +109,13 @@ func (p *Provider) ResolveToken(ctx context.Context, req credential.TokenSpec) (
 	return &credential.Token{Value: token, Source: "env:" + envKey}, nil
 }
 
+func parseBrand(value string) credential.Brand {
+	if strings.ToLower(strings.TrimSpace(value)) == "lark" {
+		return credential.BrandLark
+	}
+	return credential.BrandFeishu
+}
+
 func init() {
 	credential.Register(&Provider{})
 }
diff --git a/extension/credential/env/env_test.go b/extension/credential/env/env_test.go
index 096bd9fe29..15d069685c 100644
--- a/extension/credential/env/env_test.go
+++ b/extension/credential/env/env_test.go
@@ -9,8 +9,8 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/envvars"
 )
 
 func TestProvider_Name(t *testing.T) {
@@ -20,9 +20,9 @@ func TestProvider_Name(t *testing.T) {
 }
 
 func TestResolveAccount_BothSet(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "cli_test")
-	t.Setenv(envvars.CliAppSecret, "secret_test")
-	t.Setenv(envvars.CliBrand, " LARK ")
+	t.Setenv(envnames.CliAppID, "cli_test")
+	t.Setenv(envnames.CliAppSecret, "secret_test")
+	t.Setenv(envnames.CliBrand, " LARK ")
 
 	acct, err := (&Provider{}).ResolveAccount(context.Background())
 	if err != nil {
@@ -41,7 +41,7 @@ func TestResolveAccount_NeitherSet(t *testing.T) {
 }
 
 func TestResolveAccount_OnlyIDSet(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "cli_test")
+	t.Setenv(envnames.CliAppID, "cli_test")
 	_, err := (&Provider{}).ResolveAccount(context.Background())
 	var blockErr *credential.BlockError
 	if !errors.As(err, &blockErr) {
@@ -50,8 +50,8 @@ func TestResolveAccount_OnlyIDSet(t *testing.T) {
 }
 
 func TestResolveAccount_AppIDAndUserTokenWithoutSecret(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "cli_test")
-	t.Setenv(envvars.CliUserAccessToken, "uat_test")
+	t.Setenv(envnames.CliAppID, "cli_test")
+	t.Setenv(envnames.CliUserAccessToken, "uat_test")
 
 	acct, err := (&Provider{}).ResolveAccount(context.Background())
 	if err != nil {
@@ -69,7 +69,7 @@ func TestResolveAccount_AppIDAndUserTokenWithoutSecret(t *testing.T) {
 }
 
 func TestResolveAccount_OnlySecretSet(t *testing.T) {
-	t.Setenv(envvars.CliAppSecret, "secret_test")
+	t.Setenv(envnames.CliAppSecret, "secret_test")
 	_, err := (&Provider{}).ResolveAccount(context.Background())
 	var blockErr *credential.BlockError
 	if !errors.As(err, &blockErr) {
@@ -78,21 +78,21 @@ func TestResolveAccount_OnlySecretSet(t *testing.T) {
 }
 
 func TestResolveAccount_OnlyTokenSetWithoutAppID(t *testing.T) {
-	t.Setenv(envvars.CliUserAccessToken, "uat_test")
+	t.Setenv(envnames.CliUserAccessToken, "uat_test")
 
 	_, err := (&Provider{}).ResolveAccount(context.Background())
 	var blockErr *credential.BlockError
 	if !errors.As(err, &blockErr) {
 		t.Fatalf("expected BlockError, got %v", err)
 	}
-	if !strings.Contains(err.Error(), envvars.CliAppID) {
-		t.Fatalf("error = %v, want mention of %s", err, envvars.CliAppID)
+	if !strings.Contains(err.Error(), envnames.CliAppID) {
+		t.Fatalf("error = %v, want mention of %s", err, envnames.CliAppID)
 	}
 }
 
 func TestResolveAccount_DefaultBrand(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "cli_test")
-	t.Setenv(envvars.CliAppSecret, "secret_test")
+	t.Setenv(envnames.CliAppID, "cli_test")
+	t.Setenv(envnames.CliAppSecret, "secret_test")
 	acct, _ := (&Provider{}).ResolveAccount(context.Background())
 	if acct.Brand != "feishu" {
 		t.Errorf("expected 'feishu', got %q", acct.Brand)
@@ -100,9 +100,9 @@ func TestResolveAccount_DefaultBrand(t *testing.T) {
 }
 
 func TestResolveAccount_DefaultAsFromEnv(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "cli_test")
-	t.Setenv(envvars.CliAppSecret, "secret_test")
-	t.Setenv(envvars.CliDefaultAs, "user")
+	t.Setenv(envnames.CliAppID, "cli_test")
+	t.Setenv(envnames.CliAppSecret, "secret_test")
+	t.Setenv(envnames.CliDefaultAs, "user")
 
 	acct, err := (&Provider{}).ResolveAccount(context.Background())
 	if err != nil {
@@ -114,23 +114,23 @@ func TestResolveAccount_DefaultAsFromEnv(t *testing.T) {
 }
 
 func TestResolveToken_UATSet(t *testing.T) {
-	t.Setenv(envvars.CliUserAccessToken, "u-env")
+	t.Setenv(envnames.CliUserAccessToken, "u-env")
 	tok, err := (&Provider{}).ResolveToken(context.Background(), credential.TokenSpec{Type: credential.TokenTypeUAT})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if tok.Value != "u-env" || tok.Source != "env:"+envvars.CliUserAccessToken {
+	if tok.Value != "u-env" || tok.Source != "env:"+envnames.CliUserAccessToken {
 		t.Errorf("unexpected: %+v", tok)
 	}
 }
 
 func TestResolveToken_TATSet(t *testing.T) {
-	t.Setenv(envvars.CliTenantAccessToken, "t-env")
+	t.Setenv(envnames.CliTenantAccessToken, "t-env")
 	tok, err := (&Provider{}).ResolveToken(context.Background(), credential.TokenSpec{Type: credential.TokenTypeTAT})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if tok.Value != "t-env" || tok.Source != "env:"+envvars.CliTenantAccessToken {
+	if tok.Value != "t-env" || tok.Source != "env:"+envnames.CliTenantAccessToken {
 		t.Errorf("unexpected: %+v", tok)
 	}
 }
@@ -143,9 +143,9 @@ func TestResolveToken_NotSet(t *testing.T) {
 }
 
 func TestResolveAccount_StrictModeBot(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "app")
-	t.Setenv(envvars.CliAppSecret, "secret")
-	t.Setenv(envvars.CliStrictMode, "bot")
+	t.Setenv(envnames.CliAppID, "app")
+	t.Setenv(envnames.CliAppSecret, "secret")
+	t.Setenv(envnames.CliStrictMode, "bot")
 	acct, err := (&Provider{}).ResolveAccount(context.Background())
 	if err != nil {
 		t.Fatal(err)
@@ -156,9 +156,9 @@ func TestResolveAccount_StrictModeBot(t *testing.T) {
 }
 
 func TestResolveAccount_StrictModeUser(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "app")
-	t.Setenv(envvars.CliAppSecret, "secret")
-	t.Setenv(envvars.CliStrictMode, "user")
+	t.Setenv(envnames.CliAppID, "app")
+	t.Setenv(envnames.CliAppSecret, "secret")
+	t.Setenv(envnames.CliStrictMode, "user")
 	acct, err := (&Provider{}).ResolveAccount(context.Background())
 	if err != nil {
 		t.Fatal(err)
@@ -169,9 +169,9 @@ func TestResolveAccount_StrictModeUser(t *testing.T) {
 }
 
 func TestResolveAccount_StrictModeOff(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "app")
-	t.Setenv(envvars.CliAppSecret, "secret")
-	t.Setenv(envvars.CliStrictMode, "off")
+	t.Setenv(envnames.CliAppID, "app")
+	t.Setenv(envnames.CliAppSecret, "secret")
+	t.Setenv(envnames.CliStrictMode, "off")
 	acct, err := (&Provider{}).ResolveAccount(context.Background())
 	if err != nil {
 		t.Fatal(err)
@@ -182,9 +182,9 @@ func TestResolveAccount_StrictModeOff(t *testing.T) {
 }
 
 func TestResolveAccount_InferFromUATOnly(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "app")
-	t.Setenv(envvars.CliAppSecret, "secret")
-	t.Setenv(envvars.CliUserAccessToken, "u-tok")
+	t.Setenv(envnames.CliAppID, "app")
+	t.Setenv(envnames.CliAppSecret, "secret")
+	t.Setenv(envnames.CliUserAccessToken, "u-tok")
 	acct, err := (&Provider{}).ResolveAccount(context.Background())
 	if err != nil {
 		t.Fatal(err)
@@ -198,9 +198,9 @@ func TestResolveAccount_InferFromUATOnly(t *testing.T) {
 }
 
 func TestResolveAccount_InferFromTATOnly(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "app")
-	t.Setenv(envvars.CliAppSecret, "secret")
-	t.Setenv(envvars.CliTenantAccessToken, "t-tok")
+	t.Setenv(envnames.CliAppID, "app")
+	t.Setenv(envnames.CliAppSecret, "secret")
+	t.Setenv(envnames.CliTenantAccessToken, "t-tok")
 	acct, err := (&Provider{}).ResolveAccount(context.Background())
 	if err != nil {
 		t.Fatal(err)
@@ -214,10 +214,10 @@ func TestResolveAccount_InferFromTATOnly(t *testing.T) {
 }
 
 func TestResolveAccount_InferBothTokens(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "app")
-	t.Setenv(envvars.CliAppSecret, "secret")
-	t.Setenv(envvars.CliUserAccessToken, "u-tok")
-	t.Setenv(envvars.CliTenantAccessToken, "t-tok")
+	t.Setenv(envnames.CliAppID, "app")
+	t.Setenv(envnames.CliAppSecret, "secret")
+	t.Setenv(envnames.CliUserAccessToken, "u-tok")
+	t.Setenv(envnames.CliTenantAccessToken, "t-tok")
 	acct, err := (&Provider{}).ResolveAccount(context.Background())
 	if err != nil {
 		t.Fatal(err)
@@ -231,11 +231,11 @@ func TestResolveAccount_InferBothTokens(t *testing.T) {
 }
 
 func TestResolveAccount_StrictModeOverridesTokenInference(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "app")
-	t.Setenv(envvars.CliAppSecret, "secret")
-	t.Setenv(envvars.CliUserAccessToken, "u-tok")
-	t.Setenv(envvars.CliTenantAccessToken, "t-tok")
-	t.Setenv(envvars.CliStrictMode, "bot")
+	t.Setenv(envnames.CliAppID, "app")
+	t.Setenv(envnames.CliAppSecret, "secret")
+	t.Setenv(envnames.CliUserAccessToken, "u-tok")
+	t.Setenv(envnames.CliTenantAccessToken, "t-tok")
+	t.Setenv(envnames.CliStrictMode, "bot")
 	acct, err := (&Provider{}).ResolveAccount(context.Background())
 	if err != nil {
 		t.Fatal(err)
@@ -246,9 +246,9 @@ func TestResolveAccount_StrictModeOverridesTokenInference(t *testing.T) {
 }
 
 func TestResolveAccount_InvalidStrictModeRejected(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "app")
-	t.Setenv(envvars.CliAppSecret, "secret")
-	t.Setenv(envvars.CliStrictMode, "invalid")
+	t.Setenv(envnames.CliAppID, "app")
+	t.Setenv(envnames.CliAppSecret, "secret")
+	t.Setenv(envnames.CliStrictMode, "invalid")
 
 	_, err := (&Provider{}).ResolveAccount(context.Background())
 	if err == nil {
@@ -258,15 +258,15 @@ func TestResolveAccount_InvalidStrictModeRejected(t *testing.T) {
 	if !errors.As(err, &blockErr) {
 		t.Fatalf("expected BlockError, got %T", err)
 	}
-	if !strings.Contains(err.Error(), envvars.CliStrictMode) {
-		t.Fatalf("error = %v, want mention of %s", err, envvars.CliStrictMode)
+	if !strings.Contains(err.Error(), envnames.CliStrictMode) {
+		t.Fatalf("error = %v, want mention of %s", err, envnames.CliStrictMode)
 	}
 }
 
 func TestResolveAccount_InvalidDefaultAsRejected(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "app")
-	t.Setenv(envvars.CliAppSecret, "secret")
-	t.Setenv(envvars.CliDefaultAs, "invalid")
+	t.Setenv(envnames.CliAppID, "app")
+	t.Setenv(envnames.CliAppSecret, "secret")
+	t.Setenv(envnames.CliDefaultAs, "invalid")
 
 	_, err := (&Provider{}).ResolveAccount(context.Background())
 	if err == nil {
@@ -276,7 +276,7 @@ func TestResolveAccount_InvalidDefaultAsRejected(t *testing.T) {
 	if !errors.As(err, &blockErr) {
 		t.Fatalf("expected BlockError, got %T", err)
 	}
-	if !strings.Contains(err.Error(), envvars.CliDefaultAs) {
-		t.Fatalf("error = %v, want mention of %s", err, envvars.CliDefaultAs)
+	if !strings.Contains(err.Error(), envnames.CliDefaultAs) {
+		t.Fatalf("error = %v, want mention of %s", err, envnames.CliDefaultAs)
 	}
 }
diff --git a/extension/credential/sidecar/provider.go b/extension/credential/sidecar/provider.go
index d01f56616b..39a10583ed 100644
--- a/extension/credential/sidecar/provider.go
+++ b/extension/credential/sidecar/provider.go
@@ -14,10 +14,10 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"strings"
 
+	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/sidecar"
 )
 
@@ -32,7 +32,7 @@ func (p *Provider) Priority() int { return 0 }
 // placeholder secret, and SupportedIdentities derived from STRICT_MODE.
 // Returns nil, nil when sidecar mode is not active (AUTH_PROXY not set).
 func (p *Provider) ResolveAccount(ctx context.Context) (*credential.Account, error) {
-	proxyAddr := os.Getenv(envvars.CliAuthProxy)
+	proxyAddr := os.Getenv(envnames.CliAuthProxy)
 	if proxyAddr == "" {
 		return nil, nil // not in sidecar mode, skip
 	}
@@ -40,26 +40,26 @@ func (p *Provider) ResolveAccount(ctx context.Context) (*credential.Account, err
 	if err := sidecar.ValidateProxyAddr(proxyAddr); err != nil {
 		return nil, &credential.BlockError{
 			Provider: "sidecar",
-			Reason:   fmt.Sprintf("invalid %s %q: %v", envvars.CliAuthProxy, proxyAddr, err),
+			Reason:   fmt.Sprintf("invalid %s %q: %v", envnames.CliAuthProxy, proxyAddr, err),
 		}
 	}
 
-	appID := os.Getenv(envvars.CliAppID)
+	appID := os.Getenv(envnames.CliAppID)
 	if appID == "" {
 		return nil, &credential.BlockError{
 			Provider: "sidecar",
-			Reason:   envvars.CliAuthProxy + " is set but " + envvars.CliAppID + " is missing",
+			Reason:   envnames.CliAuthProxy + " is set but " + envnames.CliAppID + " is missing",
 		}
 	}
 
-	if os.Getenv(envvars.CliProxyKey) == "" {
+	if os.Getenv(envnames.CliProxyKey) == "" {
 		return nil, &credential.BlockError{
 			Provider: "sidecar",
-			Reason:   envvars.CliAuthProxy + " is set but " + envvars.CliProxyKey + " is missing",
+			Reason:   envnames.CliAuthProxy + " is set but " + envnames.CliProxyKey + " is missing",
 		}
 	}
 
-	brand := credential.Brand(core.ParseBrand(os.Getenv(envvars.CliBrand)))
+	brand := parseBrand(os.Getenv(envnames.CliBrand))
 
 	acct := &credential.Account{
 		AppID:     appID,
@@ -68,7 +68,7 @@ func (p *Provider) ResolveAccount(ctx context.Context) (*credential.Account, err
 	}
 
 	// Parse DefaultAs
-	switch id := credential.Identity(os.Getenv(envvars.CliDefaultAs)); id {
+	switch id := credential.Identity(os.Getenv(envnames.CliDefaultAs)); id {
 	case "", credential.IdentityAuto:
 		acct.DefaultAs = id
 	case credential.IdentityUser, credential.IdentityBot:
@@ -76,12 +76,12 @@ func (p *Provider) ResolveAccount(ctx context.Context) (*credential.Account, err
 	default:
 		return nil, &credential.BlockError{
 			Provider: "sidecar",
-			Reason:   fmt.Sprintf("invalid %s %q (want user, bot, or auto)", envvars.CliDefaultAs, id),
+			Reason:   fmt.Sprintf("invalid %s %q (want user, bot, or auto)", envnames.CliDefaultAs, id),
 		}
 	}
 
 	// Parse SupportedIdentities from STRICT_MODE, default to SupportsAll.
-	switch strictMode := os.Getenv(envvars.CliStrictMode); strictMode {
+	switch strictMode := os.Getenv(envnames.CliStrictMode); strictMode {
 	case "bot":
 		acct.SupportedIdentities = credential.SupportsBot
 	case "user":
@@ -91,7 +91,7 @@ func (p *Provider) ResolveAccount(ctx context.Context) (*credential.Account, err
 	default:
 		return nil, &credential.BlockError{
 			Provider: "sidecar",
-			Reason:   fmt.Sprintf("invalid %s %q (want bot, user, or off)", envvars.CliStrictMode, strictMode),
+			Reason:   fmt.Sprintf("invalid %s %q (want bot, user, or off)", envnames.CliStrictMode, strictMode),
 		}
 	}
 
@@ -103,7 +103,7 @@ func (p *Provider) ResolveAccount(ctx context.Context) (*credential.Account, err
 // (user vs bot), strips it, and the sidecar injects the real token.
 // Returns nil, nil when sidecar mode is not active.
 func (p *Provider) ResolveToken(ctx context.Context, req credential.TokenSpec) (*credential.Token, error) {
-	if os.Getenv(envvars.CliAuthProxy) == "" {
+	if os.Getenv(envnames.CliAuthProxy) == "" {
 		return nil, nil
 	}
 
@@ -124,6 +124,13 @@ func (p *Provider) ResolveToken(ctx context.Context, req credential.TokenSpec) (
 	}, nil
 }
 
+func parseBrand(value string) credential.Brand {
+	if strings.ToLower(strings.TrimSpace(value)) == "lark" {
+		return credential.BrandLark
+	}
+	return credential.BrandFeishu
+}
+
 func init() {
 	credential.Register(&Provider{})
 }
diff --git a/extension/credential/sidecar/provider_test.go b/extension/credential/sidecar/provider_test.go
index e265b5652f..7b1c6100a3 100644
--- a/extension/credential/sidecar/provider_test.go
+++ b/extension/credential/sidecar/provider_test.go
@@ -10,8 +10,8 @@ import (
 	"os"
 	"testing"
 
+	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/sidecar"
 )
 
@@ -40,7 +40,7 @@ func unsetEnv(t *testing.T, key string) {
 }
 
 func TestResolveAccount_NotActive(t *testing.T) {
-	unsetEnv(t, envvars.CliAuthProxy)
+	unsetEnv(t, envnames.CliAuthProxy)
 
 	p := &Provider{}
 	acct, err := p.ResolveAccount(context.Background())
@@ -53,12 +53,12 @@ func TestResolveAccount_NotActive(t *testing.T) {
 }
 
 func TestResolveAccount_Active(t *testing.T) {
-	setEnv(t, envvars.CliAuthProxy, "http://127.0.0.1:16384")
-	setEnv(t, envvars.CliProxyKey, "test-key")
-	setEnv(t, envvars.CliAppID, "cli_test123")
-	setEnv(t, envvars.CliBrand, " LARK ")
-	unsetEnv(t, envvars.CliDefaultAs)
-	unsetEnv(t, envvars.CliStrictMode)
+	setEnv(t, envnames.CliAuthProxy, "http://127.0.0.1:16384")
+	setEnv(t, envnames.CliProxyKey, "test-key")
+	setEnv(t, envnames.CliAppID, "cli_test123")
+	setEnv(t, envnames.CliBrand, " LARK ")
+	unsetEnv(t, envnames.CliDefaultAs)
+	unsetEnv(t, envnames.CliStrictMode)
 
 	p := &Provider{}
 	acct, err := p.ResolveAccount(context.Background())
@@ -83,9 +83,9 @@ func TestResolveAccount_Active(t *testing.T) {
 }
 
 func TestResolveAccount_MissingProxyKey(t *testing.T) {
-	setEnv(t, envvars.CliAuthProxy, "http://127.0.0.1:16384")
-	unsetEnv(t, envvars.CliProxyKey)
-	setEnv(t, envvars.CliAppID, "cli_test")
+	setEnv(t, envnames.CliAuthProxy, "http://127.0.0.1:16384")
+	unsetEnv(t, envnames.CliProxyKey)
+	setEnv(t, envnames.CliAppID, "cli_test")
 
 	p := &Provider{}
 	_, err := p.ResolveAccount(context.Background())
@@ -98,9 +98,9 @@ func TestResolveAccount_MissingProxyKey(t *testing.T) {
 }
 
 func TestResolveAccount_MissingAppID(t *testing.T) {
-	setEnv(t, envvars.CliAuthProxy, "http://127.0.0.1:16384")
-	setEnv(t, envvars.CliProxyKey, "test-key")
-	unsetEnv(t, envvars.CliAppID)
+	setEnv(t, envnames.CliAuthProxy, "http://127.0.0.1:16384")
+	setEnv(t, envnames.CliProxyKey, "test-key")
+	unsetEnv(t, envnames.CliAppID)
 
 	p := &Provider{}
 	_, err := p.ResolveAccount(context.Background())
@@ -113,9 +113,9 @@ func TestResolveAccount_MissingAppID(t *testing.T) {
 }
 
 func TestResolveAccount_StrictMode(t *testing.T) {
-	setEnv(t, envvars.CliAuthProxy, "http://127.0.0.1:16384")
-	setEnv(t, envvars.CliProxyKey, "test-key")
-	setEnv(t, envvars.CliAppID, "cli_test")
+	setEnv(t, envnames.CliAuthProxy, "http://127.0.0.1:16384")
+	setEnv(t, envnames.CliProxyKey, "test-key")
+	setEnv(t, envnames.CliAppID, "cli_test")
 
 	tests := []struct {
 		mode string
@@ -131,9 +131,9 @@ func TestResolveAccount_StrictMode(t *testing.T) {
 	for _, tt := range tests {
 		t.Run("strict_"+tt.mode, func(t *testing.T) {
 			if tt.mode == "" {
-				unsetEnv(t, envvars.CliStrictMode)
+				unsetEnv(t, envnames.CliStrictMode)
 			} else {
-				setEnv(t, envvars.CliStrictMode, tt.mode)
+				setEnv(t, envnames.CliStrictMode, tt.mode)
 			}
 			acct, err := p.ResolveAccount(context.Background())
 			if err != nil {
@@ -147,7 +147,7 @@ func TestResolveAccount_StrictMode(t *testing.T) {
 }
 
 func TestResolveToken_NotActive(t *testing.T) {
-	unsetEnv(t, envvars.CliAuthProxy)
+	unsetEnv(t, envnames.CliAuthProxy)
 
 	p := &Provider{}
 	tok, err := p.ResolveToken(context.Background(), credential.TokenSpec{Type: credential.TokenTypeUAT})
@@ -160,8 +160,8 @@ func TestResolveToken_NotActive(t *testing.T) {
 }
 
 func TestResolveToken_Sentinels(t *testing.T) {
-	setEnv(t, envvars.CliAuthProxy, "http://127.0.0.1:16384")
-	setEnv(t, envvars.CliProxyKey, "test-key")
+	setEnv(t, envnames.CliAuthProxy, "http://127.0.0.1:16384")
+	setEnv(t, envnames.CliProxyKey, "test-key")
 
 	p := &Provider{}
 
diff --git a/extension/transport/sidecar/interceptor.go b/extension/transport/sidecar/interceptor.go
index 6d928bd8a7..339dcf1d1e 100644
--- a/extension/transport/sidecar/interceptor.go
+++ b/extension/transport/sidecar/interceptor.go
@@ -20,8 +20,8 @@ import (
 	"os"
 	"strings"
 
+	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/extension/transport"
-	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/sidecar"
 )
 
@@ -36,15 +36,15 @@ func (p *Provider) Name() string { return "sidecar" }
 // the non-sidecar transport path (where the credential layer will typically
 // block them for lack of a valid account).
 func (p *Provider) ResolveInterceptor(ctx context.Context) transport.Interceptor {
-	proxyAddr := os.Getenv(envvars.CliAuthProxy)
+	proxyAddr := os.Getenv(envnames.CliAuthProxy)
 	if proxyAddr == "" {
 		return nil
 	}
 	if err := sidecar.ValidateProxyAddr(proxyAddr); err != nil {
-		fmt.Fprintf(os.Stderr, "WARNING: invalid %s, sidecar interceptor disabled: %v\n", envvars.CliAuthProxy, err)
+		fmt.Fprintf(os.Stderr, "WARNING: invalid %s, sidecar interceptor disabled: %v\n", envnames.CliAuthProxy, err)
 		return nil
 	}
-	key := os.Getenv(envvars.CliProxyKey)
+	key := os.Getenv(envnames.CliProxyKey)
 	return &Interceptor{
 		key:         []byte(key),
 		sidecarHost: sidecar.ProxyHost(proxyAddr),
@@ -166,12 +166,12 @@ func detectSentinel(req *http.Request) (identity, authHeader string) {
 }
 
 func init() {
-	proxyAddr := os.Getenv(envvars.CliAuthProxy)
+	proxyAddr := os.Getenv(envnames.CliAuthProxy)
 	if proxyAddr == "" {
 		return
 	}
 	if err := sidecar.ValidateProxyAddr(proxyAddr); err != nil {
-		fmt.Fprintf(os.Stderr, "WARNING: ignoring invalid %s: %v\n", envvars.CliAuthProxy, err)
+		fmt.Fprintf(os.Stderr, "WARNING: ignoring invalid %s: %v\n", envnames.CliAuthProxy, err)
 		return
 	}
 	transport.Register(&Provider{})
diff --git a/internal/cmdutil/factory_default_test.go b/internal/cmdutil/factory_default_test.go
index 1f47971ceb..94f9438128 100644
--- a/internal/cmdutil/factory_default_test.go
+++ b/internal/cmdutil/factory_default_test.go
@@ -8,12 +8,12 @@ import (
 	"errors"
 	"testing"
 
+	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/errs"
 	_ "github.com/larksuite/cli/extension/credential/env"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
-	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/internal/vfs/localfileio"
 )
 
@@ -29,10 +29,10 @@ func (p *countingFileIOProvider) ResolveFileIO(context.Context) fileio.FileIO {
 }
 
 func TestNewDefault_InvocationProfileUsedByStrictModeAndConfig(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "")
-	t.Setenv(envvars.CliAppSecret, "")
-	t.Setenv(envvars.CliUserAccessToken, "")
-	t.Setenv(envvars.CliTenantAccessToken, "")
+	t.Setenv(envnames.CliAppID, "")
+	t.Setenv(envnames.CliAppSecret, "")
+	t.Setenv(envnames.CliUserAccessToken, "")
+	t.Setenv(envnames.CliTenantAccessToken, "")
 
 	dir := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
@@ -77,10 +77,10 @@ func TestNewDefault_InvocationProfileUsedByStrictModeAndConfig(t *testing.T) {
 }
 
 func TestNewDefault_InvocationProfileMissingSticksAcrossEarlyStrictMode(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "")
-	t.Setenv(envvars.CliAppSecret, "")
-	t.Setenv(envvars.CliUserAccessToken, "")
-	t.Setenv(envvars.CliTenantAccessToken, "")
+	t.Setenv(envnames.CliAppID, "")
+	t.Setenv(envnames.CliAppSecret, "")
+	t.Setenv(envnames.CliUserAccessToken, "")
+	t.Setenv(envnames.CliTenantAccessToken, "")
 
 	dir := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
@@ -118,11 +118,11 @@ func TestNewDefault_InvocationProfileMissingSticksAcrossEarlyStrictMode(t *testi
 }
 
 func TestNewDefault_ResolveAs_UsesDefaultAsFromEnvAccount(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "env-app")
-	t.Setenv(envvars.CliAppSecret, "env-secret")
-	t.Setenv(envvars.CliDefaultAs, "user")
-	t.Setenv(envvars.CliUserAccessToken, "")
-	t.Setenv(envvars.CliTenantAccessToken, "")
+	t.Setenv(envnames.CliAppID, "env-app")
+	t.Setenv(envnames.CliAppSecret, "env-secret")
+	t.Setenv(envnames.CliDefaultAs, "user")
+	t.Setenv(envnames.CliUserAccessToken, "")
+	t.Setenv(envnames.CliTenantAccessToken, "")
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
 	f := NewDefault(nil, InvocationContext{})
@@ -138,11 +138,11 @@ func TestNewDefault_ResolveAs_UsesDefaultAsFromEnvAccount(t *testing.T) {
 }
 
 func TestNewDefault_ConfigReturnsCliConfigCopyOfCredentialAccount(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "env-app")
-	t.Setenv(envvars.CliAppSecret, "env-secret")
-	t.Setenv(envvars.CliDefaultAs, "")
-	t.Setenv(envvars.CliUserAccessToken, "uat-token")
-	t.Setenv(envvars.CliTenantAccessToken, "")
+	t.Setenv(envnames.CliAppID, "env-app")
+	t.Setenv(envnames.CliAppSecret, "env-secret")
+	t.Setenv(envnames.CliDefaultAs, "")
+	t.Setenv(envnames.CliUserAccessToken, "uat-token")
+	t.Setenv(envnames.CliTenantAccessToken, "")
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
 	f := NewDefault(nil, InvocationContext{})
@@ -163,11 +163,11 @@ func TestNewDefault_ConfigReturnsCliConfigCopyOfCredentialAccount(t *testing.T)
 }
 
 func TestNewDefault_ConfigUsesRuntimePlaceholderForTokenOnlyEnvAccount(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "env-app")
-	t.Setenv(envvars.CliAppSecret, "")
-	t.Setenv(envvars.CliDefaultAs, "")
-	t.Setenv(envvars.CliUserAccessToken, "uat-token")
-	t.Setenv(envvars.CliTenantAccessToken, "")
+	t.Setenv(envnames.CliAppID, "env-app")
+	t.Setenv(envnames.CliAppSecret, "")
+	t.Setenv(envnames.CliDefaultAs, "")
+	t.Setenv(envnames.CliUserAccessToken, "uat-token")
+	t.Setenv(envnames.CliTenantAccessToken, "")
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
 	f := NewDefault(nil, InvocationContext{})
diff --git a/internal/cmdutil/factory_proxy_warn_test.go b/internal/cmdutil/factory_proxy_warn_test.go
index ffdeb488fc..114e26303e 100644
--- a/internal/cmdutil/factory_proxy_warn_test.go
+++ b/internal/cmdutil/factory_proxy_warn_test.go
@@ -7,8 +7,8 @@ import (
 	"io"
 	"testing"
 
+	"github.com/larksuite/cli/envnames"
 	_ "github.com/larksuite/cli/extension/credential/env" // registers the env-backed account provider
-	"github.com/larksuite/cli/internal/envvars"
 )
 
 // installProxyWarnSpy replaces warnIfProxied with a counter for one test and
@@ -61,11 +61,11 @@ func TestCachedHttpClientFunc_ProxyWarnGate(t *testing.T) {
 func TestCachedLarkClientFunc_ProxyWarnGate(t *testing.T) {
 	for _, tc := range proxyWarnGateCases {
 		t.Run(tc.name, func(t *testing.T) {
-			t.Setenv(envvars.CliAppID, "env-app")
-			t.Setenv(envvars.CliAppSecret, "env-secret")
-			t.Setenv(envvars.CliDefaultAs, "")
-			t.Setenv(envvars.CliUserAccessToken, "")
-			t.Setenv(envvars.CliTenantAccessToken, "")
+			t.Setenv(envnames.CliAppID, "env-app")
+			t.Setenv(envnames.CliAppSecret, "env-secret")
+			t.Setenv(envnames.CliDefaultAs, "")
+			t.Setenv(envnames.CliUserAccessToken, "")
+			t.Setenv(envnames.CliTenantAccessToken, "")
 			t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
 			calls := installProxyWarnSpy(t)
diff --git a/internal/cmdutil/factory_test.go b/internal/cmdutil/factory_test.go
index 97eed80975..829c8722fc 100644
--- a/internal/cmdutil/factory_test.go
+++ b/internal/cmdutil/factory_test.go
@@ -11,11 +11,11 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
-	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/internal/output"
 )
 
@@ -92,7 +92,7 @@ func TestResolveAs_DefaultAs_FromConfig(t *testing.T) {
 }
 
 func TestResolveAs_DefaultAs_EnvDoesNotBypassConfigSource(t *testing.T) {
-	t.Setenv(envvars.CliDefaultAs, "user")
+	t.Setenv(envnames.CliDefaultAs, "user")
 
 	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
 	cmd := newCmdWithAsFlag("auto", false)
diff --git a/internal/credential/integration_test.go b/internal/credential/integration_test.go
index de173d1948..e462cf6232 100644
--- a/internal/credential/integration_test.go
+++ b/internal/credential/integration_test.go
@@ -7,11 +7,11 @@ import (
 	"context"
 	"testing"
 
+	"github.com/larksuite/cli/envnames"
 	extcred "github.com/larksuite/cli/extension/credential"
 	envprovider "github.com/larksuite/cli/extension/credential/env"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
-	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/keychain"
 )
@@ -23,9 +23,9 @@ func (n *noopKC) Set(service, account, value string) error    { return nil }
 func (n *noopKC) Remove(service, account string) error        { return nil }
 
 func TestFullChain_EnvWins(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "env_app")
-	t.Setenv(envvars.CliAppSecret, "env_secret")
-	t.Setenv(envvars.CliUserAccessToken, "env_uat")
+	t.Setenv(envnames.CliAppID, "env_app")
+	t.Setenv(envnames.CliAppSecret, "env_secret")
+	t.Setenv(envnames.CliUserAccessToken, "env_uat")
 
 	ep := &envprovider.Provider{}
 	cp := credential.NewCredentialProvider(
@@ -82,8 +82,8 @@ func (m *mockDefaultTokenProvider) ResolveToken(ctx context.Context, req credent
 }
 
 func TestFullChain_ConfigStrictMode(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "")
-	t.Setenv(envvars.CliAppSecret, "")
+	t.Setenv(envnames.CliAppID, "")
+	t.Setenv(envnames.CliAppSecret, "")
 	dir := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
 
@@ -125,8 +125,8 @@ func TestFullChain_ConfigStrictMode(t *testing.T) {
 // consumers (mail signature, etc.) silently fall back to defaults — defeating
 // the whole point of persisting --lang.
 func TestFullChain_LangSurvivesProductionPath(t *testing.T) {
-	t.Setenv(envvars.CliAppID, "")
-	t.Setenv(envvars.CliAppSecret, "")
+	t.Setenv(envnames.CliAppID, "")
+	t.Setenv(envnames.CliAppSecret, "")
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
 	multi := &core.MultiAppConfig{
diff --git a/internal/envvars/envvars.go b/internal/envvars/envvars.go
index 36b60e42d5..fc90a52f15 100644
--- a/internal/envvars/envvars.go
+++ b/internal/envvars/envvars.go
@@ -4,22 +4,9 @@
 package envvars
 
 const (
-	CliAppID             = "LARKSUITE_CLI_APP_ID"
-	CliAppSecret         = "LARKSUITE_CLI_APP_SECRET"
-	CliBrand             = "LARKSUITE_CLI_BRAND"
-	CliUserAccessToken   = "LARKSUITE_CLI_USER_ACCESS_TOKEN"
-	CliTenantAccessToken = "LARKSUITE_CLI_TENANT_ACCESS_TOKEN"
-	CliDefaultAs         = "LARKSUITE_CLI_DEFAULT_AS"
-	CliStrictMode        = "LARKSUITE_CLI_STRICT_MODE"
-
-	// Sidecar proxy (auth proxy mode)
-	CliAuthProxy = "LARKSUITE_CLI_AUTH_PROXY" // sidecar HTTP address, e.g. "http://127.0.0.1:16384"
-	CliProxyKey  = "LARKSUITE_CLI_PROXY_KEY"  // HMAC signing key shared with sidecar
-
 	// Content safety scanning mode
 	CliContentSafetyMode = "LARKSUITE_CLI_CONTENT_SAFETY_MODE"
 
-	CliAgentName  = "LARKSUITE_CLI_AGENT_NAME"
 	CliAgentTrace = "LARKSUITE_CLI_AGENT_TRACE"
 
 	CliProxyEnable  = "LARKSUITE_CLI_PROXY_ENABLE"
diff --git a/internal/envvars/read.go b/internal/envvars/read.go
index 34868386cd..e2a9d52315 100644
--- a/internal/envvars/read.go
+++ b/internal/envvars/read.go
@@ -10,12 +10,13 @@ import (
 )
 
 const (
+	agentNameEnv     = "LARKSUITE_CLI_AGENT_NAME"
 	agentNameMaxLen  = 128
 	agentTraceMaxLen = 1024
 )
 
 func AgentName() string {
-	return sanitizeSingleLine(os.Getenv(CliAgentName), agentNameMaxLen)
+	return sanitizeSingleLine(os.Getenv(agentNameEnv), agentNameMaxLen)
 }
 
 func AgentTrace() string {
diff --git a/internal/envvars/read_test.go b/internal/envvars/read_test.go
index 39903e17bf..a28277ad92 100644
--- a/internal/envvars/read_test.go
+++ b/internal/envvars/read_test.go
@@ -9,35 +9,35 @@ import (
 )
 
 func TestAgentName_EmptyWhenEnvUnset(t *testing.T) {
-	t.Setenv(CliAgentName, "")
+	t.Setenv(agentNameEnv, "")
 	if got := AgentName(); got != "" {
 		t.Fatalf("AgentName() = %q, want empty when env unset", got)
 	}
 }
 
 func TestAgentName_ReturnsCleanValue(t *testing.T) {
-	t.Setenv(CliAgentName, "claude-code")
+	t.Setenv(agentNameEnv, "claude-code")
 	if got := AgentName(); got != "claude-code" {
 		t.Fatalf("AgentName() = %q, want %q", got, "claude-code")
 	}
 }
 
 func TestAgentName_TrimsWhitespace(t *testing.T) {
-	t.Setenv(CliAgentName, "  cursor  ")
+	t.Setenv(agentNameEnv, "  cursor  ")
 	if got := AgentName(); got != "cursor" {
 		t.Fatalf("AgentName() = %q, want %q (whitespace trimmed)", got, "cursor")
 	}
 }
 
 func TestAgentName_RejectsCRLFInjection(t *testing.T) {
-	t.Setenv(CliAgentName, "agent\r\nX-Evil: attack")
+	t.Setenv(agentNameEnv, "agent\r\nX-Evil: attack")
 	if got := AgentName(); got != "" {
 		t.Fatalf("AgentName() = %q, want empty for CR/LF value", got)
 	}
 }
 
 func TestAgentName_RejectsControlChar(t *testing.T) {
-	t.Setenv(CliAgentName, "agent\x01injected")
+	t.Setenv(agentNameEnv, "agent\x01injected")
 	if got := AgentName(); got != "" {
 		t.Fatalf("AgentName() = %q, want empty for control char value", got)
 	}
@@ -45,7 +45,7 @@ func TestAgentName_RejectsControlChar(t *testing.T) {
 
 func TestAgentName_RejectsOverlongValue(t *testing.T) {
 	longVal := strings.Repeat("a", agentNameMaxLen+1)
-	t.Setenv(CliAgentName, longVal)
+	t.Setenv(agentNameEnv, longVal)
 	if got := AgentName(); got != "" {
 		t.Fatalf("AgentName() returned non-empty for %d-byte value (max %d)", len(longVal), agentNameMaxLen)
 	}
diff --git a/internal/qualitygate/deptest/layering-edges.txt b/internal/qualitygate/deptest/layering-edges.txt
index 5301b6aaa2..4bf0bc39e0 100644
--- a/internal/qualitygate/deptest/layering-edges.txt
+++ b/internal/qualitygate/deptest/layering-edges.txt
@@ -1,21 +1,4 @@
 # from	denied	owner	reason	added_at
-github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/charcheck	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/core	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/envvars	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/i18n	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/keychain	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/validate	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/vfs	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/vfs/localfileio	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/charcheck	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/core	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/envvars	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/i18n	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/keychain	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/validate	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/vfs	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/vfs/localfileio	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
-github.com/larksuite/cli/extension/transport/sidecar	github.com/larksuite/cli/internal/envvars	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
 github.com/larksuite/cli/events	github.com/larksuite/cli/shortcuts/im/convert_lib	arch-migration	events root aggregates the existing im conversion dependency	2026-07-24
 github.com/larksuite/cli/events	github.com/larksuite/cli/shortcuts/common	arch-migration	events root aggregates the existing im conversion dependency	2026-07-24
 github.com/larksuite/cli/events/im	github.com/larksuite/cli/shortcuts/im/convert_lib	arch-migration	events->shortcuts inversion via convert_lib	2026-07-24
diff --git a/main_noauthsidecar.go b/main_noauthsidecar.go
index 514afda63d..28baa22972 100644
--- a/main_noauthsidecar.go
+++ b/main_noauthsidecar.go
@@ -21,7 +21,7 @@ import (
 	"io"
 	"os"
 
-	"github.com/larksuite/cli/internal/envvars"
+	"github.com/larksuite/cli/envnames"
 )
 
 func init() {
@@ -35,7 +35,7 @@ func init() {
 // isolation that this binary cannot provide. Factored out from init() so
 // tests can exercise the decision without actually calling os.Exit.
 func checkNoAuthsidecarBuild(getenv func(string) string, stderr io.Writer) int {
-	v := getenv(envvars.CliAuthProxy)
+	v := getenv(envnames.CliAuthProxy)
 	if v == "" {
 		return 0
 	}
@@ -49,6 +49,6 @@ func checkNoAuthsidecarBuild(getenv func(string) string, stderr io.Writer) int {
 			"To fix, either:\n"+
 			"  - rebuild the CLI with: go build -tags authsidecar\n"+
 			"  - or unset %s if sidecar isolation is not required\n",
-		envvars.CliAuthProxy, envvars.CliAuthProxy)
+		envnames.CliAuthProxy, envnames.CliAuthProxy)
 	return 2
 }
diff --git a/main_noauthsidecar_test.go b/main_noauthsidecar_test.go
index 5879015c25..7747aa9a49 100644
--- a/main_noauthsidecar_test.go
+++ b/main_noauthsidecar_test.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/larksuite/cli/internal/envvars"
+	"github.com/larksuite/cli/envnames"
 )
 
 func TestCheckNoAuthsidecarBuild_Unset(t *testing.T) {
@@ -30,7 +30,7 @@ func TestCheckNoAuthsidecarBuild_Unset(t *testing.T) {
 func TestCheckNoAuthsidecarBuild_Set(t *testing.T) {
 	var stderr bytes.Buffer
 	env := func(k string) string {
-		if k == envvars.CliAuthProxy {
+		if k == envnames.CliAuthProxy {
 			return "http://127.0.0.1:16384"
 		}
 		return ""
@@ -41,7 +41,7 @@ func TestCheckNoAuthsidecarBuild_Set(t *testing.T) {
 	}
 	msg := stderr.String()
 	for _, want := range []string{
-		envvars.CliAuthProxy,
+		envnames.CliAuthProxy,
 		"authsidecar", // build-tag name must appear so operators can act on it
 		"rebuild",
 	} {
diff --git a/sidecar/server-demo/handler_test.go b/sidecar/server-demo/handler_test.go
index edd2446fef..25ce6c3552 100644
--- a/sidecar/server-demo/handler_test.go
+++ b/sidecar/server-demo/handler_test.go
@@ -17,10 +17,10 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/envnames"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
-	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/sidecar"
 )
 
@@ -410,13 +410,13 @@ func TestProxyHandler_AcceptsAllowedAuthHeaders(t *testing.T) {
 }
 
 func TestRun_RejectsSelfProxy(t *testing.T) {
-	old, had := os.LookupEnv(envvars.CliAuthProxy)
-	os.Setenv(envvars.CliAuthProxy, "http://127.0.0.1:16384")
+	old, had := os.LookupEnv(envnames.CliAuthProxy)
+	os.Setenv(envnames.CliAuthProxy, "http://127.0.0.1:16384")
 	defer func() {
 		if had {
-			os.Setenv(envvars.CliAuthProxy, old)
+			os.Setenv(envnames.CliAuthProxy, old)
 		} else {
-			os.Unsetenv(envvars.CliAuthProxy)
+			os.Unsetenv(envnames.CliAuthProxy)
 		}
 	}()
 
@@ -424,8 +424,8 @@ func TestRun_RejectsSelfProxy(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error when AUTH_PROXY is set")
 	}
-	if !strings.Contains(err.Error(), envvars.CliAuthProxy) {
-		t.Errorf("error should mention %s, got: %v", envvars.CliAuthProxy, err)
+	if !strings.Contains(err.Error(), envnames.CliAuthProxy) {
+		t.Errorf("error should mention %s, got: %v", envnames.CliAuthProxy, err)
 	}
 }
 
diff --git a/sidecar/server-demo/main.go b/sidecar/server-demo/main.go
index 7292daa263..1005655feb 100644
--- a/sidecar/server-demo/main.go
+++ b/sidecar/server-demo/main.go
@@ -28,9 +28,9 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/internal/vfs"
 	"github.com/larksuite/cli/sidecar"
 )
@@ -62,8 +62,8 @@ func run(ctx context.Context, listen, keyFile, logFile, profile string) error {
 	// Reject self-proxy: if this process inherited AUTH_PROXY, the sidecar
 	// credential provider would activate and return sentinel tokens instead
 	// of real ones, breaking the "trusted side holds real credentials" premise.
-	if v := os.Getenv(envvars.CliAuthProxy); v != "" {
-		return fmt.Errorf("%s is set in this environment (%s); unset it before starting the sidecar server", envvars.CliAuthProxy, v)
+	if v := os.Getenv(envnames.CliAuthProxy); v != "" {
+		return fmt.Errorf("%s is set in this environment (%s); unset it before starting the sidecar server", envnames.CliAuthProxy, v)
 	}
 	if listen == "" {
 		return fmt.Errorf("invalid --listen address: empty")
@@ -155,10 +155,10 @@ func run(ctx context.Context, listen, keyFile, logFile, profile string) error {
 	fmt.Fprintf(os.Stderr, "HMAC key prefix: %s\n", keyPrefix)
 	fmt.Fprintf(os.Stderr, "Full key written to %s (mode 0600)\n", keyFile)
 	fmt.Fprintf(os.Stderr, "\nSet in sandbox:\n")
-	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envvars.CliAuthProxy, proxyURL)
-	fmt.Fprintf(os.Stderr, "  export %s=\"<read from %s>\"\n", envvars.CliProxyKey, keyFile)
-	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envvars.CliAppID, cfg.AppID)
-	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envvars.CliBrand, string(cfg.Brand))
+	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envnames.CliAuthProxy, proxyURL)
+	fmt.Fprintf(os.Stderr, "  export %s=\"<read from %s>\"\n", envnames.CliProxyKey, keyFile)
+	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envnames.CliAppID, cfg.AppID)
+	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envnames.CliBrand, string(cfg.Brand))
 
 	if err := server.Serve(listener); err != nil && err != http.ErrServerClosed {
 		return fmt.Errorf("sidecar server exited unexpectedly: %v", err)
diff --git a/sidecar/server-multi-tenant-demo/handler_test.go b/sidecar/server-multi-tenant-demo/handler_test.go
index ffdd64e68d..10dd9d0f0c 100644
--- a/sidecar/server-multi-tenant-demo/handler_test.go
+++ b/sidecar/server-multi-tenant-demo/handler_test.go
@@ -19,10 +19,10 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/envnames"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
-	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/sidecar"
 )
 
@@ -412,7 +412,7 @@ func TestProxyHandler_AcceptsAllowedAuthHeaders(t *testing.T) {
 }
 
 func TestRun_RejectsSelfProxy(t *testing.T) {
-	t.Setenv(envvars.CliAuthProxy, "http://127.0.0.1:16384")
+	t.Setenv(envnames.CliAuthProxy, "http://127.0.0.1:16384")
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	keyPath := filepath.Join(t.TempDir(), "proxy.key")
 
@@ -420,8 +420,8 @@ func TestRun_RejectsSelfProxy(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error when AUTH_PROXY is set")
 	}
-	if !strings.Contains(err.Error(), envvars.CliAuthProxy) {
-		t.Errorf("error should mention %s, got: %v", envvars.CliAuthProxy, err)
+	if !strings.Contains(err.Error(), envnames.CliAuthProxy) {
+		t.Errorf("error should mention %s, got: %v", envnames.CliAuthProxy, err)
 	}
 }
 
diff --git a/sidecar/server-multi-tenant-demo/main.go b/sidecar/server-multi-tenant-demo/main.go
index 42b1551d77..0ea9f0757a 100644
--- a/sidecar/server-multi-tenant-demo/main.go
+++ b/sidecar/server-multi-tenant-demo/main.go
@@ -29,9 +29,9 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/internal/vfs"
 	"github.com/larksuite/cli/sidecar"
@@ -62,8 +62,8 @@ func defaultKeyFile() string {
 }
 
 func run(ctx context.Context, listen, keyFile, keysDir, logFile, profile string) error {
-	if v := os.Getenv(envvars.CliAuthProxy); v != "" {
-		return fmt.Errorf("%s is set in this environment (%s); unset it before starting the sidecar server", envvars.CliAuthProxy, v)
+	if v := os.Getenv(envnames.CliAuthProxy); v != "" {
+		return fmt.Errorf("%s is set in this environment (%s); unset it before starting the sidecar server", envnames.CliAuthProxy, v)
 	}
 	if listen == "" {
 		return fmt.Errorf("invalid --listen address: empty")
@@ -183,10 +183,10 @@ func run(ctx context.Context, listen, keyFile, keysDir, logFile, profile string)
 	fmt.Fprintf(os.Stderr, "Full key written to %s (mode 0600)\n", keyFile)
 	fmt.Fprintf(os.Stderr, "Client keys dir: %s\n", keysDir)
 	fmt.Fprintf(os.Stderr, "\nSet in sandbox:\n")
-	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envvars.CliAuthProxy, proxyURL)
-	fmt.Fprintf(os.Stderr, "  export %s=\"<read from %s>\"\n", envvars.CliProxyKey, keyFile)
-	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envvars.CliAppID, cfg.AppID)
-	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envvars.CliBrand, string(cfg.Brand))
+	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envnames.CliAuthProxy, proxyURL)
+	fmt.Fprintf(os.Stderr, "  export %s=\"<read from %s>\"\n", envnames.CliProxyKey, keyFile)
+	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envnames.CliAppID, cfg.AppID)
+	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envnames.CliBrand, string(cfg.Brand))
 
 	if err := server.Serve(listener); err != nil && err != http.ErrServerClosed {
 		return fmt.Errorf("sidecar server exited unexpectedly: %v", err)

From d62f8dcbe82624f9d575e0df6854cf862bec1b5c Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Sat, 25 Jul 2026 17:05:01 +0800
Subject: [PATCH 14/50] refactor(events): move message conversion below
 shortcuts

---
 events/im/message_receive.go                  |  8 +-
 .../imcontent}/card.go                        |  4 +-
 .../imcontent}/card_test.go                   |  2 +-
 .../imcontent}/card_userdsl.go                |  4 +-
 .../imcontent}/card_userdsl_test.go           |  2 +-
 internal/imcontent/convert.go                 | 93 +++++++++++++++++
 internal/imcontent/helpers.go                 | 99 +++++++++++++++++++
 .../imcontent}/media.go                       |  2 +-
 .../imcontent}/misc.go                        | 10 +-
 .../imcontent}/text.go                        |  7 +-
 .../imcontent}/text_test.go                   |  2 +-
 .../qualitygate/deptest/layering-edges.txt    |  4 -
 shortcuts/im/convert_lib/content_convert.go   | 46 +--------
 .../im/convert_lib/content_media_misc_test.go | 73 +++++++-------
 shortcuts/im/convert_lib/helpers.go           | 80 ++-------------
 shortcuts/im/convert_lib/merge.go             | 21 +---
 shortcuts/im/convert_lib/pure_adapters.go     | 27 +++++
 17 files changed, 292 insertions(+), 192 deletions(-)
 rename {shortcuts/im/convert_lib => internal/imcontent}/card.go (99%)
 rename {shortcuts/im/convert_lib => internal/imcontent}/card_test.go (99%)
 rename {shortcuts/im/convert_lib => internal/imcontent}/card_userdsl.go (99%)
 rename {shortcuts/im/convert_lib => internal/imcontent}/card_userdsl_test.go (99%)
 create mode 100644 internal/imcontent/convert.go
 create mode 100644 internal/imcontent/helpers.go
 rename {shortcuts/im/convert_lib => internal/imcontent}/media.go (99%)
 rename {shortcuts/im/convert_lib => internal/imcontent}/misc.go (97%)
 rename {shortcuts/im/convert_lib => internal/imcontent}/text.go (96%)
 rename {shortcuts/im/convert_lib => internal/imcontent}/text_test.go (99%)
 create mode 100644 shortcuts/im/convert_lib/pure_adapters.go

diff --git a/events/im/message_receive.go b/events/im/message_receive.go
index ae73021232..4d9ae4160a 100644
--- a/events/im/message_receive.go
+++ b/events/im/message_receive.go
@@ -8,7 +8,7 @@ import (
 	"encoding/json"
 
 	"github.com/larksuite/cli/internal/event"
-	convertlib "github.com/larksuite/cli/shortcuts/im/convert_lib"
+	"github.com/larksuite/cli/internal/imcontent"
 )
 
 // ImMessageReceiveOutput is the flattened shape for im.message.receive_v1; `desc` tags drive the reflected schema.
@@ -74,11 +74,11 @@ func processImMessageReceive(_ context.Context, _ event.APIClient, raw *event.Ra
 	msg := envelope.Event.Message
 	var content string
 	if msg.MessageType == "interactive" {
-		content = convertlib.ConvertInteractiveEventContent(msg.Content, msg.Mentions)
+		content = imcontent.ConvertInteractiveEventContent(msg.Content, msg.Mentions)
 	} else {
-		content = convertlib.ConvertBodyContent(msg.MessageType, &convertlib.ConvertContext{
+		content = imcontent.ConvertBodyContent(msg.MessageType, &imcontent.ConvertContext{
 			RawContent: msg.Content,
-			MentionMap: convertlib.BuildMentionKeyMap(msg.Mentions),
+			MentionMap: imcontent.BuildMentionKeyMap(msg.Mentions),
 		})
 	}
 
diff --git a/shortcuts/im/convert_lib/card.go b/internal/imcontent/card.go
similarity index 99%
rename from shortcuts/im/convert_lib/card.go
rename to internal/imcontent/card.go
index e58bf49595..635fb84e21 100644
--- a/shortcuts/im/convert_lib/card.go
+++ b/internal/imcontent/card.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package convertlib
+package imcontent
 
 import (
 	"encoding/json"
@@ -1639,7 +1639,7 @@ func (c *cardConverter) convertAt(prop cardObj) string {
 						if name, _ := mention["name"].(string); name != "" {
 							userName = name
 						}
-						if id := extractMentionOpenId(mention["id"]); id != "" {
+						if id := extractMentionOpenID(mention["id"]); id != "" {
 							actualUserID = id
 							fromMentions = true
 						}
diff --git a/shortcuts/im/convert_lib/card_test.go b/internal/imcontent/card_test.go
similarity index 99%
rename from shortcuts/im/convert_lib/card_test.go
rename to internal/imcontent/card_test.go
index 1c25486eaf..1f41f8eadd 100644
--- a/shortcuts/im/convert_lib/card_test.go
+++ b/internal/imcontent/card_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package convertlib
+package imcontent
 
 import (
 	"strings"
diff --git a/shortcuts/im/convert_lib/card_userdsl.go b/internal/imcontent/card_userdsl.go
similarity index 99%
rename from shortcuts/im/convert_lib/card_userdsl.go
rename to internal/imcontent/card_userdsl.go
index 62a0168079..bbf7e3bb77 100644
--- a/shortcuts/im/convert_lib/card_userdsl.go
+++ b/internal/imcontent/card_userdsl.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package convertlib
+package imcontent
 
 import (
 	"encoding/json"
@@ -39,7 +39,7 @@ func buildMentionAtMap(mentions []interface{}) map[string]string {
 		item, _ := raw.(map[string]interface{})
 		key, _ := item["key"].(string)
 		name, _ := item["name"].(string)
-		openID := extractMentionOpenId(item["id"])
+		openID := extractMentionOpenID(item["id"])
 		if key == "" {
 			continue
 		}
diff --git a/shortcuts/im/convert_lib/card_userdsl_test.go b/internal/imcontent/card_userdsl_test.go
similarity index 99%
rename from shortcuts/im/convert_lib/card_userdsl_test.go
rename to internal/imcontent/card_userdsl_test.go
index 6f73ea3f86..7e1f0f2f7f 100644
--- a/shortcuts/im/convert_lib/card_userdsl_test.go
+++ b/internal/imcontent/card_userdsl_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package convertlib
+package imcontent
 
 import (
 	"encoding/json"
diff --git a/internal/imcontent/convert.go b/internal/imcontent/convert.go
new file mode 100644
index 0000000000..25a688d43a
--- /dev/null
+++ b/internal/imcontent/convert.go
@@ -0,0 +1,93 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+// Package imcontent converts Lark message content into human-readable text.
+package imcontent
+
+import "fmt"
+
+// ContentConverter converts one message type's raw content.
+type ContentConverter interface {
+	Convert(ctx *ConvertContext) string
+}
+
+// ConvertContext contains the data needed by pure message conversion.
+type ConvertContext struct {
+	RawContent string
+	MentionMap map[string]string
+	Mentions   []interface{}
+}
+
+var converters = map[string]ContentConverter{
+	"text":                 textConverter{},
+	"post":                 postConverter{},
+	"image":                imageConverter{},
+	"file":                 fileConverter{},
+	"audio":                audioMsgConverter{},
+	"video":                videoMsgConverter{},
+	"media":                videoMsgConverter{},
+	"sticker":              stickerConverter{},
+	"interactive":          interactiveConverter{},
+	"share_chat":           shareChatConverter{},
+	"share_user":           shareUserConverter{},
+	"location":             locationConverter{},
+	"merge_forward":        mergeForwardConverter{},
+	"folder":               folderConverter{},
+	"share_calendar_event": calendarEventConverter{},
+	"calendar":             calendarInviteConverter{},
+	"general_calendar":     generalCalendarConverter{},
+	"video_chat":           videoChatConverter{},
+	"system":               systemConverter{},
+	"todo":                 todoConverter{},
+	"vote":                 voteConverter{},
+	"hongbao":              hongbaoConverter{},
+}
+
+// ConvertBodyContent converts a raw message body to human-readable text.
+func ConvertBodyContent(messageType string, ctx *ConvertContext) string {
+	if ctx == nil || ctx.RawContent == "" {
+		return ""
+	}
+	if converter, ok := converters[messageType]; ok {
+		return converter.Convert(ctx)
+	}
+	return fmt.Sprintf("[%s]", messageType)
+}
+
+type mergeForwardConverter struct{}
+
+func (mergeForwardConverter) Convert(ctx *ConvertContext) string {
+	ids := ParseMergeForwardIDs(ctx.RawContent)
+	if len(ids) > 0 {
+		return fmt.Sprintf("[Merged forward: %d messages]", len(ids))
+	}
+	return "[Merged forward]"
+}
+
+// ParseMergeForwardIDs extracts message IDs from merge_forward content.
+func ParseMergeForwardIDs(raw string) []string {
+	parsed, err := ParseJSONObject(raw)
+	if err != nil {
+		return nil
+	}
+	rawIDs, _ := parsed["create_message_ids"].([]interface{})
+	ids := make([]string, 0, len(rawIDs))
+	for _, rawID := range rawIDs {
+		if id, ok := rawID.(string); ok {
+			ids = append(ids, id)
+		}
+	}
+	return ids
+}
+
+func extractMentionOpenID(id interface{}) string {
+	switch value := id.(type) {
+	case string:
+		return value
+	case map[string]interface{}:
+		openID, _ := value["open_id"].(string)
+		return openID
+	default:
+		return ""
+	}
+}
diff --git a/internal/imcontent/helpers.go b/internal/imcontent/helpers.go
new file mode 100644
index 0000000000..7ae06d271c
--- /dev/null
+++ b/internal/imcontent/helpers.go
@@ -0,0 +1,99 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package imcontent
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// ParseJSONObject parses a raw JSON string into a map.
+func ParseJSONObject(raw string) (map[string]interface{}, error) {
+	var value map[string]interface{}
+	if err := json.Unmarshal([]byte(raw), &value); err != nil {
+		return nil, err
+	}
+	return value, nil
+}
+
+func invalidJSONPlaceholder(kind string) string {
+	if kind == "" {
+		return "[Invalid JSON content]"
+	}
+	return fmt.Sprintf("[Invalid %s JSON]", kind)
+}
+
+// BuildMentionKeyMap builds a key-to-name lookup from a message mentions array.
+func BuildMentionKeyMap(mentions []interface{}) map[string]string {
+	result := map[string]string{}
+	for _, raw := range mentions {
+		item, _ := raw.(map[string]interface{})
+		key, _ := item["key"].(string)
+		name, _ := item["name"].(string)
+		if key != "" && name != "" {
+			result[key] = name
+		}
+	}
+	return result
+}
+
+// ResolveMentionKeys replaces mention keys in text with @name format.
+func ResolveMentionKeys(text string, mentionMap map[string]string) string {
+	for key, name := range mentionMap {
+		text = strings.ReplaceAll(text, key, "@"+name)
+	}
+	return text
+}
+
+// FormatTimestamp converts a Unix timestamp string in seconds or milliseconds
+// to local time. It returns an empty string for empty or invalid values.
+func FormatTimestamp(timestamp string) string {
+	if timestamp == "" {
+		return ""
+	}
+	value, err := strconv.ParseInt(timestamp, 10, 64)
+	if err != nil || value == 0 {
+		return ""
+	}
+	if len(strings.TrimLeft(timestamp, "+-")) >= 13 {
+		value /= 1000
+	}
+	return time.Unix(value, 0).Local().Format("2006-01-02 15:04:05")
+}
+
+var xmlBodyEscaper = strings.NewReplacer(
+	"&", "&amp;",
+	"<", "&lt;",
+	">", "&gt;",
+)
+
+func xmlEscapeBody(value string) string {
+	return xmlBodyEscaper.Replace(value)
+}
+
+func escapeMDLinkText(value string) string {
+	value = strings.ReplaceAll(value, `[`, `\[`)
+	value = strings.ReplaceAll(value, `]`, `\]`)
+	return value
+}
+
+// ExtractPostBlocksText extracts plain text from post-style content blocks.
+func ExtractPostBlocksText(blocks []interface{}) string {
+	var lines []string
+	for _, paragraph := range blocks {
+		elements, _ := paragraph.([]interface{})
+		var builder strings.Builder
+		for _, raw := range elements {
+			element, _ := raw.(map[string]interface{})
+			builder.WriteString(renderPostElem(element))
+		}
+		if line := builder.String(); line != "" {
+			lines = append(lines, line)
+		}
+	}
+	return strings.Join(lines, "\n")
+}
diff --git a/shortcuts/im/convert_lib/media.go b/internal/imcontent/media.go
similarity index 99%
rename from shortcuts/im/convert_lib/media.go
rename to internal/imcontent/media.go
index 2bac70dc45..bbb295cf50 100644
--- a/shortcuts/im/convert_lib/media.go
+++ b/internal/imcontent/media.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package convertlib
+package imcontent
 
 import "fmt"
 
diff --git a/shortcuts/im/convert_lib/misc.go b/internal/imcontent/misc.go
similarity index 97%
rename from shortcuts/im/convert_lib/misc.go
rename to internal/imcontent/misc.go
index 9ee9c53f20..0fb8173cc5 100644
--- a/shortcuts/im/convert_lib/misc.go
+++ b/internal/imcontent/misc.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package convertlib
+package imcontent
 
 import (
 	"fmt"
@@ -133,8 +133,8 @@ func formatCalendarContent(parsed map[string]interface{}, tag, extraAttrs string
 		inner = append(inner, summary)
 	}
 
-	start := formatTimestamp(startTime)
-	end := formatTimestamp(endTime)
+	start := FormatTimestamp(startTime)
+	end := FormatTimestamp(endTime)
 	if start != "" && end != "" {
 		inner = append(inner, start+" ~ "+end)
 	} else if start != "" {
@@ -213,13 +213,13 @@ func (todoConverter) Convert(ctx *ConvertContext) string {
 			inner = append(inner, title)
 		}
 		if blocks, ok := summary["content"].([]interface{}); ok {
-			if text := extractPostBlocksText(blocks); text != "" {
+			if text := ExtractPostBlocksText(blocks); text != "" {
 				inner = append(inner, text)
 			}
 		}
 	}
 	if dueTime, _ := parsed["due_time"].(string); dueTime != "" {
-		if formatted := formatTimestamp(dueTime); formatted != "" {
+		if formatted := FormatTimestamp(dueTime); formatted != "" {
 			inner = append(inner, "Due: "+formatted)
 		}
 	}
diff --git a/shortcuts/im/convert_lib/text.go b/internal/imcontent/text.go
similarity index 96%
rename from shortcuts/im/convert_lib/text.go
rename to internal/imcontent/text.go
index c047be7fd7..4e643ea0fc 100644
--- a/shortcuts/im/convert_lib/text.go
+++ b/internal/imcontent/text.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package convertlib
+package imcontent
 
 import (
 	"fmt"
@@ -97,6 +97,11 @@ func unwrapPostLocale(parsed map[string]interface{}) map[string]interface{} {
 	return nil
 }
 
+// UnwrapPostLocale returns the post body for the first supported locale shape.
+func UnwrapPostLocale(parsed map[string]interface{}) map[string]interface{} {
+	return unwrapPostLocale(parsed)
+}
+
 // renderPostElem renders a single post (rich-text) element to its inline text
 // form: text/a/at carry their content through applyPostStyle for text.style
 // Markdown emphasis, emotion becomes :emoji_type:, md is passed through raw,
diff --git a/shortcuts/im/convert_lib/text_test.go b/internal/imcontent/text_test.go
similarity index 99%
rename from shortcuts/im/convert_lib/text_test.go
rename to internal/imcontent/text_test.go
index 235b5857cd..4df877d8a1 100644
--- a/shortcuts/im/convert_lib/text_test.go
+++ b/internal/imcontent/text_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package convertlib
+package imcontent
 
 import "testing"
 
diff --git a/internal/qualitygate/deptest/layering-edges.txt b/internal/qualitygate/deptest/layering-edges.txt
index 4bf0bc39e0..32daa463a4 100644
--- a/internal/qualitygate/deptest/layering-edges.txt
+++ b/internal/qualitygate/deptest/layering-edges.txt
@@ -1,8 +1,4 @@
 # from	denied	owner	reason	added_at
-github.com/larksuite/cli/events	github.com/larksuite/cli/shortcuts/im/convert_lib	arch-migration	events root aggregates the existing im conversion dependency	2026-07-24
-github.com/larksuite/cli/events	github.com/larksuite/cli/shortcuts/common	arch-migration	events root aggregates the existing im conversion dependency	2026-07-24
-github.com/larksuite/cli/events/im	github.com/larksuite/cli/shortcuts/im/convert_lib	arch-migration	events->shortcuts inversion via convert_lib	2026-07-24
-github.com/larksuite/cli/events/im	github.com/larksuite/cli/shortcuts/common	arch-migration	events->shortcuts inversion via convert_lib	2026-07-24
 github.com/larksuite/cli/shortcuts/im	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
 github.com/larksuite/cli/shortcuts/mail	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
 github.com/larksuite/cli/shortcuts/minutes	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
diff --git a/shortcuts/im/convert_lib/content_convert.go b/shortcuts/im/convert_lib/content_convert.go
index 1292b7d33c..1a1ee3fb5b 100644
--- a/shortcuts/im/convert_lib/content_convert.go
+++ b/shortcuts/im/convert_lib/content_convert.go
@@ -5,7 +5,6 @@ package convertlib
 
 import (
 	"encoding/json"
-	"fmt"
 	"math"
 	"net/url"
 	"reflect"
@@ -13,14 +12,10 @@ import (
 	"strings"
 
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/imcontent"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
-// ContentConverter defines the interface for converting a message type's raw content to human-readable text.
-type ContentConverter interface {
-	Convert(ctx *ConvertContext) string
-}
-
 // ConvertContext holds all context needed for content conversion.
 type ConvertContext struct {
 	RawContent string
@@ -45,45 +40,12 @@ type ConvertContext struct {
 	MergeForwardSubItems map[string][]map[string]interface{}
 }
 
-// converters maps message types to their ContentConverter implementations.
-var converters map[string]ContentConverter
-
-func init() {
-	converters = map[string]ContentConverter{
-		"text":                 textConverter{},
-		"post":                 postConverter{},
-		"image":                imageConverter{},
-		"file":                 fileConverter{},
-		"audio":                audioMsgConverter{},
-		"video":                videoMsgConverter{},
-		"media":                videoMsgConverter{},
-		"sticker":              stickerConverter{},
-		"interactive":          interactiveConverter{},
-		"share_chat":           shareChatConverter{},
-		"share_user":           shareUserConverter{},
-		"location":             locationConverter{},
-		"merge_forward":        mergeForwardConverter{},
-		"folder":               folderConverter{},
-		"share_calendar_event": calendarEventConverter{},
-		"calendar":             calendarInviteConverter{},
-		"general_calendar":     generalCalendarConverter{},
-		"video_chat":           videoChatConverter{},
-		"system":               systemConverter{},
-		"todo":                 todoConverter{},
-		"vote":                 voteConverter{},
-		"hongbao":              hongbaoConverter{},
-	}
-}
-
 // ConvertBodyContent converts body.content (a raw JSON string) to human-readable text.
 func ConvertBodyContent(msgType string, ctx *ConvertContext) string {
-	if ctx.RawContent == "" {
-		return ""
-	}
-	if c, ok := converters[msgType]; ok {
-		return c.Convert(ctx)
+	if msgType == "merge_forward" {
+		return (mergeForwardConverter{}).Convert(ctx)
 	}
-	return fmt.Sprintf("[%s]", msgType)
+	return imcontent.ConvertBodyContent(msgType, pureConvertContext(ctx))
 }
 
 // FormatEventMessage converts an event-pushed message to a human-readable map.
diff --git a/shortcuts/im/convert_lib/content_media_misc_test.go b/shortcuts/im/convert_lib/content_media_misc_test.go
index b6b2be25db..0fe7efd290 100644
--- a/shortcuts/im/convert_lib/content_media_misc_test.go
+++ b/shortcuts/im/convert_lib/content_media_misc_test.go
@@ -464,26 +464,26 @@ func TestExtractMentionOpenIdAndTruncateContent(t *testing.T) {
 }
 
 func TestMediaConverters(t *testing.T) {
-	if got := (imageConverter{}).Convert(&ConvertContext{RawContent: `{"image_key":"img_1"}`}); got != "[Image: img_1]" {
-		t.Fatalf("imageConverter.Convert() = %q", got)
+	if got := convertPureForTest("image", `{"image_key":"img_1"}`); got != "[Image: img_1]" {
+		t.Fatalf("ConvertBodyContent(image) = %q", got)
 	}
-	if got := (imageConverter{}).Convert(&ConvertContext{RawContent: `{invalid`}); got != "[Invalid image JSON]" {
-		t.Fatalf("imageConverter.Convert(invalid) = %q", got)
+	if got := convertPureForTest("image", `{invalid`); got != "[Invalid image JSON]" {
+		t.Fatalf("ConvertBodyContent(image invalid) = %q", got)
 	}
-	if got := (fileConverter{}).Convert(&ConvertContext{RawContent: `{"file_key":"file_1","file_name":"demo.pdf"}`}); got != `<file key="file_1" name="demo.pdf"/>` {
-		t.Fatalf("fileConverter.Convert() = %q", got)
+	if got := convertPureForTest("file", `{"file_key":"file_1","file_name":"demo.pdf"}`); got != `<file key="file_1" name="demo.pdf"/>` {
+		t.Fatalf("ConvertBodyContent(file) = %q", got)
 	}
-	if got := (fileConverter{}).Convert(&ConvertContext{RawContent: `{"file_key":"file_\"1","file_name":"demo\\\".pdf"}`}); got != `<file key="file_\"1" name="demo\\\".pdf"/>` {
-		t.Fatalf("fileConverter.Convert(escaped) = %q", got)
+	if got := convertPureForTest("file", `{"file_key":"file_\"1","file_name":"demo\\\".pdf"}`); got != `<file key="file_\"1" name="demo\\\".pdf"/>` {
+		t.Fatalf("ConvertBodyContent(file escaped) = %q", got)
 	}
-	if got := (audioMsgConverter{}).Convert(&ConvertContext{RawContent: `{"duration":3500}`}); got != "[Voice: 4s]" {
-		t.Fatalf("audioMsgConverter.Convert() = %q", got)
+	if got := convertPureForTest("audio", `{"duration":3500}`); got != "[Voice: 4s]" {
+		t.Fatalf("ConvertBodyContent(audio) = %q", got)
 	}
-	if got := (videoMsgConverter{}).Convert(&ConvertContext{RawContent: `{"file_key":"file_2","file_name":"clip.mp4","duration":5000,"image_key":"img_cover"}`}); got != `<video key="file_2" name="clip.mp4" duration="5s" cover_image_key="img_cover"/>` {
-		t.Fatalf("videoMsgConverter.Convert() = %q", got)
+	if got := convertPureForTest("video", `{"file_key":"file_2","file_name":"clip.mp4","duration":5000,"image_key":"img_cover"}`); got != `<video key="file_2" name="clip.mp4" duration="5s" cover_image_key="img_cover"/>` {
+		t.Fatalf("ConvertBodyContent(video) = %q", got)
 	}
-	if got := (videoMsgConverter{}).Convert(&ConvertContext{RawContent: `{"file_key":"file_\"2","file_name":"clip\\\".mp4","duration":5000,"image_key":"img_\"cover"}`}); got != `<video key="file_\"2" name="clip\\\".mp4" duration="5s" cover_image_key="img_\"cover"/>` {
-		t.Fatalf("videoMsgConverter.Convert(escaped) = %q", got)
+	if got := convertPureForTest("video", `{"file_key":"file_\"2","file_name":"clip\\\".mp4","duration":5000,"image_key":"img_\"cover"}`); got != `<video key="file_\"2" name="clip\\\".mp4" duration="5s" cover_image_key="img_\"cover"/>` {
+		t.Fatalf("ConvertBodyContent(video escaped) = %q", got)
 	}
 }
 
@@ -493,19 +493,19 @@ func TestMiscConverters(t *testing.T) {
 		got  string
 		want string
 	}{
-		{name: "sticker", got: (stickerConverter{}).Convert(nil), want: "[Sticker]"},
-		{name: "video chat", got: (videoChatConverter{}).Convert(nil), want: "[Video call]"},
-		{name: "share chat", got: (shareChatConverter{}).Convert(&ConvertContext{RawContent: `{"chat_id":"oc_1"}`}), want: "[Chat card: oc_1]"},
-		{name: "share user", got: (shareUserConverter{}).Convert(&ConvertContext{RawContent: `{"user_id":"ou_1"}`}), want: "[User card: ou_1]"},
-		{name: "location", got: (locationConverter{}).Convert(&ConvertContext{RawContent: `{"name":"Shanghai"}`}), want: "[Location: Shanghai]"},
-		{name: "folder", got: (folderConverter{}).Convert(&ConvertContext{RawContent: `{"file_key":"fld_1","file_name":"Docs"}`}), want: `<folder key="fld_1" name="Docs"/>`},
-		{name: "calendar share", got: (calendarEventConverter{}).Convert(&ConvertContext{RawContent: `{"summary":"Review","start_time":"1710500000","end_time":"1710503600","open_calendar_id":"cal_1","open_event_id":"evt_1"}`}), want: "<calendar_share open_calendar_id=\"cal_1\" open_event_id=\"evt_1\">\nReview\n" + formatTimestamp("1710500000") + " ~ " + formatTimestamp("1710503600") + "\n</calendar_share>"},
-		{name: "calendar invite", got: (calendarInviteConverter{}).Convert(&ConvertContext{RawContent: `{"summary":"Invite","start_time":"1710500000"}`}), want: "<calendar_invite>\nInvite\n" + formatTimestamp("1710500000") + "\n</calendar_invite>"},
-		{name: "general calendar", got: (generalCalendarConverter{}).Convert(&ConvertContext{RawContent: `{"summary":"All Hands"}`}), want: "<calendar>\nAll Hands\n</calendar>"},
-		{name: "vote", got: (voteConverter{}).Convert(&ConvertContext{RawContent: `{"topic":"Lunch","options":["A","B"],"status":1}`}), want: "<vote>\nLunch\n• A\n• B\n(Closed)\n</vote>"},
-		{name: "hongbao", got: (hongbaoConverter{}).Convert(&ConvertContext{RawContent: `{"text":"恭喜发财"}`}), want: `<hongbao text="恭喜发财"/>`},
-		{name: "system", got: (systemConverter{}).Convert(&ConvertContext{RawContent: `{"template":"{from_user} invited {to_chatters} to {name}","from_user":["Alice"],"to_chatters":["Bob","Carol"],"name":"Room A"}`}), want: "Alice invited Bob, Carol to Room A"},
-		{name: "invalid user card", got: (shareUserConverter{}).Convert(&ConvertContext{RawContent: `{invalid`}), want: "[Invalid user card JSON]"},
+		{name: "sticker", got: convertPureForTest("sticker", `{}`), want: "[Sticker]"},
+		{name: "video chat", got: convertPureForTest("video_chat", `{}`), want: "[Video call]"},
+		{name: "share chat", got: convertPureForTest("share_chat", `{"chat_id":"oc_1"}`), want: "[Chat card: oc_1]"},
+		{name: "share user", got: convertPureForTest("share_user", `{"user_id":"ou_1"}`), want: "[User card: ou_1]"},
+		{name: "location", got: convertPureForTest("location", `{"name":"Shanghai"}`), want: "[Location: Shanghai]"},
+		{name: "folder", got: convertPureForTest("folder", `{"file_key":"fld_1","file_name":"Docs"}`), want: `<folder key="fld_1" name="Docs"/>`},
+		{name: "calendar share", got: convertPureForTest("share_calendar_event", `{"summary":"Review","start_time":"1710500000","end_time":"1710503600","open_calendar_id":"cal_1","open_event_id":"evt_1"}`), want: "<calendar_share open_calendar_id=\"cal_1\" open_event_id=\"evt_1\">\nReview\n" + formatTimestamp("1710500000") + " ~ " + formatTimestamp("1710503600") + "\n</calendar_share>"},
+		{name: "calendar invite", got: convertPureForTest("calendar", `{"summary":"Invite","start_time":"1710500000"}`), want: "<calendar_invite>\nInvite\n" + formatTimestamp("1710500000") + "\n</calendar_invite>"},
+		{name: "general calendar", got: convertPureForTest("general_calendar", `{"summary":"All Hands"}`), want: "<calendar>\nAll Hands\n</calendar>"},
+		{name: "vote", got: convertPureForTest("vote", `{"topic":"Lunch","options":["A","B"],"status":1}`), want: "<vote>\nLunch\n• A\n• B\n(Closed)\n</vote>"},
+		{name: "hongbao", got: convertPureForTest("hongbao", `{"text":"恭喜发财"}`), want: `<hongbao text="恭喜发财"/>`},
+		{name: "system", got: convertPureForTest("system", `{"template":"{from_user} invited {to_chatters} to {name}","from_user":["Alice"],"to_chatters":["Bob","Carol"],"name":"Room A"}`), want: "Alice invited Bob, Carol to Room A"},
+		{name: "invalid user card", got: convertPureForTest("share_user", `{invalid`), want: "[Invalid user card JSON]"},
 	}
 
 	for _, tt := range tests {
@@ -517,6 +517,10 @@ func TestMiscConverters(t *testing.T) {
 	}
 }
 
+func convertPureForTest(messageType, rawContent string) string {
+	return ConvertBodyContent(messageType, &ConvertContext{RawContent: rawContent})
+}
+
 // TestFormatMessageItemResourcesGate verifies the resources block is only
 // emitted when extractResources is on; the default path (and back-compat
 // wrappers) must never add a resources key.
@@ -572,8 +576,8 @@ func TestAudioConverterFileKey(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := (audioMsgConverter{}).Convert(&ConvertContext{RawContent: tt.raw}); got != tt.want {
-				t.Fatalf("audioMsgConverter.Convert(%s) = %q, want %q", tt.name, got, tt.want)
+			if got := convertPureForTest("audio", tt.raw); got != tt.want {
+				t.Fatalf("ConvertBodyContent(audio %s) = %q, want %q", tt.name, got, tt.want)
 			}
 		})
 	}
@@ -582,18 +586,15 @@ func TestAudioConverterFileKey(t *testing.T) {
 // TestStickerUnchanged: DEC-001 default A keeps sticker rendering as [Sticker]
 // regardless of payload; sticker must never be enriched or downloaded.
 func TestStickerUnchanged(t *testing.T) {
-	if got := (stickerConverter{}).Convert(nil); got != "[Sticker]" {
-		t.Fatalf("stickerConverter.Convert(nil) = %q, want %q", got, "[Sticker]")
-	}
-	if got := (stickerConverter{}).Convert(&ConvertContext{RawContent: `{"file_key":"sticker_1"}`}); got != "[Sticker]" {
-		t.Fatalf("stickerConverter.Convert(with key) = %q, want %q", got, "[Sticker]")
+	if got := convertPureForTest("sticker", `{"file_key":"sticker_1"}`); got != "[Sticker]" {
+		t.Fatalf("ConvertBodyContent(sticker) = %q, want %q", got, "[Sticker]")
 	}
 }
 
 func TestTodoConverter(t *testing.T) {
-	got := (todoConverter{}).Convert(&ConvertContext{RawContent: `{"task_id":"task_1","summary":{"title":"Finish report","content":[[{"tag":"text","text":"prepare slides"}]]},"due_time":"1710500000"}`})
+	got := convertPureForTest("todo", `{"task_id":"task_1","summary":{"title":"Finish report","content":[[{"tag":"text","text":"prepare slides"}]]},"due_time":"1710500000"}`)
 	want := "<todo task_id=\"task_1\">\nFinish report\nprepare slides\nDue: " + formatTimestamp("1710500000") + "\n</todo>"
 	if got != want {
-		t.Fatalf("todoConverter.Convert() = %q, want %q", got, want)
+		t.Fatalf("ConvertBodyContent(todo) = %q, want %q", got, want)
 	}
 }
diff --git a/shortcuts/im/convert_lib/helpers.go b/shortcuts/im/convert_lib/helpers.go
index 8ff308f627..9ef681cbe0 100644
--- a/shortcuts/im/convert_lib/helpers.go
+++ b/shortcuts/im/convert_lib/helpers.go
@@ -4,51 +4,23 @@
 package convertlib
 
 import (
-	"encoding/json"
-	"fmt"
-	"strconv"
-	"strings"
-	"time"
-
+	"github.com/larksuite/cli/internal/imcontent"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
 // ParseJSONObject parses a raw JSON string into a map.
 func ParseJSONObject(raw string) (map[string]interface{}, error) {
-	var v map[string]interface{}
-	if err := json.Unmarshal([]byte(raw), &v); err != nil {
-		return nil, err
-	}
-	return v, nil
-}
-
-func invalidJSONPlaceholder(kind string) string {
-	if kind == "" {
-		return "[Invalid JSON content]"
-	}
-	return fmt.Sprintf("[Invalid %s JSON]", kind)
+	return imcontent.ParseJSONObject(raw)
 }
 
 // BuildMentionKeyMap builds a key→name lookup from the message "mentions" array.
 func BuildMentionKeyMap(mentions []interface{}) map[string]string {
-	m := map[string]string{}
-	for _, raw := range mentions {
-		item, _ := raw.(map[string]interface{})
-		key, _ := item["key"].(string)
-		name, _ := item["name"].(string)
-		if key != "" && name != "" {
-			m[key] = name
-		}
-	}
-	return m
+	return imcontent.BuildMentionKeyMap(mentions)
 }
 
 // ResolveMentionKeys replaces mention keys in text with @name format.
 func ResolveMentionKeys(text string, mentionMap map[string]string) string {
-	for key, name := range mentionMap {
-		text = strings.ReplaceAll(text, key, "@"+name)
-	}
-	return text
+	return imcontent.ResolveMentionKeys(text, mentionMap)
 }
 
 // formatTimestamp converts a Unix timestamp string (seconds or milliseconds) to
@@ -56,17 +28,7 @@ func ResolveMentionKeys(text string, mentionMap map[string]string) string {
 // seconds; larger values are treated as milliseconds.
 // Returns empty string if the input is empty or unparseable.
 func formatTimestamp(ts string) string {
-	if ts == "" {
-		return ""
-	}
-	n, err := strconv.ParseInt(ts, 10, 64)
-	if err != nil || n == 0 {
-		return ""
-	}
-	if len(strings.TrimLeft(ts, "+-")) >= 13 { // milliseconds timestamps are typically 13+ digits
-		n /= 1000
-	}
-	return time.Unix(n, 0).Local().Format("2006-01-02 15:04:05")
+	return imcontent.FormatTimestamp(ts)
 }
 
 // pickSenderName returns the server-provided display name from a message sender:
@@ -132,37 +94,7 @@ func AttachSenderNames(messages []map[string]interface{}, nameMap map[string]str
 	}
 }
 
-// xmlEscapeBody escapes XML special characters for use in element body content.
-var xmlBodyEscaper = strings.NewReplacer(
-	"&", "&amp;",
-	"<", "&lt;",
-	">", "&gt;",
-)
-
-func xmlEscapeBody(s string) string {
-	return xmlBodyEscaper.Replace(s)
-}
-
-// escapeMDLinkText escapes square brackets in Markdown link text to prevent link injection.
-func escapeMDLinkText(s string) string {
-	s = strings.ReplaceAll(s, `[`, `\[`)
-	s = strings.ReplaceAll(s, `]`, `\]`)
-	return s
-}
-
 // extractPostBlocksText extracts plain text from post-style content blocks ([][]element).
 func extractPostBlocksText(blocks []interface{}) string {
-	var lines []string
-	for _, para := range blocks {
-		elems, _ := para.([]interface{})
-		var sb strings.Builder
-		for _, el := range elems {
-			elem, _ := el.(map[string]interface{})
-			sb.WriteString(renderPostElem(elem))
-		}
-		if s := sb.String(); s != "" {
-			lines = append(lines, s)
-		}
-	}
-	return strings.Join(lines, "\n")
+	return imcontent.ExtractPostBlocksText(blocks)
 }
diff --git a/shortcuts/im/convert_lib/merge.go b/shortcuts/im/convert_lib/merge.go
index d51e804bcf..39eb33035f 100644
--- a/shortcuts/im/convert_lib/merge.go
+++ b/shortcuts/im/convert_lib/merge.go
@@ -11,6 +11,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/larksuite/cli/internal/imcontent"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
@@ -62,12 +63,7 @@ func (mergeForwardConverter) Convert(ctx *ConvertContext) string {
 			return renderMergeForwardTree(ctx, subItems)
 		}
 	}
-	// Final fallback: try to extract message IDs from content (some older formats include them)
-	ids := ParseMergeForwardIDs(ctx.RawContent)
-	if len(ids) > 0 {
-		return fmt.Sprintf("[Merged forward: %d messages]", len(ids))
-	}
-	return "[Merged forward]"
+	return imcontent.ConvertBodyContent("merge_forward", pureConvertContext(ctx))
 }
 
 // renderMergeForwardTree resolves sender names for the supplied sub-items and
@@ -242,18 +238,7 @@ func mergeForwardMessagesPath(messageID string) string {
 
 // ParseMergeForwardIDs extracts message IDs from a merge_forward content JSON.
 func ParseMergeForwardIDs(raw string) []string {
-	parsed, err := ParseJSONObject(raw)
-	if err != nil {
-		return nil
-	}
-	rawIds, _ := parsed["create_message_ids"].([]interface{})
-	ids := make([]string, 0, len(rawIds))
-	for _, id := range rawIds {
-		if s, ok := id.(string); ok {
-			ids = append(ids, s)
-		}
-	}
-	return ids
+	return imcontent.ParseMergeForwardIDs(raw)
 }
 
 // BuildMergeForwardChildrenMap builds a parent→children map from a flat items list.
diff --git a/shortcuts/im/convert_lib/pure_adapters.go b/shortcuts/im/convert_lib/pure_adapters.go
new file mode 100644
index 0000000000..047fe0841c
--- /dev/null
+++ b/shortcuts/im/convert_lib/pure_adapters.go
@@ -0,0 +1,27 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package convertlib
+
+import "github.com/larksuite/cli/internal/imcontent"
+
+func pureConvertContext(ctx *ConvertContext) *imcontent.ConvertContext {
+	if ctx == nil {
+		return nil
+	}
+	return &imcontent.ConvertContext{
+		RawContent: ctx.RawContent,
+		MentionMap: ctx.MentionMap,
+		Mentions:   ctx.Mentions,
+	}
+}
+
+// ConvertInteractiveEventContent preserves the former conversion library API
+// while the implementation lives in the lower-level content package.
+func ConvertInteractiveEventContent(rawContent string, mentions []interface{}) string {
+	return imcontent.ConvertInteractiveEventContent(rawContent, mentions)
+}
+
+func unwrapPostLocale(parsed map[string]interface{}) map[string]interface{} {
+	return imcontent.UnwrapPostLocale(parsed)
+}

From 5e23bbeddbb37d7f8efb3db33e55c0e2e7dae5ec Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Sat, 25 Jul 2026 17:13:32 +0800
Subject: [PATCH 15/50] refactor(auth): extract authentication logging from
 keychain

---
 internal/auth/app_registration.go             |  10 +-
 internal/auth/auth_response_log.go            |  26 +++-
 internal/auth/device_flow.go                  |   9 +-
 internal/auth/device_flow_test.go             |  32 +++--
 internal/auth/revoke.go                       |   2 +-
 internal/auth/uat_client.go                   |   3 +-
 internal/auth/verify.go                       |   6 +-
 internal/auth/verify_test.go                  |   7 +-
 .../auth_log.go => authlog/authlog.go}        | 125 +++++++++---------
 .../authlog_test.go}                          |   8 +-
 internal/cmdutil/factory_default.go           |   4 -
 internal/keychain/keychain.go                 |   3 +-
 12 files changed, 130 insertions(+), 105 deletions(-)
 rename internal/{keychain/auth_log.go => authlog/authlog.go} (58%)
 rename internal/{keychain/auth_log_test.go => authlog/authlog_test.go} (83%)

diff --git a/internal/auth/app_registration.go b/internal/auth/app_registration.go
index 44d5c3af95..f7f8cc403b 100644
--- a/internal/auth/app_registration.go
+++ b/internal/auth/app_registration.go
@@ -14,6 +14,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/larksuite/cli/internal/authlog"
 	"github.com/larksuite/cli/internal/core"
 )
 
@@ -116,7 +117,7 @@ func RequestAppRegistration(ctx context.Context, httpClient *http.Client, brand
 		return nil, err
 	}
 	defer resp.Body.Close()
-	logHTTPResponse(resp)
+	logHTTPResponse(newAuthLogger(), resp)
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
@@ -180,7 +181,7 @@ func BuildVerificationURL(baseURL, cliVersion string) string {
 }
 
 // pollOnce performs one ctx-bound poll request and decodes the payload.
-func pollOnce(ctx context.Context, httpClient *http.Client, brand core.LarkBrand, deviceCode string) (map[string]interface{}, error) {
+func pollOnce(ctx context.Context, httpClient *http.Client, brand core.LarkBrand, deviceCode string, logger *authlog.Logger) (map[string]interface{}, error) {
 	form := url.Values{}
 	form.Set("action", "poll")
 	form.Set("device_code", deviceCode)
@@ -196,7 +197,7 @@ func pollOnce(ctx context.Context, httpClient *http.Client, brand core.LarkBrand
 		return nil, fmt.Errorf("poll network error: %w", err)
 	}
 	defer resp.Body.Close()
-	logHTTPResponse(resp)
+	logHTTPResponse(logger, resp)
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
@@ -230,6 +231,7 @@ func RegisterAppWithDiscovery(ctx context.Context, httpClient *http.Client, resp
 	effectiveBrand := currentBrand
 	switched := false
 	waitBeforePoll := false
+	authLogger := newAuthLogger()
 
 	for {
 		if waitBeforePoll {
@@ -244,7 +246,7 @@ func RegisterAppWithDiscovery(ctx context.Context, httpClient *http.Client, resp
 			return nil, effectiveBrand, registrationContextError(ctx)
 		}
 
-		data, err := pollOnce(ctx, httpClient, currentBrand, resp.DeviceCode)
+		data, err := pollOnce(ctx, httpClient, currentBrand, resp.DeviceCode, authLogger)
 		if err != nil {
 			fmt.Fprintf(errOut, "[lark-cli] [WARN] app-registration: %v\n", err)
 			interval = minInt(interval+1, maxPollIntervalSeconds)
diff --git a/internal/auth/auth_response_log.go b/internal/auth/auth_response_log.go
index b57a9edaef..54a09c538d 100644
--- a/internal/auth/auth_response_log.go
+++ b/internal/auth/auth_response_log.go
@@ -6,14 +6,23 @@ package auth
 import (
 	"net/http"
 
-	"github.com/larksuite/cli/internal/keychain"
+	"github.com/larksuite/cli/internal/authlog"
+	"github.com/larksuite/cli/internal/core"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 )
 
+type authLogger interface {
+	LogResponse(path string, status int, logID string)
+}
+
+func newAuthLogger() *authlog.Logger {
+	return authlog.New(authlog.Options{RuntimeDir: core.GetRuntimeDir})
+}
+
 // logHTTPResponse logs the HTTP response details for an authentication request.
 // It extracts the request path, status code, and x-tt-logid from the given HTTP response.
-func logHTTPResponse(resp *http.Response) {
-	if resp == nil {
+func logHTTPResponse(logger authLogger, resp *http.Response) {
+	if logger == nil || resp == nil {
 		return
 	}
 
@@ -22,20 +31,23 @@ func logHTTPResponse(resp *http.Response) {
 		path = resp.Request.URL.Path
 	}
 
-	keychain.LogAuthResponse(path, resp.StatusCode, resp.Header.Get("x-tt-logid"))
+	logger.LogResponse(path, resp.StatusCode, resp.Header.Get("x-tt-logid"))
 }
 
 // logSDKResponse logs the SDK response details for an authentication request.
 // It extracts the status code and x-tt-logid from the given API response object.
-func logSDKResponse(path string, apiResp *larkcore.ApiResp) {
+func logSDKResponse(logger authLogger, path string, apiResp *larkcore.ApiResp) {
+	if logger == nil {
+		return
+	}
 	if path == "" {
 		path = "missing"
 	}
 
 	if apiResp == nil {
-		keychain.LogAuthResponse(path, 0, "")
+		logger.LogResponse(path, 0, "")
 		return
 	}
 
-	keychain.LogAuthResponse(path, apiResp.StatusCode, apiResp.Header.Get("x-tt-logid"))
+	logger.LogResponse(path, apiResp.StatusCode, apiResp.Header.Get("x-tt-logid"))
 }
diff --git a/internal/auth/device_flow.go b/internal/auth/device_flow.go
index 7acdad859c..5b63d6c838 100644
--- a/internal/auth/device_flow.go
+++ b/internal/auth/device_flow.go
@@ -63,6 +63,10 @@ func ResolveOAuthEndpoints(brand core.LarkBrand) OAuthEndpoints {
 
 // RequestDeviceAuthorization requests a device authorization code.
 func RequestDeviceAuthorization(httpClient *http.Client, appId, appSecret string, brand core.LarkBrand, scope string, errOut io.Writer) (*DeviceAuthResponse, error) {
+	return requestDeviceAuthorization(httpClient, appId, appSecret, brand, scope, errOut, newAuthLogger())
+}
+
+func requestDeviceAuthorization(httpClient *http.Client, appId, appSecret string, brand core.LarkBrand, scope string, errOut io.Writer, logger authLogger) (*DeviceAuthResponse, error) {
 	if errOut == nil {
 		errOut = io.Discard
 	}
@@ -95,7 +99,7 @@ func RequestDeviceAuthorization(httpClient *http.Client, appId, appSecret string
 		return nil, err
 	}
 	defer resp.Body.Close()
-	logHTTPResponse(resp)
+	logHTTPResponse(logger, resp)
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
@@ -155,6 +159,7 @@ func PollDeviceToken(ctx context.Context, httpClient *http.Client, appId, appSec
 	deadline := time.Now().Add(time.Duration(expiresIn) * time.Second)
 	currentInterval := interval
 	attempts := 0
+	authLogger := newAuthLogger()
 
 	for time.Now().Before(deadline) && attempts < maxPollAttempts {
 		attempts++
@@ -186,7 +191,7 @@ func PollDeviceToken(ctx context.Context, httpClient *http.Client, appId, appSec
 			currentInterval = minInt(currentInterval+1, maxPollInterval)
 			continue
 		}
-		logHTTPResponse(resp)
+		logHTTPResponse(authLogger, resp)
 
 		body, err := io.ReadAll(resp.Body)
 		resp.Body.Close()
diff --git a/internal/auth/device_flow_test.go b/internal/auth/device_flow_test.go
index 397098cc18..d4360daea9 100644
--- a/internal/auth/device_flow_test.go
+++ b/internal/auth/device_flow_test.go
@@ -14,9 +14,9 @@ import (
 	"testing"
 	"time"
 
+	"github.com/larksuite/cli/internal/authlog"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/internal/keychain"
 )
 
 type roundTripFunc func(*http.Request) (*http.Response, error)
@@ -25,6 +25,14 @@ func (fn roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
 	return fn(req)
 }
 
+func testAuthLogger(buf *bytes.Buffer, now func() time.Time, args func() []string) *authlog.Logger {
+	return authlog.New(authlog.Options{
+		Logger: log.New(buf, "", 0),
+		Now:    now,
+		Args:   args,
+	})
+}
+
 // TestResolveOAuthEndpoints_Feishu validates endpoints for the Feishu brand.
 func TestResolveOAuthEndpoints_Feishu(t *testing.T) {
 	ep := ResolveOAuthEndpoints(core.BrandFeishu)
@@ -76,14 +84,13 @@ func TestRequestDeviceAuthorization_LogsResponse(t *testing.T) {
 	})
 
 	var buf bytes.Buffer
-	restore := keychain.SetAuthLogHooksForTest(log.New(&buf, "", 0), func() time.Time {
+	authLogger := testAuthLogger(&buf, func() time.Time {
 		return time.Date(2026, 4, 2, 3, 4, 5, 0, time.UTC)
 	}, func() []string {
 		return []string{"lark-cli", "auth", "login", "--device-code", "device-code-secret", "--app-secret=top-secret"}
 	})
-	t.Cleanup(restore)
 
-	_, err := RequestDeviceAuthorization(httpmock.NewClient(reg), "cli_a", "secret_b", core.BrandFeishu, "", nil)
+	_, err := requestDeviceAuthorization(httpmock.NewClient(reg), "cli_a", "secret_b", core.BrandFeishu, "", nil, authLogger)
 	if err != nil {
 		t.Fatalf("RequestDeviceAuthorization() error: %v", err)
 	}
@@ -108,7 +115,7 @@ func TestRequestDeviceAuthorization_LogsResponse(t *testing.T) {
 
 // TestFormatAuthCmdline_TruncatesExtraArgs verifies that long command lines are truncated.
 func TestFormatAuthCmdline_TruncatesExtraArgs(t *testing.T) {
-	got := keychain.FormatAuthCmdline([]string{
+	got := authlog.FormatAuthCmdline([]string{
 		"lark-cli",
 		"auth",
 		"login",
@@ -126,11 +133,10 @@ func TestFormatAuthCmdline_TruncatesExtraArgs(t *testing.T) {
 // TestLogAuthResponse_IgnoresTypedNilHTTPResponse tests that a typed nil HTTP response is ignored gracefully.
 func TestLogAuthResponse_IgnoresTypedNilHTTPResponse(t *testing.T) {
 	var buf bytes.Buffer
-	restore := keychain.SetAuthLogHooksForTest(log.New(&buf, "", 0), nil, nil)
-	t.Cleanup(restore)
+	authLogger := testAuthLogger(&buf, nil, nil)
 
 	var resp *http.Response
-	logHTTPResponse(resp)
+	logHTTPResponse(authLogger, resp)
 
 	if got := buf.String(); got != "" {
 		t.Fatalf("expected no log output, got %q", got)
@@ -140,14 +146,13 @@ func TestLogAuthResponse_IgnoresTypedNilHTTPResponse(t *testing.T) {
 // TestLogAuthResponse_HandlesNilSDKResponse verifies that a nil SDK response is handled without panicking.
 func TestLogAuthResponse_HandlesNilSDKResponse(t *testing.T) {
 	var buf bytes.Buffer
-	restore := keychain.SetAuthLogHooksForTest(log.New(&buf, "", 0), func() time.Time {
+	authLogger := testAuthLogger(&buf, func() time.Time {
 		return time.Date(2026, 4, 2, 3, 4, 5, 0, time.UTC)
 	}, func() []string {
 		return []string{"lark-cli", "auth", "status", "--verify"}
 	})
-	t.Cleanup(restore)
 
-	logSDKResponse(PathUserInfoV1, nil)
+	logSDKResponse(authLogger, PathUserInfoV1, nil)
 
 	got := buf.String()
 	if !strings.Contains(got, "path="+PathUserInfoV1) {
@@ -160,14 +165,13 @@ func TestLogAuthResponse_HandlesNilSDKResponse(t *testing.T) {
 
 func TestLogAuthError_RecordsStructuredEntry(t *testing.T) {
 	var buf bytes.Buffer
-	restore := keychain.SetAuthLogHooksForTest(log.New(&buf, "", 0), func() time.Time {
+	authLogger := testAuthLogger(&buf, func() time.Time {
 		return time.Date(2026, 4, 2, 3, 4, 5, 0, time.UTC)
 	}, func() []string {
 		return []string{"lark-cli", "auth", "login", "--device-code", "secret"}
 	})
-	t.Cleanup(restore)
 
-	keychain.LogAuthError("keychain", "Set", fmt.Errorf("keychain Set error: %w", http.ErrUseLastResponse))
+	authLogger.LogError("keychain", "Set", fmt.Errorf("keychain Set error: %w", http.ErrUseLastResponse))
 
 	got := buf.String()
 	if !strings.Contains(got, "auth-error") {
diff --git a/internal/auth/revoke.go b/internal/auth/revoke.go
index f1f046daf0..27e0e42572 100644
--- a/internal/auth/revoke.go
+++ b/internal/auth/revoke.go
@@ -38,7 +38,7 @@ func RevokeToken(httpClient *http.Client, appId, appSecret string, brand core.La
 		return errs.NewNetworkError(errs.SubtypeNetworkTransport, "token revoke transport error: %v", err).WithCause(err)
 	}
 	defer resp.Body.Close()
-	logHTTPResponse(resp)
+	logHTTPResponse(newAuthLogger(), resp)
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
diff --git a/internal/auth/uat_client.go b/internal/auth/uat_client.go
index d1a0683927..a14d5edef0 100644
--- a/internal/auth/uat_client.go
+++ b/internal/auth/uat_client.go
@@ -187,6 +187,7 @@ func doRefreshToken(httpClient *http.Client, opts UATCallOptions, stored *Stored
 	}
 
 	endpoints := ResolveOAuthEndpoints(opts.Domain)
+	authLogger := newAuthLogger()
 
 	callEndpoint := func() (map[string]interface{}, error) {
 		form := url.Values{}
@@ -206,7 +207,7 @@ func doRefreshToken(httpClient *http.Client, opts UATCallOptions, stored *Stored
 			return nil, err
 		}
 		defer resp.Body.Close()
-		logHTTPResponse(resp)
+		logHTTPResponse(authLogger, resp)
 
 		body, err := io.ReadAll(resp.Body)
 		if err != nil {
diff --git a/internal/auth/verify.go b/internal/auth/verify.go
index 8786a7d3c4..f6840e97d0 100644
--- a/internal/auth/verify.go
+++ b/internal/auth/verify.go
@@ -16,6 +16,10 @@ import (
 // VerifyUserToken calls /authen/v1/user_info to confirm the token is accepted server-side.
 // Returns nil on success or an error describing why the server rejected the token.
 func VerifyUserToken(ctx context.Context, sdk *lark.Client, accessToken string) error {
+	return verifyUserToken(ctx, sdk, accessToken, newAuthLogger())
+}
+
+func verifyUserToken(ctx context.Context, sdk *lark.Client, accessToken string, logger authLogger) error {
 	apiResp, err := sdk.Do(ctx, &larkcore.ApiReq{
 		HttpMethod:                http.MethodGet,
 		ApiPath:                   PathUserInfoV1,
@@ -24,7 +28,7 @@ func VerifyUserToken(ctx context.Context, sdk *lark.Client, accessToken string)
 	if err != nil {
 		return err
 	}
-	logSDKResponse(PathUserInfoV1, apiResp)
+	logSDKResponse(logger, PathUserInfoV1, apiResp)
 
 	var resp struct {
 		Code int    `json:"code"`
diff --git a/internal/auth/verify_test.go b/internal/auth/verify_test.go
index d513a66a3f..21c11736fe 100644
--- a/internal/auth/verify_test.go
+++ b/internal/auth/verify_test.go
@@ -6,13 +6,11 @@ package auth
 import (
 	"bytes"
 	"context"
-	"log"
 	"net/http"
 	"strings"
 	"testing"
 	"time"
 
-	"github.com/larksuite/cli/internal/keychain"
 	lark "github.com/larksuite/oapi-sdk-go/v3"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
@@ -86,14 +84,13 @@ func TestVerifyUserToken(t *testing.T) {
 			)
 
 			var buf bytes.Buffer
-			restore := keychain.SetAuthLogHooksForTest(log.New(&buf, "", 0), func() time.Time {
+			authLogger := testAuthLogger(&buf, func() time.Time {
 				return time.Date(2026, 4, 2, 3, 4, 5, 0, time.UTC)
 			}, func() []string {
 				return []string{"lark-cli", "auth", "status"}
 			})
-			t.Cleanup(restore)
 
-			err := VerifyUserToken(context.Background(), sdk, "test-token")
+			err := verifyUserToken(context.Background(), sdk, "test-token", authLogger)
 			if tt.wantErr {
 				if err == nil {
 					t.Fatal("expected error, got nil")
diff --git a/internal/keychain/auth_log.go b/internal/authlog/authlog.go
similarity index 58%
rename from internal/keychain/auth_log.go
rename to internal/authlog/authlog.go
index 7b175942c8..8594d654c8 100644
--- a/internal/keychain/auth_log.go
+++ b/internal/authlog/authlog.go
@@ -1,7 +1,8 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package keychain
+// Package authlog records authentication response and error diagnostics.
+package authlog
 
 import (
 	"fmt"
@@ -16,11 +17,41 @@ import (
 	"github.com/larksuite/cli/internal/vfs"
 )
 
-// RuntimeDirFunc returns the workspace-aware config directory.
-// Default: falls back to LARKSUITE_CLI_CONFIG_DIR or ~/.lark-cli (pre-workspace behavior).
-// Injected by cmdutil.NewDefault → core.GetRuntimeDir after workspace detection.
-// This avoids an import cycle (core → keychain → core).
-var RuntimeDirFunc = defaultRuntimeDir
+// Options configures one authentication logger instance.
+type Options struct {
+	RuntimeDir func() string
+	Logger     *log.Logger
+	Now        func() time.Time
+	Args       func() []string
+}
+
+// Logger records authentication diagnostics in a workspace-specific log.
+type Logger struct {
+	runtimeDir func() string
+	logger     *log.Logger
+	loggerOnce sync.Once
+	now        func() time.Time
+	args       func() []string
+}
+
+// New creates an authentication logger with explicit dependencies.
+func New(options Options) *Logger {
+	if options.RuntimeDir == nil {
+		options.RuntimeDir = defaultRuntimeDir
+	}
+	if options.Now == nil {
+		options.Now = time.Now
+	}
+	if options.Args == nil {
+		options.Args = func() []string { return os.Args }
+	}
+	return &Logger{
+		runtimeDir: options.RuntimeDir,
+		logger:     options.Logger,
+		now:        options.Now,
+		args:       options.Args,
+	}
+}
 
 func defaultRuntimeDir() string {
 	if dir := os.Getenv("LARKSUITE_CLI_CONFIG_DIR"); dir != "" {
@@ -39,15 +70,7 @@ func defaultRuntimeDir() string {
 	return filepath.Join(home, ".lark-cli")
 }
 
-var (
-	authResponseLogger     *log.Logger
-	authResponseLoggerOnce = &sync.Once{}
-
-	authResponseLogNow  = time.Now
-	authResponseLogArgs = func() []string { return os.Args }
-)
-
-func authLogDir() string {
+func (l *Logger) logDir() string {
 	// LARKSUITE_CLI_LOG_DIR is the highest-priority override.
 	// When set, it bypasses workspace subtree routing entirely.
 	if dir := os.Getenv("LARKSUITE_CLI_LOG_DIR"); dir != "" {
@@ -57,20 +80,17 @@ func authLogDir() string {
 		}
 	}
 
-	// Fall back to the workspace-aware runtime dir. RuntimeDirFunc is injected
-	// by factory after workspace detection; before injection it defaults to
-	// the pre-workspace behavior so older call paths remain correct.
-	return filepath.Join(RuntimeDirFunc(), "logs")
+	return filepath.Join(l.runtimeDir(), "logs")
 }
 
-func initAuthLogger() {
-	authResponseLoggerOnce.Do(func() {
-		if authResponseLogger != nil {
+func (l *Logger) init() {
+	l.loggerOnce.Do(func() {
+		if l.logger != nil {
 			return
 		}
 
-		dir := authLogDir()
-		now := authResponseLogNow()
+		dir := l.logDir()
+		now := l.now()
 		if err := vfs.MkdirAll(dir, 0700); err != nil {
 			return
 		}
@@ -78,7 +98,7 @@ func initAuthLogger() {
 		logName := fmt.Sprintf("auth-%s.log", now.Format("2006-01-02"))
 		logPath := filepath.Join(dir, logName)
 		if f, err := vfs.OpenFile(logPath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600); err == nil {
-			authResponseLogger = log.New(f, "", 0)
+			l.logger = log.New(f, "", 0)
 			cleanupOldLogs(dir, now)
 		}
 	})
@@ -96,66 +116,47 @@ func FormatAuthCmdline(args []string) string {
 	return strings.Join(args[:3], " ") + " ..."
 }
 
-func LogAuthResponse(path string, status int, logID string) {
-	initAuthLogger()
-	if authResponseLogger == nil {
+// LogResponse records one authentication HTTP response.
+func (l *Logger) LogResponse(path string, status int, logID string) {
+	if l == nil {
+		return
+	}
+	l.init()
+	if l.logger == nil {
 		return
 	}
 
-	authResponseLogger.Printf(
+	l.logger.Printf(
 		"[lark-cli] auth-response: time=%s path=%s status=%d x-tt-logid=%s cmdline=%s",
-		authResponseLogNow().Format(time.RFC3339Nano),
+		l.now().Format(time.RFC3339Nano),
 		path,
 		status,
 		logID,
-		FormatAuthCmdline(authResponseLogArgs()),
+		FormatAuthCmdline(l.args()),
 	)
 }
 
-func LogAuthError(component, op string, err error) {
-	if err == nil {
+// LogError records one authentication-related local error.
+func (l *Logger) LogError(component, op string, err error) {
+	if l == nil || err == nil {
 		return
 	}
 
-	initAuthLogger()
-	if authResponseLogger == nil {
+	l.init()
+	if l.logger == nil {
 		return
 	}
 
-	authResponseLogger.Printf(
+	l.logger.Printf(
 		"[lark-cli] auth-error: time=%s component=%s op=%s error=%q cmdline=%s",
-		authResponseLogNow().Format(time.RFC3339Nano),
+		l.now().Format(time.RFC3339Nano),
 		component,
 		op,
 		err.Error(),
-		FormatAuthCmdline(authResponseLogArgs()),
+		FormatAuthCmdline(l.args()),
 	)
 }
 
-func SetAuthLogHooksForTest(logger *log.Logger, now func() time.Time, args func() []string) func() {
-	prevLogger := authResponseLogger
-	prevNow := authResponseLogNow
-	prevArgs := authResponseLogArgs
-	prevOnce := authResponseLoggerOnce
-
-	authResponseLogger = logger
-	authResponseLoggerOnce = &sync.Once{}
-
-	if now != nil {
-		authResponseLogNow = now
-	}
-	if args != nil {
-		authResponseLogArgs = args
-	}
-
-	return func() {
-		authResponseLogger = prevLogger
-		authResponseLogNow = prevNow
-		authResponseLogArgs = prevArgs
-		authResponseLoggerOnce = prevOnce
-	}
-}
-
 func cleanupOldLogs(dir string, now time.Time) {
 	defer func() {
 		if r := recover(); r != nil {
diff --git a/internal/keychain/auth_log_test.go b/internal/authlog/authlog_test.go
similarity index 83%
rename from internal/keychain/auth_log_test.go
rename to internal/authlog/authlog_test.go
index 423d2b1cbd..f1e27a2239 100644
--- a/internal/keychain/auth_log_test.go
+++ b/internal/authlog/authlog_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package keychain
+package authlog
 
 import (
 	"path/filepath"
@@ -16,7 +16,8 @@ func TestAuthLogDir_UsesValidatedLogDirEnv(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_LOG_DIR", filepath.Join(base, "logs", "..", "auth"))
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", "")
 
-	got := authLogDir()
+	logger := New(Options{RuntimeDir: func() string { return t.TempDir() }})
+	got := logger.logDir()
 	want := filepath.Join(base, "auth")
 	if got != want {
 		t.Fatalf("authLogDir() = %q, want %q", got, want)
@@ -30,7 +31,8 @@ func TestAuthLogDir_InvalidLogDirFallsBackToConfigDir(t *testing.T) {
 	configDir := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
 
-	got := authLogDir()
+	logger := New(Options{RuntimeDir: func() string { return configDir }})
+	got := logger.logDir()
 	want := filepath.Join(configDir, "logs")
 	if got != want {
 		t.Fatalf("authLogDir() = %q, want %q", got, want)
diff --git a/internal/cmdutil/factory_default.go b/internal/cmdutil/factory_default.go
index 2051e0beaa..a4fb5084be 100644
--- a/internal/cmdutil/factory_default.go
+++ b/internal/cmdutil/factory_default.go
@@ -48,10 +48,6 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 	ws := core.DetectWorkspaceFromEnv(os.Getenv)
 	core.SetCurrentWorkspace(ws)
 
-	// Inject workspace-aware dir into keychain's log system.
-	// This breaks the core↔keychain import cycle by using a function variable.
-	keychain.RuntimeDirFunc = core.GetRuntimeDir
-
 	// Phase 0: FileIO provider (no dependency)
 	f.FileIOProvider = fileio.GetProvider()
 
diff --git a/internal/keychain/keychain.go b/internal/keychain/keychain.go
index 334442efbb..419382e31b 100644
--- a/internal/keychain/keychain.go
+++ b/internal/keychain/keychain.go
@@ -10,6 +10,7 @@ import (
 	"fmt"
 
 	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/authlog"
 )
 
 var (
@@ -46,7 +47,7 @@ func wrapError(op string, err error) error {
 
 	func() {
 		defer func() { recover() }()
-		LogAuthError("keychain", op, fmt.Errorf("keychain %s error: %w", op, err))
+		authlog.New(authlog.Options{}).LogError("keychain", op, fmt.Errorf("keychain %s error: %w", op, err))
 	}()
 
 	return errs.NewAPIError(errs.SubtypeUnknown, "%s", msg).

From 5157c3a00e01481f9cd449c7c22962ae7a6a0595 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Sat, 25 Jul 2026 17:17:07 +0800
Subject: [PATCH 16/50] refactor(binding): split audit and config
 responsibilities

---
 cmd/config/binder.go                          | 20 +++++++++----------
 .../{binding => openclawbind}/json_pointer.go |  2 +-
 .../json_pointer_test.go                      |  2 +-
 .../{binding => openclawbind}/lark_channel.go |  4 ++--
 .../lark_channel_test.go                      |  2 +-
 internal/{binding => openclawbind}/reader.go  |  2 +-
 .../{binding => openclawbind}/reader_test.go  |  2 +-
 .../secret_resolve.go                         |  2 +-
 .../secret_resolve_exec.go                    |  6 ++++--
 .../secret_resolve_exec_test.go               |  2 +-
 .../secret_resolve_file.go                    |  5 +++--
 .../secret_resolve_file_test.go               |  2 +-
 .../secret_resolve_test.go                    |  2 +-
 internal/{binding => openclawbind}/tilde.go   |  2 +-
 .../{binding => openclawbind}/tilde_test.go   |  2 +-
 internal/{binding => openclawbind}/types.go   |  2 +-
 .../{binding => openclawbind}/types_test.go   |  2 +-
 internal/{binding => secaudit}/audit.go       |  2 +-
 internal/{binding => secaudit}/audit_test.go  |  2 +-
 internal/{binding => secaudit}/audit_unix.go  |  2 +-
 .../{binding => secaudit}/audit_windows.go    |  2 +-
 .../audit_windows_test.go                     |  2 +-
 internal/transport/config.go                  |  4 ++--
 internal/transport/tls_ca.go                  |  4 ++--
 24 files changed, 41 insertions(+), 38 deletions(-)
 rename internal/{binding => openclawbind}/json_pointer.go (99%)
 rename internal/{binding => openclawbind}/json_pointer_test.go (99%)
 rename internal/{binding => openclawbind}/lark_channel.go (96%)
 rename internal/{binding => openclawbind}/lark_channel_test.go (99%)
 rename internal/{binding => openclawbind}/reader.go (96%)
 rename internal/{binding => openclawbind}/reader_test.go (99%)
 rename internal/{binding => openclawbind}/secret_resolve.go (99%)
 rename internal/{binding => openclawbind}/secret_resolve_exec.go (98%)
 rename internal/{binding => openclawbind}/secret_resolve_exec_test.go (99%)
 rename internal/{binding => openclawbind}/secret_resolve_file.go (96%)
 rename internal/{binding => openclawbind}/secret_resolve_file_test.go (99%)
 rename internal/{binding => openclawbind}/secret_resolve_test.go (99%)
 rename internal/{binding => openclawbind}/tilde.go (99%)
 rename internal/{binding => openclawbind}/tilde_test.go (99%)
 rename internal/{binding => openclawbind}/types.go (99%)
 rename internal/{binding => openclawbind}/types_test.go (99%)
 rename internal/{binding => secaudit}/audit.go (99%)
 rename internal/{binding => secaudit}/audit_test.go (99%)
 rename internal/{binding => secaudit}/audit_unix.go (99%)
 rename internal/{binding => secaudit}/audit_windows.go (97%)
 rename internal/{binding => secaudit}/audit_windows_test.go (97%)

diff --git a/cmd/config/binder.go b/cmd/config/binder.go
index a24f927be1..7bf42e6b31 100644
--- a/cmd/config/binder.go
+++ b/cmd/config/binder.go
@@ -10,8 +10,8 @@ import (
 	"strings"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/binding"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/openclawbind"
 	"github.com/larksuite/cli/internal/vfs"
 )
 
@@ -138,15 +138,15 @@ type openclawBinder struct {
 	path string
 
 	// Cached between ListCandidates and Build so we don't re-read / re-parse.
-	cfg     *binding.OpenClawRoot
-	rawApps []binding.CandidateApp
+	cfg     *openclawbind.OpenClawRoot
+	rawApps []openclawbind.CandidateApp
 }
 
 func (b *openclawBinder) Name() string       { return "openclaw" }
 func (b *openclawBinder) ConfigPath() string { return b.path }
 
 func (b *openclawBinder) ListCandidates() ([]Candidate, error) {
-	cfg, err := binding.ReadOpenClawConfig(b.path)
+	cfg, err := openclawbind.ReadOpenClawConfig(b.path)
 	if err != nil {
 		return nil, errs.NewConfigError(errs.SubtypeInvalidConfig, "cannot read %s: %v", b.path, err).
 			WithHint("verify OpenClaw is installed and configured").
@@ -157,7 +157,7 @@ func (b *openclawBinder) ListCandidates() ([]Candidate, error) {
 			WithHint("configure Feishu in OpenClaw first")
 	}
 
-	raw := binding.ListCandidateApps(cfg.Channels.Feishu)
+	raw := openclawbind.ListCandidateApps(cfg.Channels.Feishu)
 	b.cfg = cfg
 	b.rawApps = raw
 
@@ -173,7 +173,7 @@ func (b *openclawBinder) Build(appID string) (*core.AppConfig, error) {
 		return nil, errs.NewInternalError(errs.SubtypeSDKError, "internal: Build called before ListCandidates")
 	}
 
-	var selected *binding.CandidateApp
+	var selected *openclawbind.CandidateApp
 	for i := range b.rawApps {
 		if b.rawApps[i].AppID == appID {
 			selected = &b.rawApps[i]
@@ -188,7 +188,7 @@ func (b *openclawBinder) Build(appID string) (*core.AppConfig, error) {
 		return nil, errs.NewConfigError(errs.SubtypeInvalidClient, "appSecret is empty for app %s in %s", selected.AppID, b.path).
 			WithHint("configure channels.feishu.appSecret in openclaw.json")
 	}
-	secret, err := binding.ResolveSecretInput(selected.AppSecret, b.cfg.Secrets, os.Getenv)
+	secret, err := openclawbind.ResolveSecretInput(selected.AppSecret, b.cfg.Secrets, os.Getenv)
 	if err != nil {
 		return nil, errs.NewConfigError(errs.SubtypeInvalidClient, "failed to resolve appSecret for %s: %v", selected.AppID, err).
 			WithHint("check appSecret configuration in %s", b.path).
@@ -274,14 +274,14 @@ type larkChannelBinder struct {
 	path string
 
 	// Cached between ListCandidates and Build so we don't re-read the file.
-	cfg *binding.LarkChannelRoot
+	cfg *openclawbind.LarkChannelRoot
 }
 
 func (b *larkChannelBinder) Name() string       { return "lark-channel" }
 func (b *larkChannelBinder) ConfigPath() string { return b.path }
 
 func (b *larkChannelBinder) ListCandidates() ([]Candidate, error) {
-	cfg, err := binding.ReadLarkChannelConfig(b.path)
+	cfg, err := openclawbind.ReadLarkChannelConfig(b.path)
 	if err != nil {
 		return nil, errs.NewConfigError(errs.SubtypeInvalidConfig, "cannot read %s: %v", b.path, err).
 			WithHint("verify lark-channel-bridge is installed and configured").
@@ -309,7 +309,7 @@ func (b *larkChannelBinder) Build(appID string) (*core.AppConfig, error) {
 
 	// Resolve through the same SecretInput pipeline openclaw uses, so
 	// bridge configs can use ${VAR} / env / file / exec just like openclaw.
-	secret, err := binding.ResolveSecretInput(b.cfg.Accounts.App.Secret, b.cfg.Secrets, os.Getenv)
+	secret, err := openclawbind.ResolveSecretInput(b.cfg.Accounts.App.Secret, b.cfg.Secrets, os.Getenv)
 	if err != nil {
 		return nil, errs.NewConfigError(errs.SubtypeInvalidClient, "failed to resolve appSecret for %s: %v", appID, err).
 			WithHint("check appSecret configuration in %s", b.path).
diff --git a/internal/binding/json_pointer.go b/internal/openclawbind/json_pointer.go
similarity index 99%
rename from internal/binding/json_pointer.go
rename to internal/openclawbind/json_pointer.go
index e3f46e9002..fa3688a0ec 100644
--- a/internal/binding/json_pointer.go
+++ b/internal/openclawbind/json_pointer.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"fmt"
diff --git a/internal/binding/json_pointer_test.go b/internal/openclawbind/json_pointer_test.go
similarity index 99%
rename from internal/binding/json_pointer_test.go
rename to internal/openclawbind/json_pointer_test.go
index 26f0ec9610..190bfbab3f 100644
--- a/internal/binding/json_pointer_test.go
+++ b/internal/openclawbind/json_pointer_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"testing"
diff --git a/internal/binding/lark_channel.go b/internal/openclawbind/lark_channel.go
similarity index 96%
rename from internal/binding/lark_channel.go
rename to internal/openclawbind/lark_channel.go
index f80afb53ad..a07e55fce6 100644
--- a/internal/binding/lark_channel.go
+++ b/internal/openclawbind/lark_channel.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"encoding/json"
@@ -18,7 +18,7 @@ type LarkChannelRoot struct {
 	// Secrets is an optional registry of secret providers — same shape as
 	// openclaw's `secrets` block. Lets bridge declare `exec` provider scripts
 	// (for AES-encrypted secret backends), `env` allowlists, or `file`
-	// indirection rules. Resolved by binding.ResolveSecretInput.
+	// indirection rules. Resolved by ResolveSecretInput.
 	Secrets *SecretsConfig `json:"secrets,omitempty"`
 }
 
diff --git a/internal/binding/lark_channel_test.go b/internal/openclawbind/lark_channel_test.go
similarity index 99%
rename from internal/binding/lark_channel_test.go
rename to internal/openclawbind/lark_channel_test.go
index 4908556b48..9b19994e1e 100644
--- a/internal/binding/lark_channel_test.go
+++ b/internal/openclawbind/lark_channel_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"os"
diff --git a/internal/binding/reader.go b/internal/openclawbind/reader.go
similarity index 96%
rename from internal/binding/reader.go
rename to internal/openclawbind/reader.go
index 1778212150..2845cd7a2f 100644
--- a/internal/binding/reader.go
+++ b/internal/openclawbind/reader.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"encoding/json"
diff --git a/internal/binding/reader_test.go b/internal/openclawbind/reader_test.go
similarity index 99%
rename from internal/binding/reader_test.go
rename to internal/openclawbind/reader_test.go
index 0f9611e641..7c37f1bd24 100644
--- a/internal/binding/reader_test.go
+++ b/internal/openclawbind/reader_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"os"
diff --git a/internal/binding/secret_resolve.go b/internal/openclawbind/secret_resolve.go
similarity index 99%
rename from internal/binding/secret_resolve.go
rename to internal/openclawbind/secret_resolve.go
index da85369135..e11acf82cb 100644
--- a/internal/binding/secret_resolve.go
+++ b/internal/openclawbind/secret_resolve.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"fmt"
diff --git a/internal/binding/secret_resolve_exec.go b/internal/openclawbind/secret_resolve_exec.go
similarity index 98%
rename from internal/binding/secret_resolve_exec.go
rename to internal/openclawbind/secret_resolve_exec.go
index eb4a8632a2..160bcf2340 100644
--- a/internal/binding/secret_resolve_exec.go
+++ b/internal/openclawbind/secret_resolve_exec.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"bytes"
@@ -11,6 +11,8 @@ import (
 	"os/exec"
 	"path/filepath"
 	"time"
+
+	"github.com/larksuite/cli/internal/secaudit"
 )
 
 // execRequest is the JSON payload sent to exec provider's stdin.
@@ -69,7 +71,7 @@ func prepareExecRun(ref *SecretRef, providerName string, pc *ProviderConfig, get
 		return nil, fmt.Errorf("exec provider command is empty")
 	}
 
-	securePath, err := AssertSecurePath(AuditParams{
+	securePath, err := secaudit.AssertSecurePath(secaudit.AuditParams{
 		TargetPath:            pc.Command,
 		Label:                 "exec provider command",
 		TrustedDirs:           pc.TrustedDirs,
diff --git a/internal/binding/secret_resolve_exec_test.go b/internal/openclawbind/secret_resolve_exec_test.go
similarity index 99%
rename from internal/binding/secret_resolve_exec_test.go
rename to internal/openclawbind/secret_resolve_exec_test.go
index dbc6610cfc..2e029fc76c 100644
--- a/internal/binding/secret_resolve_exec_test.go
+++ b/internal/openclawbind/secret_resolve_exec_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"fmt"
diff --git a/internal/binding/secret_resolve_file.go b/internal/openclawbind/secret_resolve_file.go
similarity index 96%
rename from internal/binding/secret_resolve_file.go
rename to internal/openclawbind/secret_resolve_file.go
index 26b5f731c7..ce54ff7b61 100644
--- a/internal/binding/secret_resolve_file.go
+++ b/internal/openclawbind/secret_resolve_file.go
@@ -1,13 +1,14 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"encoding/json"
 	"fmt"
 	"strings"
 
+	"github.com/larksuite/cli/internal/secaudit"
 	"github.com/larksuite/cli/internal/vfs"
 )
 
@@ -34,7 +35,7 @@ func resolveFileRef(ref *SecretRef, pc *ProviderConfig) (string, error) {
 	targetPath := expandTildePath(pc.Path)
 
 	// Security audit on file path
-	securePath, err := AssertSecurePath(AuditParams{
+	securePath, err := secaudit.AssertSecurePath(secaudit.AuditParams{
 		TargetPath:            targetPath,
 		Label:                 "secrets.providers file path",
 		TrustedDirs:           pc.TrustedDirs,
diff --git a/internal/binding/secret_resolve_file_test.go b/internal/openclawbind/secret_resolve_file_test.go
similarity index 99%
rename from internal/binding/secret_resolve_file_test.go
rename to internal/openclawbind/secret_resolve_file_test.go
index fc43508dcb..4a68e19264 100644
--- a/internal/binding/secret_resolve_file_test.go
+++ b/internal/openclawbind/secret_resolve_file_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"os"
diff --git a/internal/binding/secret_resolve_test.go b/internal/openclawbind/secret_resolve_test.go
similarity index 99%
rename from internal/binding/secret_resolve_test.go
rename to internal/openclawbind/secret_resolve_test.go
index 1d377d28dd..07203809bc 100644
--- a/internal/binding/secret_resolve_test.go
+++ b/internal/openclawbind/secret_resolve_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"testing"
diff --git a/internal/binding/tilde.go b/internal/openclawbind/tilde.go
similarity index 99%
rename from internal/binding/tilde.go
rename to internal/openclawbind/tilde.go
index fe2933e1b2..26b6d43a43 100644
--- a/internal/binding/tilde.go
+++ b/internal/openclawbind/tilde.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"os"
diff --git a/internal/binding/tilde_test.go b/internal/openclawbind/tilde_test.go
similarity index 99%
rename from internal/binding/tilde_test.go
rename to internal/openclawbind/tilde_test.go
index 3d64723033..e054aed0b8 100644
--- a/internal/binding/tilde_test.go
+++ b/internal/openclawbind/tilde_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"os"
diff --git a/internal/binding/types.go b/internal/openclawbind/types.go
similarity index 99%
rename from internal/binding/types.go
rename to internal/openclawbind/types.go
index 8bf83813ce..b371418b03 100644
--- a/internal/binding/types.go
+++ b/internal/openclawbind/types.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"encoding/json"
diff --git a/internal/binding/types_test.go b/internal/openclawbind/types_test.go
similarity index 99%
rename from internal/binding/types_test.go
rename to internal/openclawbind/types_test.go
index 3710307c5e..2f0c69f351 100644
--- a/internal/binding/types_test.go
+++ b/internal/openclawbind/types_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package openclawbind
 
 import (
 	"encoding/json"
diff --git a/internal/binding/audit.go b/internal/secaudit/audit.go
similarity index 99%
rename from internal/binding/audit.go
rename to internal/secaudit/audit.go
index 57c6a4d413..32ea687eab 100644
--- a/internal/binding/audit.go
+++ b/internal/secaudit/audit.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package secaudit
 
 import (
 	"fmt"
diff --git a/internal/binding/audit_test.go b/internal/secaudit/audit_test.go
similarity index 99%
rename from internal/binding/audit_test.go
rename to internal/secaudit/audit_test.go
index 28ff581808..7329a7e540 100644
--- a/internal/binding/audit_test.go
+++ b/internal/secaudit/audit_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package binding
+package secaudit
 
 import (
 	"fmt"
diff --git a/internal/binding/audit_unix.go b/internal/secaudit/audit_unix.go
similarity index 99%
rename from internal/binding/audit_unix.go
rename to internal/secaudit/audit_unix.go
index 5e6d76a4f6..a8de3866c5 100644
--- a/internal/binding/audit_unix.go
+++ b/internal/secaudit/audit_unix.go
@@ -3,7 +3,7 @@
 
 //go:build !windows
 
-package binding
+package secaudit
 
 import (
 	"fmt"
diff --git a/internal/binding/audit_windows.go b/internal/secaudit/audit_windows.go
similarity index 97%
rename from internal/binding/audit_windows.go
rename to internal/secaudit/audit_windows.go
index b2958a0c01..a4daf86448 100644
--- a/internal/binding/audit_windows.go
+++ b/internal/secaudit/audit_windows.go
@@ -3,7 +3,7 @@
 
 //go:build windows
 
-package binding
+package secaudit
 
 import (
 	"fmt"
diff --git a/internal/binding/audit_windows_test.go b/internal/secaudit/audit_windows_test.go
similarity index 97%
rename from internal/binding/audit_windows_test.go
rename to internal/secaudit/audit_windows_test.go
index 3993fcdbc3..f53d36beed 100644
--- a/internal/binding/audit_windows_test.go
+++ b/internal/secaudit/audit_windows_test.go
@@ -3,7 +3,7 @@
 
 //go:build windows
 
-package binding
+package secaudit
 
 import (
 	"os"
diff --git a/internal/transport/config.go b/internal/transport/config.go
index 009e5f2c89..4fe64ddcff 100644
--- a/internal/transport/config.go
+++ b/internal/transport/config.go
@@ -23,9 +23,9 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/larksuite/cli/internal/binding"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/envvars"
+	"github.com/larksuite/cli/internal/secaudit"
 	"github.com/larksuite/cli/internal/vfs"
 )
 
@@ -94,7 +94,7 @@ func Load() (*Config, error) {
 		// egresses and which extra CA is trusted, so a file another local user or
 		// process can tamper with (symlink, foreign owner, group/world-writable)
 		// could redirect credential traffic. Audit it the same way the CA file is.
-		safePath, err := binding.AssertSecurePath(binding.AuditParams{
+		safePath, err := secaudit.AssertSecurePath(secaudit.AuditParams{
 			TargetPath:            p,
 			Label:                 ConfigFileName,
 			AllowReadableByOthers: true, // config is not a secret; only writability/owner/symlink matter
diff --git a/internal/transport/tls_ca.go b/internal/transport/tls_ca.go
index 079cb6f1df..377cb07aff 100644
--- a/internal/transport/tls_ca.go
+++ b/internal/transport/tls_ca.go
@@ -11,8 +11,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/larksuite/cli/internal/binding"
 	"github.com/larksuite/cli/internal/envvars"
+	"github.com/larksuite/cli/internal/secaudit"
 	"github.com/larksuite/cli/internal/vfs"
 )
 
@@ -26,7 +26,7 @@ func applyExtraRootCA(t *http.Transport, caPath string) error {
 	if !filepath.IsAbs(caPath) {
 		return fmt.Errorf("invalid %s %q: must be an absolute path to a PEM file", envvars.CliCAPath, caPath)
 	}
-	safeCAPath, err := binding.AssertSecurePath(binding.AuditParams{
+	safeCAPath, err := secaudit.AssertSecurePath(secaudit.AuditParams{
 		TargetPath:            caPath,
 		Label:                 envvars.CliCAPath,
 		AllowReadableByOthers: true,

From aa50bec07ec079f319d420985d0e57983de651c7 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Sat, 25 Jul 2026 17:56:41 +0800
Subject: [PATCH 17/50] refactor(credential): share the brand parser across
 providers

Removing the internal/core dependency left each credential provider with its
own copy of the brand rule. Two identical five-line functions mean the brand
set can grow in one provider and silently not in the other, with nothing to
catch it at build time.

Move the rule next to the Brand constants as credential.ParseBrand and have
both providers call it. Same behaviour, one definition.
---
 extension/credential/env/env.go          | 10 +---------
 extension/credential/sidecar/provider.go | 10 +---------
 extension/credential/types.go            | 16 +++++++++++++++-
 3 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/extension/credential/env/env.go b/extension/credential/env/env.go
index 9af1693c58..5910b80093 100644
--- a/extension/credential/env/env.go
+++ b/extension/credential/env/env.go
@@ -7,7 +7,6 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"strings"
 
 	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/extension/credential"
@@ -42,7 +41,7 @@ func (p *Provider) ResolveAccount(ctx context.Context) (*credential.Account, err
 			Reason:   envnames.CliAppID + " is set but no app secret or access token is available",
 		}
 	}
-	brand := parseBrand(os.Getenv(envnames.CliBrand))
+	brand := credential.ParseBrand(os.Getenv(envnames.CliBrand))
 	acct := &credential.Account{AppID: appID, AppSecret: appSecret, Brand: brand}
 
 	switch id := credential.Identity(os.Getenv(envnames.CliDefaultAs)); id {
@@ -109,13 +108,6 @@ func (p *Provider) ResolveToken(ctx context.Context, req credential.TokenSpec) (
 	return &credential.Token{Value: token, Source: "env:" + envKey}, nil
 }
 
-func parseBrand(value string) credential.Brand {
-	if strings.ToLower(strings.TrimSpace(value)) == "lark" {
-		return credential.BrandLark
-	}
-	return credential.BrandFeishu
-}
-
 func init() {
 	credential.Register(&Provider{})
 }
diff --git a/extension/credential/sidecar/provider.go b/extension/credential/sidecar/provider.go
index 39a10583ed..87182e5205 100644
--- a/extension/credential/sidecar/provider.go
+++ b/extension/credential/sidecar/provider.go
@@ -14,7 +14,6 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"strings"
 
 	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/extension/credential"
@@ -59,7 +58,7 @@ func (p *Provider) ResolveAccount(ctx context.Context) (*credential.Account, err
 		}
 	}
 
-	brand := parseBrand(os.Getenv(envnames.CliBrand))
+	brand := credential.ParseBrand(os.Getenv(envnames.CliBrand))
 
 	acct := &credential.Account{
 		AppID:     appID,
@@ -124,13 +123,6 @@ func (p *Provider) ResolveToken(ctx context.Context, req credential.TokenSpec) (
 	}, nil
 }
 
-func parseBrand(value string) credential.Brand {
-	if strings.ToLower(strings.TrimSpace(value)) == "lark" {
-		return credential.BrandLark
-	}
-	return credential.BrandFeishu
-}
-
 func init() {
 	credential.Register(&Provider{})
 }
diff --git a/extension/credential/types.go b/extension/credential/types.go
index 209013fda5..19a5dc2afd 100644
--- a/extension/credential/types.go
+++ b/extension/credential/types.go
@@ -3,7 +3,10 @@
 
 package credential
 
-import "context"
+import (
+	"context"
+	"strings"
+)
 
 // Brand represents the Lark platform brand.
 type Brand string
@@ -13,6 +16,17 @@ const (
 	BrandFeishu Brand = "feishu"
 )
 
+// ParseBrand maps a brand string to a Brand, defaulting to BrandFeishu.
+// It lives next to the Brand constants so every credential source resolves the
+// brand the same way; duplicating the rule per provider would let one copy
+// drift when the brand set changes.
+func ParseBrand(value string) Brand {
+	if strings.ToLower(strings.TrimSpace(value)) == string(BrandLark) {
+		return BrandLark
+	}
+	return BrandFeishu
+}
+
 // NoAppSecret marks that a credential source does not provide a real app secret.
 // Token-only sources should return this value instead of inventing placeholder text.
 const NoAppSecret = ""

From 2d1341aff64aa67707e5a7bcfcc9b7ddab881fb8 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Sat, 25 Jul 2026 17:56:42 +0800
Subject: [PATCH 18/50] refactor(convertlib): drop the unused
 interactive-content wrapper

Once events switched to internal/imcontent directly, the convert_lib wrapper
for ConvertInteractiveEventContent had no callers left. It is newly unreachable
code, which the CI dead-code gate rejects because it only tolerates entries
that already exist on the base branch.
---
 shortcuts/im/convert_lib/pure_adapters.go | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/shortcuts/im/convert_lib/pure_adapters.go b/shortcuts/im/convert_lib/pure_adapters.go
index 047fe0841c..00aecd92bc 100644
--- a/shortcuts/im/convert_lib/pure_adapters.go
+++ b/shortcuts/im/convert_lib/pure_adapters.go
@@ -16,12 +16,6 @@ func pureConvertContext(ctx *ConvertContext) *imcontent.ConvertContext {
 	}
 }
 
-// ConvertInteractiveEventContent preserves the former conversion library API
-// while the implementation lives in the lower-level content package.
-func ConvertInteractiveEventContent(rawContent string, mentions []interface{}) string {
-	return imcontent.ConvertInteractiveEventContent(rawContent, mentions)
-}
-
 func unwrapPostLocale(parsed map[string]interface{}) map[string]interface{} {
 	return imcontent.UnwrapPostLocale(parsed)
 }

From 85490cb3daf9810a1e2dd599af88d683c23313c3 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Sat, 25 Jul 2026 17:56:55 +0800
Subject: [PATCH 19/50] fix(authlog): share one authentication logger per
 process
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extracting the logger from keychain replaced an injected package variable with
per-call construction, which regressed two things.

Keychain errors went to the wrong directory. cmdutil used to inject
core.GetRuntimeDir into keychain, so every auth diagnostic landed in the
workspace-aware log. keychain now built its logger with empty Options, falling
back to the pre-workspace ~/.lark-cli path while internal/auth kept passing
core.GetRuntimeDir. Inside a workspace the two halves of one investigation
split across two directories, and LARKSUITE_CLI_LOG_DIR masks it whenever that
override is set.

Each call also built a fresh logger. The sync.Once guarding file creation is
per instance, so every logged line reopened the file — never closed — and
re-ran the week-old-log prune. wrapError fires on every keychain operation, and
a locked keychain is exactly the failure this log exists to diagnose.

Install one logger while the command factory is built, which is the only place
that knows the workspace-aware directory: authlog cannot resolve it itself
because internal/core imports internal/keychain, which imports authlog. Both
callers now read that shared instance, so there is one file handle and one
prune per process. Tests pin the singleton and the install-wins behaviour.

The process-wide variable is a stopgap: the internal/core split can hand the
runtime directory to authlog directly and remove the indirection.
---
 internal/auth/auth_response_log.go  |  6 ++--
 internal/authlog/authlog.go         | 39 ++++++++++++++++++++++
 internal/authlog/authlog_test.go    | 50 +++++++++++++++++++++++++++++
 internal/cmdutil/factory_default.go |  7 ++++
 internal/keychain/keychain.go       |  2 +-
 5 files changed, 101 insertions(+), 3 deletions(-)

diff --git a/internal/auth/auth_response_log.go b/internal/auth/auth_response_log.go
index 54a09c538d..f1f5c0af19 100644
--- a/internal/auth/auth_response_log.go
+++ b/internal/auth/auth_response_log.go
@@ -7,7 +7,6 @@ import (
 	"net/http"
 
 	"github.com/larksuite/cli/internal/authlog"
-	"github.com/larksuite/cli/internal/core"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 )
 
@@ -15,8 +14,11 @@ type authLogger interface {
 	LogResponse(path string, status int, logID string)
 }
 
+// newAuthLogger returns the process-wide authentication logger. It is shared on
+// purpose: one file handle and one log-prune per process, and keychain errors
+// land in the same file as the responses they explain.
 func newAuthLogger() *authlog.Logger {
-	return authlog.New(authlog.Options{RuntimeDir: core.GetRuntimeDir})
+	return authlog.Shared()
 }
 
 // logHTTPResponse logs the HTTP response details for an authentication request.
diff --git a/internal/authlog/authlog.go b/internal/authlog/authlog.go
index 8594d654c8..a43a4a277a 100644
--- a/internal/authlog/authlog.go
+++ b/internal/authlog/authlog.go
@@ -53,6 +53,45 @@ func New(options Options) *Logger {
 	}
 }
 
+// shared holds the process-wide logger. A Logger caches its file handle and
+// prunes week-old logs on first use, so constructing one per call would leak a
+// descriptor and re-run the prune for every line written.
+//
+// SetShared is the single writer and runs once while the command factory is
+// built, which is also the only place that knows the workspace-aware runtime
+// directory. This package cannot resolve that directory itself: internal/core
+// imports internal/keychain, which imports this package, so importing core here
+// would close an import cycle. Untangling that belongs to the internal/core
+// split, after which this indirection can go away.
+var (
+	sharedMu  sync.Mutex
+	sharedLog *Logger
+)
+
+// SetShared installs the process-wide authentication logger.
+func SetShared(logger *Logger) {
+	if logger == nil {
+		return
+	}
+
+	sharedMu.Lock()
+	defer sharedMu.Unlock()
+	sharedLog = logger
+}
+
+// Shared returns the process-wide authentication logger. When the command
+// factory has not installed one — library callers, tests — it falls back to a
+// logger rooted at the pre-workspace runtime directory, matching the behaviour
+// of call paths that ran before workspace detection.
+func Shared() *Logger {
+	sharedMu.Lock()
+	defer sharedMu.Unlock()
+	if sharedLog == nil {
+		sharedLog = New(Options{})
+	}
+	return sharedLog
+}
+
 func defaultRuntimeDir() string {
 	if dir := os.Getenv("LARKSUITE_CLI_CONFIG_DIR"); dir != "" {
 		return dir
diff --git a/internal/authlog/authlog_test.go b/internal/authlog/authlog_test.go
index f1e27a2239..a892009d51 100644
--- a/internal/authlog/authlog_test.go
+++ b/internal/authlog/authlog_test.go
@@ -38,3 +38,53 @@ func TestAuthLogDir_InvalidLogDirFallsBackToConfigDir(t *testing.T) {
 		t.Fatalf("authLogDir() = %q, want %q", got, want)
 	}
 }
+
+// TestShared_ReturnsOneLoggerPerProcess pins the property the callers depend on:
+// every call site must observe the same logger, otherwise each one opens its own
+// file handle and re-runs the log prune.
+func TestShared_ReturnsOneLoggerPerProcess(t *testing.T) {
+	restoreShared(t)
+
+	first := Shared()
+	if first == nil {
+		t.Fatal("Shared() returned nil")
+	}
+	if second := Shared(); second != first {
+		t.Fatalf("Shared() returned a different logger on the second call: %p then %p", first, second)
+	}
+}
+
+// TestSetShared_InstalledLoggerWins covers the startup wiring: the command
+// factory installs a workspace-aware logger and later callers must get it
+// instead of the pre-workspace fallback.
+func TestSetShared_InstalledLoggerWins(t *testing.T) {
+	restoreShared(t)
+
+	installed := New(Options{RuntimeDir: func() string { return "workspace-dir" }})
+	SetShared(installed)
+	if got := Shared(); got != installed {
+		t.Fatalf("Shared() = %p, want the installed logger %p", got, installed)
+	}
+
+	// A nil install must not wipe the configured logger.
+	SetShared(nil)
+	if got := Shared(); got != installed {
+		t.Fatalf("SetShared(nil) replaced the logger: got %p, want %p", got, installed)
+	}
+}
+
+// restoreShared isolates each test from the process-wide logger.
+func restoreShared(t *testing.T) {
+	t.Helper()
+
+	sharedMu.Lock()
+	previous := sharedLog
+	sharedLog = nil
+	sharedMu.Unlock()
+
+	t.Cleanup(func() {
+		sharedMu.Lock()
+		sharedLog = previous
+		sharedMu.Unlock()
+	})
+}
diff --git a/internal/cmdutil/factory_default.go b/internal/cmdutil/factory_default.go
index a4fb5084be..af6f714e32 100644
--- a/internal/cmdutil/factory_default.go
+++ b/internal/cmdutil/factory_default.go
@@ -18,6 +18,7 @@ import (
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/auth"
+	"github.com/larksuite/cli/internal/authlog"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/keychain"
@@ -48,6 +49,12 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 	ws := core.DetectWorkspaceFromEnv(os.Getenv)
 	core.SetCurrentWorkspace(ws)
 
+	// Auth diagnostics: install the one logger the whole process shares, now
+	// that the workspace is known. authlog cannot resolve the workspace-aware
+	// directory itself (core imports keychain, which imports authlog), so this
+	// is the only place that can supply it.
+	authlog.SetShared(authlog.New(authlog.Options{RuntimeDir: core.GetRuntimeDir}))
+
 	// Phase 0: FileIO provider (no dependency)
 	f.FileIOProvider = fileio.GetProvider()
 
diff --git a/internal/keychain/keychain.go b/internal/keychain/keychain.go
index 419382e31b..4dc88d95df 100644
--- a/internal/keychain/keychain.go
+++ b/internal/keychain/keychain.go
@@ -47,7 +47,7 @@ func wrapError(op string, err error) error {
 
 	func() {
 		defer func() { recover() }()
-		authlog.New(authlog.Options{}).LogError("keychain", op, fmt.Errorf("keychain %s error: %w", op, err))
+		authlog.Shared().LogError("keychain", op, fmt.Errorf("keychain %s error: %w", op, err))
 	}()
 
 	return errs.NewAPIError(errs.SubtypeUnknown, "%s", msg).

From 602f6719dcd3398cefbc30299fa3e835a81edd43 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Sat, 25 Jul 2026 18:06:42 +0800
Subject: [PATCH 20/50] chore(qualitygate): align the bootstrap baseline with
 the merged registry

The approved bootstrap snapshot records the registry size at the moment the
file first reaches the target branch, and it is the only check that runs in
that situation. This change now carries both the registry and the first round
of cleanup, so the file lands on main holding 18 edges rather than the 39 it
was pinned to.

Update the count and hash to match, and state in a comment why the baseline
stays hardcoded: a value CI could supply would let anyone raise the approved
size without the change appearing in a diff.
---
 scripts/check-layering-ratchet.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/scripts/check-layering-ratchet.sh b/scripts/check-layering-ratchet.sh
index ad76b2cabd..336275a43d 100644
--- a/scripts/check-layering-ratchet.sh
+++ b/scripts/check-layering-ratchet.sh
@@ -87,8 +87,12 @@ layering_ratchet_main() (
   fi
 
   local base_revision="${1:-${QUALITY_GATE_CHANGED_FROM:-}}"
-  local approved_initial_count="${2:-39}"
-  local approved_initial_hash="${3:-5636d50d10b9de1e08dc9f06cd66671b3f438650fa5b7f28b95aa7d5a69a1c21}"
+  # The approved size of the registry at the moment it first reaches the target
+  # branch. Only consulted while the target branch has no registry file, so it
+  # is read exactly once: on the change that introduces the file. Hardcoded on
+  # purpose — a configurable baseline could be raised in CI without review.
+  local approved_initial_count="${2:-18}"
+  local approved_initial_hash="${3:-3e7c5e9cb420248b817a3fdbe936069dbb295398751eee4f66b36cfa571d111b}"
   if [[ -z "$base_revision" ]]; then
     echo "Layering ratchet requires a base revision." >&2
     return 1

From aec9c4677d5139d172b32b8ce36ac96d9591d580 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Mon, 27 Jul 2026 11:21:42 +0800
Subject: [PATCH 21/50] fix(authlog): allow the cleanup panic notice and cover
 the logger
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two things surfaced once CI compared this branch against main.

The panic notice in cleanupOldLogs writes to os.Stderr, which forbidigo
rejects. The line is unchanged from internal/keychain, but moving the file
makes every line new to a diff-scoped linter. This package is a leaf with no
IOStreams in scope — the same constraint defaultRuntimeDir already documents —
and a panic in background cleanup still has to be visible, so mark it the way
internal/output marks its equivalent stderr write.

Coverage of the package sat at 28.6%: the extraction brought no test for what
the logger actually writes. Add three. One pins that lines land under the
supplied RuntimeDir, which is the property that regressed when a caller
constructed the logger with empty options. One covers the nil-receiver guard
both entry points carry. One pins the seven-day retention window and the
filename patterns the prune may touch. Coverage is now 80.5%.
---
 internal/authlog/authlog.go      |  3 ++
 internal/authlog/authlog_test.go | 74 ++++++++++++++++++++++++++++++++
 2 files changed, 77 insertions(+)

diff --git a/internal/authlog/authlog.go b/internal/authlog/authlog.go
index a43a4a277a..9f7edbbe9b 100644
--- a/internal/authlog/authlog.go
+++ b/internal/authlog/authlog.go
@@ -199,6 +199,9 @@ func (l *Logger) LogError(component, op string, err error) {
 func cleanupOldLogs(dir string, now time.Time) {
 	defer func() {
 		if r := recover(); r != nil {
+			//nolint:forbidigo // same leaf-package constraint as defaultRuntimeDir: no
+			// IOStreams in scope, and a panic in background cleanup must still be
+			// visible. Carried over unchanged from internal/keychain.
 			fmt.Fprintf(os.Stderr, "[lark-cli] [WARN] background log cleanup panicked: %v\n", r)
 		}
 	}()
diff --git a/internal/authlog/authlog_test.go b/internal/authlog/authlog_test.go
index a892009d51..b2fb35d9e6 100644
--- a/internal/authlog/authlog_test.go
+++ b/internal/authlog/authlog_test.go
@@ -4,8 +4,12 @@
 package authlog
 
 import (
+	"errors"
+	"os"
 	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 )
 
 // TestAuthLogDir_UsesValidatedLogDirEnv verifies that a valid absolute
@@ -73,6 +77,76 @@ func TestSetShared_InstalledLoggerWins(t *testing.T) {
 	}
 }
 
+// TestLogger_WritesUnderTheConfiguredRuntimeDir guards the directory the logger
+// picks. A caller that supplies a workspace-aware RuntimeDir must get its lines
+// there; falling back to the process default silently splits one investigation
+// across two files.
+func TestLogger_WritesUnderTheConfiguredRuntimeDir(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_LOG_DIR", "")
+	runtimeDir := t.TempDir()
+	now := time.Date(2026, 7, 25, 10, 0, 0, 0, time.UTC)
+
+	logger := New(Options{
+		RuntimeDir: func() string { return runtimeDir },
+		Now:        func() time.Time { return now },
+		Args:       func() []string { return []string{"lark-cli", "auth", "login"} },
+	})
+	logger.LogResponse("/open-apis/authen/v1/user_info", 200, "logid-1")
+	logger.LogError("keychain", "Get", errors.New("keychain locked"))
+
+	path := filepath.Join(runtimeDir, "logs", "auth-2026-07-25.log")
+	body, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read %s: %v", path, err)
+	}
+
+	for _, want := range []string{
+		"auth-response:", "status=200", "x-tt-logid=logid-1",
+		"auth-error:", "component=keychain", "op=Get", "keychain locked",
+		"cmdline=lark-cli auth login",
+	} {
+		if !strings.Contains(string(body), want) {
+			t.Errorf("log is missing %q:\n%s", want, body)
+		}
+	}
+}
+
+// TestLogger_NilReceiverIsInert covers the guard both entry points carry, so a
+// caller holding no logger cannot turn a diagnostic into a crash.
+func TestLogger_NilReceiverIsInert(t *testing.T) {
+	var logger *Logger
+	logger.LogResponse("/path", 500, "logid")
+	logger.LogError("keychain", "Get", errors.New("boom"))
+}
+
+// TestCleanupOldLogs_PrunesOnlyExpiredAuthLogs pins the retention window and the
+// filename patterns it is allowed to touch.
+func TestCleanupOldLogs_PrunesOnlyExpiredAuthLogs(t *testing.T) {
+	dir := t.TempDir()
+	now := time.Date(2026, 7, 25, 10, 0, 0, 0, time.UTC)
+	survives := map[string]bool{
+		"auth-2026-07-25.log":  true,  // today
+		"auth-2026-07-18.log":  true,  // exactly at the seven-day cutoff
+		"auth-2026-07-17.log":  false, // past the cutoff
+		"auth-not-a-date.log":  true,  // unparsable, left alone
+		"other-2020-01-01.log": true,  // not an auth log
+	}
+	for name := range survives {
+		if err := os.WriteFile(filepath.Join(dir, name), []byte("x"), 0o600); err != nil {
+			t.Fatalf("seed %s: %v", name, err)
+		}
+	}
+
+	cleanupOldLogs(dir, now)
+
+	for name, want := range survives {
+		_, err := os.Stat(filepath.Join(dir, name))
+		if got := err == nil; got != want {
+			t.Errorf("%s present = %v, want %v", name, got, want)
+		}
+	}
+}
+
 // restoreShared isolates each test from the process-wide logger.
 func restoreShared(t *testing.T) {
 	t.Helper()

From 4073e75def97d829fb2624e2dcc15b5ff2782e77 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Mon, 27 Jul 2026 14:14:10 +0800
Subject: [PATCH 22/50] fix(qualitygate): exempt single edges instead of whole
 packages

Two packages were listed in ExceptFrom, which makes the evaluator skip the
source package before it looks at any dependency. gitcred needs keychain and
vfs; manifest-export needs the cmd root. Exempting them wholesale also cleared
every other denied import, so a later gitcred -> internal/client or
manifest-export -> events would pass the gate and never reach the registry. A
probe confirmed both slip through unreported.

Add ExceptEdges, matched on the exact (from, denied) pair, and move these two
across. ExceptFrom stays for packages whose whole job is to sit on the boundary
the rule draws: the shortcuts/common runtime gate, the cmd assembly roots, the
wrapper-main demos. Contract tests feed each package its allowed imports plus
one denied import and assert exactly one violation, so the allowed edges carry
weight instead of being asserted trivially.
---
 internal/qualitygate/deptest/layering_test.go | 76 ++++++++++++++++---
 1 file changed, 65 insertions(+), 11 deletions(-)

diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index 2c27ef8d01..86ff7bbd80 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -42,8 +42,15 @@ type Rule struct {
 	Mode       Mode
 	FromPrefix string
 	Denied     []string
-	// ExceptFrom exempts import paths matched exactly.
+	// ExceptFrom exempts import paths matched exactly, for packages whose whole
+	// job is to sit on the boundary the rule draws: a runtime gate, an assembly
+	// root, a demo of the fork pattern. Reach for ExceptEdges instead whenever
+	// the package merely happens to need one or two of the denied imports, since
+	// exempting it wholesale also clears every denied import added later.
 	ExceptFrom []string
+	// ExceptEdges exempts single (from, denied) pairs, both matched exactly. The
+	// package stays under the rule for everything else.
+	ExceptEdges []layeringEdge
 	// AllowedRepoDeps inverts the check. When set, every dependency inside this
 	// module that is not listed here (matched exactly) is a violation and Denied
 	// is unused. Dependencies outside the module - standard library and
@@ -113,9 +120,13 @@ var rules = []Rule{
 			modulePath + "/internal/client",
 			modulePath + "/internal/vfs",
 		},
-		ExceptFrom: []string{
-			modulePath + "/shortcuts/common",
-			modulePath + "/shortcuts/apps/gitcred",
+		// shortcuts/common is the runtime gate itself, so it holds all five.
+		ExceptFrom: []string{modulePath + "/shortcuts/common"},
+		// gitcred only needs these two to read the git credential helper's
+		// store; it stays under the rule for auth, credential and client.
+		ExceptEdges: []layeringEdge{
+			{From: modulePath + "/shortcuts/apps/gitcred", Denied: modulePath + "/internal/keychain"},
+			{From: modulePath + "/shortcuts/apps/gitcred", Denied: modulePath + "/internal/vfs"},
 		},
 	},
 	{
@@ -143,8 +154,11 @@ var rules = []Rule{
 			modulePath + "/shortcuts",
 			modulePath + "/events",
 		},
-		ExceptFrom: []string{
-			modulePath + "/internal/qualitygate/cmd/manifest-export",
+		// The command-tree collector has to walk the assembled tree to export it;
+		// deptest_test.go asserts that dependency exists. It stays under the rule
+		// for shortcuts and events.
+		ExceptEdges: []layeringEdge{
+			{From: modulePath + "/internal/qualitygate/cmd/manifest-export", Denied: modulePath + "/cmd"},
 		},
 	},
 }
@@ -484,9 +498,10 @@ func TestLayeringRuleContracts(t *testing.T) {
 				modulePath + "/internal/client",
 				modulePath + "/internal/vfs",
 			},
-			ExceptFrom: []string{
-				modulePath + "/shortcuts/common",
-				modulePath + "/shortcuts/apps/gitcred",
+			ExceptFrom: []string{modulePath + "/shortcuts/common"},
+			ExceptEdges: []layeringEdge{
+				{From: modulePath + "/shortcuts/apps/gitcred", Denied: modulePath + "/internal/keychain"},
+				{From: modulePath + "/shortcuts/apps/gitcred", Denied: modulePath + "/internal/vfs"},
 			},
 		},
 		{
@@ -514,8 +529,8 @@ func TestLayeringRuleContracts(t *testing.T) {
 				modulePath + "/shortcuts",
 				modulePath + "/events",
 			},
-			ExceptFrom: []string{
-				modulePath + "/internal/qualitygate/cmd/manifest-export",
+			ExceptEdges: []layeringEdge{
+				{From: modulePath + "/internal/qualitygate/cmd/manifest-export", Denied: modulePath + "/cmd"},
 			},
 		},
 	}
@@ -668,6 +683,42 @@ func TestLayeringRuleContracts(t *testing.T) {
 			wantFrom:   modulePath + "/shortcuts/im",
 			wantDenied: modulePath + "/internal/auth",
 		},
+		{
+			// The edge exemption is per (from, denied) pair: gitcred keeps the two
+			// it needs and stays covered for the other three. Asserting a single
+			// violation is what makes the two allowed edges load-bearing here.
+			name:     "shortcuts-gitcred-keeps-only-its-two-edges",
+			ruleName: "shortcuts-runtime-gate",
+			packages: []listedPackage{
+				{
+					ImportPath: modulePath + "/shortcuts/apps/gitcred",
+					Imports: []string{
+						modulePath + "/internal/keychain",
+						modulePath + "/internal/vfs",
+						modulePath + "/internal/client",
+					},
+				},
+			},
+			wantFrom:   modulePath + "/shortcuts/apps/gitcred",
+			wantDenied: modulePath + "/internal/client",
+		},
+		{
+			// Same shape for the command-tree collector: cmd is exempt, the rest of
+			// the rule still applies to it.
+			name:     "internal-collector-keeps-only-the-cmd-edge",
+			ruleName: "internal-no-upper",
+			packages: []listedPackage{
+				{
+					ImportPath: modulePath + "/internal/qualitygate/cmd/manifest-export",
+					Imports: []string{
+						modulePath + "/cmd",
+						modulePath + "/events",
+					},
+				},
+			},
+			wantFrom:   modulePath + "/internal/qualitygate/cmd/manifest-export",
+			wantDenied: modulePath + "/events",
+		},
 		{
 			name:     "cmd-direct-denial-and-assembly-exceptions",
 			ruleName: "cmd-assembly-only",
@@ -1550,6 +1601,9 @@ func evaluateLayeringRule(packages []listedPackage, rule Rule) []layeringViolati
 			if !ruleRejectsDependency(rule, dependency) {
 				continue
 			}
+			if slices.Contains(rule.ExceptEdges, layeringEdge{From: pkg.ImportPath, Denied: dependency}) {
+				continue
+			}
 			violations = append(violations, layeringViolation{
 				layeringEdge: layeringEdge{
 					From:   pkg.ImportPath,

From b028c33e8fa7e208dc6bbb81f5fc5077a7df6017 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Mon, 27 Jul 2026 14:14:10 +0800
Subject: [PATCH 23/50] fix(authlog): keep the installed logger for the life of
 the process
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The package documents one logger and one file handle per process, but SetShared
overwrote the current instance on every call and the factory can be built more
than once. A second construction opened a second file, left the first one open
with no way to close it, and moved later lines to whichever workspace directory
that construction resolved.

Only the first explicit install now takes effect. A lazily created fallback is
not an explicit install, so the first real one still replaces it — and closes
the file it had opened, which needs the handle to be retained rather than
handed to log.New and forgotten. The once-guarded init becomes a mutex so the
handle can be released safely; a closed logger drops writes instead of pointing
at a file nobody reads.

Tests cover two non-nil installs and the fallback handover, and both fail if
the guard is removed.
---
 internal/authlog/authlog.go      | 107 +++++++++++++++++++++++--------
 internal/authlog/authlog_test.go |  64 ++++++++++++++++--
 2 files changed, 136 insertions(+), 35 deletions(-)

diff --git a/internal/authlog/authlog.go b/internal/authlog/authlog.go
index 9f7edbbe9b..2ea988d477 100644
--- a/internal/authlog/authlog.go
+++ b/internal/authlog/authlog.go
@@ -28,10 +28,15 @@ type Options struct {
 // Logger records authentication diagnostics in a workspace-specific log.
 type Logger struct {
 	runtimeDir func() string
-	logger     *log.Logger
-	loggerOnce sync.Once
 	now        func() time.Time
 	args       func() []string
+
+	// mu guards everything below. The file handle is retained so a logger that
+	// gets superseded can release it instead of waiting for process exit.
+	mu       sync.Mutex
+	resolved bool
+	logger   *log.Logger
+	file     *os.File
 }
 
 // New creates an authentication logger with explicit dependencies.
@@ -64,11 +69,17 @@ func New(options Options) *Logger {
 // would close an import cycle. Untangling that belongs to the internal/core
 // split, after which this indirection can go away.
 var (
-	sharedMu  sync.Mutex
-	sharedLog *Logger
+	sharedMu        sync.Mutex
+	sharedLog       *Logger
+	sharedInstalled bool
 )
 
-// SetShared installs the process-wide authentication logger.
+// SetShared installs the process-wide authentication logger. Only the first
+// explicit install takes effect: the factory can be constructed more than once
+// in one process, and letting a later construction swap the logger would open a
+// second file and silently move subsequent lines to another workspace
+// directory. A lazily created fallback is not an explicit install, so the first
+// real one replaces it and closes the file it had opened.
 func SetShared(logger *Logger) {
 	if logger == nil {
 		return
@@ -76,7 +87,16 @@ func SetShared(logger *Logger) {
 
 	sharedMu.Lock()
 	defer sharedMu.Unlock()
+	if sharedInstalled {
+		return
+	}
+
+	superseded := sharedLog
 	sharedLog = logger
+	sharedInstalled = true
+	if superseded != nil {
+		_ = superseded.close()
+	}
 }
 
 // Shared returns the process-wide authentication logger. When the command
@@ -122,25 +142,56 @@ func (l *Logger) logDir() string {
 	return filepath.Join(l.runtimeDir(), "logs")
 }
 
-func (l *Logger) init() {
-	l.loggerOnce.Do(func() {
-		if l.logger != nil {
-			return
-		}
+// writer resolves the destination on first use and returns nil when the log
+// file could not be opened, or when this logger has been superseded.
+func (l *Logger) writer() *log.Logger {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if l.resolved {
+		return l.logger
+	}
+	l.resolved = true
+	if l.logger != nil {
+		return l.logger
+	}
 
-		dir := l.logDir()
-		now := l.now()
-		if err := vfs.MkdirAll(dir, 0700); err != nil {
-			return
-		}
+	dir := l.logDir()
+	now := l.now()
+	if err := vfs.MkdirAll(dir, 0700); err != nil {
+		return nil
+	}
 
-		logName := fmt.Sprintf("auth-%s.log", now.Format("2006-01-02"))
-		logPath := filepath.Join(dir, logName)
-		if f, err := vfs.OpenFile(logPath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600); err == nil {
-			l.logger = log.New(f, "", 0)
-			cleanupOldLogs(dir, now)
-		}
-	})
+	logName := fmt.Sprintf("auth-%s.log", now.Format("2006-01-02"))
+	logPath := filepath.Join(dir, logName)
+	f, err := vfs.OpenFile(logPath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
+	if err != nil {
+		return nil
+	}
+
+	l.logger = log.New(f, "", 0)
+	l.file = f
+	cleanupOldLogs(dir, now)
+	return l.logger
+}
+
+// close releases the log file, if one was opened, and stops the logger from
+// opening another. Writes after this point are dropped rather than landing in a
+// file nobody reads.
+func (l *Logger) close() error {
+	if l == nil {
+		return nil
+	}
+
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.resolved = true
+	l.logger = nil
+	file := l.file
+	l.file = nil
+	if file == nil {
+		return nil
+	}
+	return file.Close()
 }
 
 func FormatAuthCmdline(args []string) string {
@@ -160,12 +211,12 @@ func (l *Logger) LogResponse(path string, status int, logID string) {
 	if l == nil {
 		return
 	}
-	l.init()
-	if l.logger == nil {
+	writer := l.writer()
+	if writer == nil {
 		return
 	}
 
-	l.logger.Printf(
+	writer.Printf(
 		"[lark-cli] auth-response: time=%s path=%s status=%d x-tt-logid=%s cmdline=%s",
 		l.now().Format(time.RFC3339Nano),
 		path,
@@ -181,12 +232,12 @@ func (l *Logger) LogError(component, op string, err error) {
 		return
 	}
 
-	l.init()
-	if l.logger == nil {
+	writer := l.writer()
+	if writer == nil {
 		return
 	}
 
-	l.logger.Printf(
+	writer.Printf(
 		"[lark-cli] auth-error: time=%s component=%s op=%s error=%q cmdline=%s",
 		l.now().Format(time.RFC3339Nano),
 		component,
diff --git a/internal/authlog/authlog_test.go b/internal/authlog/authlog_test.go
index b2fb35d9e6..deab489f82 100644
--- a/internal/authlog/authlog_test.go
+++ b/internal/authlog/authlog_test.go
@@ -5,11 +5,12 @@ package authlog
 
 import (
 	"errors"
-	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"time"
+
+	"github.com/larksuite/cli/internal/vfs"
 )
 
 // TestAuthLogDir_UsesValidatedLogDirEnv verifies that a valid absolute
@@ -95,7 +96,7 @@ func TestLogger_WritesUnderTheConfiguredRuntimeDir(t *testing.T) {
 	logger.LogError("keychain", "Get", errors.New("keychain locked"))
 
 	path := filepath.Join(runtimeDir, "logs", "auth-2026-07-25.log")
-	body, err := os.ReadFile(path)
+	body, err := vfs.ReadFile(path)
 	if err != nil {
 		t.Fatalf("read %s: %v", path, err)
 	}
@@ -132,7 +133,7 @@ func TestCleanupOldLogs_PrunesOnlyExpiredAuthLogs(t *testing.T) {
 		"other-2020-01-01.log": true,  // not an auth log
 	}
 	for name := range survives {
-		if err := os.WriteFile(filepath.Join(dir, name), []byte("x"), 0o600); err != nil {
+		if err := vfs.WriteFile(filepath.Join(dir, name), []byte("x"), 0o600); err != nil {
 			t.Fatalf("seed %s: %v", name, err)
 		}
 	}
@@ -140,25 +141,74 @@ func TestCleanupOldLogs_PrunesOnlyExpiredAuthLogs(t *testing.T) {
 	cleanupOldLogs(dir, now)
 
 	for name, want := range survives {
-		_, err := os.Stat(filepath.Join(dir, name))
+		_, err := vfs.Stat(filepath.Join(dir, name))
 		if got := err == nil; got != want {
 			t.Errorf("%s present = %v, want %v", name, got, want)
 		}
 	}
 }
 
+// TestSetShared_FirstExplicitInstallWins covers a factory being constructed more
+// than once in one process. A later install must not swap the logger: that would
+// open a second file and move subsequent lines to another workspace directory.
+func TestSetShared_FirstExplicitInstallWins(t *testing.T) {
+	restoreShared(t)
+
+	first := New(Options{RuntimeDir: func() string { return "first" }})
+	second := New(Options{RuntimeDir: func() string { return "second" }})
+	SetShared(first)
+	SetShared(second)
+
+	if got := Shared(); got != first {
+		t.Fatalf("Shared() = %p, want the first installed logger %p", got, first)
+	}
+}
+
+// TestSetShared_ReleasesTheSupersededFallback pins the one replacement that is
+// allowed: a lazily created fallback gives way to the first explicit install,
+// and its file handle is released rather than held until the process exits.
+func TestSetShared_ReleasesTheSupersededFallback(t *testing.T) {
+	restoreShared(t)
+	t.Setenv("LARKSUITE_CLI_LOG_DIR", "")
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	fallback := Shared()
+	fallback.LogError("keychain", "Get", errors.New("before the factory exists"))
+	fallback.mu.Lock()
+	opened := fallback.file != nil
+	fallback.mu.Unlock()
+	if !opened {
+		t.Fatal("fallback did not open a log file, so the release path is untested")
+	}
+
+	installed := New(Options{RuntimeDir: func() string { return t.TempDir() }})
+	SetShared(installed)
+
+	if got := Shared(); got != installed {
+		t.Fatalf("Shared() = %p, want the installed logger %p", got, installed)
+	}
+	fallback.mu.Lock()
+	defer fallback.mu.Unlock()
+	if fallback.file != nil {
+		t.Error("superseded fallback still holds its file handle")
+	}
+	if fallback.logger != nil {
+		t.Error("superseded fallback can still write")
+	}
+}
+
 // restoreShared isolates each test from the process-wide logger.
 func restoreShared(t *testing.T) {
 	t.Helper()
 
 	sharedMu.Lock()
-	previous := sharedLog
-	sharedLog = nil
+	previousLog, previousInstalled := sharedLog, sharedInstalled
+	sharedLog, sharedInstalled = nil, false
 	sharedMu.Unlock()
 
 	t.Cleanup(func() {
 		sharedMu.Lock()
-		sharedLog = previous
+		sharedLog, sharedInstalled = previousLog, previousInstalled
 		sharedMu.Unlock()
 	})
 }

From bf56e903ba833416478fb563b017e4dc86f4e859 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Mon, 27 Jul 2026 14:37:02 +0800
Subject: [PATCH 24/50] docs: point the two brand parsers at each other

Removing extension's dependency on internal left the brand rule implemented
twice, once per Brand type. The two cannot share code: extension is published
as a standalone SDK and may not import internal, which is the constraint this
branch exists to establish. Cross-reference them so a third brand is added to
both rather than to whichever one the next author happens to open.

Also correct the timestamp wrapper's comment, which has claimed "HH:mm" since
before this branch while every implementation formatted seconds too.
---
 extension/credential/types.go       | 5 +++++
 internal/core/types.go              | 4 ++++
 shortcuts/im/convert_lib/helpers.go | 2 +-
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/extension/credential/types.go b/extension/credential/types.go
index 19a5dc2afd..79e980ada8 100644
--- a/extension/credential/types.go
+++ b/extension/credential/types.go
@@ -20,6 +20,11 @@ const (
 // It lives next to the Brand constants so every credential source resolves the
 // brand the same way; duplicating the rule per provider would let one copy
 // drift when the brand set changes.
+//
+// internal/core.ParseBrand applies the same rule to core.LarkBrand, which the
+// rest of the CLI uses. The two cannot share an implementation: this package is
+// published as a standalone SDK and may not import internal. Adding a brand
+// means changing both.
 func ParseBrand(value string) Brand {
 	if strings.ToLower(strings.TrimSpace(value)) == string(BrandLark) {
 		return BrandLark
diff --git a/internal/core/types.go b/internal/core/types.go
index 29720d4c35..c2bc95d7d9 100644
--- a/internal/core/types.go
+++ b/internal/core/types.go
@@ -17,6 +17,10 @@ const (
 
 // ParseBrand normalizes a brand string (case-insensitive, whitespace-tolerant);
 // anything other than "lark" normalizes to BrandFeishu.
+//
+// extension/credential.ParseBrand applies the same rule to its own Brand type.
+// The two cannot share an implementation: extension is published as a standalone
+// SDK and may not import internal. Adding a brand means changing both.
 func ParseBrand(value string) LarkBrand {
 	if strings.ToLower(strings.TrimSpace(value)) == "lark" {
 		return BrandLark
diff --git a/shortcuts/im/convert_lib/helpers.go b/shortcuts/im/convert_lib/helpers.go
index 9ef681cbe0..e416e0dc13 100644
--- a/shortcuts/im/convert_lib/helpers.go
+++ b/shortcuts/im/convert_lib/helpers.go
@@ -24,7 +24,7 @@ func ResolveMentionKeys(text string, mentionMap map[string]string) string {
 }
 
 // formatTimestamp converts a Unix timestamp string (seconds or milliseconds) to
-// "YYYY-MM-DD HH:mm" local time. Values with fewer than 10 digits are treated as
+// "YYYY-MM-DD HH:mm:ss" local time. Values with fewer than 10 digits are treated as
 // seconds; larger values are treated as milliseconds.
 // Returns empty string if the input is empty or unparseable.
 func formatTimestamp(ts string) string {

From 52a1187c2076e3b6ba726860b25e40a779679865 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Mon, 27 Jul 2026 15:23:02 +0800
Subject: [PATCH 25/50] test(qualitygate): detect build tags the union never
 scans

The build-tag list was checked against a literal, so the test only caught edits
to the list itself. A tag introduced anywhere else left its files out of every
graph and the rules went quiet on them, with nothing to notice. The platform
list does not have this hole: it is cross-checked against .goreleaser.yml.

Walk the tree for //go:build constraints and require every custom tag to be
either unioned or listed as excluded. GOOS, GOARCH and toolchain terms come
from `go tool dist list` so a new port cannot look like a custom tag.

Exclusions now carry a reason that is verified rather than asserted: the two
demo tags are skipped because their files sit outside every rule's FromPrefix,
and the test fails if a file carrying one ever lands inside one. A listed
exclusion nobody uses fails too, so the list cannot rot.
---
 internal/qualitygate/deptest/layering_test.go | 149 +++++++++++++++++-
 1 file changed, 146 insertions(+), 3 deletions(-)

diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index 86ff7bbd80..4bc39bb58d 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"io/fs"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -221,11 +222,21 @@ var layeringBuildTargets = []goListTarget{
 }
 
 // layeringBuildTags is the set of build tags whose import graphs are unioned
-// before evaluating the rules. Demo-only tags (authsidecar_demo,
-// authsidecar_multi_tenant_demo) are intentionally excluded: that code lives
-// under sidecar/server-demo*/ and never sits in a layer any rule governs.
+// before evaluating the rules. A tag that appears in neither this list nor
+// layeringExcludedBuildTags leaves its files unscanned, so
+// TestLayeringBuildTagsCoverTheRepository requires every custom tag in the tree
+// to appear in one of them.
 var layeringBuildTags = []string{"", "authsidecar"}
 
+// layeringExcludedBuildTags names custom build tags deliberately left out of the
+// union. The reason is checked, not just recorded: every file carrying one of
+// these must sit outside every rule's FromPrefix, so enabling the tag cannot
+// change what the rules see.
+var layeringExcludedBuildTags = map[string]string{
+	"authsidecar_demo":              "demo binary under sidecar/, which no rule governs",
+	"authsidecar_multi_tenant_demo": "demo binary under sidecar/, which no rule governs",
+}
+
 type layeringEdge struct {
 	From   string
 	Denied string
@@ -894,6 +905,138 @@ func TestLayeringBuildTags(t *testing.T) {
 	}
 }
 
+// TestLayeringBuildTagsCoverTheRepository closes the gap the list above cannot
+// close on its own: comparing it against a literal only catches edits to the
+// list, never a build tag introduced somewhere else. A tag nobody added here
+// leaves its files out of every graph, and the rules go quiet on them.
+func TestLayeringBuildTagsCoverTheRepository(t *testing.T) {
+	root := repoRoot(t)
+	tagFiles := collectCustomBuildTags(t, root)
+
+	for tag, files := range tagFiles {
+		if slices.Contains(layeringBuildTags, tag) {
+			continue
+		}
+		reason, excluded := layeringExcludedBuildTags[tag]
+		if !excluded {
+			t.Errorf(
+				"build tag %q is used by %v but is neither unioned into layeringBuildTags nor listed in layeringExcludedBuildTags; its files are never scanned",
+				tag, files,
+			)
+			continue
+		}
+
+		// The exclusion claims the tagged code sits outside every rule. Check it,
+		// so the reason cannot quietly stop being true.
+		for _, file := range files {
+			pkg := packageImportPath(root, file)
+			for _, rule := range rules {
+				if matchesPackagePrefix(rule.FromPrefix, pkg) {
+					t.Errorf(
+						"build tag %q is excluded because %s, but %s is governed by %s; union the tag instead",
+						tag, reason, pkg, rule.Name,
+					)
+				}
+			}
+		}
+	}
+
+	for tag := range layeringExcludedBuildTags {
+		if _, used := tagFiles[tag]; !used {
+			t.Errorf("build tag %q is listed as excluded but no file uses it; drop the entry", tag)
+		}
+	}
+}
+
+// collectCustomBuildTags maps every non-platform build tag in the tree to the
+// files that carry it. GOOS, GOARCH and toolchain terms come from the toolchain
+// itself rather than a hand-kept list, so a new port cannot look like a custom
+// tag.
+func collectCustomBuildTags(t *testing.T, root string) map[string][]string {
+	t.Helper()
+	builtin := toolchainBuildTerms(t)
+	constraint := regexp.MustCompile(`(?m)^//go:build (.+)$`)
+	splitter := regexp.MustCompile(`[\s()&|!,]+`)
+
+	tags := make(map[string][]string)
+	err := filepath.WalkDir(root, func(path string, entry fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if entry.IsDir() {
+			if entry.Name() == ".git" || entry.Name() == "node_modules" {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+		if !strings.HasSuffix(path, ".go") {
+			return nil
+		}
+
+		content, err := vfs.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		relative, err := filepath.Rel(root, path)
+		if err != nil {
+			return err
+		}
+		for _, match := range constraint.FindAllStringSubmatch(string(content), -1) {
+			for _, term := range splitter.Split(match[1], -1) {
+				if term == "" || builtin[term] || strings.HasPrefix(term, "go1.") {
+					continue
+				}
+				relative = filepath.ToSlash(relative)
+				if !slices.Contains(tags[term], relative) {
+					tags[term] = append(tags[term], relative)
+				}
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("walk %s: %v", root, err)
+	}
+	return tags
+}
+
+// toolchainBuildTerms returns the build constraint terms Go defines itself.
+func toolchainBuildTerms(t *testing.T) map[string]bool {
+	t.Helper()
+	cmd := exec.Command("go", "tool", "dist", "list")
+	out, err := cmd.Output()
+	if err != nil {
+		t.Fatalf("go tool dist list: %v", err)
+	}
+
+	terms := map[string]bool{
+		// Not ports: toolchain and meta terms Go recognises on its own.
+		"cgo": true, "gc": true, "gccgo": true, "race": true, "msan": true,
+		"asan": true, "unix": true, "boringcrypto": true,
+		// Conventional marker for files excluded from every build.
+		"ignore": true,
+	}
+	for _, pair := range strings.Fields(string(out)) {
+		goos, goarch, found := strings.Cut(pair, "/")
+		if !found {
+			continue
+		}
+		terms[goos] = true
+		terms[goarch] = true
+	}
+	return terms
+}
+
+// packageImportPath maps a file inside the module to the import path of the
+// package that holds it.
+func packageImportPath(root, relativeFile string) string {
+	dir := filepath.ToSlash(filepath.Dir(relativeFile))
+	if dir == "." {
+		return modulePath
+	}
+	return modulePath + "/" + dir
+}
+
 func TestLayeringBuildTargetsMatchGoReleaser(t *testing.T) {
 	root := repoRoot(t)
 	content, err := vfs.ReadFile(filepath.Join(root, ".goreleaser.yml"))

From 475f04a8dd6ed9747cdfcc231107e96e2284b6c8 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Mon, 27 Jul 2026 15:43:46 +0800
Subject: [PATCH 26/50] fix(authlog): stop trusting argument position, and
 speak up on a rejected log dir
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two behaviours carried over from internal/keychain, both left as they were when
the package moved.

FormatAuthCmdline kept the first three arguments. That protected secrets only
while no sensitive flag appeared early: a global flag in front of the
subcommand put its value straight into a file that is world-readable to the
user, kept for seven days. Today's CLI cannot reach that state — the only
persistent flag is --profile and secrets arrive through --app-secret-stdin — so
this is about the shape, not a live leak. Drop everything from the first flag
onward instead. A denylist of sensitive names would need extending whenever one
is added; the command path is what the log is for, and it lives entirely in the
leading non-flag arguments. args[0] is reduced to its base name so an absolute
install path stays out too.

logDir swallowed the error when LARKSUITE_CLI_LOG_DIR failed validation and
wrote elsewhere while the caller kept watching the path they configured. Warn
instead. This fires only on a rejected override, not on every run, and logDir
resolves once per process.

Tests cover a flag ahead of the subcommand, the absolute-path case, and that a
usable override still prints nothing.
---
 internal/authlog/authlog.go      |  40 +++++++++++-
 internal/authlog/authlog_test.go | 108 +++++++++++++++++++++++++++++++
 2 files changed, 145 insertions(+), 3 deletions(-)

diff --git a/internal/authlog/authlog.go b/internal/authlog/authlog.go
index 2ea988d477..129ddf9444 100644
--- a/internal/authlog/authlog.go
+++ b/internal/authlog/authlog.go
@@ -137,6 +137,18 @@ func (l *Logger) logDir() string {
 		if err == nil {
 			return safeDir
 		}
+		// The caller asked for a specific directory and it was rejected. Staying
+		// quiet would send the logs elsewhere while they keep watching the path
+		// they configured. This fires only on a rejected override, and logDir
+		// resolves once per process.
+		//
+		//nolint:forbidigo // leaf package with no IOStreams in scope; keychain
+		// surfaces its own directory warning the same way.
+		fmt.Fprintf(
+			os.Stderr,
+			"[lark-cli] [WARN] LARKSUITE_CLI_LOG_DIR is unusable (%v); writing auth logs under the default directory instead\n",
+			err,
+		)
 	}
 
 	return filepath.Join(l.runtimeDir(), "logs")
@@ -194,16 +206,38 @@ func (l *Logger) close() error {
 	return file.Close()
 }
 
+// FormatAuthCmdline renders the command path for the log and stops at the first
+// flag.
+//
+// Everything from the first flag onward is dropped rather than filtered by name.
+// A denylist of sensitive flags has to be extended whenever one is added, and
+// the rule it replaced — keep the first three arguments — only held while no
+// sensitive flag happened to appear early. Neither survives contact with a flag
+// nobody remembered to classify. What the log needs is which command ran, and
+// that is entirely in the leading non-flag arguments.
+//
+// args[0] is reduced to its base name so an absolute install path does not end
+// up in the file either.
 func FormatAuthCmdline(args []string) string {
 	if len(args) == 0 {
 		return ""
 	}
 
-	if len(args) <= 3 {
-		return strings.Join(args, " ")
+	path := []string{filepath.Base(args[0])}
+	dropped := false
+	for _, arg := range args[1:] {
+		if strings.HasPrefix(arg, "-") {
+			dropped = true
+			break
+		}
+		path = append(path, arg)
 	}
 
-	return strings.Join(args[:3], " ") + " ..."
+	line := strings.Join(path, " ")
+	if dropped {
+		line += " ..."
+	}
+	return line
 }
 
 // LogResponse records one authentication HTTP response.
diff --git a/internal/authlog/authlog_test.go b/internal/authlog/authlog_test.go
index deab489f82..e4c3bcde0e 100644
--- a/internal/authlog/authlog_test.go
+++ b/internal/authlog/authlog_test.go
@@ -5,6 +5,8 @@ package authlog
 
 import (
 	"errors"
+	"io"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -197,6 +199,112 @@ func TestSetShared_ReleasesTheSupersededFallback(t *testing.T) {
 	}
 }
 
+// TestFormatAuthCmdline_DropsEverythingFromTheFirstFlag is the regression guard
+// for the rule this replaced. Keeping the first three arguments was safe only
+// while no sensitive flag appeared early; a global flag in front of the
+// subcommand put its value straight into the file.
+func TestFormatAuthCmdline_DropsEverythingFromTheFirstFlag(t *testing.T) {
+	cases := []struct {
+		name string
+		args []string
+		want string
+	}{
+		{
+			name: "flag before the subcommand",
+			args: []string{"lark-cli", "--token=super-secret", "auth", "login"},
+			want: "lark-cli ...",
+		},
+		{
+			name: "separated flag value",
+			args: []string{"lark-cli", "auth", "login", "--device-code", "device-secret"},
+			want: "lark-cli auth login ...",
+		},
+		{
+			name: "absolute install path is reduced to the binary name",
+			args: []string{"/opt/internal-tools/build-42/lark-cli", "auth", "status"},
+			want: "lark-cli auth status",
+		},
+		{
+			name: "no flags at all",
+			args: []string{"lark-cli", "auth", "status"},
+			want: "lark-cli auth status",
+		},
+		{
+			name: "empty",
+			args: nil,
+			want: "",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := FormatAuthCmdline(tc.args)
+			if got != tc.want {
+				t.Fatalf("FormatAuthCmdline(%q) = %q, want %q", tc.args, got, tc.want)
+			}
+			for _, arg := range tc.args {
+				if strings.Contains(arg, "secret") && strings.Contains(got, "secret") {
+					t.Fatalf("FormatAuthCmdline leaked %q into %q", arg, got)
+				}
+			}
+		})
+	}
+}
+
+// TestAuthLogDir_RejectedOverrideWarns covers the one case where staying silent
+// misleads: the caller set the directory explicitly and it was refused.
+func TestAuthLogDir_RejectedOverrideWarns(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_LOG_DIR", "relative-logs")
+	configDir := t.TempDir()
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
+
+	logger := New(Options{RuntimeDir: func() string { return configDir }})
+	warning := captureStderr(t, func() { _ = logger.logDir() })
+
+	for _, want := range []string{"LARKSUITE_CLI_LOG_DIR", "default directory"} {
+		if !strings.Contains(warning, want) {
+			t.Errorf("warning %q does not mention %q", warning, want)
+		}
+	}
+}
+
+// TestAuthLogDir_AcceptedOverrideStaysQuiet keeps the warning scoped to the
+// failure: a usable override must not print anything.
+func TestAuthLogDir_AcceptedOverrideStaysQuiet(t *testing.T) {
+	base := t.TempDir()
+	base, _ = filepath.EvalSymlinks(base)
+	t.Setenv("LARKSUITE_CLI_LOG_DIR", filepath.Join(base, "auth"))
+
+	logger := New(Options{RuntimeDir: func() string { return base }})
+	if warning := captureStderr(t, func() { _ = logger.logDir() }); warning != "" {
+		t.Fatalf("a usable override printed %q", warning)
+	}
+}
+
+// captureStderr redirects os.Stderr for the duration of fn and returns what was
+// written to it.
+func captureStderr(t *testing.T, fn func()) string {
+	t.Helper()
+
+	reader, writer, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("pipe: %v", err)
+	}
+	previous := os.Stderr
+	os.Stderr = writer
+	defer func() { os.Stderr = previous }()
+
+	fn()
+	if err := writer.Close(); err != nil {
+		t.Fatalf("close writer: %v", err)
+	}
+	out, err := io.ReadAll(reader)
+	if err != nil {
+		t.Fatalf("read captured stderr: %v", err)
+	}
+	return string(out)
+}
+
 // restoreShared isolates each test from the process-wide logger.
 func restoreShared(t *testing.T) {
 	t.Helper()

From 2662729cd62478d3bb4a9c0769ca913786aafce2 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Mon, 27 Jul 2026 15:43:46 +0800
Subject: [PATCH 27/50] test(core): enforce the brand parity the comments only
 request
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

bf56e903 asked the next author to change both ParseBrand implementations by
cross-referencing them. That is the weakest kind of guarantee: it holds until
someone adds a brand to the package they happened to open.

Assert it instead. The constants are read out of both sources rather than
listed again, so a brand added to one package is under test immediately, and
the two parsers are compared on every declared value plus the inputs that
exercise the normalisation — case, padding, an unknown brand, a near miss.

The file sits in neither parser's package so neither owns the contract. It does
not merge the two implementations: extension/credential ships as a standalone
SDK and may not import internal, which is the constraint this branch exists to
establish.
---
 internal/core/brand_parity_test.go | 84 ++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)
 create mode 100644 internal/core/brand_parity_test.go

diff --git a/internal/core/brand_parity_test.go b/internal/core/brand_parity_test.go
new file mode 100644
index 0000000000..4b8bd69e42
--- /dev/null
+++ b/internal/core/brand_parity_test.go
@@ -0,0 +1,84 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package core_test
+
+import (
+	"os"
+	"regexp"
+	"sort"
+	"testing"
+
+	"github.com/larksuite/cli/extension/credential"
+	"github.com/larksuite/cli/internal/core"
+)
+
+// The brand rule is implemented twice, once per Brand type, because
+// extension/credential ships as a standalone SDK and may not import internal.
+// Cross-reference comments ask the next author to change both; this file makes
+// the request enforceable. It lives here rather than beside either parser so
+// neither side owns the contract.
+//
+// The constants are read out of the source instead of listed again, so adding a
+// brand to one package is enough to put it under test.
+var brandConstant = regexp.MustCompile(`(?m)^\s+Brand[A-Za-z0-9]*\s+(?:Brand|LarkBrand)\s+=\s+"([^"]+)"`)
+
+func brandValues(t *testing.T, path string) []string {
+	t.Helper()
+
+	source, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read %s: %v", path, err)
+	}
+	matches := brandConstant.FindAllStringSubmatch(string(source), -1)
+	if len(matches) == 0 {
+		t.Fatalf("no brand constants found in %s; the pattern needs updating", path)
+	}
+
+	values := make([]string, 0, len(matches))
+	for _, match := range matches {
+		values = append(values, match[1])
+	}
+	sort.Strings(values)
+	return values
+}
+
+// TestBrandConstantsMatchAcrossPackages fails when one package learns a brand
+// the other has not.
+func TestBrandConstantsMatchAcrossPackages(t *testing.T) {
+	sdk := brandValues(t, "../../extension/credential/types.go")
+	internal := brandValues(t, "types.go")
+
+	if len(sdk) != len(internal) {
+		t.Fatalf("brand constants differ: extension/credential has %v, internal/core has %v", sdk, internal)
+	}
+	for i := range sdk {
+		if sdk[i] != internal[i] {
+			t.Fatalf("brand constants differ: extension/credential has %v, internal/core has %v", sdk, internal)
+		}
+	}
+}
+
+// TestParseBrandAgreesAcrossPackages fails when the two parsers resolve the same
+// input differently — the drift the cross-reference comments only ask for.
+func TestParseBrandAgreesAcrossPackages(t *testing.T) {
+	inputs := brandValues(t, "../../extension/credential/types.go")
+	inputs = append(inputs,
+		"",           // unset
+		"LARK",       // case
+		"  lark  ",   // padding
+		"Feishu",     // case on the default
+		"neo",        // a brand neither package knows yet
+		"lark-suite", // near miss
+	)
+
+	for _, input := range inputs {
+		t.Run(input, func(t *testing.T) {
+			fromCore := string(core.ParseBrand(input))
+			fromSDK := string(credential.ParseBrand(input))
+			if fromCore != fromSDK {
+				t.Fatalf("ParseBrand(%q): internal/core = %q, extension/credential = %q", input, fromCore, fromSDK)
+			}
+		})
+	}
+}

From 97e397cf0cfa5e04fe724de9fd0f9584e77dfba6 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Mon, 27 Jul 2026 16:42:20 +0800
Subject: [PATCH 28/50] refactor(sidecar): return typed errors from the demo
 servers

Both demo entry points reported every startup failure with fmt.Errorf, so the
self-proxy rejection was indistinguishable from a missing key file except by
reading the sentence. Classify them instead: a poisoned environment and an
unreadable config are ConfigError, flag validation is ValidationError, local
key and log file work is InternalError, and listen or serve failures are
NetworkError. Causes are attached rather than folded into the message.

The self-proxy test asserts the type with errors.As and keeps the check that
the message names the variable, so renaming the variable still fails the test
while rewording the sentence no longer does.
---
 sidecar/server-demo/handler_test.go           | 10 ++++++--
 sidecar/server-demo/main.go                   | 19 +++++++-------
 .../server-multi-tenant-demo/handler_test.go  | 10 ++++++--
 sidecar/server-multi-tenant-demo/main.go      | 25 ++++++++++---------
 4 files changed, 39 insertions(+), 25 deletions(-)

diff --git a/sidecar/server-demo/handler_test.go b/sidecar/server-demo/handler_test.go
index 25ce6c3552..03f050e088 100644
--- a/sidecar/server-demo/handler_test.go
+++ b/sidecar/server-demo/handler_test.go
@@ -8,6 +8,7 @@ package main
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -18,6 +19,7 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/envnames"
+	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
@@ -424,8 +426,12 @@ func TestRun_RejectsSelfProxy(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error when AUTH_PROXY is set")
 	}
-	if !strings.Contains(err.Error(), envnames.CliAuthProxy) {
-		t.Errorf("error should mention %s, got: %v", envnames.CliAuthProxy, err)
+	var configErr *errs.ConfigError
+	if !errors.As(err, &configErr) {
+		t.Fatalf("self-proxy rejection = %T, want *errs.ConfigError so callers can branch on the type", err)
+	}
+	if !strings.Contains(configErr.Error(), envnames.CliAuthProxy) {
+		t.Errorf("error should mention %s, got: %v", envnames.CliAuthProxy, configErr)
 	}
 }
 
diff --git a/sidecar/server-demo/main.go b/sidecar/server-demo/main.go
index 1005655feb..17af3373de 100644
--- a/sidecar/server-demo/main.go
+++ b/sidecar/server-demo/main.go
@@ -29,6 +29,7 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/envnames"
+	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/vfs"
@@ -63,25 +64,25 @@ func run(ctx context.Context, listen, keyFile, logFile, profile string) error {
 	// credential provider would activate and return sentinel tokens instead
 	// of real ones, breaking the "trusted side holds real credentials" premise.
 	if v := os.Getenv(envnames.CliAuthProxy); v != "" {
-		return fmt.Errorf("%s is set in this environment (%s); unset it before starting the sidecar server", envnames.CliAuthProxy, v)
+		return errs.NewConfigError(errs.SubtypeInvalidConfig, "%s is set in this environment (%s); unset it before starting the sidecar server", envnames.CliAuthProxy, v)
 	}
 	if listen == "" {
-		return fmt.Errorf("invalid --listen address: empty")
+		return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --listen address: empty")
 	}
 
 	// Generate HMAC key (32 bytes = 256 bits) and write it to disk (0600).
 	keyBytes := make([]byte, 32)
 	if _, err := rand.Read(keyBytes); err != nil {
-		return fmt.Errorf("failed to generate HMAC key: %v", err)
+		return errs.NewInternalError(errs.SubtypeStorage, "failed to generate HMAC key: %v", err).WithCause(err)
 	}
 	keyHex := hex.EncodeToString(keyBytes)
 
 	keyDir := filepath.Dir(keyFile)
 	if err := vfs.MkdirAll(keyDir, 0700); err != nil {
-		return fmt.Errorf("failed to create key directory: %v", err)
+		return errs.NewInternalError(errs.SubtypeStorage, "failed to create key directory: %v", err).WithCause(err)
 	}
 	if err := vfs.WriteFile(keyFile, []byte(keyHex), 0600); err != nil {
-		return fmt.Errorf("failed to write key file: %v", err)
+		return errs.NewInternalError(errs.SubtypeStorage, "failed to write key file: %v", err).WithCause(err)
 	}
 
 	// Audit logger: file or stderr.
@@ -89,7 +90,7 @@ func run(ctx context.Context, listen, keyFile, logFile, profile string) error {
 	if logFile != "" {
 		f, err := vfs.OpenFile(logFile, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600)
 		if err != nil {
-			return fmt.Errorf("failed to open log file: %v", err)
+			return errs.NewInternalError(errs.SubtypeStorage, "failed to open log file: %v", err).WithCause(err)
 		}
 		defer f.Close()
 		auditLogger = log.New(f, "", log.LstdFlags)
@@ -102,12 +103,12 @@ func run(ctx context.Context, listen, keyFile, logFile, profile string) error {
 	factory := cmdutil.NewDefault(nil, cmdutil.InvocationContext{Profile: profile})
 	cfg, err := factory.Config()
 	if err != nil {
-		return fmt.Errorf("failed to load config: %v", err)
+		return errs.NewConfigError(errs.SubtypeInvalidConfig, "failed to load config: %v", err).WithCause(err)
 	}
 
 	listener, err := net.Listen("tcp", listen)
 	if err != nil {
-		return fmt.Errorf("failed to listen on %s: %v", listen, err)
+		return errs.NewNetworkError(errs.SubtypeNetworkTransport, "failed to listen on %s: %v", listen, err).WithCause(err)
 	}
 	defer listener.Close()
 
@@ -161,7 +162,7 @@ func run(ctx context.Context, listen, keyFile, logFile, profile string) error {
 	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envnames.CliBrand, string(cfg.Brand))
 
 	if err := server.Serve(listener); err != nil && err != http.ErrServerClosed {
-		return fmt.Errorf("sidecar server exited unexpectedly: %v", err)
+		return errs.NewNetworkError(errs.SubtypeNetworkTransport, "sidecar server exited unexpectedly: %v", err).WithCause(err)
 	}
 	return nil
 }
diff --git a/sidecar/server-multi-tenant-demo/handler_test.go b/sidecar/server-multi-tenant-demo/handler_test.go
index 10dd9d0f0c..ba3ed637b5 100644
--- a/sidecar/server-multi-tenant-demo/handler_test.go
+++ b/sidecar/server-multi-tenant-demo/handler_test.go
@@ -9,6 +9,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -20,6 +21,7 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/envnames"
+	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
@@ -420,8 +422,12 @@ func TestRun_RejectsSelfProxy(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error when AUTH_PROXY is set")
 	}
-	if !strings.Contains(err.Error(), envnames.CliAuthProxy) {
-		t.Errorf("error should mention %s, got: %v", envnames.CliAuthProxy, err)
+	var configErr *errs.ConfigError
+	if !errors.As(err, &configErr) {
+		t.Fatalf("self-proxy rejection = %T, want *errs.ConfigError so callers can branch on the type", err)
+	}
+	if !strings.Contains(configErr.Error(), envnames.CliAuthProxy) {
+		t.Errorf("error should mention %s, got: %v", envnames.CliAuthProxy, configErr)
 	}
 }
 
diff --git a/sidecar/server-multi-tenant-demo/main.go b/sidecar/server-multi-tenant-demo/main.go
index 0ea9f0757a..41699eac8e 100644
--- a/sidecar/server-multi-tenant-demo/main.go
+++ b/sidecar/server-multi-tenant-demo/main.go
@@ -30,6 +30,7 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/envnames"
+	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/validate"
@@ -63,30 +64,30 @@ func defaultKeyFile() string {
 
 func run(ctx context.Context, listen, keyFile, keysDir, logFile, profile string) error {
 	if v := os.Getenv(envnames.CliAuthProxy); v != "" {
-		return fmt.Errorf("%s is set in this environment (%s); unset it before starting the sidecar server", envnames.CliAuthProxy, v)
+		return errs.NewConfigError(errs.SubtypeInvalidConfig, "%s is set in this environment (%s); unset it before starting the sidecar server", envnames.CliAuthProxy, v)
 	}
 	if listen == "" {
-		return fmt.Errorf("invalid --listen address: empty")
+		return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --listen address: empty")
 	}
 
 	if _, err := validate.SafeInputPath(keyFile); err != nil {
-		return fmt.Errorf("invalid --key-file path: %w", err)
+		return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --key-file path: %v", err).WithCause(err)
 	}
 	if logFile != "" {
 		if _, err := validate.SafeInputPath(logFile); err != nil {
-			return fmt.Errorf("invalid --log-file path: %w", err)
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --log-file path: %v", err).WithCause(err)
 		}
 	}
 	if keysDir != "" {
 		if _, err := validate.SafeInputPath(keysDir); err != nil {
-			return fmt.Errorf("invalid --keys-dir path: %w", err)
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --keys-dir path: %v", err).WithCause(err)
 		}
 	}
 
 	// Reuse existing key if present; generate a new one only on first run.
 	keyDir := filepath.Dir(keyFile)
 	if err := vfs.MkdirAll(keyDir, 0700); err != nil {
-		return fmt.Errorf("failed to create key directory: %v", err)
+		return errs.NewInternalError(errs.SubtypeStorage, "failed to create key directory: %v", err).WithCause(err)
 	}
 
 	var keyHex string
@@ -95,11 +96,11 @@ func run(ctx context.Context, listen, keyFile, keysDir, logFile, profile string)
 	} else {
 		keyBytes := make([]byte, 32)
 		if _, err := rand.Read(keyBytes); err != nil {
-			return fmt.Errorf("failed to generate HMAC key: %v", err)
+			return errs.NewInternalError(errs.SubtypeStorage, "failed to generate HMAC key: %v", err).WithCause(err)
 		}
 		keyHex = hex.EncodeToString(keyBytes)
 		if err := vfs.WriteFile(keyFile, []byte(keyHex), 0600); err != nil {
-			return fmt.Errorf("failed to write key file: %v", err)
+			return errs.NewInternalError(errs.SubtypeStorage, "failed to write key file: %v", err).WithCause(err)
 		}
 	}
 
@@ -113,7 +114,7 @@ func run(ctx context.Context, listen, keyFile, keysDir, logFile, profile string)
 	if logFile != "" {
 		f, err := vfs.OpenFile(logFile, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600)
 		if err != nil {
-			return fmt.Errorf("failed to open log file: %v", err)
+			return errs.NewInternalError(errs.SubtypeStorage, "failed to open log file: %v", err).WithCause(err)
 		}
 		defer f.Close()
 		auditLogger = log.New(f, "", log.LstdFlags)
@@ -124,12 +125,12 @@ func run(ctx context.Context, listen, keyFile, keysDir, logFile, profile string)
 	factory := cmdutil.NewDefault(nil, cmdutil.InvocationContext{Profile: profile})
 	cfg, err := factory.Config()
 	if err != nil {
-		return fmt.Errorf("failed to load config: %v", err)
+		return errs.NewConfigError(errs.SubtypeInvalidConfig, "failed to load config: %v", err).WithCause(err)
 	}
 
 	listener, err := net.Listen("tcp", listen)
 	if err != nil {
-		return fmt.Errorf("failed to listen on %s: %v", listen, err)
+		return errs.NewNetworkError(errs.SubtypeNetworkTransport, "failed to listen on %s: %v", listen, err).WithCause(err)
 	}
 	defer listener.Close()
 
@@ -189,7 +190,7 @@ func run(ctx context.Context, listen, keyFile, keysDir, logFile, profile string)
 	fmt.Fprintf(os.Stderr, "  export %s=%q\n", envnames.CliBrand, string(cfg.Brand))
 
 	if err := server.Serve(listener); err != nil && err != http.ErrServerClosed {
-		return fmt.Errorf("sidecar server exited unexpectedly: %v", err)
+		return errs.NewNetworkError(errs.SubtypeNetworkTransport, "sidecar server exited unexpectedly: %v", err).WithCause(err)
 	}
 	return nil
 }

From 57bf8ccd1e0a3f95725bcd0c70827d1108c2782c Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Mon, 27 Jul 2026 16:42:20 +0800
Subject: [PATCH 29/50] docs(authlog): record why two neighbours read the
 environment differently

LARKSUITE_CLI_LOG_DIR is validated, LARKSUITE_CLI_CONFIG_DIR is not, and the
asymmetry looks like an oversight. It is not free to remove:
validate.SafeEnvDirPath resolves symlinks, so routing CONFIG_DIR through it
changes the directory the CLI reports on any host where the path crosses one.
Applying it moved four packages' expectations from /var to /private/var on
macOS. Whether config paths should be symlink-resolved is a decision about the
on-disk contract, not a local tidy-up, so say so where the next reader looks.

Also record why the stderr capture helper uses os while the file assertions use
vfs: os.Pipe and os.Stderr are process contracts with nothing for a substituted
filesystem to intercept.
---
 internal/authlog/authlog.go      | 5 +++++
 internal/authlog/authlog_test.go | 6 ++++++
 2 files changed, 11 insertions(+)

diff --git a/internal/authlog/authlog.go b/internal/authlog/authlog.go
index 129ddf9444..ceef307688 100644
--- a/internal/authlog/authlog.go
+++ b/internal/authlog/authlog.go
@@ -114,6 +114,11 @@ func Shared() *Logger {
 
 func defaultRuntimeDir() string {
 	if dir := os.Getenv("LARKSUITE_CLI_CONFIG_DIR"); dir != "" {
+		// Deliberately unvalidated, mirroring core.GetBaseConfigDir. Routing this
+		// through validate.SafeEnvDirPath would also resolve symlinks, changing
+		// the directory the CLI reports and uses on any host where the path
+		// crosses one. Tightening it is a decision about config path semantics,
+		// not a local fix — see the follow-up note in the PR.
 		return dir
 	}
 	home, err := vfs.UserHomeDir()
diff --git a/internal/authlog/authlog_test.go b/internal/authlog/authlog_test.go
index e4c3bcde0e..7e0e061140 100644
--- a/internal/authlog/authlog_test.go
+++ b/internal/authlog/authlog_test.go
@@ -283,6 +283,12 @@ func TestAuthLogDir_AcceptedOverrideStaysQuiet(t *testing.T) {
 
 // captureStderr redirects os.Stderr for the duration of fn and returns what was
 // written to it.
+//
+// This one uses os rather than vfs on purpose. os.Pipe and os.Stderr are process
+// contracts, not filesystem access, so vfs neither wraps them nor should: the
+// code under test writes to the real stderr and there is nothing for a
+// substituted vfs.DefaultFS to intercept. Assertions that touch files stay on
+// vfs so they follow whatever the implementation uses.
 func captureStderr(t *testing.T, fn func()) string {
 	t.Helper()
 

From c12ab913490288ca72386a278d0b78a32f9b1a7f Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Mon, 27 Jul 2026 17:08:38 +0800
Subject: [PATCH 30/50] fix(authlog): restore the word cap the flag boundary
 replaced

475f04a8 stopped the command line at the first flag and dropped the
"keep three words" rule with it, on the reasoning that the command path is what
the log needs. That reasoning missed positional arguments: `api <method> <path>`
takes the path as an argument, so a document token moved from truncated to
recorded in a file that is kept for a week.

Apply both limits. Stop at the first flag, so a sensitive flag ahead of the
subcommand cannot slip through, and keep at most three words, so a positional
identifier after the command path cannot either. Removing either one fails a
test: the flag boundary alone lets the document token through, the word cap
alone lets --token=... through.

Verified case by case that nothing reaches the log that the pre-475f04a8
behaviour withheld.
---
 internal/authlog/authlog.go      | 30 ++++++++++++++++++------------
 internal/authlog/authlog_test.go | 19 +++++++++++++++++--
 2 files changed, 35 insertions(+), 14 deletions(-)

diff --git a/internal/authlog/authlog.go b/internal/authlog/authlog.go
index ceef307688..a9f9646db4 100644
--- a/internal/authlog/authlog.go
+++ b/internal/authlog/authlog.go
@@ -211,15 +211,21 @@ func (l *Logger) close() error {
 	return file.Close()
 }
 
-// FormatAuthCmdline renders the command path for the log and stops at the first
-// flag.
+// maxCmdlineWords caps the command line at the binary plus two words, which is
+// the deepest command path this CLI has (`lark-cli docs +fetch`). Anything
+// beyond that is an argument, not a command.
+const maxCmdlineWords = 3
+
+// FormatAuthCmdline renders the command path for the log under two limits, both
+// of which are load-bearing.
 //
-// Everything from the first flag onward is dropped rather than filtered by name.
-// A denylist of sensitive flags has to be extended whenever one is added, and
-// the rule it replaced — keep the first three arguments — only held while no
-// sensitive flag happened to appear early. Neither survives contact with a flag
-// nobody remembered to classify. What the log needs is which command ran, and
-// that is entirely in the leading non-flag arguments.
+// It stops at the first flag, because a denylist of sensitive flag names has to
+// be extended whenever one is added. It also keeps at most maxCmdlineWords
+// words, because positional arguments carry resource identifiers: `api GET
+// <path>` puts a document token in the fourth word. Dropping either limit
+// widens what reaches a file that lives for a week — the flag limit alone let
+// that token through, and the word limit alone let `--token=... auth login`
+// through.
 //
 // args[0] is reduced to its base name so an absolute install path does not end
 // up in the file either.
@@ -228,17 +234,17 @@ func FormatAuthCmdline(args []string) string {
 		return ""
 	}
 
-	path := []string{filepath.Base(args[0])}
+	words := []string{filepath.Base(args[0])}
 	dropped := false
 	for _, arg := range args[1:] {
-		if strings.HasPrefix(arg, "-") {
+		if strings.HasPrefix(arg, "-") || len(words) == maxCmdlineWords {
 			dropped = true
 			break
 		}
-		path = append(path, arg)
+		words = append(words, arg)
 	}
 
-	line := strings.Join(path, " ")
+	line := strings.Join(words, " ")
 	if dropped {
 		line += " ..."
 	}
diff --git a/internal/authlog/authlog_test.go b/internal/authlog/authlog_test.go
index 7e0e061140..05c2863837 100644
--- a/internal/authlog/authlog_test.go
+++ b/internal/authlog/authlog_test.go
@@ -229,6 +229,19 @@ func TestFormatAuthCmdline_DropsEverythingFromTheFirstFlag(t *testing.T) {
 			args: []string{"lark-cli", "auth", "status"},
 			want: "lark-cli auth status",
 		},
+		{
+			// `api <method> <path>` puts a document token in the fourth word.
+			// Stopping at the first flag is not enough on its own; the word cap
+			// is what keeps a positional identifier out of the file.
+			name: "positional resource identifier past the cap",
+			args: []string{"lark-cli", "api", "GET", "/open-apis/docx/v1/documents/doccnDOCTOKEN"},
+			want: "lark-cli api GET ...",
+		},
+		{
+			name: "cap applies before any flag appears",
+			args: []string{"lark-cli", "drive", "upload", "/home/me/private/quarterly.xlsx", "--to", "folder"},
+			want: "lark-cli drive upload ...",
+		},
 		{
 			name: "empty",
 			args: nil,
@@ -243,8 +256,10 @@ func TestFormatAuthCmdline_DropsEverythingFromTheFirstFlag(t *testing.T) {
 				t.Fatalf("FormatAuthCmdline(%q) = %q, want %q", tc.args, got, tc.want)
 			}
 			for _, arg := range tc.args {
-				if strings.Contains(arg, "secret") && strings.Contains(got, "secret") {
-					t.Fatalf("FormatAuthCmdline leaked %q into %q", arg, got)
+				for _, marker := range []string{"secret", "TOKEN", "private"} {
+					if strings.Contains(arg, marker) && strings.Contains(got, marker) {
+						t.Fatalf("FormatAuthCmdline leaked %q into %q", arg, got)
+					}
 				}
 			}
 		})

From 1af34e6649da909795715c174c3d4f0e7d636abe Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Mon, 27 Jul 2026 17:29:18 +0800
Subject: [PATCH 31/50] docs(authlog): correct what the word cap is measuring
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The comment claimed the binary plus two words is the deepest command path in
this CLI. It is not: generated service commands go one level further, as
`drive file.comments create_v2` in the manifest tests shows, and the cap cuts
their last word. Calling the bound a measurement invites the next reader to
raise it for a command that does not fit — which would also admit the first
positional argument, where resource identifiers live.

State it as the privacy bound it is, and add the generated-command case to the
table so the trade-off is visible next to the cases it protects.
---
 internal/authlog/authlog.go      | 9 ++++++---
 internal/authlog/authlog_test.go | 9 +++++++++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/internal/authlog/authlog.go b/internal/authlog/authlog.go
index a9f9646db4..d51489d715 100644
--- a/internal/authlog/authlog.go
+++ b/internal/authlog/authlog.go
@@ -211,9 +211,12 @@ func (l *Logger) close() error {
 	return file.Close()
 }
 
-// maxCmdlineWords caps the command line at the binary plus two words, which is
-// the deepest command path this CLI has (`lark-cli docs +fetch`). Anything
-// beyond that is an argument, not a command.
+// maxCmdlineWords keeps the privacy bound the log has always had: the binary
+// plus two words. It is a bound, not a measurement of how deep commands go —
+// generated service commands reach one level further (`lark-cli drive
+// file.comments create_v2`) and lose their last word here. Raising the cap to
+// fit them would also let the first positional argument back in, and that is
+// where resource identifiers live.
 const maxCmdlineWords = 3
 
 // FormatAuthCmdline renders the command path for the log under two limits, both
diff --git a/internal/authlog/authlog_test.go b/internal/authlog/authlog_test.go
index 05c2863837..1f24304134 100644
--- a/internal/authlog/authlog_test.go
+++ b/internal/authlog/authlog_test.go
@@ -242,6 +242,15 @@ func TestFormatAuthCmdline_DropsEverythingFromTheFirstFlag(t *testing.T) {
 			args: []string{"lark-cli", "drive", "upload", "/home/me/private/quarterly.xlsx", "--to", "folder"},
 			want: "lark-cli drive upload ...",
 		},
+		{
+			// Generated service commands are one level deeper than the cap, so
+			// their last word is lost. Recorded here so the trade-off is visible:
+			// widening the cap to keep it would also admit the first positional
+			// argument.
+			name: "generated service command loses its verb to the cap",
+			args: []string{"lark-cli", "drive", "file.comments", "create_v2"},
+			want: "lark-cli drive file.comments ...",
+		},
 		{
 			name: "empty",
 			args: nil,

From 7b6962a726d923455be0144ae7b907296b1dc85a Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Mon, 27 Jul 2026 17:45:07 +0800
Subject: [PATCH 32/50] fix(sidecar): keep the classification the resolver
 already made
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

97e397cf classified every startup failure, including the one the config
resolver had already classified. An unconfigured CLI comes back as
not_configured carrying "run: lark-cli config init"; wrapping it in
invalid_config put the wrong subtype in front — ProblemOf reads the outermost —
and dropped the hint entirely. A caller would be told the config is broken when
it was never written.

Pass typed errors through untouched and reserve a fresh error for the case
where the resolver gave none, where internal/unknown is the honest answer
rather than a guess at invalid_config.

Flag rejections now name the flag through WithParam, so a caller learns which
one to fix without reading the sentence, and the tests assert subtype and
param through ProblemOf instead of matching prose.
---
 sidecar/server-demo/handler_test.go           | 31 +++++++++++++++++++
 sidecar/server-demo/main.go                   | 11 +++++--
 .../server-multi-tenant-demo/handler_test.go  | 31 +++++++++++++++++++
 sidecar/server-multi-tenant-demo/main.go      | 17 +++++++---
 4 files changed, 83 insertions(+), 7 deletions(-)

diff --git a/sidecar/server-demo/handler_test.go b/sidecar/server-demo/handler_test.go
index 03f050e088..ac8afd74bc 100644
--- a/sidecar/server-demo/handler_test.go
+++ b/sidecar/server-demo/handler_test.go
@@ -430,11 +430,42 @@ func TestRun_RejectsSelfProxy(t *testing.T) {
 	if !errors.As(err, &configErr) {
 		t.Fatalf("self-proxy rejection = %T, want *errs.ConfigError so callers can branch on the type", err)
 	}
+	problem, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatal("self-proxy rejection carries no Problem, so machine callers cannot classify it")
+	}
+	if problem.Subtype != errs.SubtypeInvalidConfig {
+		t.Errorf("subtype = %q, want %q", problem.Subtype, errs.SubtypeInvalidConfig)
+	}
 	if !strings.Contains(configErr.Error(), envnames.CliAuthProxy) {
 		t.Errorf("error should mention %s, got: %v", envnames.CliAuthProxy, configErr)
 	}
 }
 
+// TestRun_EmptyListenReportsTheFlag pins that a rejected flag names itself, so a
+// caller reading the problem knows which one to fix without parsing prose.
+func TestRun_EmptyListenReportsTheFlag(t *testing.T) {
+	err := run(context.Background(), "", "/tmp/should-not-be-created.key", "", "")
+	if err == nil {
+		t.Fatal("expected an error for an empty --listen")
+	}
+
+	problem, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("error %T carries no Problem", err)
+	}
+	if problem.Subtype != errs.SubtypeInvalidArgument {
+		t.Errorf("subtype = %q, want %q", problem.Subtype, errs.SubtypeInvalidArgument)
+	}
+	var validationErr *errs.ValidationError
+	if !errors.As(err, &validationErr) {
+		t.Fatalf("error = %T, want *errs.ValidationError", err)
+	}
+	if validationErr.Param != "--listen" {
+		t.Errorf("Param = %q, want the offending flag named", validationErr.Param)
+	}
+}
+
 func TestForwardClient_RedirectStripsAuth(t *testing.T) {
 	redirectTarget := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if auth := r.Header.Get("Authorization"); auth != "" {
diff --git a/sidecar/server-demo/main.go b/sidecar/server-demo/main.go
index 17af3373de..f1c0b434f9 100644
--- a/sidecar/server-demo/main.go
+++ b/sidecar/server-demo/main.go
@@ -67,7 +67,7 @@ func run(ctx context.Context, listen, keyFile, logFile, profile string) error {
 		return errs.NewConfigError(errs.SubtypeInvalidConfig, "%s is set in this environment (%s); unset it before starting the sidecar server", envnames.CliAuthProxy, v)
 	}
 	if listen == "" {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --listen address: empty")
+		return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --listen address: empty").WithParam("--listen")
 	}
 
 	// Generate HMAC key (32 bytes = 256 bits) and write it to disk (0600).
@@ -103,7 +103,14 @@ func run(ctx context.Context, listen, keyFile, logFile, profile string) error {
 	factory := cmdutil.NewDefault(nil, cmdutil.InvocationContext{Profile: profile})
 	cfg, err := factory.Config()
 	if err != nil {
-		return errs.NewConfigError(errs.SubtypeInvalidConfig, "failed to load config: %v", err).WithCause(err)
+		// The resolver already classifies this: an unconfigured CLI comes back as
+		// not_configured with its own recovery hint. Re-wrapping would put
+		// invalid_config in front of it, and ProblemOf reads the outermost — a
+		// caller would be told the config is broken when it was never written.
+		if typed, ok := errs.UnwrapTypedError(err); ok {
+			return typed
+		}
+		return errs.NewInternalError(errs.SubtypeUnknown, "failed to load config: %v", err).WithCause(err)
 	}
 
 	listener, err := net.Listen("tcp", listen)
diff --git a/sidecar/server-multi-tenant-demo/handler_test.go b/sidecar/server-multi-tenant-demo/handler_test.go
index ba3ed637b5..a694a23bd9 100644
--- a/sidecar/server-multi-tenant-demo/handler_test.go
+++ b/sidecar/server-multi-tenant-demo/handler_test.go
@@ -426,11 +426,42 @@ func TestRun_RejectsSelfProxy(t *testing.T) {
 	if !errors.As(err, &configErr) {
 		t.Fatalf("self-proxy rejection = %T, want *errs.ConfigError so callers can branch on the type", err)
 	}
+	problem, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatal("self-proxy rejection carries no Problem, so machine callers cannot classify it")
+	}
+	if problem.Subtype != errs.SubtypeInvalidConfig {
+		t.Errorf("subtype = %q, want %q", problem.Subtype, errs.SubtypeInvalidConfig)
+	}
 	if !strings.Contains(configErr.Error(), envnames.CliAuthProxy) {
 		t.Errorf("error should mention %s, got: %v", envnames.CliAuthProxy, configErr)
 	}
 }
 
+// TestRun_EmptyListenReportsTheFlag pins that a rejected flag names itself, so a
+// caller reading the problem knows which one to fix without parsing prose.
+func TestRun_EmptyListenReportsTheFlag(t *testing.T) {
+	err := run(context.Background(), "", "/tmp/should-not-be-created.key", "", "", "")
+	if err == nil {
+		t.Fatal("expected an error for an empty --listen")
+	}
+
+	problem, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("error %T carries no Problem", err)
+	}
+	if problem.Subtype != errs.SubtypeInvalidArgument {
+		t.Errorf("subtype = %q, want %q", problem.Subtype, errs.SubtypeInvalidArgument)
+	}
+	var validationErr *errs.ValidationError
+	if !errors.As(err, &validationErr) {
+		t.Fatalf("error = %T, want *errs.ValidationError", err)
+	}
+	if validationErr.Param != "--listen" {
+		t.Errorf("Param = %q, want the offending flag named", validationErr.Param)
+	}
+}
+
 func TestForwardClient_RedirectStripsAuth(t *testing.T) {
 	redirectTarget := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if auth := r.Header.Get("Authorization"); auth != "" {
diff --git a/sidecar/server-multi-tenant-demo/main.go b/sidecar/server-multi-tenant-demo/main.go
index 41699eac8e..636f77a425 100644
--- a/sidecar/server-multi-tenant-demo/main.go
+++ b/sidecar/server-multi-tenant-demo/main.go
@@ -67,20 +67,20 @@ func run(ctx context.Context, listen, keyFile, keysDir, logFile, profile string)
 		return errs.NewConfigError(errs.SubtypeInvalidConfig, "%s is set in this environment (%s); unset it before starting the sidecar server", envnames.CliAuthProxy, v)
 	}
 	if listen == "" {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --listen address: empty")
+		return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --listen address: empty").WithParam("--listen")
 	}
 
 	if _, err := validate.SafeInputPath(keyFile); err != nil {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --key-file path: %v", err).WithCause(err)
+		return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --key-file path: %v", err).WithParam("--key-file").WithCause(err)
 	}
 	if logFile != "" {
 		if _, err := validate.SafeInputPath(logFile); err != nil {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --log-file path: %v", err).WithCause(err)
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --log-file path: %v", err).WithParam("--log-file").WithCause(err)
 		}
 	}
 	if keysDir != "" {
 		if _, err := validate.SafeInputPath(keysDir); err != nil {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --keys-dir path: %v", err).WithCause(err)
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --keys-dir path: %v", err).WithParam("--keys-dir").WithCause(err)
 		}
 	}
 
@@ -125,7 +125,14 @@ func run(ctx context.Context, listen, keyFile, keysDir, logFile, profile string)
 	factory := cmdutil.NewDefault(nil, cmdutil.InvocationContext{Profile: profile})
 	cfg, err := factory.Config()
 	if err != nil {
-		return errs.NewConfigError(errs.SubtypeInvalidConfig, "failed to load config: %v", err).WithCause(err)
+		// The resolver already classifies this: an unconfigured CLI comes back as
+		// not_configured with its own recovery hint. Re-wrapping would put
+		// invalid_config in front of it, and ProblemOf reads the outermost — a
+		// caller would be told the config is broken when it was never written.
+		if typed, ok := errs.UnwrapTypedError(err); ok {
+			return typed
+		}
+		return errs.NewInternalError(errs.SubtypeUnknown, "failed to load config: %v", err).WithCause(err)
 	}
 
 	listener, err := net.Listen("tcp", listen)

From 9c50045f14f2d91138f006768fe5cb739aebcb95 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Mon, 27 Jul 2026 17:45:07 +0800
Subject: [PATCH 33/50] docs(authlog): drop the pointer to a note that was
 never written

The comment sent readers to a follow-up in the pull request description that
does not exist there. Keep the reason in the source, where it is already
complete, and add the evidence that made the decision: applying the validator
moved four packages' expectations from /var to /private/var, because it
resolves symlinks.
---
 internal/authlog/authlog.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/internal/authlog/authlog.go b/internal/authlog/authlog.go
index d51489d715..04c42fa0e5 100644
--- a/internal/authlog/authlog.go
+++ b/internal/authlog/authlog.go
@@ -117,8 +117,10 @@ func defaultRuntimeDir() string {
 		// Deliberately unvalidated, mirroring core.GetBaseConfigDir. Routing this
 		// through validate.SafeEnvDirPath would also resolve symlinks, changing
 		// the directory the CLI reports and uses on any host where the path
-		// crosses one. Tightening it is a decision about config path semantics,
-		// not a local fix — see the follow-up note in the PR.
+		// crosses one — applying it moved four packages' expectations from /var
+		// to /private/var on macOS. Whether config paths should be
+		// symlink-resolved is a decision about the on-disk contract, and it has
+		// to be made in one place for every reader of this variable.
 		return dir
 	}
 	home, err := vfs.UserHomeDir()

From 2634092ff206f2f891e6035685d27b5783ea52f6 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 11:45:57 +0800
Subject: [PATCH 34/50] refactor(shortcuts): route scope checks through common

---
 .../qualitygate/deptest/layering-edges.txt    |  8 ------
 shortcuts/common/runner.go                    | 26 +++++++++++++++++++
 shortcuts/drive/drive_task_result.go          |  7 +++--
 shortcuts/im/helpers.go                       |  8 +++---
 shortcuts/mail/helpers.go                     | 19 +++++++-------
 shortcuts/minutes/minutes_detail.go           |  8 +++---
 shortcuts/vc/vc_detail.go                     |  8 +++---
 shortcuts/vc/vc_notes.go                      |  8 +++---
 shortcuts/vc/vc_recording.go                  |  7 +++--
 9 files changed, 53 insertions(+), 46 deletions(-)

diff --git a/internal/qualitygate/deptest/layering-edges.txt b/internal/qualitygate/deptest/layering-edges.txt
index 32daa463a4..306268c4c8 100644
--- a/internal/qualitygate/deptest/layering-edges.txt
+++ b/internal/qualitygate/deptest/layering-edges.txt
@@ -1,13 +1,5 @@
 # from	denied	owner	reason	added_at
-github.com/larksuite/cli/shortcuts/im	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/mail	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/minutes	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/vc	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
 github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/keychain	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/drive	github.com/larksuite/cli/internal/credential	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/im	github.com/larksuite/cli/internal/credential	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/minutes	github.com/larksuite/cli/internal/credential	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/vc	github.com/larksuite/cli/internal/credential	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
 github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
 github.com/larksuite/cli/shortcuts/drive	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
 github.com/larksuite/cli/shortcuts/im	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
diff --git a/shortcuts/common/runner.go b/shortcuts/common/runner.go
index dc1f058df7..3fd9948b20 100644
--- a/shortcuts/common/runner.go
+++ b/shortcuts/common/runner.go
@@ -198,6 +198,32 @@ func (ctx *RuntimeContext) EnsureScopes(scopes []string) error {
 	return checkShortcutScopes(ctx.Factory, ctx.ctx, ctx.As(), ctx.Config, scopes)
 }
 
+// ResolveTokenScopes resolves the current credential and returns its scope metadata.
+func (ctx *RuntimeContext) ResolveTokenScopes(callCtx context.Context) (string, bool, error) {
+	result, err := ctx.Factory.Credential.ResolveToken(callCtx, credential.NewTokenSpec(ctx.As(), ctx.Config.AppID))
+	if err != nil {
+		return "", false, err
+	}
+	if result == nil || result.Scopes == "" {
+		return "", false, nil
+	}
+	return result.Scopes, true, nil
+}
+
+// StoredTokenScopes returns scope metadata from the locally stored user token.
+func (ctx *RuntimeContext) StoredTokenScopes() (string, bool) {
+	stored := auth.GetStoredToken(ctx.Config.AppID, ctx.UserOpenId())
+	if stored == nil {
+		return "", false
+	}
+	return stored.Scope, true
+}
+
+// MissingScopes returns required scopes absent from the stored scope string.
+func MissingScopes(storedScope string, required []string) []string {
+	return auth.MissingScopes(storedScope, required)
+}
+
 // ── Flag accessors ──
 
 // Str returns a string flag value.
diff --git a/shortcuts/drive/drive_task_result.go b/shortcuts/drive/drive_task_result.go
index 2ca70f3cd0..7537bb42f5 100644
--- a/shortcuts/drive/drive_task_result.go
+++ b/shortcuts/drive/drive_task_result.go
@@ -10,7 +10,6 @@ import (
 	"strings"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -242,7 +241,7 @@ func queryTaskCheck(runtime *common.RuntimeContext, taskID string) (map[string]i
 }
 
 func validateDriveTaskResultScopes(ctx context.Context, runtime *common.RuntimeContext, scenario string) error {
-	result, err := runtime.Factory.Credential.ResolveToken(ctx, credential.NewTokenSpec(runtime.As(), runtime.Config.AppID))
+	scopes, ok, err := runtime.ResolveTokenScopes(ctx)
 	if err != nil {
 		// Propagate cancellation/timeout so callers stop instead of falling through
 		// to the API call. Other token errors are non-fatal here: the API call will
@@ -252,7 +251,7 @@ func validateDriveTaskResultScopes(ctx context.Context, runtime *common.RuntimeC
 		}
 		return nil
 	}
-	if result == nil || result.Scopes == "" {
+	if !ok {
 		return nil
 	}
 
@@ -264,7 +263,7 @@ func validateDriveTaskResultScopes(ctx context.Context, runtime *common.RuntimeC
 		required = []string{"wiki:space:read"}
 	}
 
-	return requireDriveScopes(result.Scopes, required)
+	return requireDriveScopes(scopes, required)
 }
 
 func requireDriveScopes(storedScopes string, required []string) error {
diff --git a/shortcuts/im/helpers.go b/shortcuts/im/helpers.go
index 9fcd3c0e0d..a07df92b27 100644
--- a/shortcuts/im/helpers.go
+++ b/shortcuts/im/helpers.go
@@ -21,8 +21,6 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/auth"
-	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
@@ -1284,19 +1282,19 @@ func checkFlagRequiredScopes(ctx context.Context, rt *common.RuntimeContext, req
 	if len(required) == 0 {
 		return nil
 	}
-	result, err := rt.Factory.Credential.ResolveToken(ctx, credential.NewTokenSpec(rt.As(), rt.Config.AppID))
+	scopes, ok, err := rt.ResolveTokenScopes(ctx)
 	if err != nil {
 		return errs.NewAuthenticationError(errs.SubtypeTokenMissing, "cannot verify required scope(s): %v", err).
 			WithHint("%s", flagScopeLoginHint(required)).
 			WithCause(err)
 	}
-	if result == nil || result.Scopes == "" {
+	if !ok {
 		fmt.Fprintf(rt.IO().ErrOut,
 			"warning: cannot verify required scope(s) because token scope metadata is unavailable; API may fail if missing: %s\n",
 			strings.Join(required, " "))
 		return nil
 	}
-	if missing := auth.MissingScopes(result.Scopes, required); len(missing) > 0 {
+	if missing := common.MissingScopes(scopes, required); len(missing) > 0 {
 		return errs.NewPermissionError(errs.SubtypeMissingScope, "missing required scope(s): %s", strings.Join(missing, ", ")).
 			WithMissingScopes(missing...).
 			WithHint("%s", flagScopeLoginHint(missing))
diff --git a/shortcuts/mail/helpers.go b/shortcuts/mail/helpers.go
index 52131a9858..70d38127df 100644
--- a/shortcuts/mail/helpers.go
+++ b/shortcuts/mail/helpers.go
@@ -21,7 +21,6 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 	draftpkg "github.com/larksuite/cli/shortcuts/mail/draft"
@@ -2368,12 +2367,12 @@ func validateConfirmSendScope(runtime *common.RuntimeContext) error {
 	if appID == "" || userOpenId == "" {
 		return nil
 	}
-	stored := auth.GetStoredToken(appID, userOpenId)
-	if stored == nil {
+	storedScope, ok := runtime.StoredTokenScopes()
+	if !ok {
 		return nil
 	}
 	required := []string{"mail:user_mailbox.message:send"}
-	if missing := auth.MissingScopes(stored.Scope, required); len(missing) > 0 {
+	if missing := common.MissingScopes(storedScope, required); len(missing) > 0 {
 		return errs.NewPermissionError(errs.SubtypeMissingScope,
 			"--confirm-send requires scope: %s", strings.Join(missing, ", ")).
 			WithHint("run `lark-cli auth login --scope %q` to grant the send permission", strings.Join(missing, " ")).
@@ -2393,12 +2392,12 @@ func validateFolderReadScope(runtime *common.RuntimeContext) error {
 	if appID == "" || userOpenId == "" {
 		return nil
 	}
-	stored := auth.GetStoredToken(appID, userOpenId)
-	if stored == nil {
+	storedScope, ok := runtime.StoredTokenScopes()
+	if !ok {
 		return nil
 	}
 	required := []string{"mail:user_mailbox.folder:read"}
-	if missing := auth.MissingScopes(stored.Scope, required); len(missing) > 0 {
+	if missing := common.MissingScopes(storedScope, required); len(missing) > 0 {
 		return errs.NewPermissionError(errs.SubtypeMissingScope,
 			"folder resolution requires scope: %s", strings.Join(missing, ", ")).
 			WithHint("run `lark-cli auth login --scope %q` to grant folder read permission", strings.Join(missing, " ")).
@@ -2418,12 +2417,12 @@ func validateLabelReadScope(runtime *common.RuntimeContext) error {
 	if appID == "" || userOpenId == "" {
 		return nil
 	}
-	stored := auth.GetStoredToken(appID, userOpenId)
-	if stored == nil {
+	storedScope, ok := runtime.StoredTokenScopes()
+	if !ok {
 		return nil
 	}
 	required := []string{"mail:user_mailbox.message:modify"}
-	if missing := auth.MissingScopes(stored.Scope, required); len(missing) > 0 {
+	if missing := common.MissingScopes(storedScope, required); len(missing) > 0 {
 		return errs.NewPermissionError(errs.SubtypeMissingScope,
 			"label resolution requires scope: %s", strings.Join(missing, ", ")).
 			WithHint("run `lark-cli auth login --scope %q` to grant label access permission", strings.Join(missing, " ")).
diff --git a/shortcuts/minutes/minutes_detail.go b/shortcuts/minutes/minutes_detail.go
index 4d8cb36862..b8a176829f 100644
--- a/shortcuts/minutes/minutes_detail.go
+++ b/shortcuts/minutes/minutes_detail.go
@@ -18,8 +18,6 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/auth"
-	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -317,9 +315,9 @@ var MinutesDetail = common.Shortcut{
 			}
 		}
 		// dynamic scope check
-		result, err := runtime.Factory.Credential.ResolveToken(ctx, credential.NewTokenSpec(runtime.As(), runtime.Config.AppID))
-		if err == nil && result != nil && result.Scopes != "" {
-			if missing := auth.MissingScopes(result.Scopes, scopesDetailMinuteTokens); len(missing) > 0 {
+		scopes, ok, err := runtime.ResolveTokenScopes(ctx)
+		if err == nil && ok {
+			if missing := common.MissingScopes(scopes, scopesDetailMinuteTokens); len(missing) > 0 {
 				return errs.NewPermissionError(errs.SubtypeMissingScope,
 					"missing required scope(s): %s", strings.Join(missing, ", ")).
 					WithHint("run `lark-cli auth login --scope %q` in the background. It blocks and outputs a verification URL — retrieve the URL and open it in a browser to complete login.", strings.Join(missing, " ")).
diff --git a/shortcuts/vc/vc_detail.go b/shortcuts/vc/vc_detail.go
index 057def3040..a2329fc127 100644
--- a/shortcuts/vc/vc_detail.go
+++ b/shortcuts/vc/vc_detail.go
@@ -14,8 +14,6 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/auth"
-	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -176,9 +174,9 @@ var VCDetail = common.Shortcut{
 			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--meeting-ids: too many IDs (%d), maximum is %d", len(ids), maxBatchSize).WithParam("--meeting-ids")
 		}
 		// dynamic scope check
-		result, err := runtime.Factory.Credential.ResolveToken(ctx, credential.NewTokenSpec(runtime.As(), runtime.Config.AppID))
-		if err == nil && result != nil && result.Scopes != "" {
-			if missing := auth.MissingScopes(result.Scopes, scopesDetailMeetingIDs); len(missing) > 0 {
+		scopes, ok, err := runtime.ResolveTokenScopes(ctx)
+		if err == nil && ok {
+			if missing := common.MissingScopes(scopes, scopesDetailMeetingIDs); len(missing) > 0 {
 				return errs.NewPermissionError(errs.SubtypeMissingScope,
 					"missing required scope(s): %s", strings.Join(missing, ", ")).
 					WithHint("run `lark-cli auth login --scope %q` in the background. It blocks and outputs a verification URL — retrieve the URL and open it in a browser to complete login.", strings.Join(missing, " ")).
diff --git a/shortcuts/vc/vc_notes.go b/shortcuts/vc/vc_notes.go
index 0d1b03259d..58745db2c0 100644
--- a/shortcuts/vc/vc_notes.go
+++ b/shortcuts/vc/vc_notes.go
@@ -24,8 +24,6 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/auth"
-	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -584,9 +582,9 @@ var VCNotes = common.Shortcut{
 		default:
 			// unreachable: ExactlyOne already ensures one flag is set
 		}
-		result, err := runtime.Factory.Credential.ResolveToken(ctx, credential.NewTokenSpec(runtime.As(), runtime.Config.AppID))
-		if err == nil && result != nil && result.Scopes != "" {
-			if missing := auth.MissingScopes(result.Scopes, required); len(missing) > 0 {
+		scopes, ok, err := runtime.ResolveTokenScopes(ctx)
+		if err == nil && ok {
+			if missing := common.MissingScopes(scopes, required); len(missing) > 0 {
 				return errs.NewPermissionError(errs.SubtypeMissingScope,
 					"missing required scope(s): %s", strings.Join(missing, ", ")).
 					WithHint("run `lark-cli auth login --scope %q` in the background. It blocks and outputs a verification URL — retrieve the URL and open it in a browser to complete login.", strings.Join(missing, " ")).
diff --git a/shortcuts/vc/vc_recording.go b/shortcuts/vc/vc_recording.go
index 2497efc127..7f602fa17a 100644
--- a/shortcuts/vc/vc_recording.go
+++ b/shortcuts/vc/vc_recording.go
@@ -19,7 +19,6 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -119,9 +118,9 @@ var VCRecording = common.Shortcut{
 		appID := runtime.Config.AppID
 		userOpenID := runtime.UserOpenId()
 		if appID != "" && userOpenID != "" {
-			stored := auth.GetStoredToken(appID, userOpenID)
-			if stored != nil {
-				if missing := auth.MissingScopes(stored.Scope, required); len(missing) > 0 {
+			storedScope, ok := runtime.StoredTokenScopes()
+			if ok {
+				if missing := common.MissingScopes(storedScope, required); len(missing) > 0 {
 					return errs.NewPermissionError(errs.SubtypeMissingScope,
 						"missing required scope(s): %s", strings.Join(missing, ", ")).
 						WithHint("run `lark-cli auth login --scope %q` in the background. It blocks and outputs a verification URL — retrieve the URL and open it in a browser to complete login.", strings.Join(missing, " ")).

From 770c23035caf87bd4d198892c9ee77444ffc3b6d Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 11:48:37 +0800
Subject: [PATCH 35/50] refactor(shortcuts): route client helpers through
 common

---
 .../qualitygate/deptest/layering-edges.txt    |  6 -----
 shortcuts/apps/git_credential.go              |  3 +--
 shortcuts/common/runner.go                    | 24 +++++++++++++++++++
 shortcuts/drive/drive_export_common.go        |  3 +--
 .../im/im_messages_resources_download.go      |  3 +--
 shortcuts/mail/mail_triage.go                 |  3 +--
 shortcuts/mail/mail_watch.go                  |  3 +--
 shortcuts/markdown/helpers.go                 |  5 ++--
 shortcuts/task/task_upload_attachment.go      |  3 +--
 9 files changed, 32 insertions(+), 21 deletions(-)

diff --git a/internal/qualitygate/deptest/layering-edges.txt b/internal/qualitygate/deptest/layering-edges.txt
index 306268c4c8..b8c99df5c9 100644
--- a/internal/qualitygate/deptest/layering-edges.txt
+++ b/internal/qualitygate/deptest/layering-edges.txt
@@ -1,11 +1,5 @@
 # from	denied	owner	reason	added_at
 github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/keychain	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/drive	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/im	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/mail	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/markdown	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/task	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
 github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/vfs	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
 github.com/larksuite/cli/shortcuts/event	github.com/larksuite/cli/internal/vfs	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
 github.com/larksuite/cli/shortcuts/mail	github.com/larksuite/cli/internal/vfs	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
diff --git a/shortcuts/apps/git_credential.go b/shortcuts/apps/git_credential.go
index 7a1804beba..b330fa119b 100644
--- a/shortcuts/apps/git_credential.go
+++ b/shortcuts/apps/git_credential.go
@@ -22,7 +22,6 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
@@ -497,7 +496,7 @@ func issuedFromData(appID string, data map[string]interface{}) (*gitcred.IssuedC
 // handled locally.
 func parseIssueCredentialData(resp *larkcore.ApiResp, err error, cc errclass.ClassifyContext) (map[string]any, error) {
 	if err != nil {
-		return nil, redactGitCredentialIssueError(client.WrapDoAPIError(err))
+		return nil, redactGitCredentialIssueError(common.WrapDoAPIError(err))
 	}
 	detail := logIDDetail(resp)
 	if resp == nil || len(resp.RawBody) == 0 {
diff --git a/shortcuts/common/runner.go b/shortcuts/common/runner.go
index 3fd9948b20..c9eaaf0aa1 100644
--- a/shortcuts/common/runner.go
+++ b/shortcuts/common/runner.go
@@ -14,6 +14,7 @@ import (
 	"slices"
 	"strings"
 	"sync"
+	"time"
 
 	"github.com/google/uuid"
 	lark "github.com/larksuite/oapi-sdk-go/v3"
@@ -280,6 +281,29 @@ func (ctx *RuntimeContext) Changed(name string) bool {
 
 // ── API helpers ──
 
+// Option configures streaming API request behavior.
+type Option = client.Option
+
+// WithHeaders adds HTTP headers to a streaming API request.
+func WithHeaders(headers http.Header) Option {
+	return client.WithHeaders(headers)
+}
+
+// WithTimeout sets a timeout for a streaming API request.
+func WithTimeout(timeout time.Duration) Option {
+	return client.WithTimeout(timeout)
+}
+
+// WrapDoAPIError classifies SDK request failures as typed command errors.
+func WrapDoAPIError(err error) error {
+	return client.WrapDoAPIError(err)
+}
+
+// ResolveFilename derives a download filename from an API response.
+func ResolveFilename(resp *larkcore.ApiResp) string {
+	return client.ResolveFilename(resp)
+}
+
 // CallAPITyped calls the Lark API using the current identity (ctx.As()) via
 // the SDK request path (buildRequest → APIClient.DoAPI → DoSDKRequest) and
 // returns the "data" object, classifying failures into typed errs.* errors via
diff --git a/shortcuts/drive/drive_export_common.go b/shortcuts/drive/drive_export_common.go
index 894d2f8643..4b2354c8bf 100644
--- a/shortcuts/drive/drive_export_common.go
+++ b/shortcuts/drive/drive_export_common.go
@@ -17,7 +17,6 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -608,7 +607,7 @@ func downloadDriveExportFile(ctx context.Context, runtime *common.RuntimeContext
 	if fileName == "" {
 		// Fall back to the server-provided download name when the caller did not
 		// request an explicit local file name.
-		fileName = client.ResolveFilename(apiResp)
+		fileName = common.ResolveFilename(apiResp)
 	}
 	savedPath, err := saveContentToOutputDir(runtime.FileIO(), outputDir, fileName, apiResp.RawBody, overwrite)
 	if err != nil {
diff --git a/shortcuts/im/im_messages_resources_download.go b/shortcuts/im/im_messages_resources_download.go
index 1327e00f18..e2fdd19f5b 100644
--- a/shortcuts/im/im_messages_resources_download.go
+++ b/shortcuts/im/im_messages_resources_download.go
@@ -16,7 +16,6 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/shortcuts/common"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 )
@@ -413,7 +412,7 @@ func doIMResourceDownloadRequest(ctx context.Context, runtime *common.RuntimeCon
 
 	var lastErr error
 	for attempt := 0; attempt <= imDownloadRequestRetries; attempt++ {
-		resp, err := runtime.DoAPIStream(ctx, req, client.WithTimeout(defaultIMResourceDownloadTimeout), client.WithHeaders(headerValues))
+		resp, err := runtime.DoAPIStream(ctx, req, common.WithTimeout(defaultIMResourceDownloadTimeout), common.WithHeaders(headerValues))
 		if err == nil {
 			return resp, nil
 		}
diff --git a/shortcuts/mail/mail_triage.go b/shortcuts/mail/mail_triage.go
index 974d656627..eebc16ba55 100644
--- a/shortcuts/mail/mail_triage.go
+++ b/shortcuts/mail/mail_triage.go
@@ -13,7 +13,6 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
@@ -1097,7 +1096,7 @@ func doJSONAPI(runtime *common.RuntimeContext, req *larkcore.ApiReq, action stri
 	for attempt := 0; attempt <= triageAPIRetries; attempt++ {
 		apiResp, err := runtime.DoAPI(req)
 		if err != nil {
-			lastErr = mailDecorateProblemMessage(client.WrapDoAPIError(err), "%s", action)
+			lastErr = mailDecorateProblemMessage(common.WrapDoAPIError(err), "%s", action)
 			if attempt == triageAPIRetries {
 				return nil, lastErr
 			}
diff --git a/shortcuts/mail/mail_watch.go b/shortcuts/mail/mail_watch.go
index ff877313cf..0eafe87e4e 100644
--- a/shortcuts/mail/mail_watch.go
+++ b/shortcuts/mail/mail_watch.go
@@ -23,7 +23,6 @@ import (
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
@@ -714,7 +713,7 @@ func fetchMessageForWatch(runtime *common.RuntimeContext, mailbox, messageID, fo
 		QueryParams: queryParams,
 	})
 	if err != nil {
-		return nil, client.WrapDoAPIError(err)
+		return nil, common.WrapDoAPIError(err)
 	}
 	data, err := runtime.ClassifyAPIResponse(apiResp)
 	if err != nil {
diff --git a/shortcuts/markdown/helpers.go b/shortcuts/markdown/helpers.go
index 6f64975793..a82057e94a 100644
--- a/shortcuts/markdown/helpers.go
+++ b/shortcuts/markdown/helpers.go
@@ -17,7 +17,6 @@ import (
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -432,7 +431,7 @@ func uploadMarkdownFileAll(runtime *common.RuntimeContext, spec markdownUploadSp
 			Body:       fd,
 		}, larkcore.WithFileUpload())
 		if err != nil {
-			return markdownUploadResult{}, markdownUploadProblem(client.WrapDoAPIError(err), markdownUploadAllAction)
+			return markdownUploadResult{}, markdownUploadProblem(common.WrapDoAPIError(err), markdownUploadAllAction)
 		}
 
 		data, err := runtime.ClassifyAPIResponse(apiResp)
@@ -572,7 +571,7 @@ func uploadMarkdownMultipartParts(runtime *common.RuntimeContext, fileReader io.
 				Body:       fd,
 			}, larkcore.WithFileUpload())
 			if err != nil {
-				return markdownUploadProblem(client.WrapDoAPIError(err), action)
+				return markdownUploadProblem(common.WrapDoAPIError(err), action)
 			}
 			if _, err := runtime.ClassifyAPIResponse(apiResp); err != nil {
 				return markdownUploadProblem(err, action)
diff --git a/shortcuts/task/task_upload_attachment.go b/shortcuts/task/task_upload_attachment.go
index 099e3f66b7..810a8a800e 100644
--- a/shortcuts/task/task_upload_attachment.go
+++ b/shortcuts/task/task_upload_attachment.go
@@ -15,7 +15,6 @@ import (
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -165,7 +164,7 @@ var UploadAttachmentTask = common.Shortcut{
 			ApiPath:     taskAttachmentUploadPath,
 			QueryParams: queryParams,
 			Body:        &bodyBuf,
-		}, client.WithHeaders(headers))
+		}, common.WithHeaders(headers))
 		if err != nil {
 			fmt.Fprintf(runtime.IO().ErrOut,
 				"[+upload-attachment] http response: error=%v\n", err)

From 342d1a247d441d4cbed6404c4634773f1aa7589a Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 11:53:54 +0800
Subject: [PATCH 36/50] refactor(shortcuts): centralize output directory
 creation

---
 internal/outputdir/outputdir.go               | 24 +++++++++++++++++++
 .../qualitygate/deptest/layering-edges.txt    |  2 --
 shortcuts/common/output_dir.go                | 14 +++++++++++
 shortcuts/event/pipeline.go                   |  6 ++---
 shortcuts/mail/mail_watch.go                  |  3 +--
 5 files changed, 42 insertions(+), 7 deletions(-)
 create mode 100644 internal/outputdir/outputdir.go
 create mode 100644 shortcuts/common/output_dir.go

diff --git a/internal/outputdir/outputdir.go b/internal/outputdir/outputdir.go
new file mode 100644
index 0000000000..c177d9efb8
--- /dev/null
+++ b/internal/outputdir/outputdir.go
@@ -0,0 +1,24 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+// Package outputdir validates and creates directories used for command output.
+package outputdir
+
+import (
+	"path/filepath"
+
+	"github.com/larksuite/cli/internal/validate"
+	"github.com/larksuite/cli/internal/vfs"
+)
+
+// Ensure creates an output directory with owner-only permissions.
+func Ensure(path string) error {
+	if !filepath.IsAbs(path) {
+		resolved, err := validate.SafeOutputPath(path)
+		if err != nil {
+			return err
+		}
+		path = resolved
+	}
+	return vfs.MkdirAll(path, 0700)
+}
diff --git a/internal/qualitygate/deptest/layering-edges.txt b/internal/qualitygate/deptest/layering-edges.txt
index b8c99df5c9..fca7c2d9ac 100644
--- a/internal/qualitygate/deptest/layering-edges.txt
+++ b/internal/qualitygate/deptest/layering-edges.txt
@@ -1,5 +1,3 @@
 # from	denied	owner	reason	added_at
 github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/keychain	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
 github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/vfs	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/event	github.com/larksuite/cli/internal/vfs	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/mail	github.com/larksuite/cli/internal/vfs	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
diff --git a/shortcuts/common/output_dir.go b/shortcuts/common/output_dir.go
new file mode 100644
index 0000000000..8cae75b37c
--- /dev/null
+++ b/shortcuts/common/output_dir.go
@@ -0,0 +1,14 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package common
+
+import "github.com/larksuite/cli/internal/outputdir"
+
+// EnsureOutputDir creates an output directory with owner-only permissions.
+// Relative paths are validated and resolved within the working directory.
+// Absolute paths are accepted for callers that already resolved them through
+// SafeOutputPath or RuntimeContext.ResolveSavePath.
+func EnsureOutputDir(path string) error {
+	return outputdir.Ensure(path)
+}
diff --git a/shortcuts/event/pipeline.go b/shortcuts/event/pipeline.go
index 0b9b4caf51..4d960d740c 100644
--- a/shortcuts/event/pipeline.go
+++ b/shortcuts/event/pipeline.go
@@ -17,7 +17,7 @@ import (
 
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/shortcuts/common"
 	larkevent "github.com/larksuite/oapi-sdk-go/v3/event"
 )
 
@@ -62,13 +62,13 @@ func NewEventPipeline(
 // EnsureDirs creates all configured output directories once at startup.
 func (p *EventPipeline) EnsureDirs() error {
 	if p.config.OutputDir != "" {
-		if err := vfs.MkdirAll(p.config.OutputDir, 0700); err != nil {
+		if err := common.EnsureOutputDir(p.config.OutputDir); err != nil {
 			return eventFileIOError(err, "create output dir")
 		}
 	}
 	if p.config.Router != nil {
 		for _, route := range p.config.Router.routes {
-			if err := vfs.MkdirAll(route.dir, 0700); err != nil {
+			if err := common.EnsureOutputDir(route.dir); err != nil {
 				return eventFileIOError(err, "create route dir %s", route.dir)
 			}
 		}
diff --git a/shortcuts/mail/mail_watch.go b/shortcuts/mail/mail_watch.go
index 0eafe87e4e..d01e75d78d 100644
--- a/shortcuts/mail/mail_watch.go
+++ b/shortcuts/mail/mail_watch.go
@@ -26,7 +26,6 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/internal/vfs"
 	"github.com/larksuite/cli/shortcuts/common"
 
 	larkevent "github.com/larksuite/oapi-sdk-go/v3/event"
@@ -206,7 +205,7 @@ var MailWatch = common.Shortcut{
 				return mailValidationParamError("--output-dir", "invalid --output-dir %q: %v", outputDir, err).WithCause(err)
 			}
 			outputDir = safePath
-			if err := vfs.MkdirAll(outputDir, 0700); err != nil {
+			if err := common.EnsureOutputDir(outputDir); err != nil {
 				return mailFileIOError("cannot create output directory %q: %v", err, outputDir, err)
 			}
 		}

From 38312d3a9c7393992f0ab6d353518596269a747a Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 11:58:22 +0800
Subject: [PATCH 37/50] refactor(apps): move local state behind internal
 storage

---
 .../qualitygate/deptest/layering-edges.txt    |  2 -
 internal/sparkstore/git_credential.go         | 52 ++++++++++++++++++
 .../apps => internal/sparkstore}/storage.go   | 34 ++++++++----
 .../sparkstore}/storage_test.go               |  2 +-
 scripts/check-layering-ratchet.sh             | 12 ++---
 shortcuts/apps/apps_errors.go                 |  6 ---
 shortcuts/apps/git_credential.go              | 48 +++--------------
 shortcuts/apps/git_credential_storage.go      | 54 -------------------
 shortcuts/apps/git_credential_test.go         | 21 ++++----
 shortcuts/apps/gitcred/app_manager.go         | 44 +++++++++++++++
 10 files changed, 147 insertions(+), 128 deletions(-)
 create mode 100644 internal/sparkstore/git_credential.go
 rename {shortcuts/apps => internal/sparkstore}/storage.go (77%)
 rename {shortcuts/apps => internal/sparkstore}/storage_test.go (99%)
 delete mode 100644 shortcuts/apps/git_credential_storage.go
 create mode 100644 shortcuts/apps/gitcred/app_manager.go

diff --git a/internal/qualitygate/deptest/layering-edges.txt b/internal/qualitygate/deptest/layering-edges.txt
index fca7c2d9ac..a433077d43 100644
--- a/internal/qualitygate/deptest/layering-edges.txt
+++ b/internal/qualitygate/deptest/layering-edges.txt
@@ -1,3 +1 @@
 # from	denied	owner	reason	added_at
-github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/keychain	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
-github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/vfs	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
diff --git a/internal/sparkstore/git_credential.go b/internal/sparkstore/git_credential.go
new file mode 100644
index 0000000000..5d599411e0
--- /dev/null
+++ b/internal/sparkstore/git_credential.go
@@ -0,0 +1,52 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package sparkstore
+
+import (
+	"errors"
+	"net/url"
+	"os"
+
+	"github.com/larksuite/cli/internal/vfs"
+)
+
+// AppStorage adapts Spark local state to the Git credential store interface.
+type AppStorage struct{}
+
+func (AppStorage) Read(appID, key string) ([]byte, error) {
+	return Read(appID, key)
+}
+
+func (AppStorage) Write(appID, key string, data []byte) error {
+	return Write(appID, key, data)
+}
+
+func (AppStorage) Delete(appID, key string) error {
+	return Delete(appID, key)
+}
+
+func (AppStorage) ListAppIDs() ([]string, error) {
+	entries, err := vfs.ReadDir(Root())
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return []string{}, nil
+		}
+		return nil, storageError(err, "apps storage: read root: %v", err)
+	}
+	appIDs := make([]string, 0, len(entries))
+	for _, e := range entries {
+		if !e.IsDir() {
+			continue
+		}
+		appID, err := url.PathUnescape(e.Name())
+		if err != nil {
+			continue
+		}
+		if err := checkSeg(appID, "appID"); err != nil {
+			continue
+		}
+		appIDs = append(appIDs, appID)
+	}
+	return appIDs, nil
+}
diff --git a/shortcuts/apps/storage.go b/internal/sparkstore/storage.go
similarity index 77%
rename from shortcuts/apps/storage.go
rename to internal/sparkstore/storage.go
index fea308a20b..4223ded955 100644
--- a/shortcuts/apps/storage.go
+++ b/internal/sparkstore/storage.go
@@ -1,7 +1,8 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package apps
+// Package sparkstore persists local state for Spark applications.
+package sparkstore
 
 import (
 	"errors"
@@ -12,7 +13,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/internal/vfs" //nolint:depguard // existing apps storage persists CLI config-dir state; it is not user file I/O.
+	"github.com/larksuite/cli/internal/vfs"
 )
 
 // storageRoot is the per-domain local-storage directory name under the config dir.
@@ -25,7 +26,7 @@ const storageRoot = "spark"
 // can traverse out of the storage directory.
 func checkSeg(name, what string) error {
 	if err := validate.ResourceName(name, what); err != nil {
-		return appsStorageError(err, "apps storage: %v", err)
+		return storageError(err, "apps storage: %v", err)
 	}
 	if name == "." {
 		return errs.NewInternalError(errs.SubtypeStorage, "apps storage: %s must not be \".\"", what)
@@ -36,7 +37,7 @@ func checkSeg(name, what string) error {
 // appDir returns the storage directory for one app: ~/.lark-cli/spark/<esc(appID)>/
 // (workspace-aware).
 func appDir(appID string) string {
-	return filepath.Join(core.GetConfigDir(), storageRoot, validate.EncodePathSegment(appID))
+	return filepath.Join(Root(), validate.EncodePathSegment(appID))
 }
 
 // appKeyPath returns the file path for one (appID, key).
@@ -44,6 +45,16 @@ func appKeyPath(appID, key string) string {
 	return filepath.Join(appDir(appID), validate.EncodePathSegment(key))
 }
 
+// Root returns the Spark application storage root under the CLI config directory.
+func Root() string {
+	return filepath.Join(core.GetConfigDir(), storageRoot)
+}
+
+// Path returns the storage path for one application key.
+func Path(appID, key string) string {
+	return appKeyPath(appID, key)
+}
+
 // Read returns the bytes stored under (appID, key). A missing file returns
 // (nil, nil). Content is opaque — callers own the format. Note: an empty stored
 // value is indistinguishable from a missing key (both yield nil), so this store
@@ -60,7 +71,7 @@ func Read(appID, key string) ([]byte, error) {
 		if errors.Is(err, os.ErrNotExist) {
 			return nil, nil
 		}
-		return nil, appsStorageError(err, "apps storage: read: %v", err)
+		return nil, storageError(err, "apps storage: read: %v", err)
 	}
 	return data, nil
 }
@@ -79,10 +90,10 @@ func Write(appID, key string, data []byte) error {
 		return err
 	}
 	if err := vfs.MkdirAll(appDir(appID), 0700); err != nil {
-		return appsStorageError(err, "apps storage: create dir: %v", err)
+		return storageError(err, "apps storage: create dir: %v", err)
 	}
 	if err := validate.AtomicWrite(appKeyPath(appID, key), data, 0600); err != nil {
-		return appsStorageError(err, "apps storage: write: %v", err)
+		return storageError(err, "apps storage: write: %v", err)
 	}
 	return nil
 }
@@ -96,7 +107,7 @@ func Delete(appID, key string) error {
 		return err
 	}
 	if err := vfs.Remove(appKeyPath(appID, key)); err != nil && !errors.Is(err, os.ErrNotExist) {
-		return appsStorageError(err, "apps storage: delete: %v", err)
+		return storageError(err, "apps storage: delete: %v", err)
 	}
 	return nil
 }
@@ -113,7 +124,7 @@ func List(appID string) ([]string, error) {
 		if errors.Is(err, os.ErrNotExist) {
 			return []string{}, nil
 		}
-		return nil, appsStorageError(err, "apps storage: read dir: %v", err)
+		return nil, storageError(err, "apps storage: read dir: %v", err)
 	}
 	keys := make([]string, 0, len(entries))
 	for _, e := range entries {
@@ -131,3 +142,8 @@ func List(appID string) ([]string, error) {
 	}
 	return keys, nil
 }
+
+// storageError classifies local application state failures as internal/storage.
+func storageError(err error, format string, args ...any) *errs.InternalError {
+	return errs.NewInternalError(errs.SubtypeStorage, format, args...).WithCause(err)
+}
diff --git a/shortcuts/apps/storage_test.go b/internal/sparkstore/storage_test.go
similarity index 99%
rename from shortcuts/apps/storage_test.go
rename to internal/sparkstore/storage_test.go
index 1546e5ab84..3fa47bf532 100644
--- a/shortcuts/apps/storage_test.go
+++ b/internal/sparkstore/storage_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package apps
+package sparkstore
 
 import (
 	"os"
diff --git a/scripts/check-layering-ratchet.sh b/scripts/check-layering-ratchet.sh
index 336275a43d..2d67b8697c 100644
--- a/scripts/check-layering-ratchet.sh
+++ b/scripts/check-layering-ratchet.sh
@@ -87,12 +87,12 @@ layering_ratchet_main() (
   fi
 
   local base_revision="${1:-${QUALITY_GATE_CHANGED_FROM:-}}"
-  # The approved size of the registry at the moment it first reaches the target
-  # branch. Only consulted while the target branch has no registry file, so it
-  # is read exactly once: on the change that introduces the file. Hardcoded on
-  # purpose — a configurable baseline could be raised in CI without review.
-  local approved_initial_count="${2:-18}"
-  local approved_initial_hash="${3:-3e7c5e9cb420248b817a3fdbe936069dbb295398751eee4f66b36cfa571d111b}"
+  # The registry first reaches the target branch with no approved exceptions.
+  # Only consulted while the target branch has no registry file, so bootstrap
+  # requires the extracted key set to stay empty. Hardcoded on purpose — a
+  # configurable baseline could be raised in CI without review.
+  local approved_initial_count="${2:-0}"
+  local approved_initial_hash="${3:-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855}"
   if [[ -z "$base_revision" ]]; then
     echo "Layering ratchet requires a base revision." >&2
     return 1
diff --git a/shortcuts/apps/apps_errors.go b/shortcuts/apps/apps_errors.go
index a00998e1fc..41cdbfdb82 100644
--- a/shortcuts/apps/apps_errors.go
+++ b/shortcuts/apps/apps_errors.go
@@ -30,12 +30,6 @@ func appsFailedPreconditionError(format string, args ...any) *errs.ValidationErr
 	return errs.NewValidationError(errs.SubtypeFailedPrecondition, format, args...)
 }
 
-// appsStorageError classifies a local credential/state storage failure
-// (read, write, delete, list) as internal/storage.
-func appsStorageError(err error, format string, args ...any) *errs.InternalError {
-	return errs.NewInternalError(errs.SubtypeStorage, format, args...).WithCause(err)
-}
-
 // appsExternalToolError classifies a runtime failure of an external tool the
 // CLI shells out to (git, npx) as internal/external_tool. The tool output is
 // carried in the message; recovery guidance goes in the hint.
diff --git a/shortcuts/apps/git_credential.go b/shortcuts/apps/git_credential.go
index b330fa119b..b5e3054d57 100644
--- a/shortcuts/apps/git_credential.go
+++ b/shortcuts/apps/git_credential.go
@@ -10,8 +10,6 @@ import (
 	"io"
 	"net/http"
 	"net/url"
-	"path/filepath"
-	"sort"
 	"strconv"
 	"strings"
 	"text/tabwriter"
@@ -25,7 +23,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
-	"github.com/larksuite/cli/internal/keychain"
+	"github.com/larksuite/cli/internal/sparkstore"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/apps/gitcred"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -69,7 +67,7 @@ var AppsGitCredentialInit = common.Shortcut{
 			Set("mode", "api-plus-local-setup").
 			Set("action", "initialize_local_git_credential").
 			Set("app_id", appID).
-			Set("metadata_file", appKeyPath(appID, gitcred.MetadataFilename)).
+			Set("metadata_file", sparkstore.Path(appID, gitcred.MetadataFilename)).
 			Set("local_effects", []string{
 				"save the issued PAT in the local system credential store",
 				"write app-scoped git credential metadata",
@@ -80,7 +78,7 @@ var AppsGitCredentialInit = common.Shortcut{
 	},
 	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
 		appID := strings.TrimSpace(rctx.Str("app-id"))
-		manager := newGitCredentialManager(appID, rctx.Factory.Keychain, runtimeIssuer{rctx: rctx})
+		manager := gitcred.NewAppManager(appID, rctx.Factory.Keychain, runtimeIssuer{rctx: rctx})
 		result, err := manager.Init(ctx, profileFromConfig(rctx.Config), appID)
 		if err != nil {
 			return gitCredentialLocalError("Initialize local app Git credential", err)
@@ -154,7 +152,7 @@ var AppsGitCredentialRemove = common.Shortcut{
 			Set("mode", "local-cleanup-only").
 			Set("action", "remove_local_git_credential").
 			Set("app_id", appID).
-			Set("metadata_file", appKeyPath(appID, gitcred.MetadataFilename)).
+			Set("metadata_file", sparkstore.Path(appID, gitcred.MetadataFilename)).
 			Set("effects", []string{
 				"read app-scoped git credential metadata",
 				"remove the saved PAT from the local system credential store",
@@ -164,7 +162,7 @@ var AppsGitCredentialRemove = common.Shortcut{
 	},
 	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
 		appID := strings.TrimSpace(rctx.Str("app-id"))
-		manager := newGitCredentialManager(appID, rctx.Factory.Keychain, nil)
+		manager := gitcred.NewAppManager(appID, rctx.Factory.Keychain, nil)
 		result, err := manager.Remove(ctx, profileFromConfig(rctx.Config), appID)
 		if err != nil {
 			return gitCredentialLocalError("Remove local app Git credential", err)
@@ -214,14 +212,14 @@ var AppsGitCredentialList = common.Shortcut{
 			Desc("Preview local Git credential listing (no API call, read-only local state).").
 			Set("mode", "local-read-only").
 			Set("action", "list_local_git_credentials").
-			Set("storage_root", filepath.Join(core.GetConfigDir(), storageRoot)).
+			Set("storage_root", sparkstore.Root()).
 			Set("reads", []string{
 				"scan app-scoped git credential metadata under the CLI config directory",
 				"derive per-app repository URLs and local credential status from local metadata",
 			})
 	},
 	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		records, err := listGitCredentialRecords(rctx.Factory.Keychain, time.Now)
+		records, err := gitcred.ListCredentialRecords(rctx.Factory.Keychain, time.Now)
 		if err != nil {
 			return gitCredentialLocalError("List local app Git credentials", err)
 		}
@@ -342,7 +340,7 @@ func runGitCredentialHelper(ctx context.Context, f *cmdutil.Factory, appID, acti
 		fmt.Fprintln(f.IOStreams.ErrOut, "Git credential unavailable: missing app_id; rerun lark-cli apps +git-credential-init --app-id <app_id>")
 		return nil
 	}
-	manager := newGitCredentialManager(appID, f.Keychain, factoryIssuer{f: f})
+	manager := gitcred.NewAppManager(appID, f.Keychain, factoryIssuer{f: f})
 	switch action {
 	case "get":
 		input, err := gitcred.ParseCredentialInput(f.IOStreams.In)
@@ -366,36 +364,6 @@ func runGitCredentialHelper(ctx context.Context, f *cmdutil.Factory, appID, acti
 	}
 }
 
-func newGitCredentialManager(appID string, kc keychain.KeychainAccess, issuer gitcred.Issuer) *gitcred.Manager {
-	storage := gitCredentialAppStorage{}
-	return gitcred.NewManager(gitcred.NewAppStore(appID, storage), gitcred.NewSecretStore(kc), gitcred.GlobalGitConfig{}, issuer)
-}
-
-func listGitCredentialRecords(kc keychain.KeychainAccess, now func() time.Time) ([]gitcred.ListRecord, error) {
-	storage := gitCredentialAppStorage{}
-	appIDs, err := storage.ListAppIDs()
-	if err != nil {
-		return nil, err
-	}
-	records := make([]gitcred.ListRecord, 0, len(appIDs))
-	for _, appID := range appIDs {
-		manager := newGitCredentialManager(appID, kc, nil)
-		manager.Now = now
-		result, err := manager.List()
-		if err != nil {
-			return nil, err
-		}
-		records = append(records, result.Records...)
-	}
-	sort.Slice(records, func(i, j int) bool {
-		if records[i].AppID == records[j].AppID {
-			return records[i].GitHTTPURL < records[j].GitHTTPURL
-		}
-		return records[i].AppID < records[j].AppID
-	})
-	return records, nil
-}
-
 func gitCredentialListPayload(records []gitcred.ListRecord) []map[string]interface{} {
 	out := make([]map[string]interface{}, 0, len(records))
 	for _, record := range records {
diff --git a/shortcuts/apps/git_credential_storage.go b/shortcuts/apps/git_credential_storage.go
deleted file mode 100644
index d76355c4b2..0000000000
--- a/shortcuts/apps/git_credential_storage.go
+++ /dev/null
@@ -1,54 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"errors"
-	"net/url"
-	"os"
-	"path/filepath"
-
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/vfs" //nolint:depguard // Git credential list scans CLI config-dir state; it is not user file I/O.
-)
-
-type gitCredentialAppStorage struct{}
-
-func (gitCredentialAppStorage) Read(appID, key string) ([]byte, error) {
-	return Read(appID, key)
-}
-
-func (gitCredentialAppStorage) Write(appID, key string, data []byte) error {
-	return Write(appID, key, data)
-}
-
-func (gitCredentialAppStorage) Delete(appID, key string) error {
-	return Delete(appID, key)
-}
-
-func (gitCredentialAppStorage) ListAppIDs() ([]string, error) {
-	root := filepath.Join(core.GetConfigDir(), storageRoot)
-	entries, err := vfs.ReadDir(root)
-	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			return []string{}, nil
-		}
-		return nil, appsStorageError(err, "apps storage: read root: %v", err)
-	}
-	appIDs := make([]string, 0, len(entries))
-	for _, e := range entries {
-		if !e.IsDir() {
-			continue
-		}
-		appID, err := url.PathUnescape(e.Name())
-		if err != nil {
-			continue
-		}
-		if err := checkSeg(appID, "appID"); err != nil {
-			continue
-		}
-		appIDs = append(appIDs, appID)
-	}
-	return appIDs, nil
-}
diff --git a/shortcuts/apps/git_credential_test.go b/shortcuts/apps/git_credential_test.go
index 7aa0d58bed..b3d84adc56 100644
--- a/shortcuts/apps/git_credential_test.go
+++ b/shortcuts/apps/git_credential_test.go
@@ -26,6 +26,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/sparkstore"
 	"github.com/larksuite/cli/shortcuts/apps/gitcred"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -283,7 +284,7 @@ func TestAppsGitCredentialInitExecutesAndRefreshes(t *testing.T) {
 	if got := stdout.String(); !strings.Contains(got, `"status": "initialized"`) || !strings.Contains(got, `"repository_url": "https://example.com/git/u/app.git"`) {
 		t.Fatalf("init stdout = %s", got)
 	}
-	meta, err := Read("app_xxx", gitcred.MetadataFilename)
+	meta, err := sparkstore.Read("app_xxx", gitcred.MetadataFilename)
 	if err != nil {
 		t.Fatalf("read app-scoped metadata: %v", err)
 	}
@@ -525,10 +526,10 @@ func TestAppsGitCredentialListEmpty(t *testing.T) {
 
 func TestGitCredentialAppStorageListAppIDsSkipsNonCredentialAppDirs(t *testing.T) {
 	newAppsExecuteFactory(t)
-	if err := Write("app/a", gitcred.MetadataFilename, []byte("{}")); err != nil {
+	if err := sparkstore.Write("app/a", gitcred.MetadataFilename, []byte("{}")); err != nil {
 		t.Fatalf("Write escaped app metadata: %v", err)
 	}
-	if err := Write("app_b", gitcred.MetadataFilename, []byte("{}")); err != nil {
+	if err := sparkstore.Write("app_b", gitcred.MetadataFilename, []byte("{}")); err != nil {
 		t.Fatalf("Write app_b metadata: %v", err)
 	}
 	root := filepath.Join(core.GetConfigDir(), "spark")
@@ -541,7 +542,7 @@ func TestGitCredentialAppStorageListAppIDsSkipsNonCredentialAppDirs(t *testing.T
 		}
 	}
 
-	appIDs, err := gitCredentialAppStorage{}.ListAppIDs()
+	appIDs, err := (sparkstore.AppStorage{}).ListAppIDs()
 	if err != nil {
 		t.Fatalf("ListAppIDs: %v", err)
 	}
@@ -569,10 +570,10 @@ func TestAppsGitCredentialListReturnsScanErrors(t *testing.T) {
 
 	t.Run("record error", func(t *testing.T) {
 		factory, _, _ := newAppsExecuteFactory(t)
-		if err := Write("app_xxx", gitcred.MetadataFilename, []byte("{bad json")); err != nil {
+		if err := sparkstore.Write("app_xxx", gitcred.MetadataFilename, []byte("{bad json")); err != nil {
 			t.Fatalf("write invalid metadata: %v", err)
 		}
-		_, err := listGitCredentialRecords(factory.Keychain, time.Now)
+		_, err := gitcred.ListCredentialRecords(factory.Keychain, time.Now)
 		if err == nil || !strings.Contains(err.Error(), "invalid git.json") {
 			t.Fatalf("listGitCredentialRecords record error = %v", err)
 		}
@@ -584,7 +585,7 @@ func TestListGitCredentialRecordsSortsDuplicateDecodedAppIDs(t *testing.T) {
 	kc := newAppsTestKeychain()
 	factory.Keychain = kc
 	now := time.Unix(1780000000, 0)
-	manager := newGitCredentialManager("app_x", kc, nil)
+	manager := gitcred.NewAppManager("app_x", kc, nil)
 	manager.Now = func() time.Time { return now }
 	record := gitcred.CredentialRecord{
 		AppID:      "app_x",
@@ -602,7 +603,7 @@ func TestListGitCredentialRecordsSortsDuplicateDecodedAppIDs(t *testing.T) {
 		t.Fatalf("mkdir duplicate encoded app dir: %v", err)
 	}
 
-	records, err := listGitCredentialRecords(kc, func() time.Time { return now })
+	records, err := gitcred.ListCredentialRecords(kc, func() time.Time { return now })
 	if err != nil {
 		t.Fatalf("listGitCredentialRecords returned error: %v", err)
 	}
@@ -682,7 +683,7 @@ func TestAppsGitCredentialRemoveRequiresAppID(t *testing.T) {
 
 func TestAppsGitCredentialRemoveReturnsStoreError(t *testing.T) {
 	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := Write("app_xxx", gitcred.MetadataFilename, []byte("{bad json")); err != nil {
+	if err := sparkstore.Write("app_xxx", gitcred.MetadataFilename, []byte("{bad json")); err != nil {
 		t.Fatalf("write invalid metadata: %v", err)
 	}
 	err := runAppsShortcut(t, AppsGitCredentialRemove, []string{"+git-credential-remove", "--app-id", "app_xxx", "--as", "user"}, factory, stdout)
@@ -738,7 +739,7 @@ func TestRunGitCredentialHelperActions(t *testing.T) {
 	factory, stdout, _ := newAppsExecuteFactory(t)
 	kc := newAppsTestKeychain()
 	factory.Keychain = kc
-	storage := gitCredentialAppStorage{}
+	storage := sparkstore.AppStorage{}
 	manager := gitcred.NewManager(gitcred.NewAppStore("app_xxx", storage), gitcred.NewSecretStore(kc), nil, testAppsIssuer{next: &gitcred.IssuedCredential{
 		GitHTTPURL: "https://example.com/git/u/app.git",
 		Username:   "x-access-token",
diff --git a/shortcuts/apps/gitcred/app_manager.go b/shortcuts/apps/gitcred/app_manager.go
new file mode 100644
index 0000000000..df53bd4c66
--- /dev/null
+++ b/shortcuts/apps/gitcred/app_manager.go
@@ -0,0 +1,44 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package gitcred
+
+import (
+	"sort"
+	"time"
+
+	"github.com/larksuite/cli/internal/keychain"
+	"github.com/larksuite/cli/internal/sparkstore"
+)
+
+// NewAppManager builds a Git credential manager backed by Spark app storage.
+func NewAppManager(appID string, kc keychain.KeychainAccess, issuer Issuer) *Manager {
+	storage := sparkstore.AppStorage{}
+	return NewManager(NewAppStore(appID, storage), NewSecretStore(kc), GlobalGitConfig{}, issuer)
+}
+
+// ListCredentialRecords returns local Git credential records for all stored apps.
+func ListCredentialRecords(kc keychain.KeychainAccess, now func() time.Time) ([]ListRecord, error) {
+	storage := sparkstore.AppStorage{}
+	appIDs, err := storage.ListAppIDs()
+	if err != nil {
+		return nil, err
+	}
+	records := make([]ListRecord, 0, len(appIDs))
+	for _, appID := range appIDs {
+		manager := NewAppManager(appID, kc, nil)
+		manager.Now = now
+		result, err := manager.List()
+		if err != nil {
+			return nil, err
+		}
+		records = append(records, result.Records...)
+	}
+	sort.Slice(records, func(i, j int) bool {
+		if records[i].AppID == records[j].AppID {
+			return records[i].GitHTTPURL < records[j].GitHTTPURL
+		}
+		return records[i].AppID < records[j].AppID
+	})
+	return records, nil
+}

From 9d8e93c682a839f2dd123288f464dfe35a12d060 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 12:00:36 +0800
Subject: [PATCH 38/50] refactor(core): extract risk constants

---
 internal/cmdutil/risk.go        | 10 +++++-----
 internal/{core => risk}/risk.go |  2 +-
 internal/schema/assembler.go    |  6 +++---
 internal/schema/lint.go         |  6 +++---
 4 files changed, 12 insertions(+), 12 deletions(-)
 rename internal/{core => risk}/risk.go (97%)

diff --git a/internal/cmdutil/risk.go b/internal/cmdutil/risk.go
index 29ce402bb7..731fa30bcf 100644
--- a/internal/cmdutil/risk.go
+++ b/internal/cmdutil/risk.go
@@ -4,19 +4,19 @@
 package cmdutil
 
 import (
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/risk"
 	"github.com/spf13/cobra"
 )
 
 const riskLevelAnnotationKey = "risk_level"
 
-// Risk level constants — aliases of the canonical core.Risk* values, re-exported
+// Risk level constants — aliases of the canonical risk.Risk* values, re-exported
 // here so command code gets the risk vocabulary and the SetRisk/GetRisk helpers
 // from one package. core is the single source of truth.
 const (
-	RiskRead          = core.RiskRead
-	RiskWrite         = core.RiskWrite
-	RiskHighRiskWrite = core.RiskHighRiskWrite
+	RiskRead          = risk.RiskRead
+	RiskWrite         = risk.RiskWrite
+	RiskHighRiskWrite = risk.RiskHighRiskWrite
 )
 
 // SetRisk stores a command's static risk level on cobra annotations so the
diff --git a/internal/core/risk.go b/internal/risk/risk.go
similarity index 97%
rename from internal/core/risk.go
rename to internal/risk/risk.go
index 4c9014010b..9dfa1a86b8 100644
--- a/internal/core/risk.go
+++ b/internal/risk/risk.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package risk
 
 // Risk levels — the three-tier convention used across the CLI. They live here,
 // at the leaf, so the envelope renderer (internal/schema) and the command
diff --git a/internal/schema/assembler.go b/internal/schema/assembler.go
index 6b1c43f0df..42dfa44386 100644
--- a/internal/schema/assembler.go
+++ b/internal/schema/assembler.go
@@ -10,8 +10,8 @@ import (
 
 	"github.com/larksuite/cli/internal/affordance"
 	"github.com/larksuite/cli/internal/apicatalog"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/meta"
+	"github.com/larksuite/cli/internal/risk"
 )
 
 // Convert renders a meta.Field as a JSON-Schema Property. meta owns the value
@@ -145,7 +145,7 @@ func buildInputSchema(m meta.Method) *InputSchema {
 	addInputObject(is, "data", "", m.Data(), false, "--data")
 	addInputObject(is, "file", "Binary file uploads. Each property is a file field with format:binary; CLI maps each to --file <key>=<path>.", m.Files(), false, "--file")
 
-	if m.Risk == core.RiskHighRiskWrite {
+	if m.Risk == risk.RiskHighRiskWrite {
 		falseVal := false
 		is.Properties.Set("yes", Property{
 			Type:        "boolean",
@@ -206,7 +206,7 @@ func buildMeta(m meta.Method) *Meta {
 	if m.Risk != "" {
 		out.Risk = m.Risk
 	} else {
-		out.Risk = core.RiskRead
+		out.Risk = risk.RiskRead
 	}
 	if m.DocURL != "" {
 		out.DocURL = m.DocURL
diff --git a/internal/schema/lint.go b/internal/schema/lint.go
index 7600527c53..da669e39c8 100644
--- a/internal/schema/lint.go
+++ b/internal/schema/lint.go
@@ -7,7 +7,7 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/risk"
 )
 
 var validJSONSchemaTypes = map[string]bool{
@@ -81,7 +81,7 @@ func lintEnvelope(env Envelope) []error {
 	}
 
 	// ---- L3: cross-field self-consistency ----
-	dangerExpected := env.Meta.Risk == core.RiskWrite || env.Meta.Risk == core.RiskHighRiskWrite
+	dangerExpected := env.Meta.Risk == risk.RiskWrite || env.Meta.Risk == risk.RiskHighRiskWrite
 	if env.Meta.Danger != dangerExpected {
 		errs = append(errs, fmt.Errorf("L3: _meta.danger=%v inconsistent with risk=%q", env.Meta.Danger, env.Meta.Risk))
 	}
@@ -92,7 +92,7 @@ func lintEnvelope(env Envelope) []error {
 	if env.InputSchema != nil && env.InputSchema.Properties != nil {
 		_, hasYes = env.InputSchema.Properties.Map["yes"]
 	}
-	wantYes := env.Meta.Risk == core.RiskHighRiskWrite
+	wantYes := env.Meta.Risk == risk.RiskHighRiskWrite
 	if hasYes != wantYes {
 		errs = append(errs, fmt.Errorf("L3: inputSchema `yes` property=%v inconsistent with risk=%q", hasYes, env.Meta.Risk))
 	}

From 3732c6bcceba0f78b1f00aa7e1226b6c729122ef Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 12:10:53 +0800
Subject: [PATCH 39/50] refactor(core): extract brand package

---
 internal/core/types.go => brand/brand.go      | 30 +++----
 .../core/types_test.go => brand/brand_test.go | 30 +++----
 cmd/api/api_paginate_test.go                  |  3 +-
 cmd/api/api_test.go                           | 83 +++++++++---------
 cmd/auth/auth_test.go                         | 23 ++---
 cmd/auth/check_test.go                        |  9 +-
 cmd/auth/login.go                             |  9 +-
 cmd/auth/login_brand_filter_test.go           | 10 +--
 cmd/auth/login_interactive.go                 |  4 +-
 cmd/auth/login_test.go                        | 23 ++---
 cmd/auth/logout_test.go                       | 15 ++--
 cmd/auth/qrcode_test.go                       |  5 +-
 cmd/auth/scopes_test.go                       |  3 +-
 cmd/auth/status_test.go                       |  5 +-
 cmd/build.go                                  |  6 +-
 cmd/config/bind_test.go                       |  7 +-
 cmd/config/binder.go                          |  7 +-
 cmd/config/config.go                          |  6 +-
 cmd/config/config_test.go                     | 19 +++--
 cmd/config/init.go                            |  9 +-
 cmd/config/init_interactive.go                |  7 +-
 cmd/config/init_probe.go                      |  6 +-
 cmd/config/init_probe_test.go                 | 24 +++---
 cmd/config/init_test.go                       | 15 ++--
 cmd/config/risk_control_test.go               |  7 +-
 cmd/config/strict_mode_test.go                |  5 +-
 cmd/doctor/doctor.go                          |  5 +-
 cmd/doctor/doctor_test.go                     | 13 +--
 cmd/event/bus_test.go                         |  3 +-
 cmd/event/console_url.go                      | 11 +--
 cmd/event/console_url_test.go                 |  5 +-
 cmd/event/consume.go                          |  7 +-
 cmd/event/preflight_test.go                   | 15 ++--
 cmd/event/runtime_test.go                     |  3 +-
 cmd/global_flags_test.go                      |  7 +-
 cmd/profile/add.go                            |  3 +-
 cmd/profile/list.go                           | 13 +--
 cmd/profile/profile_test.go                   | 35 ++++----
 cmd/root_integration_test.go                  |  7 +-
 cmd/root_test.go                              |  9 +-
 cmd/schema/schema_test.go                     |  5 +-
 cmd/service/service_paginate_test.go          |  3 +-
 cmd/service/service_test.go                   | 27 +++---
 cmd/startup_brand.go                          |  9 +-
 cmd/startup_brand_test.go                     | 10 +--
 cmd/update/update.go                          |  9 +-
 cmd/update/update_test.go                     | 11 +--
 cmd/whoami/whoami.go                          |  3 +-
 cmd/whoami/whoami_test.go                     | 23 ++---
 extension/credential/types.go                 | 19 ++---
 internal/auth/app_registration.go             | 20 ++---
 internal/auth/app_registration_test.go        | 42 +++++-----
 internal/auth/device_flow.go                  | 14 ++--
 internal/auth/device_flow_test.go             | 10 +--
 internal/auth/revoke.go                       |  4 +-
 internal/auth/revoke_test.go                  | 14 ++--
 internal/auth/uat_client.go                   |  3 +-
 internal/auth/uat_client_options_test.go      |  5 +-
 internal/client/client.go                     |  5 +-
 internal/client/client_test.go                | 13 +--
 internal/client/dostream_test.go              |  3 +-
 internal/cmdutil/factory_default.go           |  3 +-
 internal/cmdutil/factory_default_test.go      |  7 +-
 internal/cmdutil/factory_test.go              |  7 +-
 internal/cmdutil/testing.go                   |  3 +-
 internal/cmdutil/testing_test.go              |  5 +-
 internal/core/brand_parity_test.go            | 84 -------------------
 internal/core/config.go                       |  7 +-
 internal/core/config_strict_mode_test.go      |  6 +-
 internal/core/config_test.go                  | 27 +++---
 internal/credential/credential_provider.go    |  2 +-
 .../credential/credential_provider_test.go    |  9 +-
 internal/credential/integration_test.go       |  5 +-
 internal/credential/tat_fetch.go              |  8 +-
 internal/credential/tat_fetch_test.go         | 30 +++----
 internal/credential/types.go                  |  5 +-
 internal/credential/types_test.go             |  9 +-
 internal/credential/user_info.go              |  6 +-
 internal/errclass/classify.go                 |  8 +-
 internal/identitydiag/diagnostics.go          |  3 +-
 internal/identitydiag/diagnostics_test.go     | 35 ++++----
 internal/output/emitter_legacy_compat_test.go |  3 +-
 .../qualitygate/publiccontent/scan_test.go    |  2 +-
 internal/registry/loader.go                   |  8 +-
 internal/registry/loader_test.go              |  4 +-
 .../registry/registrytest/registrytest.go     |  4 +-
 internal/registry/remote.go                   |  5 +-
 internal/registry/remote_test.go              |  8 +-
 internal/registry/scope_hint.go               |  6 +-
 internal/registry/scope_hint_test.go          | 10 +--
 internal/riskcontrol/transport.go             | 12 +--
 internal/selfupdate/updater.go                |  8 +-
 internal/selfupdate/updater_test.go           |  8 +-
 lint/domaincontract/scan.go                   | 10 +--
 .../application/slash_command_list_test.go    |  3 +-
 shortcuts/apps/apps_create_test.go            |  3 +-
 shortcuts/apps/apps_html_publish_test.go      |  3 +-
 shortcuts/apps/apps_init_test.go              |  3 +-
 shortcuts/apps/apps_meta_test.go              |  3 +-
 shortcuts/apps/apps_openapi_key_list_test.go  |  3 +-
 shortcuts/apps/apps_release_create_test.go    |  3 +-
 shortcuts/apps/apps_release_get_test.go       |  3 +-
 shortcuts/apps/apps_release_list_test.go      |  3 +-
 shortcuts/apps/apps_role_common_test.go       |  3 +-
 shortcuts/apps/git_credential_test.go         |  7 +-
 shortcuts/base/base_execute_test.go           |  3 +-
 shortcuts/base/record_markdown_test.go        |  3 +-
 shortcuts/calendar/calendar_meeting_test.go   |  3 +-
 shortcuts/calendar/calendar_test.go           |  7 +-
 shortcuts/calendar/description_rich_images.go |  6 +-
 .../calendar/description_rich_images_test.go  | 10 +--
 shortcuts/common/call_api_typed_test.go       |  7 +-
 shortcuts/common/drive_media_upload_test.go   |  3 +-
 shortcuts/common/drive_meta_test.go           |  3 +-
 shortcuts/common/mcp_client.go                |  6 +-
 shortcuts/common/permission_grant_test.go     | 21 ++---
 shortcuts/common/resource_url.go              |  6 +-
 shortcuts/common/resource_url_test.go         | 42 +++++-----
 shortcuts/common/runner_botinfo_test.go       |  3 +-
 shortcuts/common/runner_contentsafety_test.go |  3 +-
 shortcuts/common/runner_identity_flag_test.go |  3 +-
 shortcuts/common/runner_jq_test.go            |  5 +-
 .../common/runner_partial_failure_test.go     |  3 +-
 shortcuts/common/testing_test.go              |  3 +-
 shortcuts/contact/contact_search_user.go      | 10 +--
 shortcuts/contact/contact_search_user_test.go | 29 +++----
 shortcuts/doc/doc_media_test.go               |  3 +-
 shortcuts/doc/docs_create_test.go             |  3 +-
 shortcuts/drive/drive_import_test.go          |  9 +-
 shortcuts/drive/drive_io_test.go              | 41 ++++-----
 .../drive/drive_permission_grant_test.go      |  3 +-
 shortcuts/drive/drive_push_test.go            |  3 +-
 shortcuts/drive/drive_sync_test.go            | 65 +++++++-------
 shortcuts/event/processor_test.go             |  3 +-
 shortcuts/event/subscribe.go                  |  4 +-
 shortcuts/event/subscribe_test.go             |  6 +-
 shortcuts/im/convert_lib/content_convert.go   |  8 +-
 .../im/convert_lib/content_media_misc_test.go | 25 +++---
 shortcuts/im/convert_lib/runtime_test.go      |  3 +-
 shortcuts/im/helpers_network_test.go          |  3 +-
 shortcuts/im/im_feed_shortcut_test.go         |  3 +-
 shortcuts/mail/draft/service_test.go          |  3 +-
 shortcuts/mail/large_attachment.go            | 22 ++---
 shortcuts/mail/large_attachment_test.go       | 69 +++++++--------
 shortcuts/mail/mail_shortcut_test.go          |  3 +-
 shortcuts/mail/mail_watch.go                  |  4 +-
 shortcuts/mail/signature_compose_test.go      |  3 +-
 shortcuts/markdown/markdown_test.go           |  5 +-
 shortcuts/minutes/minutes_download_test.go    |  3 +-
 shortcuts/note/note_transcript.go             |  4 +-
 shortcuts/note/note_transcript_test.go        |  5 +-
 shortcuts/okr/okr_batch_create_test.go        |  3 +-
 shortcuts/okr/okr_create_test.go              |  3 +-
 shortcuts/okr/okr_cycle_detail_test.go        |  3 +-
 shortcuts/okr/okr_cycle_list_test.go          |  3 +-
 shortcuts/okr/okr_image_upload_test.go        |  3 +-
 shortcuts/okr/okr_indicator_update_test.go    |  3 +-
 shortcuts/okr/okr_openapi_test.go             |  6 +-
 shortcuts/okr/okr_patch_test.go               |  3 +-
 shortcuts/okr/okr_progress_create.go          |  4 +-
 shortcuts/okr/okr_progress_create_test.go     |  3 +-
 shortcuts/okr/okr_progress_delete_test.go     |  3 +-
 shortcuts/okr/okr_progress_get_test.go        |  3 +-
 shortcuts/okr/okr_progress_list_test.go       |  3 +-
 shortcuts/okr/okr_progress_update_test.go     |  3 +-
 shortcuts/okr/okr_reorder_test.go             |  3 +-
 shortcuts/okr/okr_weight_test.go              |  3 +-
 shortcuts/register.go                         | 14 ++--
 shortcuts/register_brand_guard_test.go        | 11 +--
 .../backward/lark_sheets_sheet_create_test.go |  3 +-
 .../lark_sheets_sheet_write_image_test.go     |  3 +-
 shortcuts/sheets/helpers_test.go              |  3 +-
 .../sheets/sheet_media_parent_type_test.go    |  3 +-
 shortcuts/slides/slides_create_test.go        |  3 +-
 shortcuts/task/task_shortcut_test.go          |  3 +-
 shortcuts/vc/vc_notes_test.go                 |  3 +-
 shortcuts/vc/vc_search_test.go                | 15 ++--
 .../whiteboard/whiteboard_export_test.go      |  3 +-
 .../whiteboard/whiteboard_update_test.go      |  3 +-
 shortcuts/wiki/wiki_helpers.go                |  4 +-
 shortcuts/wiki/wiki_node_create_test.go       |  7 +-
 sidecar/server-demo/allowlist.go              |  3 +-
 sidecar/server-demo/handler.go                |  4 +-
 sidecar/server-demo/handler_test.go           |  6 +-
 sidecar/server-demo/main.go                   |  6 +-
 sidecar/server-multi-tenant-demo/allowlist.go |  3 +-
 .../server-multi-tenant-demo/auth_bridge.go   |  7 +-
 sidecar/server-multi-tenant-demo/handler.go   |  4 +-
 .../server-multi-tenant-demo/handler_test.go  |  6 +-
 sidecar/server-multi-tenant-demo/main.go      |  6 +-
 tests/sidecar_e2e/roundtrip_test.go           |  2 +-
 191 files changed, 926 insertions(+), 885 deletions(-)
 rename internal/core/types.go => brand/brand.go (70%)
 rename internal/core/types_test.go => brand/brand_test.go (79%)
 delete mode 100644 internal/core/brand_parity_test.go

diff --git a/internal/core/types.go b/brand/brand.go
similarity index 70%
rename from internal/core/types.go
rename to brand/brand.go
index c2bc95d7d9..0e230dcdab 100644
--- a/internal/core/types.go
+++ b/brand/brand.go
@@ -1,31 +1,27 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package brand
 
 import "strings"
 
-// LarkBrand represents the Lark platform brand.
+// Brand represents the Lark platform brand.
 // "feishu" targets China-mainland, "lark" targets international.
-// ParseBrand and ResolveEndpoints map unrecognized values to BrandFeishu.
-type LarkBrand string
+// ParseBrand and ResolveEndpoints map unrecognized values to Feishu.
+type Brand string
 
 const (
-	BrandFeishu LarkBrand = "feishu"
-	BrandLark   LarkBrand = "lark"
+	Feishu Brand = "feishu"
+	Lark   Brand = "lark"
 )
 
 // ParseBrand normalizes a brand string (case-insensitive, whitespace-tolerant);
-// anything other than "lark" normalizes to BrandFeishu.
-//
-// extension/credential.ParseBrand applies the same rule to its own Brand type.
-// The two cannot share an implementation: extension is published as a standalone
-// SDK and may not import internal. Adding a brand means changing both.
-func ParseBrand(value string) LarkBrand {
+// anything other than "lark" normalizes to Feishu.
+func ParseBrand(value string) Brand {
 	if strings.ToLower(strings.TrimSpace(value)) == "lark" {
-		return BrandLark
+		return Lark
 	}
-	return BrandFeishu
+	return Feishu
 }
 
 // OAuthTokenV3Path is the unified OAuth 2.0 Token Endpoint path on the accounts
@@ -44,9 +40,9 @@ type Endpoints struct {
 
 // ResolveEndpoints resolves endpoint URLs for the brand, normalizing its
 // input so stored values with unusual casing still resolve correctly.
-func ResolveEndpoints(brand LarkBrand) Endpoints {
+func ResolveEndpoints(brand Brand) Endpoints {
 	switch ParseBrand(string(brand)) {
-	case BrandLark:
+	case Lark:
 		return Endpoints{
 			Open:     "https://open.larksuite.com",
 			Accounts: "https://accounts.larksuite.com",
@@ -64,6 +60,6 @@ func ResolveEndpoints(brand LarkBrand) Endpoints {
 }
 
 // ResolveOpenBaseURL returns the Open API base URL for the given brand.
-func ResolveOpenBaseURL(brand LarkBrand) string {
+func ResolveOpenBaseURL(brand Brand) string {
 	return ResolveEndpoints(brand).Open
 }
diff --git a/internal/core/types_test.go b/brand/brand_test.go
similarity index 79%
rename from internal/core/types_test.go
rename to brand/brand_test.go
index aa196ff8b3..bd43221d7e 100644
--- a/internal/core/types_test.go
+++ b/brand/brand_test.go
@@ -1,12 +1,12 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package brand
 
 import "testing"
 
 func TestResolveEndpoints_Feishu(t *testing.T) {
-	ep := ResolveEndpoints(BrandFeishu)
+	ep := ResolveEndpoints(Feishu)
 	if ep.Open != "https://open.feishu.cn" {
 		t.Errorf("Open = %q, want feishu.cn", ep.Open)
 	}
@@ -22,7 +22,7 @@ func TestResolveEndpoints_Feishu(t *testing.T) {
 }
 
 func TestResolveEndpoints_Lark(t *testing.T) {
-	ep := ResolveEndpoints(BrandLark)
+	ep := ResolveEndpoints(Lark)
 	if ep.Open != "https://open.larksuite.com" {
 		t.Errorf("Open = %q, want larksuite.com", ep.Open)
 	}
@@ -50,10 +50,10 @@ func TestResolveEndpoints_EmptyDefaultsToFeishu(t *testing.T) {
 }
 
 func TestResolveOpenBaseURL(t *testing.T) {
-	if got := ResolveOpenBaseURL(BrandFeishu); got != "https://open.feishu.cn" {
+	if got := ResolveOpenBaseURL(Feishu); got != "https://open.feishu.cn" {
 		t.Errorf("ResolveOpenBaseURL(feishu) = %q", got)
 	}
-	if got := ResolveOpenBaseURL(BrandLark); got != "https://open.larksuite.com" {
+	if got := ResolveOpenBaseURL(Lark); got != "https://open.larksuite.com" {
 		t.Errorf("ResolveOpenBaseURL(lark) = %q", got)
 	}
 }
@@ -61,15 +61,15 @@ func TestResolveOpenBaseURL(t *testing.T) {
 func TestParseBrand(t *testing.T) {
 	cases := []struct {
 		in   string
-		want LarkBrand
+		want Brand
 	}{
-		{"", BrandFeishu},
-		{"feishu", BrandFeishu},
-		{"lark", BrandLark},
-		{"LARK", BrandLark},
-		{" lark ", BrandLark},
-		{"Lark", BrandLark},
-		{"xyz", BrandFeishu},
+		{"", Feishu},
+		{"feishu", Feishu},
+		{"lark", Lark},
+		{"LARK", Lark},
+		{" lark ", Lark},
+		{"Lark", Lark},
+		{"xyz", Feishu},
 	}
 	for _, c := range cases {
 		if got := ParseBrand(c.in); got != c.want {
@@ -83,11 +83,11 @@ func TestParseBrand(t *testing.T) {
 // unusual casing or whitespace still resolve to their intended endpoints.
 func TestResolveEndpoints_NormalizesBrand(t *testing.T) {
 	for _, raw := range []string{"LARK", " lark ", "Lark"} {
-		if got := ResolveEndpoints(LarkBrand(raw)).Open; got != "https://open.larksuite.com" {
+		if got := ResolveEndpoints(Brand(raw)).Open; got != "https://open.larksuite.com" {
 			t.Errorf("ResolveEndpoints(%q).Open = %q, want the lark endpoint", raw, got)
 		}
 	}
-	if got := ResolveEndpoints(LarkBrand("unexpected")).Open; got != "https://open.feishu.cn" {
+	if got := ResolveEndpoints(Brand("unexpected")).Open; got != "https://open.feishu.cn" {
 		t.Errorf("ResolveEndpoints(unexpected).Open = %q, want the feishu default", got)
 	}
 }
diff --git a/cmd/api/api_paginate_test.go b/cmd/api/api_paginate_test.go
index 11e576bfee..8e1113ed45 100644
--- a/cmd/api/api_paginate_test.go
+++ b/cmd/api/api_paginate_test.go
@@ -13,6 +13,7 @@ import (
 	"net/http"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -47,7 +48,7 @@ func newAPIPaginateTestHarness(t *testing.T) (*client.APIClient, *bytes.Buffer,
 	config := &core.CliConfig{
 		AppID:     "test-app",
 		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 	f, out, errOut, reg := cmdutil.TestFactory(t, config)
 	ac, err := f.NewAPIClientWithConfig(config)
diff --git a/cmd/api/api_test.go b/cmd/api/api_test.go
index c269bb9bb4..158cd7e27a 100644
--- a/cmd/api/api_test.go
+++ b/cmd/api/api_test.go
@@ -16,6 +16,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	extcs "github.com/larksuite/cli/extension/contentsafety"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -41,7 +42,7 @@ func newTestRootCmd() *cobra.Command {
 
 func TestApiCmd_FlagParsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *APIOptions
@@ -70,7 +71,7 @@ func TestApiCmd_FlagParsing(t *testing.T) {
 
 func TestApiCmd_DryRun(t *testing.T) {
 	f, stdout, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := newTestApiCmd(f, nil)
@@ -105,7 +106,7 @@ func TestApiCmd_DryRun(t *testing.T) {
 
 func TestApiCmd_DryRunWithJq(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := newTestApiCmd(f, nil)
@@ -123,7 +124,7 @@ func TestApiCmd_DryRunWithJq(t *testing.T) {
 // write into the map ParseJSONMap returns.
 func TestApiCmd_NullParamsWithPageSize(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := newTestApiCmd(f, nil)
@@ -138,7 +139,7 @@ func TestApiCmd_NullParamsWithPageSize(t *testing.T) {
 
 func TestApiCmd_BotMode(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	// Register API endpoint stub
@@ -171,7 +172,7 @@ func TestApiCmd_BotMode(t *testing.T) {
 
 func TestApiCmd_MissingArgs(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := newTestApiCmd(f, nil)
@@ -184,7 +185,7 @@ func TestApiCmd_MissingArgs(t *testing.T) {
 
 func TestApiCmd_EmptyMethodRejected(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := newTestApiCmd(f, nil)
@@ -200,7 +201,7 @@ func TestApiCmd_EmptyMethodRejected(t *testing.T) {
 
 func TestApiCmd_InvalidParamsJSON(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := newTestApiCmd(f, nil)
@@ -213,7 +214,7 @@ func TestApiCmd_InvalidParamsJSON(t *testing.T) {
 
 func TestApiValidArgsFunction(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := newTestApiCmd(f, nil)
@@ -279,7 +280,7 @@ func TestApiValidArgsFunction(t *testing.T) {
 
 func TestNewCmdApi_StrictModeHidesAsFlag(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu, SupportedIdentities: 2,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu, SupportedIdentities: 2,
 	})
 
 	cmd := newTestApiCmd(f, nil)
@@ -297,7 +298,7 @@ func TestNewCmdApi_StrictModeHidesAsFlag(t *testing.T) {
 
 func TestApiCmd_PageLimitDefault(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *APIOptions
@@ -317,7 +318,7 @@ func TestApiCmd_PageLimitDefault(t *testing.T) {
 
 func TestApiCmd_ParamsAndDataBothStdinConflict(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := newTestApiCmd(f, nil)
@@ -333,7 +334,7 @@ func TestApiCmd_ParamsAndDataBothStdinConflict(t *testing.T) {
 
 func TestApiCmd_OutputAndPageAllConflict(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *APIOptions
@@ -356,7 +357,7 @@ func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
 	cmdutil.TestChdir(t, dir)
 
 	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-bin", AppSecret: "test-secret-bin", Brand: core.BrandFeishu,
+		AppID: "test-app-bin", AppSecret: "test-secret-bin", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -406,7 +407,7 @@ func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
 
 func TestApiCmd_PageAll_NonBatchAPI_FallbackToJSON(t *testing.T) {
 	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-pageall1", AppSecret: "test-secret-pageall1", Brand: core.BrandFeishu,
+		AppID: "test-app-pageall1", AppSecret: "test-secret-pageall1", Brand: brand.Feishu,
 	})
 
 	// Register a non-batch API that returns scalar data (no array field)
@@ -450,7 +451,7 @@ func TestApiCmd_PageAll_NonBatchAPI_FallbackToJSON(t *testing.T) {
 
 func TestApiCmd_PageAll_NonBatchAPI_ErrorStillOutputsJSON(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-pageall-err", AppSecret: "test-secret-pageall-err", Brand: core.BrandFeishu,
+		AppID: "test-app-pageall-err", AppSecret: "test-secret-pageall-err", Brand: brand.Feishu,
 	})
 
 	// Non-batch API that returns a business error (code != 0)
@@ -487,7 +488,7 @@ func TestApiCmd_PageAll_NonBatchAPI_ErrorStillOutputsJSON(t *testing.T) {
 
 func TestApiCmd_PageAll_BatchAPI_StreamsItems(t *testing.T) {
 	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-pageall2", AppSecret: "test-secret-pageall2", Brand: core.BrandFeishu,
+		AppID: "test-app-pageall2", AppSecret: "test-secret-pageall2", Brand: brand.Feishu,
 	})
 
 	// Register a batch API that returns an array field
@@ -520,7 +521,7 @@ func TestApiCmd_PageAll_BatchAPI_StreamsItems(t *testing.T) {
 
 func TestApiCmd_PageAll_StreamBusinessErrorDoesNotDumpJSON(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-pageall-stream-err", AppSecret: "test-secret-pageall-stream-err", Brand: core.BrandFeishu,
+		AppID: "test-app-pageall-stream-err", AppSecret: "test-secret-pageall-stream-err", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -562,7 +563,7 @@ func TestApiCmd_PageAll_StreamBusinessErrorDoesNotDumpJSON(t *testing.T) {
 
 func TestApiCmd_PageAll_BatchAPI_DefaultJSONEnvelope(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-pageall-json", AppSecret: "test-secret-pageall-json", Brand: core.BrandFeishu,
+		AppID: "test-app-pageall-json", AppSecret: "test-secret-pageall-json", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -628,7 +629,7 @@ func TestApiCmd_PageAll_DefaultJSONRunsContentSafety(t *testing.T) {
 	t.Cleanup(func() { extcs.Register(nil) })
 
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-pageall-safety", AppSecret: "test-secret-pageall-safety", Brand: core.BrandFeishu,
+		AppID: "test-app-pageall-safety", AppSecret: "test-secret-pageall-safety", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -679,7 +680,7 @@ func TestApiCmd_PageAll_StreamFormatRunsContentSafety(t *testing.T) {
 	t.Cleanup(func() { extcs.Register(nil) })
 
 	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-pageall-stream-safety", AppSecret: "test-secret-pageall-stream-safety", Brand: core.BrandFeishu,
+		AppID: "test-app-pageall-stream-safety", AppSecret: "test-secret-pageall-stream-safety", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -724,7 +725,7 @@ func TestApiCmd_PageAll_StreamFormatBlockSkipsBlockedPage(t *testing.T) {
 	t.Cleanup(func() { extcs.Register(nil) })
 
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-pageall-stream-block", AppSecret: "test-secret-pageall-stream-block", Brand: core.BrandFeishu,
+		AppID: "test-app-pageall-stream-block", AppSecret: "test-secret-pageall-stream-block", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -810,7 +811,7 @@ func TestNormalisePath_StripsQueryAndFragment(t *testing.T) {
 
 func TestApiCmd_JqFlag_Parsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *APIOptions
@@ -830,7 +831,7 @@ func TestApiCmd_JqFlag_Parsing(t *testing.T) {
 
 func TestApiCmd_JqFlag_ShortForm(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *APIOptions
@@ -850,7 +851,7 @@ func TestApiCmd_JqFlag_ShortForm(t *testing.T) {
 
 func TestApiCmd_JqAndOutputConflict(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
@@ -868,7 +869,7 @@ func TestApiCmd_JqAndOutputConflict(t *testing.T) {
 
 func TestApiCmd_JqFilter_AppliesExpression(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-jq", AppSecret: "test-secret-jq", Brand: core.BrandFeishu,
+		AppID: "test-app-jq", AppSecret: "test-secret-jq", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -902,7 +903,7 @@ func TestApiCmd_JqFilter_AppliesExpression(t *testing.T) {
 
 func TestApiCmd_JqAndFormatConflict(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
@@ -920,7 +921,7 @@ func TestApiCmd_JqAndFormatConflict(t *testing.T) {
 
 func TestApiCmd_JqInvalidExpression(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
@@ -938,7 +939,7 @@ func TestApiCmd_JqInvalidExpression(t *testing.T) {
 
 func TestApiCmd_PageAll_WithJq(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-pjq", AppSecret: "test-secret-pjq", Brand: core.BrandFeishu,
+		AppID: "test-app-pjq", AppSecret: "test-secret-pjq", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -969,7 +970,7 @@ func TestApiCmd_PageAll_WithJq(t *testing.T) {
 
 func TestApiCmd_MethodUppercase(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *APIOptions
@@ -989,7 +990,7 @@ func TestApiCmd_MethodUppercase(t *testing.T) {
 
 func TestApiCmd_FileFlagParsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	var gotOpts *APIOptions
 	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
@@ -1008,7 +1009,7 @@ func TestApiCmd_FileFlagParsing(t *testing.T) {
 
 func TestApiCmd_FileAndOutputConflict(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
 		return apiRun(opts)
@@ -1025,7 +1026,7 @@ func TestApiCmd_FileAndOutputConflict(t *testing.T) {
 
 func TestApiCmd_FileWithGET(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
 		return apiRun(opts)
@@ -1042,7 +1043,7 @@ func TestApiCmd_FileWithGET(t *testing.T) {
 
 func TestApiCmd_FileStdinConflictWithData(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
 		return apiRun(opts)
@@ -1065,7 +1066,7 @@ func TestApiCmd_DryRunWithFile(t *testing.T) {
 	}
 
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	cmd := newTestApiCmd(f, nil)
 	cmd.SetArgs([]string{"POST", "/open-apis/im/v1/images", "--file", "image=" + tmpFile, "--data", `{"image_type":"message"}`, "--dry-run", "--as", "bot"})
@@ -1103,7 +1104,7 @@ func TestApiCmd_DryRunWithFile(t *testing.T) {
 // a CLI release.
 func TestApiCmd_PermissionError_DerivesFirstClassFields(t *testing.T) {
 	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "cli_test_perm", AppSecret: "secret", Brand: core.BrandFeishu,
+		AppID: "cli_test_perm", AppSecret: "secret", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -1142,7 +1143,7 @@ func TestApiCmd_PermissionError_DerivesFirstClassFields(t *testing.T) {
 
 func TestApiCmd_JsonFlag_Accepted(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *APIOptions
@@ -1195,7 +1196,7 @@ func parseMultipartFilenames(t *testing.T, stub *httpmock.Stub) (map[string]stri
 
 func TestApiCmd_FileUpload_PreservesFilename(t *testing.T) {
 	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	dir := t.TempDir()
@@ -1224,7 +1225,7 @@ func TestApiCmd_FileUpload_PreservesFilename(t *testing.T) {
 
 func TestApiCmd_FileUpload_FieldPrefixKeepsBasename(t *testing.T) {
 	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	dir := t.TempDir()
@@ -1259,7 +1260,7 @@ func TestApiCmd_FileUpload_FieldPrefixKeepsBasename(t *testing.T) {
 
 func TestApiCmd_FileUpload_WithDataFields(t *testing.T) {
 	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	dir := t.TempDir()
@@ -1292,7 +1293,7 @@ func TestApiCmd_FileUpload_WithDataFields(t *testing.T) {
 
 func TestApiCmd_FileUpload_StdinFallsBackToUnknown(t *testing.T) {
 	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	f.IOStreams.In = bytes.NewReader([]byte("stdin-bytes"))
 
diff --git a/cmd/auth/auth_test.go b/cmd/auth/auth_test.go
index f633a61433..d006727ee9 100644
--- a/cmd/auth/auth_test.go
+++ b/cmd/auth/auth_test.go
@@ -12,6 +12,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -24,7 +25,7 @@ import (
 
 func TestAuthLoginCmd_FlagParsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *LoginOptions
@@ -47,7 +48,7 @@ func TestAuthLoginCmd_FlagParsing(t *testing.T) {
 
 func TestAuthLoginCmd_HelpGuidesNonStreamingAgentsToSplitFlow(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := NewCmdAuthLogin(f, func(opts *LoginOptions) error { return nil })
@@ -73,7 +74,7 @@ func TestAuthLoginCmd_HelpGuidesNonStreamingAgentsToSplitFlow(t *testing.T) {
 
 func TestAuthCheckCmd_FlagParsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *CheckOptions
@@ -93,7 +94,7 @@ func TestAuthCheckCmd_FlagParsing(t *testing.T) {
 
 func TestAuthCheckCmd_AcceptsJSONFlag(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *CheckOptions
@@ -193,7 +194,7 @@ func TestAuthListCmd_AcceptsJSONFlag(t *testing.T) {
 
 func TestAuthStatusCmd_FlagParsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *StatusOptions
@@ -212,7 +213,7 @@ func TestAuthStatusCmd_FlagParsing(t *testing.T) {
 
 func TestAuthStatusCmd_AcceptsJSONFlag(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *StatusOptions
@@ -235,7 +236,7 @@ func TestAuthStatusCmd_AcceptsJSONFlag(t *testing.T) {
 
 func TestAuthStatusCmd_VerifyFlag(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *StatusOptions
@@ -337,7 +338,7 @@ func TestDomainFlagCompletion(t *testing.T) {
 
 func TestAuthScopesCmd_FlagParsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *ScopesOptions
@@ -357,7 +358,7 @@ func TestAuthScopesCmd_FlagParsing(t *testing.T) {
 
 func TestAuthScopesCmd_JSONFlagForcesJSONFormat(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *ScopesOptions
@@ -383,7 +384,7 @@ func TestAuthScopesCmd_JSONFlagForcesJSONFormat(t *testing.T) {
 
 func TestAuthScopesRun_UsesTenantAccessTokenFromCredentialProvider(t *testing.T) {
 	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "", Brand: brand.Feishu,
 	})
 	tokenResolver := &authScopesTokenResolver{}
 	f.Credential = credential.NewCredentialProvider(nil, nil, tokenResolver, nil)
@@ -439,7 +440,7 @@ func TestAuthScopesRun_UsesTenantAccessTokenFromCredentialProvider(t *testing.T)
 // supplied MissingScopes — not a bare error wrapped as InternalError.
 func TestAuthScopesRun_LarkPermissionError_TypedAsPermissionError(t *testing.T) {
 	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	tokenResolver := &authScopesTokenResolver{}
 	f.Credential = credential.NewCredentialProvider(nil, nil, tokenResolver, nil)
diff --git a/cmd/auth/check_test.go b/cmd/auth/check_test.go
index 708e2925a9..046f08841b 100644
--- a/cmd/auth/check_test.go
+++ b/cmd/auth/check_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/larksuite/cli/brand"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -24,7 +25,7 @@ import (
 
 func TestAuthCheckRun_NotLoggedIn_ExitOneWithStdoutOnly(t *testing.T) {
 	f, stdout, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		// UserOpenId left empty: triggers the not_logged_in branch.
 	})
 
@@ -56,7 +57,7 @@ func TestAuthCheckRun_NotLoggedIn_ExitOneWithStdoutOnly(t *testing.T) {
 
 func TestAuthCheckRun_NoStoredToken_ExitOneWithStdoutOnly(t *testing.T) {
 	f, stdout, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		UserOpenId: "ou_user", UserName: "tester",
 	})
 
@@ -95,7 +96,7 @@ func TestAuthCheckRun_ScopedTokenPresent_ExitZero(t *testing.T) {
 	cfg := &core.CliConfig{
 		AppID:      "test-app",
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_user",
 		UserName:   "tester",
 	}
@@ -151,7 +152,7 @@ func TestAuthCheckRun_EmptyScopeIsValidationError(t *testing.T) {
 	// answer — it must surface as a typed ValidationError with the normal
 	// stderr envelope, distinct from the silent ErrBare predicate path.
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	err := authCheckRun(&CheckOptions{Factory: f, Scope: "   "})
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index 3b240b1765..d47aa5be44 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 
 	larkauth "github.com/larksuite/cli/internal/auth"
@@ -72,7 +73,7 @@ to generate QR codes (supports ASCII and PNG formats).`,
 
 	cmd.Flags().StringVar(&opts.Scope, "scope", "", "scopes to request (space- or comma-separated). Combines additively with --domain/--recommend")
 	cmd.Flags().BoolVar(&opts.Recommend, "recommend", false, "request only recommended (auto-approve) scopes")
-	var helpBrand core.LarkBrand
+	var helpBrand brandpkg.Brand
 	if f != nil && f.Config != nil {
 		if cfg, err := f.Config(); err == nil && cfg != nil {
 			helpBrand = cfg.Brand
@@ -512,7 +513,7 @@ func findProfileByName(multi *core.MultiAppConfig, profileName string) *core.App
 // shortcut scopes for the given domain names.
 // Domains with auth_domain children are automatically expanded to include
 // their children's scopes.
-func collectScopesForDomains(domains []string, identity string, brand core.LarkBrand) []string {
+func collectScopesForDomains(domains []string, identity string, brand brandpkg.Brand) []string {
 	scopeSet := make(map[string]bool)
 
 	// 1. API scopes from from_meta projects
@@ -553,7 +554,7 @@ func collectScopesForDomains(domains []string, identity string, brand core.LarkB
 // allKnownDomains returns all valid auth domain names (from_meta projects +
 // shortcut services), excluding domains that have auth_domain set (they are
 // folded into their parent domain).
-func allKnownDomains(brand core.LarkBrand) map[string]bool {
+func allKnownDomains(brand brandpkg.Brand) map[string]bool {
 	domains := make(map[string]bool)
 	for _, p := range registry.ListFromMetaProjects() {
 		if !registry.HasAuthDomain(p) {
@@ -572,7 +573,7 @@ func allKnownDomains(brand core.LarkBrand) map[string]bool {
 }
 
 // sortedKnownDomains returns all valid domain names sorted alphabetically.
-func sortedKnownDomains(brand core.LarkBrand) []string {
+func sortedKnownDomains(brand brandpkg.Brand) []string {
 	m := allKnownDomains(brand)
 	domains := make([]string, 0, len(m))
 	for d := range m {
diff --git a/cmd/auth/login_brand_filter_test.go b/cmd/auth/login_brand_filter_test.go
index b8eae24e53..d1ce334780 100644
--- a/cmd/auth/login_brand_filter_test.go
+++ b/cmd/auth/login_brand_filter_test.go
@@ -6,26 +6,26 @@ package auth
 import (
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/brand"
 )
 
 func TestBrandFilter_AppsExcludedOnLark(t *testing.T) {
-	feishuDomains := allKnownDomains(core.BrandFeishu)
+	feishuDomains := allKnownDomains(brand.Feishu)
 	if !feishuDomains["apps"] {
 		t.Errorf("expected apps domain to be known on Feishu brand")
 	}
 
-	larkDomains := allKnownDomains(core.BrandLark)
+	larkDomains := allKnownDomains(brand.Lark)
 	if larkDomains["apps"] {
 		t.Errorf("expected apps domain to be EXCLUDED on Lark brand")
 	}
 
-	feishuScopes := collectScopesForDomains([]string{"apps"}, "user", core.BrandFeishu)
+	feishuScopes := collectScopesForDomains([]string{"apps"}, "user", brand.Feishu)
 	if len(feishuScopes) == 0 {
 		t.Errorf("expected non-empty scopes for apps on Feishu brand, got %d", len(feishuScopes))
 	}
 
-	larkScopes := collectScopesForDomains([]string{"apps"}, "user", core.BrandLark)
+	larkScopes := collectScopesForDomains([]string{"apps"}, "user", brand.Lark)
 	if len(larkScopes) != 0 {
 		t.Errorf("expected empty scopes for apps on Lark brand, got %d: %v", len(larkScopes), larkScopes)
 	}
diff --git a/cmd/auth/login_interactive.go b/cmd/auth/login_interactive.go
index 70e01065cb..ccf381e681 100644
--- a/cmd/auth/login_interactive.go
+++ b/cmd/auth/login_interactive.go
@@ -10,9 +10,9 @@ import (
 
 	"github.com/charmbracelet/huh"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/registry"
 	"github.com/larksuite/cli/shortcuts"
@@ -102,7 +102,7 @@ func buildDomainMeta(name, lang string) domainMeta {
 }
 
 // runInteractiveLogin shows an interactive TUI form for domain and permission selection.
-func runInteractiveLogin(ios *cmdutil.IOStreams, lang string, msg *loginMsg, brand core.LarkBrand) (*interactiveResult, error) {
+func runInteractiveLogin(ios *cmdutil.IOStreams, lang string, msg *loginMsg, brand brandpkg.Brand) (*interactiveResult, error) {
 	allDomains := getDomainMetadata(lang)
 
 	// Build multi-select options
diff --git a/cmd/auth/login_test.go b/cmd/auth/login_test.go
index f2aa3389a9..5d82a1120a 100644
--- a/cmd/auth/login_test.go
+++ b/cmd/auth/login_test.go
@@ -14,6 +14,7 @@ import (
 	"strings"
 	"testing"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -309,7 +310,7 @@ func TestGetDomainMetadata_HasTitleAndDescription(t *testing.T) {
 
 func TestAuthLoginRun_NonTerminal_NoFlags_RejectsWithHint(t *testing.T) {
 	f, _, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "cli_test", AppSecret: "secret", Brand: core.BrandFeishu,
+		AppID: "cli_test", AppSecret: "secret", Brand: brandpkg.Feishu,
 	})
 	// TestFactory has IsTerminal=false by default
 	opts := &LoginOptions{Factory: f, Ctx: context.Background()}
@@ -614,7 +615,7 @@ func TestAuthLoginRun_MissingRequestedScopeAlignsWithLoginSuccess(t *testing.T)
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
-		Brand:       core.BrandFeishu,
+		Brand:       brandpkg.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -730,7 +731,7 @@ func TestAuthLoginRun_DeviceCodeUsesCachedRequestedScopes(t *testing.T) {
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
-		Brand:       core.BrandFeishu,
+		Brand:       brandpkg.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -847,7 +848,7 @@ func TestAuthLoginRun_DeviceCodeTokenNilCleansScopeCache(t *testing.T) {
 
 	original := pollDeviceToken
 	t.Cleanup(func() { pollDeviceToken = original })
-	pollDeviceToken = func(ctx context.Context, httpClient *http.Client, appId, appSecret string, brand core.LarkBrand, deviceCode string, interval, expiresIn int, errOut io.Writer) *larkauth.DeviceFlowResult {
+	pollDeviceToken = func(ctx context.Context, httpClient *http.Client, appId, appSecret string, brand brandpkg.Brand, deviceCode string, interval, expiresIn int, errOut io.Writer) *larkauth.DeviceFlowResult {
 		return &larkauth.DeviceFlowResult{OK: true, Token: nil}
 	}
 
@@ -855,7 +856,7 @@ func TestAuthLoginRun_DeviceCodeTokenNilCleansScopeCache(t *testing.T) {
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
-		Brand:       core.BrandFeishu,
+		Brand:       brandpkg.Feishu,
 	})
 
 	err := authLoginRun(&LoginOptions{
@@ -886,7 +887,7 @@ func TestAuthLoginRun_JSONAbort_StdoutEventOnly_StderrEmpty(t *testing.T) {
 
 	original := pollDeviceToken
 	t.Cleanup(func() { pollDeviceToken = original })
-	pollDeviceToken = func(ctx context.Context, httpClient *http.Client, appId, appSecret string, brand core.LarkBrand, deviceCode string, interval, expiresIn int, errOut io.Writer) *larkauth.DeviceFlowResult {
+	pollDeviceToken = func(ctx context.Context, httpClient *http.Client, appId, appSecret string, brand brandpkg.Brand, deviceCode string, interval, expiresIn int, errOut io.Writer) *larkauth.DeviceFlowResult {
 		return &larkauth.DeviceFlowResult{OK: false, Message: "user denied"}
 	}
 
@@ -894,7 +895,7 @@ func TestAuthLoginRun_JSONAbort_StdoutEventOnly_StderrEmpty(t *testing.T) {
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
-		Brand:       core.BrandFeishu,
+		Brand:       brandpkg.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -960,7 +961,7 @@ func TestAuthLoginRun_JSONWriteFailure_NoWaitReturnsWriterError(t *testing.T) {
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
-		Brand:       core.BrandFeishu,
+		Brand:       brandpkg.Feishu,
 	})
 	f.IOStreams.Out = failWriter{}
 
@@ -997,7 +998,7 @@ func TestAuthLoginRun_NoWaitJSONHintIncludesRawURLGuidance(t *testing.T) {
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
-		Brand:       core.BrandFeishu,
+		Brand:       brandpkg.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -1071,7 +1072,7 @@ func TestAuthLoginRun_JSONWriteFailure_DeviceAuthorizationReturnsWriterError(t *
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
-		Brand:       core.BrandFeishu,
+		Brand:       brandpkg.Feishu,
 	})
 	f.IOStreams.Out = failWriter{}
 
@@ -1109,7 +1110,7 @@ func TestAuthLoginRun_JSONDeviceAuthorizationAgentHintIncludesRawURLGuidance(t *
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
-		Brand:       core.BrandFeishu,
+		Brand:       brandpkg.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
diff --git a/cmd/auth/logout_test.go b/cmd/auth/logout_test.go
index 613e470548..5a1a3cf008 100644
--- a/cmd/auth/logout_test.go
+++ b/cmd/auth/logout_test.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -24,7 +25,7 @@ func writeLogoutConfig(t *testing.T, users []core.AppUser) {
 			{
 				AppId:     "test-app",
 				AppSecret: core.PlainSecret("test-secret"),
-				Brand:     core.BrandFeishu,
+				Brand:     brand.Feishu,
 				Users:     users,
 			},
 		},
@@ -160,7 +161,7 @@ func TestAuthLogoutRun_RevokesTokenAndClearsLocalState(t *testing.T) {
 				Name:      "default",
 				AppId:     "cli_test",
 				AppSecret: core.PlainSecret("secret"),
-				Brand:     core.BrandFeishu,
+				Brand:     brand.Feishu,
 				Users:     []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
 			},
 		},
@@ -181,7 +182,7 @@ func TestAuthLogoutRun_RevokesTokenAndClearsLocalState(t *testing.T) {
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
-		Brand:       core.BrandFeishu,
+		Brand:       brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -231,7 +232,7 @@ func TestAuthLogoutRun_FallsBackToAccessTokenWhenRefreshTokenMissing(t *testing.
 				Name:      "default",
 				AppId:     "cli_test",
 				AppSecret: core.PlainSecret("secret"),
-				Brand:     core.BrandFeishu,
+				Brand:     brand.Feishu,
 				Users:     []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
 			},
 		},
@@ -251,7 +252,7 @@ func TestAuthLogoutRun_FallsBackToAccessTokenWhenRefreshTokenMissing(t *testing.
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
-		Brand:       core.BrandFeishu,
+		Brand:       brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -301,7 +302,7 @@ func TestAuthLogoutRun_RevokeFailureStillClearsLocalState(t *testing.T) {
 				Name:      "default",
 				AppId:     "cli_test",
 				AppSecret: core.PlainSecret("secret"),
-				Brand:     core.BrandFeishu,
+				Brand:     brand.Feishu,
 				Users:     []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
 			},
 		},
@@ -322,7 +323,7 @@ func TestAuthLogoutRun_RevokeFailureStillClearsLocalState(t *testing.T) {
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
-		Brand:       core.BrandFeishu,
+		Brand:       brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
diff --git a/cmd/auth/qrcode_test.go b/cmd/auth/qrcode_test.go
index a171026c82..b2e1d78c0b 100644
--- a/cmd/auth/qrcode_test.go
+++ b/cmd/auth/qrcode_test.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
@@ -18,7 +19,7 @@ import (
 
 func TestNewCmdAuthQRCode_FlagParsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *QRCodeOptions
@@ -46,7 +47,7 @@ func TestNewCmdAuthQRCode_FlagParsing(t *testing.T) {
 
 func TestNewCmdAuthQRCode_ASCIIFlag(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *QRCodeOptions
diff --git a/cmd/auth/scopes_test.go b/cmd/auth/scopes_test.go
index 9ab748d6ba..2dd81c67e2 100644
--- a/cmd/auth/scopes_test.go
+++ b/cmd/auth/scopes_test.go
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -34,7 +35,7 @@ func scopesTestFactory(t *testing.T) *ScopesOptions {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID:     "test-app",
 		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	})
 	return &ScopesOptions{
 		Factory: f,
diff --git a/cmd/auth/status_test.go b/cmd/auth/status_test.go
index 7bf0608c77..b5d32c8311 100644
--- a/cmd/auth/status_test.go
+++ b/cmd/auth/status_test.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -15,7 +16,7 @@ import (
 
 func TestAuthStatusRun_SplitsBotAndUserIdentity(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu,
 	})
 
 	if err := authStatusRun(&StatusOptions{Factory: f}); err != nil {
@@ -39,7 +40,7 @@ func TestAuthStatusRun_SplitsBotAndUserIdentity(t *testing.T) {
 
 func TestAuthStatusRun_VerifyReportsBotIdentity(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu,
 	})
 	reg.Register(&httpmock.Stub{
 		Method: http.MethodGet,
diff --git a/cmd/build.go b/cmd/build.go
index 55f89304c4..8f32451430 100644
--- a/cmd/build.go
+++ b/cmd/build.go
@@ -8,6 +8,7 @@ import (
 	"io"
 	"io/fs"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/cmd/api"
 	"github.com/larksuite/cli/cmd/auth"
 	"github.com/larksuite/cli/cmd/completion"
@@ -25,7 +26,6 @@ import (
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdpolicy"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/hook"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/registry"
@@ -44,7 +44,7 @@ type buildConfig struct {
 	skipStrictMode bool
 	skipService    bool
 	serviceCatalog *apicatalog.Catalog
-	startupBrand   core.LarkBrand
+	startupBrand   brandpkg.Brand
 }
 
 // WithStartupBrand initializes the API registry with the given brand before
@@ -52,7 +52,7 @@ type buildConfig struct {
 // registry's sync.Once locks onto the Feishu default at first catalog access,
 // long before the lazily-resolved config brand is known — see
 // ResolveStartupBrand for the caller-side resolution.
-func WithStartupBrand(brand core.LarkBrand) BuildOption {
+func WithStartupBrand(brand brandpkg.Brand) BuildOption {
 	return func(c *buildConfig) {
 		c.startupBrand = brand
 	}
diff --git a/cmd/config/bind_test.go b/cmd/config/bind_test.go
index 04ea8442a2..7f0c018039 100644
--- a/cmd/config/bind_test.go
+++ b/cmd/config/bind_test.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -807,7 +808,7 @@ func TestConfigShowRun_WorkspaceField(t *testing.T) {
 		Apps: []core.AppConfig{{
 			AppId:     "cli_local_test",
 			AppSecret: core.PlainSecret("secret"),
-			Brand:     core.BrandFeishu,
+			Brand:     brand.Feishu,
 		}},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -1008,8 +1009,8 @@ func TestConfigBindRun_HermesSuccess(t *testing.T) {
 	if multi.Apps[0].AppId != "cli_hermes_abc" {
 		t.Errorf("appId = %q, want %q", multi.Apps[0].AppId, "cli_hermes_abc")
 	}
-	if multi.Apps[0].Brand != core.BrandLark {
-		t.Errorf("brand = %q, want %q", multi.Apps[0].Brand, core.BrandLark)
+	if multi.Apps[0].Brand != brand.Lark {
+		t.Errorf("brand = %q, want %q", multi.Apps[0].Brand, brand.Lark)
 	}
 }
 
diff --git a/cmd/config/binder.go b/cmd/config/binder.go
index 7bf42e6b31..2cd252ce57 100644
--- a/cmd/config/binder.go
+++ b/cmd/config/binder.go
@@ -9,6 +9,7 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/openclawbind"
@@ -205,7 +206,7 @@ func (b *openclawBinder) Build(appID string) (*core.AppConfig, error) {
 	return &core.AppConfig{
 		AppId:     selected.AppID,
 		AppSecret: stored,
-		Brand:     core.ParseBrand(selected.Brand),
+		Brand:     brand.ParseBrand(selected.Brand),
 	}, nil
 }
 
@@ -261,7 +262,7 @@ func (b *hermesBinder) Build(appID string) (*core.AppConfig, error) {
 	return &core.AppConfig{
 		AppId:     appID,
 		AppSecret: stored,
-		Brand:     core.ParseBrand(b.envMap["FEISHU_DOMAIN"]),
+		Brand:     brand.ParseBrand(b.envMap["FEISHU_DOMAIN"]),
 	}, nil
 }
 
@@ -326,7 +327,7 @@ func (b *larkChannelBinder) Build(appID string) (*core.AppConfig, error) {
 	return &core.AppConfig{
 		AppId:     appID,
 		AppSecret: stored,
-		Brand:     core.ParseBrand(b.cfg.Accounts.App.Tenant),
+		Brand:     brand.ParseBrand(b.cfg.Accounts.App.Tenant),
 	}, nil
 }
 
diff --git a/cmd/config/config.go b/cmd/config/config.go
index ae316af819..9bfd13b696 100644
--- a/cmd/config/config.go
+++ b/cmd/config/config.go
@@ -4,8 +4,8 @@
 package config
 
 import (
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/spf13/cobra"
 )
 
@@ -38,6 +38,6 @@ func NewCmdConfig(f *cmdutil.Factory) *cobra.Command {
 	return cmd
 }
 
-func parseBrand(value string) core.LarkBrand {
-	return core.ParseBrand(value)
+func parseBrand(value string) brand.Brand {
+	return brand.ParseBrand(value)
 }
diff --git a/cmd/config/config_test.go b/cmd/config/config_test.go
index 9f0f3da62c..894e7430fd 100644
--- a/cmd/config/config_test.go
+++ b/cmd/config/config_test.go
@@ -12,6 +12,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -67,7 +68,7 @@ func TestConfigInitCmd_FlagParsing(t *testing.T) {
 
 func TestConfigShowCmd_FlagParsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	var gotOpts *ConfigShowOptions
@@ -114,7 +115,7 @@ func TestConfigShowRun_NoActiveProfileReturnsStructuredError(t *testing.T) {
 			Name:      "default",
 			AppId:     "app-default",
 			AppSecret: core.PlainSecret("secret-default"),
-			Brand:     core.BrandFeishu,
+			Brand:     brand.Feishu,
 		}},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -187,13 +188,13 @@ func TestSaveInitConfig_OmitLangPreservesPrior(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, nil)
 
 	existing := &core.MultiAppConfig{Apps: []core.AppConfig{
-		{AppId: "cli_x", AppSecret: core.PlainSecret("s"), Brand: core.BrandFeishu, Lang: i18n.LangJaJP},
+		{AppId: "cli_x", AppSecret: core.PlainSecret("s"), Brand: brand.Feishu, Lang: i18n.LangJaJP},
 	}}
 	if err := core.SaveMultiAppConfig(existing); err != nil {
 		t.Fatalf("seed config: %v", err)
 	}
 
-	if err := saveInitConfig("", existing, f, "cli_x", core.PlainSecret("s2"), core.BrandFeishu, ""); err != nil {
+	if err := saveInitConfig("", existing, f, "cli_x", core.PlainSecret("s2"), brand.Feishu, ""); err != nil {
 		t.Fatalf("saveInitConfig (no --lang): %v", err)
 	}
 
@@ -324,7 +325,7 @@ func TestConfigRemoveRun_SaveFailurePreservesExistingConfigAndSecrets(t *testing
 			AppSecret: core.SecretInput{
 				Ref: &core.SecretRef{Source: "keychain", ID: "appsecret:app-test"},
 			},
-			Brand: core.BrandFeishu,
+			Brand: brand.Feishu,
 			Users: []core.AppUser{{UserOpenId: "ou_1", UserName: "Tester"}},
 		}},
 	}
@@ -383,12 +384,12 @@ func TestSaveAsProfile_RejectsProfileNameCollisionWithExistingAppID(t *testing.T
 				Name:      "prod",
 				AppId:     "cli_prod",
 				AppSecret: core.PlainSecret("secret"),
-				Brand:     core.BrandFeishu,
+				Brand:     brand.Feishu,
 			},
 		},
 	}
 
-	err := saveAsProfile(existing, keychain.KeychainAccess(&noopConfigKeychain{}), "cli_prod", "app-new", core.PlainSecret("new-secret"), core.BrandLark, "en")
+	err := saveAsProfile(existing, keychain.KeychainAccess(&noopConfigKeychain{}), "cli_prod", "app-new", core.PlainSecret("new-secret"), brand.Lark, "en")
 	if err == nil {
 		t.Fatal("expected conflict error")
 	}
@@ -435,14 +436,14 @@ func TestUpdateExistingProfileWithoutSecret_RejectsAppIDChange(t *testing.T) {
 				Name:      "prod",
 				AppId:     "app-old",
 				AppSecret: core.SecretInput{Ref: &core.SecretRef{Source: "keychain", ID: "appsecret:app-old"}},
-				Brand:     core.BrandFeishu,
+				Brand:     brand.Feishu,
 				Lang:      "zh",
 				Users:     []core.AppUser{{UserOpenId: "ou_1", UserName: "User"}},
 			},
 		},
 	}
 
-	err := updateExistingProfileWithoutSecret(multi, "", "app-new", core.BrandLark, "en")
+	err := updateExistingProfileWithoutSecret(multi, "", "app-new", brand.Lark, "en")
 	if err == nil {
 		t.Fatal("expected error when changing app ID without a new secret")
 	}
diff --git a/cmd/config/init.go b/cmd/config/init.go
index 544c4c60be..5926ba2cb0 100644
--- a/cmd/config/init.go
+++ b/cmd/config/init.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -152,7 +153,7 @@ func cleanupOldConfig(existing *core.MultiAppConfig, f *cmdutil.Factory, skipApp
 }
 
 // saveAsOnlyApp overwrites config.json with a single-app config.
-func saveAsOnlyApp(appId string, secret core.SecretInput, brand core.LarkBrand, lang string) error {
+func saveAsOnlyApp(appId string, secret core.SecretInput, brand brandpkg.Brand, lang string) error {
 	config := &core.MultiAppConfig{
 		Apps: []core.AppConfig{{
 			AppId: appId, AppSecret: secret, Brand: brand, Lang: i18n.Lang(lang), Users: []core.AppUser{},
@@ -164,7 +165,7 @@ func saveAsOnlyApp(appId string, secret core.SecretInput, brand core.LarkBrand,
 // saveInitConfig saves a new/updated app config, respecting --profile mode.
 // With profileName: appends or updates the named profile (preserves other profiles).
 // Without profileName: cleans up old config and saves as the only app.
-func saveInitConfig(profileName string, existing *core.MultiAppConfig, f *cmdutil.Factory, appId string, secret core.SecretInput, brand core.LarkBrand, lang string) error {
+func saveInitConfig(profileName string, existing *core.MultiAppConfig, f *cmdutil.Factory, appId string, secret core.SecretInput, brand brandpkg.Brand, lang string) error {
 	if profileName != "" {
 		return saveAsProfile(existing, f.Keychain, profileName, appId, secret, brand, lang)
 	}
@@ -195,7 +196,7 @@ func wrapSaveConfigError(err error) error {
 // saveAsProfile appends or updates a named profile in the config.
 // If a profile with the same name exists, it updates it; otherwise appends.
 // When updating, cleans up old keychain secrets if AppId changed.
-func saveAsProfile(existing *core.MultiAppConfig, kc keychain.KeychainAccess, profileName, appId string, secret core.SecretInput, brand core.LarkBrand, lang string) error {
+func saveAsProfile(existing *core.MultiAppConfig, kc keychain.KeychainAccess, profileName, appId string, secret core.SecretInput, brand brandpkg.Brand, lang string) error {
 	multi := existing
 	if multi == nil {
 		multi = &core.MultiAppConfig{}
@@ -272,7 +273,7 @@ func wrapUpdateExistingProfileErr(err error) error {
 	return errs.NewInternalError(errs.SubtypeSDKError, "failed to save config: %v", err).WithCause(err)
 }
 
-func updateExistingProfileWithoutSecret(existing *core.MultiAppConfig, profileName, appID string, brand core.LarkBrand, lang string) error {
+func updateExistingProfileWithoutSecret(existing *core.MultiAppConfig, profileName, appID string, brand brandpkg.Brand, lang string) error {
 	if existing == nil {
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "App Secret cannot be empty for new configuration").
 			WithParam("--app-secret")
diff --git a/cmd/config/init_interactive.go b/cmd/config/init_interactive.go
index ecc3ef0201..253fbe8e58 100644
--- a/cmd/config/init_interactive.go
+++ b/cmd/config/init_interactive.go
@@ -10,6 +10,7 @@ import (
 	"net"
 
 	"github.com/charmbracelet/huh"
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/build"
 	qrcode "github.com/skip2/go-qrcode"
 
@@ -24,7 +25,7 @@ import (
 // configInitResult holds the result of the interactive config init flow.
 type configInitResult struct {
 	Mode      string // "create" or "existing"
-	Brand     core.LarkBrand
+	Brand     brand.Brand
 	AppID     string
 	AppSecret string
 }
@@ -150,8 +151,8 @@ func runExistingAppForm(f *cmdutil.Factory, msg *initMsg) (*configInitResult, er
 
 // runCreateAppFlow runs the "create new app" flow via OpenClaw device flow.
 // If brandOverride is non-empty, skip the interactive brand selection.
-func runCreateAppFlow(ctx context.Context, f *cmdutil.Factory, brandOverride core.LarkBrand, msg *initMsg) (*configInitResult, error) {
-	var larkBrand core.LarkBrand
+func runCreateAppFlow(ctx context.Context, f *cmdutil.Factory, brandOverride brand.Brand, msg *initMsg) (*configInitResult, error) {
+	var larkBrand brand.Brand
 	if brandOverride != "" {
 		larkBrand = brandOverride
 	} else {
diff --git a/cmd/config/init_probe.go b/cmd/config/init_probe.go
index b6873ac21a..f86bf8092a 100644
--- a/cmd/config/init_probe.go
+++ b/cmd/config/init_probe.go
@@ -11,10 +11,10 @@ import (
 	"net/http"
 	"time"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 )
 
@@ -47,7 +47,7 @@ const probeTimeout = 3 * time.Second
 //  2. If TAT succeeded, a POST to the probe endpoint is fired. The outcome of
 //     that call (success, server error, timeout, parse failure) is always
 //     ignored — return nil regardless.
-func runProbe(parent context.Context, factory *cmdutil.Factory, appID, appSecret string, brand core.LarkBrand) error {
+func runProbe(parent context.Context, factory *cmdutil.Factory, appID, appSecret string, brand brandpkg.Brand) error {
 	if factory == nil {
 		return nil
 	}
@@ -73,7 +73,7 @@ func runProbe(parent context.Context, factory *cmdutil.Factory, appID, appSecret
 	}
 
 	// TAT succeeded — fire the probe call. Any outcome is ignored.
-	url := core.ResolveEndpoints(brand).Open + "/open-apis/application/v6/larksuite_cli_app/probe"
+	url := brandpkg.ResolveEndpoints(brand).Open + "/open-apis/application/v6/larksuite_cli_app/probe"
 	body := []byte(fmt.Sprintf(`{"from":"lark-cli/%s"}`, build.Version))
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(body))
 	if err != nil {
diff --git a/cmd/config/init_probe_test.go b/cmd/config/init_probe_test.go
index f4156a73b9..99b0db7d88 100644
--- a/cmd/config/init_probe_test.go
+++ b/cmd/config/init_probe_test.go
@@ -13,10 +13,10 @@ import (
 	"testing"
 	"time"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 )
 
 // fakeRT routes requests to per-path handlers and records what it saw.
@@ -132,7 +132,7 @@ func TestRunProbe_TATInvalidClient_ReturnsConfigError(t *testing.T) {
 	}
 	f, errBuf := fakeFactory(t, rt)
 
-	err := runProbe(context.Background(), f, "cli_x", "secret_y", core.BrandFeishu)
+	err := runProbe(context.Background(), f, "cli_x", "secret_y", brand.Feishu)
 
 	if rt.probeCalls != 0 {
 		t.Error("probe endpoint must not be called when TAT fails")
@@ -148,7 +148,7 @@ func TestRunProbe_TATUnauthorizedClient_ReturnsConfigError(t *testing.T) {
 		},
 	}
 	f, errBuf := fakeFactory(t, rt)
-	assertConfigRejection(t, runProbe(context.Background(), f, "cli_x", "secret_y", core.BrandFeishu), errBuf)
+	assertConfigRejection(t, runProbe(context.Background(), f, "cli_x", "secret_y", brand.Feishu), errBuf)
 }
 
 // Any other deterministic client-side OAuth error (e.g. invalid_scope) falls
@@ -161,7 +161,7 @@ func TestRunProbe_TATOtherClientError_Propagates(t *testing.T) {
 		},
 	}
 	f, errBuf := fakeFactory(t, rt)
-	err := runProbe(context.Background(), f, "cli_x", "secret_y", core.BrandFeishu)
+	err := runProbe(context.Background(), f, "cli_x", "secret_y", brand.Feishu)
 	if err == nil || !errs.IsTyped(err) {
 		t.Fatalf("expected a propagated typed error, got %T: %v", err, err)
 	}
@@ -180,7 +180,7 @@ func TestRunProbe_TATHTTPNon200_Silent(t *testing.T) {
 			},
 		}
 		f, errBuf := fakeFactory(t, rt)
-		assertSilent(t, runProbe(context.Background(), f, "cli_x", "secret_y", core.BrandFeishu), errBuf)
+		assertSilent(t, runProbe(context.Background(), f, "cli_x", "secret_y", brand.Feishu), errBuf)
 	}
 }
 
@@ -191,7 +191,7 @@ func TestRunProbe_TATTransportError_Silent(t *testing.T) {
 		},
 	}
 	f, errBuf := fakeFactory(t, rt)
-	assertSilent(t, runProbe(context.Background(), f, "cli_x", "secret_y", core.BrandFeishu), errBuf)
+	assertSilent(t, runProbe(context.Background(), f, "cli_x", "secret_y", brand.Feishu), errBuf)
 }
 
 func TestRunProbe_TATSuccess_ProbeFails_Silent(t *testing.T) {
@@ -201,7 +201,7 @@ func TestRunProbe_TATSuccess_ProbeFails_Silent(t *testing.T) {
 		},
 	}
 	f, errBuf := fakeFactory(t, rt)
-	err := runProbe(context.Background(), f, "cli_x", "secret_y", core.BrandFeishu)
+	err := runProbe(context.Background(), f, "cli_x", "secret_y", brand.Feishu)
 	if rt.probeCalls != 1 {
 		t.Errorf("probe should be called once, got %d", rt.probeCalls)
 	}
@@ -211,7 +211,7 @@ func TestRunProbe_TATSuccess_ProbeFails_Silent(t *testing.T) {
 func TestRunProbe_TATSuccess_ProbeOK_Silent(t *testing.T) {
 	rt := &fakeRT{}
 	f, errBuf := fakeFactory(t, rt)
-	err := runProbe(context.Background(), f, "cli_x", "secret_y", core.BrandFeishu)
+	err := runProbe(context.Background(), f, "cli_x", "secret_y", brand.Feishu)
 	if rt.tatCalls != 1 || rt.probeCalls != 1 {
 		t.Errorf("expected 1/1 calls, got tat=%d probe=%d", rt.tatCalls, rt.probeCalls)
 	}
@@ -221,7 +221,7 @@ func TestRunProbe_TATSuccess_ProbeOK_Silent(t *testing.T) {
 func TestRunProbe_ProbeRequestShape(t *testing.T) {
 	rt := &fakeRT{}
 	f, _ := fakeFactory(t, rt)
-	if err := runProbe(context.Background(), f, "cli_x", "secret_y", core.BrandFeishu); err != nil {
+	if err := runProbe(context.Background(), f, "cli_x", "secret_y", brand.Feishu); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 
@@ -245,7 +245,7 @@ func TestRunProbe_ProbeRequestShape(t *testing.T) {
 func TestRunProbe_LarkBrand_HostRoutedCorrectly(t *testing.T) {
 	rt := &fakeRT{}
 	f, _ := fakeFactory(t, rt)
-	if err := runProbe(context.Background(), f, "cli_x", "secret_y", core.BrandLark); err != nil {
+	if err := runProbe(context.Background(), f, "cli_x", "secret_y", brand.Lark); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if rt.probeReq == nil {
@@ -262,7 +262,7 @@ func TestRunProbe_HTTPClientError_Silent(t *testing.T) {
 	f.HttpClient = func() (*http.Client, error) {
 		return nil, errors.New("client init failed")
 	}
-	assertSilent(t, runProbe(context.Background(), f, "cli_x", "secret_y", core.BrandFeishu), errBuf)
+	assertSilent(t, runProbe(context.Background(), f, "cli_x", "secret_y", brand.Feishu), errBuf)
 }
 
 func TestRunProbe_TimeoutHonored(t *testing.T) {
@@ -275,7 +275,7 @@ func TestRunProbe_TimeoutHonored(t *testing.T) {
 	f, errBuf := fakeFactory(t, rt)
 
 	start := time.Now()
-	err := runProbe(context.Background(), f, "cli_x", "secret_y", core.BrandFeishu)
+	err := runProbe(context.Background(), f, "cli_x", "secret_y", brand.Feishu)
 	elapsed := time.Since(start)
 
 	if elapsed > 4*time.Second {
diff --git a/cmd/config/init_test.go b/cmd/config/init_test.go
index 7347b8b528..1f42553ba6 100644
--- a/cmd/config/init_test.go
+++ b/cmd/config/init_test.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
@@ -19,7 +20,7 @@ import (
 // not for missing user input.
 
 func TestUpdateExistingProfileWithoutSecret_NilConfig_EmitsValidationError(t *testing.T) {
-	err := updateExistingProfileWithoutSecret(nil, "", "cli_test", core.BrandFeishu, "en")
+	err := updateExistingProfileWithoutSecret(nil, "", "cli_test", brand.Feishu, "en")
 	assertValidationParam(t, err, "--app-secret")
 }
 
@@ -29,10 +30,10 @@ func TestUpdateExistingProfileWithoutSecret_UnknownProfile_EmitsValidationError(
 			Name:      "default",
 			AppId:     "app-default",
 			AppSecret: core.PlainSecret("secret-default"),
-			Brand:     core.BrandFeishu,
+			Brand:     brand.Feishu,
 		}},
 	}
-	err := updateExistingProfileWithoutSecret(existing, "missing-profile", "cli_test", core.BrandFeishu, "en")
+	err := updateExistingProfileWithoutSecret(existing, "missing-profile", "cli_test", brand.Feishu, "en")
 	assertValidationParam(t, err, "--app-secret")
 }
 
@@ -43,10 +44,10 @@ func TestUpdateExistingProfileWithoutSecret_NoCurrentApp_EmitsValidationError(t
 			Name:      "default",
 			AppId:     "app-default",
 			AppSecret: core.PlainSecret("secret-default"),
-			Brand:     core.BrandFeishu,
+			Brand:     brand.Feishu,
 		}},
 	}
-	err := updateExistingProfileWithoutSecret(existing, "", "cli_test", core.BrandFeishu, "en")
+	err := updateExistingProfileWithoutSecret(existing, "", "cli_test", brand.Feishu, "en")
 	assertValidationParam(t, err, "--app-secret")
 }
 
@@ -56,10 +57,10 @@ func TestUpdateExistingProfileWithoutSecret_AppIdMismatch_EmitsValidationError(t
 			Name:      "default",
 			AppId:     "app-default",
 			AppSecret: core.PlainSecret("secret-default"),
-			Brand:     core.BrandFeishu,
+			Brand:     brand.Feishu,
 		}},
 	}
-	err := updateExistingProfileWithoutSecret(existing, "", "cli_different", core.BrandFeishu, "en")
+	err := updateExistingProfileWithoutSecret(existing, "", "cli_different", brand.Feishu, "en")
 	assertValidationParam(t, err, "--app-secret")
 }
 
diff --git a/cmd/config/risk_control_test.go b/cmd/config/risk_control_test.go
index 7b29f830fa..be19ffa752 100644
--- a/cmd/config/risk_control_test.go
+++ b/cmd/config/risk_control_test.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -16,7 +17,7 @@ import (
 func TestRiskControlWorkspacePolicy(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
+		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: brand.Feishu,
 	}}}
 	if err := core.SaveMultiAppConfig(config); err != nil {
 		t.Fatal(err)
@@ -87,7 +88,7 @@ func TestRiskControlWorkspacePolicy(t *testing.T) {
 func TestRiskControlWorkspacePolicyRejectsInvalidValue(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
+		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: brand.Feishu,
 	}}}); err != nil {
 		t.Fatal(err)
 	}
@@ -108,7 +109,7 @@ func TestRiskControlWorkspacePolicyRejectsInvalidValue(t *testing.T) {
 func TestRiskControlWorkspacePolicyAllowedWithExternalCredentials(t *testing.T) {
 	f := newConfigFactoryWithExternalProvider(t)
 	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
+		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: brand.Feishu,
 	}}}
 	if err := core.SaveMultiAppConfig(config); err != nil {
 		t.Fatal(err)
diff --git a/cmd/config/strict_mode_test.go b/cmd/config/strict_mode_test.go
index 7b930415ed..5466d09237 100644
--- a/cmd/config/strict_mode_test.go
+++ b/cmd/config/strict_mode_test.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 )
@@ -19,7 +20,7 @@ func setupStrictModeTestConfig(t *testing.T) {
 		Apps: []core.AppConfig{{
 			AppId:     "test-app",
 			AppSecret: core.PlainSecret("secret"),
-			Brand:     core.BrandFeishu,
+			Brand:     brand.Feishu,
 		}},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -111,7 +112,7 @@ func TestStrictMode_SetGlobal_DoesNotRequireActiveProfile(t *testing.T) {
 			Name:      "default",
 			AppId:     "test-app",
 			AppSecret: core.PlainSecret("secret"),
-			Brand:     core.BrandFeishu,
+			Brand:     brand.Feishu,
 		}},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
diff --git a/cmd/doctor/doctor.go b/cmd/doctor/doctor.go
index bef93d03a8..7017fe9f24 100644
--- a/cmd/doctor/doctor.go
+++ b/cmd/doctor/doctor.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -118,7 +119,7 @@ func doctorRun(opts *DoctorOptions) error {
 	}
 	checks = append(checks, pass("app_resolved", fmt.Sprintf("app: %s (%s)", cfg.AppID, cfg.Brand)))
 
-	ep := core.ResolveEndpoints(cfg.Brand)
+	ep := brand.ResolveEndpoints(cfg.Brand)
 
 	// ── 3. Identity readiness ──
 	diagnostics := identitydiag.Diagnose(opts.Ctx, f, cfg, !opts.Offline)
@@ -149,7 +150,7 @@ func identityCheck(name string, id identitydiag.Identity) checkResult {
 }
 
 // networkChecks probes Open API and MCP endpoints concurrently.
-func networkChecks(ctx context.Context, opts *DoctorOptions, ep core.Endpoints) []checkResult {
+func networkChecks(ctx context.Context, opts *DoctorOptions, ep brand.Endpoints) []checkResult {
 	if opts.Offline {
 		return []checkResult{
 			skip("endpoint_open", "skipped (--offline)"),
diff --git a/cmd/doctor/doctor_test.go b/cmd/doctor/doctor_test.go
index 76cfbd77e4..35e1700160 100644
--- a/cmd/doctor/doctor_test.go
+++ b/cmd/doctor/doctor_test.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -21,7 +22,7 @@ import (
 
 func TestNewCmdDoctor_FlagParsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := NewCmdDoctor(f)
@@ -88,7 +89,7 @@ func TestFinishDoctor(t *testing.T) {
 }
 
 func TestNetworkChecks_Offline(t *testing.T) {
-	ep := core.Endpoints{Open: "https://open.feishu.cn", MCP: "https://mcp.feishu.cn"}
+	ep := brand.Endpoints{Open: "https://open.feishu.cn", MCP: "https://mcp.feishu.cn"}
 	opts := &DoctorOptions{Ctx: context.Background(), Offline: true}
 	checks := networkChecks(opts.Ctx, opts, ep)
 	if len(checks) != 2 {
@@ -110,7 +111,7 @@ func TestDoctorRun_SplitsBotAndMissingUserIdentity(t *testing.T) {
 				Name:      "default",
 				AppId:     "test-app",
 				AppSecret: core.PlainSecret("secret"),
-				Brand:     core.BrandFeishu,
+				Brand:     brand.Feishu,
 			},
 		},
 	}); err != nil {
@@ -118,7 +119,7 @@ func TestDoctorRun_SplitsBotAndMissingUserIdentity(t *testing.T) {
 	}
 
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu,
 	})
 	err := doctorRun(&DoctorOptions{
 		Factory: f,
@@ -182,14 +183,14 @@ func TestDoctor_ExternalProvider_IdentityReadyHintNotBlockedCommand(t *testing.T
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{
 		CurrentApp: "default",
-		Apps:       []core.AppConfig{{Name: "default", AppId: "cli_x", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu}},
+		Apps:       []core.AppConfig{{Name: "default", AppId: "cli_x", AppSecret: core.PlainSecret("secret"), Brand: brand.Feishu}},
 	}); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
 	// Provider serves neither identity: bot unsupported, user supported but not
 	// signed in → both unavailable → identity_ready fails.
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: core.BrandFeishu, SupportedIdentities: uint8(extcred.SupportsUser)}
+	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsUser)}
 	cred := credential.NewCredentialProvider(
 		[]extcred.Provider{&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}}},
 		nil, nil,
diff --git a/cmd/event/bus_test.go b/cmd/event/bus_test.go
index b974cb38a1..804887cdb9 100644
--- a/cmd/event/bus_test.go
+++ b/cmd/event/bus_test.go
@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -25,7 +26,7 @@ func TestBusCommandLoggerSetupFailureIsTypedFileIO(t *testing.T) {
 	}
 
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "cli_bus_test", AppSecret: "secret", Brand: core.BrandFeishu,
+		AppID: "cli_bus_test", AppSecret: "secret", Brand: brand.Feishu,
 	})
 	cmd := NewCmdBus(f)
 	cmd.SetArgs([]string{})
diff --git a/cmd/event/console_url.go b/cmd/event/console_url.go
index efe95597c7..1fbf0ba577 100644
--- a/cmd/event/console_url.go
+++ b/cmd/event/console_url.go
@@ -10,6 +10,7 @@ import (
 	"encoding/json"
 	"fmt"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/core"
 	eventlib "github.com/larksuite/cli/internal/event"
 )
@@ -67,23 +68,23 @@ func encodeAddons(a ManifestAddons) (string, error) {
 }
 
 // consoleAddonsURL builds the scan-to-enable deep link carrying incremental scopes/events/callbacks.
-func consoleAddonsURL(brand core.LarkBrand, appID string, a ManifestAddons) (string, error) {
+func consoleAddonsURL(brand brandpkg.Brand, appID string, a ManifestAddons) (string, error) {
 	encoded, err := encodeAddons(a)
 	if err != nil {
 		return "", err
 	}
-	host := core.ResolveEndpoints(brand).Open
+	host := brandpkg.ResolveEndpoints(brand).Open
 	return fmt.Sprintf("%s%s?%s=%s&addons=%s", host, addonsLandingPath, addonsClientIDParam, appID, encoded), nil
 }
 
 // consoleLandingURL is the bare landing page (no addons) — fallback when encoding fails.
-func consoleLandingURL(brand core.LarkBrand, appID string) string {
-	host := core.ResolveEndpoints(brand).Open
+func consoleLandingURL(brand brandpkg.Brand, appID string) string {
+	host := brandpkg.ResolveEndpoints(brand).Open
 	return fmt.Sprintf("%s%s?%s=%s", host, addonsLandingPath, addonsClientIDParam, appID)
 }
 
 // addonsHintURL returns the scan URL, degrading to the bare landing page on encode error.
-func addonsHintURL(brand core.LarkBrand, appID string, a ManifestAddons) string {
+func addonsHintURL(brand brandpkg.Brand, appID string, a ManifestAddons) string {
 	url, err := consoleAddonsURL(brand, appID, a)
 	if err != nil {
 		return consoleLandingURL(brand, appID)
diff --git a/cmd/event/console_url_test.go b/cmd/event/console_url_test.go
index a9f3ce1eec..ea8fbca0af 100644
--- a/cmd/event/console_url_test.go
+++ b/cmd/event/console_url_test.go
@@ -12,6 +12,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/core"
 	eventlib "github.com/larksuite/cli/internal/event"
 )
@@ -55,11 +56,11 @@ func TestEncodeAddons_RoundTrip(t *testing.T) {
 }
 
 func TestConsoleAddonsURL_FormatAndBrandHost(t *testing.T) {
-	url, err := consoleAddonsURL(core.BrandFeishu, "cli_x", ManifestAddons{Callbacks: &AddonsCallbacks{Items: []string{"card.action.trigger"}}})
+	url, err := consoleAddonsURL(brand.Feishu, "cli_x", ManifestAddons{Callbacks: &AddonsCallbacks{Items: []string{"card.action.trigger"}}})
 	if err != nil {
 		t.Fatalf("url: %v", err)
 	}
-	host := core.ResolveEndpoints(core.BrandFeishu).Open
+	host := brand.ResolveEndpoints(brand.Feishu).Open
 	prefix := host + "/page/launcher?clientID=cli_x&addons="
 	if !strings.HasPrefix(url, prefix) {
 		t.Errorf("url = %q, want prefix %q", url, prefix)
diff --git a/cmd/event/consume.go b/cmd/event/consume.go
index 21ded3f9cd..b677a5d69d 100644
--- a/cmd/event/consume.go
+++ b/cmd/event/consume.go
@@ -16,6 +16,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/appmeta"
 	"github.com/larksuite/cli/internal/auth"
@@ -118,7 +119,7 @@ func runConsume(cmd *cobra.Command, f *cmdutil.Factory, eventKey string, o consu
 		outputDir = safePath
 	}
 
-	domain := core.ResolveEndpoints(cfg.Brand).Open
+	domain := brandpkg.ResolveEndpoints(cfg.Brand).Open
 
 	// Surface auth errors before forking the bus daemon.
 	if _, err := resolveTenantToken(cmd.Context(), f, cfg.AppID); err != nil {
@@ -238,7 +239,7 @@ func resolveIdentity(cmd *cobra.Command, f *cmdutil.Factory, keyDef *eventlib.Ke
 type preflightCtx struct {
 	factory  *cmdutil.Factory
 	appID    string
-	brand    core.LarkBrand
+	brand    brandpkg.Brand
 	eventKey string
 	identity core.Identity
 	keyDef   *eventlib.KeyDefinition
@@ -291,7 +292,7 @@ func preflightScopes(ctx context.Context, pf *preflightCtx) error {
 // the tenant token carries them. User: the scan link only updates the app
 // manifest — the user's own token still lacks the scopes until it is
 // re-authorized — so direct the user to re-login instead.
-func scopeRemediationHint(brand core.LarkBrand, appID string, identity core.Identity, missing []string) string {
+func scopeRemediationHint(brand brandpkg.Brand, appID string, identity core.Identity, missing []string) string {
 	if identity.IsBot() {
 		return fmt.Sprintf("grant these scopes by scanning: %s",
 			addonsHintURL(brand, appID, missingScopeAddons(identity, missing)))
diff --git a/cmd/event/preflight_test.go b/cmd/event/preflight_test.go
index bbe3a2fdcf..5830b215aa 100644
--- a/cmd/event/preflight_test.go
+++ b/cmd/event/preflight_test.go
@@ -8,13 +8,14 @@ import (
 	"strings"
 	"testing"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/appmeta"
 	"github.com/larksuite/cli/internal/core"
 	eventlib "github.com/larksuite/cli/internal/event"
 )
 
-func newPreflightCtx(appID string, brand core.LarkBrand, identity core.Identity, keyDef *eventlib.KeyDefinition, appVer *appmeta.AppVersion) *preflightCtx {
+func newPreflightCtx(appID string, brand brandpkg.Brand, identity core.Identity, keyDef *eventlib.KeyDefinition, appVer *appmeta.AppVersion) *preflightCtx {
 	key := ""
 	if keyDef != nil {
 		key = keyDef.Key
@@ -177,7 +178,7 @@ func TestPreflightScopes_NoRequiredScopes_SkipsCheck(t *testing.T) {
 func TestPreflightEventTypes_CallbackMissing(t *testing.T) {
 	pf := &preflightCtx{
 		appID:               "cli_x",
-		brand:               core.BrandFeishu,
+		brand:               brandpkg.Feishu,
 		eventKey:            "test.cb",
 		identity:            core.AsBot,
 		subscribedCallbacks: []string{"profile.view.get"},
@@ -206,7 +207,7 @@ func TestPreflightEventTypes_CallbackMissing(t *testing.T) {
 func TestPreflightEventTypes_CallbackSkippedWhenNil(t *testing.T) {
 	pf := &preflightCtx{
 		appID:               "cli_x",
-		brand:               core.BrandFeishu,
+		brand:               brandpkg.Feishu,
 		eventKey:            "test.cb",
 		identity:            core.AsBot,
 		subscribedCallbacks: nil, // fetch 失败/拿不到 -> 弱依赖跳过
@@ -227,7 +228,7 @@ func TestPreflightEventTypes_CallbackEmptyReportsMissing(t *testing.T) {
 	// not skipped as a weak dependency.
 	pf := &preflightCtx{
 		appID:               "cli_x",
-		brand:               core.BrandFeishu,
+		brand:               brandpkg.Feishu,
 		eventKey:            "test.cb",
 		identity:            core.AsBot,
 		subscribedCallbacks: []string{}, // fetched, none subscribed
@@ -249,7 +250,7 @@ func TestPreflightEventTypes_CallbackEmptyReportsMissing(t *testing.T) {
 func TestPreflightEventTypes_CallbackAllSubscribed_Passes(t *testing.T) {
 	pf := &preflightCtx{
 		appID:               "cli_x",
-		brand:               core.BrandFeishu,
+		brand:               brandpkg.Feishu,
 		eventKey:            "test.cb",
 		identity:            core.AsBot,
 		subscribedCallbacks: []string{"card.action.trigger", "profile.view.get"},
@@ -266,12 +267,12 @@ func TestPreflightEventTypes_CallbackAllSubscribed_Passes(t *testing.T) {
 
 func TestScopeRemediationHint_ByIdentity(t *testing.T) {
 	// bot: scan-to-enable link (adds scopes to app manifest)
-	bot := scopeRemediationHint(core.BrandFeishu, "cli_x", core.AsBot, []string{"im:message"})
+	bot := scopeRemediationHint(brandpkg.Feishu, "cli_x", core.AsBot, []string{"im:message"})
 	if !strings.Contains(bot, "/page/launcher?clientID=cli_x&addons=") {
 		t.Errorf("bot hint should give the scan link, got: %s", bot)
 	}
 	// user: re-login (scan link cannot grant scopes to the user's own token)
-	user := scopeRemediationHint(core.BrandFeishu, "cli_x", core.AsUser, []string{"im:message"})
+	user := scopeRemediationHint(brandpkg.Feishu, "cli_x", core.AsUser, []string{"im:message"})
 	if !strings.Contains(user, "auth login --scope") {
 		t.Errorf("user hint should direct to auth login, got: %s", user)
 	}
diff --git a/cmd/event/runtime_test.go b/cmd/event/runtime_test.go
index 67f2bea1c2..efae1d6f9a 100644
--- a/cmd/event/runtime_test.go
+++ b/cmd/event/runtime_test.go
@@ -14,6 +14,7 @@ import (
 	lark "github.com/larksuite/oapi-sdk-go/v3"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/core"
@@ -45,7 +46,7 @@ func newTestConsumeRuntime(rt http.RoundTripper) *consumeRuntime {
 			SDK:        sdk,
 			ErrOut:     io.Discard,
 			Credential: credential.NewCredentialProvider(nil, nil, &staticTokenResolver{}, nil),
-			Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu},
+			Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 		},
 		accessIdentity: core.AsBot,
 	}
diff --git a/cmd/global_flags_test.go b/cmd/global_flags_test.go
index 67ee198394..af0a357857 100644
--- a/cmd/global_flags_test.go
+++ b/cmd/global_flags_test.go
@@ -8,6 +8,7 @@ import (
 	"os"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/spf13/pflag"
@@ -59,7 +60,7 @@ func TestIsSingleAppMode_NoConfig(t *testing.T) {
 func TestIsSingleAppMode_SingleApp(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	saveAppsForTest(t, []core.AppConfig{
-		{Name: "default", AppId: "cli_a", AppSecret: core.PlainSecret("x"), Brand: core.BrandFeishu},
+		{Name: "default", AppId: "cli_a", AppSecret: core.PlainSecret("x"), Brand: brand.Feishu},
 	})
 	if !isSingleAppMode() {
 		t.Fatal("isSingleAppMode() = false, want true for single-app config")
@@ -69,8 +70,8 @@ func TestIsSingleAppMode_SingleApp(t *testing.T) {
 func TestIsSingleAppMode_MultiApp(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	saveAppsForTest(t, []core.AppConfig{
-		{Name: "a", AppId: "cli_a", AppSecret: core.PlainSecret("x"), Brand: core.BrandFeishu},
-		{Name: "b", AppId: "cli_b", AppSecret: core.PlainSecret("y"), Brand: core.BrandFeishu},
+		{Name: "a", AppId: "cli_a", AppSecret: core.PlainSecret("x"), Brand: brand.Feishu},
+		{Name: "b", AppId: "cli_b", AppSecret: core.PlainSecret("y"), Brand: brand.Feishu},
 	})
 	if isSingleAppMode() {
 		t.Fatal("isSingleAppMode() = true, want false for multi-app config")
diff --git a/cmd/profile/add.go b/cmd/profile/add.go
index d384c5ba1f..3723b83366 100644
--- a/cmd/profile/add.go
+++ b/cmd/profile/add.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -120,7 +121,7 @@ func profileAddRun(f *cmdutil.Factory, name, appID string, appSecretStdin bool,
 		return errs.NewInternalError(errs.SubtypeStorage, "%v", err).WithCause(err)
 	}
 
-	parsedBrand := core.ParseBrand(brand)
+	parsedBrand := brandpkg.ParseBrand(brand)
 
 	// Capture current profile before appending (avoid setting PreviousApp to self)
 	var previousName string
diff --git a/cmd/profile/list.go b/cmd/profile/list.go
index 5b0234c2c9..1a44625ad9 100644
--- a/cmd/profile/list.go
+++ b/cmd/profile/list.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -18,12 +19,12 @@ import (
 
 // profileListItem is the JSON output for a single profile entry.
 type profileListItem struct {
-	Name        string         `json:"name"`
-	AppID       string         `json:"appId"`
-	Brand       core.LarkBrand `json:"brand"`
-	Active      bool           `json:"active"`
-	User        string         `json:"user,omitempty"`
-	TokenStatus string         `json:"tokenStatus,omitempty"`
+	Name        string      `json:"name"`
+	AppID       string      `json:"appId"`
+	Brand       brand.Brand `json:"brand"`
+	Active      bool        `json:"active"`
+	User        string      `json:"user,omitempty"`
+	TokenStatus string      `json:"tokenStatus,omitempty"`
 }
 
 // NewCmdProfileList creates the profile list subcommand.
diff --git a/cmd/profile/profile_test.go b/cmd/profile/profile_test.go
index 472a803bf6..5c8ffd39d6 100644
--- a/cmd/profile/profile_test.go
+++ b/cmd/profile/profile_test.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -118,7 +119,7 @@ func TestProfileAddRun_UseAfterUpdatesCurrentAndPrevious(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		CurrentApp: "default",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: core.BrandFeishu},
+			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -153,8 +154,8 @@ func TestProfileRemoveRun_RemovesCurrentProfileAndSwitchesToFirstRemaining(t *te
 		CurrentApp:  "target",
 		PreviousApp: "default",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: core.BrandFeishu},
-			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: core.BrandLark},
+			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
+			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -190,7 +191,7 @@ func TestProfileRenameRun_UpdatesCurrentAndPreviousReferences(t *testing.T) {
 			Name:      "old",
 			AppId:     "app-old",
 			AppSecret: core.PlainSecret("secret-old"),
-			Brand:     core.BrandFeishu,
+			Brand:     brand.Feishu,
 		}},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -226,7 +227,7 @@ func TestProfileRenameRun_AllowsRenameToOwnAppID(t *testing.T) {
 			Name:      "old",
 			AppId:     "app-old",
 			AppSecret: core.PlainSecret("secret-old"),
-			Brand:     core.BrandFeishu,
+			Brand:     brand.Feishu,
 		}},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -259,8 +260,8 @@ func TestProfileUseRun_ToggleBackUsesPreviousProfile(t *testing.T) {
 		CurrentApp:  "default",
 		PreviousApp: "target",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: core.BrandFeishu},
-			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: core.BrandLark},
+			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
+			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -289,8 +290,8 @@ func TestProfileListRun_OutputsProfiles(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		CurrentApp: "default",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: core.BrandFeishu},
-			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: core.BrandLark},
+			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
+			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -342,8 +343,8 @@ func TestProfileRemoveRun_SaveFailureReturnsStructuredError(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		CurrentApp: "target",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: core.BrandFeishu},
-			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: core.BrandLark},
+			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
+			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -370,7 +371,7 @@ func TestProfileRenameRun_SaveFailureReturnsStructuredError(t *testing.T) {
 			Name:      "old",
 			AppId:     "app-old",
 			AppSecret: core.PlainSecret("secret-old"),
-			Brand:     core.BrandFeishu,
+			Brand:     brand.Feishu,
 		}},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -394,8 +395,8 @@ func TestProfileUseRun_SaveFailureReturnsStructuredError(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		CurrentApp: "default",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: core.BrandFeishu},
-			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: core.BrandLark},
+			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
+			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -464,8 +465,8 @@ func saveTwoProfiles(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		CurrentApp: "default",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: core.BrandFeishu},
-			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: core.BrandLark},
+			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
+			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -612,7 +613,7 @@ func TestProfileRemoveRun_ValidationErrors(t *testing.T) {
 		multi := &core.MultiAppConfig{
 			CurrentApp: "solo",
 			Apps: []core.AppConfig{
-				{Name: "solo", AppId: "app-solo", AppSecret: core.PlainSecret("secret-solo"), Brand: core.BrandFeishu},
+				{Name: "solo", AppId: "app-solo", AppSecret: core.PlainSecret("secret-solo"), Brand: brand.Feishu},
 			},
 		}
 		if err := core.SaveMultiAppConfig(multi); err != nil {
diff --git a/cmd/root_integration_test.go b/cmd/root_integration_test.go
index 096eac9a10..d1bac0913b 100644
--- a/cmd/root_integration_test.go
+++ b/cmd/root_integration_test.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/cmd/api"
 	"github.com/larksuite/cli/cmd/auth"
 	"github.com/larksuite/cli/cmd/service"
@@ -174,13 +175,13 @@ func newStrictModeDefaultFactory(t *testing.T, profile string, mode core.StrictM
 				Name:      "default",
 				AppId:     "app-default",
 				AppSecret: core.PlainSecret("secret-default"),
-				Brand:     core.BrandFeishu,
+				Brand:     brand.Feishu,
 			},
 			{
 				Name:       "target",
 				AppId:      "app-target",
 				AppSecret:  core.PlainSecret("secret-target"),
-				Brand:      core.BrandFeishu,
+				Brand:      brand.Feishu,
 				StrictMode: &targetMode,
 			},
 		},
@@ -429,7 +430,7 @@ func TestIntegration_StrictModeBot_ProfileOverride_APIExplicitUserReturnsEnvelop
 
 func TestIntegration_Shortcut_BusinessError_OutputsEnvelope(t *testing.T) {
 	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "e2e-sc-err", AppSecret: "secret", Brand: core.BrandFeishu,
+		AppID: "e2e-sc-err", AppSecret: "secret", Brand: brand.Feishu,
 	})
 	reg.Register(&httpmock.Stub{
 		URL:    "/open-apis/im/v1/messages",
diff --git a/cmd/root_test.go b/cmd/root_test.go
index e7f3f5e738..c9b97cce84 100644
--- a/cmd/root_test.go
+++ b/cmd/root_test.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/cmd/api"
 	"github.com/larksuite/cli/cmd/auth"
 	cmdconfig "github.com/larksuite/cli/cmd/config"
@@ -513,7 +514,7 @@ func TestApplyNeedAuthorizationHint_ServiceMethodUsesLocalScopesWhenNoUAT(t *tes
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	f.ResolvedIdentity = core.AsUser
 
@@ -561,7 +562,7 @@ func TestApplyNeedAuthorizationHint_ShortcutUsesDeclaredScopesWhenNoUAT(t *testi
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	f.ResolvedIdentity = core.AsUser
 
@@ -586,7 +587,7 @@ func TestApplyNeedAuthorizationHint_ShortcutIncludesConditionalScopes(t *testing
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	f.ResolvedIdentity = core.AsUser
 
@@ -612,7 +613,7 @@ func TestApplyNeedAuthorizationHint_AppendsExistingHint(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	f.ResolvedIdentity = core.AsUser
 
diff --git a/cmd/schema/schema_test.go b/cmd/schema/schema_test.go
index 7e1762c8e4..a6615270e2 100644
--- a/cmd/schema/schema_test.go
+++ b/cmd/schema/schema_test.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -199,7 +200,7 @@ func TestSchemaCmd_NoYesForReadRisk(t *testing.T) {
 
 func TestSchemaCmd_UnknownService(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := NewCmdSchema(f, nil)
@@ -228,7 +229,7 @@ func TestSchemaCmd_UnknownService(t *testing.T) {
 // subtype invalid_argument and a hint listing the available methods.
 func TestSchemaCmd_UnknownMethod_TypedValidation(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := NewCmdSchema(f, nil)
diff --git a/cmd/service/service_paginate_test.go b/cmd/service/service_paginate_test.go
index 62f77b7c42..aa1e0bd856 100644
--- a/cmd/service/service_paginate_test.go
+++ b/cmd/service/service_paginate_test.go
@@ -13,6 +13,7 @@ import (
 	"net/http"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -47,7 +48,7 @@ func newServicePaginateTestHarness(t *testing.T) (*client.APIClient, *bytes.Buff
 	config := &core.CliConfig{
 		AppID:     "test-app",
 		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 	f, out, errOut, reg := cmdutil.TestFactory(t, config)
 	ac, err := f.NewAPIClientWithConfig(config)
diff --git a/cmd/service/service_test.go b/cmd/service/service_test.go
index 79df1e6c5a..e449146c44 100644
--- a/cmd/service/service_test.go
+++ b/cmd/service/service_test.go
@@ -15,6 +15,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	extcs "github.com/larksuite/cli/extension/contentsafety"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -27,7 +28,7 @@ import (
 // ── helpers ──
 
 var testConfig = &core.CliConfig{
-	AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+	AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 }
 
 func driveSpec() meta.Service {
@@ -132,7 +133,7 @@ func TestRegisterService_MergesExistingCommand(t *testing.T) {
 
 func TestNewCmdServiceMethod_StrictModeHidesAsFlag(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu, SupportedIdentities: 2,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu, SupportedIdentities: 2,
 	})
 
 	cmd := NewCmdServiceMethod(f, driveSpec(), driveMethod("GET", nil), "copy", "files", nil)
@@ -464,7 +465,7 @@ func TestServiceMethod_BotMode_Success(t *testing.T) {
 
 func TestServiceMethod_BotMode_PageAll_JSON(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-page", AppSecret: "test-secret-page", Brand: core.BrandFeishu,
+		AppID: "test-app-page", AppSecret: "test-secret-page", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -532,7 +533,7 @@ func TestServiceMethod_PageAll_DefaultJSONRunsContentSafety(t *testing.T) {
 	t.Cleanup(func() { extcs.Register(nil) })
 
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-service-safety", AppSecret: "test-secret-service-safety", Brand: core.BrandFeishu,
+		AppID: "test-app-service-safety", AppSecret: "test-secret-service-safety", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -586,7 +587,7 @@ func TestServiceMethod_PageAll_StreamFormatRunsContentSafety(t *testing.T) {
 	t.Cleanup(func() { extcs.Register(nil) })
 
 	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-service-stream-safety", AppSecret: "test-secret-service-stream-safety", Brand: core.BrandFeishu,
+		AppID: "test-app-service-stream-safety", AppSecret: "test-secret-service-stream-safety", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -634,7 +635,7 @@ func TestServiceMethod_PageAll_StreamFormatBlockSkipsBlockedPage(t *testing.T) {
 	t.Cleanup(func() { extcs.Register(nil) })
 
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-service-stream-block", AppSecret: "test-secret-service-stream-block", Brand: core.BrandFeishu,
+		AppID: "test-app-service-stream-block", AppSecret: "test-secret-service-stream-block", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -690,7 +691,7 @@ func TestServiceMethod_PageAll_StreamFormatBlockSkipsBlockedPage(t *testing.T) {
 
 func TestServiceMethod_BusinessErrorReturnsTypedErrorWithoutSuccessEnvelope(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-service-err", AppSecret: "test-secret-service-err", Brand: core.BrandFeishu,
+		AppID: "test-app-service-err", AppSecret: "test-secret-service-err", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -721,7 +722,7 @@ func TestServiceMethod_BusinessErrorReturnsTypedErrorWithoutSuccessEnvelope(t *t
 
 func TestServiceMethod_PageAll_DefaultBusinessErrorOutputsRawResponse(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-service-pageall-err", AppSecret: "test-secret-service-pageall-err", Brand: core.BrandFeishu,
+		AppID: "test-app-service-pageall-err", AppSecret: "test-secret-service-pageall-err", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -751,7 +752,7 @@ func TestServiceMethod_PageAll_DefaultBusinessErrorOutputsRawResponse(t *testing
 
 func TestServiceMethod_PageAll_StreamBusinessErrorDoesNotDumpJSON(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-service-pageall-stream-err", AppSecret: "test-secret-service-pageall-stream-err", Brand: core.BrandFeishu,
+		AppID: "test-app-service-pageall-stream-err", AppSecret: "test-secret-service-pageall-stream-err", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -797,7 +798,7 @@ func TestServiceMethod_PageAll_StreamBusinessErrorDoesNotDumpJSON(t *testing.T)
 
 func TestServiceMethod_UnknownFormat_Warning(t *testing.T) {
 	f, _, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-fmt", AppSecret: "test-secret-fmt", Brand: core.BrandFeishu,
+		AppID: "test-app-fmt", AppSecret: "test-secret-fmt", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -881,7 +882,7 @@ func TestServiceMethod_JqAndOutputConflict(t *testing.T) {
 
 func TestServiceMethod_JqFilter_AppliesExpression(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-jq", AppSecret: "test-secret-jq", Brand: core.BrandFeishu,
+		AppID: "test-app-jq", AppSecret: "test-secret-jq", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -952,7 +953,7 @@ func TestServiceMethod_JqInvalidExpression(t *testing.T) {
 
 func TestServiceMethod_PageAll_WithJq(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-spjq", AppSecret: "test-secret-spjq", Brand: core.BrandFeishu,
+		AppID: "test-app-spjq", AppSecret: "test-secret-spjq", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
@@ -985,7 +986,7 @@ func TestServiceMethod_PageAll_WithJq(t *testing.T) {
 
 func TestServiceMethod_PageAll_WithJqBusinessErrorOutputsRawResponse(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-spjq-err", AppSecret: "test-secret-spjq-err", Brand: core.BrandFeishu,
+		AppID: "test-app-spjq-err", AppSecret: "test-secret-spjq-err", Brand: brand.Feishu,
 	})
 
 	reg.Register(&httpmock.Stub{
diff --git a/cmd/startup_brand.go b/cmd/startup_brand.go
index 80f3761275..6d71f63f30 100644
--- a/cmd/startup_brand.go
+++ b/cmd/startup_brand.go
@@ -6,6 +6,7 @@ package cmd
 import (
 	"os"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/internal/core"
 )
@@ -15,14 +16,14 @@ import (
 // first catalog access. It mirrors the credential chain's brand precedence —
 // environment, then the active profile's raw config entry — without touching
 // the keychain (no secrets are needed to know the brand).
-func ResolveStartupBrand(profile string) core.LarkBrand {
+func ResolveStartupBrand(profile string) brand.Brand {
 	if raw := os.Getenv(envnames.CliBrand); raw != "" {
-		return core.ParseBrand(raw)
+		return brand.ParseBrand(raw)
 	}
 	if cfg, err := core.LoadMultiAppConfig(); err == nil {
 		if app := cfg.CurrentAppConfig(profile); app != nil {
-			return core.ParseBrand(string(app.Brand))
+			return brand.ParseBrand(string(app.Brand))
 		}
 	}
-	return core.BrandFeishu
+	return brand.Feishu
 }
diff --git a/cmd/startup_brand_test.go b/cmd/startup_brand_test.go
index 4458db0395..ce2dc69e40 100644
--- a/cmd/startup_brand_test.go
+++ b/cmd/startup_brand_test.go
@@ -14,8 +14,8 @@ import (
 	"testing"
 
 	"github.com/google/uuid"
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/registry"
 )
 
@@ -48,7 +48,7 @@ func TestResolveStartupBrand_Precedence(t *testing.T) {
 	os.Unsetenv("LARKSUITE_CLI_BRAND")
 
 	// No config at all → default brand.
-	if got := ResolveStartupBrand(""); got != core.BrandFeishu {
+	if got := ResolveStartupBrand(""); got != brand.Feishu {
 		t.Errorf("empty state brand = %q, want feishu", got)
 	}
 
@@ -59,16 +59,16 @@ func TestResolveStartupBrand_Precedence(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(tmp, "config.json"), []byte(raw), 0600); err != nil {
 		t.Fatal(err)
 	}
-	if got := ResolveStartupBrand(""); got != core.BrandFeishu {
+	if got := ResolveStartupBrand(""); got != brand.Feishu {
 		t.Errorf("default profile brand = %q, want feishu", got)
 	}
-	if got := ResolveStartupBrand("lark-prof"); got != core.BrandLark {
+	if got := ResolveStartupBrand("lark-prof"); got != brand.Lark {
 		t.Errorf("lark profile brand = %q, want lark (normalized)", got)
 	}
 
 	// Environment wins over the config file.
 	t.Setenv("LARKSUITE_CLI_BRAND", "lark")
-	if got := ResolveStartupBrand(""); got != core.BrandLark {
+	if got := ResolveStartupBrand(""); got != brand.Lark {
 		t.Errorf("env brand = %q, want lark", got)
 	}
 }
diff --git a/cmd/update/update.go b/cmd/update/update.go
index 750941f9e8..fecb98f9f2 100644
--- a/cmd/update/update.go
+++ b/cmd/update/update.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -175,17 +176,17 @@ func updateRun(opts *UpdateOptions) error {
 // resolveSkillsBrand returns the skills-source brand: resolved config first,
 // then the active profile's raw config entry (the brand is not a secret; a
 // locked keychain must not flip the source), then the default with a notice.
-func resolveSkillsBrand(f *cmdutil.Factory, errOut stdio.Writer) core.LarkBrand {
+func resolveSkillsBrand(f *cmdutil.Factory, errOut stdio.Writer) brand.Brand {
 	if cfg, err := f.Config(); err == nil && cfg != nil {
-		return core.ParseBrand(string(cfg.Brand))
+		return brand.ParseBrand(string(cfg.Brand))
 	}
 	if raw, err := core.LoadMultiAppConfig(); err == nil {
 		if app := raw.CurrentAppConfig(f.Invocation.Profile); app != nil {
-			return core.ParseBrand(string(app.Brand))
+			return brand.ParseBrand(string(app.Brand))
 		}
 	}
 	fmt.Fprintf(errOut, "note: could not resolve the configured brand; syncing skills from the default source\n")
-	return core.BrandFeishu
+	return brand.Feishu
 }
 
 // --- Output helpers ---
diff --git a/cmd/update/update_test.go b/cmd/update/update_test.go
index 3df74b040b..005bb12a19 100644
--- a/cmd/update/update_test.go
+++ b/cmd/update/update_test.go
@@ -16,6 +16,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -1865,9 +1866,9 @@ func TestResolveSkillsBrand_LayeredFallback(t *testing.T) {
 	// Layer 1: resolved config wins.
 	var errBuf bytes.Buffer
 	f := &cmdutil.Factory{Config: func() (*core.CliConfig, error) {
-		return &core.CliConfig{Brand: core.LarkBrand(" LARK ")}, nil
+		return &core.CliConfig{Brand: brand.Brand(" LARK ")}, nil
 	}}
-	if got := resolveSkillsBrand(f, &errBuf); got != core.BrandLark {
+	if got := resolveSkillsBrand(f, &errBuf); got != brand.Lark {
 		t.Errorf("resolved-config brand = %q, want lark", got)
 	}
 
@@ -1881,7 +1882,7 @@ func TestResolveSkillsBrand_LayeredFallback(t *testing.T) {
 	}
 	f = &cmdutil.Factory{Config: func() (*core.CliConfig, error) { return nil, errors.New("keychain locked") }}
 	errBuf.Reset()
-	if got := resolveSkillsBrand(f, &errBuf); got != core.BrandLark {
+	if got := resolveSkillsBrand(f, &errBuf); got != brand.Lark {
 		t.Errorf("raw-config brand = %q, want lark", got)
 	}
 	if errBuf.Len() != 0 {
@@ -1891,7 +1892,7 @@ func TestResolveSkillsBrand_LayeredFallback(t *testing.T) {
 	// Layer 3: nothing readable → default brand with a notice.
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	errBuf.Reset()
-	if got := resolveSkillsBrand(f, &errBuf); got != core.BrandFeishu {
+	if got := resolveSkillsBrand(f, &errBuf); got != brand.Feishu {
 		t.Errorf("fallback brand = %q, want feishu", got)
 	}
 	if !strings.Contains(errBuf.String(), "could not resolve the configured brand") {
@@ -1914,7 +1915,7 @@ func TestResolveSkillsBrand_RespectsActiveProfile(t *testing.T) {
 		Config:     func() (*core.CliConfig, error) { return nil, errors.New("keychain locked") },
 	}
 	var errBuf bytes.Buffer
-	if got := resolveSkillsBrand(f, &errBuf); got != core.BrandLark {
+	if got := resolveSkillsBrand(f, &errBuf); got != brand.Lark {
 		t.Errorf("brand = %q, want lark (the active profile's brand)", got)
 	}
 	if errBuf.Len() != 0 {
diff --git a/cmd/whoami/whoami.go b/cmd/whoami/whoami.go
index d5b4b387f9..f15b9aa588 100644
--- a/cmd/whoami/whoami.go
+++ b/cmd/whoami/whoami.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/identitydiag"
@@ -25,7 +26,7 @@ import (
 type whoamiResult struct {
 	Profile        string         `json:"profile"`
 	AppID          string         `json:"appId"`
-	Brand          core.LarkBrand `json:"brand"`
+	Brand          brand.Brand    `json:"brand"`
 	DefaultAs      string         `json:"defaultAs"`
 	Identity       string         `json:"identity"`
 	IdentitySource string         `json:"identitySource"`
diff --git a/cmd/whoami/whoami_test.go b/cmd/whoami/whoami_test.go
index 0888623974..2fc7018699 100644
--- a/cmd/whoami/whoami_test.go
+++ b/cmd/whoami/whoami_test.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -48,7 +49,7 @@ func TestResolveSource(t *testing.T) {
 }
 
 func TestBuildResult_UserValid(t *testing.T) {
-	cfg := &core.CliConfig{ProfileName: "my-app", AppID: "cli_x", Brand: core.BrandLark, DefaultAs: core.AsAuto}
+	cfg := &core.CliConfig{ProfileName: "my-app", AppID: "cli_x", Brand: brand.Lark, DefaultAs: core.AsAuto}
 	diag := identitydiag.Result{
 		User: identitydiag.Identity{Available: true, Status: "ready", TokenStatus: "valid", OpenID: "ou_x", UserName: "Alice"},
 	}
@@ -67,13 +68,13 @@ func TestBuildResult_UserValid(t *testing.T) {
 	if r.Hint != "" {
 		t.Fatalf("hint = %q, want empty", r.Hint)
 	}
-	if r.Profile != "my-app" || r.AppID != "cli_x" || r.Brand != core.BrandLark {
+	if r.Profile != "my-app" || r.AppID != "cli_x" || r.Brand != brand.Lark {
 		t.Fatalf("app context = %#v", r)
 	}
 }
 
 func TestBuildResult_UserMissingToken(t *testing.T) {
-	cfg := &core.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: core.BrandLark}
+	cfg := &core.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: brand.Lark}
 	diag := identitydiag.Result{
 		User: identitydiag.Identity{Available: false, Status: "missing", Hint: "run: lark-cli auth login --help"}, // never logged in
 	}
@@ -96,7 +97,7 @@ func TestBuildResult_UserMissingToken(t *testing.T) {
 }
 
 func TestBuildResult_BotReady(t *testing.T) {
-	cfg := &core.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: core.BrandFeishu, DefaultAs: core.AsBot}
+	cfg := &core.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: brand.Feishu, DefaultAs: core.AsBot}
 	diag := identitydiag.Result{
 		Bot: identitydiag.Identity{Available: true, Status: "ready"},
 	}
@@ -117,7 +118,7 @@ func TestBuildResult_BotReady(t *testing.T) {
 }
 
 func TestBuildResult_BotNotConfigured(t *testing.T) {
-	cfg := &core.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: brand.Feishu}
 	diag := identitydiag.Result{
 		Bot: identitydiag.Identity{Available: false, Status: "not_configured", Hint: "run: lark-cli config --help"},
 	}
@@ -136,7 +137,7 @@ func TestBuildResult_BotNotConfigured(t *testing.T) {
 
 func TestWhoami_BotJSON(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		ProfileName: "test-profile", AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		ProfileName: "test-profile", AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
 	cmd := NewCmdWhoami(f)
@@ -170,7 +171,7 @@ func TestWhoami_RejectsInvalidAs(t *testing.T) {
 	for _, bad := range []string{"admin", "USER", "bogus123", ""} {
 		t.Run("as="+bad, func(t *testing.T) {
 			f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-				ProfileName: "p", AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+				ProfileName: "p", AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 			})
 			cmd := NewCmdWhoami(f)
 			cmd.SetArgs([]string{"--as", bad})
@@ -196,7 +197,7 @@ func TestWhoami_RejectsInvalidAs(t *testing.T) {
 
 func TestWhoami_ConfigErrorPropagates(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		ProfileName: "p", AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		ProfileName: "p", AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	wantErr := fmt.Errorf("boom")
 	f.Config = func() (*core.CliConfig, error) { return nil, wantErr }
@@ -219,7 +220,7 @@ func TestWhoami_StrictModeRejectsCrossIdentity(t *testing.T) {
 	// rejected by CheckStrictMode; whoami must reject it identically rather than
 	// previewing a user identity the next call would refuse.
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		ProfileName: "p", AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		ProfileName: "p", AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		SupportedIdentities: 2, // bot only
 	})
 	cmd := NewCmdWhoami(f)
@@ -267,7 +268,7 @@ func externalWhoamiFactory(cfg *core.CliConfig) (*cmdutil.Factory, *bytes.Buffer
 // unavailable identity must not be told to "auth login" (which is blocked).
 func TestWhoami_ExternalProvider_UserReady(t *testing.T) {
 	cfg := &core.CliConfig{
-		ProfileName: "p", AppID: "cli_x", Brand: core.BrandFeishu,
+		ProfileName: "p", AppID: "cli_x", Brand: brand.Feishu,
 		SupportedIdentities: uint8(extcred.SupportsAll), UserOpenId: "ou_x", UserName: "Alice",
 	}
 	f, out := externalWhoamiFactory(cfg)
@@ -294,7 +295,7 @@ func TestWhoami_ExternalProvider_UserReady(t *testing.T) {
 
 func TestWhoami_ExternalProvider_UserHintNotKeychain(t *testing.T) {
 	cfg := &core.CliConfig{
-		ProfileName: "p", AppID: "cli_x", Brand: core.BrandFeishu,
+		ProfileName: "p", AppID: "cli_x", Brand: brand.Feishu,
 		SupportedIdentities: uint8(extcred.SupportsUser), // user supported but not signed in
 	}
 	f, out := externalWhoamiFactory(cfg)
diff --git a/extension/credential/types.go b/extension/credential/types.go
index 79e980ada8..e9665c8288 100644
--- a/extension/credential/types.go
+++ b/extension/credential/types.go
@@ -5,31 +5,24 @@ package credential
 
 import (
 	"context"
-	"strings"
+
+	"github.com/larksuite/cli/brand"
 )
 
 // Brand represents the Lark platform brand.
-type Brand string
+type Brand = brand.Brand
 
 const (
-	BrandLark   Brand = "lark"
-	BrandFeishu Brand = "feishu"
+	BrandLark   = brand.Lark
+	BrandFeishu = brand.Feishu
 )
 
 // ParseBrand maps a brand string to a Brand, defaulting to BrandFeishu.
 // It lives next to the Brand constants so every credential source resolves the
 // brand the same way; duplicating the rule per provider would let one copy
 // drift when the brand set changes.
-//
-// internal/core.ParseBrand applies the same rule to core.LarkBrand, which the
-// rest of the CLI uses. The two cannot share an implementation: this package is
-// published as a standalone SDK and may not import internal. Adding a brand
-// means changing both.
 func ParseBrand(value string) Brand {
-	if strings.ToLower(strings.TrimSpace(value)) == string(BrandLark) {
-		return BrandLark
-	}
-	return BrandFeishu
+	return brand.ParseBrand(value)
 }
 
 // NoAppSecret marks that a credential source does not provide a real app secret.
diff --git a/internal/auth/app_registration.go b/internal/auth/app_registration.go
index f7f8cc403b..5828a39d70 100644
--- a/internal/auth/app_registration.go
+++ b/internal/auth/app_registration.go
@@ -14,8 +14,8 @@ import (
 	"strings"
 	"time"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/authlog"
-	"github.com/larksuite/cli/internal/core"
 )
 
 // Terminal registration outcomes, exposed for typed classification by callers.
@@ -27,7 +27,7 @@ var (
 
 // Protocol defaults, mirroring the official SDK registration flow.
 const (
-	registrationBootstrapBrand = core.BrandFeishu
+	registrationBootstrapBrand = brandpkg.Feishu
 	defaultPollIntervalSeconds = 5
 	defaultExpireInSeconds     = 600
 	beginRequestTimeout        = 30 * time.Second
@@ -82,14 +82,14 @@ type AppRegUserInfo struct {
 }
 
 // appRegistrationEndpoint returns the brand's accounts registration endpoint.
-func appRegistrationEndpoint(brand core.LarkBrand) string {
-	return core.ResolveEndpoints(brand).Accounts + PathAppRegistration
+func appRegistrationEndpoint(brand brandpkg.Brand) string {
+	return brandpkg.ResolveEndpoints(brand).Accounts + PathAppRegistration
 }
 
 // RequestAppRegistration initiates the device flow. The registration protocol
 // always bootstraps on Feishu; brand selects the user-facing verification host.
 // The request is bounded by ctx and a begin timeout.
-func RequestAppRegistration(ctx context.Context, httpClient *http.Client, brand core.LarkBrand, errOut io.Writer) (*AppRegistrationResponse, error) {
+func RequestAppRegistration(ctx context.Context, httpClient *http.Client, brand brandpkg.Brand, errOut io.Writer) (*AppRegistrationResponse, error) {
 	if errOut == nil {
 		errOut = io.Discard
 	}
@@ -97,7 +97,7 @@ func RequestAppRegistration(ctx context.Context, httpClient *http.Client, brand
 	ctx, cancel := context.WithTimeout(ctx, beginRequestTimeout)
 	defer cancel()
 
-	ep := core.ResolveEndpoints(brand)
+	ep := brandpkg.ResolveEndpoints(brand)
 	endpoint := appRegistrationEndpoint(registrationBootstrapBrand)
 
 	form := url.Values{}
@@ -181,7 +181,7 @@ func BuildVerificationURL(baseURL, cliVersion string) string {
 }
 
 // pollOnce performs one ctx-bound poll request and decodes the payload.
-func pollOnce(ctx context.Context, httpClient *http.Client, brand core.LarkBrand, deviceCode string, logger *authlog.Logger) (map[string]interface{}, error) {
+func pollOnce(ctx context.Context, httpClient *http.Client, brand brandpkg.Brand, deviceCode string, logger *authlog.Logger) (map[string]interface{}, error) {
 	form := url.Values{}
 	form.Set("action", "poll")
 	form.Set("device_code", deviceCode)
@@ -215,7 +215,7 @@ func pollOnce(ctx context.Context, httpClient *http.Client, brand core.LarkBrand
 // non-error responses without complete credentials keep polling, and one
 // deadline from the begin expiry bounds all waits and in-flight requests.
 // The returned brand is the one the credentials were issued on.
-func RegisterAppWithDiscovery(ctx context.Context, httpClient *http.Client, resp *AppRegistrationResponse, errOut io.Writer) (*AppRegistrationResult, core.LarkBrand, error) {
+func RegisterAppWithDiscovery(ctx context.Context, httpClient *http.Client, resp *AppRegistrationResponse, errOut io.Writer) (*AppRegistrationResult, brandpkg.Brand, error) {
 	if errOut == nil {
 		errOut = io.Discard
 	}
@@ -259,7 +259,7 @@ func RegisterAppWithDiscovery(ctx context.Context, httpClient *http.Client, resp
 		if !switched {
 			if userInfoRaw, ok := data["user_info"].(map[string]interface{}); ok {
 				if tb := getStr(userInfoRaw, "tenant_brand"); tb != "" {
-					if actual := core.ParseBrand(tb); actual != currentBrand {
+					if actual := brandpkg.ParseBrand(tb); actual != currentBrand {
 						currentBrand = actual
 						effectiveBrand = actual
 						switched = true
@@ -287,7 +287,7 @@ func RegisterAppWithDiscovery(ctx context.Context, httpClient *http.Client, resp
 				// The issuing domain is authoritative; a contradictory final
 				// tenant report is a protocol violation, not a brand override.
 				if result.UserInfo != nil && result.UserInfo.TenantBrand != "" &&
-					core.ParseBrand(result.UserInfo.TenantBrand) != effectiveBrand {
+					brandpkg.ParseBrand(result.UserInfo.TenantBrand) != effectiveBrand {
 					return nil, effectiveBrand, fmt.Errorf("app registration returned credentials with a contradictory tenant brand %q", result.UserInfo.TenantBrand)
 				}
 				return result, effectiveBrand, nil
diff --git a/internal/auth/app_registration_test.go b/internal/auth/app_registration_test.go
index 64993e9ccb..aa7543fcf9 100644
--- a/internal/auth/app_registration_test.go
+++ b/internal/auth/app_registration_test.go
@@ -12,7 +12,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/larksuite/cli/internal/core"
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/smartystreets/goconvey/convey"
 )
 
@@ -51,11 +51,11 @@ func Test_BuildVerificationURL(t *testing.T) {
 
 func TestAppRegistrationEndpoint(t *testing.T) {
 	cases := []struct {
-		brand core.LarkBrand
+		brand brandpkg.Brand
 		want  string
 	}{
-		{core.BrandFeishu, "https://accounts.feishu.cn" + PathAppRegistration},
-		{core.BrandLark, "https://accounts.larksuite.com" + PathAppRegistration},
+		{brandpkg.Feishu, "https://accounts.feishu.cn" + PathAppRegistration},
+		{brandpkg.Lark, "https://accounts.larksuite.com" + PathAppRegistration},
 	}
 	for _, c := range cases {
 		if got := appRegistrationEndpoint(c.brand); got != c.want {
@@ -66,11 +66,11 @@ func TestAppRegistrationEndpoint(t *testing.T) {
 
 func TestRequestAppRegistration_UsesFeishuBootstrapAndConfiguredVerificationBrand(t *testing.T) {
 	cases := []struct {
-		brand            core.LarkBrand
+		brand            brandpkg.Brand
 		verificationHost string
 	}{
-		{core.BrandFeishu, "open.feishu.cn"},
-		{core.BrandLark, "open.larksuite.com"},
+		{brandpkg.Feishu, "open.feishu.cn"},
+		{brandpkg.Lark, "open.larksuite.com"},
 	}
 	for _, c := range cases {
 		t.Run(string(c.brand), func(t *testing.T) {
@@ -94,7 +94,7 @@ func TestRequestAppRegistration_UsesFeishuBootstrapAndConfiguredVerificationBran
 // Full Lark routing contract: Lark selects the Lark verification page, while
 // registration bootstraps on Feishu and switches only after the tenant signal.
 // The Lark credential response omits user_info, so the effective domain must
-// still determine the saved brand.
+// still determine the saved brandpkg.
 func TestRegisterAppWithDiscovery_LarkFlowUsesProtocolBootstrap(t *testing.T) {
 	var calls []string
 	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
@@ -115,7 +115,7 @@ func TestRegisterAppWithDiscovery_LarkFlowUsesProtocolBootstrap(t *testing.T) {
 		t.Errorf("unexpected host polled: %s", r.URL.Host)
 		return jsonResponse(`{}`), nil
 	})}
-	resp, err := RequestAppRegistration(context.Background(), client, core.BrandLark, io.Discard)
+	resp, err := RequestAppRegistration(context.Background(), client, brandpkg.Lark, io.Discard)
 	if err != nil {
 		t.Fatalf("RequestAppRegistration error = %v", err)
 	}
@@ -127,8 +127,8 @@ func TestRegisterAppWithDiscovery_LarkFlowUsesProtocolBootstrap(t *testing.T) {
 	if err != nil {
 		t.Fatalf("RegisterAppWithDiscovery error = %v, want nil", err)
 	}
-	if finalBrand != core.BrandLark {
-		t.Errorf("finalBrand = %q, want %q (credentials were issued on the lark domain)", finalBrand, core.BrandLark)
+	if finalBrand != brandpkg.Lark {
+		t.Errorf("finalBrand = %q, want %q (credentials were issued on the lark domain)", finalBrand, brandpkg.Lark)
 	}
 	if result.ClientID != "cli_x" || result.ClientSecret != "test-secret" {
 		t.Errorf("credentials = (%q, %q), want (cli_x, test-secret)", result.ClientID, result.ClientSecret)
@@ -162,8 +162,8 @@ func TestRegisterAppWithDiscovery_BootstrapBrandSinglePoll(t *testing.T) {
 	if err != nil {
 		t.Fatalf("RegisterAppWithDiscovery error = %v, want nil", err)
 	}
-	if finalBrand != core.BrandFeishu {
-		t.Errorf("finalBrand = %q, want %q", finalBrand, core.BrandFeishu)
+	if finalBrand != brandpkg.Feishu {
+		t.Errorf("finalBrand = %q, want %q", finalBrand, brandpkg.Feishu)
 	}
 	if polls != 1 {
 		t.Errorf("polls = %d, want 1", polls)
@@ -214,7 +214,7 @@ func TestRegisterAppWithDiscovery_PollsUntilCredentials(t *testing.T) {
 	if polls != 3 {
 		t.Errorf("polls = %d, want 3", polls)
 	}
-	if result.ClientSecret != "test-secret" || finalBrand != core.BrandFeishu {
+	if result.ClientSecret != "test-secret" || finalBrand != brandpkg.Feishu {
 		t.Errorf("result = (%q, %q), want (test-secret, feishu)", result.ClientSecret, finalBrand)
 	}
 }
@@ -240,7 +240,7 @@ func TestRegisterAppWithDiscovery_ImmediateFirstPollAndSwitch(t *testing.T) {
 	if elapsed := time.Since(start); elapsed > 2*time.Second {
 		t.Errorf("discovery waited an interval somewhere: took %v", elapsed)
 	}
-	if finalBrand != core.BrandLark || result.ClientSecret != "test-secret" {
+	if finalBrand != brandpkg.Lark || result.ClientSecret != "test-secret" {
 		t.Errorf("result = (%q, %q), want (test-secret, lark)", result.ClientSecret, finalBrand)
 	}
 	want := []string{"accounts.feishu.cn", "accounts.larksuite.com"}
@@ -286,7 +286,7 @@ func TestRequestAppRegistration_ProtocolFields(t *testing.T) {
 	}
 
 	resp, err := RequestAppRegistration(context.Background(),
-		serve(`{"device_code":"d","expire_in":60,"interval":3}`), core.BrandFeishu, io.Discard)
+		serve(`{"device_code":"d","expire_in":60,"interval":3}`), brandpkg.Feishu, io.Discard)
 	if err != nil {
 		t.Fatalf("begin error = %v", err)
 	}
@@ -295,7 +295,7 @@ func TestRequestAppRegistration_ProtocolFields(t *testing.T) {
 	}
 
 	resp, err = RequestAppRegistration(context.Background(),
-		serve(`{"device_code":"d","expires_in":45}`), core.BrandFeishu, io.Discard)
+		serve(`{"device_code":"d","expires_in":45}`), brandpkg.Feishu, io.Discard)
 	if err != nil {
 		t.Fatalf("legacy begin error = %v", err)
 	}
@@ -304,7 +304,7 @@ func TestRequestAppRegistration_ProtocolFields(t *testing.T) {
 	}
 
 	resp, err = RequestAppRegistration(context.Background(),
-		serve(`{"device_code":"d","interval":0}`), core.BrandFeishu, io.Discard)
+		serve(`{"device_code":"d","interval":0}`), brandpkg.Feishu, io.Discard)
 	if err != nil {
 		t.Fatalf("defaults begin error = %v", err)
 	}
@@ -313,7 +313,7 @@ func TestRequestAppRegistration_ProtocolFields(t *testing.T) {
 	}
 
 	if _, err := RequestAppRegistration(context.Background(),
-		serve(`{"interval":5}`), core.BrandFeishu, io.Discard); err == nil {
+		serve(`{"interval":5}`), brandpkg.Feishu, io.Discard); err == nil {
 		t.Error("missing device_code: expected error, got nil")
 	}
 }
@@ -335,7 +335,7 @@ func TestRegisterAppWithDiscovery_PendingWithTenantSignalSwitches(t *testing.T)
 	if err != nil {
 		t.Fatalf("RegisterAppWithDiscovery error = %v, want nil", err)
 	}
-	if finalBrand != core.BrandLark || result.ClientSecret != "test-secret" {
+	if finalBrand != brandpkg.Lark || result.ClientSecret != "test-secret" {
 		t.Errorf("result = (%q, %q), want (test-secret, lark)", result.ClientSecret, finalBrand)
 	}
 	want := []string{"accounts.feishu.cn", "accounts.larksuite.com"}
@@ -394,7 +394,7 @@ func TestRequestAppRegistration_BodyReadCancelKeepsCause(t *testing.T) {
 			Header:     make(http.Header),
 		}, nil
 	})}
-	_, err := RequestAppRegistration(context.Background(), client, core.BrandFeishu, io.Discard)
+	_, err := RequestAppRegistration(context.Background(), client, brandpkg.Feishu, io.Discard)
 	if !errors.Is(err, context.Canceled) {
 		t.Errorf("err = %v, want a context.Canceled cause", err)
 	}
diff --git a/internal/auth/device_flow.go b/internal/auth/device_flow.go
index 5b63d6c838..3a29b0795a 100644
--- a/internal/auth/device_flow.go
+++ b/internal/auth/device_flow.go
@@ -14,7 +14,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/larksuite/cli/internal/core"
+	brandpkg "github.com/larksuite/cli/brand"
 )
 
 // DeviceAuthResponse is the response from the device authorization endpoint.
@@ -51,9 +51,9 @@ type OAuthEndpoints struct {
 	Token               string
 }
 
-// ResolveOAuthEndpoints resolves OAuth endpoint URLs based on brand.
-func ResolveOAuthEndpoints(brand core.LarkBrand) OAuthEndpoints {
-	ep := core.ResolveEndpoints(brand)
+// ResolveOAuthEndpoints resolves OAuth endpoint URLs based on brandpkg.
+func ResolveOAuthEndpoints(brand brandpkg.Brand) OAuthEndpoints {
+	ep := brandpkg.ResolveEndpoints(brand)
 	return OAuthEndpoints{
 		DeviceAuthorization: ep.Accounts + PathDeviceAuthorization,
 		Revoke:              ep.Accounts + PathOAuthRevoke,
@@ -62,11 +62,11 @@ func ResolveOAuthEndpoints(brand core.LarkBrand) OAuthEndpoints {
 }
 
 // RequestDeviceAuthorization requests a device authorization code.
-func RequestDeviceAuthorization(httpClient *http.Client, appId, appSecret string, brand core.LarkBrand, scope string, errOut io.Writer) (*DeviceAuthResponse, error) {
+func RequestDeviceAuthorization(httpClient *http.Client, appId, appSecret string, brand brandpkg.Brand, scope string, errOut io.Writer) (*DeviceAuthResponse, error) {
 	return requestDeviceAuthorization(httpClient, appId, appSecret, brand, scope, errOut, newAuthLogger())
 }
 
-func requestDeviceAuthorization(httpClient *http.Client, appId, appSecret string, brand core.LarkBrand, scope string, errOut io.Writer, logger authLogger) (*DeviceAuthResponse, error) {
+func requestDeviceAuthorization(httpClient *http.Client, appId, appSecret string, brand brandpkg.Brand, scope string, errOut io.Writer, logger authLogger) (*DeviceAuthResponse, error) {
 	if errOut == nil {
 		errOut = io.Discard
 	}
@@ -143,7 +143,7 @@ func requestDeviceAuthorization(httpClient *http.Client, appId, appSecret string
 }
 
 // PollDeviceToken polls the token endpoint until authorization completes or times out.
-func PollDeviceToken(ctx context.Context, httpClient *http.Client, appId, appSecret string, brand core.LarkBrand, deviceCode string, interval, expiresIn int, errOut io.Writer) *DeviceFlowResult {
+func PollDeviceToken(ctx context.Context, httpClient *http.Client, appId, appSecret string, brand brandpkg.Brand, deviceCode string, interval, expiresIn int, errOut io.Writer) *DeviceFlowResult {
 	if errOut == nil {
 		errOut = io.Discard
 	}
diff --git a/internal/auth/device_flow_test.go b/internal/auth/device_flow_test.go
index d4360daea9..ffb7c21894 100644
--- a/internal/auth/device_flow_test.go
+++ b/internal/auth/device_flow_test.go
@@ -14,8 +14,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/authlog"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
@@ -35,7 +35,7 @@ func testAuthLogger(buf *bytes.Buffer, now func() time.Time, args func() []strin
 
 // TestResolveOAuthEndpoints_Feishu validates endpoints for the Feishu brand.
 func TestResolveOAuthEndpoints_Feishu(t *testing.T) {
-	ep := ResolveOAuthEndpoints(core.BrandFeishu)
+	ep := ResolveOAuthEndpoints(brand.Feishu)
 	if ep.DeviceAuthorization != "https://accounts.feishu.cn/oauth/v1/device_authorization" {
 		t.Errorf("DeviceAuthorization = %q", ep.DeviceAuthorization)
 	}
@@ -49,7 +49,7 @@ func TestResolveOAuthEndpoints_Feishu(t *testing.T) {
 
 // TestResolveOAuthEndpoints_Lark validates endpoints for the Lark brand.
 func TestResolveOAuthEndpoints_Lark(t *testing.T) {
-	ep := ResolveOAuthEndpoints(core.BrandLark)
+	ep := ResolveOAuthEndpoints(brand.Lark)
 	if ep.DeviceAuthorization != "https://accounts.larksuite.com/oauth/v1/device_authorization" {
 		t.Errorf("DeviceAuthorization = %q", ep.DeviceAuthorization)
 	}
@@ -90,7 +90,7 @@ func TestRequestDeviceAuthorization_LogsResponse(t *testing.T) {
 		return []string{"lark-cli", "auth", "login", "--device-code", "device-code-secret", "--app-secret=top-secret"}
 	})
 
-	_, err := requestDeviceAuthorization(httpmock.NewClient(reg), "cli_a", "secret_b", core.BrandFeishu, "", nil, authLogger)
+	_, err := requestDeviceAuthorization(httpmock.NewClient(reg), "cli_a", "secret_b", brand.Feishu, "", nil, authLogger)
 	if err != nil {
 		t.Fatalf("RequestDeviceAuthorization() error: %v", err)
 	}
@@ -209,7 +209,7 @@ func TestPollDeviceToken_DefaultsZeroIntervalToFiveSeconds(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
 	t.Cleanup(cancel)
 
-	result := PollDeviceToken(ctx, client, "cli_a", "secret_b", core.BrandFeishu, "device-code", 0, 10, nil)
+	result := PollDeviceToken(ctx, client, "cli_a", "secret_b", brand.Feishu, "device-code", 0, 10, nil)
 	if result == nil {
 		t.Fatal("PollDeviceToken() returned nil result")
 	}
diff --git a/internal/auth/revoke.go b/internal/auth/revoke.go
index 27e0e42572..a7c5e6dee4 100644
--- a/internal/auth/revoke.go
+++ b/internal/auth/revoke.go
@@ -11,12 +11,12 @@ import (
 	"net/url"
 	"strings"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 )
 
 // RevokeToken revokes a previously issued OAuth token.
-func RevokeToken(httpClient *http.Client, appId, appSecret string, brand core.LarkBrand, token, tokenTypeHint string) error {
+func RevokeToken(httpClient *http.Client, appId, appSecret string, brand brandpkg.Brand, token, tokenTypeHint string) error {
 	endpoints := ResolveOAuthEndpoints(brand)
 
 	form := url.Values{}
diff --git a/internal/auth/revoke_test.go b/internal/auth/revoke_test.go
index 28184bfa8e..d78ae255df 100644
--- a/internal/auth/revoke_test.go
+++ b/internal/auth/revoke_test.go
@@ -10,8 +10,8 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
@@ -54,7 +54,7 @@ func TestRevokeToken_PostsExpectedForm(t *testing.T) {
 	}
 	reg.Register(stub)
 
-	err := RevokeToken(httpmock.NewClient(reg), "cli_a", "secret_b", core.BrandFeishu, "user-access-token", "access_token")
+	err := RevokeToken(httpmock.NewClient(reg), "cli_a", "secret_b", brand.Feishu, "user-access-token", "access_token")
 	if err != nil {
 		t.Fatalf("RevokeToken() error = %v", err)
 	}
@@ -71,7 +71,7 @@ func TestRevokeToken_DoFailureReturnsTypedNetworkError(t *testing.T) {
 		}),
 	}
 
-	err := RevokeToken(httpClient, "cli_a", "secret_b", core.BrandFeishu, "user-access-token", "access_token")
+	err := RevokeToken(httpClient, "cli_a", "secret_b", brand.Feishu, "user-access-token", "access_token")
 	if err == nil {
 		t.Fatal("expected error")
 	}
@@ -98,7 +98,7 @@ func TestRevokeToken_ReportsHTTPError(t *testing.T) {
 		Body:   map[string]interface{}{"error": "invalid_token"},
 	})
 
-	err := RevokeToken(httpmock.NewClient(reg), "cli_a", "secret_b", core.BrandFeishu, "user-access-token", "access_token")
+	err := RevokeToken(httpmock.NewClient(reg), "cli_a", "secret_b", brand.Feishu, "user-access-token", "access_token")
 	if err == nil {
 		t.Fatal("expected error")
 	}
@@ -127,7 +127,7 @@ func TestRevokeToken_ReportsOAuthCodeErrorAsTypedAPIError(t *testing.T) {
 		},
 	})
 
-	err := RevokeToken(httpmock.NewClient(reg), "cli_a", "secret_b", core.BrandFeishu, "user-access-token", "access_token")
+	err := RevokeToken(httpmock.NewClient(reg), "cli_a", "secret_b", brand.Feishu, "user-access-token", "access_token")
 	if err == nil {
 		t.Fatal("expected error")
 	}
@@ -156,7 +156,7 @@ func TestRevokeToken_ReportsOAuthErrorFieldAsTypedAPIError(t *testing.T) {
 		},
 	})
 
-	err := RevokeToken(httpmock.NewClient(reg), "cli_a", "secret_b", core.BrandFeishu, "user-access-token", "access_token")
+	err := RevokeToken(httpmock.NewClient(reg), "cli_a", "secret_b", brand.Feishu, "user-access-token", "access_token")
 	if err == nil {
 		t.Fatal("expected error")
 	}
@@ -184,7 +184,7 @@ func TestRevokeToken_ReadFailureReturnsTypedInternalError(t *testing.T) {
 		}),
 	}
 
-	err := RevokeToken(httpClient, "cli_a", "secret_b", core.BrandFeishu, "user-access-token", "access_token")
+	err := RevokeToken(httpClient, "cli_a", "secret_b", brand.Feishu, "user-access-token", "access_token")
 	if err == nil {
 		t.Fatal("expected error")
 	}
diff --git a/internal/auth/uat_client.go b/internal/auth/uat_client.go
index a14d5edef0..e7bff5a7e1 100644
--- a/internal/auth/uat_client.go
+++ b/internal/auth/uat_client.go
@@ -18,6 +18,7 @@ import (
 	"time"
 
 	"github.com/gofrs/flock"
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
@@ -36,7 +37,7 @@ type UATCallOptions struct {
 	UserOpenId string
 	AppId      string
 	AppSecret  string
-	Domain     core.LarkBrand
+	Domain     brand.Brand
 	ErrOut     io.Writer // diagnostic/status output (caller injects f.IOStreams.ErrOut)
 }
 
diff --git a/internal/auth/uat_client_options_test.go b/internal/auth/uat_client_options_test.go
index d1f8257735..7729c63350 100644
--- a/internal/auth/uat_client_options_test.go
+++ b/internal/auth/uat_client_options_test.go
@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/core"
 )
 
@@ -15,7 +16,7 @@ func TestNewUATCallOptions(t *testing.T) {
 	cfg := &core.CliConfig{
 		AppID:      "app123",
 		AppSecret:  "secret",
-		Brand:      core.BrandLark,
+		Brand:      brand.Lark,
 		UserOpenId: "ou_test",
 	}
 	errOut := &bytes.Buffer{}
@@ -28,7 +29,7 @@ func TestNewUATCallOptions(t *testing.T) {
 	if opts.AppSecret != "secret" {
 		t.Errorf("AppSecret = %q, want secret", opts.AppSecret)
 	}
-	if opts.Domain != core.BrandLark {
+	if opts.Domain != brand.Lark {
 		t.Errorf("Domain = %q, want lark", opts.Domain)
 	}
 	if opts.UserOpenId != "ou_test" {
diff --git a/internal/client/client.go b/internal/client/client.go
index f40a1057b4..3ece6f8c47 100644
--- a/internal/client/client.go
+++ b/internal/client/client.go
@@ -18,6 +18,7 @@ import (
 	lark "github.com/larksuite/oapi-sdk-go/v3"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
@@ -262,7 +263,7 @@ func (r *cancelOnCloseBody) Close() error {
 	return err
 }
 
-func buildStreamURL(brand core.LarkBrand, req *larkcore.ApiReq) (string, error) {
+func buildStreamURL(brand brandpkg.Brand, req *larkcore.ApiReq) (string, error) {
 	requestURL := req.ApiPath
 	if !strings.HasPrefix(requestURL, "http://") && !strings.HasPrefix(requestURL, "https://") {
 		var pathSegs []string
@@ -281,7 +282,7 @@ func buildStreamURL(brand core.LarkBrand, req *larkcore.ApiReq) (string, error)
 			}
 			pathSegs = append(pathSegs, url.PathEscape(pathValue))
 		}
-		endpoints := core.ResolveEndpoints(brand)
+		endpoints := brandpkg.ResolveEndpoints(brand)
 		requestURL = strings.TrimRight(endpoints.Open, "/") + strings.Join(pathSegs, "/")
 	}
 	if query := req.QueryParams.Encode(); query != "" {
diff --git a/internal/client/client_test.go b/internal/client/client_test.go
index 97018078d0..7765d66625 100644
--- a/internal/client/client_test.go
+++ b/internal/client/client_test.go
@@ -19,6 +19,7 @@ import (
 	lark "github.com/larksuite/oapi-sdk-go/v3"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	internalauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/core"
@@ -59,7 +60,7 @@ func newTestAPIClient(t *testing.T, rt http.RoundTripper) (*APIClient, *bytes.Bu
 		lark.WithHttpClient(httpClient),
 	)
 	testCred := credential.NewCredentialProvider(nil, nil, &staticTokenResolver{}, nil)
-	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu}
 	return &APIClient{
 		SDK:        sdk,
 		ErrOut:     errBuf,
@@ -464,7 +465,7 @@ func TestDoStream_IgnoresBaseHTTPClientTimeout(t *testing.T) {
 	ac := &APIClient{
 		HTTP:       &http.Client{Timeout: 5 * time.Millisecond},
 		Credential: credential.NewCredentialProvider(nil, nil, &staticTokenResolver{}, nil),
-		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu},
+		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 	}
 
 	resp, err := ac.DoStream(context.Background(), &larkcore.ApiReq{
@@ -499,7 +500,7 @@ func TestDoStream_TransportFailureSplitsSubtype(t *testing.T) {
 	ac := &APIClient{
 		HTTP:       &http.Client{Transport: rt},
 		Credential: credential.NewCredentialProvider(nil, nil, &staticTokenResolver{}, nil),
-		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu},
+		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 	}
 
 	_, err := ac.DoStream(context.Background(), &larkcore.ApiReq{
@@ -533,7 +534,7 @@ func TestResolveAccessToken_NoToken_ReturnsTypedAuthenticationError(t *testing.T
 	ac := &APIClient{
 		HTTP:       &http.Client{},
 		Credential: credential.NewCredentialProvider(nil, nil, &failingTokenResolver{}, nil),
-		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu},
+		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 	}
 
 	_, err := ac.resolveAccessToken(context.Background(), core.AsUser)
@@ -573,7 +574,7 @@ func TestResolveAccessToken_NeedAuthorization_SurfacesAsTypedAuthentication(t *t
 	ac := &APIClient{
 		HTTP:       &http.Client{},
 		Credential: credential.NewCredentialProvider(nil, nil, &needAuthTokenResolver{userOpenID: "ou_test_user"}, nil),
-		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu},
+		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 	}
 
 	_, err := ac.resolveAccessToken(context.Background(), core.AsUser)
@@ -613,7 +614,7 @@ func TestDoSDKRequest_AuthFailureSurfacesTypedAuthenticationError(t *testing.T)
 	ac := &APIClient{
 		HTTP:       &http.Client{},
 		Credential: credential.NewCredentialProvider(nil, nil, &failingTokenResolver{}, nil),
-		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu},
+		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 	}
 
 	_, err := ac.DoSDKRequest(context.Background(), &larkcore.ApiReq{
diff --git a/internal/client/dostream_test.go b/internal/client/dostream_test.go
index 0a33868a43..e0422000b8 100644
--- a/internal/client/dostream_test.go
+++ b/internal/client/dostream_test.go
@@ -11,6 +11,7 @@ import (
 
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -20,7 +21,7 @@ import (
 func TestDoStream_HTTPErrorIncludesLogID(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
-	config := &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu}
+	config := &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu}
 	factory, _, _, reg := cmdutil.TestFactory(t, config)
 	reg.Register(&httpmock.Stub{
 		Method:  http.MethodGet,
diff --git a/internal/cmdutil/factory_default.go b/internal/cmdutil/factory_default.go
index 3eff5e43c3..04c318b8ce 100644
--- a/internal/cmdutil/factory_default.go
+++ b/internal/cmdutil/factory_default.go
@@ -15,6 +15,7 @@ import (
 	lark "github.com/larksuite/oapi-sdk-go/v3"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
+	"github.com/larksuite/cli/brand"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/auth"
@@ -162,7 +163,7 @@ func cachedLarkClientFunc(f *Factory, workspaceConfig workspaceConfigSource) fun
 			Transport:     sdkTransport,
 			CheckRedirect: safeRedirectPolicy,
 		}))
-		ep := core.ResolveEndpoints(acct.Brand)
+		ep := brand.ResolveEndpoints(acct.Brand)
 		opts = append(opts, lark.WithOpenBaseUrl(ep.Open))
 		return lark.NewClient(acct.AppID, credential.RuntimeAppSecret(acct.AppSecret), opts...), nil
 	})
diff --git a/internal/cmdutil/factory_default_test.go b/internal/cmdutil/factory_default_test.go
index 94f9438128..320db6681a 100644
--- a/internal/cmdutil/factory_default_test.go
+++ b/internal/cmdutil/factory_default_test.go
@@ -8,6 +8,7 @@ import (
 	"errors"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/errs"
 	_ "github.com/larksuite/cli/extension/credential/env"
@@ -45,13 +46,13 @@ func TestNewDefault_InvocationProfileUsedByStrictModeAndConfig(t *testing.T) {
 				Name:      "default",
 				AppId:     "app-default",
 				AppSecret: core.PlainSecret("secret-default"),
-				Brand:     core.BrandFeishu,
+				Brand:     brand.Feishu,
 			},
 			{
 				Name:       "target",
 				AppId:      "app-target",
 				AppSecret:  core.PlainSecret("secret-target"),
-				Brand:      core.BrandFeishu,
+				Brand:      brand.Feishu,
 				StrictMode: &bot,
 			},
 		},
@@ -92,7 +93,7 @@ func TestNewDefault_InvocationProfileMissingSticksAcrossEarlyStrictMode(t *testi
 				Name:      "default",
 				AppId:     "app-default",
 				AppSecret: core.PlainSecret("secret-default"),
-				Brand:     core.BrandFeishu,
+				Brand:     brand.Feishu,
 			},
 		},
 	}
diff --git a/internal/cmdutil/factory_test.go b/internal/cmdutil/factory_test.go
index 829c8722fc..d6300872e8 100644
--- a/internal/cmdutil/factory_test.go
+++ b/internal/cmdutil/factory_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
@@ -195,7 +196,7 @@ func TestCheckIdentity_Unsupported_AutoDetected(t *testing.T) {
 // --- NewAPIClient / NewAPIClientWithConfig tests ---
 
 func TestNewAPIClient(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", Brand: core.BrandLark}
+	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", Brand: brand.Lark}
 	f, _, _, _ := TestFactory(t, cfg)
 
 	ac, err := f.NewAPIClient()
@@ -208,7 +209,7 @@ func TestNewAPIClient(t *testing.T) {
 }
 
 func TestNewAPIClientWithConfig(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", Brand: core.BrandLark}
+	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", Brand: brand.Lark}
 	f, _, _, _ := TestFactory(t, cfg)
 
 	ac, err := f.NewAPIClientWithConfig(cfg)
@@ -227,7 +228,7 @@ func TestNewAPIClientWithConfig(t *testing.T) {
 }
 
 func TestNewAPIClientWithConfig_NilIOStreams(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", Brand: core.BrandLark}
+	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", Brand: brand.Lark}
 	f, _, _, _ := TestFactory(t, cfg)
 	f.IOStreams = nil
 
diff --git a/internal/cmdutil/testing.go b/internal/cmdutil/testing.go
index 8d8be452bb..875d1d7668 100644
--- a/internal/cmdutil/testing.go
+++ b/internal/cmdutil/testing.go
@@ -13,6 +13,7 @@ import (
 	lark "github.com/larksuite/oapi-sdk-go/v3"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
@@ -52,7 +53,7 @@ func TestFactory(t *testing.T, config *core.CliConfig) (*Factory, *bytes.Buffer,
 			lark.WithHeaders(BaseSecurityHeaders()),
 		}
 		if config.Brand != "" {
-			opts = append(opts, lark.WithOpenBaseUrl(core.ResolveOpenBaseURL(config.Brand)))
+			opts = append(opts, lark.WithOpenBaseUrl(brand.ResolveOpenBaseURL(config.Brand)))
 		}
 		testLarkClient = lark.NewClient(config.AppID, credential.RuntimeAppSecret(config.AppSecret), opts...)
 	}
diff --git a/internal/cmdutil/testing_test.go b/internal/cmdutil/testing_test.go
index e12d5370ef..e2cbddd39f 100644
--- a/internal/cmdutil/testing_test.go
+++ b/internal/cmdutil/testing_test.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
@@ -16,7 +17,7 @@ import (
 func TestTestFactory_ReplacesGlobals(t *testing.T) {
 	config := &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret",
-		Brand: core.BrandFeishu,
+		Brand: brand.Feishu,
 	}
 
 	f, stdout, stderr, reg := TestFactory(t, config)
@@ -51,7 +52,7 @@ func TestTestFactory_ReplacesGlobals(t *testing.T) {
 	if err != nil {
 		t.Fatalf("HttpClient() error: %v", err)
 	}
-	baseURL := core.ResolveOpenBaseURL(core.BrandFeishu)
+	baseURL := brand.ResolveOpenBaseURL(brand.Feishu)
 	req, _ := http.NewRequest("GET", baseURL+"/test", nil)
 	resp, err := httpClient.Do(req)
 	if err != nil {
diff --git a/internal/core/brand_parity_test.go b/internal/core/brand_parity_test.go
deleted file mode 100644
index 4b8bd69e42..0000000000
--- a/internal/core/brand_parity_test.go
+++ /dev/null
@@ -1,84 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package core_test
-
-import (
-	"os"
-	"regexp"
-	"sort"
-	"testing"
-
-	"github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/core"
-)
-
-// The brand rule is implemented twice, once per Brand type, because
-// extension/credential ships as a standalone SDK and may not import internal.
-// Cross-reference comments ask the next author to change both; this file makes
-// the request enforceable. It lives here rather than beside either parser so
-// neither side owns the contract.
-//
-// The constants are read out of the source instead of listed again, so adding a
-// brand to one package is enough to put it under test.
-var brandConstant = regexp.MustCompile(`(?m)^\s+Brand[A-Za-z0-9]*\s+(?:Brand|LarkBrand)\s+=\s+"([^"]+)"`)
-
-func brandValues(t *testing.T, path string) []string {
-	t.Helper()
-
-	source, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("read %s: %v", path, err)
-	}
-	matches := brandConstant.FindAllStringSubmatch(string(source), -1)
-	if len(matches) == 0 {
-		t.Fatalf("no brand constants found in %s; the pattern needs updating", path)
-	}
-
-	values := make([]string, 0, len(matches))
-	for _, match := range matches {
-		values = append(values, match[1])
-	}
-	sort.Strings(values)
-	return values
-}
-
-// TestBrandConstantsMatchAcrossPackages fails when one package learns a brand
-// the other has not.
-func TestBrandConstantsMatchAcrossPackages(t *testing.T) {
-	sdk := brandValues(t, "../../extension/credential/types.go")
-	internal := brandValues(t, "types.go")
-
-	if len(sdk) != len(internal) {
-		t.Fatalf("brand constants differ: extension/credential has %v, internal/core has %v", sdk, internal)
-	}
-	for i := range sdk {
-		if sdk[i] != internal[i] {
-			t.Fatalf("brand constants differ: extension/credential has %v, internal/core has %v", sdk, internal)
-		}
-	}
-}
-
-// TestParseBrandAgreesAcrossPackages fails when the two parsers resolve the same
-// input differently — the drift the cross-reference comments only ask for.
-func TestParseBrandAgreesAcrossPackages(t *testing.T) {
-	inputs := brandValues(t, "../../extension/credential/types.go")
-	inputs = append(inputs,
-		"",           // unset
-		"LARK",       // case
-		"  lark  ",   // padding
-		"Feishu",     // case on the default
-		"neo",        // a brand neither package knows yet
-		"lark-suite", // near miss
-	)
-
-	for _, input := range inputs {
-		t.Run(input, func(t *testing.T) {
-			fromCore := string(core.ParseBrand(input))
-			fromSDK := string(credential.ParseBrand(input))
-			if fromCore != fromSDK {
-				t.Fatalf("ParseBrand(%q): internal/core = %q, extension/credential = %q", input, fromCore, fromSDK)
-			}
-		})
-	}
-}
diff --git a/internal/core/config.go b/internal/core/config.go
index 9a96065938..2f1117e905 100644
--- a/internal/core/config.go
+++ b/internal/core/config.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"unicode/utf8"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/keychain"
@@ -41,7 +42,7 @@ type AppConfig struct {
 	Name       string      `json:"name,omitempty"`
 	AppId      string      `json:"appId"`
 	AppSecret  SecretInput `json:"appSecret"`
-	Brand      LarkBrand   `json:"brand"`
+	Brand      brand.Brand `json:"brand"`
 	Lang       i18n.Lang   `json:"lang,omitempty"`
 	DefaultAs  Identity    `json:"defaultAs,omitempty"` // AsUser | AsBot | AsAuto
 	StrictMode *StrictMode `json:"strictMode,omitempty"`
@@ -163,7 +164,7 @@ type CliConfig struct {
 	ProfileName         string
 	AppID               string
 	AppSecret           string
-	Brand               LarkBrand
+	Brand               brand.Brand
 	DefaultAs           Identity // AsUser | AsBot | AsAuto | "" (from config file)
 	UserOpenId          string
 	UserName            string
@@ -275,7 +276,7 @@ func ResolveConfigFromMulti(raw *MultiAppConfig, kc keychain.KeychainAccess, pro
 		ProfileName: app.ProfileName(),
 		AppID:       app.AppId,
 		AppSecret:   secret,
-		Brand:       ParseBrand(string(app.Brand)),
+		Brand:       brand.ParseBrand(string(app.Brand)),
 		Lang:        app.Lang,
 		DefaultAs:   app.DefaultAs,
 	}
diff --git a/internal/core/config_strict_mode_test.go b/internal/core/config_strict_mode_test.go
index 95c79a8d86..2ca5e54b27 100644
--- a/internal/core/config_strict_mode_test.go
+++ b/internal/core/config_strict_mode_test.go
@@ -6,12 +6,14 @@ package core
 import (
 	"encoding/json"
 	"testing"
+
+	"github.com/larksuite/cli/brand"
 )
 
 func TestMultiAppConfig_StrictMode_JSON(t *testing.T) {
 	// StrictMode="" should be omitted (omitempty)
 	m := &MultiAppConfig{
-		Apps: []AppConfig{{AppId: "a", AppSecret: PlainSecret("s"), Brand: BrandFeishu, Users: []AppUser{}}},
+		Apps: []AppConfig{{AppId: "a", AppSecret: PlainSecret("s"), Brand: brand.Feishu, Users: []AppUser{}}},
 	}
 	data, _ := json.Marshal(m)
 	if string(data) != `{"apps":[{"appId":"a","appSecret":"s","brand":"feishu","users":[]}]}` {
@@ -30,7 +32,7 @@ func TestMultiAppConfig_StrictMode_JSON(t *testing.T) {
 
 func TestAppConfig_StrictMode_JSON(t *testing.T) {
 	// StrictMode nil should be omitted
-	app := &AppConfig{AppId: "a", AppSecret: PlainSecret("s"), Brand: BrandFeishu, Users: []AppUser{}}
+	app := &AppConfig{AppId: "a", AppSecret: PlainSecret("s"), Brand: brand.Feishu, Users: []AppUser{}}
 	data, _ := json.Marshal(app)
 	var parsed map[string]interface{}
 	json.Unmarshal(data, &parsed)
diff --git a/internal/core/config_test.go b/internal/core/config_test.go
index 233ef94d43..82d89722a4 100644
--- a/internal/core/config_test.go
+++ b/internal/core/config_test.go
@@ -8,6 +8,7 @@ import (
 	"errors"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/keychain"
 )
@@ -24,7 +25,7 @@ func (stubKeychain) Remove(service, account string) error     { return nil }
 func TestAppConfig_LangSerialization(t *testing.T) {
 	app := AppConfig{
 		AppId: "cli_test", AppSecret: PlainSecret("secret"),
-		Brand: BrandFeishu, Lang: "en", Users: []AppUser{},
+		Brand: brand.Feishu, Lang: "en", Users: []AppUser{},
 	}
 	data, err := json.Marshal(app)
 	if err != nil {
@@ -43,7 +44,7 @@ func TestAppConfig_LangSerialization(t *testing.T) {
 func TestAppConfig_LangOmitEmpty(t *testing.T) {
 	app := AppConfig{
 		AppId: "cli_test", AppSecret: PlainSecret("secret"),
-		Brand: BrandFeishu, Users: []AppUser{},
+		Brand: brand.Feishu, Users: []AppUser{},
 	}
 	data, err := json.Marshal(app)
 	if err != nil {
@@ -65,7 +66,7 @@ func TestMultiAppConfig_RoundTrip(t *testing.T) {
 		RiskControl: &disabled,
 		Apps: []AppConfig{{
 			AppId: "cli_test", AppSecret: PlainSecret("s"),
-			Brand: BrandLark, Lang: "zh", Users: []AppUser{},
+			Brand: brand.Lark, Lang: "zh", Users: []AppUser{},
 		}},
 	}
 	data, err := json.MarshalIndent(config, "", "  ")
@@ -83,8 +84,8 @@ func TestMultiAppConfig_RoundTrip(t *testing.T) {
 	if got.Apps[0].Lang != "zh" {
 		t.Errorf("Lang = %q, want %q", got.Apps[0].Lang, "zh")
 	}
-	if got.Apps[0].Brand != BrandLark {
-		t.Errorf("Brand = %q, want %q", got.Apps[0].Brand, BrandLark)
+	if got.Apps[0].Brand != brand.Lark {
+		t.Errorf("Brand = %q, want %q", got.Apps[0].Brand, brand.Lark)
 	}
 	if got.RiskControl == nil || *got.RiskControl {
 		t.Errorf("RiskControl = %v, want explicit false", got.RiskControl)
@@ -100,7 +101,7 @@ func TestResolveConfigFromMulti_RejectsSecretKeyMismatch(t *testing.T) {
 					Source: "keychain",
 					ID:     "appsecret:cli_old_app",
 				}},
-				Brand: BrandFeishu,
+				Brand: brand.Feishu,
 			},
 		},
 	}
@@ -124,7 +125,7 @@ func TestResolveConfigFromMulti_AcceptsPlainSecret(t *testing.T) {
 			{
 				AppId:     "cli_abc",
 				AppSecret: PlainSecret("my-secret"),
-				Brand:     BrandFeishu,
+				Brand:     brand.Feishu,
 			},
 		},
 	}
@@ -144,7 +145,7 @@ func TestResolveConfigFromMulti_CarriesLang(t *testing.T) {
 			{
 				AppId:     "cli_abc",
 				AppSecret: PlainSecret("my-secret"),
-				Brand:     BrandFeishu,
+				Brand:     brand.Feishu,
 				Lang:      "en",
 			},
 		},
@@ -171,7 +172,7 @@ func TestResolveConfigFromMulti_MatchingKeychainRefPassesValidation(t *testing.T
 					Source: "keychain",
 					ID:     "appsecret:cli_abc",
 				}},
-				Brand: BrandFeishu,
+				Brand: brand.Feishu,
 			},
 		},
 	}
@@ -201,7 +202,7 @@ func TestResolveConfigFromMulti_DoesNotUseEnvProfileFallback(t *testing.T) {
 				Name:      "active",
 				AppId:     "cli_active",
 				AppSecret: PlainSecret("secret"),
-				Brand:     BrandFeishu,
+				Brand:     brand.Feishu,
 			},
 		},
 	}
@@ -242,13 +243,13 @@ func TestResolveConfigFromMulti_NormalizesBrand(t *testing.T) {
 	multi := &MultiAppConfig{Apps: []AppConfig{{
 		AppId:     "cli_x",
 		AppSecret: PlainSecret("test-secret"),
-		Brand:     LarkBrand(" LARK "),
+		Brand:     brand.Brand(" LARK "),
 	}}}
 	cfg, err := ResolveConfigFromMulti(multi, nil, "")
 	if err != nil {
 		t.Fatalf("ResolveConfigFromMulti error = %v", err)
 	}
-	if cfg.Brand != BrandLark {
-		t.Errorf("Brand = %q, want %q (normalized at ingress)", cfg.Brand, BrandLark)
+	if cfg.Brand != brand.Lark {
+		t.Errorf("Brand = %q, want %q (normalized at ingress)", cfg.Brand, brand.Lark)
 	}
 }
diff --git a/internal/credential/credential_provider.go b/internal/credential/credential_provider.go
index 8f20be11d9..c3cfd2ea78 100644
--- a/internal/credential/credential_provider.go
+++ b/internal/credential/credential_provider.go
@@ -372,7 +372,7 @@ func convertAccount(ext *extcred.Account) *Account {
 	return &Account{
 		AppID:               ext.AppID,
 		AppSecret:           ext.AppSecret,
-		Brand:               core.LarkBrand(ext.Brand),
+		Brand:               ext.Brand,
 		DefaultAs:           core.Identity(ext.DefaultAs),
 		ProfileName:         ext.ProfileName,
 		UserOpenId:          ext.OpenID,
diff --git a/internal/credential/credential_provider_test.go b/internal/credential/credential_provider_test.go
index 6dd13a985d..b4ba44df51 100644
--- a/internal/credential/credential_provider_test.go
+++ b/internal/credential/credential_provider_test.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/core"
@@ -150,7 +151,7 @@ func TestCredentialProvider_TokenFallsToDefault(t *testing.T) {
 func TestCredentialProvider_TokenDoesNotMixSourcesAfterDefaultAccountSelection(t *testing.T) {
 	cp := NewCredentialProvider(
 		[]extcred.Provider{&mockExtProvider{name: "env", token: &extcred.Token{Value: "ext_tok", Source: "env"}}},
-		&mockDefaultAcct{account: &Account{AppID: "default_app", Brand: core.BrandFeishu}},
+		&mockDefaultAcct{account: &Account{AppID: "default_app", Brand: brand.Feishu}},
 		&mockDefaultToken{result: &TokenResult{Token: "default_tok"}},
 		nil,
 	)
@@ -251,7 +252,7 @@ func TestCredentialProvider_ResolveIdentityHint_DefaultSourceUsesStoredTokenStat
 
 	cp := NewCredentialProvider(
 		nil,
-		&mockDefaultAcct{account: &Account{AppID: "default_app", Brand: core.BrandFeishu, UserOpenId: "ou_default"}},
+		&mockDefaultAcct{account: &Account{AppID: "default_app", Brand: brand.Feishu, UserOpenId: "ou_default"}},
 		&mockDefaultToken{result: &TokenResult{Token: "default_tok"}},
 		nil,
 	)
@@ -286,7 +287,7 @@ func TestCredentialProvider_ResolveIdentityHint_CachesResult(t *testing.T) {
 
 	cp := NewCredentialProvider(
 		nil,
-		&mockDefaultAcct{account: &Account{AppID: "default_app", Brand: core.BrandFeishu, UserOpenId: "ou_default"}},
+		&mockDefaultAcct{account: &Account{AppID: "default_app", Brand: brand.Feishu, UserOpenId: "ou_default"}},
 		&mockDefaultToken{result: &TokenResult{Token: "default_tok"}},
 		nil,
 	)
@@ -329,7 +330,7 @@ func TestCredentialProvider_ResolveAccountDoesNotEnrichWithTokenFromDifferentPro
 		[]extcred.Provider{&mockExtProvider{name: "env", token: &extcred.Token{Value: "ext_tok", Source: "env"}}},
 		&mockDefaultAcct{account: &Account{
 			AppID:      "default_app",
-			Brand:      core.BrandFeishu,
+			Brand:      brand.Feishu,
 			UserOpenId: "ou_default",
 			UserName:   "Default User",
 		}},
diff --git a/internal/credential/integration_test.go b/internal/credential/integration_test.go
index e462cf6232..99d459ced7 100644
--- a/internal/credential/integration_test.go
+++ b/internal/credential/integration_test.go
@@ -7,6 +7,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/envnames"
 	extcred "github.com/larksuite/cli/extension/credential"
 	envprovider "github.com/larksuite/cli/extension/credential/env"
@@ -92,7 +93,7 @@ func TestFullChain_ConfigStrictMode(t *testing.T) {
 		Apps: []core.AppConfig{{
 			AppId:      "cfg_app",
 			AppSecret:  core.PlainSecret("cfg_secret"),
-			Brand:      core.BrandLark,
+			Brand:      brand.Lark,
 			StrictMode: &botMode,
 		}},
 	}
@@ -133,7 +134,7 @@ func TestFullChain_LangSurvivesProductionPath(t *testing.T) {
 		Apps: []core.AppConfig{{
 			AppId:     "cfg_app",
 			AppSecret: core.PlainSecret("cfg_secret"),
-			Brand:     core.BrandFeishu,
+			Brand:     brand.Feishu,
 			Lang:      i18n.LangJaJP,
 		}},
 	}
diff --git a/internal/credential/tat_fetch.go b/internal/credential/tat_fetch.go
index 0d916245d4..2c776d80f3 100644
--- a/internal/credential/tat_fetch.go
+++ b/internal/credential/tat_fetch.go
@@ -12,7 +12,7 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/larksuite/cli/internal/core"
+	brandpkg "github.com/larksuite/cli/brand"
 )
 
 // FetchTAT performs a single HTTP POST to mint a tenant access token via the
@@ -31,9 +31,9 @@ import (
 // deterministic credential rejection apart from upstream/transport noise.
 //
 // The caller owns the context timeout.
-func FetchTAT(ctx context.Context, httpClient *http.Client, brand core.LarkBrand, appID, appSecret string) (string, error) {
-	ep := core.ResolveEndpoints(brand)
-	endpoint := ep.Accounts + core.OAuthTokenV3Path
+func FetchTAT(ctx context.Context, httpClient *http.Client, brand brandpkg.Brand, appID, appSecret string) (string, error) {
+	ep := brandpkg.ResolveEndpoints(brand)
+	endpoint := ep.Accounts + brandpkg.OAuthTokenV3Path
 
 	form := url.Values{}
 	form.Set("grant_type", "client_credentials")
diff --git a/internal/credential/tat_fetch_test.go b/internal/credential/tat_fetch_test.go
index a899d205ac..bd427598c4 100644
--- a/internal/credential/tat_fetch_test.go
+++ b/internal/credential/tat_fetch_test.go
@@ -12,8 +12,8 @@ import (
 	"strings"
 	"testing"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 )
 
 // stubRoundTripper lets us assert request shape and return canned responses.
@@ -48,7 +48,7 @@ func TestFetchTAT_Success(t *testing.T) {
 	}
 	hc := &http.Client{Transport: rt}
 
-	token, err := FetchTAT(context.Background(), hc, core.BrandFeishu, "cli_app", "secret_x")
+	token, err := FetchTAT(context.Background(), hc, brandpkg.Feishu, "cli_app", "secret_x")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -79,7 +79,7 @@ func TestFetchTAT_InvalidClient_ConfigInvalidClient(t *testing.T) {
 	rt := &stubRoundTripper{respCode: 400, respBody: `{"error":"invalid_client","error_description":"The client secret is invalid.","code":20002}`}
 	hc := &http.Client{Transport: rt}
 
-	token, err := FetchTAT(context.Background(), hc, core.BrandFeishu, "cli_app", "secret_x")
+	token, err := FetchTAT(context.Background(), hc, brandpkg.Feishu, "cli_app", "secret_x")
 	if err == nil {
 		t.Fatal("expected error for invalid_client")
 	}
@@ -106,7 +106,7 @@ func TestFetchTAT_OtherClientError_Typed(t *testing.T) {
 	rt := &stubRoundTripper{respCode: 400, respBody: `{"code":20068,"error":"invalid_scope","error_description":"unauthorized scope"}`}
 	hc := &http.Client{Transport: rt}
 
-	_, err := FetchTAT(context.Background(), hc, core.BrandFeishu, "cli_app", "secret_x")
+	_, err := FetchTAT(context.Background(), hc, brandpkg.Feishu, "cli_app", "secret_x")
 	if err == nil {
 		t.Fatal("expected error for invalid_scope")
 	}
@@ -127,7 +127,7 @@ func TestFetchTAT_OtherClientError_CodeZero_Typed(t *testing.T) {
 	rt := &stubRoundTripper{respCode: 400, respBody: `{"error":"invalid_scope","error_description":"the requested scope is not granted"}`}
 	hc := &http.Client{Transport: rt}
 
-	tok, err := FetchTAT(context.Background(), hc, core.BrandFeishu, "cli_app", "secret_x")
+	tok, err := FetchTAT(context.Background(), hc, brandpkg.Feishu, "cli_app", "secret_x")
 	if err == nil {
 		t.Fatal("expected non-nil error for code-0 invalid_scope (must not return empty token + nil error)")
 	}
@@ -146,7 +146,7 @@ func TestFetchTAT_LarkStyleMsg_FallsBackOnTypedError(t *testing.T) {
 	rt := &stubRoundTripper{respCode: 400, respBody: `{"code":99999,"msg":"app ticket invalid"}`}
 	hc := &http.Client{Transport: rt}
 
-	_, err := FetchTAT(context.Background(), hc, core.BrandFeishu, "cli_app", "secret_x")
+	_, err := FetchTAT(context.Background(), hc, brandpkg.Feishu, "cli_app", "secret_x")
 	if err == nil {
 		t.Fatal("expected error for {code, msg} response")
 	}
@@ -165,7 +165,7 @@ func TestFetchTAT_ServerError_Untyped(t *testing.T) {
 	rt := &stubRoundTripper{respCode: 500, respBody: `{"code":20050,"error":"server_error","error_description":"please retry"}`}
 	hc := &http.Client{Transport: rt}
 
-	_, err := FetchTAT(context.Background(), hc, core.BrandFeishu, "cli_app", "secret_x")
+	_, err := FetchTAT(context.Background(), hc, brandpkg.Feishu, "cli_app", "secret_x")
 	if err == nil {
 		t.Fatal("expected error for server_error")
 	}
@@ -191,7 +191,7 @@ func TestFetchTAT_RateLimit_Untyped(t *testing.T) {
 			rt := &stubRoundTripper{respCode: tc.code, respBody: tc.body}
 			hc := &http.Client{Transport: rt}
 
-			_, err := FetchTAT(context.Background(), hc, core.BrandFeishu, "cli_app", "secret_x")
+			_, err := FetchTAT(context.Background(), hc, brandpkg.Feishu, "cli_app", "secret_x")
 			if err == nil {
 				t.Fatal("expected error for rate-limit")
 			}
@@ -209,7 +209,7 @@ func TestFetchTAT_HTTPNon200_Untyped(t *testing.T) {
 	for _, code := range []int{401, 403, 500, 503} {
 		rt := &stubRoundTripper{respCode: code, respBody: `whatever`}
 		hc := &http.Client{Transport: rt}
-		_, err := FetchTAT(context.Background(), hc, core.BrandFeishu, "cli_app", "secret_x")
+		_, err := FetchTAT(context.Background(), hc, brandpkg.Feishu, "cli_app", "secret_x")
 		if err == nil {
 			t.Fatalf("HTTP %d: expected error", code)
 		}
@@ -224,7 +224,7 @@ func TestFetchTAT_TransportError_Untyped(t *testing.T) {
 	rt := &stubRoundTripper{err: sentinel}
 	hc := &http.Client{Transport: rt}
 
-	_, err := FetchTAT(context.Background(), hc, core.BrandFeishu, "cli_app", "secret_x")
+	_, err := FetchTAT(context.Background(), hc, brandpkg.Feishu, "cli_app", "secret_x")
 	if err == nil {
 		t.Fatal("expected error")
 	}
@@ -240,7 +240,7 @@ func TestFetchTAT_ParseError_Untyped(t *testing.T) {
 	rt := &stubRoundTripper{respCode: 200, respBody: `not json`}
 	hc := &http.Client{Transport: rt}
 
-	_, err := FetchTAT(context.Background(), hc, core.BrandFeishu, "cli_app", "secret_x")
+	_, err := FetchTAT(context.Background(), hc, brandpkg.Feishu, "cli_app", "secret_x")
 	if err == nil {
 		t.Fatal("expected parse error")
 	}
@@ -251,11 +251,11 @@ func TestFetchTAT_ParseError_Untyped(t *testing.T) {
 
 func TestFetchTAT_BrandRouting(t *testing.T) {
 	tests := []struct {
-		brand   core.LarkBrand
+		brand   brandpkg.Brand
 		wantURL string
 	}{
-		{core.BrandFeishu, "https://accounts.feishu.cn/oauth/v3/token"},
-		{core.BrandLark, "https://accounts.larksuite.com/oauth/v3/token"},
+		{brandpkg.Feishu, "https://accounts.feishu.cn/oauth/v3/token"},
+		{brandpkg.Lark, "https://accounts.larksuite.com/oauth/v3/token"},
 	}
 	for _, tc := range tests {
 		t.Run(string(tc.brand), func(t *testing.T) {
@@ -283,7 +283,7 @@ func TestFetchTAT_ContextCanceled(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel() // pre-canceled
 
-	_, err := FetchTAT(ctx, hc, core.BrandFeishu, "a", "b")
+	_, err := FetchTAT(ctx, hc, brandpkg.Feishu, "a", "b")
 	if err == nil {
 		t.Fatal("expected error for canceled context")
 	}
diff --git a/internal/credential/types.go b/internal/credential/types.go
index 430b22ba87..df131e6402 100644
--- a/internal/credential/types.go
+++ b/internal/credential/types.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/larksuite/cli/brand"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/i18n"
@@ -20,7 +21,7 @@ type Account struct {
 	ProfileName         string
 	AppID               string
 	AppSecret           string
-	Brand               core.LarkBrand
+	Brand               brand.Brand
 	DefaultAs           core.Identity
 	UserOpenId          string
 	UserName            string
@@ -82,7 +83,7 @@ func (a *Account) ToCliConfig() *core.CliConfig {
 		ProfileName:         a.ProfileName,
 		AppID:               a.AppID,
 		AppSecret:           normalizeAccountAppSecret(a.AppSecret),
-		Brand:               core.ParseBrand(string(a.Brand)),
+		Brand:               brand.ParseBrand(string(a.Brand)),
 		DefaultAs:           a.DefaultAs,
 		UserOpenId:          a.UserOpenId,
 		UserName:            a.UserName,
diff --git a/internal/credential/types_test.go b/internal/credential/types_test.go
index 1c1f288534..0ddd271ea4 100644
--- a/internal/credential/types_test.go
+++ b/internal/credential/types_test.go
@@ -6,6 +6,7 @@ package credential
 import (
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/i18n"
 )
@@ -50,7 +51,7 @@ func TestAccountFromCliConfigAndBack_ReturnCopies(t *testing.T) {
 		ProfileName:         "target",
 		AppID:               "app-1",
 		AppSecret:           "secret-1",
-		Brand:               core.BrandLark,
+		Brand:               brand.Lark,
 		DefaultAs:           "user",
 		UserOpenId:          "ou_123",
 		UserName:            "alice",
@@ -99,7 +100,7 @@ func TestAccountToCliConfig_TokenOnlySecretPreservesNoAppSecret(t *testing.T) {
 		ProfileName: "env",
 		AppID:       "app-1",
 		AppSecret:   "",
-		Brand:       core.BrandFeishu,
+		Brand:       brand.Feishu,
 	}
 
 	cfg := acct.ToCliConfig()
@@ -134,7 +135,7 @@ func TestRuntimeAppSecret_TokenOnlyUsesPlaceholder(t *testing.T) {
 // The credential-layer ingress normalizes brand casing for all runtime consumers.
 func TestToCliConfig_NormalizesBrand(t *testing.T) {
 	acct := &Account{AppID: "cli_x", Brand: " LARK "}
-	if got := acct.ToCliConfig().Brand; got != core.BrandLark {
-		t.Errorf("Brand = %q, want %q", got, core.BrandLark)
+	if got := acct.ToCliConfig().Brand; got != brand.Lark {
+		t.Errorf("Brand = %q, want %q", got, brand.Lark)
 	}
 }
diff --git a/internal/credential/user_info.go b/internal/credential/user_info.go
index 7631a91def..1f84533000 100644
--- a/internal/credential/user_info.go
+++ b/internal/credential/user_info.go
@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/larksuite/cli/internal/core"
+	brandpkg "github.com/larksuite/cli/brand"
 )
 
 type userInfo struct {
@@ -18,8 +18,8 @@ type userInfo struct {
 }
 
 // fetchUserInfo calls /open-apis/authen/v1/user_info with a UAT to get the user's identity.
-func fetchUserInfo(ctx context.Context, httpClient *http.Client, brand core.LarkBrand, uat string) (*userInfo, error) {
-	ep := core.ResolveEndpoints(brand)
+func fetchUserInfo(ctx context.Context, httpClient *http.Client, brand brandpkg.Brand, uat string) (*userInfo, error) {
+	ep := brandpkg.ResolveEndpoints(brand)
 	url := ep.Open + "/open-apis/authen/v1/user_info"
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
diff --git a/internal/errclass/classify.go b/internal/errclass/classify.go
index bc200b4de3..a1eff1c2ad 100644
--- a/internal/errclass/classify.go
+++ b/internal/errclass/classify.go
@@ -9,15 +9,15 @@ import (
 	"net/url"
 	"strings"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 )
 
 // ClassifyContext is the contextual data BuildAPIError uses to populate
 // identity-aware fields on typed errors (PermissionError.Identity / ConsoleURL).
 // Brand and Identity are plain strings at this boundary; ConsoleURL normalizes
-// Brand through core.ParseBrand, so callers can pass a raw brand string without
-// coupling this contract to core's brand enum.
+// Brand through brandpkg.ParseBrand, so callers can pass a raw brand string without
+// coupling this contract to the brand enum.
 type ClassifyContext struct {
 	Brand    string // "feishu" | "lark" — drives console_url host
 	AppID    string // placed in console_url
@@ -462,7 +462,7 @@ func ConsoleURL(brand, appID string, scopes []string) string {
 	// parameters via `&`/`#`. The brand→host mapping is owned by core so the
 	// open-platform base URL stays a single source of truth.
 	base := fmt.Sprintf("%s/page/scope-apply?clientID=%s",
-		core.ResolveOpenBaseURL(core.ParseBrand(brand)), url.QueryEscape(appID))
+		brandpkg.ResolveOpenBaseURL(brandpkg.ParseBrand(brand)), url.QueryEscape(appID))
 	if len(scopes) == 0 {
 		return base
 	}
diff --git a/internal/identitydiag/diagnostics.go b/internal/identitydiag/diagnostics.go
index 0e7fb1cc96..70a1a58c16 100644
--- a/internal/identitydiag/diagnostics.go
+++ b/internal/identitydiag/diagnostics.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/larksuite/cli/brand"
 	extcred "github.com/larksuite/cli/extension/credential"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -363,7 +364,7 @@ func fetchBotInfo(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConfig,
 	}
 	ctx, cancel := context.WithTimeout(ctx, verifyTimeout)
 	defer cancel()
-	url := strings.TrimRight(core.ResolveEndpoints(cfg.Brand).Open, "/") + "/open-apis/bot/v3/info"
+	url := strings.TrimRight(brand.ResolveEndpoints(cfg.Brand).Open, "/") + "/open-apis/bot/v3/info"
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return nil, err
diff --git a/internal/identitydiag/diagnostics_test.go b/internal/identitydiag/diagnostics_test.go
index fa4a32341b..2cc8d7a9c3 100644
--- a/internal/identitydiag/diagnostics_test.go
+++ b/internal/identitydiag/diagnostics_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/larksuite/cli/brand"
 	extcred "github.com/larksuite/cli/extension/credential"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -20,7 +21,7 @@ import (
 )
 
 func TestDiagnose_NoUserReportsBotReadyAndUserMissing(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu}
 	f, _, _, _ := cmdutil.TestFactory(t, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -33,7 +34,7 @@ func TestDiagnose_NoUserReportsBotReadyAndUserMissing(t *testing.T) {
 }
 
 func TestDiagnose_BotIdentityNotConfigured(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test-app", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "test-app", Brand: brand.Feishu}
 	f, _, _, _ := cmdutil.TestFactory(t, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -43,7 +44,7 @@ func TestDiagnose_BotIdentityNotConfigured(t *testing.T) {
 }
 
 func TestDiagnose_VerifyBotIdentity(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	stub := &httpmock.Stub{
 		Method: http.MethodGet,
@@ -82,7 +83,7 @@ func TestDiagnose_VerifyUserIdentity(t *testing.T) {
 	cfg := &core.CliConfig{
 		AppID:      "test-app-user",
 		AppSecret:  "secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_user",
 		UserName:   "tester",
 	}
@@ -135,7 +136,7 @@ func TestDiagnose_VerifyUserIdentity(t *testing.T) {
 }
 
 func TestDiagnose_VerifyBotIdentity_HTTPErrorSurfacesEnvelope(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	reg.Register(&httpmock.Stub{
 		Method: http.MethodGet,
@@ -160,7 +161,7 @@ func TestDiagnose_VerifyBotIdentity_HTTPErrorSurfacesEnvelope(t *testing.T) {
 }
 
 func TestDiagnose_VerifyBotIdentity_BusinessErrorCode(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	reg.Register(&httpmock.Stub{
 		Method: http.MethodGet,
@@ -188,7 +189,7 @@ func TestDiagnose_VerifyUserIdentity_ServerRejects(t *testing.T) {
 	cfg := &core.CliConfig{
 		AppID:      "test-app-reject",
 		AppSecret:  "secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_user",
 		UserName:   "tester",
 	}
@@ -244,7 +245,7 @@ func TestDiagnose_UserIdentityExpired(t *testing.T) {
 	cfg := &core.CliConfig{
 		AppID:      "test-app-expired",
 		AppSecret:  "secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_expired",
 		UserName:   "tester",
 	}
@@ -278,7 +279,7 @@ func TestDiagnose_BotIdentityStrictUserOnly(t *testing.T) {
 	cfg := &core.CliConfig{
 		AppID:               "test-app",
 		AppSecret:           "secret",
-		Brand:               core.BrandFeishu,
+		Brand:               brand.Feishu,
 		SupportedIdentities: 1,
 	}
 	f, _, _, _ := cmdutil.TestFactory(t, cfg)
@@ -290,7 +291,7 @@ func TestDiagnose_BotIdentityStrictUserOnly(t *testing.T) {
 }
 
 func TestDiagnose_UserIdentityMissingAppConfig(t *testing.T) {
-	cfg := &core.CliConfig{Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{Brand: brand.Feishu}
 	f, _, _, _ := cmdutil.TestFactory(t, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -323,7 +324,7 @@ func TestDiagnose_UserIdentityNeedsRefresh(t *testing.T) {
 	cfg := &core.CliConfig{
 		AppID:      "test-app-needs-refresh",
 		AppSecret:  "secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_refresh",
 		UserName:   "tester",
 	}
@@ -398,7 +399,7 @@ func assertExternalHint(t *testing.T, hint string) {
 }
 
 func TestDiagnose_External_UserReady(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: core.BrandFeishu, SupportedIdentities: uint8(extcred.SupportsAll), UserOpenId: "ou_x", UserName: "Alice"}
+	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsAll), UserOpenId: "ou_x", UserName: "Alice"}
 	f := externalFactory(&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}}, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -420,7 +421,7 @@ func TestDiagnose_External_UserReady(t *testing.T) {
 }
 
 func TestDiagnose_External_UserNotSignedIn(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: core.BrandFeishu, SupportedIdentities: uint8(extcred.SupportsAll)}
+	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsAll)}
 	f := externalFactory(&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}}, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -431,7 +432,7 @@ func TestDiagnose_External_UserNotSignedIn(t *testing.T) {
 }
 
 func TestDiagnose_External_BotOnly(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: core.BrandFeishu, SupportedIdentities: uint8(extcred.SupportsBot), UserOpenId: "ou_x"}
+	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsBot), UserOpenId: "ou_x"}
 	f := externalFactory(&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}}, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -447,7 +448,7 @@ func TestDiagnose_External_BotOnly(t *testing.T) {
 }
 
 func TestDiagnose_External_UserOnly(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: core.BrandLark, SupportedIdentities: uint8(extcred.SupportsUser), UserOpenId: "ou_x", UserName: "Bob"}
+	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Lark, SupportedIdentities: uint8(extcred.SupportsUser), UserOpenId: "ou_x", UserName: "Bob"}
 	f := externalFactory(&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}}, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -461,7 +462,7 @@ func TestDiagnose_External_UserOnly(t *testing.T) {
 }
 
 func TestDiagnose_External_VerifyUserResolvesToken(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: core.BrandFeishu, SupportedIdentities: uint8(extcred.SupportsUser), UserOpenId: "ou_x", UserName: "Alice"}
+	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsUser), UserOpenId: "ou_x", UserName: "Alice"}
 	f := externalFactory(&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}, token: &extcred.Token{Value: "ext-uat"}}, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, true)
@@ -471,7 +472,7 @@ func TestDiagnose_External_VerifyUserResolvesToken(t *testing.T) {
 }
 
 func TestDiagnose_External_VerifyUserTokenUnavailable(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: core.BrandFeishu, SupportedIdentities: uint8(extcred.SupportsUser), UserOpenId: "ou_x"}
+	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsUser), UserOpenId: "ou_x"}
 	f := externalFactory(&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}}, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, true)
diff --git a/internal/output/emitter_legacy_compat_test.go b/internal/output/emitter_legacy_compat_test.go
index 6063a898cc..2b0b2968ad 100644
--- a/internal/output/emitter_legacy_compat_test.go
+++ b/internal/output/emitter_legacy_compat_test.go
@@ -20,6 +20,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	extcs "github.com/larksuite/cli/extension/contentsafety"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -402,7 +403,7 @@ func runRuntimeContextOracle(t *testing.T, data interface{}, opts runtimeOracleO
 
 	factory := &cmdutil.Factory{IOStreams: &cmdutil.IOStreams{Out: stdout, ErrOut: stderr}}
 	runtime := common.TestNewRuntimeContextForAPI(
-		context.Background(), leaf, &core.CliConfig{Brand: core.BrandFeishu}, factory, core.AsBot,
+		context.Background(), leaf, &core.CliConfig{Brand: brand.Feishu}, factory, core.AsBot,
 	)
 	runtime.Format = opts.format
 	runtime.JqExpr = opts.jq
diff --git a/internal/qualitygate/publiccontent/scan_test.go b/internal/qualitygate/publiccontent/scan_test.go
index ea670a109b..152a3d67da 100644
--- a/internal/qualitygate/publiccontent/scan_test.go
+++ b/internal/qualitygate/publiccontent/scan_test.go
@@ -829,7 +829,7 @@ func TestScanFileAllowsStrongAuthTokenKeysWithoutStrongValueEvidence(t *testing.
 
 func TestScanFileAllowsTestFixtureSecretValues(t *testing.T) {
 	got := ScanFile("fixtures/calendar_meeting_test.go", []byte(strings.Join([]string{
-		`AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,`,
+		`AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,`,
 		`cfg := &core.CliConfig{AppID: "a", AppSecret: "s"}`,
 		`os.WriteFile(path, []byte("FEISHU_APP_ID=cli_abc\nFEISHU_APP_SECRET=secret\n"), 0600)`,
 		`rt := &stubRoundTripper{respBody: ` + "`" + `{"access_token":"t","token_type":"Bearer"}` + "`" + `}`,
diff --git a/internal/registry/loader.go b/internal/registry/loader.go
index ab2bbaba16..43257180ee 100644
--- a/internal/registry/loader.go
+++ b/internal/registry/loader.go
@@ -13,7 +13,7 @@ import (
 	"strconv"
 	"sync"
 
-	"github.com/larksuite/cli/internal/core"
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/meta"
 	"github.com/larksuite/cli/internal/update"
 )
@@ -66,12 +66,12 @@ var (
 // Init initializes the registry with default brand (feishu).
 // It is safe to call multiple times (sync.Once).
 func Init() {
-	InitWithBrand(core.BrandFeishu)
+	InitWithBrand(brandpkg.Feishu)
 }
 
 // ConfiguredBrand reports the brand the registry was initialized with
 // (empty before initialization). Diagnostics and startup-order tests use it.
-func ConfiguredBrand() core.LarkBrand {
+func ConfiguredBrand() brandpkg.Brand {
 	return configuredBrand
 }
 
@@ -80,7 +80,7 @@ func ConfiguredBrand() core.LarkBrand {
 // It is safe to call multiple times (sync.Once).
 // Remote fetch errors are silently ignored when embedded data is available.
 // If no embedded data exists and no cache is found, a synchronous fetch is attempted.
-func InitWithBrand(brand core.LarkBrand) {
+func InitWithBrand(brand brandpkg.Brand) {
 	initOnce.Do(func() {
 		configuredBrand = brand
 		// 1. Load embedded meta_data.json as baseline (no-op if not compiled in)
diff --git a/internal/registry/loader_test.go b/internal/registry/loader_test.go
index d37bb1a867..1086518b8b 100644
--- a/internal/registry/loader_test.go
+++ b/internal/registry/loader_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/meta"
 )
 
@@ -52,7 +52,7 @@ func initWithCache(t *testing.T, embeddedVer, cacheVer string) {
 	t.Setenv("LARKSUITE_CLI_REMOTE_META", "on")
 	t.Setenv("LARKSUITE_CLI_META_TTL", "3600")
 	seedCache(t, tmp, "svc", "CACHE", cacheVer, "feishu")
-	InitWithBrand(core.BrandFeishu)
+	InitWithBrand(brand.Feishu)
 }
 
 func titleOf(t *testing.T, name string) string {
diff --git a/internal/registry/registrytest/registrytest.go b/internal/registry/registrytest/registrytest.go
index 3b3512a45e..a6979a651d 100644
--- a/internal/registry/registrytest/registrytest.go
+++ b/internal/registry/registrytest/registrytest.go
@@ -16,7 +16,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/registry"
 	"github.com/larksuite/cli/internal/vfs"
 )
@@ -65,7 +65,7 @@ func Seed(testRoot string) error {
 	cacheMeta, err := json.Marshal(registry.CacheMeta{
 		LastCheckAt: time.Now().Unix(),
 		Version:     fixture.Version,
-		Brand:       string(core.BrandFeishu),
+		Brand:       string(brand.Feishu),
 	})
 	if err != nil {
 		return err
diff --git a/internal/registry/remote.go b/internal/registry/remote.go
index 6f47441dc4..f73d71ac1f 100644
--- a/internal/registry/remote.go
+++ b/internal/registry/remote.go
@@ -15,6 +15,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/meta"
@@ -53,7 +54,7 @@ type remoteResponse struct {
 }
 
 // configuredBrand is set by InitWithBrand and determines which API host to use.
-var configuredBrand core.LarkBrand
+var configuredBrand brand.Brand
 
 // --- configuration helpers ---
 
@@ -75,7 +76,7 @@ func remoteMetaURL(version string) string {
 	if testMetaURL != "" {
 		return testMetaURL
 	}
-	base := core.ResolveEndpoints(configuredBrand).Open + "/api/tools/open/api_definition"
+	base := brand.ResolveEndpoints(configuredBrand).Open + "/api/tools/open/api_definition"
 	q := "protocol=meta&client_version=" + url.QueryEscape(build.Version)
 	if version != "" {
 		q += "&data_version=" + url.QueryEscape(version)
diff --git a/internal/registry/remote_test.go b/internal/registry/remote_test.go
index 15c7281c7b..a5b49bc17b 100644
--- a/internal/registry/remote_test.go
+++ b/internal/registry/remote_test.go
@@ -14,7 +14,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/meta"
 )
 
@@ -511,7 +511,7 @@ func TestBrandSwitchInvalidatesCache(t *testing.T) {
 	testMetaURL = ts.URL
 
 	// Init with lark brand — should invalidate feishu cache and sync fetch
-	InitWithBrand(core.BrandLark)
+	InitWithBrand(brand.Lark)
 
 	// The old feishu_svc should NOT be loaded from stale cache
 	// The new lark_svc from sync fetch should be available
@@ -524,7 +524,7 @@ func TestRemoteMetaURL_BrandSpecific(t *testing.T) {
 	testMetaURL = ""
 
 	// Default URL (feishu) with no version
-	configuredBrand = core.BrandFeishu
+	configuredBrand = brand.Feishu
 	u := remoteMetaURL("")
 	if !strings.Contains(u, "open.feishu.cn") {
 		t.Errorf("expected feishu URL, got %s", u)
@@ -534,7 +534,7 @@ func TestRemoteMetaURL_BrandSpecific(t *testing.T) {
 	}
 
 	// Lark brand with version param
-	configuredBrand = core.BrandLark
+	configuredBrand = brand.Lark
 	u = remoteMetaURL("1.0.3")
 	if !strings.Contains(u, "open.larksuite.com") {
 		t.Errorf("expected lark URL, got %s", u)
diff --git a/internal/registry/scope_hint.go b/internal/registry/scope_hint.go
index c1af42d9ff..cc915b465c 100644
--- a/internal/registry/scope_hint.go
+++ b/internal/registry/scope_hint.go
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/larksuite/cli/internal/core"
+	brandpkg "github.com/larksuite/cli/brand"
 )
 
 // ExtractRequiredScopes pulls scope names out of the API error's
@@ -55,13 +55,13 @@ func SelectRecommendedScopeFromStrings(scopes []string, _ string) string {
 // BuildConsoleScopeURL returns the developer-console "apply scope" URL for the
 // given app and scope, branded for feishu / lark. Returns "" when appID or
 // scope is empty so callers can omit the field cleanly.
-func BuildConsoleScopeURL(brand core.LarkBrand, appID, scope string) string {
+func BuildConsoleScopeURL(brand brandpkg.Brand, appID, scope string) string {
 	if appID == "" || scope == "" {
 		return ""
 	}
 	return fmt.Sprintf(
 		"%s/page/scope-apply?clientID=%s&scopes=%s",
-		core.ResolveOpenBaseURL(brand),
+		brandpkg.ResolveOpenBaseURL(brand),
 		url.QueryEscape(appID),
 		url.QueryEscape(scope),
 	)
diff --git a/internal/registry/scope_hint_test.go b/internal/registry/scope_hint_test.go
index e19628d6f0..8b6fc16681 100644
--- a/internal/registry/scope_hint_test.go
+++ b/internal/registry/scope_hint_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/brand"
 )
 
 func TestExtractRequiredScopes_HappyPath(t *testing.T) {
@@ -45,7 +45,7 @@ func TestExtractRequiredScopes_NilOrMalformed(t *testing.T) {
 }
 
 func TestBuildConsoleScopeURL_BrandSpecificHost(t *testing.T) {
-	got := BuildConsoleScopeURL(core.BrandFeishu, "cli_xxx", "docs:permission.member:create")
+	got := BuildConsoleScopeURL(brand.Feishu, "cli_xxx", "docs:permission.member:create")
 	if !strings.Contains(got, "open.feishu.cn") {
 		t.Errorf("feishu brand should use open.feishu.cn host, got %s", got)
 	}
@@ -56,17 +56,17 @@ func TestBuildConsoleScopeURL_BrandSpecificHost(t *testing.T) {
 		t.Errorf("scope not URL-escaped: %s", got)
 	}
 
-	got = BuildConsoleScopeURL(core.BrandLark, "cli_yyy", "drive:drive")
+	got = BuildConsoleScopeURL(brand.Lark, "cli_yyy", "drive:drive")
 	if !strings.Contains(got, "open.larksuite.com") {
 		t.Errorf("lark brand should use open.larksuite.com host, got %s", got)
 	}
 }
 
 func TestBuildConsoleScopeURL_EmptyInput(t *testing.T) {
-	if got := BuildConsoleScopeURL(core.BrandFeishu, "", "docs:doc"); got != "" {
+	if got := BuildConsoleScopeURL(brand.Feishu, "", "docs:doc"); got != "" {
 		t.Errorf("empty appID should yield empty url, got %s", got)
 	}
-	if got := BuildConsoleScopeURL(core.BrandFeishu, "cli_xxx", ""); got != "" {
+	if got := BuildConsoleScopeURL(brand.Feishu, "cli_xxx", ""); got != "" {
 		t.Errorf("empty scope should yield empty url, got %s", got)
 	}
 }
diff --git a/internal/riskcontrol/transport.go b/internal/riskcontrol/transport.go
index 9beebdb03c..0f3e620b6c 100644
--- a/internal/riskcontrol/transport.go
+++ b/internal/riskcontrol/transport.go
@@ -8,7 +8,7 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/larksuite/cli/internal/core"
+	brandpkg "github.com/larksuite/cli/brand"
 	internaltransport "github.com/larksuite/cli/internal/transport"
 )
 
@@ -87,10 +87,10 @@ type origin struct {
 }
 
 var officialFeishuOrigins = [...]origin{
-	apiOrigin(core.BrandFeishu, core.ResolveEndpoints(core.BrandFeishu).Open),
-	apiOrigin(core.BrandLark, core.ResolveEndpoints(core.BrandLark).Open),
-	apiOrigin(core.BrandFeishu, core.ResolveEndpoints(core.BrandFeishu).Accounts),
-	apiOrigin(core.BrandLark, core.ResolveEndpoints(core.BrandLark).Accounts),
+	apiOrigin(brandpkg.Feishu, brandpkg.ResolveEndpoints(brandpkg.Feishu).Open),
+	apiOrigin(brandpkg.Lark, brandpkg.ResolveEndpoints(brandpkg.Lark).Open),
+	apiOrigin(brandpkg.Feishu, brandpkg.ResolveEndpoints(brandpkg.Feishu).Accounts),
+	apiOrigin(brandpkg.Lark, brandpkg.ResolveEndpoints(brandpkg.Lark).Accounts),
 }
 
 func (t *Transport) routeAllowsSignals(req *http.Request) bool {
@@ -117,7 +117,7 @@ func originOf(value *url.URL) origin {
 	return origin{scheme: scheme, host: strings.ToLower(value.Hostname()), port: port}
 }
 
-func apiOrigin(brand core.LarkBrand, endpointURL string) origin {
+func apiOrigin(brand brandpkg.Brand, endpointURL string) origin {
 	endpoint, err := url.Parse(endpointURL)
 	if err != nil {
 		return origin{}
diff --git a/internal/selfupdate/updater.go b/internal/selfupdate/updater.go
index 8ff0e0370c..7b95037e4a 100644
--- a/internal/selfupdate/updater.go
+++ b/internal/selfupdate/updater.go
@@ -16,7 +16,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/transport"
 	"github.com/larksuite/cli/internal/vfs"
 )
@@ -105,7 +105,7 @@ func (r *NpmResult) CombinedOutput() string {
 // / RestoreAvailableOverride for testing.
 type Updater struct {
 	// Brand selects the skills index/source endpoints (zero value = feishu).
-	Brand core.LarkBrand
+	Brand brand.Brand
 
 	DetectOverride           func() DetectResult
 	NpmInstallOverride       func(version string) *NpmResult
@@ -140,12 +140,12 @@ func (u *Updater) skillsIndexURL() string {
 	if officialSkillsIndexURL != "" {
 		return officialSkillsIndexURL
 	}
-	return core.ResolveEndpoints(u.Brand).Open + "/.well-known/skills/index.json"
+	return brand.ResolveEndpoints(u.Brand).Open + "/.well-known/skills/index.json"
 }
 
 // skillsSource returns the brand's skills source host for `npx skills add`.
 func (u *Updater) skillsSource() string {
-	return core.ResolveEndpoints(u.Brand).Open
+	return brand.ResolveEndpoints(u.Brand).Open
 }
 
 // DetectInstallMethod determines how the CLI was installed and whether the
diff --git a/internal/selfupdate/updater_test.go b/internal/selfupdate/updater_test.go
index 967f8cbd7e..2f000a99f0 100644
--- a/internal/selfupdate/updater_test.go
+++ b/internal/selfupdate/updater_test.go
@@ -17,7 +17,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/larksuite/cli/internal/core"
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/vfs"
 )
 
@@ -519,12 +519,12 @@ func TestDetectInstallMethod_Caches(t *testing.T) {
 
 func TestSkillsBrandHosts(t *testing.T) {
 	cases := []struct {
-		brand      core.LarkBrand
+		brand      brandpkg.Brand
 		wantIndex  string
 		wantSource string
 	}{
-		{core.BrandFeishu, "https://open.feishu.cn/.well-known/skills/index.json", "https://open.feishu.cn"},
-		{core.BrandLark, "https://open.larksuite.com/.well-known/skills/index.json", "https://open.larksuite.com"},
+		{brandpkg.Feishu, "https://open.feishu.cn/.well-known/skills/index.json", "https://open.feishu.cn"},
+		{brandpkg.Lark, "https://open.larksuite.com/.well-known/skills/index.json", "https://open.larksuite.com"},
 	}
 	for _, c := range cases {
 		u := &Updater{Brand: c.brand}
diff --git a/lint/domaincontract/scan.go b/lint/domaincontract/scan.go
index ba2776de17..f4a8817414 100644
--- a/lint/domaincontract/scan.go
+++ b/lint/domaincontract/scan.go
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 
 // Package domaincontract guards the Go CLI against direct reuse of the current
-// resolver-owned host FQDNs outside core.ResolveEndpoints.
+// resolver-owned host FQDNs outside brand.ResolveEndpoints.
 package domaincontract
 
 import (
@@ -150,8 +150,8 @@ func ScanRepo(root string) ([]lintapi.Violation, error) {
 						Action:     lintapi.ActionReject,
 						File:       display,
 						Line:       pos.Line,
-						Message:    "SDK base-URL global " + pkg.Name + "." + node.Sel.Name + " bypasses the resolver — use core.ResolveEndpoints",
-						Suggestion: "derive the host from core.ResolveEndpoints(brand) instead of the SDK global",
+						Message:    "SDK base-URL global " + pkg.Name + "." + node.Sel.Name + " bypasses the resolver — use brand.ResolveEndpoints",
+						Suggestion: "derive the host from brand.ResolveEndpoints(brand) instead of the SDK global",
 					})
 				}
 			case *ast.BasicLit:
@@ -175,8 +175,8 @@ func ScanRepo(root string) ([]lintapi.Violation, error) {
 							Action:     lintapi.ActionReject,
 							File:       display,
 							Line:       pos.Line,
-							Message:    "hardcoded resolver host " + host + " — outbound domains must come from core.ResolveEndpoints",
-							Suggestion: "use core.ResolveEndpoints(brand) instead of a literal host",
+							Message:    "hardcoded resolver host " + host + " — outbound domains must come from brand.ResolveEndpoints",
+							Suggestion: "use brand.ResolveEndpoints(brand) instead of a literal host",
 						})
 						return true
 					}
diff --git a/shortcuts/application/slash_command_list_test.go b/shortcuts/application/slash_command_list_test.go
index cd44e0cb97..00e3791b94 100644
--- a/shortcuts/application/slash_command_list_test.go
+++ b/shortcuts/application/slash_command_list_test.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -17,7 +18,7 @@ import (
 )
 
 func appTestConfig() *core.CliConfig {
-	return &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu}
+	return &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu}
 }
 
 // mountAndRun mounts the shortcut under a parent cobra command and runs it.
diff --git a/shortcuts/apps/apps_create_test.go b/shortcuts/apps/apps_create_test.go
index 93c02fba5a..9ecaab2c83 100644
--- a/shortcuts/apps/apps_create_test.go
+++ b/shortcuts/apps/apps_create_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -28,7 +29,7 @@ func newAppsExecuteFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *http
 	cfg := &core.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_test",
 	}
 	factory, stdout, _, reg := cmdutil.TestFactory(t, cfg)
diff --git a/shortcuts/apps/apps_html_publish_test.go b/shortcuts/apps/apps_html_publish_test.go
index a9526442ec..5d8f4709eb 100644
--- a/shortcuts/apps/apps_html_publish_test.go
+++ b/shortcuts/apps/apps_html_publish_test.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -528,7 +529,7 @@ func newTOSTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Registry
 	cfg := &core.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_test",
 	}
 	factory, _, _, reg := cmdutil.TestFactory(t, cfg)
diff --git a/shortcuts/apps/apps_init_test.go b/shortcuts/apps/apps_init_test.go
index 04f0dbb331..97850c05ff 100644
--- a/shortcuts/apps/apps_init_test.go
+++ b/shortcuts/apps/apps_init_test.go
@@ -17,6 +17,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -758,7 +759,7 @@ func newAppsExecuteFactoryWithStderr(t *testing.T) (*cmdutil.Factory, *bytes.Buf
 	cfg := &core.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_test",
 	}
 	factory, stdout, stderr, reg := cmdutil.TestFactory(t, cfg)
diff --git a/shortcuts/apps/apps_meta_test.go b/shortcuts/apps/apps_meta_test.go
index 3d410c8dda..57c0e541dd 100644
--- a/shortcuts/apps/apps_meta_test.go
+++ b/shortcuts/apps/apps_meta_test.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -17,7 +18,7 @@ import (
 
 func newMetaTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Registry) {
 	t.Helper()
-	cfg := &core.CliConfig{Brand: core.BrandFeishu, AppID: "cli_meta_test"}
+	cfg := &core.CliConfig{Brand: brand.Feishu, AppID: "cli_meta_test"}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	rt := common.TestNewRuntimeContextForAPI(
 		context.Background(),
diff --git a/shortcuts/apps/apps_openapi_key_list_test.go b/shortcuts/apps/apps_openapi_key_list_test.go
index 6e3548b142..c9b22e7654 100644
--- a/shortcuts/apps/apps_openapi_key_list_test.go
+++ b/shortcuts/apps/apps_openapi_key_list_test.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -24,7 +25,7 @@ func newOpenAPIKeyRCtx(t *testing.T, flagDefs map[string]string, flags map[strin
 	cfg := &core.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_test",
 	}
 	factory, stdoutBuf, _, reg := cmdutil.TestFactory(t, cfg)
diff --git a/shortcuts/apps/apps_release_create_test.go b/shortcuts/apps/apps_release_create_test.go
index 9e62f5007e..239b5f0de7 100644
--- a/shortcuts/apps/apps_release_create_test.go
+++ b/shortcuts/apps/apps_release_create_test.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -50,7 +51,7 @@ func newReleaseCreateRuntimeContext(t *testing.T, appID, branch string) (*common
 	cfg := &core.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_test",
 	}
 	factory, stdoutBuf, _, reg := cmdutil.TestFactory(t, cfg)
diff --git a/shortcuts/apps/apps_release_get_test.go b/shortcuts/apps/apps_release_get_test.go
index 9cd46cb38f..3daa538340 100644
--- a/shortcuts/apps/apps_release_get_test.go
+++ b/shortcuts/apps/apps_release_get_test.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -40,7 +41,7 @@ func newStatusRuntimeContext(t *testing.T, appID, releaseID string) (*common.Run
 	cfg := &core.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_test",
 	}
 	factory, stdoutBuf, _, reg := cmdutil.TestFactory(t, cfg)
diff --git a/shortcuts/apps/apps_release_list_test.go b/shortcuts/apps/apps_release_list_test.go
index d8c7c56f7f..7d3fdb5037 100644
--- a/shortcuts/apps/apps_release_list_test.go
+++ b/shortcuts/apps/apps_release_list_test.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -50,7 +51,7 @@ func newReleaseListRuntimeContext(t *testing.T, appID string) (*common.RuntimeCo
 	cfg := &core.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_test",
 	}
 	factory, stdoutBuf, _, reg := cmdutil.TestFactory(t, cfg)
diff --git a/shortcuts/apps/apps_role_common_test.go b/shortcuts/apps/apps_role_common_test.go
index 247450faad..c0244c7918 100644
--- a/shortcuts/apps/apps_role_common_test.go
+++ b/shortcuts/apps/apps_role_common_test.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -24,7 +25,7 @@ func newRoleRCtx(t *testing.T, flagDefs map[string]string, flags map[string]stri
 	cfg := &core.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_test",
 	}
 	factory, stdoutBuf, _, reg := cmdutil.TestFactory(t, cfg)
diff --git a/shortcuts/apps/git_credential_test.go b/shortcuts/apps/git_credential_test.go
index b3d84adc56..4fa1a210b9 100644
--- a/shortcuts/apps/git_credential_test.go
+++ b/shortcuts/apps/git_credential_test.go
@@ -21,6 +21,7 @@ import (
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -797,7 +798,7 @@ func TestRunGitCredentialHelperActions(t *testing.T) {
 	if !strings.Contains(stderr.String(), "config failed") {
 		t.Fatalf("stderr = %q", stderr.String())
 	}
-	cfg = &core.CliConfig{AppID: "cli", AppSecret: "secret", Brand: core.BrandFeishu, UserOpenId: "ou_test"}
+	cfg = &core.CliConfig{AppID: "cli", AppSecret: "secret", Brand: brand.Feishu, UserOpenId: "ou_test"}
 	factory.Config = func() (*core.CliConfig, error) { return cfg, nil }
 	stderr.Reset()
 	if err := runGitCredentialHelper(context.Background(), factory, "app_xxx", "unknown"); err != nil {
@@ -865,13 +866,13 @@ func TestFactoryIssuerBranches(t *testing.T) {
 	}
 
 	factory.Config = func() (*core.CliConfig, error) {
-		return &core.CliConfig{AppID: "cli", AppSecret: "secret", Brand: core.BrandFeishu}, nil
+		return &core.CliConfig{AppID: "cli", AppSecret: "secret", Brand: brand.Feishu}, nil
 	}
 	if _, err := (factoryIssuer{f: factory}).Issue(context.Background(), "app_xxx", gitcred.ProfileContext{}); err == nil {
 		t.Fatal("factory issuer without login returned nil")
 	}
 	factory.Config = func() (*core.CliConfig, error) {
-		return &core.CliConfig{AppID: "cli", AppSecret: "secret", Brand: core.BrandFeishu, UserOpenId: "ou_test"}, nil
+		return &core.CliConfig{AppID: "cli", AppSecret: "secret", Brand: brand.Feishu, UserOpenId: "ou_test"}, nil
 	}
 	factory.LarkClient = func() (*lark.Client, error) { return nil, errors.New("sdk failed") }
 	if _, err := (factoryIssuer{f: factory}).Issue(context.Background(), "app_xxx", gitcred.ProfileContext{}); err == nil {
diff --git a/shortcuts/base/base_execute_test.go b/shortcuts/base/base_execute_test.go
index 5faa3739ef..7e0af4054a 100644
--- a/shortcuts/base/base_execute_test.go
+++ b/shortcuts/base/base_execute_test.go
@@ -18,6 +18,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -36,7 +37,7 @@ func newExecuteFactoryWithUserOpenID(t *testing.T, userOpenID string) (*cmdutil.
 	config := &core.CliConfig{
 		AppID:      "test-app-" + strings.ReplaceAll(strings.ToLower(t.Name()), "/", "-"),
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: userOpenID,
 	}
 	factory, stdout, _, reg := cmdutil.TestFactory(t, config)
diff --git a/shortcuts/base/record_markdown_test.go b/shortcuts/base/record_markdown_test.go
index 09775b2f14..aabce5a705 100644
--- a/shortcuts/base/record_markdown_test.go
+++ b/shortcuts/base/record_markdown_test.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	extcs "github.com/larksuite/cli/extension/contentsafety"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -39,7 +40,7 @@ func newRecordMarkdownTestRuntime(stdout, stderr *bytes.Buffer) *common.RuntimeC
 	parentCmd.AddCommand(baseCmd)
 	baseCmd.AddCommand(cmd)
 	return &common.RuntimeContext{
-		Config:  &core.CliConfig{Brand: core.BrandFeishu},
+		Config:  &core.CliConfig{Brand: brand.Feishu},
 		Cmd:     cmd,
 		Factory: &cmdutil.Factory{IOStreams: &cmdutil.IOStreams{Out: stdout, ErrOut: stderr}},
 	}
diff --git a/shortcuts/calendar/calendar_meeting_test.go b/shortcuts/calendar/calendar_meeting_test.go
index 653c1a5c8d..d09c256597 100644
--- a/shortcuts/calendar/calendar_meeting_test.go
+++ b/shortcuts/calendar/calendar_meeting_test.go
@@ -15,6 +15,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -56,7 +57,7 @@ func calWarmTokenCache(t *testing.T) {
 
 func calDefaultConfig() *core.CliConfig {
 	return &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		UserOpenId: "ou_testuser",
 	}
 }
diff --git a/shortcuts/calendar/calendar_test.go b/shortcuts/calendar/calendar_test.go
index 121bd76569..9a3004c4c3 100644
--- a/shortcuts/calendar/calendar_test.go
+++ b/shortcuts/calendar/calendar_test.go
@@ -13,6 +13,7 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -78,20 +79,20 @@ func mountAndRun(t *testing.T, s common.Shortcut, args []string, f *cmdutil.Fact
 
 func defaultConfig() *core.CliConfig {
 	return &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		UserOpenId: "ou_testuser",
 	}
 }
 
 func noLoginConfig() *core.CliConfig {
 	return &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 }
 
 func noLoginBotDefaultConfig() *core.CliConfig {
 	return &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		DefaultAs: "bot",
 	}
 }
diff --git a/shortcuts/calendar/description_rich_images.go b/shortcuts/calendar/description_rich_images.go
index 1254cd2205..fb852f7bdc 100644
--- a/shortcuts/calendar/description_rich_images.go
+++ b/shortcuts/calendar/description_rich_images.go
@@ -17,8 +17,8 @@ import (
 	"regexp"
 	"strings"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -156,9 +156,9 @@ func localImagePath(src string) string {
 	return s
 }
 
-func buildCalendarImagePreviewURL(brand core.LarkBrand, fileToken string, width, height int, size int64) string {
+func buildCalendarImagePreviewURL(brand brandpkg.Brand, fileToken string, width, height int, size int64) string {
 	host := "internal-api-drive-stream.larkoffice.com"
-	if brand == core.BrandLark {
+	if brand == brandpkg.Lark {
 		host = "internal-api-drive-stream.larksuite.com"
 	}
 	u := fmt.Sprintf("https://%s/space/api/box/stream/download/preview/%s?preview_type=16", host, fileToken)
diff --git a/shortcuts/calendar/description_rich_images_test.go b/shortcuts/calendar/description_rich_images_test.go
index 03690c3e11..ab244a10e7 100644
--- a/shortcuts/calendar/description_rich_images_test.go
+++ b/shortcuts/calendar/description_rich_images_test.go
@@ -15,9 +15,9 @@ import (
 	"strings"
 	"testing"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
@@ -65,11 +65,11 @@ func TestLocalImagePath(t *testing.T) {
 // segment is exactly the uploaded file token.
 func TestBuildCalendarImagePreviewURL(t *testing.T) {
 	for _, tc := range []struct {
-		brand    core.LarkBrand
+		brand    brandpkg.Brand
 		hostFrag string
 	}{
-		{core.BrandFeishu, "larkoffice"},
-		{core.BrandLark, "larksuite"},
+		{brandpkg.Feishu, "larkoffice"},
+		{brandpkg.Lark, "larksuite"},
 	} {
 		raw := buildCalendarImagePreviewURL(tc.brand, "boxcnTOKEN123", 416, 306, 142568)
 		u, err := url.Parse(raw)
@@ -90,7 +90,7 @@ func TestBuildCalendarImagePreviewURL(t *testing.T) {
 	}
 
 	// With unknown dimensions the helper params are omitted entirely.
-	raw := buildCalendarImagePreviewURL(core.BrandFeishu, "boxcnTOKEN123", 0, 0, 0)
+	raw := buildCalendarImagePreviewURL(brandpkg.Feishu, "boxcnTOKEN123", 0, 0, 0)
 	if strings.Contains(raw, "im_w") || strings.Contains(raw, "im_size") {
 		t.Errorf("expected no dimension params for unknown size, got %q", raw)
 	}
diff --git a/shortcuts/common/call_api_typed_test.go b/shortcuts/common/call_api_typed_test.go
index c8b7d3e1cd..d1421adb93 100644
--- a/shortcuts/common/call_api_typed_test.go
+++ b/shortcuts/common/call_api_typed_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -20,7 +21,7 @@ import (
 
 func newCallAPITypedRuntime(t *testing.T) (*RuntimeContext, *httpmock.Registry) {
 	t.Helper()
-	cfg := &core.CliConfig{Brand: core.BrandFeishu, AppID: "cli_x"}
+	cfg := &core.CliConfig{Brand: brand.Feishu, AppID: "cli_x"}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	rt := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+x"}, cfg, f, core.AsUser)
 	return rt, reg
@@ -102,7 +103,7 @@ func TestCallAPITyped_Success(t *testing.T) {
 // runtime: Brand / AppID from config, Identity from the resolved caller, and
 // LarkCmd from the running command path.
 func TestAPIClassifyContext(t *testing.T) {
-	cfg := &core.CliConfig{Brand: core.BrandLark, AppID: "cli_x"}
+	cfg := &core.CliConfig{Brand: brand.Lark, AppID: "cli_x"}
 	rt := TestNewRuntimeContextWithIdentity(&cobra.Command{Use: "+upload"}, cfg, core.AsUser)
 
 	cc := rt.APIClassifyContext()
@@ -119,7 +120,7 @@ func TestAPIClassifyContext(t *testing.T) {
 		t.Errorf("LarkCmd = %q, want +upload", cc.LarkCmd)
 	}
 
-	bot := TestNewRuntimeContextWithIdentity(&cobra.Command{Use: "+push"}, &core.CliConfig{Brand: core.BrandFeishu, AppID: "y"}, core.AsBot)
+	bot := TestNewRuntimeContextWithIdentity(&cobra.Command{Use: "+push"}, &core.CliConfig{Brand: brand.Feishu, AppID: "y"}, core.AsBot)
 	if got := bot.APIClassifyContext().Identity; got != "bot" {
 		t.Errorf("bot Identity = %q, want bot", got)
 	}
diff --git a/shortcuts/common/drive_media_upload_test.go b/shortcuts/common/drive_media_upload_test.go
index e3abf0c84c..d901ea3047 100644
--- a/shortcuts/common/drive_media_upload_test.go
+++ b/shortcuts/common/drive_media_upload_test.go
@@ -15,6 +15,7 @@ import (
 	"sync/atomic"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -305,7 +306,7 @@ func newDriveMediaUploadTestRuntime(t *testing.T) (*RuntimeContext, *httpmock.Re
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
 	cfg := &core.CliConfig{
-		AppID: fmt.Sprintf("common-drive-media-test-%d", commonDriveMediaUploadTestSeq.Add(1)), AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: fmt.Sprintf("common-drive-media-test-%d", commonDriveMediaUploadTestSeq.Add(1)), AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	runtime := &RuntimeContext{
diff --git a/shortcuts/common/drive_meta_test.go b/shortcuts/common/drive_meta_test.go
index 582c9b2ac4..4bd0adc1a0 100644
--- a/shortcuts/common/drive_meta_test.go
+++ b/shortcuts/common/drive_meta_test.go
@@ -10,6 +10,7 @@ import (
 	"sync/atomic"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -157,7 +158,7 @@ func newDriveMetaTestRuntime(t *testing.T) (*RuntimeContext, *httpmock.Registry)
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
 	cfg := &core.CliConfig{
-		AppID: fmt.Sprintf("drive-meta-test-%d", driveMetaTestSeq.Add(1)), AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: fmt.Sprintf("drive-meta-test-%d", driveMetaTestSeq.Add(1)), AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	runtime := &RuntimeContext{
diff --git a/shortcuts/common/mcp_client.go b/shortcuts/common/mcp_client.go
index 895aa2a4c2..28e66da85a 100644
--- a/shortcuts/common/mcp_client.go
+++ b/shortcuts/common/mcp_client.go
@@ -14,16 +14,16 @@ import (
 
 	"github.com/google/uuid"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/util"
 )
 
 const mcpErrorBodyLimit = 4000
 
-func MCPEndpoint(brand core.LarkBrand) string {
-	return core.ResolveEndpoints(brand).MCP + "/mcp"
+func MCPEndpoint(brand brandpkg.Brand) string {
+	return brandpkg.ResolveEndpoints(brand).MCP + "/mcp"
 }
 
 // CallMCPTool calls an MCP tool via JSON-RPC 2.0 and returns the parsed result.
diff --git a/shortcuts/common/permission_grant_test.go b/shortcuts/common/permission_grant_test.go
index abd966b652..26bbafaac6 100644
--- a/shortcuts/common/permission_grant_test.go
+++ b/shortcuts/common/permission_grant_test.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"testing"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
@@ -43,7 +44,7 @@ func TestAutoGrantStderrWarning_SkippedNoUser(t *testing.T) {
 	config := &core.CliConfig{
 		AppID:     "perm-grant-test-skip",
 		AppSecret: "perm-grant-test-secret-skip",
-		Brand:     core.BrandFeishu,
+		Brand:     brandpkg.Feishu,
 	}
 	f, _, stderr, _ := cmdutil.TestFactory(t, config)
 
@@ -77,7 +78,7 @@ func TestAutoGrantStderrWarning_GrantFailed(t *testing.T) {
 	config := &core.CliConfig{
 		AppID:      "perm-grant-test-fail",
 		AppSecret:  "perm-grant-test-secret-fail",
-		Brand:      core.BrandFeishu,
+		Brand:      brandpkg.Feishu,
 		UserOpenId: "ou_test_user",
 	}
 	f, _, stderr, reg := cmdutil.TestFactory(t, config)
@@ -123,7 +124,7 @@ func TestAutoGrantStderrWarning_GrantFailed(t *testing.T) {
 
 // ── annotateGrantPermissionError unit tests ────────────────────────────────
 
-func newAnnotateRuntime(brand core.LarkBrand, appID string) *RuntimeContext {
+func newAnnotateRuntime(brand brandpkg.Brand, appID string) *RuntimeContext {
 	return &RuntimeContext{
 		Config: &core.CliConfig{
 			AppID: appID,
@@ -136,7 +137,7 @@ func newAnnotateRuntime(brand core.LarkBrand, appID string) *RuntimeContext {
 // console_url must be brand-specific. The hint should be overridden to point
 // at the developer console.
 func TestAnnotateGrantPermissionError_AppScopeNotEnabled(t *testing.T) {
-	rt := newAnnotateRuntime(core.BrandFeishu, "cli_demo")
+	rt := newAnnotateRuntime(brandpkg.Feishu, "cli_demo")
 	result := map[string]interface{}{
 		"hint": "generic fallback hint",
 	}
@@ -168,7 +169,7 @@ func TestAnnotateGrantPermissionError_AppScopeNotEnabled(t *testing.T) {
 }
 
 func TestAnnotateGrantPermissionError_LarkBrand(t *testing.T) {
-	rt := newAnnotateRuntime(core.BrandLark, "cli_demo")
+	rt := newAnnotateRuntime(brandpkg.Lark, "cli_demo")
 	result := map[string]interface{}{}
 	err := apiErrWithScopes(99991679, "Permission denied [99991679]", "docs:permission.member:create")
 
@@ -182,7 +183,7 @@ func TestAnnotateGrantPermissionError_LarkBrand(t *testing.T) {
 // Non-permission errors (network, validation, plain errors) must not be
 // annotated — keep the existing generic hint untouched.
 func TestAnnotateGrantPermissionError_NonPermissionErrorNoOp(t *testing.T) {
-	rt := newAnnotateRuntime(core.BrandFeishu, "cli_demo")
+	rt := newAnnotateRuntime(brandpkg.Feishu, "cli_demo")
 
 	cases := []error{
 		errors.New("plain error"),
@@ -209,7 +210,7 @@ func TestAnnotateGrantPermissionError_NonPermissionErrorNoOp(t *testing.T) {
 // permission_violations missing → only lark_code is annotated; no console_url
 // and the existing hint stays as-is (caller's generic fallback wins).
 func TestAnnotateGrantPermissionError_NoViolations(t *testing.T) {
-	rt := newAnnotateRuntime(core.BrandFeishu, "cli_demo")
+	rt := newAnnotateRuntime(brandpkg.Feishu, "cli_demo")
 	result := map[string]interface{}{
 		"hint": "untouched fallback",
 	}
@@ -230,7 +231,7 @@ func TestAnnotateGrantPermissionError_NoViolations(t *testing.T) {
 
 // AppID empty → no console_url even when violations exist.
 func TestAnnotateGrantPermissionError_EmptyAppID(t *testing.T) {
-	rt := newAnnotateRuntime(core.BrandFeishu, "")
+	rt := newAnnotateRuntime(brandpkg.Feishu, "")
 	result := map[string]interface{}{}
 	err := apiErrWithScopes(99991672, "Permission denied", "docs:doc")
 
@@ -245,7 +246,7 @@ func TestAnnotateGrantPermissionError_EmptyAppID(t *testing.T) {
 
 // Defensive: nil/empty arguments must be safe no-ops.
 func TestAnnotateGrantPermissionError_NilArgsSafe(t *testing.T) {
-	rt := newAnnotateRuntime(core.BrandFeishu, "cli_demo")
+	rt := newAnnotateRuntime(brandpkg.Feishu, "cli_demo")
 
 	annotateGrantPermissionError(nil, map[string]interface{}{}, nil)
 	annotateGrantPermissionError(rt, nil, nil)
@@ -260,7 +261,7 @@ func TestAutoGrantStderrWarning_GrantFailed_AppScopeNotEnabled_Annotated(t *test
 	config := &core.CliConfig{
 		AppID:      "cli_app_demo",
 		AppSecret:  "secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brandpkg.Feishu,
 		UserOpenId: "ou_test_user",
 	}
 	f, _, _, reg := cmdutil.TestFactory(t, config)
diff --git a/shortcuts/common/resource_url.go b/shortcuts/common/resource_url.go
index 29ec31c10e..46e60686e8 100644
--- a/shortcuts/common/resource_url.go
+++ b/shortcuts/common/resource_url.go
@@ -7,7 +7,7 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/larksuite/cli/internal/core"
+	brandpkg "github.com/larksuite/cli/brand"
 )
 
 // BuildResourceURL returns a brand-standard, user-facing URL for a freshly
@@ -22,14 +22,14 @@ import (
 // Returns "" when token is empty or kind is unrecognized — callers should
 // only set the field when the result is non-empty so that "" never overrides
 // a real URL the backend already returned.
-func BuildResourceURL(brand core.LarkBrand, kind, token string) string {
+func BuildResourceURL(brand brandpkg.Brand, kind, token string) string {
 	token = strings.TrimSpace(token)
 	if token == "" {
 		return ""
 	}
 
 	host := "https://www.feishu.cn"
-	if brand == core.BrandLark {
+	if brand == brandpkg.Lark {
 		host = "https://www.larksuite.com"
 	}
 
diff --git a/shortcuts/common/resource_url_test.go b/shortcuts/common/resource_url_test.go
index c0109fe9c4..9bfce6576f 100644
--- a/shortcuts/common/resource_url_test.go
+++ b/shortcuts/common/resource_url_test.go
@@ -6,7 +6,7 @@ package common
 import (
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	brandpkg "github.com/larksuite/cli/brand"
 )
 
 func TestParseResourceURL(t *testing.T) {
@@ -90,7 +90,7 @@ func TestParseResourceURL_RoundTrip(t *testing.T) {
 
 	for _, kind := range types {
 		t.Run(kind, func(t *testing.T) {
-			built := BuildResourceURL(core.BrandFeishu, kind, token)
+			built := BuildResourceURL(brandpkg.Feishu, kind, token)
 			if built == "" {
 				t.Fatalf("BuildResourceURL returned empty for kind %q", kind)
 			}
@@ -113,29 +113,29 @@ func TestBuildResourceURL(t *testing.T) {
 
 	tests := []struct {
 		name  string
-		brand core.LarkBrand
+		brand brandpkg.Brand
 		kind  string
 		token string
 		want  string
 	}{
-		{"feishu docx", core.BrandFeishu, "docx", "doxcnABC", "https://www.feishu.cn/docx/doxcnABC"},
-		{"feishu doc legacy", core.BrandFeishu, "doc", "doccnABC", "https://www.feishu.cn/doc/doccnABC"},
-		{"feishu sheet", core.BrandFeishu, "sheet", "shtcnABC", "https://www.feishu.cn/sheets/shtcnABC"},
-		{"feishu bitable", core.BrandFeishu, "bitable", "bascnABC", "https://www.feishu.cn/base/bascnABC"},
-		{"feishu wiki", core.BrandFeishu, "wiki", "wikcnABC", "https://www.feishu.cn/wiki/wikcnABC"},
-		{"feishu file", core.BrandFeishu, "file", "boxcnABC", "https://www.feishu.cn/file/boxcnABC"},
-		{"feishu folder", core.BrandFeishu, "folder", "fldcnABC", "https://www.feishu.cn/drive/folder/fldcnABC"},
-		{"feishu mindnote", core.BrandFeishu, "mindnote", "mncnABC", "https://www.feishu.cn/mindnote/mncnABC"},
-		{"feishu slides", core.BrandFeishu, "slides", "slkcnABC", "https://www.feishu.cn/slides/slkcnABC"},
-		{"lark docx", core.BrandLark, "docx", "doxcnABC", "https://www.larksuite.com/docx/doxcnABC"},
-		{"lark wiki", core.BrandLark, "wiki", "wikcnABC", "https://www.larksuite.com/wiki/wikcnABC"},
-		{"empty brand defaults to feishu", core.LarkBrand(""), "docx", "doxcnABC", "https://www.feishu.cn/docx/doxcnABC"},
-		{"kind case-insensitive", core.BrandFeishu, "DOCX", "doxcnABC", "https://www.feishu.cn/docx/doxcnABC"},
-		{"token whitespace trimmed", core.BrandFeishu, "docx", "  doxcnABC  ", "https://www.feishu.cn/docx/doxcnABC"},
-		{"empty token", core.BrandFeishu, "docx", "", ""},
-		{"whitespace-only token", core.BrandFeishu, "docx", "   ", ""},
-		{"unknown kind", core.BrandFeishu, "calendar", "calABC", ""},
-		{"empty kind", core.BrandFeishu, "", "doxcnABC", ""},
+		{"feishu docx", brandpkg.Feishu, "docx", "doxcnABC", "https://www.feishu.cn/docx/doxcnABC"},
+		{"feishu doc legacy", brandpkg.Feishu, "doc", "doccnABC", "https://www.feishu.cn/doc/doccnABC"},
+		{"feishu sheet", brandpkg.Feishu, "sheet", "shtcnABC", "https://www.feishu.cn/sheets/shtcnABC"},
+		{"feishu bitable", brandpkg.Feishu, "bitable", "bascnABC", "https://www.feishu.cn/base/bascnABC"},
+		{"feishu wiki", brandpkg.Feishu, "wiki", "wikcnABC", "https://www.feishu.cn/wiki/wikcnABC"},
+		{"feishu file", brandpkg.Feishu, "file", "boxcnABC", "https://www.feishu.cn/file/boxcnABC"},
+		{"feishu folder", brandpkg.Feishu, "folder", "fldcnABC", "https://www.feishu.cn/drive/folder/fldcnABC"},
+		{"feishu mindnote", brandpkg.Feishu, "mindnote", "mncnABC", "https://www.feishu.cn/mindnote/mncnABC"},
+		{"feishu slides", brandpkg.Feishu, "slides", "slkcnABC", "https://www.feishu.cn/slides/slkcnABC"},
+		{"lark docx", brandpkg.Lark, "docx", "doxcnABC", "https://www.larksuite.com/docx/doxcnABC"},
+		{"lark wiki", brandpkg.Lark, "wiki", "wikcnABC", "https://www.larksuite.com/wiki/wikcnABC"},
+		{"empty brand defaults to feishu", brandpkg.Brand(""), "docx", "doxcnABC", "https://www.feishu.cn/docx/doxcnABC"},
+		{"kind case-insensitive", brandpkg.Feishu, "DOCX", "doxcnABC", "https://www.feishu.cn/docx/doxcnABC"},
+		{"token whitespace trimmed", brandpkg.Feishu, "docx", "  doxcnABC  ", "https://www.feishu.cn/docx/doxcnABC"},
+		{"empty token", brandpkg.Feishu, "docx", "", ""},
+		{"whitespace-only token", brandpkg.Feishu, "docx", "   ", ""},
+		{"unknown kind", brandpkg.Feishu, "calendar", "calABC", ""},
+		{"empty kind", brandpkg.Feishu, "", "doxcnABC", ""},
 	}
 
 	for _, tt := range tests {
diff --git a/shortcuts/common/runner_botinfo_test.go b/shortcuts/common/runner_botinfo_test.go
index f8d77f747d..28360ae6bd 100644
--- a/shortcuts/common/runner_botinfo_test.go
+++ b/shortcuts/common/runner_botinfo_test.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -21,7 +22,7 @@ func botInfoTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-app",
 		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/common/runner_contentsafety_test.go b/shortcuts/common/runner_contentsafety_test.go
index 262663aa48..d0f3a1ba77 100644
--- a/shortcuts/common/runner_contentsafety_test.go
+++ b/shortcuts/common/runner_contentsafety_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	extcs "github.com/larksuite/cli/extension/contentsafety"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -37,7 +38,7 @@ func newCSTestContext(t *testing.T) (*RuntimeContext, *bytes.Buffer, *bytes.Buff
 	parentCmd.AddCommand(cmd)
 	rctx := &RuntimeContext{
 		ctx:        context.Background(),
-		Config:     &core.CliConfig{Brand: core.BrandFeishu},
+		Config:     &core.CliConfig{Brand: brand.Feishu},
 		Cmd:        cmd,
 		resolvedAs: core.AsBot,
 		Factory: &cmdutil.Factory{
diff --git a/shortcuts/common/runner_identity_flag_test.go b/shortcuts/common/runner_identity_flag_test.go
index a6ed1020b3..52c22641bc 100644
--- a/shortcuts/common/runner_identity_flag_test.go
+++ b/shortcuts/common/runner_identity_flag_test.go
@@ -7,6 +7,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/spf13/cobra"
@@ -14,7 +15,7 @@ import (
 
 func TestShortcutMount_StrictModeHidesAsFlag(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu, SupportedIdentities: 2,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu, SupportedIdentities: 2,
 	})
 	parent := &cobra.Command{Use: "root"}
 	shortcut := Shortcut{
diff --git a/shortcuts/common/runner_jq_test.go b/shortcuts/common/runner_jq_test.go
index 3f20fcbb27..9b853506cd 100644
--- a/shortcuts/common/runner_jq_test.go
+++ b/shortcuts/common/runner_jq_test.go
@@ -15,6 +15,7 @@ import (
 	lark "github.com/larksuite/oapi-sdk-go/v3"
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -40,7 +41,7 @@ func newJqTestContext(jqExpr, format string) (*RuntimeContext, *bytes.Buffer, *b
 
 	rctx := &RuntimeContext{
 		ctx:        context.Background(),
-		Config:     &core.CliConfig{Brand: core.BrandFeishu},
+		Config:     &core.CliConfig{Brand: brand.Feishu},
 		Cmd:        cmd,
 		Format:     format,
 		JqExpr:     jqExpr,
@@ -225,7 +226,7 @@ func newTestFactory() *cmdutil.Factory {
 	return &cmdutil.Factory{
 		Config: func() (*core.CliConfig, error) {
 			return &core.CliConfig{
-				AppID: "test", AppSecret: "test", Brand: core.BrandFeishu,
+				AppID: "test", AppSecret: "test", Brand: brand.Feishu,
 			}, nil
 		},
 		LarkClient: func() (*lark.Client, error) {
diff --git a/shortcuts/common/runner_partial_failure_test.go b/shortcuts/common/runner_partial_failure_test.go
index 3147abbe32..fb348a90a0 100644
--- a/shortcuts/common/runner_partial_failure_test.go
+++ b/shortcuts/common/runner_partial_failure_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
@@ -21,7 +22,7 @@ import (
 // returned error is the typed partial-failure exit signal (ExitAPI), distinct
 // from ErrBare (the silent-exit signal).
 func TestOutPartialFailure(t *testing.T) {
-	cfg := &core.CliConfig{Brand: core.BrandFeishu, AppID: "cli_x"}
+	cfg := &core.CliConfig{Brand: brand.Feishu, AppID: "cli_x"}
 	f, stdout, _, _ := cmdutil.TestFactory(t, cfg)
 	rt := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+push"}, cfg, f, core.AsUser)
 
diff --git a/shortcuts/common/testing_test.go b/shortcuts/common/testing_test.go
index e2c7650611..40175edefc 100644
--- a/shortcuts/common/testing_test.go
+++ b/shortcuts/common/testing_test.go
@@ -9,13 +9,14 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 )
 
 func TestTestNewRuntimeContextForAPIWiresFields(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	cfg := &core.CliConfig{AppID: "self-test-app", AppSecret: "secret", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "self-test-app", AppSecret: "secret", Brand: brand.Feishu}
 	f, _, _, _ := cmdutil.TestFactory(t, cfg)
 	cmd := &cobra.Command{Use: "testing-helper"}
 
diff --git a/shortcuts/contact/contact_search_user.go b/shortcuts/contact/contact_search_user.go
index b1a43b841a..f2aaa30dca 100644
--- a/shortcuts/contact/contact_search_user.go
+++ b/shortcuts/contact/contact_search_user.go
@@ -15,8 +15,8 @@ import (
 	"strings"
 	"unicode/utf8"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
@@ -260,7 +260,7 @@ func isHumanReadableFormat(format string) bool {
 
 // We deliberately do not surface a numeric rank: the API returns no relevance
 // score, and a derived ordinal would tempt agents to over-trust it.
-func projectUsers(data *searchUserAPIData, lang string, brand core.LarkBrand) ([]searchUser, bool) {
+func projectUsers(data *searchUserAPIData, lang string, brand brandpkg.Brand) ([]searchUser, bool) {
 	if data == nil {
 		return []searchUser{}, false
 	}
@@ -317,13 +317,13 @@ func prettyUserRows(users []searchUser) []map[string]interface{} {
 // lark→en_us first) → fixedLocaleFallback → dictionary order → openID.
 // Does NOT fall back to display_info, which may contain phone/email instead
 // of a name.
-func pickName(i18n map[string]string, lang string, brand core.LarkBrand, openID string) string {
+func pickName(i18n map[string]string, lang string, brand brandpkg.Brand, openID string) string {
 	primary := make([]string, 0, 3)
 	if lang != "" {
 		primary = append(primary, strings.ReplaceAll(strings.ToLower(lang), "-", "_"))
 	}
 	switch brand {
-	case core.BrandLark:
+	case brandpkg.Lark:
 		primary = append(primary, "en_us", "zh_cn")
 	default:
 		primary = append(primary, "zh_cn", "en_us")
@@ -356,7 +356,7 @@ func pickName(i18n map[string]string, lang string, brand core.LarkBrand, openID
 
 // Cross-tenant users may have empty email / department; pass through as empty
 // string so consumers can distinguish "unknown" from "confirmed absent".
-func rowFromItem(item *searchUserAPIItem, lang string, brand core.LarkBrand) searchUser {
+func rowFromItem(item *searchUserAPIItem, lang string, brand brandpkg.Brand) searchUser {
 	meta := &item.MetaData
 	i18n := meta.I18nNames
 	if i18n == nil {
diff --git a/shortcuts/contact/contact_search_user_test.go b/shortcuts/contact/contact_search_user_test.go
index b02356df18..22ac2683f9 100644
--- a/shortcuts/contact/contact_search_user_test.go
+++ b/shortcuts/contact/contact_search_user_test.go
@@ -15,6 +15,7 @@ import (
 	"time"
 	"unicode/utf8"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -38,14 +39,14 @@ func newSearchUserTestCommand() *cobra.Command {
 
 func searchUserDefaultConfig() *core.CliConfig {
 	return &core.CliConfig{
-		AppID: "test", AppSecret: "test", Brand: core.BrandFeishu,
+		AppID: "test", AppSecret: "test", Brand: brand.Feishu,
 		UserOpenId: "ou_self",
 	}
 }
 
 func TestPickName_ExplicitLang_Hit(t *testing.T) {
 	i18n := map[string]string{"zh_cn": "张三", "en_us": "Zhangsan"}
-	got := pickName(i18n, "en-US", core.BrandFeishu, "ou_x")
+	got := pickName(i18n, "en-US", brand.Feishu, "ou_x")
 	if got != "Zhangsan" {
 		t.Errorf("got %q, want Zhangsan", got)
 	}
@@ -53,7 +54,7 @@ func TestPickName_ExplicitLang_Hit(t *testing.T) {
 
 func TestPickName_ExplicitLang_MissFallsToBrand(t *testing.T) {
 	i18n := map[string]string{"zh_cn": "张三"}
-	got := pickName(i18n, "ja-JP", core.BrandFeishu, "ou_x")
+	got := pickName(i18n, "ja-JP", brand.Feishu, "ou_x")
 	if got != "张三" {
 		t.Errorf("got %q, want 张三 (brand fallback)", got)
 	}
@@ -61,7 +62,7 @@ func TestPickName_ExplicitLang_MissFallsToBrand(t *testing.T) {
 
 func TestPickName_BrandFeishu_PicksZh(t *testing.T) {
 	i18n := map[string]string{"zh_cn": "张三", "en_us": "Zhangsan"}
-	got := pickName(i18n, "", core.BrandFeishu, "ou_x")
+	got := pickName(i18n, "", brand.Feishu, "ou_x")
 	if got != "张三" {
 		t.Errorf("got %q, want 张三", got)
 	}
@@ -69,7 +70,7 @@ func TestPickName_BrandFeishu_PicksZh(t *testing.T) {
 
 func TestPickName_BrandLark_PicksEn(t *testing.T) {
 	i18n := map[string]string{"zh_cn": "张三", "en_us": "Zhangsan"}
-	got := pickName(i18n, "", core.BrandLark, "ou_x")
+	got := pickName(i18n, "", brand.Lark, "ou_x")
 	if got != "Zhangsan" {
 		t.Errorf("got %q, want Zhangsan", got)
 	}
@@ -77,7 +78,7 @@ func TestPickName_BrandLark_PicksEn(t *testing.T) {
 
 func TestPickName_FixedLocaleList_HitJaJp(t *testing.T) {
 	i18n := map[string]string{"ja_jp": "Yamada"}
-	got := pickName(i18n, "", core.BrandFeishu, "ou_x")
+	got := pickName(i18n, "", brand.Feishu, "ou_x")
 	if got != "Yamada" {
 		t.Errorf("got %q, want Yamada (fixed locale list fallback)", got)
 	}
@@ -85,14 +86,14 @@ func TestPickName_FixedLocaleList_HitJaJp(t *testing.T) {
 
 func TestPickName_DictOrderFallback(t *testing.T) {
 	i18n := map[string]string{"xx_yy": "Foo", "aa_bb": "Bar"}
-	got := pickName(i18n, "", core.BrandFeishu, "ou_x")
+	got := pickName(i18n, "", brand.Feishu, "ou_x")
 	if got != "Bar" {
 		t.Errorf("got %q, want Bar (alphabetical tie-break, first non-empty is 'aa_bb')", got)
 	}
 }
 
 func TestPickName_AllEmpty_FallsToOpenID(t *testing.T) {
-	got := pickName(map[string]string{}, "", core.BrandFeishu, "ou_x")
+	got := pickName(map[string]string{}, "", brand.Feishu, "ou_x")
 	if got != "ou_x" {
 		t.Errorf("got %q, want ou_x", got)
 	}
@@ -100,9 +101,9 @@ func TestPickName_AllEmpty_FallsToOpenID(t *testing.T) {
 
 func TestPickName_Determinism(t *testing.T) {
 	i18n := map[string]string{"xx_yy": "Foo", "aa_bb": "Bar", "mm_nn": "Baz"}
-	first := pickName(i18n, "", core.BrandFeishu, "ou_x")
+	first := pickName(i18n, "", brand.Feishu, "ou_x")
 	for i := 0; i < 50; i++ {
-		got := pickName(i18n, "", core.BrandFeishu, "ou_x")
+		got := pickName(i18n, "", brand.Feishu, "ou_x")
 		if got != first {
 			t.Fatalf("non-deterministic: iter %d got %q, expected %q (map iteration leaked)", i, got, first)
 		}
@@ -186,7 +187,7 @@ func TestRowFromItem_FullMapping(t *testing.T) {
 			Description:           "Coffee fanatic ☕",
 		},
 	}
-	got := rowFromItem(item, "", core.BrandFeishu)
+	got := rowFromItem(item, "", brand.Feishu)
 
 	if got.OpenID != "ou_a" {
 		t.Errorf("OpenID: got %q, want ou_a", got.OpenID)
@@ -228,7 +229,7 @@ func TestRowFromItem_FullMapping(t *testing.T) {
 
 func TestRowFromItem_HasChattedFalseWhenChatIDEmpty(t *testing.T) {
 	item := &searchUserAPIItem{ID: "ou_a"}
-	got := rowFromItem(item, "", core.BrandFeishu)
+	got := rowFromItem(item, "", brand.Feishu)
 	if got.HasChatted {
 		t.Errorf("HasChatted: got true, want false")
 	}
@@ -244,7 +245,7 @@ func TestRowFromItem_CrossTenantEmptyEmailNoPanic(t *testing.T) {
 			IsCrossTenant: true,
 		},
 	}
-	got := rowFromItem(item, "", core.BrandFeishu)
+	got := rowFromItem(item, "", brand.Feishu)
 	if got.Email != "" {
 		t.Errorf("Email: expected empty, got %q", got.Email)
 	}
@@ -254,7 +255,7 @@ func TestRowFromItem_CrossTenantEmptyEmailNoPanic(t *testing.T) {
 }
 
 func TestProjectUsers_NilData(t *testing.T) {
-	users, hasMore := projectUsers(nil, "", core.BrandFeishu)
+	users, hasMore := projectUsers(nil, "", brand.Feishu)
 	if users == nil {
 		t.Fatalf("users should be an empty slice, not nil")
 	}
diff --git a/shortcuts/doc/doc_media_test.go b/shortcuts/doc/doc_media_test.go
index b7495dd832..a526766a59 100644
--- a/shortcuts/doc/doc_media_test.go
+++ b/shortcuts/doc/doc_media_test.go
@@ -16,6 +16,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -25,7 +26,7 @@ import (
 
 func docsTestConfigWithAppID(appID string) *core.CliConfig {
 	return &core.CliConfig{
-		AppID: appID, AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: appID, AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/doc/docs_create_test.go b/shortcuts/doc/docs_create_test.go
index f5002ebb13..31fe97e918 100644
--- a/shortcuts/doc/docs_create_test.go
+++ b/shortcuts/doc/docs_create_test.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -309,7 +310,7 @@ func docsCreateTestConfig(t *testing.T, userOpenID string) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:      "test-docs-create-" + suffix,
 		AppSecret:  "secret-docs-create-" + suffix,
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: userOpenID,
 	}
 }
diff --git a/shortcuts/drive/drive_import_test.go b/shortcuts/drive/drive_import_test.go
index 4e71607936..de873f6756 100644
--- a/shortcuts/drive/drive_import_test.go
+++ b/shortcuts/drive/drive_import_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -571,10 +572,10 @@ func driveImportMockEnv(t *testing.T, reg *httpmock.Registry, ticket string, pol
 }
 
 // driveImportTestConfig builds a CliConfig for the import fallback tests.
-// The brand defaults to BrandFeishu when omitted; pass core.BrandLark to
+// The brand defaults to BrandFeishu when omitted; pass brand.Lark to
 // exercise the larksuite.com branch of BuildResourceURL.
-func driveImportTestConfig(suffix string, brands ...core.LarkBrand) *core.CliConfig {
-	brand := core.BrandFeishu
+func driveImportTestConfig(suffix string, brands ...brand.Brand) *core.CliConfig {
+	brand := brand.Feishu
 	if len(brands) > 0 {
 		brand = brands[0]
 	}
@@ -680,7 +681,7 @@ func TestDriveImportFallbackURLWhenServerURLIsWhitespace(t *testing.T) {
 }
 
 func TestDriveImportFallbackURLForLarkBrand(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, driveImportTestConfig("lark-brand", core.BrandLark))
+	f, stdout, _, reg := cmdutil.TestFactory(t, driveImportTestConfig("lark-brand", brand.Lark))
 	driveImportMockEnv(t, reg, "ticket_lark", map[string]interface{}{
 		"token":      "doxcn_imported",
 		"type":       "docx",
diff --git a/shortcuts/drive/drive_io_test.go b/shortcuts/drive/drive_io_test.go
index 39a1a929f8..c9f91e6b89 100644
--- a/shortcuts/drive/drive_io_test.go
+++ b/shortcuts/drive/drive_io_test.go
@@ -18,6 +18,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -29,7 +30,7 @@ var driveTaskCheckPollMu sync.Mutex
 
 func driveTestConfig() *core.CliConfig {
 	return &core.CliConfig{
-		AppID: "drive-test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 }
 
@@ -77,7 +78,7 @@ func withDriveWorkingDir(t *testing.T, dir string) {
 func TestDriveUploadLargeFileUsesMultipart(t *testing.T) {
 	// Use a distinct AppID to avoid Lark SDK global token cache collision with other tests.
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -155,7 +156,7 @@ func TestDriveUploadLargeFileUsesMultipart(t *testing.T) {
 
 func TestDriveUploadLargeFileToWikiUsesMultipart(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-large-wiki-test", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-large-wiki-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -232,7 +233,7 @@ func TestDriveUploadLargeFileToWikiUsesMultipart(t *testing.T) {
 
 func TestDriveUploadLargeFileOverwriteUsesMultipart(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-large-overwrite-test", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-large-overwrite-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -302,7 +303,7 @@ func TestDriveUploadLargeFileOverwriteUsesMultipart(t *testing.T) {
 
 func TestDriveUploadLargeFileOverwriteReturnsVersionFromUploadFinish(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-large-overwrite-version-test", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-large-overwrite-version-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -367,7 +368,7 @@ func TestDriveUploadLargeFileOverwriteReturnsVersionFromUploadFinish(t *testing.
 
 func TestDriveUploadLargeFileOverwriteReturnsVersionFromUploadFinishAlias(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-large-overwrite-data-version-test", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-large-overwrite-data-version-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -432,7 +433,7 @@ func TestDriveUploadLargeFileOverwriteReturnsVersionFromUploadFinishAlias(t *tes
 
 func TestDriveUploadSmallFile(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-small-test", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-small-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -471,7 +472,7 @@ func TestDriveUploadSmallFile(t *testing.T) {
 
 func TestDriveUploadSmallFileOverwriteUsesFileToken(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-small-overwrite-test", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-small-overwrite-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -517,7 +518,7 @@ func TestDriveUploadSmallFileOverwriteUsesFileToken(t *testing.T) {
 
 func TestDriveUploadReturnsVersionFromDataVersionAlias(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-small-data-version-test", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-small-data-version-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -558,7 +559,7 @@ func TestDriveUploadReturnsVersionFromDataVersionAlias(t *testing.T) {
 
 func TestDriveUploadSmallFileToWiki(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-small-wiki-test", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-small-wiki-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -608,7 +609,7 @@ func TestDriveUploadSmallFileToWiki(t *testing.T) {
 
 func TestDriveUploadUsesMetaURLForExplorerParent(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-explorer-meta-url", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-explorer-meta-url", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -659,7 +660,7 @@ func TestDriveUploadUsesMetaURLForExplorerParent(t *testing.T) {
 
 func TestDriveUploadUsesMetaURLForWikiParent(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-wiki-meta-url", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-wiki-meta-url", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -707,7 +708,7 @@ func TestDriveUploadUsesMetaURLForWikiParent(t *testing.T) {
 
 func TestDriveUploadSmallFileAPIError(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-small-err", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-small-err", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -743,7 +744,7 @@ func TestDriveUploadSmallFileAPIError(t *testing.T) {
 
 func TestDriveUploadSmallFileNoToken(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-small-notoken", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-small-notoken", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -780,7 +781,7 @@ func TestDriveUploadSmallFileNoToken(t *testing.T) {
 
 func TestDriveUploadSmallFileInvalidJSON(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-small-json", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-small-json", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -814,7 +815,7 @@ func TestDriveUploadSmallFileInvalidJSON(t *testing.T) {
 
 func TestDriveUploadPrepareInvalidResponse(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-prepare-bad", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-prepare-bad", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -860,7 +861,7 @@ func TestDriveUploadPrepareInvalidResponse(t *testing.T) {
 
 func TestDriveUploadPartAPIError(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-part-err", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-part-err", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -922,7 +923,7 @@ func TestDriveUploadPartAPIError(t *testing.T) {
 
 func TestDriveUploadPartInvalidJSON(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-part-json", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-part-json", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -974,7 +975,7 @@ func TestDriveUploadPartInvalidJSON(t *testing.T) {
 
 func TestDriveUploadFinishNoToken(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-finish-notoken", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-finish-notoken", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
@@ -1035,7 +1036,7 @@ func TestDriveUploadFinishNoToken(t *testing.T) {
 
 func TestDriveUploadWithCustomName(t *testing.T) {
 	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-name-test", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-upload-name-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
 
diff --git a/shortcuts/drive/drive_permission_grant_test.go b/shortcuts/drive/drive_permission_grant_test.go
index 122b5aa109..88c9f134ee 100644
--- a/shortcuts/drive/drive_permission_grant_test.go
+++ b/shortcuts/drive/drive_permission_grant_test.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -252,7 +253,7 @@ func drivePermissionGrantTestConfig(t *testing.T, userOpenID string) *core.CliCo
 	return &core.CliConfig{
 		AppID:      "drive-permission-test-" + suffix,
 		AppSecret:  "drive-permission-secret-" + suffix,
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: userOpenID,
 	}
 }
diff --git a/shortcuts/drive/drive_push_test.go b/shortcuts/drive/drive_push_test.go
index 21c57e6781..ce5e3f8f9d 100644
--- a/shortcuts/drive/drive_push_test.go
+++ b/shortcuts/drive/drive_push_test.go
@@ -16,6 +16,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -2100,7 +2101,7 @@ func TestDrivePushMirrorsEmptyDirectories(t *testing.T) {
 // pattern).
 func TestDrivePushUploadsLargeFileViaMultipart(t *testing.T) {
 	pushTestConfig := &core.CliConfig{
-		AppID: "drive-push-multipart-test", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-push-multipart-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, pushTestConfig)
 
diff --git a/shortcuts/drive/drive_sync_test.go b/shortcuts/drive/drive_sync_test.go
index 70104a2f37..90f1436693 100644
--- a/shortcuts/drive/drive_sync_test.go
+++ b/shortcuts/drive/drive_sync_test.go
@@ -18,6 +18,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -192,7 +193,7 @@ func (r *driveSyncReadThenError) Read(p []byte) (int, error) {
 // remote version.
 func TestDriveSyncRemoteWinsPullsNewRemoteAndPushesNewLocal(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-remote-wins", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-remote-wins", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -313,7 +314,7 @@ func TestDriveSyncRemoteWinsPullsNewRemoteAndPushesNewLocal(t *testing.T) {
 
 func TestDriveSyncAbortsAfterNewRemoteDownloadForbidden(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-forbidden", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-forbidden", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -380,7 +381,7 @@ func TestDriveSyncAbortsAfterNewRemoteDownloadForbidden(t *testing.T) {
 // pushes the local version over the remote file.
 func TestDriveSyncLocalWinsPushesOverRemote(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-local-wins", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-local-wins", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -455,7 +456,7 @@ func TestDriveSyncLocalWinsPushesOverRemote(t *testing.T) {
 // and then downloads the remote version to the original path.
 func TestDriveSyncKeepBothRenamesLocalAndPullsRemote(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-keep-both", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-keep-both", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -557,7 +558,7 @@ func TestDriveSyncKeepBothRenamesLocalAndPullsRemote(t *testing.T) {
 // local file has been renamed.
 func TestDriveSyncKeepBothRollsBackRenameOnPullFailure(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-keep-both-rollback", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-keep-both-rollback", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -627,7 +628,7 @@ func TestDriveSyncKeepBothRollsBackRenameOnPullFailure(t *testing.T) {
 // available and the diff contains modified entries.
 func TestDriveSyncAskConflictFailsBeforeWritesWithoutStdin(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-ask-eof", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-ask-eof", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -721,7 +722,7 @@ func TestDriveSyncFailsOnDuplicateRemoteFiles(t *testing.T) {
 // the diff against the same duplicate-remote selection used during execution.
 func TestDriveSyncUsesResolvedDuplicateTargetForDiff(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-duplicate-resolution", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-duplicate-resolution", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -784,7 +785,7 @@ func TestDriveSyncUsesResolvedDuplicateTargetForDiff(t *testing.T) {
 // overwrites on nested files keep parent_node aligned with the file's parent.
 func TestDriveSyncLocalWinsNestedFileUsesParentFolderToken(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-local-wins-nested", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-local-wins-nested", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -871,7 +872,7 @@ func TestDriveSyncLocalWinsNestedFileUsesParentFolderToken(t *testing.T) {
 // instead of being silently dropped.
 func TestDriveSyncNewLocalDisappearanceIsReported(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-new-local-disappeared", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-new-local-disappeared", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -924,7 +925,7 @@ func TestDriveSyncNewLocalDisappearanceIsReported(t *testing.T) {
 // classifies files by modified_time instead of SHA-256 hash.
 func TestDriveSyncQuickModeUsesModifiedTime(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-quick", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-quick", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -1011,7 +1012,7 @@ func TestDriveSyncQuickModeUsesModifiedTime(t *testing.T) {
 // action even when the file bytes are already identical.
 func TestDriveSyncQuickModeMTimeMismatchStillTriggersWrites(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-quick-mismatch", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-quick-mismatch", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -1074,7 +1075,7 @@ func TestDriveSyncQuickModeMTimeMismatchStillTriggersWrites(t *testing.T) {
 // are identical, +sync reports zero pulled/pushed items.
 func TestDriveSyncNoChangesReportsEmptyItems(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-no-changes", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-no-changes", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -1455,7 +1456,7 @@ func TestDriveSyncRollbackRenamedLocalSurfacesStatFailure(t *testing.T) {
 
 func TestDriveSyncAskConflictEOFDuringExecuteReportsFailedItem(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-ask-exec-eof", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-ask-exec-eof", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 	f.IOStreams.In = strings.NewReader("")
@@ -1521,7 +1522,7 @@ func TestDriveSyncAskConflictEOFDuringExecuteReportsFailedItem(t *testing.T) {
 
 func TestDriveSyncAskConflictEOFDuringPlanningPreventsAnyWrites(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-ask-plan-eof", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-ask-plan-eof", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 	f.IOStreams.In = strings.NewReader("")
@@ -1619,7 +1620,7 @@ func TestDriveSyncDryRunQuickAcceptsMetadataOnlyScope(t *testing.T) {
 
 func TestDriveSyncPreflightsActionScopesBeforeListing(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-download-scope-only", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-download-scope-only", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, _ := cmdutil.TestFactory(t, syncTestConfig)
 	f.Credential = credential.NewCredentialProvider(nil, nil, &driveStatusScopedTokenResolver{scopes: "drive:drive.metadata:readonly drive:file:download"}, nil)
@@ -1669,7 +1670,7 @@ func TestDriveSyncPreflightsActionScopesBeforeListing(t *testing.T) {
 
 func TestDriveSyncAskConflictSkipReportsSkippedItem(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-ask-skip", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-ask-skip", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 	f.IOStreams.In = strings.NewReader("skip\n")
@@ -1725,7 +1726,7 @@ func TestDriveSyncAskConflictSkipReportsSkippedItem(t *testing.T) {
 
 func TestDriveSyncReportsNewRemoteDownloadFailure(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-new-remote-fail", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-new-remote-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 	f.FileIOProvider = &failSaveProvider{inner: f.FileIOProvider, failSuffix: filepath.Join("local", "d.txt"), err: fmt.Errorf("save failed")}
@@ -1776,7 +1777,7 @@ func TestDriveSyncReportsNewRemoteDownloadFailure(t *testing.T) {
 
 func TestDriveSyncReportsNewLocalEnsureFailure(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-new-local-ensure-fail", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-new-local-ensure-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -1824,7 +1825,7 @@ func TestDriveSyncReportsNewLocalEnsureFailure(t *testing.T) {
 
 func TestDriveSyncReportsNewLocalUploadFailure(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-new-local-upload-fail", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-new-local-upload-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -1872,7 +1873,7 @@ func TestDriveSyncReportsNewLocalUploadFailure(t *testing.T) {
 
 func TestDriveSyncLocalWinsReportsUploadFailure(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-local-wins-upload-fail", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-local-wins-upload-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -1933,7 +1934,7 @@ func TestDriveSyncLocalWinsReportsUploadFailure(t *testing.T) {
 
 func TestDriveSyncKeepBothReportsRenameFailure(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-keep-both-rename-fail", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-keep-both-rename-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -2263,7 +2264,7 @@ func TestDriveSyncExecuteUnknownConflictStrategySkipsModifiedFile(t *testing.T)
 
 func TestDriveSyncModifiedFileDisappearingBeforeExecuteIsSkipped(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-modified-disappears", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-modified-disappears", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 	f.FileIOProvider = &deleteOnCloseProvider{
@@ -2323,7 +2324,7 @@ func TestDriveSyncModifiedFileDisappearingBeforeExecuteIsSkipped(t *testing.T) {
 
 func TestDriveSyncRemoteWinsReportsModifiedPullFailure(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-remote-wins-pull-fail", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-remote-wins-pull-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 	f.FileIOProvider = &failSaveProvider{inner: f.FileIOProvider, failSuffix: filepath.Join("local", "a.txt"), err: fmt.Errorf("save failed")}
@@ -2378,7 +2379,7 @@ func TestDriveSyncRemoteWinsReportsModifiedPullFailure(t *testing.T) {
 
 func TestDriveSyncKeepBothReportsRollbackFailureAfterPullError(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-keep-both-rollback-fail", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-keep-both-rollback-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -2468,7 +2469,7 @@ func TestDriveSyncStatusRemoteFilesUsesStableTokens(t *testing.T) {
 
 func TestDriveSyncLocalWinsNestedFileReportsParentEnsureFailure(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-local-wins-parent-fail", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-local-wins-parent-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -2532,7 +2533,7 @@ func TestDriveSyncLocalWinsNestedFileReportsParentEnsureFailure(t *testing.T) {
 // shortcuts) are silently skipped rather than causing a panic or error.
 func TestDriveSyncSkipsNonFileRemoteEntries(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-skip-nonfile", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-skip-nonfile", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -2699,7 +2700,7 @@ func TestDriveSyncKeepBothReportsSuffixError(t *testing.T) {
 // the failure is reported via the partial-failure signal.
 func TestDriveSyncKeepBothRollbackSucceedsOnPullFailure(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-keep-both-rollback-pull-fail", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-keep-both-rollback-pull-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 	f.FileIOProvider = &failSaveProvider{inner: f.FileIOProvider, failSuffix: filepath.Join("local", "a.txt"), err: fmt.Errorf("save failed")}
@@ -2775,7 +2776,7 @@ func TestDriveSyncKeepBothRollbackSucceedsOnPullFailure(t *testing.T) {
 // falls back to remoteEntriesForPush to find the existing token.
 func TestDriveSyncLocalWinsFallbackToRemoteEntriesForPush(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-local-wins-fallback", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-local-wins-fallback", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -2852,7 +2853,7 @@ func TestDriveSyncLocalWinsFallbackToRemoteEntriesForPush(t *testing.T) {
 // directories are created on Drive during +sync, mirroring +push behavior.
 func TestDriveSyncCreatesEmptyLocalDirectoriesOnDrive(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-empty-dirs", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-empty-dirs", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -2910,7 +2911,7 @@ func TestDriveSyncCreatesEmptyLocalDirectoriesOnDrive(t *testing.T) {
 // freshly returned token rather than the stale existingToken.
 func TestDriveSyncLocalWinsUsesReturnedTokenOnUploadFailure(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-local-wins-partial-token", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-local-wins-partial-token", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -2984,7 +2985,7 @@ func TestDriveSyncLocalWinsUsesReturnedTokenOnUploadFailure(t *testing.T) {
 // the remote in a broken mixed-type state.
 func TestDriveSyncRejectsPathTypeConflict(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-type-conflict", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-type-conflict", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
@@ -3035,7 +3036,7 @@ func TestDriveSyncRejectsPathTypeConflict(t *testing.T) {
 // broken mixed-type state.
 func TestDriveSyncRejectsLocalDirVsRemoteFileTypeConflict(t *testing.T) {
 	syncTestConfig := &core.CliConfig{
-		AppID: "drive-sync-dir-vs-file-conflict", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "drive-sync-dir-vs-file-conflict", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
 
diff --git a/shortcuts/event/processor_test.go b/shortcuts/event/processor_test.go
index 8ec95a6f8c..0c25fa96b7 100644
--- a/shortcuts/event/processor_test.go
+++ b/shortcuts/event/processor_test.go
@@ -16,6 +16,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -124,7 +125,7 @@ func newSubscribeTestRuntime(t *testing.T) *common.RuntimeContext {
 		Config: &core.CliConfig{
 			AppID:     "cli_event_test",
 			AppSecret: "secret",
-			Brand:     core.BrandFeishu,
+			Brand:     brand.Feishu,
 		},
 		Factory: &cmdutil.Factory{
 			IOStreams: cmdutil.NewIOStreams(strings.NewReader(""), &out, &errOut),
diff --git a/shortcuts/event/subscribe.go b/shortcuts/event/subscribe.go
index 8a36da2b8d..a122fbd549 100644
--- a/shortcuts/event/subscribe.go
+++ b/shortcuts/event/subscribe.go
@@ -14,8 +14,8 @@ import (
 	"strings"
 	"syscall"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/lockfile"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
@@ -246,7 +246,7 @@ var EventSubscribe = common.Shortcut{
 		}
 
 		// --- WebSocket ---
-		domain := core.ResolveEndpoints(runtime.Config.Brand).Open
+		domain := brand.ResolveEndpoints(runtime.Config.Brand).Open
 
 		info(fmt.Sprintf("%sConnecting to Lark event WebSocket...%s", output.Cyan, output.Reset))
 		if eventTypeFilter != nil {
diff --git a/shortcuts/event/subscribe_test.go b/shortcuts/event/subscribe_test.go
index cf8f0dce21..ce0867a549 100644
--- a/shortcuts/event/subscribe_test.go
+++ b/shortcuts/event/subscribe_test.go
@@ -6,17 +6,17 @@ package event
 import (
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/brand"
 	lark "github.com/larksuite/oapi-sdk-go/v3"
 )
 
 // The resolver's Open host must equal the SDK's per-brand WS base URL;
 // fails if the SDK constants ever drift from the resolver.
 func TestWSDomainMatchesResolver(t *testing.T) {
-	if got, want := core.ResolveEndpoints(core.BrandFeishu).Open, lark.FeishuBaseUrl; got != want {
+	if got, want := brand.ResolveEndpoints(brand.Feishu).Open, lark.FeishuBaseUrl; got != want {
 		t.Errorf("feishu WS domain = %q, want SDK %q", got, want)
 	}
-	if got, want := core.ResolveEndpoints(core.BrandLark).Open, lark.LarkBaseUrl; got != want {
+	if got, want := brand.ResolveEndpoints(brand.Lark).Open, lark.LarkBaseUrl; got != want {
 		t.Errorf("lark WS domain = %q, want SDK %q", got, want)
 	}
 }
diff --git a/shortcuts/im/convert_lib/content_convert.go b/shortcuts/im/convert_lib/content_convert.go
index 1a1ee3fb5b..37c7431414 100644
--- a/shortcuts/im/convert_lib/content_convert.go
+++ b/shortcuts/im/convert_lib/content_convert.go
@@ -11,7 +11,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/larksuite/cli/internal/core"
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/imcontent"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -222,7 +222,7 @@ func formatMessageItem(m map[string]interface{}, runtime *common.RuntimeContext,
 	return msg
 }
 
-func assembleMessageAppLink(m map[string]interface{}, brand core.LarkBrand) string {
+func assembleMessageAppLink(m map[string]interface{}, brand brandpkg.Brand) string {
 	domain := resolveAppLinkDomain(brand)
 	if domain == "" {
 		return ""
@@ -357,8 +357,8 @@ func normalizeMessagePosition(v interface{}) (string, bool) {
 	}
 }
 
-func resolveAppLinkDomain(brand core.LarkBrand) string {
-	appLink := core.ResolveEndpoints(brand).AppLink
+func resolveAppLinkDomain(brand brandpkg.Brand) string {
+	appLink := brandpkg.ResolveEndpoints(brand).AppLink
 	u, err := url.Parse(appLink)
 	if err != nil {
 		return ""
diff --git a/shortcuts/im/convert_lib/content_media_misc_test.go b/shortcuts/im/convert_lib/content_media_misc_test.go
index 0fe7efd290..9b2e493883 100644
--- a/shortcuts/im/convert_lib/content_media_misc_test.go
+++ b/shortcuts/im/convert_lib/content_media_misc_test.go
@@ -9,6 +9,7 @@ import (
 	"net/url"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -151,19 +152,19 @@ func TestFormatMessageItem_UpdateTime_UnchangedMessage(t *testing.T) {
 }
 
 func TestResolveAppLinkDomain(t *testing.T) {
-	if got := resolveAppLinkDomain(core.BrandFeishu); got != "applink.feishu.cn" {
+	if got := resolveAppLinkDomain(brand.Feishu); got != "applink.feishu.cn" {
 		t.Fatalf("resolveAppLinkDomain(feishu) = %q", got)
 	}
-	if got := resolveAppLinkDomain(core.BrandLark); got != "applink.larksuite.com" {
+	if got := resolveAppLinkDomain(brand.Lark); got != "applink.larksuite.com" {
 		t.Fatalf("resolveAppLinkDomain(lark) = %q", got)
 	}
-	if got := resolveAppLinkDomain(core.LarkBrand("other")); got != "applink.feishu.cn" {
+	if got := resolveAppLinkDomain(brand.Brand("other")); got != "applink.feishu.cn" {
 		t.Fatalf("resolveAppLinkDomain(other) = %q, want feishu", got)
 	}
 }
 
 func TestFormatMessageItem_MessageAppLink_PassThrough(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: core.BrandFeishu}}
+	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Feishu}}
 	raw := map[string]interface{}{
 		"msg_type":         "text",
 		"message_id":       "om_123",
@@ -181,7 +182,7 @@ func TestFormatMessageItem_MessageAppLink_PassThrough(t *testing.T) {
 }
 
 func TestFormatMessageItem_MessageAppLink_AssembleChat(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: core.BrandFeishu}}
+	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Feishu}}
 	raw := map[string]interface{}{
 		"msg_type":         "text",
 		"message_id":       "om_123",
@@ -199,7 +200,7 @@ func TestFormatMessageItem_MessageAppLink_AssembleChat(t *testing.T) {
 }
 
 func TestFormatMessageItem_MessageAppLink_AssembleThread(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: core.BrandLark}}
+	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Lark}}
 	raw := map[string]interface{}{
 		"msg_type":                "text",
 		"message_id":              "om_123",
@@ -222,7 +223,7 @@ func TestFormatMessageItem_MessageAppLink_AssembleThread(t *testing.T) {
 }
 
 func TestFormatMessageItem_MessageAppLink_FallbackToChatWhenThreadPositionInvalid(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: core.BrandFeishu}}
+	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Feishu}}
 	raw := map[string]interface{}{
 		"msg_type":                "text",
 		"message_id":              "om_123",
@@ -242,7 +243,7 @@ func TestFormatMessageItem_MessageAppLink_FallbackToChatWhenThreadPositionInvali
 }
 
 func TestFormatMessageItem_MessageAppLink_BrandUnknownDefaultsToFeishu(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: core.LarkBrand("other")}}
+	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Brand("other")}}
 	raw := map[string]interface{}{
 		"msg_type":         "text",
 		"message_id":       "om_123",
@@ -356,7 +357,7 @@ func TestAssembleMessageAppLink_EncodesQueryValues(t *testing.T) {
 		"chat_id":          "oc_1+2/3",
 		"message_position": 12,
 	}
-	gotChat := assembleMessageAppLink(chat, core.BrandFeishu)
+	gotChat := assembleMessageAppLink(chat, brand.Feishu)
 	assertURLHasQuery(t, gotChat, "applink.feishu.cn", "/client/chat/open", map[string]string{
 		"openChatId": "oc_1+2/3",
 		"position":   "12",
@@ -368,7 +369,7 @@ func TestAssembleMessageAppLink_EncodesQueryValues(t *testing.T) {
 		"thread_id":               "omt_1+2/3",
 		"thread_message_position": -1,
 	}
-	gotThread := assembleMessageAppLink(thread, core.BrandFeishu)
+	gotThread := assembleMessageAppLink(thread, brand.Feishu)
 	assertURLHasQuery(t, gotThread, "applink.feishu.cn", "/client/thread/open", map[string]string{
 		"open_thread_id":  "omt_1+2/3",
 		"open_chat_id":    "oc_1+2/3",
@@ -379,7 +380,7 @@ func TestAssembleMessageAppLink_EncodesQueryValues(t *testing.T) {
 }
 
 func TestFormatMessageItem_MessageAppLink_NonStringDoesNotLeakNull(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: core.BrandFeishu}}
+	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Feishu}}
 	raw := map[string]interface{}{
 		"msg_type":         "text",
 		"message_id":       "om_123",
@@ -415,7 +416,7 @@ func TestFormatMessageItem_MessageAppLink_RuntimeNilNoAssemble(t *testing.T) {
 }
 
 func TestFormatMessageItem_MessageAppLink_MissingFieldsNoPanic(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: core.BrandFeishu}}
+	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Feishu}}
 	raw := map[string]interface{}{
 		"msg_type":    "text",
 		"message_id":  "om_123",
diff --git a/shortcuts/im/convert_lib/runtime_test.go b/shortcuts/im/convert_lib/runtime_test.go
index 5ab8ac154c..8eb493a712 100644
--- a/shortcuts/im/convert_lib/runtime_test.go
+++ b/shortcuts/im/convert_lib/runtime_test.go
@@ -13,6 +13,7 @@ import (
 	"testing"
 	"unsafe"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
@@ -66,7 +67,7 @@ func newBotConvertlibRuntime(t *testing.T, rt http.RoundTripper) *common.Runtime
 	cfg := &core.CliConfig{
 		AppID:     "test-app",
 		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 	testCred := credential.NewCredentialProvider(nil, nil, &staticConvertlibTokenResolver{}, nil)
 	runtime := &common.RuntimeContext{
diff --git a/shortcuts/im/helpers_network_test.go b/shortcuts/im/helpers_network_test.go
index 9d75fcf62a..b464536880 100644
--- a/shortcuts/im/helpers_network_test.go
+++ b/shortcuts/im/helpers_network_test.go
@@ -23,6 +23,7 @@ import (
 	lark "github.com/larksuite/oapi-sdk-go/v3"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -88,7 +89,7 @@ func newBotShortcutRuntime(t *testing.T, rt http.RoundTripper) *common.RuntimeCo
 	cfg := &core.CliConfig{
 		AppID:     "test-app",
 		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 	testCred := credential.NewCredentialProvider(nil, nil, &staticShortcutTokenResolver{}, nil)
 	runtime := &common.RuntimeContext{
diff --git a/shortcuts/im/im_feed_shortcut_test.go b/shortcuts/im/im_feed_shortcut_test.go
index fad51359df..fc597810c6 100644
--- a/shortcuts/im/im_feed_shortcut_test.go
+++ b/shortcuts/im/im_feed_shortcut_test.go
@@ -14,6 +14,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
@@ -568,7 +569,7 @@ func TestImFeedShortcutListDryRunIncludesNonEmptyPageToken(t *testing.T) {
 
 func TestImFeedShortcutListHelpDoesNotTreatDetailAsArgName(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "app", AppSecret: "secret", Brand: core.BrandFeishu,
+		AppID: "app", AppSecret: "secret", Brand: brand.Feishu,
 	})
 	parent := &cobra.Command{Use: "im"}
 	ImFeedShortcutList.Mount(parent, f)
diff --git a/shortcuts/mail/draft/service_test.go b/shortcuts/mail/draft/service_test.go
index a005113166..7ddcfb1521 100644
--- a/shortcuts/mail/draft/service_test.go
+++ b/shortcuts/mail/draft/service_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/spf13/cobra"
 	"github.com/zalando/go-keyring"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -26,7 +27,7 @@ func draftServiceTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Re
 	cfg := &core.CliConfig{
 		AppID:      "test-app",
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_testuser",
 		UserName:   "Test User",
 	}
diff --git a/shortcuts/mail/large_attachment.go b/shortcuts/mail/large_attachment.go
index 97536fa6a2..7ba7c75f14 100644
--- a/shortcuts/mail/large_attachment.go
+++ b/shortcuts/mail/large_attachment.go
@@ -14,9 +14,9 @@ import (
 	"strings"
 	"time"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/shortcuts/common"
 	draftpkg "github.com/larksuite/cli/shortcuts/mail/draft"
 	"github.com/larksuite/cli/shortcuts/mail/emlbuilder"
@@ -197,8 +197,8 @@ func uploadLargeAttachments(ctx context.Context, runtime *common.RuntimeContext,
 // buildLargeAttachmentPreviewURL builds the download/preview URL for a large
 // attachment token. The domain is derived from the CLI's configured endpoint
 // (e.g. open.feishu.cn → www.feishu.cn).
-func buildLargeAttachmentPreviewURL(brand core.LarkBrand, fileToken string) string {
-	ep := core.ResolveEndpoints(brand)
+func buildLargeAttachmentPreviewURL(brand brandpkg.Brand, fileToken string) string {
+	ep := brandpkg.ResolveEndpoints(brand)
 	host := strings.TrimPrefix(ep.Open, "https://")
 	host = strings.TrimPrefix(host, "http://")
 	mainDomain := strings.TrimPrefix(host, "open.")
@@ -246,8 +246,8 @@ const (
 //
 //   - BrandLark    → "Lark" (same in English and Chinese)
 //   - BrandFeishu  → "飞书" for zh languages, "Feishu" for others
-func brandDisplayName(brand core.LarkBrand, lang string) string {
-	if brand == core.BrandLark {
+func brandDisplayName(brand brandpkg.Brand, lang string) string {
+	if brand == brandpkg.Lark {
 		return "Lark"
 	}
 	if strings.HasPrefix(lang, "zh") {
@@ -256,7 +256,7 @@ func brandDisplayName(brand core.LarkBrand, lang string) string {
 	return "Feishu"
 }
 
-func buildLargeAttachmentItems(brand core.LarkBrand, lang string, results []largeAttachmentResult) string {
+func buildLargeAttachmentItems(brand brandpkg.Brand, lang string, results []largeAttachmentResult) string {
 	if len(results) == 0 {
 		return ""
 	}
@@ -265,7 +265,7 @@ func buildLargeAttachmentItems(brand core.LarkBrand, lang string, results []larg
 		downloadText = "下载"
 	}
 	iconCDN := iconCDNCN
-	if brand == core.BrandLark {
+	if brand == brandpkg.Lark {
 		iconCDN = iconCDNEN
 	}
 	var items strings.Builder
@@ -282,7 +282,7 @@ func buildLargeAttachmentItems(brand core.LarkBrand, lang string, results []larg
 	return items.String()
 }
 
-func buildLargeAttachmentHTML(brand core.LarkBrand, lang string, results []largeAttachmentResult) string {
+func buildLargeAttachmentHTML(brand brandpkg.Brand, lang string, results []largeAttachmentResult) string {
 	if len(results) == 0 {
 		return ""
 	}
@@ -298,7 +298,7 @@ func buildLargeAttachmentHTML(brand core.LarkBrand, lang string, results []large
 	return fmt.Sprintf(largeAttContainerTpl, timestamp, title, buildLargeAttachmentItems(brand, lang, results))
 }
 
-func buildLargeAttachmentPlainText(brand core.LarkBrand, lang string, results []largeAttachmentResult) string {
+func buildLargeAttachmentPlainText(brand brandpkg.Brand, lang string, results []largeAttachmentResult) string {
 	if len(results) == 0 {
 		return ""
 	}
@@ -487,7 +487,7 @@ func ensureLargeAttachmentCards(runtime *common.RuntimeContext, snapshot *draftp
 		return
 	}
 
-	brand := core.BrandFeishu
+	brand := brandpkg.Feishu
 	if runtime.Config != nil {
 		brand = runtime.Config.Brand
 	}
@@ -734,7 +734,7 @@ func flattenSnapshotParts(root *draftpkg.Part) []*draftpkg.Part {
 // container, new items are appended inside that container (maintaining a
 // single container, matching the desktop client). Otherwise a new
 // container is created and inserted before the quote block (or appended).
-func injectLargeAttachmentHTMLIntoSnapshot(snapshot *draftpkg.DraftSnapshot, brand core.LarkBrand, lang string, results []largeAttachmentResult) {
+func injectLargeAttachmentHTMLIntoSnapshot(snapshot *draftpkg.DraftSnapshot, brand brandpkg.Brand, lang string, results []largeAttachmentResult) {
 	if len(results) == 0 {
 		return
 	}
diff --git a/shortcuts/mail/large_attachment_test.go b/shortcuts/mail/large_attachment_test.go
index a0aa34ada7..9d36bf40df 100644
--- a/shortcuts/mail/large_attachment_test.go
+++ b/shortcuts/mail/large_attachment_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/vfs/localfileio"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -105,12 +106,12 @@ func TestMaxLargeAttachmentSize(t *testing.T) {
 
 func TestBuildLargeAttachmentPreviewURL(t *testing.T) {
 	tests := []struct {
-		brand core.LarkBrand
+		brand brandpkg.Brand
 		token string
 		want  string
 	}{
-		{core.BrandFeishu, "abc123", "https://www.feishu.cn/mail/page/attachment?token=abc123"},
-		{core.BrandLark, "xyz789", "https://www.larksuite.com/mail/page/attachment?token=xyz789"},
+		{brandpkg.Feishu, "abc123", "https://www.feishu.cn/mail/page/attachment?token=abc123"},
+		{brandpkg.Lark, "xyz789", "https://www.larksuite.com/mail/page/attachment?token=xyz789"},
 	}
 	for _, tt := range tests {
 		got := buildLargeAttachmentPreviewURL(tt.brand, tt.token)
@@ -125,7 +126,7 @@ func TestBuildLargeAttachmentHTML(t *testing.T) {
 		{FileName: "report.pdf", FileSize: 50 * 1024 * 1024, FileToken: "tok_abc"},
 		{FileName: "data.zip", FileSize: 100 * 1024 * 1024, FileToken: "tok_xyz"},
 	}
-	html := buildLargeAttachmentHTML(core.BrandFeishu, "en_us", results)
+	html := buildLargeAttachmentHTML(brandpkg.Feishu, "en_us", results)
 
 	// Check it contains the container ID prefix
 	if !strings.Contains(html, "large-file-area-") {
@@ -155,14 +156,14 @@ func TestBuildLargeAttachmentHTML_BrandAwareTitle(t *testing.T) {
 	results := []largeAttachmentResult{{FileName: "a.pdf", FileSize: 1024, FileToken: "tok"}}
 
 	cases := []struct {
-		brand     core.LarkBrand
+		brand     brandpkg.Brand
 		lang      string
 		wantTitle string
 	}{
-		{core.BrandFeishu, "zh_cn", "来自飞书邮箱的超大附件"},
-		{core.BrandFeishu, "en_us", "Large file from Feishu Mail"},
-		{core.BrandLark, "zh_cn", "来自Lark邮箱的超大附件"},
-		{core.BrandLark, "en_us", "Large file from Lark Mail"},
+		{brandpkg.Feishu, "zh_cn", "来自飞书邮箱的超大附件"},
+		{brandpkg.Feishu, "en_us", "Large file from Feishu Mail"},
+		{brandpkg.Lark, "zh_cn", "来自Lark邮箱的超大附件"},
+		{brandpkg.Lark, "en_us", "Large file from Lark Mail"},
 	}
 	for _, tc := range cases {
 		html := buildLargeAttachmentHTML(tc.brand, tc.lang, results)
@@ -174,15 +175,15 @@ func TestBuildLargeAttachmentHTML_BrandAwareTitle(t *testing.T) {
 
 func TestBrandDisplayName(t *testing.T) {
 	cases := []struct {
-		brand core.LarkBrand
+		brand brandpkg.Brand
 		lang  string
 		want  string
 	}{
-		{core.BrandFeishu, "zh_cn", "飞书"},
-		{core.BrandFeishu, "en_us", "Feishu"},
-		{core.BrandFeishu, "", "Feishu"},
-		{core.BrandLark, "zh_cn", "Lark"},
-		{core.BrandLark, "en_us", "Lark"},
+		{brandpkg.Feishu, "zh_cn", "飞书"},
+		{brandpkg.Feishu, "en_us", "Feishu"},
+		{brandpkg.Feishu, "", "Feishu"},
+		{brandpkg.Lark, "zh_cn", "Lark"},
+		{brandpkg.Lark, "en_us", "Lark"},
 	}
 	for _, tc := range cases {
 		if got := brandDisplayName(tc.brand, tc.lang); got != tc.want {
@@ -192,7 +193,7 @@ func TestBrandDisplayName(t *testing.T) {
 }
 
 func TestBuildLargeAttachmentHTML_Empty(t *testing.T) {
-	html := buildLargeAttachmentHTML(core.BrandFeishu, "en_us", nil)
+	html := buildLargeAttachmentHTML(brandpkg.Feishu, "en_us", nil)
 	if html != "" {
 		t.Errorf("expected empty string for nil results, got %q", html)
 	}
@@ -202,7 +203,7 @@ func TestBuildLargeAttachmentHTML_EscapesSpecialChars(t *testing.T) {
 	results := []largeAttachmentResult{
 		{FileName: `file<script>alert("xss")</script>.txt`, FileSize: 100, FileToken: `tok"inject`},
 	}
-	html := buildLargeAttachmentHTML(core.BrandFeishu, "en_us", results)
+	html := buildLargeAttachmentHTML(brandpkg.Feishu, "en_us", results)
 	if strings.Contains(html, "<script>") {
 		t.Error("HTML injection: <script> not escaped")
 	}
@@ -303,7 +304,7 @@ func TestEnsureLargeAttachmentCards_InjectsMissingCards(t *testing.T) {
 			Body:      []byte("<p>Hello</p>"),
 		},
 	}
-	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: core.BrandFeishu})
+	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: brandpkg.Feishu})
 	ensureLargeAttachmentCards(rt, snapshot)
 
 	html := string(snapshot.Body.Body)
@@ -344,7 +345,7 @@ func TestEnsureLargeAttachmentCards_NoDuplicateWhenCardExists(t *testing.T) {
 			Body:      []byte("<p>Hello</p>" + existingCard),
 		},
 	}
-	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: core.BrandFeishu})
+	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: brandpkg.Feishu})
 	originalHTML := string(snapshot.Body.Body)
 	ensureLargeAttachmentCards(rt, snapshot)
 
@@ -373,7 +374,7 @@ func TestEnsureLargeAttachmentCards_PartialMissing(t *testing.T) {
 			Body:      []byte("<p>Hello</p>" + existingCard),
 		},
 	}
-	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: core.BrandFeishu})
+	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: brandpkg.Feishu})
 	ensureLargeAttachmentCards(rt, snapshot)
 
 	html := string(snapshot.Body.Body)
@@ -425,7 +426,7 @@ func TestEnsureLargeAttachmentCards_PlainTextBodyInjectsDownloadInfo(t *testing.
 			Body:      []byte("plain text body"),
 		},
 	}
-	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: core.BrandFeishu})
+	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: brandpkg.Feishu})
 	ensureLargeAttachmentCards(rt, snapshot)
 
 	body := string(snapshot.Body.Body)
@@ -457,7 +458,7 @@ func TestEnsureLargeAttachmentCards_PlainTextNoDuplicate(t *testing.T) {
 			Body:      []byte(bodyWithToken),
 		},
 	}
-	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: core.BrandFeishu})
+	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: brandpkg.Feishu})
 	ensureLargeAttachmentCards(rt, snapshot)
 
 	if string(snapshot.Body.Body) != bodyWithToken {
@@ -470,7 +471,7 @@ func TestBuildLargeAttachmentPlainText(t *testing.T) {
 		{FileName: "report.pdf", FileSize: 26214400, FileToken: "tok_aaa"},
 		{FileName: "video.mp4", FileSize: 314572800, FileToken: "tok_bbb"},
 	}
-	text := buildLargeAttachmentPlainText(core.BrandFeishu, "zh_cn", results)
+	text := buildLargeAttachmentPlainText(brandpkg.Feishu, "zh_cn", results)
 	if !strings.Contains(text, "来自飞书邮箱的超大附件") {
 		t.Error("should contain Chinese title for Feishu brand")
 	}
@@ -493,7 +494,7 @@ func TestBuildLargeAttachmentPlainText(t *testing.T) {
 		t.Error("should contain Chinese download label")
 	}
 
-	textEN := buildLargeAttachmentPlainText(core.BrandLark, "en_us", results)
+	textEN := buildLargeAttachmentPlainText(brandpkg.Lark, "en_us", results)
 	if !strings.Contains(textEN, "Large file from Lark Mail") {
 		t.Error("should contain English title for Lark brand")
 	}
@@ -547,7 +548,7 @@ func TestInjectLargeAttachmentTextIntoSnapshot_ExistingHTMLBody(t *testing.T) {
 }
 
 func TestBuildLargeAttachmentPlainText_Empty(t *testing.T) {
-	text := buildLargeAttachmentPlainText(core.BrandFeishu, "zh_cn", nil)
+	text := buildLargeAttachmentPlainText(brandpkg.Feishu, "zh_cn", nil)
 	if text != "" {
 		t.Error("should return empty string for no results")
 	}
@@ -606,7 +607,7 @@ func TestInjectLargeAttachmentHTML_MergesIntoExistingContainer(t *testing.T) {
 	newResults := []largeAttachmentResult{
 		{FileName: "new_file.txt", FileSize: 26214400, FileToken: "tok_new"},
 	}
-	injectLargeAttachmentHTMLIntoSnapshot(snapshot, core.BrandFeishu, "zh_cn", newResults)
+	injectLargeAttachmentHTMLIntoSnapshot(snapshot, brandpkg.Feishu, "zh_cn", newResults)
 
 	html := string(snapshot.Body.Body)
 
@@ -643,7 +644,7 @@ func TestInjectLargeAttachmentHTML_CreatesContainerWhenNoneExists(t *testing.T)
 	results := []largeAttachmentResult{
 		{FileName: "file.txt", FileSize: 1024, FileToken: "tok_a"},
 	}
-	injectLargeAttachmentHTMLIntoSnapshot(snapshot, core.BrandFeishu, "zh_cn", results)
+	injectLargeAttachmentHTMLIntoSnapshot(snapshot, brandpkg.Feishu, "zh_cn", results)
 
 	html := string(snapshot.Body.Body)
 	if !strings.Contains(html, "large-file-area-") {
@@ -667,7 +668,7 @@ func TestInjectLargeAttachmentHTML_TwoInjectionsProduceSingleContainer(t *testin
 			Body:      []byte("<p>body</p>"),
 		},
 	}
-	brand := core.BrandFeishu
+	brand := brandpkg.Feishu
 	lang := "zh_cn"
 
 	// First injection (from ensureLargeAttachmentCards)
@@ -907,7 +908,7 @@ func TestInjectLargeAttachmentHTML_EmptyResults(t *testing.T) {
 		Body: &draftpkg.Part{MediaType: "text/html", Body: []byte("<p>hello</p>")},
 	}
 	original := string(snapshot.Body.Body)
-	injectLargeAttachmentHTMLIntoSnapshot(snapshot, core.BrandFeishu, "zh_cn", nil)
+	injectLargeAttachmentHTMLIntoSnapshot(snapshot, brandpkg.Feishu, "zh_cn", nil)
 	if string(snapshot.Body.Body) != original {
 		t.Error("empty results should not modify body")
 	}
@@ -918,7 +919,7 @@ func TestInjectLargeAttachmentHTML_NilBodyCreatesNew(t *testing.T) {
 	results := []largeAttachmentResult{
 		{FileName: "file.txt", FileSize: 1024, FileToken: "tok_a"},
 	}
-	injectLargeAttachmentHTMLIntoSnapshot(snapshot, core.BrandFeishu, "zh_cn", results)
+	injectLargeAttachmentHTMLIntoSnapshot(snapshot, brandpkg.Feishu, "zh_cn", results)
 	if snapshot.Body == nil {
 		t.Fatal("should create body part")
 	}
@@ -938,7 +939,7 @@ func TestInjectLargeAttachmentHTML_SkipsWhenNonNilBodyButNoHTMLPart(t *testing.T
 		Body: &draftpkg.Part{MediaType: "text/plain", Body: []byte("text only")},
 	}
 	original := string(snapshot.Body.Body)
-	injectLargeAttachmentHTMLIntoSnapshot(snapshot, core.BrandFeishu, "zh_cn",
+	injectLargeAttachmentHTMLIntoSnapshot(snapshot, brandpkg.Feishu, "zh_cn",
 		[]largeAttachmentResult{{FileName: "f.txt", FileSize: 100, FileToken: "tok"}})
 	if string(snapshot.Body.Body) != original {
 		t.Error("should not modify text/plain body when looking for HTML part")
@@ -981,7 +982,7 @@ func TestStatAttachmentFiles_FileNotFound(t *testing.T) {
 
 func TestBuildLargeAttachmentItems(t *testing.T) {
 	t.Run("empty results", func(t *testing.T) {
-		got := buildLargeAttachmentItems(core.BrandFeishu, "en_us", nil)
+		got := buildLargeAttachmentItems(brandpkg.Feishu, "en_us", nil)
 		if got != "" {
 			t.Errorf("expected empty string, got %q", got)
 		}
@@ -990,7 +991,7 @@ func TestBuildLargeAttachmentItems(t *testing.T) {
 		results := []largeAttachmentResult{
 			{FileName: "doc.pdf", FileSize: 1024, FileToken: "tok1"},
 		}
-		got := buildLargeAttachmentItems(core.BrandFeishu, "zh_cn", results)
+		got := buildLargeAttachmentItems(brandpkg.Feishu, "zh_cn", results)
 		if !strings.Contains(got, "下载") {
 			t.Error("should contain Chinese download text")
 		}
@@ -1002,7 +1003,7 @@ func TestBuildLargeAttachmentItems(t *testing.T) {
 		results := []largeAttachmentResult{
 			{FileName: "doc.pdf", FileSize: 1024, FileToken: "tok1"},
 		}
-		got := buildLargeAttachmentItems(core.BrandLark, "en_us", results)
+		got := buildLargeAttachmentItems(brandpkg.Lark, "en_us", results)
 		if !strings.Contains(got, "Download") {
 			t.Error("should contain English download text")
 		}
diff --git a/shortcuts/mail/mail_shortcut_test.go b/shortcuts/mail/mail_shortcut_test.go
index 4ae0f8d978..081e8f2543 100644
--- a/shortcuts/mail/mail_shortcut_test.go
+++ b/shortcuts/mail/mail_shortcut_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/spf13/cobra"
 	"github.com/zalando/go-keyring"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -25,7 +26,7 @@ func mailTestConfig() *core.CliConfig {
 	return &core.CliConfig{
 		AppID:      "test-app",
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_testuser",
 		UserName:   "Test User",
 	}
diff --git a/shortcuts/mail/mail_watch.go b/shortcuts/mail/mail_watch.go
index d01e75d78d..e63e050109 100644
--- a/shortcuts/mail/mail_watch.go
+++ b/shortcuts/mail/mail_watch.go
@@ -22,8 +22,8 @@ import (
 
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -413,7 +413,7 @@ var MailWatch = common.Shortcut{
 		eventDispatcher.InitConfig(larkevent.WithLogger(sdkLogger))
 		eventDispatcher.OnCustomizedEvent(mailEventType, rawHandler)
 
-		endpoints := core.ResolveEndpoints(runtime.Config.Brand)
+		endpoints := brand.ResolveEndpoints(runtime.Config.Brand)
 		domain := endpoints.Open
 
 		info("Connecting to Feishu event WebSocket...")
diff --git a/shortcuts/mail/signature_compose_test.go b/shortcuts/mail/signature_compose_test.go
index 9adf52a358..8ffbae8bf7 100644
--- a/shortcuts/mail/signature_compose_test.go
+++ b/shortcuts/mail/signature_compose_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -185,7 +186,7 @@ func TestAddSignatureImagesToBuilderWithImages(t *testing.T) {
 // tests that exercise signature API code paths (autoResolveSignatureID, resolveSignature).
 func newSigTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Registry) {
 	t.Helper()
-	cfg := &core.CliConfig{Brand: core.BrandFeishu, AppID: "cli_sigtest"}
+	cfg := &core.CliConfig{Brand: brand.Feishu, AppID: "cli_sigtest"}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	rt := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+test"}, cfg, f, core.AsUser)
 	return rt, reg
diff --git a/shortcuts/markdown/markdown_test.go b/shortcuts/markdown/markdown_test.go
index a1a0c5f71a..b4a576cebf 100644
--- a/shortcuts/markdown/markdown_test.go
+++ b/shortcuts/markdown/markdown_test.go
@@ -21,6 +21,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -31,13 +32,13 @@ import (
 
 func markdownTestConfig() *core.CliConfig {
 	return &core.CliConfig{
-		AppID: "markdown-test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "markdown-test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 }
 
 func markdownPermissionTestConfig(userOpenID string) *core.CliConfig {
 	return &core.CliConfig{
-		AppID: "markdown-perm-test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "markdown-perm-test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		UserOpenId: userOpenID,
 	}
 }
diff --git a/shortcuts/minutes/minutes_download_test.go b/shortcuts/minutes/minutes_download_test.go
index 38428e7bc0..c144d377ec 100644
--- a/shortcuts/minutes/minutes_download_test.go
+++ b/shortcuts/minutes/minutes_download_test.go
@@ -16,6 +16,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -72,7 +73,7 @@ func mountAndRun(t *testing.T, s common.Shortcut, args []string, f *cmdutil.Fact
 
 func defaultConfig() *core.CliConfig {
 	return &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		UserOpenId: "ou_testuser",
 	}
 }
diff --git a/shortcuts/note/note_transcript.go b/shortcuts/note/note_transcript.go
index fe84f05783..4755014015 100644
--- a/shortcuts/note/note_transcript.go
+++ b/shortcuts/note/note_transcript.go
@@ -20,9 +20,9 @@ import (
 
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -251,7 +251,7 @@ func resolveTranscriptLocale(runtime *common.RuntimeContext) string {
 	if lang := runtime.Lang(); lang != "" {
 		return string(lang)
 	}
-	if runtime.Config.Brand == core.BrandLark {
+	if runtime.Config.Brand == brand.Lark {
 		return string(i18n.LangEnUS)
 	}
 	return string(i18n.LangZhCN)
diff --git a/shortcuts/note/note_transcript_test.go b/shortcuts/note/note_transcript_test.go
index f9914ec792..eec65d5f36 100644
--- a/shortcuts/note/note_transcript_test.go
+++ b/shortcuts/note/note_transcript_test.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -167,7 +168,7 @@ func TestNoteTranscriptDefaultsLocaleFromLarkBrand(t *testing.T) {
 	config := &core.CliConfig{
 		AppID:      "test-app-lark-locale",
 		AppSecret:  "test-secret",
-		Brand:      core.BrandLark,
+		Brand:      brand.Lark,
 		UserOpenId: "ou_testuser",
 	}
 	factory, stdout, _, reg := noteShortcutTestFactoryWithConfig(t, config)
@@ -382,7 +383,7 @@ func noteShortcutTestFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *by
 	config := &core.CliConfig{
 		AppID:      "test-app-" + strings.ReplaceAll(strings.ToLower(t.Name()), "/", "-"),
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_testuser",
 	}
 	return noteShortcutTestFactoryWithConfig(t, config)
diff --git a/shortcuts/okr/okr_batch_create_test.go b/shortcuts/okr/okr_batch_create_test.go
index ecbdf07708..a005df9888 100644
--- a/shortcuts/okr/okr_batch_create_test.go
+++ b/shortcuts/okr/okr_batch_create_test.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -24,7 +25,7 @@ func batchCreateTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-okr-batch-create",
 		AppSecret: "secret-okr-batch-create",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/okr/okr_create_test.go b/shortcuts/okr/okr_create_test.go
index a1890b08e5..4b114ee27c 100644
--- a/shortcuts/okr/okr_create_test.go
+++ b/shortcuts/okr/okr_create_test.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -22,7 +23,7 @@ func createTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-okr-create",
 		AppSecret: patchTestValue(),
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/okr/okr_cycle_detail_test.go b/shortcuts/okr/okr_cycle_detail_test.go
index f1eb759bc7..e65baf8015 100644
--- a/shortcuts/okr/okr_cycle_detail_test.go
+++ b/shortcuts/okr/okr_cycle_detail_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -27,7 +28,7 @@ func cycleDetailTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-okr-detail-" + suffix,
 		AppSecret: "secret-okr-detail-" + suffix,
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/okr/okr_cycle_list_test.go b/shortcuts/okr/okr_cycle_list_test.go
index 92e2ca4f6b..496fca1faf 100644
--- a/shortcuts/okr/okr_cycle_list_test.go
+++ b/shortcuts/okr/okr_cycle_list_test.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -29,7 +30,7 @@ func cycleListTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-okr-list-" + suffix,
 		AppSecret: "secret-okr-list-" + suffix,
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/okr/okr_image_upload_test.go b/shortcuts/okr/okr_image_upload_test.go
index ea8b67cef7..a404ee1180 100644
--- a/shortcuts/okr/okr_image_upload_test.go
+++ b/shortcuts/okr/okr_image_upload_test.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -25,7 +26,7 @@ func uploadImageTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-okr-upload-image",
 		AppSecret: "secret-okr-upload-image",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/okr/okr_indicator_update_test.go b/shortcuts/okr/okr_indicator_update_test.go
index fda08518ab..755b842193 100644
--- a/shortcuts/okr/okr_indicator_update_test.go
+++ b/shortcuts/okr/okr_indicator_update_test.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -22,7 +23,7 @@ func indicatorUpdateTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-okr-indicator-update",
 		AppSecret: "secret-okr-indicator-update",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/okr/okr_openapi_test.go b/shortcuts/okr/okr_openapi_test.go
index 01ace57293..22ce5cf036 100644
--- a/shortcuts/okr/okr_openapi_test.go
+++ b/shortcuts/okr/okr_openapi_test.go
@@ -7,7 +7,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/brand"
 	"github.com/smartystreets/goconvey/convey"
 )
 
@@ -390,11 +390,11 @@ func TestParseCreateProgressRecordParams_BrandAwareSourceURL(t *testing.T) {
 		// This test directly tests the brand-aware default logic by constructing
 		// a minimal ContentBlock JSON and checking the resolved sourceURL.
 		convey.Convey("feishu brand defaults to feishu.cn", func() {
-			url := core.ResolveOpenBaseURL(core.BrandFeishu) + "/app"
+			url := brand.ResolveOpenBaseURL(brand.Feishu) + "/app"
 			convey.So(url, convey.ShouldEqual, "https://open.feishu.cn/app")
 		})
 		convey.Convey("lark brand defaults to larksuite.com", func() {
-			url := core.ResolveOpenBaseURL(core.BrandLark) + "/app"
+			url := brand.ResolveOpenBaseURL(brand.Lark) + "/app"
 			convey.So(url, convey.ShouldEqual, "https://open.larksuite.com/app")
 		})
 	})
diff --git a/shortcuts/okr/okr_patch_test.go b/shortcuts/okr/okr_patch_test.go
index 2be0525ebd..e956bdfc90 100644
--- a/shortcuts/okr/okr_patch_test.go
+++ b/shortcuts/okr/okr_patch_test.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -22,7 +23,7 @@ func patchTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "dummy",
 		AppSecret: patchTestValue(),
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/okr/okr_progress_create.go b/shortcuts/okr/okr_progress_create.go
index 3a56d5d9df..6ba85a5dc3 100644
--- a/shortcuts/okr/okr_progress_create.go
+++ b/shortcuts/okr/okr_progress_create.go
@@ -12,8 +12,8 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -78,7 +78,7 @@ func parseCreateProgressRecordParams(runtime *common.RuntimeContext) (*createPro
 
 	sourceURL := runtime.Str("source-url")
 	if sourceURL == "" {
-		sourceURL = core.ResolveOpenBaseURL(runtime.Config.Brand) + "/app"
+		sourceURL = brand.ResolveOpenBaseURL(runtime.Config.Brand) + "/app"
 	}
 
 	var progressRate *ProgressRateV1
diff --git a/shortcuts/okr/okr_progress_create_test.go b/shortcuts/okr/okr_progress_create_test.go
index ba5c19994a..ff034fd81f 100644
--- a/shortcuts/okr/okr_progress_create_test.go
+++ b/shortcuts/okr/okr_progress_create_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -22,7 +23,7 @@ func progressCreateTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-okr-progress-create",
 		AppSecret: "secret-okr-progress-create",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/okr/okr_progress_delete_test.go b/shortcuts/okr/okr_progress_delete_test.go
index ea25f1e6be..3e92ec52b2 100644
--- a/shortcuts/okr/okr_progress_delete_test.go
+++ b/shortcuts/okr/okr_progress_delete_test.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -20,7 +21,7 @@ func progressDeleteTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-okr-progress-delete",
 		AppSecret: "secret-okr-progress-delete",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/okr/okr_progress_get_test.go b/shortcuts/okr/okr_progress_get_test.go
index bf76f90b96..719bda3575 100644
--- a/shortcuts/okr/okr_progress_get_test.go
+++ b/shortcuts/okr/okr_progress_get_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -22,7 +23,7 @@ func progressGetTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-okr-progress-get",
 		AppSecret: "secret-okr-progress-get",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/okr/okr_progress_list_test.go b/shortcuts/okr/okr_progress_list_test.go
index fb2d98fa3e..39f1120a30 100644
--- a/shortcuts/okr/okr_progress_list_test.go
+++ b/shortcuts/okr/okr_progress_list_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -23,7 +24,7 @@ func progressListTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-okr-progress-list",
 		AppSecret: "secret-okr-progress-list",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/okr/okr_progress_update_test.go b/shortcuts/okr/okr_progress_update_test.go
index b3f2cc464b..048e7bb800 100644
--- a/shortcuts/okr/okr_progress_update_test.go
+++ b/shortcuts/okr/okr_progress_update_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -22,7 +23,7 @@ func progressUpdateTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-okr-progress-update",
 		AppSecret: "secret-okr-progress-update",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/okr/okr_reorder_test.go b/shortcuts/okr/okr_reorder_test.go
index 2a20f7a955..0276222d4a 100644
--- a/shortcuts/okr/okr_reorder_test.go
+++ b/shortcuts/okr/okr_reorder_test.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -29,7 +30,7 @@ func reorderTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-okr-reorder",
 		AppSecret: "secret-okr-reorder",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/okr/okr_weight_test.go b/shortcuts/okr/okr_weight_test.go
index e9c7774cd4..716e74dd78 100644
--- a/shortcuts/okr/okr_weight_test.go
+++ b/shortcuts/okr/okr_weight_test.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -37,7 +38,7 @@ func weightTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     "test-okr-weight",
 		AppSecret: "secret-okr-weight",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/register.go b/shortcuts/register.go
index 7d458ca185..6cb628077e 100644
--- a/shortcuts/register.go
+++ b/shortcuts/register.go
@@ -8,13 +8,13 @@ import (
 	"fmt"
 	"slices"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/shortcuts/okr"
 	"github.com/spf13/cobra"
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdmeta"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/deprecation"
 	"github.com/larksuite/cli/internal/registry"
 	"github.com/larksuite/cli/shortcuts/application"
@@ -42,11 +42,11 @@ import (
 
 // Empty brand (no config loaded) is treated as no-restriction so bootstrap
 // paths and tests without config still see the full service list.
-var brandRestrictedServices = map[string][]core.LarkBrand{
-	"apps": {core.BrandFeishu},
+var brandRestrictedServices = map[string][]brandpkg.Brand{
+	"apps": {brandpkg.Feishu},
 }
 
-func IsShortcutServiceAvailable(service string, brand core.LarkBrand) bool {
+func IsShortcutServiceAvailable(service string, brand brandpkg.Brand) bool {
 	allowed, ok := brandRestrictedServices[service]
 	if !ok {
 		return true
@@ -102,7 +102,7 @@ func RegisterShortcuts(program *cobra.Command, f *cmdutil.Factory) {
 
 func RegisterShortcutsWithContext(ctx context.Context, program *cobra.Command, f *cmdutil.Factory) {
 	// Factory.Config may be nil in tests that pass a zero-value factory.
-	var brand core.LarkBrand
+	var brand brandpkg.Brand
 	if f != nil && f.Config != nil {
 		if cfg, err := f.Config(); err == nil && cfg != nil {
 			brand = cfg.Brand
@@ -174,7 +174,7 @@ func RegisterShortcutsWithContext(ctx context.Context, program *cobra.Command, f
 // ArbitraryArgs keep cobra from short-circuiting with "missing required flag"
 // before our RunE runs; leaf-level PersistentPreRunE defeats cobra's "first
 // PreRunE wins" walk-up that would otherwise shadow the stub.
-func installBrandRestrictionGuard(svc *cobra.Command, service string, brand core.LarkBrand) {
+func installBrandRestrictionGuard(svc *cobra.Command, service string, brand brandpkg.Brand) {
 	stub := func(c *cobra.Command, _ []string) error {
 		c.SilenceUsage = true
 		return errs.NewValidationError(errs.SubtypeFailedPrecondition,
@@ -204,7 +204,7 @@ func installBrandRestrictionGuard(svc *cobra.Command, service string, brand core
 	walk(svc)
 
 	// --help bypasses RunE, so surface the restriction in Long too.
-	svc.Long = fmt.Sprintf("The %q feature is not yet supported on the %s brand.", service, brand)
+	svc.Long = fmt.Sprintf("The %q feature is not yet supported on the %s brandpkg.", service, brand)
 }
 
 // Sheets backward-compatibility grouping.
diff --git a/shortcuts/register_brand_guard_test.go b/shortcuts/register_brand_guard_test.go
index 4e87a4d912..db286e21e9 100644
--- a/shortcuts/register_brand_guard_test.go
+++ b/shortcuts/register_brand_guard_test.go
@@ -11,12 +11,13 @@ import (
 
 	"github.com/spf13/cobra"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 )
 
-func newFactoryWithBrand(brand core.LarkBrand) *cmdutil.Factory {
+func newFactoryWithBrand(brand brandpkg.Brand) *cmdutil.Factory {
 	return &cmdutil.Factory{
 		Config: func() (*core.CliConfig, error) {
 			return &core.CliConfig{Brand: brand}, nil
@@ -35,7 +36,7 @@ func findChild(root *cobra.Command, name string) *cobra.Command {
 
 func TestBrandGuard_AppsStaysRegisteredOnLark(t *testing.T) {
 	program := &cobra.Command{Use: "root"}
-	RegisterShortcuts(program, newFactoryWithBrand(core.BrandLark))
+	RegisterShortcuts(program, newFactoryWithBrand(brandpkg.Lark))
 
 	apps := findChild(program, "apps")
 	if apps == nil {
@@ -56,7 +57,7 @@ func TestBrandGuard_AppsStaysRegisteredOnLark(t *testing.T) {
 
 func TestBrandGuard_AppsExecuteReturnsBrandError(t *testing.T) {
 	program := &cobra.Command{Use: "root"}
-	RegisterShortcuts(program, newFactoryWithBrand(core.BrandLark))
+	RegisterShortcuts(program, newFactoryWithBrand(brandpkg.Lark))
 
 	apps := findChild(program, "apps")
 	if apps == nil {
@@ -85,7 +86,7 @@ func TestBrandGuard_AppsExecuteReturnsBrandError(t *testing.T) {
 
 func TestBrandGuard_AppsExecutableOnFeishu(t *testing.T) {
 	program := &cobra.Command{Use: "root"}
-	RegisterShortcuts(program, newFactoryWithBrand(core.BrandFeishu))
+	RegisterShortcuts(program, newFactoryWithBrand(brandpkg.Feishu))
 
 	apps := findChild(program, "apps")
 	if apps == nil {
@@ -105,7 +106,7 @@ func TestBrandGuard_AppsExecutableOnFeishu(t *testing.T) {
 
 func TestBrandGuard_DispatchHitsStubViaCobra(t *testing.T) {
 	program := &cobra.Command{Use: "root"}
-	RegisterShortcuts(program, newFactoryWithBrand(core.BrandLark))
+	RegisterShortcuts(program, newFactoryWithBrand(brandpkg.Lark))
 
 	program.SetArgs([]string{"apps", "+create", "--name", "x", "--app-type", "HTML"})
 	program.SetContext(context.Background())
diff --git a/shortcuts/sheets/backward/lark_sheets_sheet_create_test.go b/shortcuts/sheets/backward/lark_sheets_sheet_create_test.go
index a67761b0d3..86cbe5f5c2 100644
--- a/shortcuts/sheets/backward/lark_sheets_sheet_create_test.go
+++ b/shortcuts/sheets/backward/lark_sheets_sheet_create_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -288,7 +289,7 @@ func sheetCreateTestConfig(t *testing.T, userOpenID string) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:      "test-sheet-create-" + suffix,
 		AppSecret:  "secret-sheet-create-" + suffix,
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: userOpenID,
 	}
 }
diff --git a/shortcuts/sheets/backward/lark_sheets_sheet_write_image_test.go b/shortcuts/sheets/backward/lark_sheets_sheet_write_image_test.go
index 02b6701a46..7d52afa912 100644
--- a/shortcuts/sheets/backward/lark_sheets_sheet_write_image_test.go
+++ b/shortcuts/sheets/backward/lark_sheets_sheet_write_image_test.go
@@ -15,6 +15,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -24,7 +25,7 @@ import (
 
 func sheetsTestConfig() *core.CliConfig {
 	return &core.CliConfig{
-		AppID: "sheets-test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "sheets-test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 }
 
diff --git a/shortcuts/sheets/helpers_test.go b/shortcuts/sheets/helpers_test.go
index 39aef181be..bc6c9624e8 100644
--- a/shortcuts/sheets/helpers_test.go
+++ b/shortcuts/sheets/helpers_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -28,7 +29,7 @@ func testConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:      "test-sheets-" + suffix,
 		AppSecret:  "secret-sheets-" + suffix,
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_test_user",
 	}
 }
diff --git a/shortcuts/sheets/sheet_media_parent_type_test.go b/shortcuts/sheets/sheet_media_parent_type_test.go
index d37bd07376..089b65c883 100644
--- a/shortcuts/sheets/sheet_media_parent_type_test.go
+++ b/shortcuts/sheets/sheet_media_parent_type_test.go
@@ -16,6 +16,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -150,7 +151,7 @@ func newSheetMediaTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.R
 	cfg := &core.CliConfig{
 		AppID:     "test-sheets-media-" + t.Name(),
 		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	runtime := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "sheets"}, cfg, f, core.AsBot)
diff --git a/shortcuts/slides/slides_create_test.go b/shortcuts/slides/slides_create_test.go
index a2d36b414d..26c8aecb92 100644
--- a/shortcuts/slides/slides_create_test.go
+++ b/shortcuts/slides/slides_create_test.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -765,7 +766,7 @@ func slidesTestConfig(t *testing.T, userOpenID string) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:      "test-slides-create-" + suffix,
 		AppSecret:  "secret-slides-create-" + suffix,
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: userOpenID,
 	}
 }
diff --git a/shortcuts/task/task_shortcut_test.go b/shortcuts/task/task_shortcut_test.go
index de0c35b99f..12b29769b9 100644
--- a/shortcuts/task/task_shortcut_test.go
+++ b/shortcuts/task/task_shortcut_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
@@ -23,7 +24,7 @@ func taskTestConfig(t *testing.T) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:      "test-app-" + suffix,
 		AppSecret:  "test-secret-" + suffix,
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_testuser",
 		UserName:   "Test User",
 	}
diff --git a/shortcuts/vc/vc_notes_test.go b/shortcuts/vc/vc_notes_test.go
index d87ae13ad8..12c71ef058 100644
--- a/shortcuts/vc/vc_notes_test.go
+++ b/shortcuts/vc/vc_notes_test.go
@@ -17,6 +17,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -74,7 +75,7 @@ func mountAndRun(t *testing.T, s common.Shortcut, args []string, f *cmdutil.Fact
 
 func defaultConfig() *core.CliConfig {
 	return &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		UserOpenId: "ou_testuser",
 	}
 }
diff --git a/shortcuts/vc/vc_search_test.go b/shortcuts/vc/vc_search_test.go
index 0a256d0697..11cf659949 100644
--- a/shortcuts/vc/vc_search_test.go
+++ b/shortcuts/vc/vc_search_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -51,7 +52,7 @@ func TestUniqueIDs(t *testing.T) {
 }
 
 func TestParseTimeRange(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 	tests := []struct {
 		name    string
 		start   string
@@ -86,7 +87,7 @@ func TestParseTimeRange(t *testing.T) {
 }
 
 func TestBuildSearchBody(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 	cmd := &cobra.Command{Use: "test"}
 	cmd.Flags().String("query", "", "")
 	cmd.Flags().String("start", "", "")
@@ -120,7 +121,7 @@ func TestBuildSearchBody(t *testing.T) {
 }
 
 func TestBuildSearchBody_Empty(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 	cmd := &cobra.Command{Use: "test"}
 	cmd.Flags().String("query", "", "")
 	cmd.Flags().String("start", "", "")
@@ -317,7 +318,7 @@ func TestSearch_InvalidTimeRange(t *testing.T) {
 // ---------------------------------------------------------------------------
 
 func TestParseTimeRange_InvalidStart_TypedError(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 	cmd := &cobra.Command{Use: "test"}
 	cmd.Flags().String("start", "", "")
 	cmd.Flags().String("end", "", "")
@@ -344,7 +345,7 @@ func TestParseTimeRange_InvalidStart_TypedError(t *testing.T) {
 }
 
 func TestParseTimeRange_InvalidEnd_TypedError(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 	cmd := &cobra.Command{Use: "test"}
 	cmd.Flags().String("start", "", "")
 	cmd.Flags().String("end", "", "")
@@ -371,7 +372,7 @@ func TestParseTimeRange_InvalidEnd_TypedError(t *testing.T) {
 }
 
 func TestParseTimeRange_StartAfterEnd_TypedError(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 	cmd := &cobra.Command{Use: "test"}
 	cmd.Flags().String("start", "", "")
 	cmd.Flags().String("end", "", "")
@@ -442,7 +443,7 @@ func TestSearch_Validation_NoFilter_TypedError(t *testing.T) {
 }
 
 func TestBuildSearchParams(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: core.BrandFeishu}
+	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 
 	t.Run("defaults", func(t *testing.T) {
 		cmd := &cobra.Command{Use: "test"}
diff --git a/shortcuts/whiteboard/whiteboard_export_test.go b/shortcuts/whiteboard/whiteboard_export_test.go
index 22e1e933a5..c9d35c67bb 100644
--- a/shortcuts/whiteboard/whiteboard_export_test.go
+++ b/shortcuts/whiteboard/whiteboard_export_test.go
@@ -15,6 +15,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -698,7 +699,7 @@ func newExecuteFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *httpmock
 	config := &core.CliConfig{
 		AppID:      "test-app-" + strings.ReplaceAll(strings.ToLower(t.Name()), "/", "-"),
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_testuser",
 	}
 	factory, stdout, _, reg := cmdutil.TestFactory(t, config)
diff --git a/shortcuts/whiteboard/whiteboard_update_test.go b/shortcuts/whiteboard/whiteboard_update_test.go
index 9d3a5af9e1..2045b924be 100644
--- a/shortcuts/whiteboard/whiteboard_update_test.go
+++ b/shortcuts/whiteboard/whiteboard_update_test.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -382,7 +383,7 @@ func newUpdateExecuteFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *ht
 	config := &core.CliConfig{
 		AppID:      "test-app-" + strings.ReplaceAll(strings.ToLower(t.Name()), "/", "-"),
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: "ou_testuser",
 	}
 	factory, stdout, _, reg := cmdutil.TestFactory(t, config)
diff --git a/shortcuts/wiki/wiki_helpers.go b/shortcuts/wiki/wiki_helpers.go
index dc70715698..a9bc580138 100644
--- a/shortcuts/wiki/wiki_helpers.go
+++ b/shortcuts/wiki/wiki_helpers.go
@@ -6,8 +6,8 @@ package wiki
 import (
 	"strings"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -18,7 +18,7 @@ import (
 //
 // Shared by +node-create and +node-copy, hence kept here rather than in either
 // command's file.
-func wikiNodeURL(brand core.LarkBrand, node *wikiNodeRecord) string {
+func wikiNodeURL(brand brandpkg.Brand, node *wikiNodeRecord) string {
 	if node == nil {
 		return ""
 	}
diff --git a/shortcuts/wiki/wiki_node_create_test.go b/shortcuts/wiki/wiki_node_create_test.go
index face88615e..e01ecb7803 100644
--- a/shortcuts/wiki/wiki_node_create_test.go
+++ b/shortcuts/wiki/wiki_node_create_test.go
@@ -16,6 +16,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -103,7 +104,7 @@ func wikiTestConfig() *core.CliConfig {
 	return &core.CliConfig{
 		AppID:     fmt.Sprintf("wiki-test-app-%d", wikiTestConfigSeq.Add(1)),
 		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
+		Brand:     brand.Feishu,
 	}
 }
 
@@ -111,7 +112,7 @@ func wikiPermissionTestConfig(userOpenID string) *core.CliConfig {
 	return &core.CliConfig{
 		AppID:      fmt.Sprintf("wiki-permission-test-app-%d", wikiTestConfigSeq.Add(1)),
 		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
+		Brand:      brand.Feishu,
 		UserOpenId: userOpenID,
 	}
 }
@@ -840,7 +841,7 @@ func TestWikiNodeURL(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			if got := wikiNodeURL(core.BrandFeishu, tc.node); got != tc.want {
+			if got := wikiNodeURL(brand.Feishu, tc.node); got != tc.want {
 				t.Fatalf("wikiNodeURL() = %q, want %q", got, tc.want)
 			}
 		})
diff --git a/sidecar/server-demo/allowlist.go b/sidecar/server-demo/allowlist.go
index d37e855b42..9ad09e4701 100644
--- a/sidecar/server-demo/allowlist.go
+++ b/sidecar/server-demo/allowlist.go
@@ -8,13 +8,14 @@ package main
 import (
 	"strings"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/sidecar"
 )
 
 // buildAllowedHosts extracts the set of allowed target hostnames from
 // multiple brand endpoints so the sidecar can serve both feishu and lark clients.
-func buildAllowedHosts(endpoints ...core.Endpoints) map[string]bool {
+func buildAllowedHosts(endpoints ...brand.Endpoints) map[string]bool {
 	hosts := make(map[string]bool)
 	for _, ep := range endpoints {
 		for _, u := range []string{ep.Open, ep.Accounts, ep.MCP} {
diff --git a/sidecar/server-demo/handler.go b/sidecar/server-demo/handler.go
index 2fad340df1..46f7b7ba88 100644
--- a/sidecar/server-demo/handler.go
+++ b/sidecar/server-demo/handler.go
@@ -14,7 +14,7 @@ import (
 	"net/url"
 	"time"
 
-	"github.com/larksuite/cli/internal/core"
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/sidecar"
 )
@@ -24,7 +24,7 @@ type proxyHandler struct {
 	key          []byte
 	cred         *credential.CredentialProvider
 	appID        string
-	brand        core.LarkBrand
+	brand        brandpkg.Brand
 	logger       *log.Logger
 	forwardCl    *http.Client
 	allowedHosts map[string]bool // target host allowlist derived from brand
diff --git a/sidecar/server-demo/handler_test.go b/sidecar/server-demo/handler_test.go
index ac8afd74bc..c7a22cf010 100644
--- a/sidecar/server-demo/handler_test.go
+++ b/sidecar/server-demo/handler_test.go
@@ -18,10 +18,10 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/sidecar"
 )
@@ -623,12 +623,12 @@ func TestProxyHandler_StripsClientSuppliedAuthHeaders(t *testing.T) {
 }
 
 func TestBuildAllowedHosts(t *testing.T) {
-	feishu := core.Endpoints{
+	feishu := brand.Endpoints{
 		Open:     "https://open.feishu.cn",
 		Accounts: "https://accounts.feishu.cn",
 		MCP:      "https://mcp.feishu.cn",
 	}
-	lark := core.Endpoints{
+	lark := brand.Endpoints{
 		Open:     "https://open.larksuite.com",
 		Accounts: "https://accounts.larksuite.com",
 		MCP:      "https://mcp.larksuite.com",
diff --git a/sidecar/server-demo/main.go b/sidecar/server-demo/main.go
index f1c0b434f9..83c453dc64 100644
--- a/sidecar/server-demo/main.go
+++ b/sidecar/server-demo/main.go
@@ -28,10 +28,10 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/vfs"
 	"github.com/larksuite/cli/sidecar"
 )
@@ -120,8 +120,8 @@ func run(ctx context.Context, listen, keyFile, logFile, profile string) error {
 	defer listener.Close()
 
 	allowedHosts := buildAllowedHosts(
-		core.ResolveEndpoints(core.BrandFeishu),
-		core.ResolveEndpoints(core.BrandLark),
+		brand.ResolveEndpoints(brand.Feishu),
+		brand.ResolveEndpoints(brand.Lark),
 	)
 	allowedIDs := buildAllowedIdentities(cfg)
 
diff --git a/sidecar/server-multi-tenant-demo/allowlist.go b/sidecar/server-multi-tenant-demo/allowlist.go
index 44e8b50ba1..fc83a8db1c 100644
--- a/sidecar/server-multi-tenant-demo/allowlist.go
+++ b/sidecar/server-multi-tenant-demo/allowlist.go
@@ -8,13 +8,14 @@ package main
 import (
 	"strings"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/sidecar"
 )
 
 // buildAllowedHosts extracts the set of allowed target hostnames from
 // multiple brand endpoints so the sidecar can serve both feishu and lark clients.
-func buildAllowedHosts(endpoints ...core.Endpoints) map[string]bool {
+func buildAllowedHosts(endpoints ...brand.Endpoints) map[string]bool {
 	hosts := make(map[string]bool)
 	for _, ep := range endpoints {
 		for _, u := range []string{ep.Open, ep.Accounts, ep.MCP} {
diff --git a/sidecar/server-multi-tenant-demo/auth_bridge.go b/sidecar/server-multi-tenant-demo/auth_bridge.go
index 2670ff520e..7676611319 100644
--- a/sidecar/server-multi-tenant-demo/auth_bridge.go
+++ b/sidecar/server-multi-tenant-demo/auth_bridge.go
@@ -23,6 +23,7 @@ import (
 	"sync"
 	"time"
 
+	brandpkg "github.com/larksuite/cli/brand"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
@@ -38,7 +39,7 @@ type authBridge struct {
 	key       []byte
 	appID     string
 	appSecret string
-	brand     core.LarkBrand
+	brand     brandpkg.Brand
 	cred      *credential.CredentialProvider
 	logger    *log.Logger
 	httpCl    *http.Client
@@ -51,7 +52,7 @@ type authBridge struct {
 	mapFile string
 }
 
-func newAuthBridge(key []byte, appID, appSecret string, brand core.LarkBrand, cred *credential.CredentialProvider, logger *log.Logger) *authBridge {
+func newAuthBridge(key []byte, appID, appSecret string, brand brandpkg.Brand, cred *credential.CredentialProvider, logger *log.Logger) *authBridge {
 	configDir := os.Getenv("LARKSUITE_CLI_CONFIG_DIR")
 	mapFile := ""
 	if configDir != "" {
@@ -287,7 +288,7 @@ func (ab *authBridge) handlePoll(w http.ResponseWriter, r *http.Request, body []
 		GrantedAt:        now,
 	}
 
-	ep := core.ResolveEndpoints(ab.brand)
+	ep := brandpkg.ResolveEndpoints(ab.brand)
 	openID, userName, err := fetchUserInfoDirect(ab.httpCl, ep.Open, result.Token.AccessToken)
 	if err != nil {
 		ab.logger.Printf("AUTH_BRIDGE_WARN action=user_info error=%q", err.Error())
diff --git a/sidecar/server-multi-tenant-demo/handler.go b/sidecar/server-multi-tenant-demo/handler.go
index c7dc9202cc..bf97167ceb 100644
--- a/sidecar/server-multi-tenant-demo/handler.go
+++ b/sidecar/server-multi-tenant-demo/handler.go
@@ -17,7 +17,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/larksuite/cli/internal/core"
+	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/vfs"
 	"github.com/larksuite/cli/sidecar"
@@ -28,7 +28,7 @@ type proxyHandler struct {
 	key          []byte
 	cred         *credential.CredentialProvider
 	appID        string
-	brand        core.LarkBrand
+	brand        brandpkg.Brand
 	logger       *log.Logger
 	forwardCl    *http.Client
 	allowedHosts map[string]bool // target host allowlist derived from brand
diff --git a/sidecar/server-multi-tenant-demo/handler_test.go b/sidecar/server-multi-tenant-demo/handler_test.go
index a694a23bd9..4e09c338ce 100644
--- a/sidecar/server-multi-tenant-demo/handler_test.go
+++ b/sidecar/server-multi-tenant-demo/handler_test.go
@@ -20,10 +20,10 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/sidecar"
 )
@@ -619,10 +619,10 @@ func TestProxyHandler_StripsClientSuppliedAuthHeaders(t *testing.T) {
 }
 
 func TestBuildAllowedHosts(t *testing.T) {
-	feishu := core.Endpoints{
+	feishu := brand.Endpoints{
 		Open: "https://open.feishu.cn", Accounts: "https://accounts.feishu.cn", MCP: "https://mcp.feishu.cn",
 	}
-	lark := core.Endpoints{
+	lark := brand.Endpoints{
 		Open: "https://open.larksuite.com", Accounts: "https://accounts.larksuite.com", MCP: "https://mcp.larksuite.com",
 	}
 	hosts := buildAllowedHosts(feishu, lark)
diff --git a/sidecar/server-multi-tenant-demo/main.go b/sidecar/server-multi-tenant-demo/main.go
index 636f77a425..db76b54154 100644
--- a/sidecar/server-multi-tenant-demo/main.go
+++ b/sidecar/server-multi-tenant-demo/main.go
@@ -29,10 +29,10 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/internal/vfs"
 	"github.com/larksuite/cli/sidecar"
@@ -142,8 +142,8 @@ func run(ctx context.Context, listen, keyFile, keysDir, logFile, profile string)
 	defer listener.Close()
 
 	allowedHosts := buildAllowedHosts(
-		core.ResolveEndpoints(core.BrandFeishu),
-		core.ResolveEndpoints(core.BrandLark),
+		brand.ResolveEndpoints(brand.Feishu),
+		brand.ResolveEndpoints(brand.Lark),
 	)
 	allowedIDs := buildAllowedIdentities(cfg)
 
diff --git a/tests/sidecar_e2e/roundtrip_test.go b/tests/sidecar_e2e/roundtrip_test.go
index 4c2bcf6149..2cb7b4f454 100644
--- a/tests/sidecar_e2e/roundtrip_test.go
+++ b/tests/sidecar_e2e/roundtrip_test.go
@@ -21,7 +21,7 @@
 //     `lark-cli auth login` — there is no way to make it return a token
 //     without live credentials.
 //  2. sidecar/server-demo/main.go builds handler.allowedHosts from
-//     core.ResolveEndpoints(BrandFeishu/BrandLark) only — real feishu/lark
+//     brand.ResolveEndpoints(BrandFeishu/BrandLark) only — real feishu/lark
 //     hosts. An in-test mock (127.0.0.1:<port>) is never in that allowlist
 //     and would be rejected with 403 (handler.go step 4).
 //  3. sidecar/server-demo/handler.go:184 pins the forward scheme to

From ee27d0cdc2a4c185fd2e9ee7bb11b0ebcfca4bd1 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 12:15:26 +0800
Subject: [PATCH 40/50] refactor(core): extract workspace paths

---
 cmd/auth/list_test.go                         |  8 +++----
 cmd/auth/login_scope_cache.go                 |  4 ++--
 cmd/config/bind.go                            | 23 ++++++++++---------
 cmd/config/bind_test.go                       | 13 ++++++-----
 cmd/config/init.go                            |  7 +++---
 cmd/config/show.go                            |  5 ++--
 cmd/doctor/doctor.go                          |  3 ++-
 cmd/event/bus.go                              |  4 ++--
 cmd/platform_bootstrap.go                     |  6 ++---
 cmd/root_upgrade_test.go                      |  8 +++----
 internal/auth/uat_client.go                   |  3 ++-
 internal/authlog/authlog.go                   |  2 +-
 internal/cmdutil/factory_default.go           |  7 +++---
 internal/core/config.go                       | 21 ++++-------------
 internal/core/notconfigured.go                | 11 +++++----
 internal/core/notconfigured_test.go           | 21 +++++++++--------
 internal/event/bus/bus.go                     |  4 ++--
 internal/event/busdiscover/busdiscover.go     |  4 ++--
 internal/event/consume/startup.go             |  8 +++----
 internal/event/transport/transport_unix.go    |  4 ++--
 internal/lockfile/lockfile.go                 |  4 ++--
 internal/registry/remote.go                   |  4 ++--
 internal/security/contentsafety/provider.go   |  4 ++--
 internal/skillscheck/state.go                 |  6 ++---
 internal/sparkstore/storage.go                |  4 ++--
 internal/transport/config.go                  |  6 ++---
 internal/update/update.go                     |  6 ++---
 internal/{core => workspace}/workspace.go     | 15 +++++++++++-
 .../{core => workspace}/workspace_test.go     |  2 +-
 shortcuts/apps/git_credential_test.go         |  7 +++---
 shortcuts/apps/gitcred/lock.go                |  4 ++--
 shortcuts/apps/gitcred/store.go               |  4 ++--
 32 files changed, 121 insertions(+), 111 deletions(-)
 rename internal/{core => workspace}/workspace.go (92%)
 rename internal/{core => workspace}/workspace_test.go (99%)

diff --git a/cmd/auth/list_test.go b/cmd/auth/list_test.go
index 070e4fae15..3b6581db46 100644
--- a/cmd/auth/list_test.go
+++ b/cmd/auth/list_test.go
@@ -9,7 +9,7 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // TestAuthListRun_NotConfigured_ReturnsExitZero pins the contract that
@@ -69,9 +69,9 @@ func TestAuthListRun_JSONMode_NotConfigured_WritesStdoutOnly(t *testing.T) {
 func TestAuthListRun_NotConfigured_AgentWorkspace_RoutesToBindHelp(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
-	prev := core.CurrentWorkspace()
-	t.Cleanup(func() { core.SetCurrentWorkspace(prev) })
-	core.SetCurrentWorkspace(core.WorkspaceOpenClaw)
+	prev := workspace.CurrentWorkspace()
+	t.Cleanup(func() { workspace.SetCurrentWorkspace(prev) })
+	workspace.SetCurrentWorkspace(workspace.WorkspaceOpenClaw)
 
 	f, _, stderr, _ := cmdutil.TestFactory(t, nil)
 	if err := authListRun(&ListOptions{Factory: f}); err != nil {
diff --git a/cmd/auth/login_scope_cache.go b/cmd/auth/login_scope_cache.go
index ad8036bdaa..234413c558 100644
--- a/cmd/auth/login_scope_cache.go
+++ b/cmd/auth/login_scope_cache.go
@@ -11,9 +11,9 @@ import (
 	"regexp"
 
 	larkauth "github.com/larksuite/cli/internal/auth"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 var loginScopeCacheSafeChars = regexp.MustCompile(`[^a-zA-Z0-9._-]`)
@@ -25,7 +25,7 @@ type loginScopeCacheRecord struct {
 // loginScopeCacheDir returns the directory used to persist auth login --no-wait
 // requested scopes keyed by device_code.
 func loginScopeCacheDir() string {
-	return filepath.Join(core.GetConfigDir(), "cache", "auth_login_scopes")
+	return filepath.Join(workspace.GetConfigDir(), "cache", "auth_login_scopes")
 }
 
 // loginScopeCachePath returns the cache file path for a given device_code.
diff --git a/cmd/config/bind.go b/cmd/config/bind.go
index 67916b17e5..67be919393 100644
--- a/cmd/config/bind.go
+++ b/cmd/config/bind.go
@@ -20,6 +20,7 @@ import (
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // BindOptions holds all inputs for config bind.
@@ -128,8 +129,8 @@ func configBindRun(opts *BindOptions) error {
 	if err != nil {
 		return err
 	}
-	core.SetCurrentWorkspace(core.Workspace(source))
-	targetConfigPath := core.GetConfigPath()
+	workspace.SetCurrentWorkspace(workspace.Workspace(source))
+	targetConfigPath := workspace.GetConfigPath()
 
 	existing, err := reconcileExistingBinding(opts, source, targetConfigPath)
 	if err != nil {
@@ -186,12 +187,12 @@ func finalizeSource(opts *BindOptions) (string, error) {
 	}
 
 	var detected string
-	switch core.DetectWorkspaceFromEnv(os.Getenv) {
-	case core.WorkspaceOpenClaw:
+	switch workspace.DetectWorkspaceFromEnv(os.Getenv) {
+	case workspace.WorkspaceOpenClaw:
 		detected = "openclaw"
-	case core.WorkspaceHermes:
+	case workspace.WorkspaceHermes:
 		detected = "hermes"
-	case core.WorkspaceLarkChannel:
+	case workspace.WorkspaceLarkChannel:
 		detected = "lark-channel"
 	}
 
@@ -407,7 +408,7 @@ func priorLang(previousConfigBytes []byte) i18n.Lang {
 func commitBinding(opts *BindOptions, appConfig *core.AppConfig, previousConfigBytes []byte, source, configPath string) error {
 	multi := &core.MultiAppConfig{Apps: []core.AppConfig{*appConfig}}
 
-	if err := vfs.MkdirAll(core.GetConfigDir(), 0700); err != nil {
+	if err := vfs.MkdirAll(workspace.GetConfigDir(), 0700); err != nil {
 		return errs.NewInternalError(errs.SubtypeFileIO, "failed to create workspace directory: %v", err).WithCause(err)
 	}
 	data, err := json.MarshalIndent(multi, "", "  ")
@@ -503,13 +504,13 @@ func tuiSelectSource(opts *BindOptions) (string, error) {
 	var source string
 
 	// Pre-select based on detected env signals
-	detected := core.DetectWorkspaceFromEnv(os.Getenv)
+	detected := workspace.DetectWorkspaceFromEnv(os.Getenv)
 	switch detected {
-	case core.WorkspaceOpenClaw:
+	case workspace.WorkspaceOpenClaw:
 		source = "openclaw"
-	case core.WorkspaceHermes:
+	case workspace.WorkspaceHermes:
 		source = "hermes"
-	case core.WorkspaceLarkChannel:
+	case workspace.WorkspaceLarkChannel:
 		source = "lark-channel"
 	default:
 		source = "openclaw" // default first option
diff --git a/cmd/config/bind_test.go b/cmd/config/bind_test.go
index 7f0c018039..5120fac4c3 100644
--- a/cmd/config/bind_test.go
+++ b/cmd/config/bind_test.go
@@ -19,6 +19,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // wantErrDetail is the normalized comparison shape for a typed error's wire
@@ -81,8 +82,8 @@ func assertEnvelope(t *testing.T, stdout []byte, want map[string]any) {
 // Must be called at the start of any test that may trigger configBindRun (which sets workspace).
 func saveWorkspace(t *testing.T) {
 	t.Helper()
-	orig := core.CurrentWorkspace()
-	t.Cleanup(func() { core.SetCurrentWorkspace(orig) })
+	orig := workspace.CurrentWorkspace()
+	t.Cleanup(func() { workspace.SetCurrentWorkspace(orig) })
 }
 
 // ── Command flag parsing tests (aligned with config_test.go pattern) ──
@@ -640,7 +641,7 @@ func TestConfigBindRun_LarkChannel_Success(t *testing.T) {
 	// Brand is not in the stdout envelope — read it back from the persisted
 	// workspace config to verify accounts.app.tenant flowed through to the
 	// stored AppConfig.Brand field.
-	core.SetCurrentWorkspace(core.WorkspaceLarkChannel)
+	workspace.SetCurrentWorkspace(workspace.WorkspaceLarkChannel)
 	multi, err := core.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("load workspace config: %v", err)
@@ -687,7 +688,7 @@ func TestConfigBindRun_LarkChannel_LarkTenant(t *testing.T) {
 	if err := configBindRun(&BindOptions{Factory: f, Source: "lark-channel"}); err != nil {
 		t.Fatalf("expected success, got error: %v", err)
 	}
-	core.SetCurrentWorkspace(core.WorkspaceLarkChannel)
+	workspace.SetCurrentWorkspace(workspace.WorkspaceLarkChannel)
 	multi, err := core.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("load workspace config: %v", err)
@@ -802,7 +803,7 @@ func TestConfigShowRun_WorkspaceField(t *testing.T) {
 	configDir := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
 
-	core.SetCurrentWorkspace(core.WorkspaceLocal)
+	workspace.SetCurrentWorkspace(workspace.WorkspaceLocal)
 
 	multi := &core.MultiAppConfig{
 		Apps: []core.AppConfig{{
@@ -828,7 +829,7 @@ func TestConfigShowRun_AgentWorkspaceNotBound(t *testing.T) {
 	saveWorkspace(t)
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
-	core.SetCurrentWorkspace(core.WorkspaceOpenClaw)
+	workspace.SetCurrentWorkspace(workspace.WorkspaceOpenClaw)
 
 	f, _, _, _ := cmdutil.TestFactory(t, nil)
 	err := configShowRun(&ConfigShowOptions{Factory: f})
diff --git a/cmd/config/init.go b/cmd/config/init.go
index 5926ba2cb0..e4250f5218 100644
--- a/cmd/config/init.go
+++ b/cmd/config/init.go
@@ -21,6 +21,7 @@ import (
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // ConfigInitOptions holds all inputs for config init.
@@ -122,7 +123,7 @@ func guardAgentWorkspace(opts *ConfigInitOptions) error {
 	if opts.ForceInit {
 		return nil
 	}
-	ws := core.DetectWorkspaceFromEnv(os.Getenv)
+	ws := workspace.DetectWorkspaceFromEnv(os.Getenv)
 	if ws.IsLocal() {
 		return nil
 	}
@@ -346,7 +347,7 @@ func configInitRun(opts *ConfigInitOptions) error {
 		if err := saveInitConfig(opts.ProfileName, existing, f, opts.AppID, secret, brand, opts.Lang); err != nil {
 			return wrapSaveConfigError(err)
 		}
-		output.PrintSuccess(f.IOStreams.ErrOut, fmt.Sprintf("Configuration saved to %s", core.GetConfigPath()))
+		output.PrintSuccess(f.IOStreams.ErrOut, fmt.Sprintf("Configuration saved to %s", workspace.GetConfigPath()))
 		printLangPreferenceConfirmation(opts)
 		output.PrintJson(f.IOStreams.Out, map[string]interface{}{"appId": opts.AppID, "appSecret": "****", "brand": brand})
 		if err := runProbe(opts.Ctx, f, opts.AppID, opts.appSecret, brand); err != nil {
@@ -521,7 +522,7 @@ func configInitRun(opts *ConfigInitOptions) error {
 	if err := saveInitConfig(opts.ProfileName, existing, f, resolvedAppId, storedSecret, parseBrand(resolvedBrand), opts.Lang); err != nil {
 		return wrapSaveConfigError(err)
 	}
-	output.PrintSuccess(f.IOStreams.ErrOut, fmt.Sprintf("Configuration saved to %s", core.GetConfigPath()))
+	output.PrintSuccess(f.IOStreams.ErrOut, fmt.Sprintf("Configuration saved to %s", workspace.GetConfigPath()))
 	printLangPreferenceConfirmation(opts)
 	if appSecretInput != "" {
 		if err := runProbe(opts.Ctx, f, resolvedAppId, appSecretInput, parseBrand(resolvedBrand)); err != nil {
diff --git a/cmd/config/show.go b/cmd/config/show.go
index 5526f0254a..67f8e22c79 100644
--- a/cmd/config/show.go
+++ b/cmd/config/show.go
@@ -13,6 +13,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/internal/workspace"
 	"github.com/spf13/cobra"
 )
 
@@ -66,7 +67,7 @@ func configShowRun(opts *ConfigShowOptions) error {
 		users = strings.Join(userStrs, ", ")
 	}
 	output.PrintJson(f.IOStreams.Out, map[string]interface{}{
-		"workspace": core.CurrentWorkspace().Display(),
+		"workspace": workspace.CurrentWorkspace().Display(),
 		"profile":   app.ProfileName(),
 		"appId":     app.AppId,
 		"appSecret": "****",
@@ -74,6 +75,6 @@ func configShowRun(opts *ConfigShowOptions) error {
 		"lang":      app.Lang,
 		"users":     users,
 	})
-	fmt.Fprintf(f.IOStreams.ErrOut, "\nConfig file path: %s\n", core.GetConfigPath())
+	fmt.Fprintf(f.IOStreams.ErrOut, "\nConfig file path: %s\n", workspace.GetConfigPath())
 	return nil
 }
diff --git a/cmd/doctor/doctor.go b/cmd/doctor/doctor.go
index 7017fe9f24..a960ce939b 100644
--- a/cmd/doctor/doctor.go
+++ b/cmd/doctor/doctor.go
@@ -23,6 +23,7 @@ import (
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/transport"
 	"github.com/larksuite/cli/internal/update"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // DoctorOptions holds inputs for the doctor command.
@@ -240,7 +241,7 @@ func finishDoctor(f *cmdutil.Factory, checks []checkResult) error {
 
 	result := map[string]interface{}{
 		"ok":        allOK,
-		"workspace": core.CurrentWorkspace().Display(),
+		"workspace": workspace.CurrentWorkspace().Display(),
 		"checks":    checks,
 	}
 	output.PrintJson(f.IOStreams.Out, result)
diff --git a/cmd/event/bus.go b/cmd/event/bus.go
index 61d2d3c0e1..e5db061e56 100644
--- a/cmd/event/bus.go
+++ b/cmd/event/bus.go
@@ -14,10 +14,10 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/event"
 	"github.com/larksuite/cli/internal/event/bus"
 	"github.com/larksuite/cli/internal/event/transport"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // NewCmdBus creates the hidden `event _bus` daemon subcommand, forked by the consume client; fork argv lives in consume/startup.go.
@@ -35,7 +35,7 @@ func NewCmdBus(f *cmdutil.Factory) *cobra.Command {
 			}
 
 			// Sanitize AppID: an unsanitized value could escape events/ via ".." or separators.
-			eventsDir := filepath.Join(core.GetConfigDir(), "events", event.SanitizeAppID(cfg.AppID))
+			eventsDir := filepath.Join(workspace.GetConfigDir(), "events", event.SanitizeAppID(cfg.AppID))
 
 			logger, err := bus.SetupBusLogger(eventsDir)
 			if err != nil {
diff --git a/cmd/platform_bootstrap.go b/cmd/platform_bootstrap.go
index 9b1b57ac35..e8f3209be5 100644
--- a/cmd/platform_bootstrap.go
+++ b/cmd/platform_bootstrap.go
@@ -14,10 +14,10 @@ import (
 
 	"github.com/larksuite/cli/extension/platform"
 	"github.com/larksuite/cli/internal/cmdpolicy"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/hook"
 	internalplatform "github.com/larksuite/cli/internal/platform"
 	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // userPolicyFileName is the conventional filename for the user-layer Rule.
@@ -261,7 +261,7 @@ func splitCSV(s string) []string {
 // userPolicyPath returns the path of <baseConfigDir>/policy.yml.
 //
 // The base directory honours LARKSUITE_CLI_CONFIG_DIR (via
-// core.GetBaseConfigDir) so that test isolation, container deployments
+// workspace.GetBaseConfigDir) so that test isolation, container deployments
 // and per-Agent config overrides all see a consistent policy location.
 // Using vfs.UserHomeDir directly here would silently bypass the env
 // override and route every test through the real ~/.lark-cli.
@@ -271,7 +271,7 @@ func splitCSV(s string) []string {
 // the home dir can't be resolved, and the resolver already treats a
 // missing file as "no policy".
 func userPolicyPath() (string, error) {
-	return filepath.Join(core.GetBaseConfigDir(), userPolicyFileName), nil
+	return filepath.Join(workspace.GetBaseConfigDir(), userPolicyFileName), nil
 }
 
 // warnPolicyError writes a one-line stderr warning when the user policy
diff --git a/cmd/root_upgrade_test.go b/cmd/root_upgrade_test.go
index bc28b858ff..a085706bc6 100644
--- a/cmd/root_upgrade_test.go
+++ b/cmd/root_upgrade_test.go
@@ -14,7 +14,7 @@ import (
 
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/workspace"
 	"github.com/spf13/cobra"
 )
 
@@ -68,9 +68,9 @@ func TestOfferRootUpgrade(t *testing.T) {
 	// workspace detection; pin the process-global workspace to Local so
 	// statePath() resolves under LARKSUITE_CLI_CONFIG_DIR rather than a stale
 	// subdir inherited from a prior test in the package.
-	origWS := core.CurrentWorkspace()
-	t.Cleanup(func() { core.SetCurrentWorkspace(origWS) })
-	core.SetCurrentWorkspace(core.WorkspaceLocal)
+	origWS := workspace.CurrentWorkspace()
+	t.Cleanup(func() { workspace.SetCurrentWorkspace(origWS) })
+	workspace.SetCurrentWorkspace(workspace.WorkspaceLocal)
 
 	cases := []struct {
 		name                string
diff --git a/internal/auth/uat_client.go b/internal/auth/uat_client.go
index e7bff5a7e1..d59f2a7ad4 100644
--- a/internal/auth/uat_client.go
+++ b/internal/auth/uat_client.go
@@ -23,6 +23,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 var safeIDChars = regexp.MustCompile(`[^a-zA-Z0-9._-]`)
@@ -129,7 +130,7 @@ func refreshWithLock(httpClient *http.Client, opts UATCallOptions, stored *Store
 	// 2. Cross-process lock using flock
 	// We use the same underlying storage directory resolution as keychain_other.go
 	// to ensure locks are isolated properly alongside other sensitive data.
-	configDir := core.GetConfigDir()
+	configDir := workspace.GetConfigDir()
 
 	lockDir := filepath.Join(configDir, "locks")
 	if err := vfs.MkdirAll(lockDir, 0700); err != nil {
diff --git a/internal/authlog/authlog.go b/internal/authlog/authlog.go
index 04c42fa0e5..d18d6d4103 100644
--- a/internal/authlog/authlog.go
+++ b/internal/authlog/authlog.go
@@ -114,7 +114,7 @@ func Shared() *Logger {
 
 func defaultRuntimeDir() string {
 	if dir := os.Getenv("LARKSUITE_CLI_CONFIG_DIR"); dir != "" {
-		// Deliberately unvalidated, mirroring core.GetBaseConfigDir. Routing this
+		// Deliberately unvalidated, mirroring workspace.GetBaseConfigDir. Routing this
 		// through validate.SafeEnvDirPath would also resolve symlinks, changing
 		// the directory the CLI reports and uses on any host where the path
 		// crosses one — applying it moved four packages' expectations from /var
diff --git a/internal/cmdutil/factory_default.go b/internal/cmdutil/factory_default.go
index 04c318b8ce..21aa8bec6c 100644
--- a/internal/cmdutil/factory_default.go
+++ b/internal/cmdutil/factory_default.go
@@ -28,6 +28,7 @@ import (
 	_ "github.com/larksuite/cli/internal/security/contentsafety" // register content safety provider
 	"github.com/larksuite/cli/internal/transport"
 	_ "github.com/larksuite/cli/internal/vfs/localfileio" // register default FileIO provider
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // NewDefault creates a production Factory with cached closures.
@@ -48,14 +49,14 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 	// Workspace detection: determines which config subtree to use.
 	// Must run before any config or credential load, since those paths are
 	// workspace-scoped. Default is WorkspaceLocal — existing behavior unchanged.
-	ws := core.DetectWorkspaceFromEnv(os.Getenv)
-	core.SetCurrentWorkspace(ws)
+	ws := workspace.DetectWorkspaceFromEnv(os.Getenv)
+	workspace.SetCurrentWorkspace(ws)
 
 	// Auth diagnostics: install the one logger the whole process shares, now
 	// that the workspace is known. authlog cannot resolve the workspace-aware
 	// directory itself (core imports keychain, which imports authlog), so this
 	// is the only place that can supply it.
-	authlog.SetShared(authlog.New(authlog.Options{RuntimeDir: core.GetRuntimeDir}))
+	authlog.SetShared(authlog.New(authlog.Options{RuntimeDir: workspace.GetRuntimeDir}))
 
 	// Phase 0: FileIO provider (no dependency)
 	f.FileIOProvider = fileio.GetProvider()
diff --git a/internal/core/config.go b/internal/core/config.go
index 2f1117e905..03858b7cc9 100644
--- a/internal/core/config.go
+++ b/internal/core/config.go
@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"path/filepath"
 	"strings"
 	"unicode/utf8"
 
@@ -17,6 +16,7 @@ import (
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // Identity represents the caller identity for API requests.
@@ -182,19 +182,6 @@ func (c *CliConfig) CanBot() bool {
 	return c.SupportedIdentities == 0 || c.SupportedIdentities&identityBotBit != 0
 }
 
-// GetConfigDir returns the config directory path for the current workspace.
-// When workspace is local (default), this returns the same path as before
-// (LARKSUITE_CLI_CONFIG_DIR or ~/.lark-cli) — fully backward-compatible.
-// When workspace is openclaw/hermes, returns base/openclaw or base/hermes.
-func GetConfigDir() string {
-	return GetRuntimeDir()
-}
-
-// GetConfigPath returns the config file path for the current workspace.
-func GetConfigPath() string {
-	return filepath.Join(GetConfigDir(), "config.json")
-}
-
 // ErrMalformedConfig marks a config-load failure caused by malformed file
 // content (unparseable JSON, structurally empty) rather than a missing or
 // unreadable file. Callers classify with errors.Is rather than sniffing the
@@ -203,7 +190,7 @@ var ErrMalformedConfig = errors.New("malformed config")
 
 // LoadMultiAppConfig loads multi-app config from disk.
 func LoadMultiAppConfig() (*MultiAppConfig, error) {
-	data, err := vfs.ReadFile(GetConfigPath())
+	data, err := vfs.ReadFile(workspace.GetConfigPath())
 	if err != nil {
 		return nil, err
 	}
@@ -220,7 +207,7 @@ func LoadMultiAppConfig() (*MultiAppConfig, error) {
 
 // SaveMultiAppConfig saves config to disk.
 func SaveMultiAppConfig(config *MultiAppConfig) error {
-	dir := GetConfigDir()
+	dir := workspace.GetConfigDir()
 	if err := vfs.MkdirAll(dir, 0700); err != nil {
 		return err
 	}
@@ -228,7 +215,7 @@ func SaveMultiAppConfig(config *MultiAppConfig) error {
 	if err != nil {
 		return err
 	}
-	return validate.AtomicWrite(GetConfigPath(), append(data, '\n'), 0600)
+	return validate.AtomicWrite(workspace.GetConfigPath(), append(data, '\n'), 0600)
 }
 
 // RequireConfig loads the single-app config using the default profile resolution.
diff --git a/internal/core/notconfigured.go b/internal/core/notconfigured.go
index 068ea86cfa..f68d0cba41 100644
--- a/internal/core/notconfigured.go
+++ b/internal/core/notconfigured.go
@@ -8,6 +8,7 @@ import (
 	"os"
 
 	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // isMalformedConfigError reports whether a config load failure indicates a
@@ -69,8 +70,8 @@ const (
 // NotConfiguredError returns the canonical "not configured" error, with a
 // hint that depends on the active workspace:
 //
-//   - WorkspaceLocal → suggest `config init --new` (creates a new app).
-//   - WorkspaceOpenClaw / WorkspaceHermes → point at `config bind --help`
+//   - workspace.WorkspaceLocal → suggest `config init --new` (creates a new app).
+//   - workspace.WorkspaceOpenClaw / workspace.WorkspaceHermes → point at `config bind --help`
 //     rather than a ready-to-run command, because binding is policy-laden:
 //     the user must pick an identity preset (bot-only vs user-default),
 //     and re-binding may overwrite an existing one. The help text walks
@@ -79,7 +80,7 @@ const (
 // All "config not loaded yet" call sites should use this helper rather than
 // hand-rolling a hint, so AI agents always get a workspace-correct next step.
 func NotConfiguredError() error {
-	ws := CurrentWorkspace()
+	ws := workspace.CurrentWorkspace()
 	if ws.IsLocal() {
 		return errs.NewConfigError(errs.SubtypeNotConfigured, "not configured").
 			WithHint("%s", localInitHint)
@@ -97,7 +98,7 @@ func NotConfiguredError() error {
 // Agent → `config bind --help` so the AI reads the binding workflow and
 // confirms identity preset with the user before running the actual command.
 func reconfigureHint() string {
-	if CurrentWorkspace().IsLocal() {
+	if workspace.CurrentWorkspace().IsLocal() {
 		return "please run `lark-cli config init` to reconfigure"
 	}
 	return agentBindHint
@@ -108,7 +109,7 @@ func reconfigureHint() string {
 // workspaces a missing profile typically means the binding was wiped while
 // the workspace marker remained — re-binding is the correct fix, not init.
 func NoActiveProfileError() error {
-	ws := CurrentWorkspace()
+	ws := workspace.CurrentWorkspace()
 	if ws.IsLocal() {
 		return errs.NewConfigError(errs.SubtypeNotConfigured, "no active profile").
 			WithHint("%s", localInitHint)
diff --git a/internal/core/notconfigured_test.go b/internal/core/notconfigured_test.go
index d546fbe4a1..d88074fc5e 100644
--- a/internal/core/notconfigured_test.go
+++ b/internal/core/notconfigured_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // saveAndRestoreWorkspace ensures package-level currentWorkspace is reset
@@ -17,13 +18,13 @@ import (
 // accident.
 func saveAndRestoreWorkspace(t *testing.T) {
 	t.Helper()
-	prev := CurrentWorkspace()
-	t.Cleanup(func() { SetCurrentWorkspace(prev) })
+	prev := workspace.CurrentWorkspace()
+	t.Cleanup(func() { workspace.SetCurrentWorkspace(prev) })
 }
 
 func TestNotConfiguredError_Local(t *testing.T) {
 	saveAndRestoreWorkspace(t)
-	SetCurrentWorkspace(WorkspaceLocal)
+	workspace.SetCurrentWorkspace(workspace.WorkspaceLocal)
 
 	err := NotConfiguredError()
 	var cfgErr *errs.ConfigError
@@ -46,7 +47,7 @@ func TestNotConfiguredError_Local(t *testing.T) {
 
 func TestNotConfiguredError_OpenClaw(t *testing.T) {
 	saveAndRestoreWorkspace(t)
-	SetCurrentWorkspace(WorkspaceOpenClaw)
+	workspace.SetCurrentWorkspace(workspace.WorkspaceOpenClaw)
 
 	err := NotConfiguredError()
 	var cfgErr *errs.ConfigError
@@ -74,7 +75,7 @@ func TestNotConfiguredError_OpenClaw(t *testing.T) {
 
 func TestNotConfiguredError_Hermes(t *testing.T) {
 	saveAndRestoreWorkspace(t)
-	SetCurrentWorkspace(WorkspaceHermes)
+	workspace.SetCurrentWorkspace(workspace.WorkspaceHermes)
 
 	err := NotConfiguredError()
 	var cfgErr *errs.ConfigError
@@ -94,7 +95,7 @@ func TestNotConfiguredError_Hermes(t *testing.T) {
 
 func TestNoActiveProfileError_Local(t *testing.T) {
 	saveAndRestoreWorkspace(t)
-	SetCurrentWorkspace(WorkspaceLocal)
+	workspace.SetCurrentWorkspace(workspace.WorkspaceLocal)
 
 	err := NoActiveProfileError()
 	var cfgErr *errs.ConfigError
@@ -108,7 +109,7 @@ func TestNoActiveProfileError_Local(t *testing.T) {
 
 func TestNoActiveProfileError_AgentSuggestsBind(t *testing.T) {
 	saveAndRestoreWorkspace(t)
-	SetCurrentWorkspace(WorkspaceOpenClaw)
+	workspace.SetCurrentWorkspace(workspace.WorkspaceOpenClaw)
 
 	err := NoActiveProfileError()
 	var cfgErr *errs.ConfigError
@@ -122,7 +123,7 @@ func TestNoActiveProfileError_AgentSuggestsBind(t *testing.T) {
 
 func TestReconfigureHint_Local(t *testing.T) {
 	saveAndRestoreWorkspace(t)
-	SetCurrentWorkspace(WorkspaceLocal)
+	workspace.SetCurrentWorkspace(workspace.WorkspaceLocal)
 
 	got := reconfigureHint()
 	if !strings.Contains(got, "config init") {
@@ -132,7 +133,7 @@ func TestReconfigureHint_Local(t *testing.T) {
 
 func TestReconfigureHint_Agent(t *testing.T) {
 	saveAndRestoreWorkspace(t)
-	SetCurrentWorkspace(WorkspaceHermes)
+	workspace.SetCurrentWorkspace(workspace.WorkspaceHermes)
 
 	got := reconfigureHint()
 	if !strings.Contains(got, "config bind --help") {
@@ -142,7 +143,7 @@ func TestReconfigureHint_Agent(t *testing.T) {
 
 func TestLoadOrNotConfigured_FileMissing_ReturnsNotConfigured(t *testing.T) {
 	saveAndRestoreWorkspace(t)
-	SetCurrentWorkspace(WorkspaceLocal)
+	workspace.SetCurrentWorkspace(workspace.WorkspaceLocal)
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
 	_, err := LoadOrNotConfigured()
diff --git a/internal/event/bus/bus.go b/internal/event/bus/bus.go
index 849285694d..1230baa6c0 100644
--- a/internal/event/bus/bus.go
+++ b/internal/event/bus/bus.go
@@ -17,13 +17,13 @@ import (
 	"sync"
 	"time"
 
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/event"
 	"github.com/larksuite/cli/internal/event/busdiscover"
 	"github.com/larksuite/cli/internal/event/protocol"
 	"github.com/larksuite/cli/internal/event/source"
 	"github.com/larksuite/cli/internal/event/transport"
 	"github.com/larksuite/cli/internal/lockfile"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 const (
@@ -73,7 +73,7 @@ func (b *Bus) Run(ctx context.Context) error {
 
 	// alive.lock before bind: closes the cleanup-TOCTOU race where two newly forked
 	// buses each unlink and rebind the socket. Brief retry covers stop-then-restart.
-	eventsDir := filepath.Join(core.GetConfigDir(), "events", event.SanitizeAppID(b.appID))
+	eventsDir := filepath.Join(workspace.GetConfigDir(), "events", event.SanitizeAppID(b.appID))
 	pidHandle, pidErr := acquireAliveLock(eventsDir)
 	if pidErr != nil {
 		if errors.Is(pidErr, lockfile.ErrHeld) {
diff --git a/internal/event/busdiscover/busdiscover.go b/internal/event/busdiscover/busdiscover.go
index 53e67cf930..5c50675725 100644
--- a/internal/event/busdiscover/busdiscover.go
+++ b/internal/event/busdiscover/busdiscover.go
@@ -8,7 +8,7 @@ import (
 	"path/filepath"
 	"time"
 
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 type Process struct {
@@ -22,7 +22,7 @@ type Scanner interface {
 }
 
 func Default() Scanner {
-	return &fsScanner{eventsDir: filepath.Join(core.GetConfigDir(), "events")}
+	return &fsScanner{eventsDir: filepath.Join(workspace.GetConfigDir(), "events")}
 }
 
 type fsScanner struct {
diff --git a/internal/event/consume/startup.go b/internal/event/consume/startup.go
index 890e1c7723..35d11691f8 100644
--- a/internal/event/consume/startup.go
+++ b/internal/event/consume/startup.go
@@ -17,12 +17,12 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/event"
 	"github.com/larksuite/cli/internal/event/protocol"
 	"github.com/larksuite/cli/internal/event/transport"
 	"github.com/larksuite/cli/internal/lockfile"
 	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 const (
@@ -64,7 +64,7 @@ func EnsureBus(ctx context.Context, tr transport.IPC, appID, profileName, domain
 	// ErrHeld = another consume is forking; let dial retry catch its bus.
 	pid, forkErr := forkBus(tr, appID, profileName, domain)
 	if forkErr != nil && !errors.Is(forkErr, lockfile.ErrHeld) {
-		eventsRoot := filepath.Join(core.GetConfigDir(), "events")
+		eventsRoot := filepath.Join(workspace.GetConfigDir(), "events")
 		return nil, errs.NewInternalError(errs.SubtypeUnknown,
 			"failed to start event bus daemon: %s", forkErr).
 			WithCause(forkErr).
@@ -86,7 +86,7 @@ func EnsureBus(ctx context.Context, tr transport.IPC, appID, profileName, domain
 		}
 	}
 
-	logPath := filepath.Join(core.GetConfigDir(), "events", event.SanitizeAppID(appID), "bus.log")
+	logPath := filepath.Join(workspace.GetConfigDir(), "events", event.SanitizeAppID(appID), "bus.log")
 	fmt.Fprintln(errOut, "[event] event bus exited unexpectedly.")
 	fmt.Fprintln(errOut, "[event] please check app credentials (lark-cli config show) and retry.")
 	fmt.Fprintf(errOut, "[event] logs: %s\n", logPath)
@@ -125,7 +125,7 @@ func probeAndDialBus(tr transport.IPC, addr string) (net.Conn, error) {
 
 // forkBus holds bus.fork.lock until the spawned daemon is dial-able, so concurrent callers can't race past the empty-socket gap and fork independent buses.
 func forkBus(tr transport.IPC, appID, profileName, domain string) (int, error) {
-	lockPath := filepath.Join(core.GetConfigDir(), "events", event.SanitizeAppID(appID), "bus.fork.lock")
+	lockPath := filepath.Join(workspace.GetConfigDir(), "events", event.SanitizeAppID(appID), "bus.fork.lock")
 	if err := vfs.MkdirAll(filepath.Dir(lockPath), 0700); err != nil {
 		return 0, err
 	}
diff --git a/internal/event/transport/transport_unix.go b/internal/event/transport/transport_unix.go
index 86dec4f4bf..470eded50e 100644
--- a/internal/event/transport/transport_unix.go
+++ b/internal/event/transport/transport_unix.go
@@ -10,9 +10,9 @@ import (
 	"path/filepath"
 	"time"
 
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/event"
 	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 const dialTimeout = 5 * time.Second // matches winio.DialPipe for cross-platform symmetry
@@ -36,7 +36,7 @@ func (t *unixTransport) Dial(addr string) (net.Conn, error) {
 
 // Address: NOT os.UserHomeDir — honours LARKSUITE_CLI_CONFIG_DIR override.
 func (t *unixTransport) Address(appID string) string {
-	return filepath.Join(core.GetConfigDir(), "events", event.SanitizeAppID(appID), "bus.sock")
+	return filepath.Join(workspace.GetConfigDir(), "events", event.SanitizeAppID(appID), "bus.sock")
 }
 
 func (t *unixTransport) Cleanup(addr string) {
diff --git a/internal/lockfile/lockfile.go b/internal/lockfile/lockfile.go
index 6f64298d06..2e46f11322 100644
--- a/internal/lockfile/lockfile.go
+++ b/internal/lockfile/lockfile.go
@@ -10,8 +10,8 @@ import (
 	"path/filepath"
 	"regexp"
 
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // safeIDChars strips path-traversal chars from app IDs.
@@ -34,7 +34,7 @@ func ForSubscribe(appID string) (*LockFile, error) {
 	if appID == "" {
 		return nil, fmt.Errorf("app ID must not be empty")
 	}
-	dir := filepath.Join(core.GetConfigDir(), "locks")
+	dir := filepath.Join(workspace.GetConfigDir(), "locks")
 	if err := vfs.MkdirAll(dir, 0700); err != nil {
 		return nil, fmt.Errorf("create lock dir: %w", err)
 	}
diff --git a/internal/registry/remote.go b/internal/registry/remote.go
index f73d71ac1f..948f2c20aa 100644
--- a/internal/registry/remote.go
+++ b/internal/registry/remote.go
@@ -17,11 +17,11 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/build"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/meta"
 	"github.com/larksuite/cli/internal/transport"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 const (
@@ -96,7 +96,7 @@ func metaTTL() time.Duration {
 // --- cache path helpers ---
 
 func cacheDir() string {
-	return filepath.Join(core.GetConfigDir(), "cache")
+	return filepath.Join(workspace.GetConfigDir(), "cache")
 }
 
 func cachePath() string {
diff --git a/internal/security/contentsafety/provider.go b/internal/security/contentsafety/provider.go
index 0ec3d76995..29de179d20 100644
--- a/internal/security/contentsafety/provider.go
+++ b/internal/security/contentsafety/provider.go
@@ -10,7 +10,7 @@ import (
 	"sync"
 
 	extcs "github.com/larksuite/cli/extension/contentsafety"
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // regexProvider implements extcs.Provider using regex rules from config file.
@@ -76,6 +76,6 @@ func (p *regexProvider) loadOrCreate(errOut io.Writer) (*Config, error) {
 
 func init() {
 	extcs.Register(&regexProvider{
-		configDir: core.GetConfigDir(),
+		configDir: workspace.GetConfigDir(),
 	})
 }
diff --git a/internal/skillscheck/state.go b/internal/skillscheck/state.go
index eddab1cf3a..9628ce04bd 100644
--- a/internal/skillscheck/state.go
+++ b/internal/skillscheck/state.go
@@ -10,9 +10,9 @@ import (
 	"io/fs"
 	"path/filepath"
 
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 const (
@@ -31,7 +31,7 @@ type SkillsState struct {
 }
 
 func statePath() string {
-	return filepath.Join(core.GetBaseConfigDir(), stateFile)
+	return filepath.Join(workspace.GetBaseConfigDir(), stateFile)
 }
 
 func ReadState() (*SkillsState, bool, error) {
@@ -58,7 +58,7 @@ func ReadState() (*SkillsState, bool, error) {
 func WriteState(state SkillsState) error {
 	state.ensureNonNilSlices()
 
-	if err := vfs.MkdirAll(core.GetBaseConfigDir(), 0o700); err != nil {
+	if err := vfs.MkdirAll(workspace.GetBaseConfigDir(), 0o700); err != nil {
 		return err
 	}
 	data, err := json.MarshalIndent(state, "", "  ")
diff --git a/internal/sparkstore/storage.go b/internal/sparkstore/storage.go
index 4223ded955..73e7a2abd3 100644
--- a/internal/sparkstore/storage.go
+++ b/internal/sparkstore/storage.go
@@ -11,9 +11,9 @@ import (
 	"path/filepath"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 // storageRoot is the per-domain local-storage directory name under the config dir.
@@ -47,7 +47,7 @@ func appKeyPath(appID, key string) string {
 
 // Root returns the Spark application storage root under the CLI config directory.
 func Root() string {
-	return filepath.Join(core.GetConfigDir(), storageRoot)
+	return filepath.Join(workspace.GetConfigDir(), storageRoot)
 }
 
 // Path returns the storage path for one application key.
diff --git a/internal/transport/config.go b/internal/transport/config.go
index 4fe64ddcff..fcaeaf0116 100644
--- a/internal/transport/config.go
+++ b/internal/transport/config.go
@@ -23,13 +23,13 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/internal/secaudit"
 	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
-// ConfigFileName is the fixed config file name under core.GetConfigDir().
+// ConfigFileName is the fixed config file name under workspace.GetConfigDir().
 const (
 	ConfigFileName = "proxy_config.json"
 )
@@ -48,7 +48,7 @@ type Config struct {
 
 // Path returns the absolute path to the proxy plugin config file.
 func Path() string {
-	return filepath.Join(core.GetConfigDir(), ConfigFileName)
+	return filepath.Join(workspace.GetConfigDir(), ConfigFileName)
 }
 
 // loadOnce guards one-time proxy config loading for process-wide transport reuse.
diff --git a/internal/update/update.go b/internal/update/update.go
index 7bdc61d9c2..169430f5ba 100644
--- a/internal/update/update.go
+++ b/internal/update/update.go
@@ -16,10 +16,10 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/transport"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/internal/vfs"
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 const (
@@ -163,7 +163,7 @@ func IsCIEnv() bool {
 // --- state file I/O ---
 
 func statePath() string {
-	return filepath.Join(core.GetConfigDir(), stateFile)
+	return filepath.Join(workspace.GetConfigDir(), stateFile)
 }
 
 func loadState() (*updateState, error) {
@@ -179,7 +179,7 @@ func loadState() (*updateState, error) {
 }
 
 func saveState(s *updateState) error {
-	dir := core.GetConfigDir()
+	dir := workspace.GetConfigDir()
 	if err := vfs.MkdirAll(dir, 0700); err != nil {
 		return err
 	}
diff --git a/internal/core/workspace.go b/internal/workspace/workspace.go
similarity index 92%
rename from internal/core/workspace.go
rename to internal/workspace/workspace.go
index 181a6bce1f..f0b0b8f512 100644
--- a/internal/core/workspace.go
+++ b/internal/workspace/workspace.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package workspace
 
 import (
 	"os"
@@ -159,3 +159,16 @@ func GetRuntimeDir() string {
 	}
 	return filepath.Join(base, string(ws))
 }
+
+// GetConfigDir returns the config directory path for the current workspace.
+// When workspace is local (default), this returns the same path as before
+// (LARKSUITE_CLI_CONFIG_DIR or ~/.lark-cli) — fully backward-compatible.
+// When workspace is openclaw/hermes, returns base/openclaw or base/hermes.
+func GetConfigDir() string {
+	return GetRuntimeDir()
+}
+
+// GetConfigPath returns the config file path for the current workspace.
+func GetConfigPath() string {
+	return filepath.Join(GetConfigDir(), "config.json")
+}
diff --git a/internal/core/workspace_test.go b/internal/workspace/workspace_test.go
similarity index 99%
rename from internal/core/workspace_test.go
rename to internal/workspace/workspace_test.go
index 846fbb750d..c1555ecb43 100644
--- a/internal/core/workspace_test.go
+++ b/internal/workspace/workspace_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package workspace
 
 import (
 	"path/filepath"
diff --git a/shortcuts/apps/git_credential_test.go b/shortcuts/apps/git_credential_test.go
index 4fa1a210b9..7f7559ba69 100644
--- a/shortcuts/apps/git_credential_test.go
+++ b/shortcuts/apps/git_credential_test.go
@@ -28,6 +28,7 @@ import (
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/sparkstore"
+	"github.com/larksuite/cli/internal/workspace"
 	"github.com/larksuite/cli/shortcuts/apps/gitcred"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -533,7 +534,7 @@ func TestGitCredentialAppStorageListAppIDsSkipsNonCredentialAppDirs(t *testing.T
 	if err := sparkstore.Write("app_b", gitcred.MetadataFilename, []byte("{}")); err != nil {
 		t.Fatalf("Write app_b metadata: %v", err)
 	}
-	root := filepath.Join(core.GetConfigDir(), "spark")
+	root := filepath.Join(workspace.GetConfigDir(), "spark")
 	if err := os.WriteFile(filepath.Join(root, "not-an-app-dir"), []byte("x"), 0600); err != nil {
 		t.Fatalf("write non-dir: %v", err)
 	}
@@ -559,7 +560,7 @@ func TestGitCredentialAppStorageListAppIDsSkipsNonCredentialAppDirs(t *testing.T
 func TestAppsGitCredentialListReturnsScanErrors(t *testing.T) {
 	t.Run("storage root error", func(t *testing.T) {
 		factory, stdout, _ := newAppsExecuteFactory(t)
-		root := filepath.Join(core.GetConfigDir(), "spark")
+		root := filepath.Join(workspace.GetConfigDir(), "spark")
 		if err := os.WriteFile(root, []byte("not a dir"), 0600); err != nil {
 			t.Fatalf("write storage root blocker: %v", err)
 		}
@@ -600,7 +601,7 @@ func TestListGitCredentialRecordsSortsDuplicateDecodedAppIDs(t *testing.T) {
 	if err := manager.Store.Upsert(record); err != nil {
 		t.Fatalf("Upsert returned error: %v", err)
 	}
-	if err := os.Mkdir(filepath.Join(core.GetConfigDir(), "spark", "app%5Fx"), 0700); err != nil {
+	if err := os.Mkdir(filepath.Join(workspace.GetConfigDir(), "spark", "app%5Fx"), 0700); err != nil {
 		t.Fatalf("mkdir duplicate encoded app dir: %v", err)
 	}
 
diff --git a/shortcuts/apps/gitcred/lock.go b/shortcuts/apps/gitcred/lock.go
index 8723e82d5e..85f4c5a189 100644
--- a/shortcuts/apps/gitcred/lock.go
+++ b/shortcuts/apps/gitcred/lock.go
@@ -29,9 +29,9 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/lockfile"
 	"github.com/larksuite/cli/internal/vfs" //nolint:depguard // git credential locks live under CLI config dir and are not user file I/O.
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 var urlLocks sync.Map
@@ -57,7 +57,7 @@ func lockURL(url string) func() {
 // Lock ordering: when both lockApp and lockURL are needed, lockApp must be
 // taken FIRST. See package comment for the full convention.
 func lockApp(appID string) (func(), error) {
-	dir := filepath.Join(core.GetConfigDir(), "locks")
+	dir := filepath.Join(workspace.GetConfigDir(), "locks")
 	if err := vfs.MkdirAll(dir, 0700); err != nil {
 		return nil, errs.NewInternalError(errs.SubtypeStorage, "create Git credential lock dir: %v", err).WithCause(err)
 	}
diff --git a/shortcuts/apps/gitcred/store.go b/shortcuts/apps/gitcred/store.go
index 6b1988a9b9..215437cc1f 100644
--- a/shortcuts/apps/gitcred/store.go
+++ b/shortcuts/apps/gitcred/store.go
@@ -11,9 +11,9 @@ import (
 	"path/filepath"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/internal/vfs" //nolint:depguard // git credential metadata is CLI config-dir state, not user file I/O.
+	"github.com/larksuite/cli/internal/workspace"
 )
 
 type AppStorage interface {
@@ -29,7 +29,7 @@ type Store struct {
 }
 
 func NewStore() *Store {
-	return &Store{path: filepath.Join(core.GetConfigDir(), MetadataFilename)}
+	return &Store{path: filepath.Join(workspace.GetConfigDir(), MetadataFilename)}
 }
 
 func NewAppStore(appID string, storage AppStorage) *Store {

From c69a61c6725499a08a783eb58f99752f043938eb Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 14:04:51 +0800
Subject: [PATCH 41/50] refactor(core): extract secret storage

---
 cmd/auth/logout.go                            |  3 +-
 cmd/auth/logout_test.go                       |  9 ++---
 cmd/config/bind.go                            |  3 +-
 cmd/config/bind_test.go                       | 11 +++---
 cmd/config/binder.go                          |  7 ++--
 cmd/config/config_test.go                     | 17 ++++-----
 cmd/config/init.go                            | 23 ++++++------
 cmd/config/init_test.go                       |  7 ++--
 cmd/config/remove.go                          |  3 +-
 cmd/config/risk_control_test.go               |  7 ++--
 cmd/config/strict_mode_test.go                |  5 +--
 cmd/doctor/doctor_test.go                     |  5 +--
 cmd/global_flags_test.go                      |  7 ++--
 cmd/profile/add.go                            |  3 +-
 cmd/profile/profile_test.go                   | 35 ++++++++++---------
 cmd/profile/remove.go                         |  3 +-
 cmd/root_integration_test.go                  |  5 +--
 internal/cmdutil/factory_default_test.go      |  7 ++--
 internal/core/config.go                       | 23 ++++++------
 internal/core/config_strict_mode_test.go      |  5 +--
 internal/core/config_test.go                  | 21 +++++------
 internal/credential/integration_test.go       |  5 +--
 internal/{core => secret}/secret.go           |  2 +-
 internal/{core => secret}/secret_resolve.go   |  6 ++--
 .../{core => secret}/secret_resolve_test.go   | 14 ++++----
 25 files changed, 129 insertions(+), 107 deletions(-)
 rename internal/{core => secret}/secret.go (99%)
 rename internal/{core => secret}/secret_resolve.go (94%)
 rename internal/{core => secret}/secret_resolve_test.go (75%)

diff --git a/cmd/auth/logout.go b/cmd/auth/logout.go
index 7e82127edd..da8d805fbf 100644
--- a/cmd/auth/logout.go
+++ b/cmd/auth/logout.go
@@ -13,6 +13,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/internal/secret"
 )
 
 // LogoutOptions holds all inputs for auth logout.
@@ -73,7 +74,7 @@ func authLogoutRun(opts *LogoutOptions) error {
 	}
 
 	httpClient, httpErr := f.HttpClient()
-	appSecret, secretErr := core.ResolveSecretInput(app.AppSecret, f.Keychain)
+	appSecret, secretErr := secret.ResolveSecretInput(app.AppSecret, f.Keychain)
 
 	for _, user := range app.Users {
 		if httpErr == nil && secretErr == nil {
diff --git a/cmd/auth/logout_test.go b/cmd/auth/logout_test.go
index 5a1a3cf008..2c8c5e553a 100644
--- a/cmd/auth/logout_test.go
+++ b/cmd/auth/logout_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/secret"
 	"github.com/zalando/go-keyring"
 )
 
@@ -24,7 +25,7 @@ func writeLogoutConfig(t *testing.T, users []core.AppUser) {
 		Apps: []core.AppConfig{
 			{
 				AppId:     "test-app",
-				AppSecret: core.PlainSecret("test-secret"),
+				AppSecret: secret.PlainSecret("test-secret"),
 				Brand:     brand.Feishu,
 				Users:     users,
 			},
@@ -160,7 +161,7 @@ func TestAuthLogoutRun_RevokesTokenAndClearsLocalState(t *testing.T) {
 			{
 				Name:      "default",
 				AppId:     "cli_test",
-				AppSecret: core.PlainSecret("secret"),
+				AppSecret: secret.PlainSecret("secret"),
 				Brand:     brand.Feishu,
 				Users:     []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
 			},
@@ -231,7 +232,7 @@ func TestAuthLogoutRun_FallsBackToAccessTokenWhenRefreshTokenMissing(t *testing.
 			{
 				Name:      "default",
 				AppId:     "cli_test",
-				AppSecret: core.PlainSecret("secret"),
+				AppSecret: secret.PlainSecret("secret"),
 				Brand:     brand.Feishu,
 				Users:     []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
 			},
@@ -301,7 +302,7 @@ func TestAuthLogoutRun_RevokeFailureStillClearsLocalState(t *testing.T) {
 			{
 				Name:      "default",
 				AppId:     "cli_test",
-				AppSecret: core.PlainSecret("secret"),
+				AppSecret: secret.PlainSecret("secret"),
 				Brand:     brand.Feishu,
 				Users:     []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
 			},
diff --git a/cmd/config/bind.go b/cmd/config/bind.go
index 67be919393..096146e5ff 100644
--- a/cmd/config/bind.go
+++ b/cmd/config/bind.go
@@ -18,6 +18,7 @@ import (
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/internal/secret"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/internal/vfs"
 	"github.com/larksuite/cli/internal/workspace"
@@ -490,7 +491,7 @@ func cleanupKeychainFromData(kc keychain.KeychainAccess, data []byte, keep *core
 		if keepID != "" && app.AppSecret.Ref != nil && app.AppSecret.Ref.Source == "keychain" && app.AppSecret.Ref.ID == keepID {
 			continue
 		}
-		core.RemoveSecretStore(app.AppSecret, kc)
+		secret.RemoveSecretStore(app.AppSecret, kc)
 	}
 }
 
diff --git a/cmd/config/bind_test.go b/cmd/config/bind_test.go
index 5120fac4c3..f52145624e 100644
--- a/cmd/config/bind_test.go
+++ b/cmd/config/bind_test.go
@@ -19,6 +19,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/internal/secret"
 	"github.com/larksuite/cli/internal/workspace"
 )
 
@@ -808,7 +809,7 @@ func TestConfigShowRun_WorkspaceField(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		Apps: []core.AppConfig{{
 			AppId:     "cli_local_test",
-			AppSecret: core.PlainSecret("secret"),
+			AppSecret: secret.PlainSecret("secret"),
 			Brand:     brand.Feishu,
 		}},
 	}
@@ -1791,8 +1792,8 @@ func TestCleanupKeychainFromData_KeepsSecretSharedWithNewApp(t *testing.T) {
 	oldConfig := []byte(`{"apps":[{"appId":"cli_shared","appSecret":{"source":"keychain","id":"` + sharedID + `"}}]}`)
 	newApp := &core.AppConfig{
 		AppId: "cli_shared",
-		AppSecret: core.SecretInput{
-			Ref: &core.SecretRef{Source: "keychain", ID: sharedID},
+		AppSecret: secret.SecretInput{
+			Ref: &secret.SecretRef{Source: "keychain", ID: sharedID},
 		},
 	}
 
@@ -1821,8 +1822,8 @@ func TestCleanupKeychainFromData_RemovesStaleSecretWhenAppIDChanges(t *testing.T
 	oldConfig := []byte(`{"apps":[{"appId":"cli_old","appSecret":{"source":"keychain","id":"` + oldID + `"}}]}`)
 	newApp := &core.AppConfig{
 		AppId: "cli_new",
-		AppSecret: core.SecretInput{
-			Ref: &core.SecretRef{Source: "keychain", ID: newID},
+		AppSecret: secret.SecretInput{
+			Ref: &secret.SecretRef{Source: "keychain", ID: newID},
 		},
 	}
 
diff --git a/cmd/config/binder.go b/cmd/config/binder.go
index 2cd252ce57..e140c5e842 100644
--- a/cmd/config/binder.go
+++ b/cmd/config/binder.go
@@ -13,6 +13,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/openclawbind"
+	secretpkg "github.com/larksuite/cli/internal/secret"
 	"github.com/larksuite/cli/internal/vfs"
 )
 
@@ -196,7 +197,7 @@ func (b *openclawBinder) Build(appID string) (*core.AppConfig, error) {
 			WithCause(err)
 	}
 
-	stored, err := core.ForStorage(selected.AppID, core.PlainSecret(secret), b.opts.Factory.Keychain)
+	stored, err := secretpkg.ForStorage(selected.AppID, secretpkg.PlainSecret(secret), b.opts.Factory.Keychain)
 	if err != nil {
 		return nil, errs.NewInternalError(errs.SubtypeStorage, "keychain unavailable: %v", err).
 			WithHint("use file: reference in config to bypass keychain").
@@ -252,7 +253,7 @@ func (b *hermesBinder) Build(appID string) (*core.AppConfig, error) {
 			WithHint("run 'hermes setup' to configure Feishu credentials")
 	}
 
-	stored, err := core.ForStorage(appID, core.PlainSecret(appSecret), b.opts.Factory.Keychain)
+	stored, err := secretpkg.ForStorage(appID, secretpkg.PlainSecret(appSecret), b.opts.Factory.Keychain)
 	if err != nil {
 		return nil, errs.NewInternalError(errs.SubtypeStorage, "keychain unavailable: %v", err).
 			WithHint("use file: reference in config to bypass keychain").
@@ -317,7 +318,7 @@ func (b *larkChannelBinder) Build(appID string) (*core.AppConfig, error) {
 			WithCause(err)
 	}
 
-	stored, err := core.ForStorage(appID, core.PlainSecret(secret), b.opts.Factory.Keychain)
+	stored, err := secretpkg.ForStorage(appID, secretpkg.PlainSecret(secret), b.opts.Factory.Keychain)
 	if err != nil {
 		return nil, errs.NewInternalError(errs.SubtypeStorage, "keychain unavailable: %v", err).
 			WithHint("use file: reference in config to bypass keychain").
diff --git a/cmd/config/config_test.go b/cmd/config/config_test.go
index 894e7430fd..c89dd1e6ea 100644
--- a/cmd/config/config_test.go
+++ b/cmd/config/config_test.go
@@ -21,6 +21,7 @@ import (
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/internal/secret"
 )
 
 type noopConfigKeychain struct{}
@@ -114,7 +115,7 @@ func TestConfigShowRun_NoActiveProfileReturnsStructuredError(t *testing.T) {
 		Apps: []core.AppConfig{{
 			Name:      "default",
 			AppId:     "app-default",
-			AppSecret: core.PlainSecret("secret-default"),
+			AppSecret: secret.PlainSecret("secret-default"),
 			Brand:     brand.Feishu,
 		}},
 	}
@@ -188,13 +189,13 @@ func TestSaveInitConfig_OmitLangPreservesPrior(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, nil)
 
 	existing := &core.MultiAppConfig{Apps: []core.AppConfig{
-		{AppId: "cli_x", AppSecret: core.PlainSecret("s"), Brand: brand.Feishu, Lang: i18n.LangJaJP},
+		{AppId: "cli_x", AppSecret: secret.PlainSecret("s"), Brand: brand.Feishu, Lang: i18n.LangJaJP},
 	}}
 	if err := core.SaveMultiAppConfig(existing); err != nil {
 		t.Fatalf("seed config: %v", err)
 	}
 
-	if err := saveInitConfig("", existing, f, "cli_x", core.PlainSecret("s2"), brand.Feishu, ""); err != nil {
+	if err := saveInitConfig("", existing, f, "cli_x", secret.PlainSecret("s2"), brand.Feishu, ""); err != nil {
 		t.Fatalf("saveInitConfig (no --lang): %v", err)
 	}
 
@@ -322,8 +323,8 @@ func TestConfigRemoveRun_SaveFailurePreservesExistingConfigAndSecrets(t *testing
 	multi := &core.MultiAppConfig{
 		Apps: []core.AppConfig{{
 			AppId: "app-test",
-			AppSecret: core.SecretInput{
-				Ref: &core.SecretRef{Source: "keychain", ID: "appsecret:app-test"},
+			AppSecret: secret.SecretInput{
+				Ref: &secret.SecretRef{Source: "keychain", ID: "appsecret:app-test"},
 			},
 			Brand: brand.Feishu,
 			Users: []core.AppUser{{UserOpenId: "ou_1", UserName: "Tester"}},
@@ -383,13 +384,13 @@ func TestSaveAsProfile_RejectsProfileNameCollisionWithExistingAppID(t *testing.T
 			{
 				Name:      "prod",
 				AppId:     "cli_prod",
-				AppSecret: core.PlainSecret("secret"),
+				AppSecret: secret.PlainSecret("secret"),
 				Brand:     brand.Feishu,
 			},
 		},
 	}
 
-	err := saveAsProfile(existing, keychain.KeychainAccess(&noopConfigKeychain{}), "cli_prod", "app-new", core.PlainSecret("new-secret"), brand.Lark, "en")
+	err := saveAsProfile(existing, keychain.KeychainAccess(&noopConfigKeychain{}), "cli_prod", "app-new", secret.PlainSecret("new-secret"), brand.Lark, "en")
 	if err == nil {
 		t.Fatal("expected conflict error")
 	}
@@ -435,7 +436,7 @@ func TestUpdateExistingProfileWithoutSecret_RejectsAppIDChange(t *testing.T) {
 			{
 				Name:      "prod",
 				AppId:     "app-old",
-				AppSecret: core.SecretInput{Ref: &core.SecretRef{Source: "keychain", ID: "appsecret:app-old"}},
+				AppSecret: secret.SecretInput{Ref: &secret.SecretRef{Source: "keychain", ID: "appsecret:app-old"}},
 				Brand:     brand.Feishu,
 				Lang:      "zh",
 				Users:     []core.AppUser{{UserOpenId: "ou_1", UserName: "User"}},
diff --git a/cmd/config/init.go b/cmd/config/init.go
index e4250f5218..c7e265e82c 100644
--- a/cmd/config/init.go
+++ b/cmd/config/init.go
@@ -21,6 +21,7 @@ import (
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/output"
+	secretpkg "github.com/larksuite/cli/internal/secret"
 	"github.com/larksuite/cli/internal/workspace"
 )
 
@@ -146,7 +147,7 @@ func cleanupOldConfig(existing *core.MultiAppConfig, f *cmdutil.Factory, skipApp
 		if app.AppId == skipAppID {
 			continue
 		}
-		core.RemoveSecretStore(app.AppSecret, f.Keychain)
+		secretpkg.RemoveSecretStore(app.AppSecret, f.Keychain)
 		for _, user := range app.Users {
 			auth.RemoveStoredToken(app.AppId, user.UserOpenId)
 		}
@@ -154,7 +155,7 @@ func cleanupOldConfig(existing *core.MultiAppConfig, f *cmdutil.Factory, skipApp
 }
 
 // saveAsOnlyApp overwrites config.json with a single-app config.
-func saveAsOnlyApp(appId string, secret core.SecretInput, brand brandpkg.Brand, lang string) error {
+func saveAsOnlyApp(appId string, secret secretpkg.SecretInput, brand brandpkg.Brand, lang string) error {
 	config := &core.MultiAppConfig{
 		Apps: []core.AppConfig{{
 			AppId: appId, AppSecret: secret, Brand: brand, Lang: i18n.Lang(lang), Users: []core.AppUser{},
@@ -166,7 +167,7 @@ func saveAsOnlyApp(appId string, secret core.SecretInput, brand brandpkg.Brand,
 // saveInitConfig saves a new/updated app config, respecting --profile mode.
 // With profileName: appends or updates the named profile (preserves other profiles).
 // Without profileName: cleans up old config and saves as the only app.
-func saveInitConfig(profileName string, existing *core.MultiAppConfig, f *cmdutil.Factory, appId string, secret core.SecretInput, brand brandpkg.Brand, lang string) error {
+func saveInitConfig(profileName string, existing *core.MultiAppConfig, f *cmdutil.Factory, appId string, secret secretpkg.SecretInput, brand brandpkg.Brand, lang string) error {
 	if profileName != "" {
 		return saveAsProfile(existing, f.Keychain, profileName, appId, secret, brand, lang)
 	}
@@ -197,7 +198,7 @@ func wrapSaveConfigError(err error) error {
 // saveAsProfile appends or updates a named profile in the config.
 // If a profile with the same name exists, it updates it; otherwise appends.
 // When updating, cleans up old keychain secrets if AppId changed.
-func saveAsProfile(existing *core.MultiAppConfig, kc keychain.KeychainAccess, profileName, appId string, secret core.SecretInput, brand brandpkg.Brand, lang string) error {
+func saveAsProfile(existing *core.MultiAppConfig, kc keychain.KeychainAccess, profileName, appId string, secret secretpkg.SecretInput, brand brandpkg.Brand, lang string) error {
 	multi := existing
 	if multi == nil {
 		multi = &core.MultiAppConfig{}
@@ -206,7 +207,7 @@ func saveAsProfile(existing *core.MultiAppConfig, kc keychain.KeychainAccess, pr
 	if idx := findProfileIndexByName(multi, profileName); idx >= 0 {
 		// Clean up old keychain secret and user tokens if AppId changed
 		if multi.Apps[idx].AppId != appId {
-			core.RemoveSecretStore(multi.Apps[idx].AppSecret, kc)
+			secretpkg.RemoveSecretStore(multi.Apps[idx].AppSecret, kc)
 			for _, user := range multi.Apps[idx].Users {
 				auth.RemoveStoredToken(multi.Apps[idx].AppId, user.UserOpenId)
 			}
@@ -340,7 +341,7 @@ func configInitRun(opts *ConfigInitOptions) error {
 	// Mode 1: Non-interactive
 	if opts.AppID != "" && opts.appSecret != "" {
 		brand := parseBrand(opts.Brand)
-		secret, err := core.ForStorage(opts.AppID, core.PlainSecret(opts.appSecret), f.Keychain)
+		secret, err := secretpkg.ForStorage(opts.AppID, secretpkg.PlainSecret(opts.appSecret), f.Keychain)
 		if err != nil {
 			return errs.NewInternalError(errs.SubtypeSDKError, "%v", err).WithCause(err)
 		}
@@ -380,7 +381,7 @@ func configInitRun(opts *ConfigInitOptions) error {
 			return errs.NewInternalError(errs.SubtypeSDKError, "app creation returned no result")
 		}
 		existing, _ := core.LoadMultiAppConfig()
-		secret, err := core.ForStorage(result.AppID, core.PlainSecret(result.AppSecret), f.Keychain)
+		secret, err := secretpkg.ForStorage(result.AppID, secretpkg.PlainSecret(result.AppSecret), f.Keychain)
 		if err != nil {
 			return errs.NewInternalError(errs.SubtypeSDKError, "%v", err).WithCause(err)
 		}
@@ -410,7 +411,7 @@ func configInitRun(opts *ConfigInitOptions) error {
 
 		if result.AppSecret != "" {
 			// New secret provided (either from "create" or "existing" with input)
-			secret, err := core.ForStorage(result.AppID, core.PlainSecret(result.AppSecret), f.Keychain)
+			secret, err := secretpkg.ForStorage(result.AppID, secretpkg.PlainSecret(result.AppSecret), f.Keychain)
 			if err != nil {
 				return errs.NewInternalError(errs.SubtypeSDKError, "%v", err).WithCause(err)
 			}
@@ -496,9 +497,9 @@ func configInitRun(opts *ConfigInitOptions) error {
 	if resolvedAppId == "" && firstApp != nil {
 		resolvedAppId = firstApp.AppId
 	}
-	var resolvedSecret core.SecretInput
+	var resolvedSecret secretpkg.SecretInput
 	if appSecretInput != "" {
-		resolvedSecret = core.PlainSecret(appSecretInput)
+		resolvedSecret = secretpkg.PlainSecret(appSecretInput)
 	} else if firstApp != nil {
 		resolvedSecret = firstApp.AppSecret
 	}
@@ -515,7 +516,7 @@ func configInitRun(opts *ConfigInitOptions) error {
 			WithParam("--app-id")
 	}
 
-	storedSecret, err := core.ForStorage(resolvedAppId, resolvedSecret, f.Keychain)
+	storedSecret, err := secretpkg.ForStorage(resolvedAppId, resolvedSecret, f.Keychain)
 	if err != nil {
 		return errs.NewInternalError(errs.SubtypeSDKError, "%v", err).WithCause(err)
 	}
diff --git a/cmd/config/init_test.go b/cmd/config/init_test.go
index 1f42553ba6..b6b126e1fa 100644
--- a/cmd/config/init_test.go
+++ b/cmd/config/init_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/internal/secret"
 )
 
 // updateExistingProfileWithoutSecret guards four blank-input scenarios. Each
@@ -29,7 +30,7 @@ func TestUpdateExistingProfileWithoutSecret_UnknownProfile_EmitsValidationError(
 		Apps: []core.AppConfig{{
 			Name:      "default",
 			AppId:     "app-default",
-			AppSecret: core.PlainSecret("secret-default"),
+			AppSecret: secret.PlainSecret("secret-default"),
 			Brand:     brand.Feishu,
 		}},
 	}
@@ -43,7 +44,7 @@ func TestUpdateExistingProfileWithoutSecret_NoCurrentApp_EmitsValidationError(t
 		Apps: []core.AppConfig{{
 			Name:      "default",
 			AppId:     "app-default",
-			AppSecret: core.PlainSecret("secret-default"),
+			AppSecret: secret.PlainSecret("secret-default"),
 			Brand:     brand.Feishu,
 		}},
 	}
@@ -56,7 +57,7 @@ func TestUpdateExistingProfileWithoutSecret_AppIdMismatch_EmitsValidationError(t
 		Apps: []core.AppConfig{{
 			Name:      "default",
 			AppId:     "app-default",
-			AppSecret: core.PlainSecret("secret-default"),
+			AppSecret: secret.PlainSecret("secret-default"),
 			Brand:     brand.Feishu,
 		}},
 	}
diff --git a/cmd/config/remove.go b/cmd/config/remove.go
index 74dd0e8476..436a682fbd 100644
--- a/cmd/config/remove.go
+++ b/cmd/config/remove.go
@@ -11,6 +11,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/internal/secret"
 	"github.com/spf13/cobra"
 )
 
@@ -55,7 +56,7 @@ func configRemoveRun(opts *ConfigRemoveOptions) error {
 
 	// Clean up keychain entries for all apps after config is cleared.
 	for _, app := range config.Apps {
-		core.RemoveSecretStore(app.AppSecret, f.Keychain)
+		secret.RemoveSecretStore(app.AppSecret, f.Keychain)
 		for _, user := range app.Users {
 			_ = auth.RemoveStoredToken(app.AppId, user.UserOpenId)
 		}
diff --git a/cmd/config/risk_control_test.go b/cmd/config/risk_control_test.go
index be19ffa752..f349a06f54 100644
--- a/cmd/config/risk_control_test.go
+++ b/cmd/config/risk_control_test.go
@@ -12,12 +12,13 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/secret"
 )
 
 func TestRiskControlWorkspacePolicy(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: brand.Feishu,
+		AppId: "cli_test", AppSecret: secret.PlainSecret("secret"), Brand: brand.Feishu,
 	}}}
 	if err := core.SaveMultiAppConfig(config); err != nil {
 		t.Fatal(err)
@@ -88,7 +89,7 @@ func TestRiskControlWorkspacePolicy(t *testing.T) {
 func TestRiskControlWorkspacePolicyRejectsInvalidValue(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: brand.Feishu,
+		AppId: "cli_test", AppSecret: secret.PlainSecret("secret"), Brand: brand.Feishu,
 	}}}); err != nil {
 		t.Fatal(err)
 	}
@@ -109,7 +110,7 @@ func TestRiskControlWorkspacePolicyRejectsInvalidValue(t *testing.T) {
 func TestRiskControlWorkspacePolicyAllowedWithExternalCredentials(t *testing.T) {
 	f := newConfigFactoryWithExternalProvider(t)
 	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: brand.Feishu,
+		AppId: "cli_test", AppSecret: secret.PlainSecret("secret"), Brand: brand.Feishu,
 	}}}
 	if err := core.SaveMultiAppConfig(config); err != nil {
 		t.Fatal(err)
diff --git a/cmd/config/strict_mode_test.go b/cmd/config/strict_mode_test.go
index 5466d09237..c8fc3985ec 100644
--- a/cmd/config/strict_mode_test.go
+++ b/cmd/config/strict_mode_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/secret"
 )
 
 func setupStrictModeTestConfig(t *testing.T) {
@@ -19,7 +20,7 @@ func setupStrictModeTestConfig(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		Apps: []core.AppConfig{{
 			AppId:     "test-app",
-			AppSecret: core.PlainSecret("secret"),
+			AppSecret: secret.PlainSecret("secret"),
 			Brand:     brand.Feishu,
 		}},
 	}
@@ -111,7 +112,7 @@ func TestStrictMode_SetGlobal_DoesNotRequireActiveProfile(t *testing.T) {
 		Apps: []core.AppConfig{{
 			Name:      "default",
 			AppId:     "test-app",
-			AppSecret: core.PlainSecret("secret"),
+			AppSecret: secret.PlainSecret("secret"),
 			Brand:     brand.Feishu,
 		}},
 	}
diff --git a/cmd/doctor/doctor_test.go b/cmd/doctor/doctor_test.go
index 35e1700160..63c4bdb4c4 100644
--- a/cmd/doctor/doctor_test.go
+++ b/cmd/doctor/doctor_test.go
@@ -18,6 +18,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
+	"github.com/larksuite/cli/internal/secret"
 )
 
 func TestNewCmdDoctor_FlagParsing(t *testing.T) {
@@ -110,7 +111,7 @@ func TestDoctorRun_SplitsBotAndMissingUserIdentity(t *testing.T) {
 			{
 				Name:      "default",
 				AppId:     "test-app",
-				AppSecret: core.PlainSecret("secret"),
+				AppSecret: secret.PlainSecret("secret"),
 				Brand:     brand.Feishu,
 			},
 		},
@@ -183,7 +184,7 @@ func TestDoctor_ExternalProvider_IdentityReadyHintNotBlockedCommand(t *testing.T
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{
 		CurrentApp: "default",
-		Apps:       []core.AppConfig{{Name: "default", AppId: "cli_x", AppSecret: core.PlainSecret("secret"), Brand: brand.Feishu}},
+		Apps:       []core.AppConfig{{Name: "default", AppId: "cli_x", AppSecret: secret.PlainSecret("secret"), Brand: brand.Feishu}},
 	}); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
diff --git a/cmd/global_flags_test.go b/cmd/global_flags_test.go
index af0a357857..0c6fb7ce4a 100644
--- a/cmd/global_flags_test.go
+++ b/cmd/global_flags_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/secret"
 	"github.com/spf13/pflag"
 )
 
@@ -60,7 +61,7 @@ func TestIsSingleAppMode_NoConfig(t *testing.T) {
 func TestIsSingleAppMode_SingleApp(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	saveAppsForTest(t, []core.AppConfig{
-		{Name: "default", AppId: "cli_a", AppSecret: core.PlainSecret("x"), Brand: brand.Feishu},
+		{Name: "default", AppId: "cli_a", AppSecret: secret.PlainSecret("x"), Brand: brand.Feishu},
 	})
 	if !isSingleAppMode() {
 		t.Fatal("isSingleAppMode() = false, want true for single-app config")
@@ -70,8 +71,8 @@ func TestIsSingleAppMode_SingleApp(t *testing.T) {
 func TestIsSingleAppMode_MultiApp(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	saveAppsForTest(t, []core.AppConfig{
-		{Name: "a", AppId: "cli_a", AppSecret: core.PlainSecret("x"), Brand: brand.Feishu},
-		{Name: "b", AppId: "cli_b", AppSecret: core.PlainSecret("y"), Brand: brand.Feishu},
+		{Name: "a", AppId: "cli_a", AppSecret: secret.PlainSecret("x"), Brand: brand.Feishu},
+		{Name: "b", AppId: "cli_b", AppSecret: secret.PlainSecret("y"), Brand: brand.Feishu},
 	})
 	if isSingleAppMode() {
 		t.Fatal("isSingleAppMode() = true, want false for multi-app config")
diff --git a/cmd/profile/add.go b/cmd/profile/add.go
index 3723b83366..de6c032506 100644
--- a/cmd/profile/add.go
+++ b/cmd/profile/add.go
@@ -18,6 +18,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/output"
+	secretpkg "github.com/larksuite/cli/internal/secret"
 )
 
 // NewCmdProfileAdd creates the profile add subcommand.
@@ -116,7 +117,7 @@ func profileAddRun(f *cmdutil.Factory, name, appID string, appSecretStdin bool,
 	}
 
 	// Store secret securely
-	secret, err := core.ForStorage(appID, core.PlainSecret(appSecret), f.Keychain)
+	secret, err := secretpkg.ForStorage(appID, secretpkg.PlainSecret(appSecret), f.Keychain)
 	if err != nil {
 		return errs.NewInternalError(errs.SubtypeStorage, "%v", err).WithCause(err)
 	}
diff --git a/cmd/profile/profile_test.go b/cmd/profile/profile_test.go
index 5c8ffd39d6..f925e76413 100644
--- a/cmd/profile/profile_test.go
+++ b/cmd/profile/profile_test.go
@@ -17,6 +17,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/internal/secret"
 	"github.com/larksuite/cli/internal/vfs"
 )
 
@@ -119,7 +120,7 @@ func TestProfileAddRun_UseAfterUpdatesCurrentAndPrevious(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		CurrentApp: "default",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
+			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -154,8 +155,8 @@ func TestProfileRemoveRun_RemovesCurrentProfileAndSwitchesToFirstRemaining(t *te
 		CurrentApp:  "target",
 		PreviousApp: "default",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
-			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: brand.Lark},
+			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
+			{Name: "target", AppId: "app-target", AppSecret: secret.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -190,7 +191,7 @@ func TestProfileRenameRun_UpdatesCurrentAndPreviousReferences(t *testing.T) {
 		Apps: []core.AppConfig{{
 			Name:      "old",
 			AppId:     "app-old",
-			AppSecret: core.PlainSecret("secret-old"),
+			AppSecret: secret.PlainSecret("secret-old"),
 			Brand:     brand.Feishu,
 		}},
 	}
@@ -226,7 +227,7 @@ func TestProfileRenameRun_AllowsRenameToOwnAppID(t *testing.T) {
 		Apps: []core.AppConfig{{
 			Name:      "old",
 			AppId:     "app-old",
-			AppSecret: core.PlainSecret("secret-old"),
+			AppSecret: secret.PlainSecret("secret-old"),
 			Brand:     brand.Feishu,
 		}},
 	}
@@ -260,8 +261,8 @@ func TestProfileUseRun_ToggleBackUsesPreviousProfile(t *testing.T) {
 		CurrentApp:  "default",
 		PreviousApp: "target",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
-			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: brand.Lark},
+			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
+			{Name: "target", AppId: "app-target", AppSecret: secret.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -290,8 +291,8 @@ func TestProfileListRun_OutputsProfiles(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		CurrentApp: "default",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
-			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: brand.Lark},
+			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
+			{Name: "target", AppId: "app-target", AppSecret: secret.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -343,8 +344,8 @@ func TestProfileRemoveRun_SaveFailureReturnsStructuredError(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		CurrentApp: "target",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
-			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: brand.Lark},
+			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
+			{Name: "target", AppId: "app-target", AppSecret: secret.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -370,7 +371,7 @@ func TestProfileRenameRun_SaveFailureReturnsStructuredError(t *testing.T) {
 		Apps: []core.AppConfig{{
 			Name:      "old",
 			AppId:     "app-old",
-			AppSecret: core.PlainSecret("secret-old"),
+			AppSecret: secret.PlainSecret("secret-old"),
 			Brand:     brand.Feishu,
 		}},
 	}
@@ -395,8 +396,8 @@ func TestProfileUseRun_SaveFailureReturnsStructuredError(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		CurrentApp: "default",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
-			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: brand.Lark},
+			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
+			{Name: "target", AppId: "app-target", AppSecret: secret.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -465,8 +466,8 @@ func saveTwoProfiles(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		CurrentApp: "default",
 		Apps: []core.AppConfig{
-			{Name: "default", AppId: "app-default", AppSecret: core.PlainSecret("secret-default"), Brand: brand.Feishu},
-			{Name: "target", AppId: "app-target", AppSecret: core.PlainSecret("secret-target"), Brand: brand.Lark},
+			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
+			{Name: "target", AppId: "app-target", AppSecret: secret.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
@@ -613,7 +614,7 @@ func TestProfileRemoveRun_ValidationErrors(t *testing.T) {
 		multi := &core.MultiAppConfig{
 			CurrentApp: "solo",
 			Apps: []core.AppConfig{
-				{Name: "solo", AppId: "app-solo", AppSecret: core.PlainSecret("secret-solo"), Brand: brand.Feishu},
+				{Name: "solo", AppId: "app-solo", AppSecret: secret.PlainSecret("secret-solo"), Brand: brand.Feishu},
 			},
 		}
 		if err := core.SaveMultiAppConfig(multi); err != nil {
diff --git a/cmd/profile/remove.go b/cmd/profile/remove.go
index ff249c3d5f..5b7d86cf09 100644
--- a/cmd/profile/remove.go
+++ b/cmd/profile/remove.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/internal/secret"
 )
 
 // NewCmdProfileRemove creates the profile remove subcommand.
@@ -71,7 +72,7 @@ func profileRemoveRun(f *cmdutil.Factory, name string) error {
 	}
 
 	// Best-effort credential cleanup after config commit
-	core.RemoveSecretStore(appSecret, f.Keychain)
+	secret.RemoveSecretStore(appSecret, f.Keychain)
 	for _, user := range users {
 		larkauth.RemoveStoredToken(appId, user.UserOpenId)
 	}
diff --git a/cmd/root_integration_test.go b/cmd/root_integration_test.go
index d1bac0913b..26c8f72784 100644
--- a/cmd/root_integration_test.go
+++ b/cmd/root_integration_test.go
@@ -23,6 +23,7 @@ import (
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/meta"
 	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/internal/secret"
 	"github.com/larksuite/cli/internal/skillscheck"
 	"github.com/larksuite/cli/internal/update"
 	"github.com/larksuite/cli/shortcuts"
@@ -174,13 +175,13 @@ func newStrictModeDefaultFactory(t *testing.T, profile string, mode core.StrictM
 			{
 				Name:      "default",
 				AppId:     "app-default",
-				AppSecret: core.PlainSecret("secret-default"),
+				AppSecret: secret.PlainSecret("secret-default"),
 				Brand:     brand.Feishu,
 			},
 			{
 				Name:       "target",
 				AppId:      "app-target",
-				AppSecret:  core.PlainSecret("secret-target"),
+				AppSecret:  secret.PlainSecret("secret-target"),
 				Brand:      brand.Feishu,
 				StrictMode: &targetMode,
 			},
diff --git a/internal/cmdutil/factory_default_test.go b/internal/cmdutil/factory_default_test.go
index 320db6681a..9999eb1499 100644
--- a/internal/cmdutil/factory_default_test.go
+++ b/internal/cmdutil/factory_default_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
+	"github.com/larksuite/cli/internal/secret"
 	"github.com/larksuite/cli/internal/vfs/localfileio"
 )
 
@@ -45,13 +46,13 @@ func TestNewDefault_InvocationProfileUsedByStrictModeAndConfig(t *testing.T) {
 			{
 				Name:      "default",
 				AppId:     "app-default",
-				AppSecret: core.PlainSecret("secret-default"),
+				AppSecret: secret.PlainSecret("secret-default"),
 				Brand:     brand.Feishu,
 			},
 			{
 				Name:       "target",
 				AppId:      "app-target",
-				AppSecret:  core.PlainSecret("secret-target"),
+				AppSecret:  secret.PlainSecret("secret-target"),
 				Brand:      brand.Feishu,
 				StrictMode: &bot,
 			},
@@ -92,7 +93,7 @@ func TestNewDefault_InvocationProfileMissingSticksAcrossEarlyStrictMode(t *testi
 			{
 				Name:      "default",
 				AppId:     "app-default",
-				AppSecret: core.PlainSecret("secret-default"),
+				AppSecret: secret.PlainSecret("secret-default"),
 				Brand:     brand.Feishu,
 			},
 		},
diff --git a/internal/core/config.go b/internal/core/config.go
index 03858b7cc9..d2af252280 100644
--- a/internal/core/config.go
+++ b/internal/core/config.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/keychain"
+	"github.com/larksuite/cli/internal/secret"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/internal/vfs"
 	"github.com/larksuite/cli/internal/workspace"
@@ -39,14 +40,14 @@ type AppUser struct {
 
 // AppConfig is a per-app configuration entry (stored format — secrets may be unresolved).
 type AppConfig struct {
-	Name       string      `json:"name,omitempty"`
-	AppId      string      `json:"appId"`
-	AppSecret  SecretInput `json:"appSecret"`
-	Brand      brand.Brand `json:"brand"`
-	Lang       i18n.Lang   `json:"lang,omitempty"`
-	DefaultAs  Identity    `json:"defaultAs,omitempty"` // AsUser | AsBot | AsAuto
-	StrictMode *StrictMode `json:"strictMode,omitempty"`
-	Users      []AppUser   `json:"users"`
+	Name       string             `json:"name,omitempty"`
+	AppId      string             `json:"appId"`
+	AppSecret  secret.SecretInput `json:"appSecret"`
+	Brand      brand.Brand        `json:"brand"`
+	Lang       i18n.Lang          `json:"lang,omitempty"`
+	DefaultAs  Identity           `json:"defaultAs,omitempty"` // AsUser | AsBot | AsAuto
+	StrictMode *StrictMode        `json:"strictMode,omitempty"`
+	Users      []AppUser          `json:"users"`
 }
 
 // ProfileName returns the display name for this app config.
@@ -242,13 +243,13 @@ func ResolveConfigFromMulti(raw *MultiAppConfig, kc keychain.KeychainAccess, pro
 			WithHint("available profiles: %s", formatProfileNames(raw.ProfileNames()))
 	}
 
-	if err := ValidateSecretKeyMatch(app.AppId, app.AppSecret); err != nil {
+	if err := secret.ValidateSecretKeyMatch(app.AppId, app.AppSecret, reconfigureHint()); err != nil {
 		return nil, errs.NewConfigError(errs.SubtypeNotConfigured, "appId and appSecret keychain key are out of sync").
 			WithHint("%s", err.Error()).
 			WithCause(err)
 	}
 
-	secret, err := ResolveSecretInput(app.AppSecret, kc)
+	resolvedSecret, err := secret.ResolveSecretInput(app.AppSecret, kc)
 	if err != nil {
 		if errs.IsTyped(err) {
 			return nil, err
@@ -262,7 +263,7 @@ func ResolveConfigFromMulti(raw *MultiAppConfig, kc keychain.KeychainAccess, pro
 	cfg := &CliConfig{
 		ProfileName: app.ProfileName(),
 		AppID:       app.AppId,
-		AppSecret:   secret,
+		AppSecret:   resolvedSecret,
 		Brand:       brand.ParseBrand(string(app.Brand)),
 		Lang:        app.Lang,
 		DefaultAs:   app.DefaultAs,
diff --git a/internal/core/config_strict_mode_test.go b/internal/core/config_strict_mode_test.go
index 2ca5e54b27..84f747db40 100644
--- a/internal/core/config_strict_mode_test.go
+++ b/internal/core/config_strict_mode_test.go
@@ -8,12 +8,13 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/brand"
+	"github.com/larksuite/cli/internal/secret"
 )
 
 func TestMultiAppConfig_StrictMode_JSON(t *testing.T) {
 	// StrictMode="" should be omitted (omitempty)
 	m := &MultiAppConfig{
-		Apps: []AppConfig{{AppId: "a", AppSecret: PlainSecret("s"), Brand: brand.Feishu, Users: []AppUser{}}},
+		Apps: []AppConfig{{AppId: "a", AppSecret: secret.PlainSecret("s"), Brand: brand.Feishu, Users: []AppUser{}}},
 	}
 	data, _ := json.Marshal(m)
 	if string(data) != `{"apps":[{"appId":"a","appSecret":"s","brand":"feishu","users":[]}]}` {
@@ -32,7 +33,7 @@ func TestMultiAppConfig_StrictMode_JSON(t *testing.T) {
 
 func TestAppConfig_StrictMode_JSON(t *testing.T) {
 	// StrictMode nil should be omitted
-	app := &AppConfig{AppId: "a", AppSecret: PlainSecret("s"), Brand: brand.Feishu, Users: []AppUser{}}
+	app := &AppConfig{AppId: "a", AppSecret: secret.PlainSecret("s"), Brand: brand.Feishu, Users: []AppUser{}}
 	data, _ := json.Marshal(app)
 	var parsed map[string]interface{}
 	json.Unmarshal(data, &parsed)
diff --git a/internal/core/config_test.go b/internal/core/config_test.go
index 82d89722a4..5a83b02b3a 100644
--- a/internal/core/config_test.go
+++ b/internal/core/config_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/keychain"
+	"github.com/larksuite/cli/internal/secret"
 )
 
 // stubKeychain is a minimal KeychainAccess that always returns ErrNotFound.
@@ -24,7 +25,7 @@ func (stubKeychain) Remove(service, account string) error     { return nil }
 
 func TestAppConfig_LangSerialization(t *testing.T) {
 	app := AppConfig{
-		AppId: "cli_test", AppSecret: PlainSecret("secret"),
+		AppId: "cli_test", AppSecret: secret.PlainSecret("secret"),
 		Brand: brand.Feishu, Lang: "en", Users: []AppUser{},
 	}
 	data, err := json.Marshal(app)
@@ -43,7 +44,7 @@ func TestAppConfig_LangSerialization(t *testing.T) {
 
 func TestAppConfig_LangOmitEmpty(t *testing.T) {
 	app := AppConfig{
-		AppId: "cli_test", AppSecret: PlainSecret("secret"),
+		AppId: "cli_test", AppSecret: secret.PlainSecret("secret"),
 		Brand: brand.Feishu, Users: []AppUser{},
 	}
 	data, err := json.Marshal(app)
@@ -65,7 +66,7 @@ func TestMultiAppConfig_RoundTrip(t *testing.T) {
 	config := &MultiAppConfig{
 		RiskControl: &disabled,
 		Apps: []AppConfig{{
-			AppId: "cli_test", AppSecret: PlainSecret("s"),
+			AppId: "cli_test", AppSecret: secret.PlainSecret("s"),
 			Brand: brand.Lark, Lang: "zh", Users: []AppUser{},
 		}},
 	}
@@ -97,7 +98,7 @@ func TestResolveConfigFromMulti_RejectsSecretKeyMismatch(t *testing.T) {
 		Apps: []AppConfig{
 			{
 				AppId: "cli_new_app",
-				AppSecret: SecretInput{Ref: &SecretRef{
+				AppSecret: secret.SecretInput{Ref: &secret.SecretRef{
 					Source: "keychain",
 					ID:     "appsecret:cli_old_app",
 				}},
@@ -124,7 +125,7 @@ func TestResolveConfigFromMulti_AcceptsPlainSecret(t *testing.T) {
 		Apps: []AppConfig{
 			{
 				AppId:     "cli_abc",
-				AppSecret: PlainSecret("my-secret"),
+				AppSecret: secret.PlainSecret("my-secret"),
 				Brand:     brand.Feishu,
 			},
 		},
@@ -144,7 +145,7 @@ func TestResolveConfigFromMulti_CarriesLang(t *testing.T) {
 		Apps: []AppConfig{
 			{
 				AppId:     "cli_abc",
-				AppSecret: PlainSecret("my-secret"),
+				AppSecret: secret.PlainSecret("my-secret"),
 				Brand:     brand.Feishu,
 				Lang:      "en",
 			},
@@ -162,13 +163,13 @@ func TestResolveConfigFromMulti_CarriesLang(t *testing.T) {
 
 func TestResolveConfigFromMulti_MatchingKeychainRefPassesValidation(t *testing.T) {
 	// Keychain ref matches appId, so validation passes.
-	// The subsequent ResolveSecretInput will fail (no real keychain),
+	// The subsequent secret.ResolveSecretInput will fail (no real keychain),
 	// but that proves the mismatch check itself passed.
 	raw := &MultiAppConfig{
 		Apps: []AppConfig{
 			{
 				AppId: "cli_abc",
-				AppSecret: SecretInput{Ref: &SecretRef{
+				AppSecret: secret.SecretInput{Ref: &secret.SecretRef{
 					Source: "keychain",
 					ID:     "appsecret:cli_abc",
 				}},
@@ -201,7 +202,7 @@ func TestResolveConfigFromMulti_DoesNotUseEnvProfileFallback(t *testing.T) {
 			{
 				Name:      "active",
 				AppId:     "cli_active",
-				AppSecret: PlainSecret("secret"),
+				AppSecret: secret.PlainSecret("secret"),
 				Brand:     brand.Feishu,
 			},
 		},
@@ -242,7 +243,7 @@ func TestCliConfig_CanBot(t *testing.T) {
 func TestResolveConfigFromMulti_NormalizesBrand(t *testing.T) {
 	multi := &MultiAppConfig{Apps: []AppConfig{{
 		AppId:     "cli_x",
-		AppSecret: PlainSecret("test-secret"),
+		AppSecret: secret.PlainSecret("test-secret"),
 		Brand:     brand.Brand(" LARK "),
 	}}}
 	cfg, err := ResolveConfigFromMulti(multi, nil, "")
diff --git a/internal/credential/integration_test.go b/internal/credential/integration_test.go
index 99d459ced7..83fd7a1282 100644
--- a/internal/credential/integration_test.go
+++ b/internal/credential/integration_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/keychain"
+	"github.com/larksuite/cli/internal/secret"
 )
 
 type noopKC struct{}
@@ -92,7 +93,7 @@ func TestFullChain_ConfigStrictMode(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		Apps: []core.AppConfig{{
 			AppId:      "cfg_app",
-			AppSecret:  core.PlainSecret("cfg_secret"),
+			AppSecret:  secret.PlainSecret("cfg_secret"),
 			Brand:      brand.Lark,
 			StrictMode: &botMode,
 		}},
@@ -133,7 +134,7 @@ func TestFullChain_LangSurvivesProductionPath(t *testing.T) {
 	multi := &core.MultiAppConfig{
 		Apps: []core.AppConfig{{
 			AppId:     "cfg_app",
-			AppSecret: core.PlainSecret("cfg_secret"),
+			AppSecret: secret.PlainSecret("cfg_secret"),
 			Brand:     brand.Feishu,
 			Lang:      i18n.LangJaJP,
 		}},
diff --git a/internal/core/secret.go b/internal/secret/secret.go
similarity index 99%
rename from internal/core/secret.go
rename to internal/secret/secret.go
index a488e5dcf7..cc52640f19 100644
--- a/internal/core/secret.go
+++ b/internal/secret/secret.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package secret
 
 import (
 	"encoding/json"
diff --git a/internal/core/secret_resolve.go b/internal/secret/secret_resolve.go
similarity index 94%
rename from internal/core/secret_resolve.go
rename to internal/secret/secret_resolve.go
index 072aa2791c..00c77b148b 100644
--- a/internal/core/secret_resolve.go
+++ b/internal/secret/secret_resolve.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package secret
 
 import (
 	"fmt"
@@ -56,7 +56,7 @@ func ForStorage(appId string, input SecretInput, kc keychain.KeychainAccess) (Se
 // expected appId. This prevents silent mismatches when config.json is edited by
 // hand (e.g. appId changed but appSecret.id still points to the old app).
 // Only applicable when appSecret is a keychain SecretRef; other forms are skipped.
-func ValidateSecretKeyMatch(appId string, secret SecretInput) error {
+func ValidateSecretKeyMatch(appId string, secret SecretInput, reconfigureHint string) error {
 	if secret.Ref == nil || secret.Ref.Source != "keychain" {
 		return nil
 	}
@@ -64,7 +64,7 @@ func ValidateSecretKeyMatch(appId string, secret SecretInput) error {
 	if secret.Ref.ID != expected {
 		return fmt.Errorf(
 			"appSecret keychain key %q does not match appId %q (expected %q); %s",
-			secret.Ref.ID, appId, expected, reconfigureHint(),
+			secret.Ref.ID, appId, expected, reconfigureHint,
 		)
 	}
 	return nil
diff --git a/internal/core/secret_resolve_test.go b/internal/secret/secret_resolve_test.go
similarity index 75%
rename from internal/core/secret_resolve_test.go
rename to internal/secret/secret_resolve_test.go
index 79ec6b7f32..755937a9d2 100644
--- a/internal/core/secret_resolve_test.go
+++ b/internal/secret/secret_resolve_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package secret
 
 import (
 	"strings"
@@ -10,14 +10,14 @@ import (
 
 func TestValidateSecretKeyMatch_KeychainMatches(t *testing.T) {
 	secret := SecretInput{Ref: &SecretRef{Source: "keychain", ID: "appsecret:cli_abc123"}}
-	if err := ValidateSecretKeyMatch("cli_abc123", secret); err != nil {
+	if err := ValidateSecretKeyMatch("cli_abc123", secret, "reconfigure"); err != nil {
 		t.Errorf("expected no error, got: %v", err)
 	}
 }
 
 func TestValidateSecretKeyMatch_KeychainMismatch(t *testing.T) {
 	secret := SecretInput{Ref: &SecretRef{Source: "keychain", ID: "appsecret:cli_old_app"}}
-	err := ValidateSecretKeyMatch("cli_new_app", secret)
+	err := ValidateSecretKeyMatch("cli_new_app", secret, "please run `lark-cli config init` to reconfigure")
 	if err == nil {
 		t.Fatal("expected error for mismatched appId and keychain key")
 	}
@@ -32,27 +32,27 @@ func TestValidateSecretKeyMatch_KeychainMismatch(t *testing.T) {
 
 func TestValidateSecretKeyMatch_PlainSecret_Skipped(t *testing.T) {
 	secret := PlainSecret("some-secret")
-	if err := ValidateSecretKeyMatch("cli_abc123", secret); err != nil {
+	if err := ValidateSecretKeyMatch("cli_abc123", secret, "reconfigure"); err != nil {
 		t.Errorf("plain secret should be skipped, got: %v", err)
 	}
 }
 
 func TestValidateSecretKeyMatch_FileRef_Skipped(t *testing.T) {
 	secret := SecretInput{Ref: &SecretRef{Source: "file", ID: "/tmp/secret.txt"}}
-	if err := ValidateSecretKeyMatch("cli_abc123", secret); err != nil {
+	if err := ValidateSecretKeyMatch("cli_abc123", secret, "reconfigure"); err != nil {
 		t.Errorf("file ref should be skipped, got: %v", err)
 	}
 }
 
 func TestValidateSecretKeyMatch_ZeroValue_Skipped(t *testing.T) {
-	if err := ValidateSecretKeyMatch("cli_abc123", SecretInput{}); err != nil {
+	if err := ValidateSecretKeyMatch("cli_abc123", SecretInput{}, "reconfigure"); err != nil {
 		t.Errorf("zero SecretInput should be skipped, got: %v", err)
 	}
 }
 
 func TestValidateSecretKeyMatch_EmptyAppId_Mismatch(t *testing.T) {
 	secret := SecretInput{Ref: &SecretRef{Source: "keychain", ID: "appsecret:cli_abc123"}}
-	err := ValidateSecretKeyMatch("", secret)
+	err := ValidateSecretKeyMatch("", secret, "reconfigure")
 	if err == nil {
 		t.Fatal("expected error when appId is empty but keychain key references a real app")
 	}

From 939fc1eeb8ac57924acfa027144fbdaff2972986 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 14:12:20 +0800
Subject: [PATCH 42/50] refactor(core): extract identity policy

---
 cmd/api/api.go                                |  5 +-
 cmd/api/api_paginate_test.go                  |  3 +-
 cmd/api/api_test.go                           |  3 +-
 cmd/auth/auth.go                              |  6 +-
 cmd/auth/login.go                             |  3 +-
 cmd/config/bind.go                            | 11 +--
 cmd/config/bind_test.go                       | 13 ++--
 cmd/config/default_as.go                      |  3 +-
 cmd/config/strict_mode.go                     | 13 ++--
 cmd/config/strict_mode_test.go                | 13 ++--
 cmd/error_auth_hint.go                        |  8 +-
 cmd/event/console_url.go                      |  6 +-
 cmd/event/console_url_test.go                 | 16 ++--
 cmd/event/consume.go                          | 16 ++--
 cmd/event/preflight_test.go                   | 24 +++---
 cmd/event/runtime.go                          |  4 +-
 cmd/event/runtime_test.go                     |  3 +-
 cmd/prune.go                                  |  8 +-
 cmd/prune_test.go                             | 26 +++----
 cmd/root_integration_test.go                  | 19 ++---
 cmd/root_test.go                              |  9 ++-
 cmd/schema/schema.go                          |  4 +-
 cmd/service/service.go                        | 11 +--
 cmd/service/service_paginate_test.go          |  3 +-
 cmd/service/service_test.go                   |  3 +-
 cmd/whoami/whoami.go                          | 13 ++--
 cmd/whoami/whoami_test.go                     | 25 ++++---
 internal/client/client.go                     | 15 ++--
 internal/client/client_test.go                | 13 ++--
 internal/client/dostream_test.go              |  3 +-
 internal/client/pagination.go                 |  8 +-
 internal/client/response.go                   | 12 +--
 internal/client/response_test.go              |  8 +-
 internal/cmdutil/dryrun.go                    |  3 +-
 internal/cmdutil/dryrun_test.go               | 11 +--
 internal/cmdutil/factory.go                   | 31 ++++----
 internal/cmdutil/factory_default_test.go      | 15 ++--
 internal/cmdutil/factory_test.go              | 75 ++++++++++---------
 internal/cmdutil/identity.go                  |  3 +-
 internal/cmdutil/identity_test.go             | 11 +--
 internal/core/config.go                       | 41 ++++------
 internal/core/config_strict_mode_test.go      |  7 +-
 internal/credential/credential_provider.go    | 17 +++--
 .../credential/credential_provider_test.go    | 18 ++---
 internal/credential/default_provider.go       |  7 +-
 internal/credential/integration_test.go       |  3 +-
 internal/credential/types.go                  | 11 +--
 internal/errclass/classify.go                 |  2 +-
 internal/{core => identity}/strict_mode.go    | 14 +++-
 .../{core => identity}/strict_mode_test.go    |  2 +-
 internal/identitydiag/diagnostics.go          |  5 +-
 internal/meta/identity.go                     |  2 +-
 internal/output/emitter_legacy_compat_test.go |  3 +-
 internal/registry/scopes.go                   |  4 +-
 shortcuts/apps/apps_html_publish_test.go      |  3 +-
 shortcuts/apps/apps_meta_test.go              |  3 +-
 shortcuts/apps/apps_openapi_key_list_test.go  |  3 +-
 shortcuts/apps/apps_release_create_test.go    |  3 +-
 shortcuts/apps/apps_release_get_test.go       |  3 +-
 shortcuts/apps/apps_release_list_test.go      |  3 +-
 shortcuts/apps/apps_role_common_test.go       |  3 +-
 shortcuts/apps/git_credential.go              |  5 +-
 shortcuts/common/call_api_typed_test.go       |  9 ++-
 shortcuts/common/drive_media_upload_test.go   |  3 +-
 shortcuts/common/drive_meta_test.go           |  3 +-
 shortcuts/common/permission_grant_test.go     |  7 +-
 shortcuts/common/runner.go                    | 33 ++++----
 shortcuts/common/runner_contentsafety_test.go |  3 +-
 shortcuts/common/runner_jq_test.go            |  3 +-
 .../common/runner_partial_failure_test.go     |  3 +-
 shortcuts/common/runner_scope_test.go         | 11 +--
 shortcuts/common/testing.go                   |  7 +-
 shortcuts/common/testing_test.go              |  7 +-
 shortcuts/contact/contact_search_user_test.go |  3 +-
 shortcuts/doc/doc_media_test.go               |  5 +-
 shortcuts/drive/drive_create_folder_test.go   |  4 +-
 shortcuts/drive/drive_import_test.go          |  3 +-
 shortcuts/drive/drive_io_test.go              |  3 +-
 shortcuts/drive/drive_pull_test.go            |  8 +-
 shortcuts/drive/drive_task_result_test.go     | 12 +--
 shortcuts/im/builders_test.go                 |  4 +-
 shortcuts/im/convert_lib/runtime_test.go      |  3 +-
 shortcuts/im/helpers_network_test.go          |  5 +-
 shortcuts/im/im_chat_list_test.go             | 60 +++++++--------
 shortcuts/mail/signature_compose_test.go      |  3 +-
 shortcuts/markdown/markdown_test.go           | 13 ++--
 .../backward/lark_sheets_sheet_create_test.go |  3 +-
 .../sheets/sheet_media_parent_type_test.go    |  3 +-
 shortcuts/task/task_search_test.go            |  4 +-
 shortcuts/task/task_util_test.go              |  4 +-
 shortcuts/vc/helpers.go                       |  6 +-
 shortcuts/vc/helpers_test.go                  | 30 ++++----
 shortcuts/vc/vc_meeting_events.go             |  4 +-
 shortcuts/vc/vc_meeting_test.go               |  6 +-
 shortcuts/wiki/wiki_async_task_test.go        | 14 ++--
 shortcuts/wiki/wiki_delete.go                 |  4 +-
 shortcuts/wiki/wiki_delete_test.go            | 18 ++---
 shortcuts/wiki/wiki_move.go                   |  4 +-
 shortcuts/wiki/wiki_move_test.go              | 21 +++---
 shortcuts/wiki/wiki_move_to_drive.go          |  6 +-
 shortcuts/wiki/wiki_move_to_drive_test.go     | 20 ++---
 shortcuts/wiki/wiki_node_create.go            |  8 +-
 shortcuts/wiki/wiki_node_create_test.go       | 33 ++++----
 shortcuts/wiki/wiki_node_delete.go            |  4 +-
 shortcuts/wiki/wiki_node_delete_test.go       | 16 ++--
 105 files changed, 565 insertions(+), 499 deletions(-)
 rename internal/{core => identity}/strict_mode.go (76%)
 rename internal/{core => identity}/strict_mode_test.go (98%)

diff --git a/cmd/api/api.go b/cmd/api/api.go
index 4d1a039f1a..238ff06605 100644
--- a/cmd/api/api.go
+++ b/cmd/api/api.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
@@ -33,7 +34,7 @@ type APIOptions struct {
 	// Flags
 	Params    string
 	Data      string
-	As        core.Identity
+	As        identity.Identity
 	Output    string
 	PageAll   bool
 	PageSize  int
@@ -87,7 +88,7 @@ Examples:
 			opts.Path = args[1]
 			opts.Cmd = cmd
 			opts.Ctx = cmd.Context()
-			opts.As = core.Identity(asStr)
+			opts.As = identity.Identity(asStr)
 			if runF != nil {
 				return runF(opts)
 			}
diff --git a/cmd/api/api_paginate_test.go b/cmd/api/api_paginate_test.go
index 8e1113ed45..4626f22612 100644
--- a/cmd/api/api_paginate_test.go
+++ b/cmd/api/api_paginate_test.go
@@ -19,6 +19,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 )
 
@@ -63,7 +64,7 @@ func apiPaginateRequest() client.RawApiRequest {
 	return client.RawApiRequest{
 		Method: "GET",
 		URL:    "/open-apis/test/v1/items",
-		As:     core.AsBot,
+		As:     identity.AsBot,
 	}
 }
 
diff --git a/cmd/api/api_test.go b/cmd/api/api_test.go
index 158cd7e27a..697d652477 100644
--- a/cmd/api/api_test.go
+++ b/cmd/api/api_test.go
@@ -22,6 +22,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/spf13/cobra"
 )
 
@@ -61,7 +62,7 @@ func TestApiCmd_FlagParsing(t *testing.T) {
 	if gotOpts.Path != "/open-apis/test" {
 		t.Errorf("expected path /open-apis/test, got %s", gotOpts.Path)
 	}
-	if gotOpts.As != core.AsBot {
+	if gotOpts.As != identity.AsBot {
 		t.Errorf("expected as=bot, got %s", gotOpts.As)
 	}
 	if !gotOpts.DryRun {
diff --git a/cmd/auth/auth.go b/cmd/auth/auth.go
index 288f16de5b..9689e8839b 100644
--- a/cmd/auth/auth.go
+++ b/cmd/auth/auth.go
@@ -16,8 +16,8 @@ import (
 
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 // NewCmdAuth creates the auth command with subcommands.
@@ -130,7 +130,7 @@ func getAppInfo(ctx context.Context, f *cmdutil.Factory, appId string) (*appInfo
 		HttpMethod:  http.MethodGet,
 		ApiPath:     larkauth.ApplicationInfoPath(appId),
 		QueryParams: queryParams,
-	}, core.AsBot)
+	}, identity.AsBot)
 	if err != nil {
 		return nil, err
 	}
@@ -170,7 +170,7 @@ func classifyAppInfoErr(rawBody []byte, code int, msg string, f *cmdutil.Factory
 	}
 	raw["code"] = code
 	raw["msg"] = msg
-	cc := errclass.ClassifyContext{Identity: string(core.AsBot)}
+	cc := errclass.ClassifyContext{Identity: string(identity.AsBot)}
 	if cfg, _ := f.Config(); cfg != nil {
 		cc.Brand = string(cfg.Brand)
 		cc.AppID = appId
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index d47aa5be44..7cd2cd7d64 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -20,6 +20,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/i18n"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/registry"
 	"github.com/larksuite/cli/shortcuts"
@@ -56,7 +57,7 @@ send the verification URL (or QR code) to the user as your final message, end th
 run --device-code in a later step after the user confirms authorization. Use 'lark-cli auth qrcode'
 to generate QR codes (supports ASCII and PNG formats).`,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			if mode := f.ResolveStrictMode(cmd.Context()); mode == core.StrictModeBot {
+			if mode := f.ResolveStrictMode(cmd.Context()); mode == identity.StrictModeBot {
 				return errs.NewValidationError(errs.SubtypeInvalidArgument,
 					"strict mode is %q, user login is disabled in this profile", mode).
 					WithHint("if the user explicitly wants to switch to user identity, see `lark-cli config strict-mode --help` (confirm with the user before switching; switching does NOT require re-bind)")
diff --git a/cmd/config/bind.go b/cmd/config/bind.go
index 096146e5ff..819c3c38cb 100644
--- a/cmd/config/bind.go
+++ b/cmd/config/bind.go
@@ -16,6 +16,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/i18n"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/secret"
@@ -314,7 +315,7 @@ func hasStrictBotLock(data []byte) bool {
 		return false
 	}
 	for _, app := range multi.Apps {
-		if app.StrictMode != nil && *app.StrictMode == core.StrictModeBot {
+		if app.StrictMode != nil && *app.StrictMode == identity.StrictModeBot {
 			return true
 		}
 	}
@@ -374,13 +375,13 @@ func preferredLang(requested, prior i18n.Lang) i18n.Lang {
 func applyPreferences(appConfig *core.AppConfig, opts *BindOptions, prior i18n.Lang) {
 	switch opts.Identity {
 	case "bot-only":
-		sm := core.StrictModeBot
+		sm := identity.StrictModeBot
 		appConfig.StrictMode = &sm
-		appConfig.DefaultAs = core.AsBot
+		appConfig.DefaultAs = identity.AsBot
 	case "user-default":
-		sm := core.StrictModeOff
+		sm := identity.StrictModeOff
 		appConfig.StrictMode = &sm
-		appConfig.DefaultAs = core.AsUser
+		appConfig.DefaultAs = identity.AsUser
 	}
 	appConfig.Lang = preferredLang(i18n.Lang(opts.Lang), prior)
 }
diff --git a/cmd/config/bind_test.go b/cmd/config/bind_test.go
index f52145624e..cd485b4ad8 100644
--- a/cmd/config/bind_test.go
+++ b/cmd/config/bind_test.go
@@ -18,6 +18,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/i18n"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/secret"
 	"github.com/larksuite/cli/internal/workspace"
@@ -1278,7 +1279,7 @@ func TestConfigBindRun_Identity_BotOnly_Applied(t *testing.T) {
 		"message":     fmt.Sprintf(msg.MessageBotOnly, "cli_abc", "Hermes", brandDisplay("feishu", "en")),
 	})
 	assertPresetApplied(t, filepath.Join(configDir, "hermes", "config.json"),
-		core.StrictModeBot, core.AsBot)
+		identity.StrictModeBot, identity.AsBot)
 }
 
 // TestConfigBindRun_FlagModeDefaultsToBotOnly verifies the flag-mode default
@@ -1313,7 +1314,7 @@ func TestConfigBindRun_FlagModeDefaultsToBotOnly(t *testing.T) {
 		"message":     fmt.Sprintf(msg.MessageBotOnly, "cli_abc", "Hermes", brandDisplay("feishu", "")),
 	})
 	assertPresetApplied(t, filepath.Join(configDir, "hermes", "config.json"),
-		core.StrictModeBot, core.AsBot)
+		identity.StrictModeBot, identity.AsBot)
 }
 
 // TestConfigBindRun_WarnsOnIdentityEscalationWithoutForce verifies the
@@ -1409,7 +1410,7 @@ func TestConfigBindRun_IdentityEscalationWithForceAllowed(t *testing.T) {
 		t.Fatalf("expected --force to allow the escalation, got: %v", err)
 	}
 	assertPresetApplied(t, filepath.Join(hermesDir, "config.json"),
-		core.StrictModeOff, core.AsUser)
+		identity.StrictModeOff, identity.AsUser)
 }
 
 // TestConfigBindRun_AllowsRebindSameBotOnly verifies re-binding the same
@@ -1445,7 +1446,7 @@ func TestConfigBindRun_AllowsRebindSameBotOnly(t *testing.T) {
 		t.Fatalf("expected rebind to same bot-only identity to succeed, got: %v", err)
 	}
 	assertPresetApplied(t, filepath.Join(hermesDir, "config.json"),
-		core.StrictModeBot, core.AsBot)
+		identity.StrictModeBot, identity.AsBot)
 }
 
 // TestConfigBindRun_AllowsUserDefaultOnUserDefaultConfig verifies that if the
@@ -1482,12 +1483,12 @@ func TestConfigBindRun_AllowsUserDefaultOnUserDefaultConfig(t *testing.T) {
 		t.Fatalf("expected user-default→user-default rebind to succeed, got: %v", err)
 	}
 	assertPresetApplied(t, filepath.Join(hermesDir, "config.json"),
-		core.StrictModeOff, core.AsUser)
+		identity.StrictModeOff, identity.AsUser)
 }
 
 // assertPresetApplied verifies the on-disk config.json applied the identity
 // preset's StrictMode + DefaultAs expansion.
-func assertPresetApplied(t *testing.T, configPath string, wantStrict core.StrictMode, wantDefault core.Identity) {
+func assertPresetApplied(t *testing.T, configPath string, wantStrict identity.StrictMode, wantDefault identity.Identity) {
 	t.Helper()
 	data, err := os.ReadFile(configPath)
 	if err != nil {
diff --git a/cmd/config/default_as.go b/cmd/config/default_as.go
index f1d5de4e79..e2a673ded7 100644
--- a/cmd/config/default_as.go
+++ b/cmd/config/default_as.go
@@ -9,6 +9,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/spf13/cobra"
 )
 
@@ -44,7 +45,7 @@ func NewCmdConfigDefaultAs(f *cmdutil.Factory) *cobra.Command {
 				return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid identity type %q, valid values: user | bot | auto", value)
 			}
 
-			app.DefaultAs = core.Identity(value)
+			app.DefaultAs = identity.Identity(value)
 			if err := core.SaveMultiAppConfig(multi); err != nil {
 				return errs.NewInternalError(errs.SubtypeStorage, "failed to save config: %v", err).WithCause(err)
 			}
diff --git a/cmd/config/strict_mode.go b/cmd/config/strict_mode.go
index 46610585ab..e2d6a88887 100644
--- a/cmd/config/strict_mode.go
+++ b/cmd/config/strict_mode.go
@@ -10,6 +10,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/spf13/cobra"
 )
 
@@ -100,9 +101,9 @@ func showStrictMode(ctx context.Context, f *cmdutil.Factory, multi *core.MultiAp
 }
 
 func setStrictMode(f *cmdutil.Factory, multi *core.MultiAppConfig, app *core.AppConfig, value string, global bool) error {
-	mode := core.StrictMode(value)
+	mode := identity.StrictMode(value)
 	switch mode {
-	case core.StrictModeBot, core.StrictModeUser, core.StrictModeOff:
+	case identity.StrictModeBot, identity.StrictModeUser, identity.StrictModeOff:
 	default:
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid value %q, valid values: bot | user | off", value)
 	}
@@ -118,7 +119,7 @@ func setStrictMode(f *cmdutil.Factory, multi *core.MultiAppConfig, app *core.App
 	// false-positived (--global change while current profile has an explicit
 	// override) and false-negatived (--global broadening that doesn't affect
 	// the current profile but does affect other inheriting profiles).
-	var oldMode core.StrictMode
+	var oldMode identity.StrictMode
 	if global {
 		oldMode = multi.StrictMode
 	} else {
@@ -147,7 +148,7 @@ func setStrictMode(f *cmdutil.Factory, multi *core.MultiAppConfig, app *core.App
 		return errs.NewInternalError(errs.SubtypeStorage, "failed to save config: %v", err).WithCause(err)
 	}
 
-	if oldMode == core.StrictModeBot && (mode == core.StrictModeUser || mode == core.StrictModeOff) {
+	if oldMode == identity.StrictModeBot && (mode == identity.StrictModeUser || mode == identity.StrictModeOff) {
 		fmt.Fprintln(f.IOStreams.ErrOut, "⚠️ "+strictModeRelaxLang(app).IdentityEscalationMessage)
 	}
 
@@ -169,12 +170,12 @@ func strictModeRelaxLang(app *core.AppConfig) *bindMsg {
 	return getBindMsg("")
 }
 
-func resolveStrictModeStatus(multi *core.MultiAppConfig, app *core.AppConfig) (core.StrictMode, string) {
+func resolveStrictModeStatus(multi *core.MultiAppConfig, app *core.AppConfig) (identity.StrictMode, string) {
 	if app != nil && app.StrictMode != nil {
 		return *app.StrictMode, fmt.Sprintf("profile %q", app.ProfileName())
 	}
 	if multi.StrictMode.IsActive() {
 		return multi.StrictMode, "global"
 	}
-	return core.StrictModeOff, "global (default)"
+	return identity.StrictModeOff, "global (default)"
 }
diff --git a/cmd/config/strict_mode_test.go b/cmd/config/strict_mode_test.go
index c8fc3985ec..e0bfe87dad 100644
--- a/cmd/config/strict_mode_test.go
+++ b/cmd/config/strict_mode_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/secret"
 )
 
@@ -52,7 +53,7 @@ func TestStrictMode_SetBot_Profile(t *testing.T) {
 	}
 	multi, _ := core.LoadMultiAppConfig()
 	app := multi.CurrentAppConfig("")
-	if app.StrictMode == nil || *app.StrictMode != core.StrictModeBot {
+	if app.StrictMode == nil || *app.StrictMode != identity.StrictModeBot {
 		t.Error("expected StrictMode=bot on profile")
 	}
 }
@@ -67,7 +68,7 @@ func TestStrictMode_SetUser_Profile(t *testing.T) {
 	}
 	multi, _ := core.LoadMultiAppConfig()
 	app := multi.CurrentAppConfig("")
-	if app.StrictMode == nil || *app.StrictMode != core.StrictModeUser {
+	if app.StrictMode == nil || *app.StrictMode != identity.StrictModeUser {
 		t.Error("expected StrictMode=user on profile")
 	}
 }
@@ -85,7 +86,7 @@ func TestStrictMode_SetOff_Profile(t *testing.T) {
 	}
 	multi, _ := core.LoadMultiAppConfig()
 	app := multi.CurrentAppConfig("")
-	if app.StrictMode == nil || *app.StrictMode != core.StrictModeOff {
+	if app.StrictMode == nil || *app.StrictMode != identity.StrictModeOff {
 		t.Error("expected StrictMode=off on profile")
 	}
 }
@@ -99,7 +100,7 @@ func TestStrictMode_SetBot_Global(t *testing.T) {
 		t.Fatal(err)
 	}
 	multi, _ := core.LoadMultiAppConfig()
-	if multi.StrictMode != core.StrictModeBot {
+	if multi.StrictMode != identity.StrictModeBot {
 		t.Error("expected global StrictMode=bot")
 	}
 }
@@ -131,8 +132,8 @@ func TestStrictMode_SetGlobal_DoesNotRequireActiveProfile(t *testing.T) {
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig() error = %v", err)
 	}
-	if saved.StrictMode != core.StrictModeBot {
-		t.Fatalf("StrictMode = %q, want %q", saved.StrictMode, core.StrictModeBot)
+	if saved.StrictMode != identity.StrictModeBot {
+		t.Fatalf("StrictMode = %q, want %q", saved.StrictMode, identity.StrictModeBot)
 	}
 }
 
diff --git a/cmd/error_auth_hint.go b/cmd/error_auth_hint.go
index b25dec07cf..339bbde39c 100644
--- a/cmd/error_auth_hint.go
+++ b/cmd/error_auth_hint.go
@@ -14,7 +14,7 @@ import (
 	"github.com/larksuite/cli/internal/apicatalog"
 	internalauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/registry"
 	"github.com/larksuite/cli/shortcuts"
 	shortcutcommon "github.com/larksuite/cli/shortcuts/common"
@@ -58,9 +58,9 @@ func resolveDeclaredScopesForCurrentCommand(f *cmdutil.Factory) []string {
 
 	identity := string(f.ResolvedIdentity)
 	if identity == "" {
-		identity = string(core.AsUser)
+		identity = string(identitypkg.AsUser)
 	}
-	if identity != string(core.AsUser) && identity != string(core.AsBot) {
+	if identity != string(identitypkg.AsUser) && identity != string(identitypkg.AsBot) {
 		return nil
 	}
 
@@ -130,7 +130,7 @@ func commandCatalogPath(cmd *cobra.Command) []string {
 func shortcutSupportsIdentity(sc shortcutcommon.Shortcut, identity string) bool {
 	authTypes := sc.AuthTypes
 	if len(authTypes) == 0 {
-		authTypes = []string{string(core.AsUser)}
+		authTypes = []string{string(identitypkg.AsUser)}
 	}
 	for _, authType := range authTypes {
 		if authType == identity {
diff --git a/cmd/event/console_url.go b/cmd/event/console_url.go
index 1fbf0ba577..c891a24c5f 100644
--- a/cmd/event/console_url.go
+++ b/cmd/event/console_url.go
@@ -11,8 +11,8 @@ import (
 	"fmt"
 
 	brandpkg "github.com/larksuite/cli/brand"
-	"github.com/larksuite/cli/internal/core"
 	eventlib "github.com/larksuite/cli/internal/event"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 )
 
 // Landing-page contract for the scan-to-enable deep link, verified against the
@@ -95,7 +95,7 @@ func addonsHintURL(brand brandpkg.Brand, appID string, a ManifestAddons) string
 // missingScopeAddons routes missing scopes into the identity-appropriate section.
 // The unused side is an empty (non-nil) slice so JSON encodes [] not null —
 // the addons spec treats a missing tenant/user as an empty array.
-func missingScopeAddons(identity core.Identity, missing []string) ManifestAddons {
+func missingScopeAddons(identity identitypkg.Identity, missing []string) ManifestAddons {
 	s := &AddonsScopes{Tenant: []string{}, User: []string{}}
 	if identity.IsBot() {
 		s.Tenant = missing
@@ -107,7 +107,7 @@ func missingScopeAddons(identity core.Identity, missing []string) ManifestAddons
 
 // missingSubscriptionAddons routes missing events/callbacks into the right section.
 // Like missingScopeAddons, unused event sides stay [] (not null) per the addons spec.
-func missingSubscriptionAddons(subType eventlib.SubscriptionType, identity core.Identity, missing []string) ManifestAddons {
+func missingSubscriptionAddons(subType eventlib.SubscriptionType, identity identitypkg.Identity, missing []string) ManifestAddons {
 	if subType == eventlib.SubTypeCallback {
 		return ManifestAddons{Callbacks: &AddonsCallbacks{Items: missing}}
 	}
diff --git a/cmd/event/console_url_test.go b/cmd/event/console_url_test.go
index ea8fbca0af..fad29280f9 100644
--- a/cmd/event/console_url_test.go
+++ b/cmd/event/console_url_test.go
@@ -13,8 +13,8 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/brand"
-	"github.com/larksuite/cli/internal/core"
 	eventlib "github.com/larksuite/cli/internal/event"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 func decodeAddons(t *testing.T, encoded string) ManifestAddons {
@@ -72,22 +72,22 @@ func TestConsoleAddonsURL_FormatAndBrandHost(t *testing.T) {
 }
 
 func TestMissingScopeAddons_ByIdentity(t *testing.T) {
-	bot := missingScopeAddons(core.AsBot, []string{"im:message"})
+	bot := missingScopeAddons(identity.AsBot, []string{"im:message"})
 	if bot.Scopes == nil || len(bot.Scopes.Tenant) != 1 || len(bot.Scopes.User) != 0 {
 		t.Errorf("bot scopes = %+v, want tenant-only", bot.Scopes)
 	}
-	user := missingScopeAddons(core.AsUser, []string{"im:message"})
+	user := missingScopeAddons(identity.AsUser, []string{"im:message"})
 	if user.Scopes == nil || len(user.Scopes.User) != 1 || len(user.Scopes.Tenant) != 0 {
 		t.Errorf("user scopes = %+v, want user-only", user.Scopes)
 	}
 }
 
 func TestMissingSubscriptionAddons_EventVsCallback(t *testing.T) {
-	ev := missingSubscriptionAddons(eventlib.SubTypeEvent, core.AsBot, []string{"im.message.receive_v1"})
+	ev := missingSubscriptionAddons(eventlib.SubTypeEvent, identity.AsBot, []string{"im.message.receive_v1"})
 	if ev.Events == nil || len(ev.Events.Items.Tenant) != 1 {
 		t.Errorf("event addons = %+v, want events.items.tenant", ev.Events)
 	}
-	cb := missingSubscriptionAddons(eventlib.SubTypeCallback, core.AsBot, []string{"card.action.trigger"})
+	cb := missingSubscriptionAddons(eventlib.SubTypeCallback, identity.AsBot, []string{"card.action.trigger"})
 	if cb.Callbacks == nil || len(cb.Callbacks.Items) != 1 || cb.Events != nil {
 		t.Errorf("callback addons = %+v, want callbacks.items only", cb)
 	}
@@ -97,9 +97,9 @@ func TestMissingAddons_EncodeEmptyArraysNotNull(t *testing.T) {
 	// Unused identity sides must encode as [] (not null) so the launcher page's
 	// shape validation treats them as "缺省 -> 空数组" per the addons spec.
 	cases := []ManifestAddons{
-		missingScopeAddons(core.AsBot, []string{"im:message"}),
-		missingScopeAddons(core.AsUser, []string{"im:message"}),
-		missingSubscriptionAddons(eventlib.SubTypeEvent, core.AsBot, []string{"im.message.receive_v1"}),
+		missingScopeAddons(identity.AsBot, []string{"im:message"}),
+		missingScopeAddons(identity.AsUser, []string{"im:message"}),
+		missingSubscriptionAddons(eventlib.SubTypeEvent, identity.AsBot, []string{"im.message.receive_v1"}),
 	}
 	for i, a := range cases {
 		raw, err := json.Marshal(a)
diff --git a/cmd/event/consume.go b/cmd/event/consume.go
index b677a5d69d..0fe580baaf 100644
--- a/cmd/event/consume.go
+++ b/cmd/event/consume.go
@@ -21,11 +21,11 @@ import (
 	"github.com/larksuite/cli/internal/appmeta"
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	eventlib "github.com/larksuite/cli/internal/event"
 	"github.com/larksuite/cli/internal/event/consume"
 	"github.com/larksuite/cli/internal/event/transport"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
 )
@@ -132,7 +132,7 @@ func runConsume(cmd *cobra.Command, f *cmdutil.Factory, eventKey string, o consu
 	}
 	runtime := &consumeRuntime{client: apiClient, accessIdentity: identity}
 	// botRuntime pins AsBot: /app_versions rejects UAT (99991668) and /connection is app-level.
-	botRuntime := &consumeRuntime{client: apiClient, accessIdentity: core.AsBot}
+	botRuntime := &consumeRuntime{client: apiClient, accessIdentity: identitypkg.AsBot}
 
 	// Weak-dependency fetch: failures leave appVer==nil and downgrade preflight to a no-op.
 	preflightErrOut := f.IOStreams.ErrOut
@@ -225,8 +225,8 @@ func runConsume(cmd *cobra.Command, f *cmdutil.Factory, eventKey string, o consu
 }
 
 // resolveIdentity resolves the session identity and enforces keyDef.AuthTypes as a whitelist.
-func resolveIdentity(cmd *cobra.Command, f *cmdutil.Factory, keyDef *eventlib.KeyDefinition) (core.Identity, error) {
-	flagAs := core.Identity(cmd.Flag("as").Value.String())
+func resolveIdentity(cmd *cobra.Command, f *cmdutil.Factory, keyDef *eventlib.KeyDefinition) (identitypkg.Identity, error) {
+	flagAs := identitypkg.Identity(cmd.Flag("as").Value.String())
 	identity := f.ResolveAs(cmd.Context(), cmd, flagAs)
 	if len(keyDef.AuthTypes) > 0 {
 		if err := f.CheckIdentity(identity, keyDef.AuthTypes); err != nil {
@@ -241,7 +241,7 @@ type preflightCtx struct {
 	appID    string
 	brand    brandpkg.Brand
 	eventKey string
-	identity core.Identity
+	identity identitypkg.Identity
 	keyDef   *eventlib.KeyDefinition
 	appVer   *appmeta.AppVersion
 	// subscribedCallbacks is the application/get 底账 for callback-type EventKeys;
@@ -265,7 +265,7 @@ func preflightScopes(ctx context.Context, pf *preflightCtx) error {
 			return nil
 		}
 		storedScopes = strings.Join(pf.appVer.TenantScopes, " ")
-	case pf.identity == core.AsUser:
+	case pf.identity == identitypkg.AsUser:
 		result, err := pf.factory.Credential.ResolveToken(ctx, credential.NewTokenSpec(pf.identity, pf.appID))
 		if err != nil || result == nil || result.Scopes == "" {
 			return nil //nolint:nilerr // best-effort: bus handshake will surface real auth error
@@ -292,7 +292,7 @@ func preflightScopes(ctx context.Context, pf *preflightCtx) error {
 // the tenant token carries them. User: the scan link only updates the app
 // manifest — the user's own token still lacks the scopes until it is
 // re-authorized — so direct the user to re-login instead.
-func scopeRemediationHint(brand brandpkg.Brand, appID string, identity core.Identity, missing []string) string {
+func scopeRemediationHint(brand brandpkg.Brand, appID string, identity identitypkg.Identity, missing []string) string {
 	if identity.IsBot() {
 		return fmt.Sprintf("grant these scopes by scanning: %s",
 			addonsHintURL(brand, appID, missingScopeAddons(identity, missing)))
@@ -369,7 +369,7 @@ func resolveTenantToken(ctx context.Context, f *cmdutil.Factory, appID string) (
 	if ctx == nil {
 		ctx = context.Background()
 	}
-	result, err := f.Credential.ResolveToken(ctx, credential.NewTokenSpec(core.AsBot, appID))
+	result, err := f.Credential.ResolveToken(ctx, credential.NewTokenSpec(identitypkg.AsBot, appID))
 	if err != nil {
 		if _, ok := errs.ProblemOf(err); ok {
 			return "", err
diff --git a/cmd/event/preflight_test.go b/cmd/event/preflight_test.go
index 5830b215aa..c26b617724 100644
--- a/cmd/event/preflight_test.go
+++ b/cmd/event/preflight_test.go
@@ -11,11 +11,11 @@ import (
 	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/appmeta"
-	"github.com/larksuite/cli/internal/core"
 	eventlib "github.com/larksuite/cli/internal/event"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 )
 
-func newPreflightCtx(appID string, brand brandpkg.Brand, identity core.Identity, keyDef *eventlib.KeyDefinition, appVer *appmeta.AppVersion) *preflightCtx {
+func newPreflightCtx(appID string, brand brandpkg.Brand, identity identitypkg.Identity, keyDef *eventlib.KeyDefinition, appVer *appmeta.AppVersion) *preflightCtx {
 	key := ""
 	if keyDef != nil {
 		key = keyDef.Key
@@ -109,7 +109,7 @@ func TestPreflightScopes_Bot_NoAppVer_SkipsCheck(t *testing.T) {
 		Key:    "im.message.text",
 		Scopes: []string{"im:message", "im:message.group_at_msg"},
 	}
-	err := preflightScopes(nil, newPreflightCtx("cli_x", "feishu", core.AsBot, def, nil))
+	err := preflightScopes(nil, newPreflightCtx("cli_x", "feishu", identitypkg.AsBot, def, nil))
 	if err != nil {
 		t.Fatalf("bot + nil appVer should skip, got: %v", err)
 	}
@@ -125,7 +125,7 @@ func TestPreflightScopes_Bot_AllGranted_Passes(t *testing.T) {
 		"im:message.group_at_msg",
 		"contact:user:readonly",
 	}}
-	err := preflightScopes(nil, newPreflightCtx("cli_x", "feishu", core.AsBot, def, appVer))
+	err := preflightScopes(nil, newPreflightCtx("cli_x", "feishu", identitypkg.AsBot, def, appVer))
 	if err != nil {
 		t.Fatalf("all scopes granted, unexpected error: %v", err)
 	}
@@ -137,7 +137,7 @@ func TestPreflightScopes_Bot_MissingBlocks(t *testing.T) {
 		Scopes: []string{"im:message", "im:message.group_at_msg"},
 	}
 	appVer := &appmeta.AppVersion{TenantScopes: []string{"im:message"}}
-	err := preflightScopes(nil, newPreflightCtx("cli_x", "feishu", core.AsBot, def, appVer))
+	err := preflightScopes(nil, newPreflightCtx("cli_x", "feishu", identitypkg.AsBot, def, appVer))
 	if err == nil {
 		t.Fatal("expected error for missing scope")
 	}
@@ -170,7 +170,7 @@ func TestPreflightScopes_Bot_MissingBlocks(t *testing.T) {
 
 func TestPreflightScopes_NoRequiredScopes_SkipsCheck(t *testing.T) {
 	def := &eventlib.KeyDefinition{Key: "x"}
-	if err := preflightScopes(nil, newPreflightCtx("cli_x", "feishu", core.AsBot, def, nil)); err != nil {
+	if err := preflightScopes(nil, newPreflightCtx("cli_x", "feishu", identitypkg.AsBot, def, nil)); err != nil {
 		t.Fatalf("no required scopes means nothing to verify, got: %v", err)
 	}
 }
@@ -180,7 +180,7 @@ func TestPreflightEventTypes_CallbackMissing(t *testing.T) {
 		appID:               "cli_x",
 		brand:               brandpkg.Feishu,
 		eventKey:            "test.cb",
-		identity:            core.AsBot,
+		identity:            identitypkg.AsBot,
 		subscribedCallbacks: []string{"profile.view.get"},
 		keyDef: &eventlib.KeyDefinition{
 			Key:                   "test.cb",
@@ -209,7 +209,7 @@ func TestPreflightEventTypes_CallbackSkippedWhenNil(t *testing.T) {
 		appID:               "cli_x",
 		brand:               brandpkg.Feishu,
 		eventKey:            "test.cb",
-		identity:            core.AsBot,
+		identity:            identitypkg.AsBot,
 		subscribedCallbacks: nil, // fetch 失败/拿不到 -> 弱依赖跳过
 		keyDef: &eventlib.KeyDefinition{
 			Key:                   "test.cb",
@@ -230,7 +230,7 @@ func TestPreflightEventTypes_CallbackEmptyReportsMissing(t *testing.T) {
 		appID:               "cli_x",
 		brand:               brandpkg.Feishu,
 		eventKey:            "test.cb",
-		identity:            core.AsBot,
+		identity:            identitypkg.AsBot,
 		subscribedCallbacks: []string{}, // fetched, none subscribed
 		keyDef: &eventlib.KeyDefinition{
 			Key:                   "test.cb",
@@ -252,7 +252,7 @@ func TestPreflightEventTypes_CallbackAllSubscribed_Passes(t *testing.T) {
 		appID:               "cli_x",
 		brand:               brandpkg.Feishu,
 		eventKey:            "test.cb",
-		identity:            core.AsBot,
+		identity:            identitypkg.AsBot,
 		subscribedCallbacks: []string{"card.action.trigger", "profile.view.get"},
 		keyDef: &eventlib.KeyDefinition{
 			Key:                   "test.cb",
@@ -267,12 +267,12 @@ func TestPreflightEventTypes_CallbackAllSubscribed_Passes(t *testing.T) {
 
 func TestScopeRemediationHint_ByIdentity(t *testing.T) {
 	// bot: scan-to-enable link (adds scopes to app manifest)
-	bot := scopeRemediationHint(brandpkg.Feishu, "cli_x", core.AsBot, []string{"im:message"})
+	bot := scopeRemediationHint(brandpkg.Feishu, "cli_x", identitypkg.AsBot, []string{"im:message"})
 	if !strings.Contains(bot, "/page/launcher?clientID=cli_x&addons=") {
 		t.Errorf("bot hint should give the scan link, got: %s", bot)
 	}
 	// user: re-login (scan link cannot grant scopes to the user's own token)
-	user := scopeRemediationHint(brandpkg.Feishu, "cli_x", core.AsUser, []string{"im:message"})
+	user := scopeRemediationHint(brandpkg.Feishu, "cli_x", identitypkg.AsUser, []string{"im:message"})
 	if !strings.Contains(user, "auth login --scope") {
 		t.Errorf("user hint should direct to auth login, got: %s", user)
 	}
diff --git a/cmd/event/runtime.go b/cmd/event/runtime.go
index 3f03f4073c..4902e59b04 100644
--- a/cmd/event/runtime.go
+++ b/cmd/event/runtime.go
@@ -9,13 +9,13 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 // consumeRuntime routes event.APIClient calls through the shared client.APIClient with a pinned identity.
 type consumeRuntime struct {
 	client         *client.APIClient
-	accessIdentity core.Identity
+	accessIdentity identity.Identity
 }
 
 func (r *consumeRuntime) CallAPI(ctx context.Context, method, path string, body interface{}) (json.RawMessage, error) {
diff --git a/cmd/event/runtime_test.go b/cmd/event/runtime_test.go
index efae1d6f9a..de1000f930 100644
--- a/cmd/event/runtime_test.go
+++ b/cmd/event/runtime_test.go
@@ -19,6 +19,7 @@ import (
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 // staticTokenResolver always returns a fixed token without any HTTP calls.
@@ -48,7 +49,7 @@ func newTestConsumeRuntime(rt http.RoundTripper) *consumeRuntime {
 			Credential: credential.NewCredentialProvider(nil, nil, &staticTokenResolver{}, nil),
 			Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 		},
-		accessIdentity: core.AsBot,
+		accessIdentity: identity.AsBot,
 	}
 }
 
diff --git a/cmd/prune.go b/cmd/prune.go
index 49979423f0..6e612ff1de 100644
--- a/cmd/prune.go
+++ b/cmd/prune.go
@@ -12,11 +12,11 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdpolicy"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 // pruneForStrictMode removes commands incompatible with the active strict mode.
-func pruneForStrictMode(root *cobra.Command, mode core.StrictMode) {
+func pruneForStrictMode(root *cobra.Command, mode identity.StrictMode) {
 	pruneIncompatible(root, mode)
 	pruneEmpty(root)
 }
@@ -25,7 +25,7 @@ func pruneForStrictMode(root *cobra.Command, mode core.StrictMode) {
 // identities incompatible with the forced identity. Commands without annotation are kept.
 // Hidden stubs preserve direct execution so users get a strict-mode error instead
 // of Cobra's generic "unknown flag" fallback from the parent command.
-func pruneIncompatible(parent *cobra.Command, mode core.StrictMode) {
+func pruneIncompatible(parent *cobra.Command, mode identity.StrictMode) {
 	forced := string(mode.ForcedIdentity())
 	var toRemove []*cobra.Command
 	var toAdd []*cobra.Command
@@ -44,7 +44,7 @@ func pruneIncompatible(parent *cobra.Command, mode core.StrictMode) {
 	}
 }
 
-func strictModeStubFrom(child *cobra.Command, mode core.StrictMode) *cobra.Command {
+func strictModeStubFrom(child *cobra.Command, mode identity.StrictMode) *cobra.Command {
 	// The denial annotations let the hook layer's populateInvocationDenial
 	// recognise this command as denied, so the Wrap chain is physically
 	// isolated (wrapRunE takes the DeniedByPolicy branch and calls the
diff --git a/cmd/prune_test.go b/cmd/prune_test.go
index aee11177b2..501a13a6ae 100644
--- a/cmd/prune_test.go
+++ b/cmd/prune_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/larksuite/cli/extension/platform"
 	"github.com/larksuite/cli/internal/cmdpolicy"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/spf13/cobra"
 )
@@ -75,7 +75,7 @@ func findCmd(root *cobra.Command, names ...string) *cobra.Command {
 
 func TestPruneForStrictMode_Bot(t *testing.T) {
 	root := newTestTree()
-	pruneForStrictMode(root, core.StrictModeBot)
+	pruneForStrictMode(root, identity.StrictModeBot)
 
 	if cmd := findCmd(root, "im", "+search"); cmd == nil || !cmd.Hidden {
 		t.Error("+search (user-only) should be replaced by a hidden stub in bot mode")
@@ -99,7 +99,7 @@ func TestPruneForStrictMode_Bot(t *testing.T) {
 
 func TestPruneForStrictMode_User(t *testing.T) {
 	root := newTestTree()
-	pruneForStrictMode(root, core.StrictModeUser)
+	pruneForStrictMode(root, identity.StrictModeUser)
 
 	if findCmd(root, "im", "+search") == nil {
 		t.Error("+search (user-only) should be kept in user mode")
@@ -117,7 +117,7 @@ func TestPruneForStrictMode_User(t *testing.T) {
 
 func TestPruneEmpty(t *testing.T) {
 	root := newTestTree()
-	pruneForStrictMode(root, core.StrictModeBot)
+	pruneForStrictMode(root, identity.StrictModeBot)
 
 	if cmd := findCmd(root, "im", "messages"); cmd == nil || !cmd.Hidden {
 		t.Error("resource 'messages' should be kept hidden when only hidden stubs remain")
@@ -144,7 +144,7 @@ func TestPruneForStrictMode_Bot_DirectUserShortcutReturnsStrictMode(t *testing.T
 	root := newTestTree()
 	root.SilenceErrors = true
 	root.SilenceUsage = true
-	pruneForStrictMode(root, core.StrictModeBot)
+	pruneForStrictMode(root, identity.StrictModeBot)
 	root.SetArgs([]string{"im", "+search", "--query", "hello"})
 
 	err := root.Execute()
@@ -160,7 +160,7 @@ func TestPruneForStrictMode_Bot_DirectNestedUserMethodReturnsStrictMode(t *testi
 	root := newTestTree()
 	root.SilenceErrors = true
 	root.SilenceUsage = true
-	pruneForStrictMode(root, core.StrictModeBot)
+	pruneForStrictMode(root, identity.StrictModeBot)
 	root.SetArgs([]string{"im", "messages", "search", "--query", "hello"})
 
 	err := root.Execute()
@@ -176,7 +176,7 @@ func TestPruneForStrictMode_Bot_DirectAuthLoginReturnsStrictMode(t *testing.T) {
 	root := newTestTree()
 	root.SilenceErrors = true
 	root.SilenceUsage = true
-	pruneForStrictMode(root, core.StrictModeBot)
+	pruneForStrictMode(root, identity.StrictModeBot)
 	root.SetArgs([]string{"auth", "login", "--json", "--scope", "im:message.send_as_user"})
 
 	err := root.Execute()
@@ -192,7 +192,7 @@ func TestPruneForStrictMode_User_DirectBotShortcutReturnsStrictMode(t *testing.T
 	root := newTestTree()
 	root.SilenceErrors = true
 	root.SilenceUsage = true
-	pruneForStrictMode(root, core.StrictModeUser)
+	pruneForStrictMode(root, identity.StrictModeUser)
 	root.SetArgs([]string{"im", "+subscribe", "--topic", "x"})
 
 	err := root.Execute()
@@ -215,7 +215,7 @@ func TestPruneForStrictMode_User_DirectBotShortcutReturnsStrictMode(t *testing.T
 // stops at the stub and proceeds to its RunE.
 func TestStrictModeStub_BypassesParentPersistentPreRunE(t *testing.T) {
 	root := newTestTree()
-	pruneForStrictMode(root, core.StrictModeBot)
+	pruneForStrictMode(root, identity.StrictModeBot)
 	stub := findCmd(root, "auth", "login")
 	if stub == nil {
 		t.Fatal("auth/login stub should exist after StrictModeBot")
@@ -235,7 +235,7 @@ func TestStrictModeStub_BypassesParentPersistentPreRunE(t *testing.T) {
 // stub's RunE.
 func TestStrictModeStub_BypassesArgsValidator(t *testing.T) {
 	root := newTestTree()
-	pruneForStrictMode(root, core.StrictModeBot)
+	pruneForStrictMode(root, identity.StrictModeBot)
 	stub := findCmd(root, "auth", "login")
 	if stub == nil {
 		t.Fatal("auth/login stub should exist after StrictModeBot")
@@ -256,7 +256,7 @@ func TestStrictModeStub_BypassesArgsValidator(t *testing.T) {
 // still inspect the structured denial taxonomy via errors.As.
 func TestStrictModeStub_StructuredEnvelope(t *testing.T) {
 	root := newTestTree()
-	pruneForStrictMode(root, core.StrictModeBot)
+	pruneForStrictMode(root, identity.StrictModeBot)
 	stub := findCmd(root, "im", "+search")
 	if stub == nil {
 		t.Fatalf("expected im/+search stub")
@@ -318,7 +318,7 @@ func TestStrictModeStub_StructuredEnvelope(t *testing.T) {
 // and silently return nil, swallowing the strict-mode error.
 func TestStrictModeStub_HasDenialAnnotation(t *testing.T) {
 	root := newTestTree()
-	pruneForStrictMode(root, core.StrictModeBot)
+	pruneForStrictMode(root, identity.StrictModeBot)
 
 	// im/+search is user-only -> replaced by a stub in StrictModeBot.
 	stub := findCmd(root, "im", "+search")
@@ -356,7 +356,7 @@ func TestStrictModeStub_PreservesOriginalMetadata(t *testing.T) {
 	cmdutil.SetRisk(userOnly, "read")
 	svc.AddCommand(userOnly)
 
-	pruneForStrictMode(root, core.StrictModeBot)
+	pruneForStrictMode(root, identity.StrictModeBot)
 
 	stub := findCmd(root, "im", "+search")
 	if stub == nil {
diff --git a/cmd/root_integration_test.go b/cmd/root_integration_test.go
index 26c8f72784..a7d693b612 100644
--- a/cmd/root_integration_test.go
+++ b/cmd/root_integration_test.go
@@ -21,6 +21,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/meta"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/secret"
@@ -157,7 +158,7 @@ func strictModeFixtureCatalog() apicatalog.Catalog {
 	})
 }
 
-func newStrictModeDefaultFactory(t *testing.T, profile string, mode core.StrictMode) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer) {
+func newStrictModeDefaultFactory(t *testing.T, profile string, mode identity.StrictMode) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer) {
 	t.Helper()
 	t.Setenv(envnames.CliAppID, "")
 	t.Setenv(envnames.CliAppSecret, "")
@@ -208,7 +209,7 @@ func resetBuffers(stdout *bytes.Buffer, stderr *bytes.Buffer) {
 // --- service command ---
 
 func TestIntegration_StrictModeBot_ProfileOverride_HidesCommandsInHelp(t *testing.T) {
-	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", core.StrictModeBot)
+	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", identity.StrictModeBot)
 	rootCmd := buildStrictModeIntegrationRootCmd(t, f)
 
 	code := executeRootIntegration(t, f, rootCmd, []string{"auth", "--help"})
@@ -240,7 +241,7 @@ func TestIntegration_StrictModeBot_ProfileOverride_HidesCommandsInHelp(t *testin
 }
 
 func TestIntegration_StrictModeBot_ProfileOverride_DirectAuthLoginReturnsEnvelope(t *testing.T) {
-	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", core.StrictModeBot)
+	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", identity.StrictModeBot)
 	rootCmd := buildStrictModeIntegrationRootCmd(t, f)
 
 	code := executeRootIntegration(t, f, rootCmd, []string{
@@ -317,7 +318,7 @@ func assertCheckStrictModeEnvelope(t *testing.T, env typedErrorEnvelope, wantMes
 }
 
 func TestIntegration_StrictModeBot_ProfileOverride_DirectUserShortcutReturnsEnvelope(t *testing.T) {
-	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", core.StrictModeBot)
+	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", identity.StrictModeBot)
 	rootCmd := buildStrictModeIntegrationRootCmd(t, f)
 
 	code := executeRootIntegration(t, f, rootCmd, []string{
@@ -337,7 +338,7 @@ func TestIntegration_StrictModeBot_ProfileOverride_DirectUserShortcutReturnsEnve
 func TestIntegration_StrictModeUser_ProfileOverride_ChatCreateDryRunSucceeds(t *testing.T) {
 	// +chat-create supports both user and bot identities, so strict mode user
 	// should allow it and force user identity.
-	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", core.StrictModeUser)
+	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", identity.StrictModeUser)
 	rootCmd := buildStrictModeIntegrationRootCmd(t, f)
 
 	code := executeRootIntegration(t, f, rootCmd, []string{
@@ -354,7 +355,7 @@ func TestIntegration_StrictModeUser_ProfileOverride_ChatCreateDryRunSucceeds(t *
 }
 
 func TestIntegration_StrictModeUser_ProfileOverride_ShortcutExplicitBotReturnsEnvelope(t *testing.T) {
-	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", core.StrictModeUser)
+	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", identity.StrictModeUser)
 	rootCmd := buildStrictModeIntegrationRootCmd(t, f)
 
 	code := executeRootIntegration(t, f, rootCmd, []string{
@@ -372,7 +373,7 @@ func TestIntegration_StrictModeUser_ProfileOverride_ShortcutExplicitBotReturnsEn
 }
 
 func TestIntegration_StrictModeBot_ProfileOverride_ServiceExplicitUserReturnsEnvelope(t *testing.T) {
-	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", core.StrictModeBot)
+	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", identity.StrictModeBot)
 	catalog := strictModeFixtureCatalog()
 	rootCmd := buildStrictModeIntegrationRootCmdWithCatalog(t, f, &catalog)
 
@@ -391,7 +392,7 @@ func TestIntegration_StrictModeBot_ProfileOverride_ServiceExplicitUserReturnsEnv
 }
 
 func TestIntegration_StrictModeUser_ProfileOverride_ServiceBotOnlyMethodReturnsEnvelope(t *testing.T) {
-	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", core.StrictModeUser)
+	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", identity.StrictModeUser)
 	catalog := strictModeFixtureCatalog()
 	rootCmd := buildStrictModeIntegrationRootCmdWithCatalog(t, f, &catalog)
 
@@ -410,7 +411,7 @@ func TestIntegration_StrictModeUser_ProfileOverride_ServiceBotOnlyMethodReturnsE
 }
 
 func TestIntegration_StrictModeBot_ProfileOverride_APIExplicitUserReturnsEnvelope(t *testing.T) {
-	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", core.StrictModeBot)
+	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", identity.StrictModeBot)
 	rootCmd := buildStrictModeIntegrationRootCmd(t, f)
 
 	code := executeRootIntegration(t, f, rootCmd, []string{
diff --git a/cmd/root_test.go b/cmd/root_test.go
index c9b97cce84..56d4d74a82 100644
--- a/cmd/root_test.go
+++ b/cmd/root_test.go
@@ -23,6 +23,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/deprecation"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/registry"
 )
@@ -516,7 +517,7 @@ func TestApplyNeedAuthorizationHint_ServiceMethodUsesLocalScopesWhenNoUAT(t *tes
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
-	f.ResolvedIdentity = core.AsUser
+	f.ResolvedIdentity = identity.AsUser
 
 	var target registry.CommandEntry
 	for _, entry := range registry.CollectCommandScopes([]string{"calendar"}, "user") {
@@ -564,7 +565,7 @@ func TestApplyNeedAuthorizationHint_ShortcutUsesDeclaredScopesWhenNoUAT(t *testi
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
-	f.ResolvedIdentity = core.AsUser
+	f.ResolvedIdentity = identity.AsUser
 
 	root := &cobra.Command{Use: "lark-cli"}
 	serviceCmd := &cobra.Command{Use: "docs"}
@@ -589,7 +590,7 @@ func TestApplyNeedAuthorizationHint_ShortcutIncludesConditionalScopes(t *testing
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
-	f.ResolvedIdentity = core.AsUser
+	f.ResolvedIdentity = identity.AsUser
 
 	root := &cobra.Command{Use: "lark-cli"}
 	serviceCmd := &cobra.Command{Use: "drive"}
@@ -615,7 +616,7 @@ func TestApplyNeedAuthorizationHint_AppendsExistingHint(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
-	f.ResolvedIdentity = core.AsUser
+	f.ResolvedIdentity = identity.AsUser
 
 	root := &cobra.Command{Use: "lark-cli"}
 	serviceCmd := &cobra.Command{Use: "docs"}
diff --git a/cmd/schema/schema.go b/cmd/schema/schema.go
index 3b27967e08..8859618d97 100644
--- a/cmd/schema/schema.go
+++ b/cmd/schema/schema.go
@@ -12,7 +12,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/apicatalog"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/registry"
 	"github.com/larksuite/cli/internal/schema"
@@ -91,7 +91,7 @@ func schemaRun(opts *SchemaOptions) error {
 // schema owns rendering (Envelope/Envelopes); this adapter only chooses the
 // output shape — a single resolved method renders as one envelope object,
 // anything broader as an array — and maps resolve failures to hints.
-func runSchema(out io.Writer, parts []string, mode core.StrictMode) error {
+func runSchema(out io.Writer, parts []string, mode identity.StrictMode) error {
 	catalog := registry.SchemaCatalog()
 	if len(catalog.Services()) == 0 {
 		// No embedded metadata and the runtime fallback is empty too: offline
diff --git a/cmd/service/service.go b/cmd/service/service.go
index 813b9c5f7a..8f54c7d19a 100644
--- a/cmd/service/service.go
+++ b/cmd/service/service.go
@@ -19,6 +19,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/errclass"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/meta"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/registry"
@@ -134,7 +135,7 @@ type ServiceMethodOptions struct {
 	// Flags
 	Params     string
 	Data       string
-	As         core.Identity
+	As         identitypkg.Identity
 	Output     string
 	PageAll    bool
 	PageLimit  int
@@ -267,7 +268,7 @@ func buildMethodCommand(ctx context.Context, f *cmdutil.Factory, spec methodComm
 		RunE: func(cmd *cobra.Command, args []string) error {
 			opts.Cmd = cmd
 			opts.Ctx = cmd.Context()
-			opts.As = core.Identity(asStr)
+			opts.As = identitypkg.Identity(asStr)
 			if runF != nil {
 				return runF(opts)
 			}
@@ -370,7 +371,7 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {
 		return err
 	}
 
-	// Check if this API method supports the resolved identity.
+	// Check if this API method supports the resolved identitypkg.
 	if opts.Method.RestrictsIdentity() {
 		if err := f.CheckIdentity(opts.As, opts.Method.Identities()); err != nil {
 			return err
@@ -453,7 +454,7 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {
 }
 
 // checkServiceScopes pre-checks user scopes before making the API call.
-func checkServiceScopes(ctx context.Context, cred *credential.CredentialProvider, identity core.Identity, config *core.CliConfig, method meta.Method) error {
+func checkServiceScopes(ctx context.Context, cred *credential.CredentialProvider, identity identitypkg.Identity, config *core.CliConfig, method meta.Method) error {
 	if ctx.Err() != nil {
 		return ctx.Err()
 	}
@@ -682,7 +683,7 @@ func serviceDryRunOutputOptions(f *cmdutil.Factory, opts *ServiceMethodOptions)
 	}
 }
 
-func servicePaginate(ctx context.Context, ac *client.APIClient, request client.RawApiRequest, format output.Format, jqExpr string, out, errOut io.Writer, commandPath string, pagOpts client.PaginationOptions, checkErr func(interface{}, core.Identity) error) error {
+func servicePaginate(ctx context.Context, ac *client.APIClient, request client.RawApiRequest, format output.Format, jqExpr string, out, errOut io.Writer, commandPath string, pagOpts client.PaginationOptions, checkErr func(interface{}, identitypkg.Identity) error) error {
 	if pagOpts.Identity == "" {
 		pagOpts.Identity = request.As
 	}
diff --git a/cmd/service/service_paginate_test.go b/cmd/service/service_paginate_test.go
index aa1e0bd856..303fdab908 100644
--- a/cmd/service/service_paginate_test.go
+++ b/cmd/service/service_paginate_test.go
@@ -19,6 +19,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 )
 
@@ -63,7 +64,7 @@ func servicePaginateRequest() client.RawApiRequest {
 	return client.RawApiRequest{
 		Method: "GET",
 		URL:    "/open-apis/test/v1/items",
-		As:     core.AsBot,
+		As:     identity.AsBot,
 	}
 }
 
diff --git a/cmd/service/service_test.go b/cmd/service/service_test.go
index e449146c44..17df6ba984 100644
--- a/cmd/service/service_test.go
+++ b/cmd/service/service_test.go
@@ -21,6 +21,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/meta"
 	"github.com/spf13/cobra"
 )
@@ -194,7 +195,7 @@ func TestNewCmdServiceMethod_RunFCallback(t *testing.T) {
 	if captured == nil {
 		t.Fatal("runF was not called")
 	}
-	if captured.As != core.AsBot {
+	if captured.As != identity.AsBot {
 		t.Errorf("expected As=bot, got %s", captured.As)
 	}
 	if captured.SchemaPath != "drive.files.list" {
diff --git a/cmd/whoami/whoami.go b/cmd/whoami/whoami.go
index f15b9aa588..23565f36fd 100644
--- a/cmd/whoami/whoami.go
+++ b/cmd/whoami/whoami.go
@@ -11,6 +11,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/identitydiag"
 	"github.com/larksuite/cli/internal/output"
 )
@@ -81,7 +82,7 @@ func whoamiRun(cmd *cobra.Command, opts *Options) error {
 		return err
 	}
 	ctx := cmd.Context()
-	flagAs := core.Identity(opts.As)
+	flagAs := identity.Identity(opts.As)
 	as := f.ResolveAs(ctx, cmd, flagAs)
 	// Validate as a real API call does (strict mode, then identity) so whoami
 	// can't preview an identity the next call would refuse.
@@ -108,8 +109,8 @@ func whoamiRun(cmd *cobra.Command, opts *Options) error {
 // auto-detected result means auto-detect; otherwise a strict-mode forced
 // identity means strict-mode; otherwise it came from configured default-as.
 // Values are snake_case to match the other enum fields (e.g. tokenStatus).
-func resolveSource(changedAs bool, flagAs core.Identity, autoDetected bool, strictForced core.Identity) string {
-	if changedAs && (flagAs == core.AsUser || flagAs == core.AsBot) {
+func resolveSource(changedAs bool, flagAs identity.Identity, autoDetected bool, strictForced identity.Identity) string {
+	if changedAs && (flagAs == identity.AsUser || flagAs == identity.AsBot) {
 		return "flag"
 	}
 	if autoDetected {
@@ -123,10 +124,10 @@ func resolveSource(changedAs bool, flagAs core.Identity, autoDetected bool, stri
 
 // buildResult maps the resolved identity and local diagnostics into the output.
 // ResolveAs only ever returns user or bot, so the default branch handles user.
-func buildResult(cfg *core.CliConfig, as core.Identity, source string, diag identitydiag.Result) *whoamiResult {
+func buildResult(cfg *core.CliConfig, as identity.Identity, source string, diag identitydiag.Result) *whoamiResult {
 	defaultAs := cfg.DefaultAs
 	if defaultAs == "" {
-		defaultAs = core.AsAuto
+		defaultAs = identity.AsAuto
 	}
 	res := &whoamiResult{
 		Profile:        cfg.ProfileName,
@@ -139,7 +140,7 @@ func buildResult(cfg *core.CliConfig, as core.Identity, source string, diag iden
 	// Use the diagnosed hint as-is: it is tailored to the credential source, so
 	// it never says "auth login" when that is blocked under an external provider.
 	switch as {
-	case core.AsBot:
+	case identity.AsBot:
 		res.Available = diag.Bot.Available
 		res.TokenStatus = diag.Bot.Status
 		if !diag.Bot.Available {
diff --git a/cmd/whoami/whoami_test.go b/cmd/whoami/whoami_test.go
index 2fc7018699..4985845bff 100644
--- a/cmd/whoami/whoami_test.go
+++ b/cmd/whoami/whoami_test.go
@@ -19,6 +19,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/identitydiag"
 )
 
@@ -26,16 +27,16 @@ func TestResolveSource(t *testing.T) {
 	tests := []struct {
 		name         string
 		changedAs    bool
-		flagAs       core.Identity
+		flagAs       identity.Identity
 		autoDetected bool
-		strictForced core.Identity
+		strictForced identity.Identity
 		want         string
 	}{
-		{"explicit flag user", true, core.AsUser, false, "", "flag"},
-		{"explicit flag bot", true, core.AsBot, false, "", "flag"},
-		{"flag auto falls through to auto-detect", true, core.AsAuto, true, "", "auto_detect"},
+		{"explicit flag user", true, identity.AsUser, false, "", "flag"},
+		{"explicit flag bot", true, identity.AsBot, false, "", "flag"},
+		{"flag auto falls through to auto-detect", true, identity.AsAuto, true, "", "auto_detect"},
 		{"auto detected", false, "", true, "", "auto_detect"},
-		{"strict mode", false, "", false, core.AsBot, "strict_mode"},
+		{"strict mode", false, "", false, identity.AsBot, "strict_mode"},
 		{"default_as", false, "", false, "", "default_as"},
 	}
 	for _, tt := range tests {
@@ -49,11 +50,11 @@ func TestResolveSource(t *testing.T) {
 }
 
 func TestBuildResult_UserValid(t *testing.T) {
-	cfg := &core.CliConfig{ProfileName: "my-app", AppID: "cli_x", Brand: brand.Lark, DefaultAs: core.AsAuto}
+	cfg := &core.CliConfig{ProfileName: "my-app", AppID: "cli_x", Brand: brand.Lark, DefaultAs: identity.AsAuto}
 	diag := identitydiag.Result{
 		User: identitydiag.Identity{Available: true, Status: "ready", TokenStatus: "valid", OpenID: "ou_x", UserName: "Alice"},
 	}
-	r := buildResult(cfg, core.AsUser, "auto_detect", diag)
+	r := buildResult(cfg, identity.AsUser, "auto_detect", diag)
 
 	if r.Identity != "user" || r.IdentitySource != "auto_detect" {
 		t.Fatalf("identity/source = %q/%q", r.Identity, r.IdentitySource)
@@ -78,7 +79,7 @@ func TestBuildResult_UserMissingToken(t *testing.T) {
 	diag := identitydiag.Result{
 		User: identitydiag.Identity{Available: false, Status: "missing", Hint: "run: lark-cli auth login --help"}, // never logged in
 	}
-	r := buildResult(cfg, core.AsUser, "auto_detect", diag)
+	r := buildResult(cfg, identity.AsUser, "auto_detect", diag)
 
 	if r.Available {
 		t.Fatalf("available = true, want false")
@@ -97,11 +98,11 @@ func TestBuildResult_UserMissingToken(t *testing.T) {
 }
 
 func TestBuildResult_BotReady(t *testing.T) {
-	cfg := &core.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: brand.Feishu, DefaultAs: core.AsBot}
+	cfg := &core.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: brand.Feishu, DefaultAs: identity.AsBot}
 	diag := identitydiag.Result{
 		Bot: identitydiag.Identity{Available: true, Status: "ready"},
 	}
-	r := buildResult(cfg, core.AsBot, "default_as", diag)
+	r := buildResult(cfg, identity.AsBot, "default_as", diag)
 
 	if r.Identity != "bot" || r.IdentitySource != "default_as" {
 		t.Fatalf("identity/source = %q/%q", r.Identity, r.IdentitySource)
@@ -122,7 +123,7 @@ func TestBuildResult_BotNotConfigured(t *testing.T) {
 	diag := identitydiag.Result{
 		Bot: identitydiag.Identity{Available: false, Status: "not_configured", Hint: "run: lark-cli config --help"},
 	}
-	r := buildResult(cfg, core.AsBot, "auto_detect", diag)
+	r := buildResult(cfg, identity.AsBot, "auto_detect", diag)
 
 	if r.Available {
 		t.Fatalf("available = true, want false")
diff --git a/internal/client/client.go b/internal/client/client.go
index 3ece6f8c47..2cac3a61c9 100644
--- a/internal/client/client.go
+++ b/internal/client/client.go
@@ -23,6 +23,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/errclass"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/util"
 )
@@ -33,7 +34,7 @@ type RawApiRequest struct {
 	URL       string
 	Params    map[string]interface{}
 	Data      interface{}
-	As        core.Identity
+	As        identitypkg.Identity
 	ExtraOpts []larkcore.RequestOptionFunc // additional SDK request options (e.g. security headers)
 }
 
@@ -46,7 +47,7 @@ type APIClient struct {
 	Credential *credential.CredentialProvider
 }
 
-func (c *APIClient) resolveAccessToken(ctx context.Context, as core.Identity) (string, error) {
+func (c *APIClient) resolveAccessToken(ctx context.Context, as identitypkg.Identity) (string, error) {
 	result, err := c.Credential.ResolveToken(ctx, credential.NewTokenSpec(as, c.Config.AppID))
 	if err != nil {
 		var unavailableErr *credential.TokenUnavailableError
@@ -68,10 +69,10 @@ func (c *APIClient) resolveAccessToken(ctx context.Context, as core.Identity) (s
 
 // newTokenMissingError builds the typed *errs.AuthenticationError that
 // resolveAccessToken returns when no usable token is available for the
-// requested identity. cause is the underlying credential-chain error (or nil
+// requested identitypkg. cause is the underlying credential-chain error (or nil
 // for the defensive empty-token branch) and is preserved for errors.Is /
 // errors.Unwrap traversal without being serialized on the wire.
-func newTokenMissingError(as core.Identity, cause error) error {
+func newTokenMissingError(as identitypkg.Identity, cause error) error {
 	return errs.NewAuthenticationError(errs.SubtypeTokenMissing,
 		"no access token available for %s", as).
 		WithHint("run: lark-cli auth login to re-authorize").
@@ -119,7 +120,7 @@ func (c *APIClient) buildApiReq(request RawApiRequest) (*larkcore.ApiReq, []lark
 // contract in errs/ERROR_CONTRACT.md. Errors that arrive already-classified
 // (a typed *errs.* from resolveAccessToken's missing-credential paths or
 // elsewhere) flow through unchanged.
-func (c *APIClient) DoSDKRequest(ctx context.Context, req *larkcore.ApiReq, as core.Identity, extraOpts ...larkcore.RequestOptionFunc) (*larkcore.ApiResp, error) {
+func (c *APIClient) DoSDKRequest(ctx context.Context, req *larkcore.ApiReq, as identitypkg.Identity, extraOpts ...larkcore.RequestOptionFunc) (*larkcore.ApiResp, error) {
 	var opts []larkcore.RequestOptionFunc
 
 	token, err := c.resolveAccessToken(ctx, as)
@@ -155,7 +156,7 @@ func (c *APIClient) DoSDKRequest(ctx context.Context, req *larkcore.ApiReq, as c
 // any extra headers from opts are applied automatically.
 // HTTP errors (status >= 400) are handled internally: the body is read (up to 4 KB),
 // closed, and returned as a typed *errs.NetworkError — callers only receive successful responses.
-func (c *APIClient) DoStream(ctx context.Context, req *larkcore.ApiReq, as core.Identity, opts ...Option) (*http.Response, error) {
+func (c *APIClient) DoStream(ctx context.Context, req *larkcore.ApiReq, as identitypkg.Identity, opts ...Option) (*http.Response, error) {
 	cfg := buildConfig(opts)
 
 	// Resolve auth
@@ -491,7 +492,7 @@ func (c *APIClient) StreamPages(ctx context.Context, request RawApiRequest, onIt
 // the canonical Category/Subtype + identity-aware extension fields (MissingScopes,
 // ConsoleURL, etc.) for known Lark codes; unknown codes still surface as
 // *errs.APIError{Subtype: unknown}.
-func (c *APIClient) CheckResponse(result interface{}, identity core.Identity) error {
+func (c *APIClient) CheckResponse(result interface{}, identity identitypkg.Identity) error {
 	resultMap, ok := result.(map[string]interface{})
 	if !ok || resultMap == nil {
 		return nil
diff --git a/internal/client/client_test.go b/internal/client/client_test.go
index 7765d66625..9e0ae3c9d3 100644
--- a/internal/client/client_test.go
+++ b/internal/client/client_test.go
@@ -24,6 +24,7 @@ import (
 	internalauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 )
 
@@ -471,7 +472,7 @@ func TestDoStream_IgnoresBaseHTTPClientTimeout(t *testing.T) {
 	resp, err := ac.DoStream(context.Background(), &larkcore.ApiReq{
 		HttpMethod: http.MethodGet,
 		ApiPath:    srv.URL,
-	}, core.AsBot)
+	}, identity.AsBot)
 	if err != nil {
 		t.Fatalf("DoStream() error = %v", err)
 	}
@@ -506,7 +507,7 @@ func TestDoStream_TransportFailureSplitsSubtype(t *testing.T) {
 	_, err := ac.DoStream(context.Background(), &larkcore.ApiReq{
 		HttpMethod: http.MethodGet,
 		ApiPath:    "/open-apis/drive/v1/files/file_token/download",
-	}, core.AsBot)
+	}, identity.AsBot)
 	if err == nil {
 		t.Fatal("expected DNS error from DoStream transport, got nil")
 	}
@@ -537,7 +538,7 @@ func TestResolveAccessToken_NoToken_ReturnsTypedAuthenticationError(t *testing.T
 		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 	}
 
-	_, err := ac.resolveAccessToken(context.Background(), core.AsUser)
+	_, err := ac.resolveAccessToken(context.Background(), identity.AsUser)
 	if err == nil {
 		t.Fatal("expected error when no token available, got nil")
 	}
@@ -577,7 +578,7 @@ func TestResolveAccessToken_NeedAuthorization_SurfacesAsTypedAuthentication(t *t
 		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 	}
 
-	_, err := ac.resolveAccessToken(context.Background(), core.AsUser)
+	_, err := ac.resolveAccessToken(context.Background(), identity.AsUser)
 	if err == nil {
 		t.Fatal("expected error when credential chain signals need_user_authorization, got nil")
 	}
@@ -620,7 +621,7 @@ func TestDoSDKRequest_AuthFailureSurfacesTypedAuthenticationError(t *testing.T)
 	_, err := ac.DoSDKRequest(context.Background(), &larkcore.ApiReq{
 		HttpMethod: http.MethodGet,
 		ApiPath:    "/open-apis/contact/v3/users/me",
-	}, core.AsUser)
+	}, identity.AsUser)
 
 	if err == nil {
 		t.Fatal("expected auth error, got nil")
@@ -648,7 +649,7 @@ func TestDoSDKRequest_TransportFailureWrapsAsNetwork(t *testing.T) {
 	_, err := ac.DoSDKRequest(context.Background(), &larkcore.ApiReq{
 		HttpMethod: http.MethodGet,
 		ApiPath:    "/open-apis/contact/v3/users/me",
-	}, core.AsBot)
+	}, identity.AsBot)
 
 	if err == nil {
 		t.Fatal("expected error from broken transport, got nil")
diff --git a/internal/client/dostream_test.go b/internal/client/dostream_test.go
index e0422000b8..5048de9bc1 100644
--- a/internal/client/dostream_test.go
+++ b/internal/client/dostream_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 func TestDoStream_HTTPErrorIncludesLogID(t *testing.T) {
@@ -41,7 +42,7 @@ func TestDoStream_HTTPErrorIncludesLogID(t *testing.T) {
 	_, err = client.DoStream(context.Background(), &larkcore.ApiReq{
 		HttpMethod: http.MethodGet,
 		ApiPath:    "/open-apis/drive/v1/medias/file_token/download",
-	}, core.AsBot)
+	}, identity.AsBot)
 	var netErr *errs.NetworkError
 	if !errors.As(err, &netErr) {
 		t.Fatalf("expected *errs.NetworkError, got %T %v", err, err)
diff --git a/internal/client/pagination.go b/internal/client/pagination.go
index 91dc067ed5..8d79170f6e 100644
--- a/internal/client/pagination.go
+++ b/internal/client/pagination.go
@@ -7,15 +7,15 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 )
 
 // PaginationOptions contains pagination control options.
 type PaginationOptions struct {
-	PageLimit int           // max pages to fetch; 0 = unlimited (default: 10)
-	PageDelay int           // ms, default 200
-	Identity  core.Identity // identity passed to checkErr; defaults to AsUser when empty
+	PageLimit int               // max pages to fetch; 0 = unlimited (default: 10)
+	PageDelay int               // ms, default 200
+	Identity  identity.Identity // identity passed to checkErr; defaults to AsUser when empty
 }
 
 func mergePagedResults(w io.Writer, results []interface{}) interface{} {
diff --git a/internal/client/response.go b/internal/client/response.go
index 36ddc1ca38..df7b86dbb9 100644
--- a/internal/client/response.go
+++ b/internal/client/response.go
@@ -16,7 +16,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/core"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/util"
 )
@@ -34,11 +34,11 @@ type ResponseOptions struct {
 	CommandPath string        // raw cobra CommandPath() for content safety scanning
 	// Identity is forwarded to CheckError (default or caller-supplied) so the
 	// classifier can populate identity-aware fields (e.g. PermissionError.Identity).
-	// Defaults to core.AsUser when empty.
-	Identity core.Identity
+	// Defaults to identitypkg.AsUser when empty.
+	Identity identitypkg.Identity
 	// CheckError is called on parsed JSON results. Nil defaults to (*APIClient).CheckResponse
 	// with the Identity field (or AsUser when unset).
-	CheckError func(result interface{}, identity core.Identity) error
+	CheckError func(result interface{}, identity identitypkg.Identity) error
 }
 
 // httpStatusError classifies an HTTP error response by status when the body
@@ -69,7 +69,7 @@ func HandleResponse(resp *larkcore.ApiResp, opts ResponseOptions) error {
 	ct := resp.Header.Get("Content-Type")
 	identity := opts.Identity
 	if identity == "" {
-		identity = core.AsUser
+		identity = identitypkg.AsUser
 	}
 	check := opts.CheckError
 	if check == nil {
@@ -77,7 +77,7 @@ func HandleResponse(resp *larkcore.ApiResp, opts ResponseOptions) error {
 		// *errs.PermissionError / AuthenticationError / etc. A zero-value
 		// *APIClient is safe here because BuildAPIError gracefully degrades
 		// identity-aware fields (ConsoleURL etc.) when AppID is empty.
-		check = func(r interface{}, id core.Identity) error {
+		check = func(r interface{}, id identitypkg.Identity) error {
 			return (&APIClient{}).CheckResponse(r, id)
 		}
 	}
diff --git a/internal/client/response_test.go b/internal/client/response_test.go
index 28ae282659..f8f3a57906 100644
--- a/internal/client/response_test.go
+++ b/internal/client/response_test.go
@@ -17,8 +17,8 @@ import (
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/vfs/localfileio"
 )
@@ -210,7 +210,7 @@ func TestHandleResponse_JSON(t *testing.T) {
 	var out bytes.Buffer
 	var errOut bytes.Buffer
 	err := HandleResponse(resp, ResponseOptions{
-		Identity: core.AsBot,
+		Identity: identity.AsBot,
 		Out:      &out,
 		ErrOut:   &errOut,
 		FileIO:   &localfileio.LocalFileIO{},
@@ -302,7 +302,7 @@ func TestHandleResponse_NonJSONFormatsEmitExactStructuredResponseBytes(t *testin
 			var errOut bytes.Buffer
 			err = HandleResponse(resp, ResponseOptions{
 				Format:      tt.format,
-				Identity:    core.AsBot,
+				Identity:    identity.AsBot,
 				Out:         &out,
 				ErrOut:      &errOut,
 				CommandPath: "lark-cli api GET",
@@ -328,7 +328,7 @@ func TestHandleResponse_JSONWithJqUsesSuccessEnvelope(t *testing.T) {
 	var out bytes.Buffer
 	var errOut bytes.Buffer
 	err := HandleResponse(resp, ResponseOptions{
-		Identity: core.AsBot,
+		Identity: identity.AsBot,
 		JqExpr:   ".data.id",
 		Out:      &out,
 		ErrOut:   &errOut,
diff --git a/internal/cmdutil/dryrun.go b/internal/cmdutil/dryrun.go
index 4afa6f75f5..ad431f2ed0 100644
--- a/internal/cmdutil/dryrun.go
+++ b/internal/cmdutil/dryrun.go
@@ -15,6 +15,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/util"
 )
@@ -26,7 +27,7 @@ type DryRunOutputOptions struct {
 	Format      string
 	JqExpr      string
 	CommandPath string
-	Identity    core.Identity
+	Identity    identity.Identity
 	Out         io.Writer
 	ErrOut      io.Writer
 }
diff --git a/internal/cmdutil/dryrun_test.go b/internal/cmdutil/dryrun_test.go
index 6056bce188..7f28bfe702 100644
--- a/internal/cmdutil/dryrun_test.go
+++ b/internal/cmdutil/dryrun_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 func TestDryRunAPI_SingleGET(t *testing.T) {
@@ -154,7 +155,7 @@ func TestPrintDryRun_JSON(t *testing.T) {
 	}, &core.CliConfig{AppID: "app123"}, DryRunOutputOptions{
 		Format:      "json",
 		CommandPath: "lark-cli api",
-		Identity:    core.AsUser,
+		Identity:    identity.AsUser,
 		Out:         &buf,
 		ErrOut:      &errBuf,
 	})
@@ -203,7 +204,7 @@ func TestPrintDryRun_Pretty(t *testing.T) {
 		As:     "bot",
 	}, &core.CliConfig{AppID: "app456"}, DryRunOutputOptions{
 		Format:   "pretty",
-		Identity: core.AsBot,
+		Identity: identity.AsBot,
 		Out:      &buf,
 		ErrOut:   &errBuf,
 	})
@@ -234,7 +235,7 @@ func TestPrintDryRun_WithJqUsesEnvelope(t *testing.T) {
 	}, &core.CliConfig{AppID: "app123"}, DryRunOutputOptions{
 		Format:   "json",
 		JqExpr:   ".data.api[0].url",
-		Identity: core.AsBot,
+		Identity: identity.AsBot,
 		Out:      &buf,
 		ErrOut:   io.Discard,
 	})
@@ -254,7 +255,7 @@ func TestPrintDryRunWithFile_JSONEnvelope(t *testing.T) {
 		As:     "bot",
 	}, &core.CliConfig{AppID: "app123", UserOpenId: "ou_tester"}, DryRunOutputOptions{
 		Format:   "json",
-		Identity: core.AsBot,
+		Identity: identity.AsBot,
 		Out:      &buf,
 		ErrOut:   io.Discard,
 	}, FileUploadMeta{FieldName: "file", FilePath: "report.txt", FormFields: map[string]any{"parent": "fld"}})
@@ -295,7 +296,7 @@ func TestPrintDryRun_MethodTranscribedVerbatim(t *testing.T) {
 		As:     "bot",
 	}, &core.CliConfig{AppID: "app123"}, DryRunOutputOptions{
 		Format:   "json",
-		Identity: core.AsBot,
+		Identity: identity.AsBot,
 		Out:      &buf,
 		ErrOut:   io.Discard,
 	})
diff --git a/internal/cmdutil/factory.go b/internal/cmdutil/factory.go
index 1b167b7863..0820ced3d8 100644
--- a/internal/cmdutil/factory.go
+++ b/internal/cmdutil/factory.go
@@ -19,6 +19,7 @@ import (
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/keychain"
 )
 
@@ -38,7 +39,7 @@ type Factory struct {
 	Invocation           InvocationContext       // Immutable call context; do not mutate after Factory construction.
 	Keychain             keychain.KeychainAccess // secret storage (real keychain in prod, mock in tests)
 	IdentityAutoDetected bool                    // set by ResolveAs when identity was auto-detected
-	ResolvedIdentity     core.Identity           // identity resolved by the last ResolveAs call
+	ResolvedIdentity     identity.Identity       // identity resolved by the last ResolveAs call
 	CurrentCommand       *cobra.Command          // last matched command being executed; set during PersistentPreRun
 
 	Credential *credential.CredentialProvider
@@ -60,11 +61,11 @@ func (f *Factory) ResolveFileIO(ctx context.Context) fileio.FileIO {
 // ResolveAs returns the effective identity type.
 // If the user explicitly passed --as, use that value; otherwise use the configured default.
 // When the value is "auto" (or unset), auto-detect based on credential hints.
-func (f *Factory) ResolveAs(ctx context.Context, cmd *cobra.Command, flagAs core.Identity) core.Identity {
+func (f *Factory) ResolveAs(ctx context.Context, cmd *cobra.Command, flagAs identity.Identity) identity.Identity {
 	f.IdentityAutoDetected = false
 
 	if cmd != nil && cmd.Flags().Changed("as") {
-		if flagAs != core.AsAuto {
+		if flagAs != identity.AsAuto {
 			f.ResolvedIdentity = flagAs
 			return flagAs
 		}
@@ -81,7 +82,7 @@ func (f *Factory) ResolveAs(ctx context.Context, cmd *cobra.Command, flagAs core
 
 	hint := f.resolveIdentityHint(ctx)
 	if cmd == nil || !cmd.Flags().Changed("as") {
-		if defaultAs := resolveDefaultAsFromHint(hint); defaultAs != "" && defaultAs != core.AsAuto {
+		if defaultAs := resolveDefaultAsFromHint(hint); defaultAs != "" && defaultAs != identity.AsAuto {
 			f.ResolvedIdentity = defaultAs
 			return f.ResolvedIdentity
 		}
@@ -94,18 +95,18 @@ func (f *Factory) ResolveAs(ctx context.Context, cmd *cobra.Command, flagAs core
 	return result
 }
 
-func resolveDefaultAsFromHint(hint *credential.IdentityHint) core.Identity {
+func resolveDefaultAsFromHint(hint *credential.IdentityHint) identity.Identity {
 	if hint != nil {
 		return hint.DefaultAs
 	}
 	return ""
 }
 
-func autoDetectIdentityFromHint(hint *credential.IdentityHint) core.Identity {
+func autoDetectIdentityFromHint(hint *credential.IdentityHint) identity.Identity {
 	if hint != nil && hint.AutoAs != "" {
 		return hint.AutoAs
 	}
-	return core.AsBot
+	return identity.AsBot
 }
 
 func (f *Factory) resolveIdentityHint(ctx context.Context) *credential.IdentityHint {
@@ -122,7 +123,7 @@ func (f *Factory) resolveIdentityHint(ctx context.Context) *credential.IdentityH
 // CheckIdentity verifies the resolved identity is in the supported list.
 // On success, sets f.ResolvedIdentity. On failure, returns an error
 // tailored to whether the identity was explicit (--as) or auto-detected.
-func (f *Factory) CheckIdentity(as core.Identity, supported []string) error {
+func (f *Factory) CheckIdentity(as identity.Identity, supported []string) error {
 	for _, t := range supported {
 		if string(as) == t {
 			f.ResolvedIdentity = as
@@ -147,27 +148,27 @@ func (f *Factory) CheckIdentity(as core.Identity, supported []string) error {
 
 // ResolveStrictMode returns the effective strict mode by reading
 // Account.SupportedIdentities from the credential provider chain.
-func (f *Factory) ResolveStrictMode(ctx context.Context) core.StrictMode {
+func (f *Factory) ResolveStrictMode(ctx context.Context) identity.StrictMode {
 	if f.Credential == nil {
-		return core.StrictModeOff
+		return identity.StrictModeOff
 	}
 	acct, err := f.Credential.ResolveAccount(ctx)
 	if err != nil || acct == nil {
-		return core.StrictModeOff
+		return identity.StrictModeOff
 	}
 	ids := extcred.IdentitySupport(acct.SupportedIdentities)
 	switch {
 	case ids.BotOnly():
-		return core.StrictModeBot
+		return identity.StrictModeBot
 	case ids.UserOnly():
-		return core.StrictModeUser
+		return identity.StrictModeUser
 	default:
-		return core.StrictModeOff
+		return identity.StrictModeOff
 	}
 }
 
 // CheckStrictMode returns an error if strict mode is active and identity is not allowed.
-func (f *Factory) CheckStrictMode(ctx context.Context, as core.Identity) error {
+func (f *Factory) CheckStrictMode(ctx context.Context, as identity.Identity) error {
 	mode := f.ResolveStrictMode(ctx)
 	if mode.IsActive() && !mode.AllowsIdentity(as) {
 		return errs.NewValidationError(errs.SubtypeInvalidArgument,
diff --git a/internal/cmdutil/factory_default_test.go b/internal/cmdutil/factory_default_test.go
index 9999eb1499..e63184eb7e 100644
--- a/internal/cmdutil/factory_default_test.go
+++ b/internal/cmdutil/factory_default_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/secret"
 	"github.com/larksuite/cli/internal/vfs/localfileio"
 )
@@ -39,7 +40,7 @@ func TestNewDefault_InvocationProfileUsedByStrictModeAndConfig(t *testing.T) {
 	dir := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
 
-	bot := core.StrictModeBot
+	bot := identity.StrictModeBot
 	multi := &core.MultiAppConfig{
 		CurrentApp: "default",
 		Apps: []core.AppConfig{
@@ -63,8 +64,8 @@ func TestNewDefault_InvocationProfileUsedByStrictModeAndConfig(t *testing.T) {
 	}
 
 	f := NewDefault(nil, InvocationContext{Profile: "target"})
-	if got := f.ResolveStrictMode(context.Background()); got != core.StrictModeBot {
-		t.Fatalf("ResolveStrictMode() = %q, want %q", got, core.StrictModeBot)
+	if got := f.ResolveStrictMode(context.Background()); got != identity.StrictModeBot {
+		t.Fatalf("ResolveStrictMode() = %q, want %q", got, identity.StrictModeBot)
 	}
 	cfg, err := f.Config()
 	if err != nil {
@@ -103,8 +104,8 @@ func TestNewDefault_InvocationProfileMissingSticksAcrossEarlyStrictMode(t *testi
 	}
 
 	f := NewDefault(nil, InvocationContext{Profile: "missing"})
-	if got := f.ResolveStrictMode(context.Background()); got != core.StrictModeOff {
-		t.Fatalf("ResolveStrictMode() = %q, want %q", got, core.StrictModeOff)
+	if got := f.ResolveStrictMode(context.Background()); got != identity.StrictModeOff {
+		t.Fatalf("ResolveStrictMode() = %q, want %q", got, identity.StrictModeOff)
 	}
 	_, err := f.Config()
 	if err == nil {
@@ -131,8 +132,8 @@ func TestNewDefault_ResolveAs_UsesDefaultAsFromEnvAccount(t *testing.T) {
 	cmd := newCmdWithAsFlag("auto", false)
 
 	got := f.ResolveAs(context.Background(), cmd, "auto")
-	if got != core.AsUser {
-		t.Fatalf("ResolveAs() = %q, want %q", got, core.AsUser)
+	if got != identity.AsUser {
+		t.Fatalf("ResolveAs() = %q, want %q", got, identity.AsUser)
 	}
 	if f.IdentityAutoDetected {
 		t.Fatal("IdentityAutoDetected = true, want false")
diff --git a/internal/cmdutil/factory_test.go b/internal/cmdutil/factory_test.go
index d6300872e8..2011fe72b4 100644
--- a/internal/cmdutil/factory_test.go
+++ b/internal/cmdutil/factory_test.go
@@ -17,6 +17,7 @@ import (
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 )
 
@@ -36,14 +37,14 @@ func TestResolveAs_ExplicitAs(t *testing.T) {
 	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
 	cmd := newCmdWithAsFlag("bot", true)
 
-	got := f.ResolveAs(context.Background(), cmd, core.AsBot)
-	if got != core.AsBot {
+	got := f.ResolveAs(context.Background(), cmd, identity.AsBot)
+	if got != identity.AsBot {
 		t.Errorf("want bot, got %s", got)
 	}
 	if f.IdentityAutoDetected {
 		t.Error("IdentityAutoDetected should be false for explicit --as")
 	}
-	if f.ResolvedIdentity != core.AsBot {
+	if f.ResolvedIdentity != identity.AsBot {
 		t.Errorf("ResolvedIdentity want bot, got %s", f.ResolvedIdentity)
 	}
 }
@@ -52,11 +53,11 @@ func TestResolveAs_ExplicitAsUser(t *testing.T) {
 	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
 	cmd := newCmdWithAsFlag("user", true)
 
-	got := f.ResolveAs(context.Background(), cmd, core.AsUser)
-	if got != core.AsUser {
+	got := f.ResolveAs(context.Background(), cmd, identity.AsUser)
+	if got != identity.AsUser {
 		t.Errorf("want user, got %s", got)
 	}
-	if f.ResolvedIdentity != core.AsUser {
+	if f.ResolvedIdentity != identity.AsUser {
 		t.Errorf("ResolvedIdentity want user, got %s", f.ResolvedIdentity)
 	}
 }
@@ -68,7 +69,7 @@ func TestResolveAs_ExplicitAuto_FallsToAutoDetect(t *testing.T) {
 	cmd := newCmdWithAsFlag("auto", true)
 
 	got := f.ResolveAs(context.Background(), cmd, "auto")
-	if got != core.AsBot {
+	if got != identity.AsBot {
 		t.Errorf("want bot (auto-detect, no login), got %s", got)
 	}
 	if !f.IdentityAutoDetected {
@@ -84,7 +85,7 @@ func TestResolveAs_DefaultAs_FromConfig(t *testing.T) {
 	cmd := newCmdWithAsFlag("auto", false) // --as not changed
 
 	got := f.ResolveAs(context.Background(), cmd, "auto")
-	if got != core.AsBot {
+	if got != identity.AsBot {
 		t.Errorf("want bot (from default-as config), got %s", got)
 	}
 	if f.IdentityAutoDetected {
@@ -99,7 +100,7 @@ func TestResolveAs_DefaultAs_EnvDoesNotBypassConfigSource(t *testing.T) {
 	cmd := newCmdWithAsFlag("auto", false)
 
 	got := f.ResolveAs(context.Background(), cmd, "auto")
-	if got != core.AsBot {
+	if got != identity.AsBot {
 		t.Errorf("want bot (env default-as should not bypass config source), got %s", got)
 	}
 	if !f.IdentityAutoDetected {
@@ -117,7 +118,7 @@ func TestResolveAs_DefaultAs_AutoValue_FallsToAutoDetect(t *testing.T) {
 
 	got := f.ResolveAs(context.Background(), cmd, "auto")
 	// No UserOpenId → auto-detect returns bot
-	if got != core.AsBot {
+	if got != identity.AsBot {
 		t.Errorf("want bot (auto-detect), got %s", got)
 	}
 	if !f.IdentityAutoDetected {
@@ -129,7 +130,7 @@ func TestResolveAs_NilCmd_AutoDetect(t *testing.T) {
 	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
 
 	got := f.ResolveAs(context.Background(), nil, "auto")
-	if got != core.AsBot {
+	if got != identity.AsBot {
 		t.Errorf("want bot, got %s", got)
 	}
 }
@@ -139,11 +140,11 @@ func TestResolveAs_NilCmd_AutoDetect(t *testing.T) {
 func TestCheckIdentity_Supported(t *testing.T) {
 	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
 
-	err := f.CheckIdentity(core.AsBot, []string{"bot", "user"})
+	err := f.CheckIdentity(identity.AsBot, []string{"bot", "user"})
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if f.ResolvedIdentity != core.AsBot {
+	if f.ResolvedIdentity != identity.AsBot {
 		t.Errorf("ResolvedIdentity want bot, got %s", f.ResolvedIdentity)
 	}
 }
@@ -151,11 +152,11 @@ func TestCheckIdentity_Supported(t *testing.T) {
 func TestCheckIdentity_Supported_UserOnly(t *testing.T) {
 	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
 
-	err := f.CheckIdentity(core.AsUser, []string{"user"})
+	err := f.CheckIdentity(identity.AsUser, []string{"user"})
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if f.ResolvedIdentity != core.AsUser {
+	if f.ResolvedIdentity != identity.AsUser {
 		t.Errorf("ResolvedIdentity want user, got %s", f.ResolvedIdentity)
 	}
 }
@@ -164,7 +165,7 @@ func TestCheckIdentity_Unsupported_Explicit(t *testing.T) {
 	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
 	f.IdentityAutoDetected = false // explicit --as
 
-	err := f.CheckIdentity(core.AsUser, []string{"bot"})
+	err := f.CheckIdentity(identity.AsUser, []string{"bot"})
 	if err == nil {
 		t.Fatal("expected error")
 	}
@@ -180,7 +181,7 @@ func TestCheckIdentity_Unsupported_AutoDetected(t *testing.T) {
 	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
 	f.IdentityAutoDetected = true
 
-	err := f.CheckIdentity(core.AsUser, []string{"bot"})
+	err := f.CheckIdentity(identity.AsUser, []string{"bot"})
 	var ve *errs.ValidationError
 	if !errors.As(err, &ve) {
 		t.Fatalf("expected *errs.ValidationError, got %T: %v", err, err)
@@ -245,7 +246,7 @@ func TestNewAPIClientWithConfig_NilIOStreams(t *testing.T) {
 
 func TestResolveStrictMode_Off(t *testing.T) {
 	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
-	if got := f.ResolveStrictMode(context.Background()); got != core.StrictModeOff {
+	if got := f.ResolveStrictMode(context.Background()); got != identity.StrictModeOff {
 		t.Errorf("expected off, got %q", got)
 	}
 }
@@ -253,7 +254,7 @@ func TestResolveStrictMode_Off(t *testing.T) {
 func TestResolveStrictMode_BotFromAccount(t *testing.T) {
 	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2} // SupportsBot = 2
 	f, _, _, _ := TestFactory(t, cfg)
-	if got := f.ResolveStrictMode(context.Background()); got != core.StrictModeBot {
+	if got := f.ResolveStrictMode(context.Background()); got != identity.StrictModeBot {
 		t.Errorf("expected bot, got %q", got)
 	}
 }
@@ -261,7 +262,7 @@ func TestResolveStrictMode_BotFromAccount(t *testing.T) {
 func TestResolveStrictMode_UserFromAccount(t *testing.T) {
 	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1} // SupportsUser = 1
 	f, _, _, _ := TestFactory(t, cfg)
-	if got := f.ResolveStrictMode(context.Background()); got != core.StrictModeUser {
+	if got := f.ResolveStrictMode(context.Background()); got != identity.StrictModeUser {
 		t.Errorf("expected user, got %q", got)
 	}
 }
@@ -269,7 +270,7 @@ func TestResolveStrictMode_UserFromAccount(t *testing.T) {
 func TestResolveStrictMode_BothIdentities(t *testing.T) {
 	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 3} // SupportsAll = 3
 	f, _, _, _ := TestFactory(t, cfg)
-	if got := f.ResolveStrictMode(context.Background()); got != core.StrictModeOff {
+	if got := f.ResolveStrictMode(context.Background()); got != identity.StrictModeOff {
 		t.Errorf("expected off when both supported, got %q", got)
 	}
 }
@@ -277,7 +278,7 @@ func TestResolveStrictMode_BothIdentities(t *testing.T) {
 func TestResolveStrictMode_NilCredential(t *testing.T) {
 	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
 	f.Credential = nil
-	if got := f.ResolveStrictMode(context.Background()); got != core.StrictModeOff {
+	if got := f.ResolveStrictMode(context.Background()); got != identity.StrictModeOff {
 		t.Errorf("expected off with nil credential, got %q", got)
 	}
 }
@@ -287,7 +288,7 @@ func TestResolveStrictMode_NilCredential(t *testing.T) {
 func TestCheckStrictMode_BotMode_BotAllowed(t *testing.T) {
 	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2}
 	f, _, _, _ := TestFactory(t, cfg)
-	if err := f.CheckStrictMode(context.Background(), core.AsBot); err != nil {
+	if err := f.CheckStrictMode(context.Background(), identity.AsBot); err != nil {
 		t.Errorf("bot should be allowed in bot mode, got: %v", err)
 	}
 }
@@ -295,7 +296,7 @@ func TestCheckStrictMode_BotMode_BotAllowed(t *testing.T) {
 func TestCheckStrictMode_BotMode_UserBlocked(t *testing.T) {
 	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2}
 	f, _, _, _ := TestFactory(t, cfg)
-	err := f.CheckStrictMode(context.Background(), core.AsUser)
+	err := f.CheckStrictMode(context.Background(), identity.AsUser)
 	if err == nil {
 		t.Fatal("expected error for user in bot mode")
 	}
@@ -307,7 +308,7 @@ func TestCheckStrictMode_BotMode_UserBlocked(t *testing.T) {
 func TestCheckStrictMode_UserMode_UserAllowed(t *testing.T) {
 	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
 	f, _, _, _ := TestFactory(t, cfg)
-	if err := f.CheckStrictMode(context.Background(), core.AsUser); err != nil {
+	if err := f.CheckStrictMode(context.Background(), identity.AsUser); err != nil {
 		t.Errorf("user should be allowed in user mode, got: %v", err)
 	}
 }
@@ -315,7 +316,7 @@ func TestCheckStrictMode_UserMode_UserAllowed(t *testing.T) {
 func TestCheckStrictMode_UserMode_BotBlocked(t *testing.T) {
 	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
 	f, _, _, _ := TestFactory(t, cfg)
-	err := f.CheckStrictMode(context.Background(), core.AsBot)
+	err := f.CheckStrictMode(context.Background(), identity.AsBot)
 	if err == nil {
 		t.Fatal("expected error for bot in user mode")
 	}
@@ -323,10 +324,10 @@ func TestCheckStrictMode_UserMode_BotBlocked(t *testing.T) {
 
 func TestCheckStrictMode_Off_BothAllowed(t *testing.T) {
 	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
-	if err := f.CheckStrictMode(context.Background(), core.AsUser); err != nil {
+	if err := f.CheckStrictMode(context.Background(), identity.AsUser); err != nil {
 		t.Errorf("user should be allowed when off: %v", err)
 	}
-	if err := f.CheckStrictMode(context.Background(), core.AsBot); err != nil {
+	if err := f.CheckStrictMode(context.Background(), identity.AsBot); err != nil {
 		t.Errorf("bot should be allowed when off: %v", err)
 	}
 }
@@ -338,7 +339,7 @@ func TestResolveAs_StrictModeBot_ForceBot(t *testing.T) {
 	f, _, _, _ := TestFactory(t, cfg)
 	cmd := newCmdWithAsFlag("auto", false)
 	got := f.ResolveAs(context.Background(), cmd, "auto")
-	if got != core.AsBot {
+	if got != identity.AsBot {
 		t.Errorf("bot mode should force bot, got %s", got)
 	}
 }
@@ -348,7 +349,7 @@ func TestResolveAs_StrictModeUser_ForceUser(t *testing.T) {
 	f, _, _, _ := TestFactory(t, cfg)
 	cmd := newCmdWithAsFlag("auto", false)
 	got := f.ResolveAs(context.Background(), cmd, "auto")
-	if got != core.AsUser {
+	if got != identity.AsUser {
 		t.Errorf("user mode should force user, got %s", got)
 	}
 }
@@ -357,8 +358,8 @@ func TestResolveAs_StrictModeUser_PreservesExplicitBot(t *testing.T) {
 	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
 	f, _, _, _ := TestFactory(t, cfg)
 	cmd := newCmdWithAsFlag("bot", true)
-	got := f.ResolveAs(context.Background(), cmd, core.AsBot)
-	if got != core.AsBot {
+	got := f.ResolveAs(context.Background(), cmd, identity.AsBot)
+	if got != identity.AsBot {
 		t.Errorf("explicit bot should be preserved for strict-mode validation, got %s", got)
 	}
 	if err := f.CheckStrictMode(context.Background(), got); err == nil {
@@ -370,8 +371,8 @@ func TestResolveAs_StrictModeBot_PreservesExplicitUser(t *testing.T) {
 	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2}
 	f, _, _, _ := TestFactory(t, cfg)
 	cmd := newCmdWithAsFlag("user", true)
-	got := f.ResolveAs(context.Background(), cmd, core.AsUser)
-	if got != core.AsUser {
+	got := f.ResolveAs(context.Background(), cmd, identity.AsUser)
+	if got != identity.AsUser {
 		t.Errorf("explicit user should be preserved for strict-mode validation, got %s", got)
 	}
 	if err := f.CheckStrictMode(context.Background(), got); err == nil {
@@ -383,8 +384,8 @@ func TestResolveAs_StrictModeUser_ExplicitAutoForcesUser(t *testing.T) {
 	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
 	f, _, _, _ := TestFactory(t, cfg)
 	cmd := newCmdWithAsFlag("auto", true)
-	got := f.ResolveAs(context.Background(), cmd, core.AsAuto)
-	if got != core.AsUser {
+	got := f.ResolveAs(context.Background(), cmd, identity.AsAuto)
+	if got != identity.AsUser {
 		t.Errorf("--as auto should use strict-mode user identity, got %s", got)
 	}
 }
@@ -394,7 +395,7 @@ func TestResolveAs_StrictModeBot_IgnoresDefaultAsUser(t *testing.T) {
 	f, _, _, _ := TestFactory(t, cfg)
 	cmd := newCmdWithAsFlag("auto", false)
 	got := f.ResolveAs(context.Background(), cmd, "auto")
-	if got != core.AsBot {
+	if got != identity.AsBot {
 		t.Errorf("bot mode should override default-as user, got %s", got)
 	}
 }
diff --git a/internal/cmdutil/identity.go b/internal/cmdutil/identity.go
index 897cac5bdc..91e0dc77a2 100644
--- a/internal/cmdutil/identity.go
+++ b/internal/cmdutil/identity.go
@@ -8,11 +8,12 @@ import (
 	"io"
 
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 // PrintIdentity outputs the current identity to stderr so callers (including AI agents)
 // can see which identity is being used for the API call.
-func PrintIdentity(w io.Writer, as core.Identity, config *core.CliConfig, autoDetected bool) {
+func PrintIdentity(w io.Writer, as identity.Identity, config *core.CliConfig, autoDetected bool) {
 	if as.IsBot() {
 		if autoDetected {
 			fmt.Fprintln(w, "[identity: bot (auto — not logged in; `auth login` for user identity)]")
diff --git a/internal/cmdutil/identity_test.go b/internal/cmdutil/identity_test.go
index bb6e4aee62..a6a1789278 100644
--- a/internal/cmdutil/identity_test.go
+++ b/internal/cmdutil/identity_test.go
@@ -9,11 +9,12 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 func TestPrintIdentity_BotExplicit(t *testing.T) {
 	var buf bytes.Buffer
-	PrintIdentity(&buf, core.AsBot, nil, false)
+	PrintIdentity(&buf, identity.AsBot, nil, false)
 	if !strings.Contains(buf.String(), "[identity: bot]") {
 		t.Errorf("unexpected output: %s", buf.String())
 	}
@@ -21,7 +22,7 @@ func TestPrintIdentity_BotExplicit(t *testing.T) {
 
 func TestPrintIdentity_BotAutoDetected(t *testing.T) {
 	var buf bytes.Buffer
-	PrintIdentity(&buf, core.AsBot, nil, true)
+	PrintIdentity(&buf, identity.AsBot, nil, true)
 	if !strings.Contains(buf.String(), "auto") {
 		t.Errorf("expected auto hint, got: %s", buf.String())
 	}
@@ -30,7 +31,7 @@ func TestPrintIdentity_BotAutoDetected(t *testing.T) {
 func TestPrintIdentity_UserWithOpenId(t *testing.T) {
 	var buf bytes.Buffer
 	cfg := &core.CliConfig{UserOpenId: "ou_abc123"}
-	PrintIdentity(&buf, core.AsUser, cfg, false)
+	PrintIdentity(&buf, identity.AsUser, cfg, false)
 	if !strings.Contains(buf.String(), "ou_abc123") {
 		t.Errorf("expected UserOpenId in output, got: %s", buf.String())
 	}
@@ -38,7 +39,7 @@ func TestPrintIdentity_UserWithOpenId(t *testing.T) {
 
 func TestPrintIdentity_UserWithoutOpenId(t *testing.T) {
 	var buf bytes.Buffer
-	PrintIdentity(&buf, core.AsUser, &core.CliConfig{}, false)
+	PrintIdentity(&buf, identity.AsUser, &core.CliConfig{}, false)
 	if !strings.Contains(buf.String(), "[identity: user]") {
 		t.Errorf("unexpected output: %s", buf.String())
 	}
@@ -46,7 +47,7 @@ func TestPrintIdentity_UserWithoutOpenId(t *testing.T) {
 
 func TestPrintIdentity_UserNilConfig(t *testing.T) {
 	var buf bytes.Buffer
-	PrintIdentity(&buf, core.AsUser, nil, false)
+	PrintIdentity(&buf, identity.AsUser, nil, false)
 	if !strings.Contains(buf.String(), "[identity: user]") {
 		t.Errorf("unexpected output: %s", buf.String())
 	}
diff --git a/internal/core/config.go b/internal/core/config.go
index d2af252280..6c50b29405 100644
--- a/internal/core/config.go
+++ b/internal/core/config.go
@@ -13,6 +13,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/i18n"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/secret"
 	"github.com/larksuite/cli/internal/validate"
@@ -20,18 +21,6 @@ import (
 	"github.com/larksuite/cli/internal/workspace"
 )
 
-// Identity represents the caller identity for API requests.
-type Identity string
-
-const (
-	AsUser Identity = "user"
-	AsBot  Identity = "bot"
-	AsAuto Identity = "auto"
-)
-
-// IsBot returns true if the identity is bot.
-func (id Identity) IsBot() bool { return id == AsBot }
-
 // AppUser is a logged-in user record stored in config.
 type AppUser struct {
 	UserOpenId string `json:"userOpenId"`
@@ -40,14 +29,14 @@ type AppUser struct {
 
 // AppConfig is a per-app configuration entry (stored format — secrets may be unresolved).
 type AppConfig struct {
-	Name       string             `json:"name,omitempty"`
-	AppId      string             `json:"appId"`
-	AppSecret  secret.SecretInput `json:"appSecret"`
-	Brand      brand.Brand        `json:"brand"`
-	Lang       i18n.Lang          `json:"lang,omitempty"`
-	DefaultAs  Identity           `json:"defaultAs,omitempty"` // AsUser | AsBot | AsAuto
-	StrictMode *StrictMode        `json:"strictMode,omitempty"`
-	Users      []AppUser          `json:"users"`
+	Name       string               `json:"name,omitempty"`
+	AppId      string               `json:"appId"`
+	AppSecret  secret.SecretInput   `json:"appSecret"`
+	Brand      brand.Brand          `json:"brand"`
+	Lang       i18n.Lang            `json:"lang,omitempty"`
+	DefaultAs  identity.Identity    `json:"defaultAs,omitempty"` // AsUser | AsBot | AsAuto
+	StrictMode *identity.StrictMode `json:"strictMode,omitempty"`
+	Users      []AppUser            `json:"users"`
 }
 
 // ProfileName returns the display name for this app config.
@@ -61,11 +50,11 @@ func (a *AppConfig) ProfileName() string {
 
 // MultiAppConfig is the multi-app config file format.
 type MultiAppConfig struct {
-	StrictMode  StrictMode  `json:"strictMode,omitempty"`
-	RiskControl *bool       `json:"riskControl,omitempty"`
-	CurrentApp  string      `json:"currentApp,omitempty"`
-	PreviousApp string      `json:"previousApp,omitempty"`
-	Apps        []AppConfig `json:"apps"`
+	StrictMode  identity.StrictMode `json:"strictMode,omitempty"`
+	RiskControl *bool               `json:"riskControl,omitempty"`
+	CurrentApp  string              `json:"currentApp,omitempty"`
+	PreviousApp string              `json:"previousApp,omitempty"`
+	Apps        []AppConfig         `json:"apps"`
 }
 
 // RiskControlEnabled resolves the workspace policy. An omitted preference
@@ -166,7 +155,7 @@ type CliConfig struct {
 	AppID               string
 	AppSecret           string
 	Brand               brand.Brand
-	DefaultAs           Identity // AsUser | AsBot | AsAuto | "" (from config file)
+	DefaultAs           identity.Identity // AsUser | AsBot | AsAuto | "" (from config file)
 	UserOpenId          string
 	UserName            string
 	Lang                i18n.Lang
diff --git a/internal/core/config_strict_mode_test.go b/internal/core/config_strict_mode_test.go
index 84f747db40..97e1540d63 100644
--- a/internal/core/config_strict_mode_test.go
+++ b/internal/core/config_strict_mode_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/brand"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/secret"
 )
 
@@ -22,7 +23,7 @@ func TestMultiAppConfig_StrictMode_JSON(t *testing.T) {
 	}
 
 	// StrictMode="bot" should be present
-	m.StrictMode = StrictModeBot
+	m.StrictMode = identity.StrictModeBot
 	data, _ = json.Marshal(m)
 	var parsed map[string]interface{}
 	json.Unmarshal(data, &parsed)
@@ -42,7 +43,7 @@ func TestAppConfig_StrictMode_JSON(t *testing.T) {
 	}
 
 	// StrictMode = pointer to "user"
-	v := StrictModeUser
+	v := identity.StrictModeUser
 	app.StrictMode = &v
 	data, _ = json.Marshal(app)
 	json.Unmarshal(data, &parsed)
@@ -51,7 +52,7 @@ func TestAppConfig_StrictMode_JSON(t *testing.T) {
 	}
 
 	// StrictMode = pointer to "off" (explicit off — should be present, not omitted)
-	voff := StrictModeOff
+	voff := identity.StrictModeOff
 	app.StrictMode = &voff
 	data, _ = json.Marshal(app)
 	json.Unmarshal(data, &parsed)
diff --git a/internal/credential/credential_provider.go b/internal/credential/credential_provider.go
index c3cfd2ea78..10ec0ba163 100644
--- a/internal/credential/credential_provider.go
+++ b/internal/credential/credential_provider.go
@@ -14,6 +14,7 @@ import (
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 // DefaultAccountResolver is implemented by the default account provider.
@@ -69,15 +70,15 @@ func (s extensionTokenSource) ResolveIdentityHint(ctx context.Context, acct *Acc
 	// Extension sources verify user identity via enrichUserInfo, so a resolved
 	// UserOpenId is sufficient here; no keychain-backed token status lookup is needed.
 	if acct.UserOpenId != "" {
-		hint.AutoAs = core.AsUser
+		hint.AutoAs = identity.AsUser
 		return hint, nil
 	}
 	ids := extcred.IdentitySupport(acct.SupportedIdentities)
 	switch {
 	case ids.UserOnly():
-		hint.AutoAs = core.AsUser
+		hint.AutoAs = identity.AsUser
 	case ids.BotOnly():
-		hint.AutoAs = core.AsBot
+		hint.AutoAs = identity.AsBot
 	}
 	return hint, nil
 }
@@ -112,19 +113,19 @@ func (s defaultTokenSource) ResolveIdentityHint(ctx context.Context, acct *Accou
 	}
 	hint.DefaultAs = acct.DefaultAs
 	if acct.UserOpenId == "" {
-		hint.AutoAs = core.AsBot
+		hint.AutoAs = identity.AsBot
 		return hint, nil
 	}
 	stored := getStoredToken(acct.AppID, acct.UserOpenId)
 	if stored == nil {
-		hint.AutoAs = core.AsBot
+		hint.AutoAs = identity.AsBot
 		return hint, nil
 	}
 	if getStoredTokenStatus(stored) == "expired" {
-		hint.AutoAs = core.AsBot
+		hint.AutoAs = identity.AsBot
 		return hint, nil
 	}
-	hint.AutoAs = core.AsUser
+	hint.AutoAs = identity.AsUser
 	return hint, nil
 }
 
@@ -373,7 +374,7 @@ func convertAccount(ext *extcred.Account) *Account {
 		AppID:               ext.AppID,
 		AppSecret:           ext.AppSecret,
 		Brand:               ext.Brand,
-		DefaultAs:           core.Identity(ext.DefaultAs),
+		DefaultAs:           identity.Identity(ext.DefaultAs),
 		ProfileName:         ext.ProfileName,
 		UserOpenId:          ext.OpenID,
 		SupportedIdentities: uint8(ext.SupportedIdentities),
diff --git a/internal/credential/credential_provider_test.go b/internal/credential/credential_provider_test.go
index b4ba44df51..a66311b52a 100644
--- a/internal/credential/credential_provider_test.go
+++ b/internal/credential/credential_provider_test.go
@@ -14,7 +14,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/auth"
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 type mockExtProvider struct {
@@ -224,11 +224,11 @@ func TestCredentialProvider_ResolveIdentityHint_FromExtensionAccount(t *testing.
 	if err != nil {
 		t.Fatalf("ResolveIdentityHint() error = %v", err)
 	}
-	if hint.DefaultAs != core.AsUser {
-		t.Fatalf("ResolveIdentityHint() defaultAs = %q, want %q", hint.DefaultAs, core.AsUser)
+	if hint.DefaultAs != identity.AsUser {
+		t.Fatalf("ResolveIdentityHint() defaultAs = %q, want %q", hint.DefaultAs, identity.AsUser)
 	}
-	if hint.AutoAs != core.AsUser {
-		t.Fatalf("ResolveIdentityHint() autoAs = %q, want %q", hint.AutoAs, core.AsUser)
+	if hint.AutoAs != identity.AsUser {
+		t.Fatalf("ResolveIdentityHint() autoAs = %q, want %q", hint.AutoAs, identity.AsUser)
 	}
 }
 
@@ -261,8 +261,8 @@ func TestCredentialProvider_ResolveIdentityHint_DefaultSourceUsesStoredTokenStat
 	if err != nil {
 		t.Fatalf("ResolveIdentityHint() error = %v", err)
 	}
-	if hint.AutoAs != core.AsUser {
-		t.Fatalf("ResolveIdentityHint() autoAs = %q, want %q", hint.AutoAs, core.AsUser)
+	if hint.AutoAs != identity.AsUser {
+		t.Fatalf("ResolveIdentityHint() autoAs = %q, want %q", hint.AutoAs, identity.AsUser)
 	}
 }
 
@@ -297,8 +297,8 @@ func TestCredentialProvider_ResolveIdentityHint_CachesResult(t *testing.T) {
 		if err != nil {
 			t.Fatalf("ResolveIdentityHint() error = %v", err)
 		}
-		if hint.AutoAs != core.AsUser {
-			t.Fatalf("ResolveIdentityHint() autoAs = %q, want %q", hint.AutoAs, core.AsUser)
+		if hint.AutoAs != identity.AsUser {
+			t.Fatalf("ResolveIdentityHint() autoAs = %q, want %q", hint.AutoAs, identity.AsUser)
 		}
 	}
 
diff --git a/internal/credential/default_provider.go b/internal/credential/default_provider.go
index d7401b62ed..fcf1124657 100644
--- a/internal/credential/default_provider.go
+++ b/internal/credential/default_provider.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/keychain"
 
 	extcred "github.com/larksuite/cli/extension/credential"
@@ -91,16 +92,16 @@ func (p *DefaultAccountProvider) ResolveAccount(ctx context.Context) (*Account,
 // the SupportedIdentities bitflag using an already-loaded MultiAppConfig.
 func strictModeToIdentitySupport(multi *core.MultiAppConfig, profileOverride string) uint8 {
 	app := multi.CurrentAppConfig(profileOverride)
-	var mode core.StrictMode
+	var mode identity.StrictMode
 	if app != nil && app.StrictMode != nil {
 		mode = *app.StrictMode
 	} else {
 		mode = multi.StrictMode
 	}
 	switch mode {
-	case core.StrictModeBot:
+	case identity.StrictModeBot:
 		return uint8(extcred.SupportsBot)
-	case core.StrictModeUser:
+	case identity.StrictModeUser:
 		return uint8(extcred.SupportsUser)
 	default:
 		return 0
diff --git a/internal/credential/integration_test.go b/internal/credential/integration_test.go
index 83fd7a1282..ba0f9fc058 100644
--- a/internal/credential/integration_test.go
+++ b/internal/credential/integration_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/i18n"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/secret"
 )
@@ -89,7 +90,7 @@ func TestFullChain_ConfigStrictMode(t *testing.T) {
 	dir := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
 
-	botMode := core.StrictModeBot
+	botMode := identity.StrictModeBot
 	multi := &core.MultiAppConfig{
 		Apps: []core.AppConfig{{
 			AppId:      "cfg_app",
diff --git a/internal/credential/types.go b/internal/credential/types.go
index df131e6402..debe28c252 100644
--- a/internal/credential/types.go
+++ b/internal/credential/types.go
@@ -12,6 +12,7 @@ import (
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/i18n"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 )
 
 // Account is the credential-layer view of the active runtime account.
@@ -22,7 +23,7 @@ type Account struct {
 	AppID               string
 	AppSecret           string
 	Brand               brand.Brand
-	DefaultAs           core.Identity
+	DefaultAs           identitypkg.Identity
 	UserOpenId          string
 	UserName            string
 	Lang                i18n.Lang
@@ -133,10 +134,10 @@ type TokenResult struct {
 	Scopes string // optional, space-separated; empty = skip scope pre-check
 }
 
-// IdentityHint is credential-layer guidance for resolving the effective identity.
+// IdentityHint is credential-layer guidance for resolving the effective identitypkg.
 type IdentityHint struct {
-	DefaultAs core.Identity
-	AutoAs    core.Identity
+	DefaultAs identitypkg.Identity
+	AutoAs    identitypkg.Identity
 }
 
 // TokenUnavailableError reports that no usable token was available.
@@ -172,7 +173,7 @@ type TokenProvider interface {
 
 // NewTokenSpec returns a TokenSpec with the token type automatically
 // selected based on identity: TAT for bot, UAT for user.
-func NewTokenSpec(identity core.Identity, appID string) TokenSpec {
+func NewTokenSpec(identity identitypkg.Identity, appID string) TokenSpec {
 	t := TokenTypeUAT
 	if identity.IsBot() {
 		t = TokenTypeTAT
diff --git a/internal/errclass/classify.go b/internal/errclass/classify.go
index a1eff1c2ad..f274677a42 100644
--- a/internal/errclass/classify.go
+++ b/internal/errclass/classify.go
@@ -21,7 +21,7 @@ import (
 type ClassifyContext struct {
 	Brand    string // "feishu" | "lark" — drives console_url host
 	AppID    string // placed in console_url
-	Identity string // "user" / "bot" / "" — caller converts core.Identity at the boundary
+	Identity string // "user" / "bot" / "" — caller converts identitypkg.Identity at the boundary
 	LarkCmd  string // e.g. "drive +delete" — used as Action fallback on CategoryConfirmation arm
 }
 
diff --git a/internal/core/strict_mode.go b/internal/identity/strict_mode.go
similarity index 76%
rename from internal/core/strict_mode.go
rename to internal/identity/strict_mode.go
index c9cfb42985..07fe90fc6e 100644
--- a/internal/core/strict_mode.go
+++ b/internal/identity/strict_mode.go
@@ -1,7 +1,19 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package identity
+
+// Identity represents the caller identity for API requests.
+type Identity string
+
+const (
+	AsUser Identity = "user"
+	AsBot  Identity = "bot"
+	AsAuto Identity = "auto"
+)
+
+// IsBot returns true if the identity is bot.
+func (id Identity) IsBot() bool { return id == AsBot }
 
 // StrictMode represents the identity restriction policy.
 type StrictMode string
diff --git a/internal/core/strict_mode_test.go b/internal/identity/strict_mode_test.go
similarity index 98%
rename from internal/core/strict_mode_test.go
rename to internal/identity/strict_mode_test.go
index 5d67b1546d..30f50fdc76 100644
--- a/internal/core/strict_mode_test.go
+++ b/internal/identity/strict_mode_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package identity
 
 import "testing"
 
diff --git a/internal/identitydiag/diagnostics.go b/internal/identitydiag/diagnostics.go
index 70a1a58c16..f7cf954da9 100644
--- a/internal/identitydiag/diagnostics.go
+++ b/internal/identitydiag/diagnostics.go
@@ -19,6 +19,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 const (
@@ -154,7 +155,7 @@ func diagnoseExternalUser(ctx context.Context, f *cmdutil.Factory, cfg *core.Cli
 	if !verify {
 		return id
 	}
-	if _, err := f.Credential.ResolveToken(ctx, credential.NewTokenSpec(core.AsUser, cfg.AppID)); err != nil {
+	if _, err := f.Credential.ResolveToken(ctx, credential.NewTokenSpec(identity.AsUser, cfg.AppID)); err != nil {
 		return externalVerifyFailed(id, "User", provider, err)
 	}
 	id.Verified = boolPtr(true)
@@ -342,7 +343,7 @@ func resolveBotToken(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConfi
 	if f == nil || f.Credential == nil {
 		return "", &credential.TokenUnavailableError{Type: credential.TokenTypeTAT}
 	}
-	result, err := f.Credential.ResolveToken(ctx, credential.NewTokenSpec(core.AsBot, cfg.AppID))
+	result, err := f.Credential.ResolveToken(ctx, credential.NewTokenSpec(identity.AsBot, cfg.AppID))
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/meta/identity.go b/internal/meta/identity.go
index 392e0c4ed3..75ea9c05fc 100644
--- a/internal/meta/identity.go
+++ b/internal/meta/identity.go
@@ -9,7 +9,7 @@ import "sort"
 // accepts. It is a distinct type so the two directions of the token<->identity
 // mapping below cannot be swapped silently — a bare string compiles on either
 // side of a string/string signature, a Token does not. The CLI identity
-// vocabulary ("bot"/"user") already has a home in internal/core (core.Identity);
+// vocabulary ("bot"/"user") already has a home in internal/core (identity.Identity);
 // meta is a leaf and must not import core, so the identity side stays a plain
 // string here and is typed at the core boundary.
 type Token string
diff --git a/internal/output/emitter_legacy_compat_test.go b/internal/output/emitter_legacy_compat_test.go
index 2b0b2968ad..87cf46dd03 100644
--- a/internal/output/emitter_legacy_compat_test.go
+++ b/internal/output/emitter_legacy_compat_test.go
@@ -25,6 +25,7 @@ import (
 	extcs "github.com/larksuite/cli/extension/contentsafety"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -403,7 +404,7 @@ func runRuntimeContextOracle(t *testing.T, data interface{}, opts runtimeOracleO
 
 	factory := &cmdutil.Factory{IOStreams: &cmdutil.IOStreams{Out: stdout, ErrOut: stderr}}
 	runtime := common.TestNewRuntimeContextForAPI(
-		context.Background(), leaf, &core.CliConfig{Brand: brand.Feishu}, factory, core.AsBot,
+		context.Background(), leaf, &core.CliConfig{Brand: brand.Feishu}, factory, identity.AsBot,
 	)
 	runtime.Format = opts.format
 	runtime.JqExpr = opts.jq
diff --git a/internal/registry/scopes.go b/internal/registry/scopes.go
index 0a2b47f77e..0d565008b5 100644
--- a/internal/registry/scopes.go
+++ b/internal/registry/scopes.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 
 	"github.com/larksuite/cli/internal/apicatalog"
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/meta"
 )
 
@@ -57,7 +57,7 @@ func bestScope(scopes []string, priorities map[string]int) string {
 // permissive" predicate (meta.Method.SupportsToken) both live in meta, so this
 // only composes them — schema completion/render and service commands never
 // re-derive identity semantics.
-func FilterForStrictMode(mode core.StrictMode) apicatalog.MethodFilter {
+func FilterForStrictMode(mode identity.StrictMode) apicatalog.MethodFilter {
 	if !mode.IsActive() {
 		return nil
 	}
diff --git a/shortcuts/apps/apps_html_publish_test.go b/shortcuts/apps/apps_html_publish_test.go
index 5d8f4709eb..df22c44417 100644
--- a/shortcuts/apps/apps_html_publish_test.go
+++ b/shortcuts/apps/apps_html_publish_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -537,7 +538,7 @@ func newTOSTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Registry
 	rt := common.TestNewRuntimeContextForAPI(
 		context.Background(),
 		&cobra.Command{Use: "+tos-test"},
-		cfg, factory, core.AsUser,
+		cfg, factory, identity.AsUser,
 	)
 	return rt, reg
 }
diff --git a/shortcuts/apps/apps_meta_test.go b/shortcuts/apps/apps_meta_test.go
index 57c0e541dd..d79b7320e2 100644
--- a/shortcuts/apps/apps_meta_test.go
+++ b/shortcuts/apps/apps_meta_test.go
@@ -13,6 +13,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -23,7 +24,7 @@ func newMetaTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Registr
 	rt := common.TestNewRuntimeContextForAPI(
 		context.Background(),
 		&cobra.Command{Use: "+meta-test"},
-		cfg, f, core.AsUser,
+		cfg, f, identity.AsUser,
 	)
 	return rt, reg
 }
diff --git a/shortcuts/apps/apps_openapi_key_list_test.go b/shortcuts/apps/apps_openapi_key_list_test.go
index c9b22e7654..4708a6052e 100644
--- a/shortcuts/apps/apps_openapi_key_list_test.go
+++ b/shortcuts/apps/apps_openapi_key_list_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
 )
@@ -46,7 +47,7 @@ func newOpenAPIKeyRCtx(t *testing.T, flagDefs map[string]string, flags map[strin
 	for name, val := range flags {
 		_ = cmd.Flags().Set(name, val)
 	}
-	rctx := common.TestNewRuntimeContextForAPI(context.Background(), cmd, cfg, factory, core.AsUser)
+	rctx := common.TestNewRuntimeContextForAPI(context.Background(), cmd, cfg, factory, identity.AsUser)
 	return rctx, stdoutBuf, reg
 }
 
diff --git a/shortcuts/apps/apps_release_create_test.go b/shortcuts/apps/apps_release_create_test.go
index 239b5f0de7..c7b2655958 100644
--- a/shortcuts/apps/apps_release_create_test.go
+++ b/shortcuts/apps/apps_release_create_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
 )
@@ -65,7 +66,7 @@ func newReleaseCreateRuntimeContext(t *testing.T, appID, branch string) (*common
 		_ = cmd.Flags().Set("branch", branch)
 	}
 
-	rctx := common.TestNewRuntimeContextForAPI(context.Background(), cmd, cfg, factory, core.AsUser)
+	rctx := common.TestNewRuntimeContextForAPI(context.Background(), cmd, cfg, factory, identity.AsUser)
 	return rctx, stdoutBuf, reg
 }
 
diff --git a/shortcuts/apps/apps_release_get_test.go b/shortcuts/apps/apps_release_get_test.go
index 3daa538340..59958116e6 100644
--- a/shortcuts/apps/apps_release_get_test.go
+++ b/shortcuts/apps/apps_release_get_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
 )
@@ -53,7 +54,7 @@ func newStatusRuntimeContext(t *testing.T, appID, releaseID string) (*common.Run
 	_ = cmd.Flags().Set("app-id", appID)
 	_ = cmd.Flags().Set("release-id", releaseID)
 
-	rctx := common.TestNewRuntimeContextForAPI(context.Background(), cmd, cfg, factory, core.AsUser)
+	rctx := common.TestNewRuntimeContextForAPI(context.Background(), cmd, cfg, factory, identity.AsUser)
 	return rctx, stdoutBuf, reg
 }
 
diff --git a/shortcuts/apps/apps_release_list_test.go b/shortcuts/apps/apps_release_list_test.go
index 7d3fdb5037..b06dc0b0c7 100644
--- a/shortcuts/apps/apps_release_list_test.go
+++ b/shortcuts/apps/apps_release_list_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
 )
@@ -64,7 +65,7 @@ func newReleaseListRuntimeContext(t *testing.T, appID string) (*common.RuntimeCo
 	cmd.Flags().String("page-token", "", "")
 	_ = cmd.Flags().Set("app-id", appID)
 
-	rctx := common.TestNewRuntimeContextForAPI(context.Background(), cmd, cfg, factory, core.AsUser)
+	rctx := common.TestNewRuntimeContextForAPI(context.Background(), cmd, cfg, factory, identity.AsUser)
 	return rctx, stdoutBuf, reg
 }
 
diff --git a/shortcuts/apps/apps_role_common_test.go b/shortcuts/apps/apps_role_common_test.go
index c0244c7918..de5831c49f 100644
--- a/shortcuts/apps/apps_role_common_test.go
+++ b/shortcuts/apps/apps_role_common_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
 )
@@ -48,7 +49,7 @@ func newRoleRCtx(t *testing.T, flagDefs map[string]string, flags map[string]stri
 			t.Fatalf("set flag %q = %q: %v", name, val, err)
 		}
 	}
-	rctx := common.TestNewRuntimeContextForAPI(context.Background(), cmd, cfg, factory, core.AsUser)
+	rctx := common.TestNewRuntimeContextForAPI(context.Background(), cmd, cfg, factory, identity.AsUser)
 	return rctx, stdoutBuf, reg
 }
 
diff --git a/shortcuts/apps/git_credential.go b/shortcuts/apps/git_credential.go
index b5e3054d57..098d89ee4a 100644
--- a/shortcuts/apps/git_credential.go
+++ b/shortcuts/apps/git_credential.go
@@ -23,6 +23,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/sparkstore"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/apps/gitcred"
@@ -313,11 +314,11 @@ func (i factoryIssuer) Issue(ctx context.Context, appID string, profile gitcred.
 	if optFn := cmdutil.ShortcutHeaderOpts(ctx); optFn != nil {
 		opts = append(opts, optFn)
 	}
-	resp, err := ac.DoSDKRequest(ctx, req, core.AsUser, opts...)
+	resp, err := ac.DoSDKRequest(ctx, req, identity.AsUser, opts...)
 	data, err := parseIssueCredentialData(resp, err, errclass.ClassifyContext{
 		Brand:    string(cfg.Brand),
 		AppID:    cfg.AppID,
-		Identity: string(core.AsUser),
+		Identity: string(identity.AsUser),
 	})
 	if err != nil {
 		return nil, err
diff --git a/shortcuts/common/call_api_typed_test.go b/shortcuts/common/call_api_typed_test.go
index d1421adb93..8832f813fe 100644
--- a/shortcuts/common/call_api_typed_test.go
+++ b/shortcuts/common/call_api_typed_test.go
@@ -17,13 +17,14 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 func newCallAPITypedRuntime(t *testing.T) (*RuntimeContext, *httpmock.Registry) {
 	t.Helper()
 	cfg := &core.CliConfig{Brand: brand.Feishu, AppID: "cli_x"}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
-	rt := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+x"}, cfg, f, core.AsUser)
+	rt := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+x"}, cfg, f, identity.AsUser)
 	return rt, reg
 }
 
@@ -104,7 +105,7 @@ func TestCallAPITyped_Success(t *testing.T) {
 // LarkCmd from the running command path.
 func TestAPIClassifyContext(t *testing.T) {
 	cfg := &core.CliConfig{Brand: brand.Lark, AppID: "cli_x"}
-	rt := TestNewRuntimeContextWithIdentity(&cobra.Command{Use: "+upload"}, cfg, core.AsUser)
+	rt := TestNewRuntimeContextWithIdentity(&cobra.Command{Use: "+upload"}, cfg, identity.AsUser)
 
 	cc := rt.APIClassifyContext()
 	if cc.Brand != "lark" {
@@ -120,7 +121,7 @@ func TestAPIClassifyContext(t *testing.T) {
 		t.Errorf("LarkCmd = %q, want +upload", cc.LarkCmd)
 	}
 
-	bot := TestNewRuntimeContextWithIdentity(&cobra.Command{Use: "+push"}, &core.CliConfig{Brand: brand.Feishu, AppID: "y"}, core.AsBot)
+	bot := TestNewRuntimeContextWithIdentity(&cobra.Command{Use: "+push"}, &core.CliConfig{Brand: brand.Feishu, AppID: "y"}, identity.AsBot)
 	if got := bot.APIClassifyContext().Identity; got != "bot" {
 		t.Errorf("bot Identity = %q, want bot", got)
 	}
@@ -255,7 +256,7 @@ func TestDoAPIJSONTyped_Success(t *testing.T) {
 }
 
 func TestDoAPIJSONTyped_RawClientErrorBecomesTypedInternal(t *testing.T) {
-	rt := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+x"}, &core.CliConfig{}, nil, core.AsUser)
+	rt := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+x"}, &core.CliConfig{}, nil, identity.AsUser)
 	rt.apiClientFunc = func() (*client.APIClient, error) {
 		return nil, errors.New("raw client construction error")
 	}
diff --git a/shortcuts/common/drive_media_upload_test.go b/shortcuts/common/drive_media_upload_test.go
index d901ea3047..2292d841f7 100644
--- a/shortcuts/common/drive_media_upload_test.go
+++ b/shortcuts/common/drive_media_upload_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 var commonDriveMediaUploadTestSeq atomic.Int64
@@ -313,7 +314,7 @@ func newDriveMediaUploadTestRuntime(t *testing.T) (*RuntimeContext, *httpmock.Re
 		ctx:        context.Background(),
 		Config:     cfg,
 		Factory:    f,
-		resolvedAs: core.AsBot,
+		resolvedAs: identity.AsBot,
 	}
 	return runtime, reg
 }
diff --git a/shortcuts/common/drive_meta_test.go b/shortcuts/common/drive_meta_test.go
index 4bd0adc1a0..065c0c2bd9 100644
--- a/shortcuts/common/drive_meta_test.go
+++ b/shortcuts/common/drive_meta_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 var driveMetaTestSeq atomic.Int64
@@ -165,7 +166,7 @@ func newDriveMetaTestRuntime(t *testing.T) (*RuntimeContext, *httpmock.Registry)
 		ctx:        context.Background(),
 		Config:     cfg,
 		Factory:    f,
-		resolvedAs: core.AsBot,
+		resolvedAs: identity.AsBot,
 	}
 	return runtime, reg
 }
diff --git a/shortcuts/common/permission_grant_test.go b/shortcuts/common/permission_grant_test.go
index 26bbafaac6..58eff2fb3a 100644
--- a/shortcuts/common/permission_grant_test.go
+++ b/shortcuts/common/permission_grant_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 // apiErrWithScopes builds the typed error errclass.BuildAPIError produces for a
@@ -53,7 +54,7 @@ func TestAutoGrantStderrWarning_SkippedNoUser(t *testing.T) {
 		ctx:        ctx,
 		Config:     config,
 		Factory:    f,
-		resolvedAs: core.AsBot,
+		resolvedAs: identity.AsBot,
 	}
 
 	result := AutoGrantCurrentUserDrivePermission(runtime, "tkn_doc", "docx")
@@ -98,7 +99,7 @@ func TestAutoGrantStderrWarning_GrantFailed(t *testing.T) {
 		ctx:        ctx,
 		Config:     config,
 		Factory:    f,
-		resolvedAs: core.AsBot,
+		resolvedAs: identity.AsBot,
 	}
 
 	result := AutoGrantCurrentUserDrivePermission(runtime, "tkn_doc", "docx")
@@ -288,7 +289,7 @@ func TestAutoGrantStderrWarning_GrantFailed_AppScopeNotEnabled_Annotated(t *test
 		ctx:        ctx,
 		Config:     config,
 		Factory:    f,
-		resolvedAs: core.AsBot,
+		resolvedAs: identity.AsBot,
 	}
 
 	result := AutoGrantCurrentUserDrivePermission(runtime, "tkn_doc", "docx")
diff --git a/shortcuts/common/runner.go b/shortcuts/common/runner.go
index c9eaaf0aa1..39f2b686c1 100644
--- a/shortcuts/common/runner.go
+++ b/shortcuts/common/runner.go
@@ -30,6 +30,7 @@ import (
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/i18n"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
@@ -45,7 +46,7 @@ type RuntimeContext struct {
 	outputErrOnce sync.Once                         // guards first-error capture in Out()/OutFormat()
 	outputErr     error                             // deferred error from jq filtering; written at most once
 	botOnly       bool                              // set by framework for bot-only shortcuts
-	resolvedAs    core.Identity                     // effective identity resolved by framework
+	resolvedAs    identitypkg.Identity              // effective identity resolved by framework
 	Factory       *cmdutil.Factory                  // injected by framework
 	apiClientFunc func() (*client.APIClient, error) // sync.OnceValues; initialized in newRuntimeContext
 	botInfoFunc   func() (*BotInfo, error)          // sync.OnceValues; lazy bot identity from /bot/v3/info
@@ -55,20 +56,20 @@ type RuntimeContext struct {
 
 // ── Identity ──
 
-// As returns the current identity.
+// As returns the current identitypkg.
 // For bot-only shortcuts, always returns AsBot.
 // For dual-auth shortcuts, uses the resolved identity (respects default-as config).
-func (ctx *RuntimeContext) As() core.Identity {
+func (ctx *RuntimeContext) As() identitypkg.Identity {
 	if ctx.botOnly {
-		return core.AsBot
+		return identitypkg.AsBot
 	}
 	if ctx.resolvedAs.IsBot() {
-		return core.AsBot
+		return identitypkg.AsBot
 	}
 	if ctx.resolvedAs != "" {
 		return ctx.resolvedAs
 	}
-	return core.AsUser
+	return identitypkg.AsUser
 }
 
 // IsBot returns true if current identity is bot.
@@ -78,7 +79,7 @@ func (ctx *RuntimeContext) IsBot() bool {
 
 // Command returns the shortcut command name as cobra knows it (e.g.
 // "+pivot-create"). Used by per-service helpers (e.g. sheets schema
-// validation) that key off the shortcut identity.
+// validation) that key off the shortcut identitypkg.
 func (ctx *RuntimeContext) Command() string {
 	if ctx.Cmd == nil {
 		return ""
@@ -162,7 +163,7 @@ func (ctx *RuntimeContext) getAPIClient() (*client.APIClient, error) {
 	return ctx.Factory.NewAPIClientWithConfig(ctx.Config)
 }
 
-// AccessToken returns a valid access token for the current identity.
+// AccessToken returns a valid access token for the current identitypkg.
 // For user: returns user access token (with auto-refresh).
 // For bot: returns tenant access token.
 func (ctx *RuntimeContext) AccessToken() (string, error) {
@@ -424,7 +425,7 @@ func typedOrInternal(err error) error {
 }
 
 // APIClassifyContext builds the errclass.ClassifyContext for the running command
-// from the runtime config and resolved identity.
+// from the runtime config and resolved identitypkg.
 func (ctx *RuntimeContext) APIClassifyContext() errclass.ClassifyContext {
 	larkCmd := ""
 	if ctx.Cmd != nil {
@@ -521,7 +522,7 @@ func (ctx *RuntimeContext) DoAPIAsBot(req *larkcore.ApiReq, opts ...larkcore.Req
 	if optFn := cmdutil.ShortcutHeaderOpts(ctx.ctx); optFn != nil {
 		opts = append(opts, optFn)
 	}
-	return ac.DoSDKRequest(ctx.ctx, req, core.AsBot, opts...)
+	return ac.DoSDKRequest(ctx.ctx, req, identitypkg.AsBot, opts...)
 }
 
 // DoAPIStream executes a streaming HTTP request via APIClient.DoStream.
@@ -824,7 +825,7 @@ func (ctx *RuntimeContext) OutFormatRaw(data interface{}, meta *output.Meta, pre
 // checkScopePrereqs performs a fast local check: does the token
 // contain all scopes declared by the shortcut? Returns the missing ones.
 // If scope data is unavailable, returns nil (let the API call handle it).
-func checkScopePrereqs(f *cmdutil.Factory, ctx context.Context, appID string, identity core.Identity, required []string) ([]string, error) {
+func checkScopePrereqs(f *cmdutil.Factory, ctx context.Context, appID string, identity identitypkg.Identity, required []string) ([]string, error) {
 	result, err := f.Credential.ResolveToken(ctx, credential.NewTokenSpec(identity, appID))
 	if err != nil {
 		if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
@@ -1001,23 +1002,23 @@ func runShortcut(cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut, botOnly bo
 	return rctx.outputErr
 }
 
-func resolveShortcutIdentity(cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut) (core.Identity, error) {
+func resolveShortcutIdentity(cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut) (identitypkg.Identity, error) {
 	// Step 1: determine identity (--as > default-as > auto-detect).
 	asFlag, _ := cmd.Flags().GetString("as")
-	as := f.ResolveAs(cmd.Context(), cmd, core.Identity(asFlag))
+	as := f.ResolveAs(cmd.Context(), cmd, identitypkg.Identity(asFlag))
 
 	if err := f.CheckStrictMode(cmd.Context(), as); err != nil {
 		return "", err
 	}
 
-	// Step 2: check if this shortcut supports the resolved identity.
+	// Step 2: check if this shortcut supports the resolved identitypkg.
 	if err := f.CheckIdentity(as, s.AuthTypes); err != nil {
 		return "", err
 	}
 	return as, nil
 }
 
-func checkShortcutScopes(f *cmdutil.Factory, ctx context.Context, as core.Identity, config *core.CliConfig, scopes []string) error {
+func checkShortcutScopes(f *cmdutil.Factory, ctx context.Context, as identitypkg.Identity, config *core.CliConfig, scopes []string) error {
 	if len(scopes) == 0 {
 		return nil
 	}
@@ -1035,7 +1036,7 @@ func checkShortcutScopes(f *cmdutil.Factory, ctx context.Context, as core.Identi
 		WithHint("run `lark-cli auth login --scope \"%s\"` in the background. It blocks and outputs a verification URL — retrieve the URL and open it in a browser to complete login.", strings.Join(missing, " "))
 }
 
-func newRuntimeContext(cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut, config *core.CliConfig, as core.Identity, botOnly bool) (*RuntimeContext, error) {
+func newRuntimeContext(cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut, config *core.CliConfig, as identitypkg.Identity, botOnly bool) (*RuntimeContext, error) {
 	ctx := cmd.Context()
 	ctx = cmdutil.ContextWithShortcut(ctx, s.Service+":"+s.Command, uuid.New().String())
 	rctx := &RuntimeContext{ctx: ctx, Config: config, Cmd: cmd, botOnly: botOnly, resolvedAs: as, Factory: f}
diff --git a/shortcuts/common/runner_contentsafety_test.go b/shortcuts/common/runner_contentsafety_test.go
index d0f3a1ba77..8eaf366cc8 100644
--- a/shortcuts/common/runner_contentsafety_test.go
+++ b/shortcuts/common/runner_contentsafety_test.go
@@ -17,6 +17,7 @@ import (
 	extcs "github.com/larksuite/cli/extension/contentsafety"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 )
 
@@ -40,7 +41,7 @@ func newCSTestContext(t *testing.T) (*RuntimeContext, *bytes.Buffer, *bytes.Buff
 		ctx:        context.Background(),
 		Config:     &core.CliConfig{Brand: brand.Feishu},
 		Cmd:        cmd,
-		resolvedAs: core.AsBot,
+		resolvedAs: identity.AsBot,
 		Factory: &cmdutil.Factory{
 			IOStreams: &cmdutil.IOStreams{Out: stdout, ErrOut: stderr},
 		},
diff --git a/shortcuts/common/runner_jq_test.go b/shortcuts/common/runner_jq_test.go
index 9b853506cd..4308cc58c6 100644
--- a/shortcuts/common/runner_jq_test.go
+++ b/shortcuts/common/runner_jq_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 )
 
@@ -45,7 +46,7 @@ func newJqTestContext(jqExpr, format string) (*RuntimeContext, *bytes.Buffer, *b
 		Cmd:        cmd,
 		Format:     format,
 		JqExpr:     jqExpr,
-		resolvedAs: core.AsBot,
+		resolvedAs: identity.AsBot,
 		Factory: &cmdutil.Factory{
 			IOStreams: &cmdutil.IOStreams{Out: stdout, ErrOut: stderr},
 		},
diff --git a/shortcuts/common/runner_partial_failure_test.go b/shortcuts/common/runner_partial_failure_test.go
index fb348a90a0..53dd35ffc3 100644
--- a/shortcuts/common/runner_partial_failure_test.go
+++ b/shortcuts/common/runner_partial_failure_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 )
 
@@ -24,7 +25,7 @@ import (
 func TestOutPartialFailure(t *testing.T) {
 	cfg := &core.CliConfig{Brand: brand.Feishu, AppID: "cli_x"}
 	f, stdout, _, _ := cmdutil.TestFactory(t, cfg)
-	rt := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+push"}, cfg, f, core.AsUser)
+	rt := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+push"}, cfg, f, identity.AsUser)
 
 	payload := map[string]interface{}{
 		"summary": map[string]interface{}{"uploaded": 1, "failed": 1},
diff --git a/shortcuts/common/runner_scope_test.go b/shortcuts/common/runner_scope_test.go
index c3313eaf43..533822a4b3 100644
--- a/shortcuts/common/runner_scope_test.go
+++ b/shortcuts/common/runner_scope_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 type scopeCheckTokenResolver struct {
@@ -109,7 +110,7 @@ func TestCheckShortcutScopes_PropagatesContextCancellation(t *testing.T) {
 		Credential: credential.NewCredentialProvider(nil, nil, &scopeCheckTokenResolver{err: context.Canceled}, nil),
 	}
 
-	err := checkShortcutScopes(f, context.Background(), core.AsUser, &core.CliConfig{AppID: "app-1"}, []string{"im:message:read"})
+	err := checkShortcutScopes(f, context.Background(), identity.AsUser, &core.CliConfig{AppID: "app-1"}, []string{"im:message:read"})
 	if !errors.Is(err, context.Canceled) {
 		t.Fatalf("checkShortcutScopes() error = %v, want context.Canceled", err)
 	}
@@ -130,7 +131,7 @@ func TestCheckShortcutScopes_ReturnsTypedPermissionError(t *testing.T) {
 	}
 
 	required := []string{"im:message:read", "drive:drive:read", "docx:document:read"}
-	err := checkShortcutScopes(f, context.Background(), core.AsUser, &core.CliConfig{AppID: "app-1"}, required)
+	err := checkShortcutScopes(f, context.Background(), identity.AsUser, &core.CliConfig{AppID: "app-1"}, required)
 	if err == nil {
 		t.Fatal("expected error when token is missing required scopes, got nil")
 	}
@@ -145,8 +146,8 @@ func TestCheckShortcutScopes_ReturnsTypedPermissionError(t *testing.T) {
 	if permErr.Subtype != errs.SubtypeMissingScope {
 		t.Errorf("Subtype = %q, want %q", permErr.Subtype, errs.SubtypeMissingScope)
 	}
-	if permErr.Identity != string(core.AsUser) {
-		t.Errorf("Identity = %q, want %q", permErr.Identity, string(core.AsUser))
+	if permErr.Identity != string(identity.AsUser) {
+		t.Errorf("Identity = %q, want %q", permErr.Identity, string(identity.AsUser))
 	}
 	wantMissing := map[string]bool{"drive:drive:read": true, "docx:document:read": true}
 	for _, m := range permErr.MissingScopes {
@@ -171,7 +172,7 @@ func TestCheckShortcutScopes_IgnoresNonContextTokenErrors(t *testing.T) {
 		Credential: credential.NewCredentialProvider(nil, nil, &scopeCheckTokenResolver{err: errors.New("token cache unavailable")}, nil),
 	}
 
-	err := checkShortcutScopes(f, context.Background(), core.AsUser, &core.CliConfig{AppID: "app-1"}, []string{"im:message:read"})
+	err := checkShortcutScopes(f, context.Background(), identity.AsUser, &core.CliConfig{AppID: "app-1"}, []string{"im:message:read"})
 	if err != nil {
 		t.Fatalf("checkShortcutScopes() error = %v, want nil", err)
 	}
diff --git a/shortcuts/common/testing.go b/shortcuts/common/testing.go
index 345078f9e1..4c0f71cd47 100644
--- a/shortcuts/common/testing.go
+++ b/shortcuts/common/testing.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 // TestNewRuntimeContext creates a RuntimeContext for testing purposes.
@@ -26,7 +27,7 @@ func TestNewRuntimeContextWithCtx(ctx context.Context, cmd *cobra.Command, cfg *
 }
 
 // TestNewRuntimeContextWithIdentity creates a RuntimeContext with a specific identity for testing.
-func TestNewRuntimeContextWithIdentity(cmd *cobra.Command, cfg *core.CliConfig, as core.Identity) *RuntimeContext {
+func TestNewRuntimeContextWithIdentity(cmd *cobra.Command, cfg *core.CliConfig, as identity.Identity) *RuntimeContext {
 	return &RuntimeContext{Cmd: cmd, Config: cfg, resolvedAs: as}
 }
 
@@ -44,11 +45,11 @@ func TestNewRuntimeContextWithBotInfo(cmd *cobra.Command, cfg *core.CliConfig, i
 // can invoke DoAPI / CallAPI directly without wiring through a cobra parent
 // command.
 //
-// Pass core.AsBot or core.AsUser explicitly — exposing the identity as a
+// Pass identity.AsBot or identity.AsUser explicitly — exposing the identity as a
 // parameter keeps the helper reusable for tests that need to exercise the
 // user-identity code path (token store, auth login, etc.) without forking
 // into a second near-identical helper.
-func TestNewRuntimeContextForAPI(ctx context.Context, cmd *cobra.Command, cfg *core.CliConfig, f *cmdutil.Factory, as core.Identity) *RuntimeContext {
+func TestNewRuntimeContextForAPI(ctx context.Context, cmd *cobra.Command, cfg *core.CliConfig, f *cmdutil.Factory, as identity.Identity) *RuntimeContext {
 	return &RuntimeContext{
 		ctx:        ctx,
 		Cmd:        cmd,
diff --git a/shortcuts/common/testing_test.go b/shortcuts/common/testing_test.go
index 40175edefc..5d7dcd7d52 100644
--- a/shortcuts/common/testing_test.go
+++ b/shortcuts/common/testing_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 func TestTestNewRuntimeContextForAPIWiresFields(t *testing.T) {
@@ -21,7 +22,7 @@ func TestTestNewRuntimeContextForAPIWiresFields(t *testing.T) {
 	cmd := &cobra.Command{Use: "testing-helper"}
 
 	ctx := context.Background()
-	rctx := TestNewRuntimeContextForAPI(ctx, cmd, cfg, f, core.AsBot)
+	rctx := TestNewRuntimeContextForAPI(ctx, cmd, cfg, f, identity.AsBot)
 	if rctx == nil {
 		t.Fatal("TestNewRuntimeContextForAPI returned nil")
 	}
@@ -44,8 +45,8 @@ func TestTestNewRuntimeContextForAPIWiresFields(t *testing.T) {
 	// User identity should also be accepted — the whole reason for making
 	// the parameter explicit is to let user-identity code paths use this
 	// helper instead of forking a second one.
-	userRctx := TestNewRuntimeContextForAPI(ctx, cmd, cfg, f, core.AsUser)
-	if userRctx.resolvedAs != core.AsUser {
+	userRctx := TestNewRuntimeContextForAPI(ctx, cmd, cfg, f, identity.AsUser)
+	if userRctx.resolvedAs != identity.AsUser {
 		t.Errorf("resolvedAs AsUser not preserved, got %q", userRctx.resolvedAs)
 	}
 }
diff --git a/shortcuts/contact/contact_search_user_test.go b/shortcuts/contact/contact_search_user_test.go
index 22ac2683f9..429bf16844 100644
--- a/shortcuts/contact/contact_search_user_test.go
+++ b/shortcuts/contact/contact_search_user_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
 )
@@ -1024,7 +1025,7 @@ func runOneQueryRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Registr
 	t.Helper()
 	f, _, _, reg := cmdutil.TestFactory(t, searchUserDefaultConfig())
 	cmd := newSearchUserTestCommand()
-	rt := common.TestNewRuntimeContextForAPI(context.Background(), cmd, searchUserDefaultConfig(), f, core.AsUser)
+	rt := common.TestNewRuntimeContextForAPI(context.Background(), cmd, searchUserDefaultConfig(), f, identity.AsUser)
 	return rt, reg
 }
 
diff --git a/shortcuts/doc/doc_media_test.go b/shortcuts/doc/doc_media_test.go
index a526766a59..8e68da210a 100644
--- a/shortcuts/doc/doc_media_test.go
+++ b/shortcuts/doc/doc_media_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -268,7 +269,7 @@ func TestUploadDocMediaFileWithContentUsesSinglePartUpload(t *testing.T) {
 		&cobra.Command{Use: "docs +media-upload"},
 		docsTestConfigWithAppID("docs-upload-content-app"),
 		f,
-		core.AsBot,
+		identity.AsBot,
 	)
 
 	payload := []byte{0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a} // PNG magic bytes
@@ -329,7 +330,7 @@ func TestUploadDocMediaFileWithContentUsesMultipart(t *testing.T) {
 		&cobra.Command{Use: "docs +media-upload"},
 		docsTestConfigWithAppID("docs-upload-content-multi"),
 		f,
-		core.AsBot,
+		identity.AsBot,
 	)
 
 	size := common.MaxDriveMediaUploadSinglePartSize + 1
diff --git a/shortcuts/drive/drive_create_folder_test.go b/shortcuts/drive/drive_create_folder_test.go
index 974f2c573a..cd9134c0a0 100644
--- a/shortcuts/drive/drive_create_folder_test.go
+++ b/shortcuts/drive/drive_create_folder_test.go
@@ -12,8 +12,8 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -75,7 +75,7 @@ func TestDriveCreateFolderDryRunIncludesCreateRequest(t *testing.T) {
 		t.Fatalf("set --folder-token: %v", err)
 	}
 
-	runtime := common.TestNewRuntimeContextWithIdentity(cmd, nil, core.AsBot)
+	runtime := common.TestNewRuntimeContextWithIdentity(cmd, nil, identity.AsBot)
 	dry := DriveCreateFolder.DryRun(context.Background(), runtime)
 	if dry == nil {
 		t.Fatal("DryRun returned nil")
diff --git a/shortcuts/drive/drive_import_test.go b/shortcuts/drive/drive_import_test.go
index de873f6756..719adaef5f 100644
--- a/shortcuts/drive/drive_import_test.go
+++ b/shortcuts/drive/drive_import_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	_ "github.com/larksuite/cli/internal/vfs/localfileio"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -96,7 +97,7 @@ func TestDriveImportDryRunUsesExtensionlessDefaultName(t *testing.T) {
 		t.Fatalf("set --folder-token: %v", err)
 	}
 
-	runtime := common.TestNewRuntimeContextWithIdentity(cmd, nil, core.AsBot)
+	runtime := common.TestNewRuntimeContextWithIdentity(cmd, nil, identity.AsBot)
 	dry := DriveImport.DryRun(context.Background(), runtime)
 	if dry == nil {
 		t.Fatal("DryRun returned nil")
diff --git a/shortcuts/drive/drive_io_test.go b/shortcuts/drive/drive_io_test.go
index c9f91e6b89..1654b619a5 100644
--- a/shortcuts/drive/drive_io_test.go
+++ b/shortcuts/drive/drive_io_test.go
@@ -23,6 +23,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -1089,7 +1090,7 @@ func TestDriveUploadDryRunUsesWikiTarget(t *testing.T) {
 		t.Fatalf("set --wiki-token: %v", err)
 	}
 
-	runtime := common.TestNewRuntimeContextWithIdentity(cmd, nil, core.AsBot)
+	runtime := common.TestNewRuntimeContextWithIdentity(cmd, nil, identity.AsBot)
 	dry := DriveUpload.DryRun(context.Background(), runtime)
 	if dry == nil {
 		t.Fatal("DryRun returned nil")
diff --git a/shortcuts/drive/drive_pull_test.go b/shortcuts/drive/drive_pull_test.go
index 5502291b00..77a5d5f51c 100644
--- a/shortcuts/drive/drive_pull_test.go
+++ b/shortcuts/drive/drive_pull_test.go
@@ -16,8 +16,8 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
@@ -363,7 +363,7 @@ func TestDrivePullShouldSkipSmartFallsBackWhenMetadataCannotBeTrusted(t *testing
 		t.Fatalf("Chtimes: %v", err)
 	}
 
-	runtime := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "test"}, driveTestConfig(), f, core.AsBot)
+	runtime := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "test"}, driveTestConfig(), f, identity.AsBot)
 
 	for _, tt := range []struct {
 		name       string
@@ -399,7 +399,7 @@ func TestDrivePullShouldSkipSmartFallsBackWhenPathCannotBeResolved(t *testing.T)
 
 	tmpDir := t.TempDir()
 	withDriveWorkingDir(t, tmpDir)
-	runtime := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "test"}, driveTestConfig(), f, core.AsBot)
+	runtime := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "test"}, driveTestConfig(), f, identity.AsBot)
 
 	if got := drivePullShouldSkipSmart("../escape.txt", drivePullTarget{ModifiedTime: "100"}, drivePullIfExistsSmart, runtime); got {
 		t.Fatal("drivePullShouldSkipSmart() = true, want false when ResolvePath rejects the target")
@@ -414,7 +414,7 @@ func TestDrivePullShouldSkipSmartFallsBackWhenLocalFileDisappeared(t *testing.T)
 	if err := os.MkdirAll("local", 0o755); err != nil {
 		t.Fatalf("MkdirAll: %v", err)
 	}
-	runtime := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "test"}, driveTestConfig(), f, core.AsBot)
+	runtime := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "test"}, driveTestConfig(), f, identity.AsBot)
 
 	if got := drivePullShouldSkipSmart(filepath.Join("local", "missing.txt"), drivePullTarget{ModifiedTime: "100"}, drivePullIfExistsSmart, runtime); got {
 		t.Fatal("drivePullShouldSkipSmart() = true, want false when os.Stat cannot find the local file")
diff --git a/shortcuts/drive/drive_task_result_test.go b/shortcuts/drive/drive_task_result_test.go
index 99a4ef7c2c..16a6b7e8ea 100644
--- a/shortcuts/drive/drive_task_result_test.go
+++ b/shortcuts/drive/drive_task_result_test.go
@@ -15,9 +15,9 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -324,7 +324,7 @@ func (m *mockDriveTaskResultTokenResolver) ResolveToken(ctx context.Context, req
 	return &credential.TokenResult{Token: token, Scopes: m.scopes}, nil
 }
 
-func newDriveTaskResultRuntimeWithScopes(t *testing.T, as core.Identity, scopes string) *common.RuntimeContext {
+func newDriveTaskResultRuntimeWithScopes(t *testing.T, as identity.Identity, scopes string) *common.RuntimeContext {
 	t.Helper()
 
 	cfg := driveTestConfig()
@@ -603,7 +603,7 @@ func TestValidateDriveTaskResultScopesWikiScenariosRequireWikiScope(t *testing.T
 	for _, scenario := range []string{"wiki_move", "wiki_move_to_drive", "wiki_delete_space", "wiki_delete_node"} {
 		t.Run(scenario+"/rejects missing scope", func(t *testing.T) {
 			t.Parallel()
-			runtime := newDriveTaskResultRuntimeWithScopes(t, core.AsUser, "drive:drive.metadata:readonly")
+			runtime := newDriveTaskResultRuntimeWithScopes(t, identity.AsUser, "drive:drive.metadata:readonly")
 			err := validateDriveTaskResultScopes(context.Background(), runtime, scenario)
 			if err == nil || !strings.Contains(err.Error(), "missing required scope(s): wiki:space:read") {
 				t.Fatalf("expected missing wiki scope error, got %v", err)
@@ -621,7 +621,7 @@ func TestValidateDriveTaskResultScopesWikiScenariosRequireWikiScope(t *testing.T
 		})
 		t.Run(scenario+"/accepts wiki scope", func(t *testing.T) {
 			t.Parallel()
-			runtime := newDriveTaskResultRuntimeWithScopes(t, core.AsUser, "wiki:space:read")
+			runtime := newDriveTaskResultRuntimeWithScopes(t, identity.AsUser, "wiki:space:read")
 			err := validateDriveTaskResultScopes(context.Background(), runtime, scenario)
 			if err != nil {
 				t.Fatalf("validateDriveTaskResultScopes() error = %v", err)
@@ -810,7 +810,7 @@ func TestDriveTaskResultRejectsUnknownScenarioListsWikiDeleteNode(t *testing.T)
 func TestValidateDriveTaskResultScopesDriveScenariosRequireDriveScope(t *testing.T) {
 	t.Parallel()
 
-	runtime := newDriveTaskResultRuntimeWithScopes(t, core.AsUser, "wiki:space:read")
+	runtime := newDriveTaskResultRuntimeWithScopes(t, identity.AsUser, "wiki:space:read")
 	err := validateDriveTaskResultScopes(context.Background(), runtime, "import")
 	if err == nil || !strings.Contains(err.Error(), "missing required scope(s): drive:drive.metadata:readonly") {
 		t.Fatalf("expected missing drive scope error, got %v", err)
@@ -921,7 +921,7 @@ func TestValidateDriveTaskResultScopesPropagatesContextCancellation(t *testing.T
 	factory, _, _, _ := cmdutil.TestFactory(t, cfg)
 	factory.Credential = credential.NewCredentialProvider(nil, nil, cancelingTokenResolver{}, nil)
 
-	runtime := common.TestNewRuntimeContextWithIdentity(&cobra.Command{Use: "drive +task_result"}, cfg, core.AsUser)
+	runtime := common.TestNewRuntimeContextWithIdentity(&cobra.Command{Use: "drive +task_result"}, cfg, identity.AsUser)
 	runtime.Factory = factory
 
 	err := validateDriveTaskResultScopes(context.Background(), runtime, "wiki_move")
diff --git a/shortcuts/im/builders_test.go b/shortcuts/im/builders_test.go
index 8f15ede214..97820be105 100644
--- a/shortcuts/im/builders_test.go
+++ b/shortcuts/im/builders_test.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
 )
@@ -646,7 +646,7 @@ func TestShortcutValidateBranches(t *testing.T) {
 		runtime := newTestRuntimeContext(t, map[string]string{
 			"user-id": "ou_123",
 		}, nil)
-		setRuntimeField(t, runtime, "resolvedAs", core.AsBot)
+		setRuntimeField(t, runtime, "resolvedAs", identity.AsBot)
 		err := ImChatMessageList.Validate(context.Background(), runtime)
 		if err == nil || !strings.Contains(err.Error(), "requires user identity") {
 			t.Fatalf("ImChatMessageList.Validate() error = %v, want requires user identity", err)
diff --git a/shortcuts/im/convert_lib/runtime_test.go b/shortcuts/im/convert_lib/runtime_test.go
index 8eb493a712..ec7cde71e3 100644
--- a/shortcuts/im/convert_lib/runtime_test.go
+++ b/shortcuts/im/convert_lib/runtime_test.go
@@ -17,6 +17,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 	lark "github.com/larksuite/oapi-sdk-go/v3"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
@@ -84,7 +85,7 @@ func newBotConvertlibRuntime(t *testing.T, rt http.RoundTripper) *common.Runtime
 		},
 	}
 	setConvertlibRuntimeField(t, runtime, "ctx", context.Background())
-	setConvertlibRuntimeField(t, runtime, "resolvedAs", core.AsBot)
+	setConvertlibRuntimeField(t, runtime, "resolvedAs", identity.AsBot)
 	setConvertlibRuntimeField(t, runtime, "larkSDK", sdk)
 	return runtime
 }
diff --git a/shortcuts/im/helpers_network_test.go b/shortcuts/im/helpers_network_test.go
index b464536880..d41730fab6 100644
--- a/shortcuts/im/helpers_network_test.go
+++ b/shortcuts/im/helpers_network_test.go
@@ -29,6 +29,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -107,7 +108,7 @@ func newBotShortcutRuntime(t *testing.T, rt http.RoundTripper) *common.RuntimeCo
 		},
 	}
 	setRuntimeField(t, runtime, "ctx", cmdutil.ContextWithShortcut(context.Background(), "im.test", "exec-123"))
-	setRuntimeField(t, runtime, "resolvedAs", core.AsBot)
+	setRuntimeField(t, runtime, "resolvedAs", identity.AsBot)
 	setRuntimeField(t, runtime, "larkSDK", sdk)
 	return runtime
 }
@@ -115,7 +116,7 @@ func newBotShortcutRuntime(t *testing.T, rt http.RoundTripper) *common.RuntimeCo
 func newUserShortcutRuntime(t *testing.T, rt http.RoundTripper) *common.RuntimeContext {
 	t.Helper()
 	runtime := newBotShortcutRuntime(t, rt)
-	setRuntimeField(t, runtime, "resolvedAs", core.AsUser)
+	setRuntimeField(t, runtime, "resolvedAs", identity.AsUser)
 	return runtime
 }
 
diff --git a/shortcuts/im/im_chat_list_test.go b/shortcuts/im/im_chat_list_test.go
index 4fc4f06fde..6b51f9af0d 100644
--- a/shortcuts/im/im_chat_list_test.go
+++ b/shortcuts/im/im_chat_list_test.go
@@ -14,18 +14,18 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
 )
 
 // newChatListTestRuntimeContext registers flags and returns a user-identity runtime context.
 func newChatListTestRuntimeContext(t *testing.T, stringFlags map[string]string, boolFlags map[string]bool) *common.RuntimeContext {
-	return newChatListTestRuntimeContextWithIdentity(t, stringFlags, boolFlags, core.AsUser)
+	return newChatListTestRuntimeContextWithIdentity(t, stringFlags, boolFlags, identity.AsUser)
 }
 
 // newChatListTestRuntimeContextWithIdentity is the identity-aware variant.
-func newChatListTestRuntimeContextWithIdentity(t *testing.T, stringFlags map[string]string, boolFlags map[string]bool, as core.Identity) *common.RuntimeContext {
+func newChatListTestRuntimeContextWithIdentity(t *testing.T, stringFlags map[string]string, boolFlags map[string]bool, as identity.Identity) *common.RuntimeContext {
 	t.Helper()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	cmd := &cobra.Command{Use: "test"}
@@ -206,19 +206,19 @@ func TestResolveTypes(t *testing.T) {
 	cases := []struct {
 		name          string
 		raw           string
-		as            core.Identity
+		as            identity.Identity
 		wantEffective string
 		wantStripped  bool
 	}{
-		{"user empty", "", core.AsUser, "", false},
-		{"user p2p", "p2p", core.AsUser, "p2p", false},
-		{"user p2p,group", "p2p,group", core.AsUser, "p2p,group", false},
-		{"user group,p2p preserves order", "group,p2p", core.AsUser, "group,p2p", false},
-		{"user normalized casing", "P2P,GROUP", core.AsUser, "p2p,group", false},
-		{"bot empty", "", core.AsBot, "", false},
-		{"bot group only", "group", core.AsBot, "group", false},
-		{"bot p2p,group strips p2p", "p2p,group", core.AsBot, "group", true},
-		{"bot group,p2p strips p2p", "group,p2p", core.AsBot, "group", true},
+		{"user empty", "", identity.AsUser, "", false},
+		{"user p2p", "p2p", identity.AsUser, "p2p", false},
+		{"user p2p,group", "p2p,group", identity.AsUser, "p2p,group", false},
+		{"user group,p2p preserves order", "group,p2p", identity.AsUser, "group,p2p", false},
+		{"user normalized casing", "P2P,GROUP", identity.AsUser, "p2p,group", false},
+		{"bot empty", "", identity.AsBot, "", false},
+		{"bot group only", "group", identity.AsBot, "group", false},
+		{"bot p2p,group strips p2p", "p2p,group", identity.AsBot, "group", true},
+		{"bot group,p2p strips p2p", "group,p2p", identity.AsBot, "group", true},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -252,19 +252,19 @@ func TestImChatList_Validate_Types(t *testing.T) {
 	cases := []struct {
 		name     string
 		typesRaw string
-		as       core.Identity
+		as       identity.Identity
 		wantErr  string // substring; "" means no error
 	}{
-		{"user empty ok", "", core.AsUser, ""},
-		{"user p2p ok", "p2p", core.AsUser, ""},
-		{"user group ok", "group", core.AsUser, ""},
-		{"user p2p,group ok", "p2p,group", core.AsUser, ""},
-		{"user invalid element rejected", "private", core.AsUser, "expected one of p2p, group"},
-		{"user comma-only rejected", ",", core.AsUser, "must contain at least one of p2p, group"},
-		{"bot empty ok", "", core.AsBot, ""},
-		{"bot group ok", "group", core.AsBot, ""},
-		{"bot p2p,group ok (degraded at Execute)", "p2p,group", core.AsBot, ""},
-		{"bot single p2p rejected", "p2p", core.AsBot, "only supported with user identity"},
+		{"user empty ok", "", identity.AsUser, ""},
+		{"user p2p ok", "p2p", identity.AsUser, ""},
+		{"user group ok", "group", identity.AsUser, ""},
+		{"user p2p,group ok", "p2p,group", identity.AsUser, ""},
+		{"user invalid element rejected", "private", identity.AsUser, "expected one of p2p, group"},
+		{"user comma-only rejected", ",", identity.AsUser, "must contain at least one of p2p, group"},
+		{"bot empty ok", "", identity.AsBot, ""},
+		{"bot group ok", "group", identity.AsBot, ""},
+		{"bot p2p,group ok (degraded at Execute)", "p2p,group", identity.AsBot, ""},
+		{"bot single p2p rejected", "p2p", identity.AsBot, "only supported with user identity"},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -478,16 +478,16 @@ func TestImChatList_Execute_PrettyOutputRendersP2pRow(t *testing.T) {
 func TestImChatList_DryRun_TypesPassthrough(t *testing.T) {
 	cases := []struct {
 		name     string
-		as       core.Identity
+		as       identity.Identity
 		typesRaw string
 		wantSub  string // substring expected in dry-run JSON
 		wantErr  bool   // whether Validate should reject before DryRun runs
 	}{
-		{"user p2p", core.AsUser, "p2p", `"types":"p2p"`, false},
-		{"user p2p,group", core.AsUser, "p2p,group", `"types":"p2p,group"`, false},
-		{"bot p2p,group strips to group", core.AsBot, "p2p,group", `"types":"group"`, false},
-		{"bot group passes", core.AsBot, "group", `"types":"group"`, false},
-		{"bot single p2p rejected at Validate", core.AsBot, "p2p", "", true},
+		{"user p2p", identity.AsUser, "p2p", `"types":"p2p"`, false},
+		{"user p2p,group", identity.AsUser, "p2p,group", `"types":"p2p,group"`, false},
+		{"bot p2p,group strips to group", identity.AsBot, "p2p,group", `"types":"group"`, false},
+		{"bot group passes", identity.AsBot, "group", `"types":"group"`, false},
+		{"bot single p2p rejected at Validate", identity.AsBot, "p2p", "", true},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
diff --git a/shortcuts/mail/signature_compose_test.go b/shortcuts/mail/signature_compose_test.go
index 8ffbae8bf7..2633d44052 100644
--- a/shortcuts/mail/signature_compose_test.go
+++ b/shortcuts/mail/signature_compose_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 	draftpkg "github.com/larksuite/cli/shortcuts/mail/draft"
 	"github.com/larksuite/cli/shortcuts/mail/emlbuilder"
@@ -188,7 +189,7 @@ func newSigTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Registry
 	t.Helper()
 	cfg := &core.CliConfig{Brand: brand.Feishu, AppID: "cli_sigtest"}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
-	rt := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+test"}, cfg, f, core.AsUser)
+	rt := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+test"}, cfg, f, identity.AsUser)
 	return rt, reg
 }
 
diff --git a/shortcuts/markdown/markdown_test.go b/shortcuts/markdown/markdown_test.go
index b4a576cebf..74ea096768 100644
--- a/shortcuts/markdown/markdown_test.go
+++ b/shortcuts/markdown/markdown_test.go
@@ -27,6 +27,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -1335,7 +1336,7 @@ func TestUploadMarkdownMultipartPartsRejectsOversizedBlockSize(t *testing.T) {
 
 func TestWithMarkdownUploadRetryDataDoesNotRetryNonRetryable(t *testing.T) {
 	f, _, stderr, _ := cmdutil.TestFactory(t, markdownTestConfig())
-	rt := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+create"}, markdownTestConfig(), f, core.AsUser)
+	rt := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+create"}, markdownTestConfig(), f, identity.AsUser)
 
 	attempts := 0
 	expected := errs.NewAPIError(errs.SubtypePermissionDenied, "permission denied").WithCode(1061004)
@@ -1356,7 +1357,7 @@ func TestWithMarkdownUploadRetryDataDoesNotRetryNonRetryable(t *testing.T) {
 
 func TestWithMarkdownUploadRetryVoidExhaustedAppendsHint(t *testing.T) {
 	f, _, stderr, _ := cmdutil.TestFactory(t, markdownTestConfig())
-	rt := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+create"}, markdownTestConfig(), f, core.AsUser)
+	rt := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+create"}, markdownTestConfig(), f, identity.AsUser)
 
 	orig := markdownUploadRetryBackoffs
 	markdownUploadRetryBackoffs = []time.Duration{0, 0}
@@ -1470,7 +1471,7 @@ func TestUploadMarkdownFileAllMissingFileTokenGetsActionPrefix(t *testing.T) {
 	})
 
 	_, err := uploadMarkdownFileAll(
-		common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+create"}, markdownTestConfig(), f, core.AsUser),
+		common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+create"}, markdownTestConfig(), f, identity.AsUser),
 		markdownUploadSpec{ContentSet: true},
 		"README.md",
 		int64(len("# hello\n")),
@@ -1506,7 +1507,7 @@ func TestUploadMarkdownFileMultipartOpenFailureNamesFileParam(t *testing.T) {
 	})
 
 	_, err := uploadMarkdownFileMultipart(
-		common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+create"}, markdownTestConfig(), f, core.AsUser),
+		common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+create"}, markdownTestConfig(), f, identity.AsUser),
 		markdownUploadSpec{FileSet: true, FilePath: "missing.md"},
 		"missing.md",
 		int64(1),
@@ -1536,7 +1537,7 @@ func TestUploadMarkdownFileMultipartPrepareAndFinishParseErrorsGetActionPrefix(t
 		})
 
 		_, err := uploadMarkdownFileMultipart(
-			common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+create"}, markdownTestConfig(), f, core.AsUser),
+			common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+create"}, markdownTestConfig(), f, identity.AsUser),
 			markdownUploadSpec{ContentSet: true},
 			"README.md",
 			int64(len("# hello\n")),
@@ -1587,7 +1588,7 @@ func TestUploadMarkdownFileMultipartPrepareAndFinishParseErrorsGetActionPrefix(t
 		})
 
 		_, err := uploadMarkdownFileMultipart(
-			common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+create"}, markdownTestConfig(), f, core.AsUser),
+			common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+create"}, markdownTestConfig(), f, identity.AsUser),
 			markdownUploadSpec{ContentSet: true},
 			"README.md",
 			int64(len("# hello\n")),
diff --git a/shortcuts/sheets/backward/lark_sheets_sheet_create_test.go b/shortcuts/sheets/backward/lark_sheets_sheet_create_test.go
index 86cbe5f5c2..21e12226b9 100644
--- a/shortcuts/sheets/backward/lark_sheets_sheet_create_test.go
+++ b/shortcuts/sheets/backward/lark_sheets_sheet_create_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -157,7 +158,7 @@ func TestSheetCreateDryRunIncludesFolderToken(t *testing.T) {
 			"data":         "",
 		},
 		nil, nil)
-	rt = common.TestNewRuntimeContextWithIdentity(rt.Cmd, nil, core.AsBot)
+	rt = common.TestNewRuntimeContextWithIdentity(rt.Cmd, nil, identity.AsBot)
 	got := mustMarshalSheetsDryRun(t, SheetCreate.DryRun(context.Background(), rt))
 	if !strings.Contains(got, `"folder_token":"fldcn123"`) {
 		t.Fatalf("DryRun should include folder_token, got: %s", got)
diff --git a/shortcuts/sheets/sheet_media_parent_type_test.go b/shortcuts/sheets/sheet_media_parent_type_test.go
index 089b65c883..f1833b8830 100644
--- a/shortcuts/sheets/sheet_media_parent_type_test.go
+++ b/shortcuts/sheets/sheet_media_parent_type_test.go
@@ -21,6 +21,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -154,7 +155,7 @@ func newSheetMediaTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.R
 		Brand:     brand.Feishu,
 	}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
-	runtime := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "sheets"}, cfg, f, core.AsBot)
+	runtime := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "sheets"}, cfg, f, identity.AsBot)
 	return runtime, reg
 }
 
diff --git a/shortcuts/task/task_search_test.go b/shortcuts/task/task_search_test.go
index 7534c13e56..c3057e0c6a 100644
--- a/shortcuts/task/task_search_test.go
+++ b/shortcuts/task/task_search_test.go
@@ -12,8 +12,8 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -420,7 +420,7 @@ func TestGetTaskDetail_MalformedResponse(t *testing.T) {
 			warmTenantToken(t, f, reg)
 			reg.Register(tt.stub)
 
-			runtime := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "test"}, taskTestConfig(t), f, core.AsBot)
+			runtime := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "test"}, taskTestConfig(t), f, identity.AsBot)
 
 			_, err := getTaskDetail(runtime, "task-123")
 			if err == nil {
diff --git a/shortcuts/task/task_util_test.go b/shortcuts/task/task_util_test.go
index 3db84d12aa..e7a4f69db2 100644
--- a/shortcuts/task/task_util_test.go
+++ b/shortcuts/task/task_util_test.go
@@ -14,9 +14,9 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/smartystreets/goconvey/convey"
@@ -173,7 +173,7 @@ func TestHandleTaskApiResultWithContext_PermissionConsoleURL(t *testing.T) {
 func TestCallTaskAPITyped_TaskHint(t *testing.T) {
 	cfg := taskTestConfig(t)
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
-	rt := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+x"}, cfg, f, core.AsUser)
+	rt := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+x"}, cfg, f, identity.AsUser)
 	reg.Register(&httpmock.Stub{
 		Method: http.MethodGet,
 		URL:    "/open-apis/task/v2/tasks/t-1",
diff --git a/shortcuts/vc/helpers.go b/shortcuts/vc/helpers.go
index 87acf7e8d5..7df412a682 100644
--- a/shortcuts/vc/helpers.go
+++ b/shortcuts/vc/helpers.go
@@ -7,7 +7,7 @@ import (
 	"errors"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/registry"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -28,12 +28,12 @@ func normalizeMeetingQueryPermissionError(runtime *common.RuntimeContext, err er
 	}
 
 	switch {
-	case runtime.As() == core.AsUser && permissionErr.Code == output.LarkErrUserScopeInsufficient:
+	case runtime.As() == identity.AsUser && permissionErr.Code == output.LarkErrUserScopeInsufficient:
 		permissionErr.Message = "access denied for user identity; recommended scope: " + meetingQueryUserScope
 		permissionErr.WithHint("for user identity, run `lark-cli auth login --scope %q` in the background. It blocks and outputs a verification URL — retrieve the URL and open it in a browser to complete login.", meetingQueryUserScope)
 		permissionErr.WithMissingScopes(meetingQueryUserScope)
 		return err
-	case runtime.As() == core.AsBot && permissionErr.Code == output.LarkErrAppScopeNotEnabled:
+	case runtime.As() == identity.AsBot && permissionErr.Code == output.LarkErrAppScopeNotEnabled:
 		permissionErr.Message = "access denied for bot identity; recommended scope: " + meetingQueryBotScope
 		permissionErr.WithHint("ask the app developer to enable scope %s", meetingQueryBotScope)
 		permissionErr.WithMissingScopes(meetingQueryBotScope)
diff --git a/shortcuts/vc/helpers_test.go b/shortcuts/vc/helpers_test.go
index 6686d7c465..ae2927860b 100644
--- a/shortcuts/vc/helpers_test.go
+++ b/shortcuts/vc/helpers_test.go
@@ -12,12 +12,12 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
-func bareMeetingQueryRuntime(as core.Identity) *common.RuntimeContext {
+func bareMeetingQueryRuntime(as identitypkg.Identity) *common.RuntimeContext {
 	return common.TestNewRuntimeContextWithIdentity(&cobra.Command{Use: "test"}, defaultConfig(), as)
 }
 
@@ -32,12 +32,12 @@ func TestNormalizeMeetingQueryPermissionError_NilRuntimeReturnsOriginalError(t *
 func TestNormalizeMeetingQueryPermissionError_TypedNilReturnsOriginalError(t *testing.T) {
 	var permissionErr *errs.PermissionError
 	var original error = permissionErr
-	if got := normalizeMeetingQueryPermissionError(bareMeetingQueryRuntime(core.AsUser), original); got != original {
+	if got := normalizeMeetingQueryPermissionError(bareMeetingQueryRuntime(identitypkg.AsUser), original); got != original {
 		t.Fatalf("got %v, want original error %v", got, original)
 	}
 }
 
-func assertMeetingQueryPermissionError(t *testing.T, err error, identity core.Identity, code int) {
+func assertMeetingQueryPermissionError(t *testing.T, err error, identity identitypkg.Identity, code int) {
 	t.Helper()
 
 	var pe *errs.PermissionError
@@ -96,18 +96,18 @@ func assertMeetingQueryPermissionError(t *testing.T, err error, identity core.Id
 func TestNormalizeMeetingQueryPermissionError_RecommendsScopeForMatchingIdentity(t *testing.T) {
 	cases := []struct {
 		name     string
-		identity core.Identity
+		identity identitypkg.Identity
 		code     int
 		subtype  errs.Subtype
 	}{
-		{name: "user_with_user_scope_error", identity: core.AsUser, code: output.LarkErrUserScopeInsufficient, subtype: errs.SubtypeMissingScope},
-		{name: "bot_with_app_scope_error", identity: core.AsBot, code: output.LarkErrAppScopeNotEnabled, subtype: errs.SubtypeAppScopeNotApplied},
+		{name: "user_with_user_scope_error", identity: identitypkg.AsUser, code: output.LarkErrUserScopeInsufficient, subtype: errs.SubtypeMissingScope},
+		{name: "bot_with_app_scope_error", identity: identitypkg.AsBot, code: output.LarkErrAppScopeNotEnabled, subtype: errs.SubtypeAppScopeNotApplied},
 	}
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			wantScope := meetingQueryUserScope
-			if tc.identity == core.AsBot {
+			if tc.identity == identitypkg.AsBot {
 				wantScope = meetingQueryBotScope
 			}
 			wantMessage := "access denied for " + string(tc.identity) + " identity; recommended scope: " + wantScope
@@ -119,7 +119,7 @@ func TestNormalizeMeetingQueryPermissionError_RecommendsScopeForMatchingIdentity
 				WithMissingScopes(meetingQueryUserScope, meetingQueryBotScope).
 				WithRequestedScopes("requested:scope").
 				WithGrantedScopes("granted:scope")
-			if tc.identity == core.AsBot {
+			if tc.identity == identitypkg.AsBot {
 				original.ConsoleURL = "https://example.com/scopes"
 			}
 			original.Troubleshooter = "https://example.com/troubleshoot"
@@ -141,7 +141,7 @@ func TestNormalizeMeetingQueryPermissionError_RecommendsScopeForMatchingIdentity
 			if pe.Message != wantMessage {
 				t.Fatalf("Message = %q, want %q", pe.Message, wantMessage)
 			}
-			if tc.identity == core.AsBot {
+			if tc.identity == identitypkg.AsBot {
 				consoleURL, err := url.Parse(pe.ConsoleURL)
 				if err != nil {
 					t.Fatalf("ConsoleURL = %q is invalid: %v", pe.ConsoleURL, err)
@@ -160,24 +160,24 @@ func TestNormalizeMeetingQueryPermissionError_RecommendsScopeForMatchingIdentity
 func TestNormalizeMeetingQueryPermissionError_PassesThroughNonMatchingErrors(t *testing.T) {
 	cases := []struct {
 		name     string
-		identity core.Identity
+		identity identitypkg.Identity
 		err      error
 	}{
 		{
 			name:     "user_with_app_scope_error",
-			identity: core.AsUser,
+			identity: identitypkg.AsUser,
 			err: errs.NewPermissionError(errs.SubtypeAppScopeNotApplied, "app scope error").
 				WithCode(output.LarkErrAppScopeNotEnabled),
 		},
 		{
 			name:     "bot_with_user_scope_error",
-			identity: core.AsBot,
+			identity: identitypkg.AsBot,
 			err: errs.NewPermissionError(errs.SubtypeMissingScope, "user scope error").
 				WithCode(output.LarkErrUserScopeInsufficient),
 		},
 		{
 			name:     "auto_with_user_scope_error",
-			identity: core.AsAuto,
+			identity: identitypkg.AsAuto,
 			err: errs.NewPermissionError(errs.SubtypeMissingScope, "auto identity").
 				WithCode(output.LarkErrUserScopeInsufficient),
 		},
@@ -197,7 +197,7 @@ func TestNormalizeMeetingQueryPermissionError_PassesThroughNonMatchingErrors(t *
 		t.Run(tc.name, func(t *testing.T) {
 			identity := tc.identity
 			if identity == "" {
-				identity = core.AsBot
+				identity = identitypkg.AsBot
 			}
 			if got := normalizeMeetingQueryPermissionError(bareMeetingQueryRuntime(identity), tc.err); got != tc.err {
 				t.Fatalf("got %T %v, want original error %T %v", got, got, tc.err, tc.err)
diff --git a/shortcuts/vc/vc_meeting_events.go b/shortcuts/vc/vc_meeting_events.go
index e4f20f7460..57b65d82ae 100644
--- a/shortcuts/vc/vc_meeting_events.go
+++ b/shortcuts/vc/vc_meeting_events.go
@@ -16,7 +16,7 @@ import (
 	"unicode"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -208,7 +208,7 @@ func buildMeetingEventsOutput(data map[string]interface{}, events []interface{},
 }
 
 func meetingEventsCurrentIdentity(runtime *common.RuntimeContext) (meetingEventsIdentity, string) {
-	if runtime.As() == core.AsBot {
+	if runtime.As() == identitypkg.AsBot {
 		botInfo, err := runtime.BotInfo()
 		if err != nil {
 			return meetingEventsBotIdentity(nil), fmt.Sprintf("identity unavailable: %v", err)
diff --git a/shortcuts/vc/vc_meeting_test.go b/shortcuts/vc/vc_meeting_test.go
index 89e053728c..d6c3a9207f 100644
--- a/shortcuts/vc/vc_meeting_test.go
+++ b/shortcuts/vc/vc_meeting_test.go
@@ -16,8 +16,8 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -733,7 +733,7 @@ func TestMeetingListActive_Execute_BotPassesUserID(t *testing.T) {
 func TestMeetingListActive_DryRun_BotValidationErrorEnvelope(t *testing.T) {
 	cmd := &cobra.Command{Use: "+meeting-list-active"}
 	cmd.Flags().String("user-id", "", "")
-	runtime := common.TestNewRuntimeContextWithIdentity(cmd, defaultConfig(), core.AsBot)
+	runtime := common.TestNewRuntimeContextWithIdentity(cmd, defaultConfig(), identity.AsBot)
 
 	dry := VCMeetingListActive.DryRun(context.Background(), runtime)
 	if dry == nil {
@@ -765,7 +765,7 @@ func TestMeetingListActive_DryRun_BotSendsUserID(t *testing.T) {
 func TestMeetingListActive_Execute_ValidationError(t *testing.T) {
 	cmd := &cobra.Command{Use: "+meeting-list-active"}
 	cmd.Flags().String("user-id", "", "")
-	runtime := common.TestNewRuntimeContextWithIdentity(cmd, defaultConfig(), core.AsBot)
+	runtime := common.TestNewRuntimeContextWithIdentity(cmd, defaultConfig(), identity.AsBot)
 
 	err := VCMeetingListActive.Execute(context.Background(), runtime)
 	if err == nil {
diff --git a/shortcuts/wiki/wiki_async_task_test.go b/shortcuts/wiki/wiki_async_task_test.go
index 57a56203a4..577a8b41a9 100644
--- a/shortcuts/wiki/wiki_async_task_test.go
+++ b/shortcuts/wiki/wiki_async_task_test.go
@@ -11,7 +11,7 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/identity"
 )
 
 // pollWikiAsyncTask is shared infrastructure for every wiki delete shortcut,
@@ -21,7 +21,7 @@ import (
 func TestPollWikiAsyncTaskSuccessFirstPoll(t *testing.T) {
 	t.Parallel()
 
-	runtime, stderr := newWikiNodeDeleteRuntime(t, core.AsUser)
+	runtime, stderr := newWikiNodeDeleteRuntime(t, identity.AsUser)
 	status, ready, err := pollWikiAsyncTask(
 		context.Background(), runtime, "task_ok", "delete-node", 3, 0,
 		func(context.Context, string) (wikiAsyncTaskStatus, error) {
@@ -43,7 +43,7 @@ func TestPollWikiAsyncTaskSuccessFirstPoll(t *testing.T) {
 func TestPollWikiAsyncTaskFailureIsTerminal(t *testing.T) {
 	t.Parallel()
 
-	runtime, _ := newWikiNodeDeleteRuntime(t, core.AsUser)
+	runtime, _ := newWikiNodeDeleteRuntime(t, identity.AsUser)
 	_, ready, err := pollWikiAsyncTask(
 		context.Background(), runtime, "task_x", "delete-node", 3, 0,
 		func(context.Context, string) (wikiAsyncTaskStatus, error) {
@@ -62,7 +62,7 @@ func TestPollWikiAsyncTaskFailureIsTerminal(t *testing.T) {
 func TestPollWikiAsyncTaskTimeoutWhenAlwaysProcessing(t *testing.T) {
 	t.Parallel()
 
-	runtime, _ := newWikiNodeDeleteRuntime(t, core.AsUser)
+	runtime, _ := newWikiNodeDeleteRuntime(t, identity.AsUser)
 	status, ready, err := pollWikiAsyncTask(
 		context.Background(), runtime, "task_slow", "delete-space", 2, 0,
 		func(context.Context, string) (wikiAsyncTaskStatus, error) {
@@ -87,7 +87,7 @@ func TestPollWikiAsyncTaskTimeoutWhenAlwaysProcessing(t *testing.T) {
 func TestPollWikiAsyncTaskAllPollsFailWrapsWithResumeHint(t *testing.T) {
 	t.Parallel()
 
-	runtime, stderr := newWikiNodeDeleteRuntime(t, core.AsUser)
+	runtime, stderr := newWikiNodeDeleteRuntime(t, identity.AsUser)
 	transportErr := errors.New("transport boom")
 	_, ready, err := pollWikiAsyncTask(
 		context.Background(), runtime, "task_lost", "delete-node", 2, 0,
@@ -131,7 +131,7 @@ func TestParseWikiAsyncTaskStatusRejectsNilTask(t *testing.T) {
 func TestPollWikiAsyncTaskPrependsUpstreamExitHint(t *testing.T) {
 	t.Parallel()
 
-	runtime, _ := newWikiNodeDeleteRuntime(t, core.AsUser)
+	runtime, _ := newWikiNodeDeleteRuntime(t, identity.AsUser)
 	// The upstream poll error is a typed error carrying its own hint, mirroring
 	// what runtime.CallAPITyped produces for a permission failure.
 	upstream := errs.NewPermissionError(errs.SubtypePermissionDenied, "permission denied").
@@ -166,7 +166,7 @@ func TestPollWikiAsyncTaskPrependsUpstreamExitHint(t *testing.T) {
 func TestPollWikiAsyncTaskHonoursContextCancellation(t *testing.T) {
 	t.Parallel()
 
-	runtime, _ := newWikiNodeDeleteRuntime(t, core.AsUser)
+	runtime, _ := newWikiNodeDeleteRuntime(t, identity.AsUser)
 	ctx, cancel := context.WithCancel(context.Background())
 	calls := 0
 	_, ready, err := pollWikiAsyncTask(
diff --git a/shortcuts/wiki/wiki_delete.go b/shortcuts/wiki/wiki_delete.go
index 3c3eb8358c..a792342b68 100644
--- a/shortcuts/wiki/wiki_delete.go
+++ b/shortcuts/wiki/wiki_delete.go
@@ -10,7 +10,7 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -191,7 +191,7 @@ func runWikiDeleteSpace(ctx context.Context, client wikiDeleteSpaceClient, runti
 	return out, nil
 }
 
-func wikiDeleteSpaceTaskResultCommand(taskID string, identity core.Identity) string {
+func wikiDeleteSpaceTaskResultCommand(taskID string, identity identitypkg.Identity) string {
 	asFlag := string(identity)
 	if asFlag == "" {
 		asFlag = "user"
diff --git a/shortcuts/wiki/wiki_delete_test.go b/shortcuts/wiki/wiki_delete_test.go
index b2772884ec..5e23d92f7f 100644
--- a/shortcuts/wiki/wiki_delete_test.go
+++ b/shortcuts/wiki/wiki_delete_test.go
@@ -15,10 +15,10 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -74,7 +74,7 @@ func withSingleWikiDeleteSpacePoll(t *testing.T) {
 	})
 }
 
-func newWikiDeleteSpaceRuntimeWithScopes(t *testing.T, as core.Identity, scopes string) (*common.RuntimeContext, *bytes.Buffer) {
+func newWikiDeleteSpaceRuntimeWithScopes(t *testing.T, as identity.Identity, scopes string) (*common.RuntimeContext, *bytes.Buffer) {
 	t.Helper()
 
 	cfg := wikiTestConfig()
@@ -164,7 +164,7 @@ func TestWikiDeleteSpaceDryRunIncludesTaskPoll(t *testing.T) {
 func TestRunWikiDeleteSpaceSync(t *testing.T) {
 	t.Parallel()
 
-	runtime, _ := newWikiDeleteSpaceRuntimeWithScopes(t, core.AsUser, "")
+	runtime, _ := newWikiDeleteSpaceRuntimeWithScopes(t, identity.AsUser, "")
 	client := &fakeWikiDeleteSpaceClient{
 		deleteResp: &wikiDeleteSpaceResponse{},
 	}
@@ -192,7 +192,7 @@ func TestRunWikiDeleteSpaceSync(t *testing.T) {
 func TestRunWikiDeleteSpaceAsyncReady(t *testing.T) {
 	withSingleWikiDeleteSpacePoll(t)
 
-	runtime, stderr := newWikiDeleteSpaceRuntimeWithScopes(t, core.AsUser, "")
+	runtime, stderr := newWikiDeleteSpaceRuntimeWithScopes(t, identity.AsUser, "")
 	client := &fakeWikiDeleteSpaceClient{
 		deleteResp: &wikiDeleteSpaceResponse{TaskID: "task_123"},
 		taskStatuses: []wikiDeleteSpaceTaskStatus{{
@@ -215,7 +215,7 @@ func TestRunWikiDeleteSpaceAsyncReady(t *testing.T) {
 func TestRunWikiDeleteSpaceAsyncTimeoutReturnsNextCommand(t *testing.T) {
 	withSingleWikiDeleteSpacePoll(t)
 
-	runtime, stderr := newWikiDeleteSpaceRuntimeWithScopes(t, core.AsUser, "")
+	runtime, stderr := newWikiDeleteSpaceRuntimeWithScopes(t, identity.AsUser, "")
 	client := &fakeWikiDeleteSpaceClient{
 		deleteResp: &wikiDeleteSpaceResponse{TaskID: "task_123"},
 		taskStatuses: []wikiDeleteSpaceTaskStatus{{
@@ -227,7 +227,7 @@ func TestRunWikiDeleteSpaceAsyncTimeoutReturnsNextCommand(t *testing.T) {
 	if err != nil {
 		t.Fatalf("runWikiDeleteSpace() error = %v", err)
 	}
-	wantNext := wikiDeleteSpaceTaskResultCommand("task_123", core.AsUser)
+	wantNext := wikiDeleteSpaceTaskResultCommand("task_123", identity.AsUser)
 	if out["ready"] != false || out["timed_out"] != true || out["next_command"] != wantNext {
 		t.Fatalf("expected timeout response, got %#v", out)
 	}
@@ -245,7 +245,7 @@ func TestRunWikiDeleteSpaceAsyncTimeoutReturnsNextCommand(t *testing.T) {
 func TestRunWikiDeleteSpaceAsyncFailure(t *testing.T) {
 	withSingleWikiDeleteSpacePoll(t)
 
-	runtime, _ := newWikiDeleteSpaceRuntimeWithScopes(t, core.AsUser, "")
+	runtime, _ := newWikiDeleteSpaceRuntimeWithScopes(t, identity.AsUser, "")
 	client := &fakeWikiDeleteSpaceClient{
 		deleteResp: &wikiDeleteSpaceResponse{TaskID: "task_123"},
 		taskStatuses: []wikiDeleteSpaceTaskStatus{{
@@ -265,7 +265,7 @@ func TestRunWikiDeleteSpaceAsyncFailure(t *testing.T) {
 func TestPollWikiDeleteSpaceTaskWrapsPollFailuresWithHint(t *testing.T) {
 	withSingleWikiDeleteSpacePoll(t)
 
-	runtime, stderr := newWikiDeleteSpaceRuntimeWithScopes(t, core.AsUser, "")
+	runtime, stderr := newWikiDeleteSpaceRuntimeWithScopes(t, identity.AsUser, "")
 	// Seed a typed error that carries an upstream Lark code and hint so the test
 	// pins that structured fields survive a fully failed poll (not just the
 	// hint): the poll-exhaustion path must propagate the typed error in place.
@@ -294,7 +294,7 @@ func TestPollWikiDeleteSpaceTaskWrapsPollFailuresWithHint(t *testing.T) {
 	if !ok {
 		t.Fatalf("expected a typed errs.* error, got %T %v", err, err)
 	}
-	if !strings.Contains(p.Hint, "retry original") || !strings.Contains(p.Hint, wikiDeleteSpaceTaskResultCommand("task_123", core.AsUser)) {
+	if !strings.Contains(p.Hint, "retry original") || !strings.Contains(p.Hint, wikiDeleteSpaceTaskResultCommand("task_123", identity.AsUser)) {
 		t.Fatalf("hint = %q, want original hint and resume command", p.Hint)
 	}
 	if p.Code != 131006 {
diff --git a/shortcuts/wiki/wiki_move.go b/shortcuts/wiki/wiki_move.go
index 8ee798bcc5..5c1bd1b3be 100644
--- a/shortcuts/wiki/wiki_move.go
+++ b/shortcuts/wiki/wiki_move.go
@@ -10,7 +10,7 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -566,7 +566,7 @@ func runWikiDocsToWikiMove(ctx context.Context, client wikiMoveClient, runtime *
 	}
 }
 
-func wikiMoveTaskResultCommand(taskID string, identity core.Identity) string {
+func wikiMoveTaskResultCommand(taskID string, identity identitypkg.Identity) string {
 	asFlag := string(identity)
 	if asFlag == "" {
 		asFlag = "user"
diff --git a/shortcuts/wiki/wiki_move_test.go b/shortcuts/wiki/wiki_move_test.go
index 6d9a7e64f9..20883bcc1b 100644
--- a/shortcuts/wiki/wiki_move_test.go
+++ b/shortcuts/wiki/wiki_move_test.go
@@ -19,6 +19,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -138,7 +139,7 @@ func withSingleWikiMovePoll(t *testing.T) {
 	})
 }
 
-func newWikiMoveRuntimeWithScopes(t *testing.T, as core.Identity, scopes string) (*common.RuntimeContext, *bytes.Buffer) {
+func newWikiMoveRuntimeWithScopes(t *testing.T, as identity.Identity, scopes string) (*common.RuntimeContext, *bytes.Buffer) {
 	t.Helper()
 
 	cfg := wikiTestConfig()
@@ -547,7 +548,7 @@ func TestRunWikiNodeMoveReturnsResolvedMetadata(t *testing.T) {
 func TestRunWikiMoveDispatchesByMode(t *testing.T) {
 	t.Parallel()
 
-	runtime, _ := newWikiMoveRuntimeWithScopes(t, core.AsUser, "")
+	runtime, _ := newWikiMoveRuntimeWithScopes(t, identity.AsUser, "")
 	client := &fakeWikiMoveClient{
 		docsResp: &wikiMoveDocsResponse{WikiToken: "wik_ready"},
 		moveNode: &wikiNodeRecord{SpaceID: "space_dst", NodeToken: "wik_node"},
@@ -581,7 +582,7 @@ func TestRunWikiMoveDispatchesByMode(t *testing.T) {
 func TestRunWikiDocsToWikiMoveSyncReady(t *testing.T) {
 	t.Parallel()
 
-	runtime, _ := newWikiMoveRuntimeWithScopes(t, core.AsUser, "")
+	runtime, _ := newWikiMoveRuntimeWithScopes(t, identity.AsUser, "")
 	client := &fakeWikiMoveClient{
 		docsResp: &wikiMoveDocsResponse{WikiToken: "wik_ready"},
 	}
@@ -608,7 +609,7 @@ func TestRunWikiDocsToWikiMoveSyncReady(t *testing.T) {
 func TestRunWikiDocsToWikiMoveApplied(t *testing.T) {
 	t.Parallel()
 
-	runtime, _ := newWikiMoveRuntimeWithScopes(t, core.AsUser, "")
+	runtime, _ := newWikiMoveRuntimeWithScopes(t, identity.AsUser, "")
 	client := &fakeWikiMoveClient{
 		docsResp: &wikiMoveDocsResponse{Applied: true},
 	}
@@ -632,7 +633,7 @@ func TestRunWikiDocsToWikiMoveApplied(t *testing.T) {
 func TestRunWikiDocsToWikiMoveAsyncReady(t *testing.T) {
 	withSingleWikiMovePoll(t)
 
-	runtime, stderr := newWikiMoveRuntimeWithScopes(t, core.AsUser, "")
+	runtime, stderr := newWikiMoveRuntimeWithScopes(t, identity.AsUser, "")
 	client := &fakeWikiMoveClient{
 		docsResp: &wikiMoveDocsResponse{TaskID: "task_123"},
 		taskStatuses: []wikiMoveTaskStatus{{
@@ -673,7 +674,7 @@ func TestRunWikiDocsToWikiMoveAsyncReady(t *testing.T) {
 func TestRunWikiDocsToWikiMoveAsyncTimeoutReturnsNextCommand(t *testing.T) {
 	withSingleWikiMovePoll(t)
 
-	runtime, stderr := newWikiMoveRuntimeWithScopes(t, core.AsUser, "")
+	runtime, stderr := newWikiMoveRuntimeWithScopes(t, identity.AsUser, "")
 	client := &fakeWikiMoveClient{
 		docsResp: &wikiMoveDocsResponse{TaskID: "task_123"},
 		taskStatuses: []wikiMoveTaskStatus{{
@@ -689,7 +690,7 @@ func TestRunWikiDocsToWikiMoveAsyncTimeoutReturnsNextCommand(t *testing.T) {
 	if err != nil {
 		t.Fatalf("runWikiDocsToWikiMove() error = %v", err)
 	}
-	if out["ready"] != false || out["timed_out"] != true || out["next_command"] != wikiMoveTaskResultCommand("task_123", core.AsUser) {
+	if out["ready"] != false || out["timed_out"] != true || out["next_command"] != wikiMoveTaskResultCommand("task_123", identity.AsUser) {
 		t.Fatalf("expected timeout response, got %#v", out)
 	}
 	if out["status_msg"] != "processing" {
@@ -703,7 +704,7 @@ func TestRunWikiDocsToWikiMoveAsyncTimeoutReturnsNextCommand(t *testing.T) {
 func TestRunWikiDocsToWikiMoveAsyncFailureReturnsStructuredError(t *testing.T) {
 	withSingleWikiMovePoll(t)
 
-	runtime, _ := newWikiMoveRuntimeWithScopes(t, core.AsUser, "")
+	runtime, _ := newWikiMoveRuntimeWithScopes(t, identity.AsUser, "")
 	client := &fakeWikiMoveClient{
 		docsResp: &wikiMoveDocsResponse{TaskID: "task_123"},
 		taskStatuses: []wikiMoveTaskStatus{{
@@ -850,7 +851,7 @@ func TestWikiMoveExecuteDocsToWikiShortcutAsyncSuccess(t *testing.T) {
 func TestPollWikiMoveTaskWrapsRepeatedPollFailuresWithHint(t *testing.T) {
 	withSingleWikiMovePoll(t)
 
-	runtime, stderr := newWikiMoveRuntimeWithScopes(t, core.AsUser, "")
+	runtime, stderr := newWikiMoveRuntimeWithScopes(t, identity.AsUser, "")
 	client := &fakeWikiMoveClient{
 		taskErrs: []error{errs.NewAPIError(errs.SubtypeServerError, "poll failed").WithHint("retry original")},
 	}
@@ -869,7 +870,7 @@ func TestPollWikiMoveTaskWrapsRepeatedPollFailuresWithHint(t *testing.T) {
 	if !ok {
 		t.Fatalf("expected a typed errs.* error, got %T %v", err, err)
 	}
-	if !strings.Contains(p.Hint, "retry original") || !strings.Contains(p.Hint, wikiMoveTaskResultCommand("task_123", core.AsUser)) {
+	if !strings.Contains(p.Hint, "retry original") || !strings.Contains(p.Hint, wikiMoveTaskResultCommand("task_123", identity.AsUser)) {
 		t.Fatalf("hint = %q, want original hint and resume command", p.Hint)
 	}
 	if !strings.Contains(stderr.String(), "Wiki move status attempt 1/1 failed") {
diff --git a/shortcuts/wiki/wiki_move_to_drive.go b/shortcuts/wiki/wiki_move_to_drive.go
index 1eae6022a5..52f9688b67 100644
--- a/shortcuts/wiki/wiki_move_to_drive.go
+++ b/shortcuts/wiki/wiki_move_to_drive.go
@@ -11,7 +11,7 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -375,7 +375,7 @@ func parseWikiMoveToDriveTaskStatus(taskID string, task map[string]interface{})
 
 // Preserve the originating identity and profile so a resumed status lookup
 // uses the same credential context that created the async task.
-func wikiMoveToDriveTaskResultCommand(taskID string, identity core.Identity, profileName string) string {
+func wikiMoveToDriveTaskResultCommand(taskID string, identity identitypkg.Identity, profileName string) string {
 	asFlag := string(identity)
 	if asFlag == "" {
 		asFlag = "user"
@@ -399,7 +399,7 @@ func wikiMoveToDriveProfileName(runtime *common.RuntimeContext) string {
 	return runtime.Config.ProfileName
 }
 
-func wrapWikiMoveToDrivePollContextError(err error, taskID string, identity core.Identity, profileName string) error {
+func wrapWikiMoveToDrivePollContextError(err error, taskID string, identity identitypkg.Identity, profileName string) error {
 	if err == nil {
 		return nil
 	}
diff --git a/shortcuts/wiki/wiki_move_to_drive_test.go b/shortcuts/wiki/wiki_move_to_drive_test.go
index 76eb10e5fe..efcd4c01a9 100644
--- a/shortcuts/wiki/wiki_move_to_drive_test.go
+++ b/shortcuts/wiki/wiki_move_to_drive_test.go
@@ -15,8 +15,8 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -76,7 +76,7 @@ func withWikiMoveToDrivePoll(t *testing.T, attempts int) {
 	})
 }
 
-func newWikiMoveToDriveRuntime(t *testing.T, identity core.Identity) (*common.RuntimeContext, *bytes.Buffer) {
+func newWikiMoveToDriveRuntime(t *testing.T, identity identitypkg.Identity) (*common.RuntimeContext, *bytes.Buffer) {
 	t.Helper()
 	cfg := wikiTestConfig()
 	factory, _, stderr, _ := cmdutil.TestFactory(t, cfg)
@@ -225,7 +225,7 @@ func TestParseWikiMoveToDriveTaskStatus(t *testing.T) {
 
 func TestRunWikiMoveToDriveSuccess(t *testing.T) {
 	withSingleWikiMoveToDrivePoll(t)
-	runtime, stderr := newWikiMoveToDriveRuntime(t, core.AsUser)
+	runtime, stderr := newWikiMoveToDriveRuntime(t, identitypkg.AsUser)
 	client := &fakeWikiMoveToDriveClient{
 		moveTaskID: "raw-task-signature",
 		taskStatus: []wikiMoveToDriveTaskStatus{{
@@ -260,7 +260,7 @@ func TestRunWikiMoveToDriveSuccess(t *testing.T) {
 
 func TestRunWikiMoveToDriveTimeoutReturnsResumeCommand(t *testing.T) {
 	withSingleWikiMoveToDrivePoll(t)
-	runtime, _ := newWikiMoveToDriveRuntime(t, core.AsBot)
+	runtime, _ := newWikiMoveToDriveRuntime(t, identitypkg.AsBot)
 	runtime.Config.ProfileName = "secondary"
 	client := &fakeWikiMoveToDriveClient{
 		moveTaskID: "raw-task-signature",
@@ -284,7 +284,7 @@ func TestRunWikiMoveToDriveTimeoutReturnsResumeCommand(t *testing.T) {
 
 func TestPollWikiMoveToDriveContinuesFromProcessingToSuccess(t *testing.T) {
 	withWikiMoveToDrivePoll(t, 2)
-	runtime, _ := newWikiMoveToDriveRuntime(t, core.AsUser)
+	runtime, _ := newWikiMoveToDriveRuntime(t, identitypkg.AsUser)
 	client := &fakeWikiMoveToDriveClient{
 		taskStatus: []wikiMoveToDriveTaskStatus{
 			{Status: wikiMoveToDriveStatusProcessing},
@@ -303,7 +303,7 @@ func TestPollWikiMoveToDriveContinuesFromProcessingToSuccess(t *testing.T) {
 
 func TestPollWikiMoveToDriveRecoversFromTransientError(t *testing.T) {
 	withWikiMoveToDrivePoll(t, 2)
-	runtime, _ := newWikiMoveToDriveRuntime(t, core.AsUser)
+	runtime, _ := newWikiMoveToDriveRuntime(t, identitypkg.AsUser)
 	requestTimeout := errs.NewNetworkError(errs.SubtypeNetworkTimeout, "temporary request timeout").
 		WithCause(context.DeadlineExceeded)
 	client := &fakeWikiMoveToDriveClient{
@@ -325,7 +325,7 @@ func TestPollWikiMoveToDriveRecoversFromTransientError(t *testing.T) {
 
 func TestPollWikiMoveToDriveDoesNotSwallowFinalCancellation(t *testing.T) {
 	withWikiMoveToDrivePoll(t, 2)
-	runtime, _ := newWikiMoveToDriveRuntime(t, core.AsUser)
+	runtime, _ := newWikiMoveToDriveRuntime(t, identitypkg.AsUser)
 	ctx, cancel := context.WithCancel(context.Background())
 	client := &fakeWikiMoveToDriveClient{
 		taskStatus: []wikiMoveToDriveTaskStatus{{Status: wikiMoveToDriveStatusProcessing}},
@@ -345,7 +345,7 @@ func TestPollWikiMoveToDriveDoesNotSwallowFinalCancellation(t *testing.T) {
 
 func TestRunWikiMoveToDriveFailureIsTypedAPIError(t *testing.T) {
 	withSingleWikiMoveToDrivePoll(t)
-	runtime, _ := newWikiMoveToDriveRuntime(t, core.AsUser)
+	runtime, _ := newWikiMoveToDriveRuntime(t, identitypkg.AsUser)
 	client := &fakeWikiMoveToDriveClient{
 		moveTaskID: "raw-task-signature",
 		taskStatus: []wikiMoveToDriveTaskStatus{{Status: wikiMoveToDriveStatusFailure, StatusMsg: "failure"}},
@@ -360,7 +360,7 @@ func TestRunWikiMoveToDriveFailureIsTypedAPIError(t *testing.T) {
 
 func TestPollWikiMoveToDrivePreservesTypedPollError(t *testing.T) {
 	withSingleWikiMoveToDrivePoll(t)
-	runtime, _ := newWikiMoveToDriveRuntime(t, core.AsUser)
+	runtime, _ := newWikiMoveToDriveRuntime(t, identitypkg.AsUser)
 	cause := errors.New("connection reset")
 	upstream := errs.NewNetworkError(errs.SubtypeNetworkTransport, "poll failed").
 		WithCode(503).
@@ -384,7 +384,7 @@ func TestPollWikiMoveToDrivePreservesTypedPollError(t *testing.T) {
 func TestWrapWikiMoveToDrivePollContextError(t *testing.T) {
 	t.Parallel()
 
-	err := wrapWikiMoveToDrivePollContextError(context.DeadlineExceeded, "task-id", core.AsUser, "secondary")
+	err := wrapWikiMoveToDrivePollContextError(context.DeadlineExceeded, "task-id", identitypkg.AsUser, "secondary")
 	if !errors.Is(err, context.DeadlineExceeded) {
 		t.Fatal("wrapped deadline must preserve context.DeadlineExceeded")
 	}
diff --git a/shortcuts/wiki/wiki_node_create.go b/shortcuts/wiki/wiki_node_create.go
index a03d7e2017..e878bf5dae 100644
--- a/shortcuts/wiki/wiki_node_create.go
+++ b/shortcuts/wiki/wiki_node_create.go
@@ -11,7 +11,7 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -219,7 +219,7 @@ func readWikiNodeCreateSpec(runtime *common.RuntimeContext) wikiNodeCreateSpec {
 	}
 }
 
-func validateWikiNodeCreateSpec(spec wikiNodeCreateSpec, identity core.Identity) error {
+func validateWikiNodeCreateSpec(spec wikiNodeCreateSpec, identity identitypkg.Identity) error {
 	if err := validateOptionalResourceName(spec.SpaceID, "--space-id"); err != nil {
 		return err
 	}
@@ -305,7 +305,7 @@ func needsMyLibraryLookup(spec wikiNodeCreateSpec) bool {
 	return spec.SpaceID == "" || spec.SpaceID == wikiMyLibrarySpaceID
 }
 
-func runWikiNodeCreate(ctx context.Context, client wikiNodeCreateClient, identity core.Identity, spec wikiNodeCreateSpec, errOut io.Writer) (*wikiNodeCreateExecution, error) {
+func runWikiNodeCreate(ctx context.Context, client wikiNodeCreateClient, identity identitypkg.Identity, spec wikiNodeCreateSpec, errOut io.Writer) (*wikiNodeCreateExecution, error) {
 	resolvedSpace, err := resolveWikiNodeCreateSpace(ctx, client, identity, spec)
 	if err != nil {
 		return nil, err
@@ -380,7 +380,7 @@ func wrapWikiNodeCreateRetryError(err error) error {
 
 // resolveWikiNodeCreateSpace applies the shortcut's precedence rules:
 // explicit space ID wins, then parent-node inference, then my_library fallback.
-func resolveWikiNodeCreateSpace(ctx context.Context, client wikiNodeCreateClient, identity core.Identity, spec wikiNodeCreateSpec) (wikiResolvedSpace, error) {
+func resolveWikiNodeCreateSpace(ctx context.Context, client wikiNodeCreateClient, identity identitypkg.Identity, spec wikiNodeCreateSpec) (wikiResolvedSpace, error) {
 	if spec.SpaceID != "" {
 		return resolveWikiNodeCreateSpaceFromExplicitSpace(ctx, client, spec)
 	}
diff --git a/shortcuts/wiki/wiki_node_create_test.go b/shortcuts/wiki/wiki_node_create_test.go
index e01ecb7803..8affdb7400 100644
--- a/shortcuts/wiki/wiki_node_create_test.go
+++ b/shortcuts/wiki/wiki_node_create_test.go
@@ -22,6 +22,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -174,7 +175,7 @@ func TestValidateWikiNodeCreateSpecRejectsShortcutWithoutOriginNodeToken(t *test
 	err := validateWikiNodeCreateSpec(wikiNodeCreateSpec{
 		NodeType: wikiNodeTypeShortcut,
 		ObjType:  "docx",
-	}, core.AsUser)
+	}, identity.AsUser)
 	if err == nil || !strings.Contains(err.Error(), "--origin-node-token is required") {
 		t.Fatalf("expected shortcut origin-token error, got %v", err)
 	}
@@ -187,7 +188,7 @@ func TestValidateWikiNodeCreateSpecRejectsOriginTokenForOriginNode(t *testing.T)
 		NodeType:        wikiNodeTypeOrigin,
 		ObjType:         "docx",
 		OriginNodeToken: "wik_origin",
-	}, core.AsUser)
+	}, identity.AsUser)
 	if err == nil || !strings.Contains(err.Error(), "can only be used when --node-type=shortcut") {
 		t.Fatalf("expected origin-node-token validation error, got %v", err)
 	}
@@ -199,7 +200,7 @@ func TestValidateWikiNodeCreateSpecRejectsBotWithoutLocation(t *testing.T) {
 	err := validateWikiNodeCreateSpec(wikiNodeCreateSpec{
 		NodeType: wikiNodeTypeOrigin,
 		ObjType:  "docx",
-	}, core.AsBot)
+	}, identity.AsBot)
 	if err == nil || !strings.Contains(err.Error(), "bot identity requires --space-id or --parent-node-token") {
 		t.Fatalf("expected bot location validation error, got %v", err)
 	}
@@ -214,7 +215,7 @@ func TestValidateWikiNodeCreateSpecRejectsBotMyLibrarySpaceID(t *testing.T) {
 		ObjType:         "docx",
 		SpaceID:         wikiMyLibrarySpaceID,
 		ParentNodeToken: "wik_parent",
-	}, core.AsBot)
+	}, identity.AsBot)
 	if err == nil || !strings.Contains(err.Error(), "bot identity does not support --space-id my_library") {
 		t.Fatalf("expected bot my_library validation error, got %v", err)
 	}
@@ -229,7 +230,7 @@ func TestResolveWikiNodeCreateSpaceUsesParentNode(t *testing.T) {
 		},
 	}
 
-	resolved, err := resolveWikiNodeCreateSpace(context.Background(), client, core.AsUser, wikiNodeCreateSpec{
+	resolved, err := resolveWikiNodeCreateSpace(context.Background(), client, identity.AsUser, wikiNodeCreateSpec{
 		NodeType:        wikiNodeTypeOrigin,
 		ObjType:         "docx",
 		ParentNodeToken: "wik_parent",
@@ -254,7 +255,7 @@ func TestResolveWikiNodeCreateSpaceRejectsSpaceMismatch(t *testing.T) {
 		},
 	}
 
-	_, err := resolveWikiNodeCreateSpace(context.Background(), client, core.AsUser, wikiNodeCreateSpec{
+	_, err := resolveWikiNodeCreateSpace(context.Background(), client, identity.AsUser, wikiNodeCreateSpec{
 		NodeType:        wikiNodeTypeOrigin,
 		ObjType:         "docx",
 		SpaceID:         "space_other",
@@ -274,7 +275,7 @@ func TestResolveWikiNodeCreateSpaceUsesMyLibraryFallback(t *testing.T) {
 		},
 	}
 
-	resolved, err := resolveWikiNodeCreateSpace(context.Background(), client, core.AsUser, wikiNodeCreateSpec{
+	resolved, err := resolveWikiNodeCreateSpace(context.Background(), client, identity.AsUser, wikiNodeCreateSpec{
 		NodeType: wikiNodeTypeOrigin,
 		ObjType:  "docx",
 	})
@@ -292,7 +293,7 @@ func TestResolveWikiNodeCreateSpaceUsesMyLibraryFallback(t *testing.T) {
 func TestResolveWikiNodeCreateSpaceRejectsBotWithoutLocation(t *testing.T) {
 	t.Parallel()
 
-	_, err := resolveWikiNodeCreateSpace(context.Background(), &fakeWikiNodeCreateClient{}, core.AsBot, wikiNodeCreateSpec{
+	_, err := resolveWikiNodeCreateSpace(context.Background(), &fakeWikiNodeCreateClient{}, identity.AsBot, wikiNodeCreateSpec{
 		NodeType: wikiNodeTypeOrigin,
 		ObjType:  "docx",
 	})
@@ -323,7 +324,7 @@ func TestRunWikiNodeCreateCreatesNodeInResolvedSpace(t *testing.T) {
 		ObjType:  "docx",
 		Title:    "Roadmap",
 	}
-	execution, err := runWikiNodeCreate(context.Background(), client, core.AsUser, spec, io.Discard)
+	execution, err := runWikiNodeCreate(context.Background(), client, identity.AsUser, spec, io.Discard)
 	if err != nil {
 		t.Fatalf("runWikiNodeCreate() error = %v", err)
 	}
@@ -351,7 +352,7 @@ func TestRunWikiNodeCreateRejectsNilCreatedNode(t *testing.T) {
 		returnNilNode: true,
 	}
 
-	_, err := runWikiNodeCreate(context.Background(), client, core.AsUser, wikiNodeCreateSpec{
+	_, err := runWikiNodeCreate(context.Background(), client, identity.AsUser, wikiNodeCreateSpec{
 		NodeType: wikiNodeTypeOrigin,
 		ObjType:  "docx",
 		Title:    "Roadmap",
@@ -873,7 +874,7 @@ func TestRunWikiNodeCreateRetriesOnLockContention(t *testing.T) {
 		ObjType:  "docx",
 		Title:    "Roadmap",
 	}
-	execution, err := runWikiNodeCreate(context.Background(), client, core.AsUser, spec, &stderr)
+	execution, err := runWikiNodeCreate(context.Background(), client, identity.AsUser, spec, &stderr)
 	if err != nil {
 		t.Fatalf("runWikiNodeCreate() error = %v", err)
 	}
@@ -912,7 +913,7 @@ func TestRunWikiNodeCreateRetriesExhausted(t *testing.T) {
 		ObjType:  "docx",
 		Title:    "Roadmap",
 	}
-	_, err := runWikiNodeCreate(context.Background(), client, core.AsUser, spec, &stderr)
+	_, err := runWikiNodeCreate(context.Background(), client, identity.AsUser, spec, &stderr)
 	if err == nil {
 		t.Fatalf("expected error after retries exhausted")
 	}
@@ -957,7 +958,7 @@ func TestRunWikiNodeCreateNoRetryOnNonContentionError(t *testing.T) {
 		ObjType:  "docx",
 		Title:    "Roadmap",
 	}
-	_, err := runWikiNodeCreate(context.Background(), client, core.AsUser, spec, &stderr)
+	_, err := runWikiNodeCreate(context.Background(), client, identity.AsUser, spec, &stderr)
 	if err == nil {
 		t.Fatalf("expected error")
 	}
@@ -994,7 +995,7 @@ func TestRunWikiNodeCreateRetriesOnFirstLockThenSucceeds(t *testing.T) {
 		ObjType:  "docx",
 		Title:    "Roadmap",
 	}
-	execution, err := runWikiNodeCreate(context.Background(), client, core.AsUser, spec, &stderr)
+	execution, err := runWikiNodeCreate(context.Background(), client, identity.AsUser, spec, &stderr)
 	if err != nil {
 		t.Fatalf("runWikiNodeCreate() error = %v", err)
 	}
@@ -1036,7 +1037,7 @@ func TestRunWikiNodeCreateRetryContextCancelled(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 
-	_, err := runWikiNodeCreate(ctx, client, core.AsUser, spec, &stderr)
+	_, err := runWikiNodeCreate(ctx, client, identity.AsUser, spec, &stderr)
 	if err == nil {
 		t.Fatalf("expected error due to context cancellation")
 	}
@@ -1072,7 +1073,7 @@ func TestRunWikiNodeCreateNoRetryOnSuccess(t *testing.T) {
 		ObjType:  "docx",
 		Title:    "Roadmap",
 	}
-	execution, err := runWikiNodeCreate(context.Background(), client, core.AsUser, spec, &stderr)
+	execution, err := runWikiNodeCreate(context.Background(), client, identity.AsUser, spec, &stderr)
 	if err != nil {
 		t.Fatalf("runWikiNodeCreate() error = %v", err)
 	}
diff --git a/shortcuts/wiki/wiki_node_delete.go b/shortcuts/wiki/wiki_node_delete.go
index fc33c507d3..e78012fc0b 100644
--- a/shortcuts/wiki/wiki_node_delete.go
+++ b/shortcuts/wiki/wiki_node_delete.go
@@ -11,7 +11,7 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	identitypkg "github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -384,7 +384,7 @@ func resolveWikiNodeDeleteSpaceID(ctx context.Context, client wikiNodeDeleteClie
 	return spaceID, nil
 }
 
-func wikiDeleteNodeTaskResultCommand(taskID string, identity core.Identity) string {
+func wikiDeleteNodeTaskResultCommand(taskID string, identity identitypkg.Identity) string {
 	asFlag := string(identity)
 	if asFlag == "" {
 		asFlag = "user"
diff --git a/shortcuts/wiki/wiki_node_delete_test.go b/shortcuts/wiki/wiki_node_delete_test.go
index 5e4190ddcc..ce50bb6b49 100644
--- a/shortcuts/wiki/wiki_node_delete_test.go
+++ b/shortcuts/wiki/wiki_node_delete_test.go
@@ -17,9 +17,9 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -231,7 +231,7 @@ func withSingleWikiDeleteNodePoll(t *testing.T) {
 	})
 }
 
-func newWikiNodeDeleteRuntime(t *testing.T, as core.Identity) (*common.RuntimeContext, *bytes.Buffer) {
+func newWikiNodeDeleteRuntime(t *testing.T, as identity.Identity) (*common.RuntimeContext, *bytes.Buffer) {
 	t.Helper()
 
 	cfg := wikiTestConfig()
@@ -244,7 +244,7 @@ func newWikiNodeDeleteRuntime(t *testing.T, as core.Identity) (*common.RuntimeCo
 func TestRunWikiNodeDeleteResolvesSpaceWhenMissing(t *testing.T) {
 	t.Parallel()
 
-	runtime, _ := newWikiNodeDeleteRuntime(t, core.AsUser)
+	runtime, _ := newWikiNodeDeleteRuntime(t, identity.AsUser)
 	client := &fakeWikiNodeDeleteClient{
 		resolveNode: &wikiNodeRecord{SpaceID: "space_resolved"},
 	}
@@ -271,7 +271,7 @@ func TestRunWikiNodeDeleteResolvesSpaceWhenMissing(t *testing.T) {
 func TestRunWikiNodeDeleteSkipsResolveWhenSpaceProvided(t *testing.T) {
 	t.Parallel()
 
-	runtime, _ := newWikiNodeDeleteRuntime(t, core.AsUser)
+	runtime, _ := newWikiNodeDeleteRuntime(t, identity.AsUser)
 	client := &fakeWikiNodeDeleteClient{}
 
 	_, err := runWikiNodeDelete(context.Background(), client, runtime, wikiNodeDeleteSpec{
@@ -291,7 +291,7 @@ func TestRunWikiNodeDeleteSkipsResolveWhenSpaceProvided(t *testing.T) {
 func TestRunWikiNodeDeleteAsyncReadyShape(t *testing.T) {
 	withSingleWikiDeleteNodePoll(t)
 
-	runtime, stderr := newWikiNodeDeleteRuntime(t, core.AsUser)
+	runtime, stderr := newWikiNodeDeleteRuntime(t, identity.AsUser)
 	client := &fakeWikiNodeDeleteClient{
 		deleteTaskID: "task_async_node",
 		taskStatuses: []wikiAsyncTaskStatus{{Status: "success"}},
@@ -314,7 +314,7 @@ func TestRunWikiNodeDeleteAsyncReadyShape(t *testing.T) {
 func TestRunWikiNodeDeleteAsyncTimeoutReturnsNextCommand(t *testing.T) {
 	withSingleWikiDeleteNodePoll(t)
 
-	runtime, _ := newWikiNodeDeleteRuntime(t, core.AsUser)
+	runtime, _ := newWikiNodeDeleteRuntime(t, identity.AsUser)
 	client := &fakeWikiNodeDeleteClient{
 		deleteTaskID: "task_async_node",
 		taskStatuses: []wikiAsyncTaskStatus{{Status: "processing"}},
@@ -326,7 +326,7 @@ func TestRunWikiNodeDeleteAsyncTimeoutReturnsNextCommand(t *testing.T) {
 	if err != nil {
 		t.Fatalf("runWikiNodeDelete() error = %v", err)
 	}
-	wantNext := wikiDeleteNodeTaskResultCommand("task_async_node", core.AsUser)
+	wantNext := wikiDeleteNodeTaskResultCommand("task_async_node", identity.AsUser)
 	if out["ready"] != false || out["timed_out"] != true || out["next_command"] != wantNext {
 		t.Fatalf("timeout output = %#v", out)
 	}
@@ -338,7 +338,7 @@ func TestRunWikiNodeDeleteAsyncTimeoutReturnsNextCommand(t *testing.T) {
 func TestRunWikiNodeDeleteAsyncFailureSurfacesReason(t *testing.T) {
 	withSingleWikiDeleteNodePoll(t)
 
-	runtime, _ := newWikiNodeDeleteRuntime(t, core.AsUser)
+	runtime, _ := newWikiNodeDeleteRuntime(t, identity.AsUser)
 	client := &fakeWikiNodeDeleteClient{
 		deleteTaskID: "task_async_node",
 		taskStatuses: []wikiAsyncTaskStatus{{Status: "failure", StatusMsg: "permission denied"}},

From 0266a7e9a1abc9aa3413e9a6c82ae92392dff8fc Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 14:16:38 +0800
Subject: [PATCH 43/50] refactor(core): rename remaining config package

---
 AGENTS.md                                     |  2 +-
 cmd/api/api.go                                |  4 +-
 cmd/api/api_paginate_test.go                  |  4 +-
 cmd/api/api_test.go                           | 84 +++++++++----------
 cmd/auth/auth_test.go                         | 24 +++---
 cmd/auth/check_test.go                        | 10 +--
 cmd/auth/list.go                              |  6 +-
 cmd/auth/login.go                             | 16 ++--
 cmd/auth/login_config_test.go                 | 20 ++---
 cmd/auth/login_strict_test.go                 |  8 +-
 cmd/auth/login_test.go                        | 34 ++++----
 cmd/auth/logout.go                            |  8 +-
 cmd/auth/logout_test.go                       | 48 +++++------
 cmd/auth/qrcode_test.go                       |  6 +-
 cmd/auth/scopes_test.go                       |  4 +-
 cmd/auth/status_test.go                       |  6 +-
 cmd/config/bind.go                            | 20 ++---
 cmd/config/bind_test.go                       | 32 +++----
 cmd/config/binder.go                          | 16 ++--
 cmd/config/binder_test.go                     | 10 +--
 cmd/config/config_test.go                     | 36 ++++----
 cmd/config/default_as.go                      |  8 +-
 cmd/config/init.go                            | 46 +++++-----
 cmd/config/init_interactive.go                |  6 +-
 cmd/config/init_test.go                       | 14 ++--
 cmd/config/remove.go                          |  8 +-
 cmd/config/risk_control.go                    |  8 +-
 cmd/config/risk_control_test.go               | 20 ++---
 cmd/config/show.go                            |  8 +-
 cmd/config/strict_mode.go                     | 26 +++---
 cmd/config/strict_mode_test.go                | 42 +++++-----
 cmd/config/strict_mode_warning_test.go        |  4 +-
 cmd/doctor/doctor.go                          |  6 +-
 cmd/doctor/doctor_test.go                     | 18 ++--
 cmd/event/bus_test.go                         |  4 +-
 cmd/event/format_helpers_test.go              |  4 +-
 cmd/event/list_test.go                        |  6 +-
 cmd/event/runtime_test.go                     |  4 +-
 cmd/event/schema_test.go                      | 22 ++---
 cmd/global_flags.go                           |  4 +-
 cmd/global_flags_test.go                      | 12 +--
 cmd/profile/add.go                            | 14 ++--
 cmd/profile/list.go                           |  4 +-
 cmd/profile/profile_test.go                   | 82 +++++++++---------
 cmd/profile/remove.go                         |  6 +-
 cmd/profile/rename.go                         |  8 +-
 cmd/profile/use.go                            |  6 +-
 cmd/root_integration_test.go                  | 10 +--
 cmd/root_test.go                              | 14 ++--
 cmd/schema/schema_test.go                     |  6 +-
 cmd/service/service.go                        |  6 +-
 cmd/service/service_paginate_test.go          |  4 +-
 cmd/service/service_test.go                   | 28 +++----
 cmd/startup_brand.go                          |  4 +-
 cmd/update/update.go                          |  4 +-
 cmd/update/update_test.go                     | 12 +--
 cmd/whoami/whoami.go                          |  4 +-
 cmd/whoami/whoami_test.go                     | 28 +++----
 internal/auth/uat_client.go                   |  4 +-
 internal/auth/uat_client_options_test.go      |  4 +-
 internal/client/client.go                     |  4 +-
 internal/client/client_test.go                | 14 ++--
 internal/client/dostream_test.go              |  4 +-
 internal/cmdutil/dryrun.go                    |  8 +-
 internal/cmdutil/dryrun_test.go               | 14 ++--
 internal/cmdutil/factory.go                   | 12 +--
 internal/cmdutil/factory_default.go           |  6 +-
 internal/cmdutil/factory_default_test.go      | 14 ++--
 internal/cmdutil/factory_http_test.go         | 14 ++--
 internal/cmdutil/factory_proxy_warn_test.go   |  6 +-
 internal/cmdutil/factory_test.go              | 62 +++++++-------
 internal/cmdutil/identity.go                  |  4 +-
 internal/cmdutil/identity_flag_test.go        | 12 +--
 internal/cmdutil/identity_test.go             |  6 +-
 internal/cmdutil/risk_control.go              |  4 +-
 internal/cmdutil/risk_control_test.go         | 10 +--
 internal/cmdutil/testing.go                   |  8 +-
 internal/cmdutil/testing_test.go              |  4 +-
 internal/{core => config}/config.go           |  2 +-
 internal/{core => config}/config_snapshot.go  |  2 +-
 .../{core => config}/config_snapshot_test.go  |  2 +-
 .../config_strict_mode_test.go                |  2 +-
 internal/{core => config}/config_test.go      |  2 +-
 internal/{core => config}/notconfigured.go    |  2 +-
 .../{core => config}/notconfigured_test.go    |  2 +-
 internal/credential/credential_provider.go    |  4 +-
 internal/credential/default_provider.go       | 10 +--
 internal/credential/integration_test.go       | 14 ++--
 internal/credential/types.go                  | 10 +--
 internal/credential/types_test.go             |  4 +-
 internal/identitydiag/diagnostics.go          | 18 ++--
 internal/identitydiag/diagnostics_test.go     | 40 ++++-----
 internal/output/emitter_legacy_compat_test.go |  4 +-
 .../application/slash_command_list_test.go    |  6 +-
 shortcuts/apps/apps_create_test.go            |  4 +-
 shortcuts/apps/apps_html_publish_test.go      |  4 +-
 shortcuts/apps/apps_init_test.go              |  4 +-
 shortcuts/apps/apps_meta_test.go              |  4 +-
 shortcuts/apps/apps_openapi_key_list_test.go  |  4 +-
 shortcuts/apps/apps_release_create_test.go    |  4 +-
 shortcuts/apps/apps_release_get_test.go       |  4 +-
 shortcuts/apps/apps_release_list_test.go      |  4 +-
 shortcuts/apps/apps_role_common_test.go       |  4 +-
 shortcuts/apps/git_credential.go              |  4 +-
 shortcuts/apps/git_credential_test.go         | 18 ++--
 shortcuts/base/base_execute_test.go           |  4 +-
 shortcuts/base/base_shortcuts_test.go         |  4 +-
 shortcuts/base/record_markdown_test.go        |  4 +-
 shortcuts/calendar/calendar_meeting_test.go   |  6 +-
 shortcuts/calendar/calendar_test.go           | 14 ++--
 shortcuts/common/call_api_typed_test.go       | 10 +--
 shortcuts/common/drive_media_upload_test.go   |  4 +-
 shortcuts/common/drive_meta_test.go           |  4 +-
 shortcuts/common/permission_grant_test.go     | 10 +--
 shortcuts/common/runner.go                    |  8 +-
 shortcuts/common/runner_botinfo_test.go       |  8 +-
 shortcuts/common/runner_contentsafety_test.go |  4 +-
 shortcuts/common/runner_identity_flag_test.go |  4 +-
 shortcuts/common/runner_jq_test.go            |  8 +-
 shortcuts/common/runner_lang_test.go          |  4 +-
 .../common/runner_partial_failure_test.go     |  4 +-
 shortcuts/common/runner_scope_test.go         |  8 +-
 shortcuts/common/testing.go                   | 12 +--
 shortcuts/common/testing_test.go              |  4 +-
 shortcuts/common/userids_test.go              |  4 +-
 shortcuts/contact/contact_search_user_test.go |  6 +-
 shortcuts/doc/doc_media_test.go               |  6 +-
 shortcuts/doc/docs_create_test.go             |  6 +-
 shortcuts/doc/docs_fetch_v2_test.go           |  6 +-
 shortcuts/drive/drive_import_test.go          |  6 +-
 shortcuts/drive/drive_inspect_test.go         | 36 ++++----
 shortcuts/drive/drive_io_test.go              | 44 +++++-----
 .../drive/drive_permission_grant_test.go      |  6 +-
 shortcuts/drive/drive_push_test.go            |  6 +-
 shortcuts/drive/drive_sync_test.go            | 66 +++++++--------
 shortcuts/event/processor_test.go             |  4 +-
 .../im/convert_lib/content_media_misc_test.go | 16 ++--
 shortcuts/im/convert_lib/runtime_test.go      |  6 +-
 shortcuts/im/helpers_network_test.go          |  6 +-
 shortcuts/im/im_feed_shortcut_test.go         |  4 +-
 shortcuts/mail/draft/service_test.go          |  4 +-
 shortcuts/mail/large_attachment_test.go       | 12 +--
 shortcuts/mail/mail_shortcut_test.go          |  6 +-
 shortcuts/mail/mail_signature_lang_test.go    |  4 +-
 shortcuts/mail/mail_watch_test.go             |  4 +-
 shortcuts/mail/signature_compose_test.go      |  4 +-
 shortcuts/markdown/markdown_test.go           | 10 +--
 shortcuts/minutes/minutes_download_test.go    |  6 +-
 shortcuts/minutes/minutes_search_test.go      |  4 +-
 shortcuts/note/note_transcript_test.go        |  8 +-
 shortcuts/okr/okr_batch_create_test.go        |  6 +-
 shortcuts/okr/okr_create_test.go              |  6 +-
 shortcuts/okr/okr_cycle_detail_test.go        |  6 +-
 shortcuts/okr/okr_cycle_list_test.go          |  6 +-
 shortcuts/okr/okr_image_upload_test.go        |  6 +-
 shortcuts/okr/okr_indicator_update_test.go    |  6 +-
 shortcuts/okr/okr_patch_test.go               |  6 +-
 shortcuts/okr/okr_progress_create_test.go     |  6 +-
 shortcuts/okr/okr_progress_delete_test.go     |  6 +-
 shortcuts/okr/okr_progress_get_test.go        |  6 +-
 shortcuts/okr/okr_progress_list_test.go       |  6 +-
 shortcuts/okr/okr_progress_update_test.go     |  6 +-
 shortcuts/okr/okr_reorder_test.go             |  6 +-
 shortcuts/okr/okr_weight_test.go              |  6 +-
 shortcuts/register_brand_guard_test.go        |  6 +-
 shortcuts/register_test.go                    |  4 +-
 .../backward/lark_sheets_sheet_create_test.go |  6 +-
 .../lark_sheets_sheet_write_image_test.go     |  6 +-
 shortcuts/sheets/helpers_test.go              |  6 +-
 .../sheets/sheet_media_parent_type_test.go    |  4 +-
 shortcuts/slides/slides_create_test.go        |  6 +-
 shortcuts/task/task_shortcut_test.go          |  6 +-
 shortcuts/vc/vc_notes_test.go                 |  6 +-
 shortcuts/vc/vc_search_test.go                | 16 ++--
 .../whiteboard/whiteboard_export_test.go      |  4 +-
 .../whiteboard/whiteboard_update_test.go      |  4 +-
 shortcuts/wiki/wiki_move_test.go              |  4 +-
 shortcuts/wiki/wiki_node_create_test.go       | 10 +--
 sidecar/server-demo/allowlist.go              |  4 +-
 sidecar/server-multi-tenant-demo/allowlist.go |  4 +-
 .../server-multi-tenant-demo/auth_bridge.go   | 10 +--
 181 files changed, 954 insertions(+), 954 deletions(-)
 rename internal/{core => config}/config.go (99%)
 rename internal/{core => config}/config_snapshot.go (98%)
 rename internal/{core => config}/config_snapshot_test.go (98%)
 rename internal/{core => config}/config_strict_mode_test.go (99%)
 rename internal/{core => config}/config_test.go (99%)
 rename internal/{core => config}/notconfigured.go (99%)
 rename internal/{core => config}/notconfigured_test.go (99%)

diff --git a/AGENTS.md b/AGENTS.md
index 0bfcd2093d..e79fa3325d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -62,7 +62,7 @@ Both notices recommend the same fix command: `lark-cli update`. The skills notic
 | `internal/credential/` | Credential provider chain (extension → default) |
 | `extension/credential/` | Plugin-facing credential interfaces and env provider |
 | `internal/client/client.go` | APIClient: DoSDKRequest, DoStream |
-| `internal/core/config.go` | Multi-profile config loading/saving |
+| `internal/config/config.go` | Multi-profile config loading/saving |
 | `internal/vfs/` | Filesystem abstraction (use `vfs.*` instead of `os.*`) |
 | `internal/validate/path.go` | Path safety validation |
 
diff --git a/cmd/api/api.go b/cmd/api/api.go
index 238ff06605..c8d09ad2db 100644
--- a/cmd/api/api.go
+++ b/cmd/api/api.go
@@ -13,7 +13,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
@@ -305,7 +305,7 @@ func apiRun(opts *APIOptions) error {
 	return nil
 }
 
-func apiDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, opts *APIOptions) error {
+func apiDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *configpkg.CliConfig, opts *APIOptions) error {
 	return cmdutil.PrintDryRun(request, config, dryRunOutputOptions(f, opts))
 }
 
diff --git a/cmd/api/api_paginate_test.go b/cmd/api/api_paginate_test.go
index 4626f22612..512bbd9dbb 100644
--- a/cmd/api/api_paginate_test.go
+++ b/cmd/api/api_paginate_test.go
@@ -17,7 +17,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
@@ -46,7 +46,7 @@ func newAPIPaginateTestHarness(t *testing.T) (*client.APIClient, *bytes.Buffer,
 	output.PendingNotice = nil
 	t.Cleanup(func() { output.PendingNotice = previousNotice })
 
-	config := &core.CliConfig{
+	config := &configpkg.CliConfig{
 		AppID:     "test-app",
 		AppSecret: "test-secret",
 		Brand:     brand.Feishu,
diff --git a/cmd/api/api_test.go b/cmd/api/api_test.go
index 697d652477..f7d8bb09e8 100644
--- a/cmd/api/api_test.go
+++ b/cmd/api/api_test.go
@@ -20,7 +20,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	extcs "github.com/larksuite/cli/extension/contentsafety"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/spf13/cobra"
@@ -42,7 +42,7 @@ func newTestRootCmd() *cobra.Command {
 }
 
 func TestApiCmd_FlagParsing(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -71,7 +71,7 @@ func TestApiCmd_FlagParsing(t *testing.T) {
 }
 
 func TestApiCmd_DryRun(t *testing.T) {
-	f, stdout, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, stderr, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -106,7 +106,7 @@ func TestApiCmd_DryRun(t *testing.T) {
 }
 
 func TestApiCmd_DryRunWithJq(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -124,7 +124,7 @@ func TestApiCmd_DryRunWithJq(t *testing.T) {
 // not panic. Symmetric to the typed-flag overlay path in cmd/service — both
 // write into the map ParseJSONMap returns.
 func TestApiCmd_NullParamsWithPageSize(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -139,7 +139,7 @@ func TestApiCmd_NullParamsWithPageSize(t *testing.T) {
 }
 
 func TestApiCmd_BotMode(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -172,7 +172,7 @@ func TestApiCmd_BotMode(t *testing.T) {
 }
 
 func TestApiCmd_MissingArgs(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -185,7 +185,7 @@ func TestApiCmd_MissingArgs(t *testing.T) {
 }
 
 func TestApiCmd_EmptyMethodRejected(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -201,7 +201,7 @@ func TestApiCmd_EmptyMethodRejected(t *testing.T) {
 }
 
 func TestApiCmd_InvalidParamsJSON(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -214,7 +214,7 @@ func TestApiCmd_InvalidParamsJSON(t *testing.T) {
 }
 
 func TestApiValidArgsFunction(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -280,7 +280,7 @@ func TestApiValidArgsFunction(t *testing.T) {
 }
 
 func TestNewCmdApi_StrictModeHidesAsFlag(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu, SupportedIdentities: 2,
 	})
 
@@ -298,7 +298,7 @@ func TestNewCmdApi_StrictModeHidesAsFlag(t *testing.T) {
 }
 
 func TestApiCmd_PageLimitDefault(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -318,7 +318,7 @@ func TestApiCmd_PageLimitDefault(t *testing.T) {
 }
 
 func TestApiCmd_ParamsAndDataBothStdinConflict(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -334,7 +334,7 @@ func TestApiCmd_ParamsAndDataBothStdinConflict(t *testing.T) {
 }
 
 func TestApiCmd_OutputAndPageAllConflict(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -357,7 +357,7 @@ func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
 	dir := t.TempDir()
 	cmdutil.TestChdir(t, dir)
 
-	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, stderr, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-bin", AppSecret: "test-secret-bin", Brand: brand.Feishu,
 	})
 
@@ -407,7 +407,7 @@ func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
 }
 
 func TestApiCmd_PageAll_NonBatchAPI_FallbackToJSON(t *testing.T) {
-	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, stderr, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-pageall1", AppSecret: "test-secret-pageall1", Brand: brand.Feishu,
 	})
 
@@ -451,7 +451,7 @@ func TestApiCmd_PageAll_NonBatchAPI_FallbackToJSON(t *testing.T) {
 }
 
 func TestApiCmd_PageAll_NonBatchAPI_ErrorStillOutputsJSON(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-pageall-err", AppSecret: "test-secret-pageall-err", Brand: brand.Feishu,
 	})
 
@@ -488,7 +488,7 @@ func TestApiCmd_PageAll_NonBatchAPI_ErrorStillOutputsJSON(t *testing.T) {
 }
 
 func TestApiCmd_PageAll_BatchAPI_StreamsItems(t *testing.T) {
-	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, stderr, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-pageall2", AppSecret: "test-secret-pageall2", Brand: brand.Feishu,
 	})
 
@@ -521,7 +521,7 @@ func TestApiCmd_PageAll_BatchAPI_StreamsItems(t *testing.T) {
 }
 
 func TestApiCmd_PageAll_StreamBusinessErrorDoesNotDumpJSON(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-pageall-stream-err", AppSecret: "test-secret-pageall-stream-err", Brand: brand.Feishu,
 	})
 
@@ -563,7 +563,7 @@ func TestApiCmd_PageAll_StreamBusinessErrorDoesNotDumpJSON(t *testing.T) {
 }
 
 func TestApiCmd_PageAll_BatchAPI_DefaultJSONEnvelope(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-pageall-json", AppSecret: "test-secret-pageall-json", Brand: brand.Feishu,
 	})
 
@@ -629,7 +629,7 @@ func TestApiCmd_PageAll_DefaultJSONRunsContentSafety(t *testing.T) {
 	extcs.Register(provider)
 	t.Cleanup(func() { extcs.Register(nil) })
 
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-pageall-safety", AppSecret: "test-secret-pageall-safety", Brand: brand.Feishu,
 	})
 
@@ -680,7 +680,7 @@ func TestApiCmd_PageAll_StreamFormatRunsContentSafety(t *testing.T) {
 	extcs.Register(provider)
 	t.Cleanup(func() { extcs.Register(nil) })
 
-	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, stderr, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-pageall-stream-safety", AppSecret: "test-secret-pageall-stream-safety", Brand: brand.Feishu,
 	})
 
@@ -725,7 +725,7 @@ func TestApiCmd_PageAll_StreamFormatBlockSkipsBlockedPage(t *testing.T) {
 	extcs.Register(provider)
 	t.Cleanup(func() { extcs.Register(nil) })
 
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-pageall-stream-block", AppSecret: "test-secret-pageall-stream-block", Brand: brand.Feishu,
 	})
 
@@ -811,7 +811,7 @@ func TestNormalisePath_StripsQueryAndFragment(t *testing.T) {
 }
 
 func TestApiCmd_JqFlag_Parsing(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -831,7 +831,7 @@ func TestApiCmd_JqFlag_Parsing(t *testing.T) {
 }
 
 func TestApiCmd_JqFlag_ShortForm(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -851,7 +851,7 @@ func TestApiCmd_JqFlag_ShortForm(t *testing.T) {
 }
 
 func TestApiCmd_JqAndOutputConflict(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -869,7 +869,7 @@ func TestApiCmd_JqAndOutputConflict(t *testing.T) {
 }
 
 func TestApiCmd_JqFilter_AppliesExpression(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-jq", AppSecret: "test-secret-jq", Brand: brand.Feishu,
 	})
 
@@ -903,7 +903,7 @@ func TestApiCmd_JqFilter_AppliesExpression(t *testing.T) {
 }
 
 func TestApiCmd_JqAndFormatConflict(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -921,7 +921,7 @@ func TestApiCmd_JqAndFormatConflict(t *testing.T) {
 }
 
 func TestApiCmd_JqInvalidExpression(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -939,7 +939,7 @@ func TestApiCmd_JqInvalidExpression(t *testing.T) {
 }
 
 func TestApiCmd_PageAll_WithJq(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-pjq", AppSecret: "test-secret-pjq", Brand: brand.Feishu,
 	})
 
@@ -970,7 +970,7 @@ func TestApiCmd_PageAll_WithJq(t *testing.T) {
 }
 
 func TestApiCmd_MethodUppercase(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -990,7 +990,7 @@ func TestApiCmd_MethodUppercase(t *testing.T) {
 }
 
 func TestApiCmd_FileFlagParsing(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	var gotOpts *APIOptions
@@ -1009,7 +1009,7 @@ func TestApiCmd_FileFlagParsing(t *testing.T) {
 }
 
 func TestApiCmd_FileAndOutputConflict(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
@@ -1026,7 +1026,7 @@ func TestApiCmd_FileAndOutputConflict(t *testing.T) {
 }
 
 func TestApiCmd_FileWithGET(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
@@ -1043,7 +1043,7 @@ func TestApiCmd_FileWithGET(t *testing.T) {
 }
 
 func TestApiCmd_FileStdinConflictWithData(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
@@ -1066,7 +1066,7 @@ func TestApiCmd_DryRunWithFile(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	cmd := newTestApiCmd(f, nil)
@@ -1104,7 +1104,7 @@ func TestApiCmd_DryRunWithFile(t *testing.T) {
 // — there is no raw-payload passthrough; new Lark diagnostic fields require
 // a CLI release.
 func TestApiCmd_PermissionError_DerivesFirstClassFields(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "cli_test_perm", AppSecret: "secret", Brand: brand.Feishu,
 	})
 
@@ -1143,7 +1143,7 @@ func TestApiCmd_PermissionError_DerivesFirstClassFields(t *testing.T) {
 }
 
 func TestApiCmd_JsonFlag_Accepted(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -1196,7 +1196,7 @@ func parseMultipartFilenames(t *testing.T, stub *httpmock.Stub) (map[string]stri
 }
 
 func TestApiCmd_FileUpload_PreservesFilename(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -1225,7 +1225,7 @@ func TestApiCmd_FileUpload_PreservesFilename(t *testing.T) {
 }
 
 func TestApiCmd_FileUpload_FieldPrefixKeepsBasename(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -1260,7 +1260,7 @@ func TestApiCmd_FileUpload_FieldPrefixKeepsBasename(t *testing.T) {
 }
 
 func TestApiCmd_FileUpload_WithDataFields(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -1293,7 +1293,7 @@ func TestApiCmd_FileUpload_WithDataFields(t *testing.T) {
 }
 
 func TestApiCmd_FileUpload_StdinFallsBackToUnknown(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	f.IOStreams.In = bytes.NewReader([]byte("stdin-bytes"))
diff --git a/cmd/auth/auth_test.go b/cmd/auth/auth_test.go
index d006727ee9..d6bf82a1f5 100644
--- a/cmd/auth/auth_test.go
+++ b/cmd/auth/auth_test.go
@@ -16,7 +16,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
@@ -24,7 +24,7 @@ import (
 )
 
 func TestAuthLoginCmd_FlagParsing(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -47,7 +47,7 @@ func TestAuthLoginCmd_FlagParsing(t *testing.T) {
 }
 
 func TestAuthLoginCmd_HelpGuidesNonStreamingAgentsToSplitFlow(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -73,7 +73,7 @@ func TestAuthLoginCmd_HelpGuidesNonStreamingAgentsToSplitFlow(t *testing.T) {
 }
 
 func TestAuthCheckCmd_FlagParsing(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -93,7 +93,7 @@ func TestAuthCheckCmd_FlagParsing(t *testing.T) {
 }
 
 func TestAuthCheckCmd_AcceptsJSONFlag(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -193,7 +193,7 @@ func TestAuthListCmd_AcceptsJSONFlag(t *testing.T) {
 }
 
 func TestAuthStatusCmd_FlagParsing(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -212,7 +212,7 @@ func TestAuthStatusCmd_FlagParsing(t *testing.T) {
 }
 
 func TestAuthStatusCmd_AcceptsJSONFlag(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -235,7 +235,7 @@ func TestAuthStatusCmd_AcceptsJSONFlag(t *testing.T) {
 }
 
 func TestAuthStatusCmd_VerifyFlag(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -337,7 +337,7 @@ func TestDomainFlagCompletion(t *testing.T) {
 }
 
 func TestAuthScopesCmd_FlagParsing(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -357,7 +357,7 @@ func TestAuthScopesCmd_FlagParsing(t *testing.T) {
 }
 
 func TestAuthScopesCmd_JSONFlagForcesJSONFormat(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -383,7 +383,7 @@ func TestAuthScopesCmd_JSONFlagForcesJSONFormat(t *testing.T) {
 }
 
 func TestAuthScopesRun_UsesTenantAccessTokenFromCredentialProvider(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "", Brand: brand.Feishu,
 	})
 	tokenResolver := &authScopesTokenResolver{}
@@ -439,7 +439,7 @@ func TestAuthScopesRun_UsesTenantAccessTokenFromCredentialProvider(t *testing.T)
 // getAppInfo classifies it as *errs.PermissionError carrying the server-
 // supplied MissingScopes — not a bare error wrapped as InternalError.
 func TestAuthScopesRun_LarkPermissionError_TypedAsPermissionError(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	tokenResolver := &authScopesTokenResolver{}
diff --git a/cmd/auth/check_test.go b/cmd/auth/check_test.go
index 046f08841b..49b3135f41 100644
--- a/cmd/auth/check_test.go
+++ b/cmd/auth/check_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/zalando/go-keyring"
 )
@@ -24,7 +24,7 @@ import (
 // branch. These tests pin that contract end-to-end through the dispatcher.
 
 func TestAuthCheckRun_NotLoggedIn_ExitOneWithStdoutOnly(t *testing.T) {
-	f, stdout, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, stderr, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		// UserOpenId left empty: triggers the not_logged_in branch.
 	})
@@ -56,7 +56,7 @@ func TestAuthCheckRun_NotLoggedIn_ExitOneWithStdoutOnly(t *testing.T) {
 }
 
 func TestAuthCheckRun_NoStoredToken_ExitOneWithStdoutOnly(t *testing.T) {
-	f, stdout, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, stderr, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		UserOpenId: "ou_user", UserName: "tester",
 	})
@@ -93,7 +93,7 @@ func TestAuthCheckRun_ScopedTokenPresent_ExitZero(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_DATA_DIR", t.TempDir())
 
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app",
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
@@ -151,7 +151,7 @@ func TestAuthCheckRun_EmptyScopeIsValidationError(t *testing.T) {
 	// Scope validation is a real input error, not a predicate negative
 	// answer — it must surface as a typed ValidationError with the normal
 	// stderr envelope, distinct from the silent ErrBare predicate path.
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
diff --git a/cmd/auth/list.go b/cmd/auth/list.go
index f345200a49..65f7512f99 100644
--- a/cmd/auth/list.go
+++ b/cmd/auth/list.go
@@ -12,7 +12,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 )
 
@@ -45,7 +45,7 @@ func NewCmdAuthList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Co
 func authListRun(opts *ListOptions) error {
 	f := opts.Factory
 
-	multi, _ := core.LoadMultiAppConfig()
+	multi, _ := configpkg.LoadMultiAppConfig()
 	if multi == nil || len(multi.Apps) == 0 {
 		if opts.JSON {
 			output.PrintJson(f.IOStreams.Out, map[string]interface{}{
@@ -61,7 +61,7 @@ func authListRun(opts *ListOptions) error {
 		// workspace-aware, so we pull the message+hint out of
 		// NotConfiguredError() instead of hard-coding it.
 		var cfgErr *errs.ConfigError
-		if errors.As(core.NotConfiguredError(), &cfgErr) {
+		if errors.As(configpkg.NotConfiguredError(), &cfgErr) {
 			fmt.Fprintln(f.IOStreams.ErrOut, cfgErr.Message)
 			if cfgErr.Hint != "" {
 				fmt.Fprintln(f.IOStreams.ErrOut, "  hint: "+cfgErr.Hint)
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index 7cd2cd7d64..f89fe7f577 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -18,7 +18,7 @@ import (
 
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
@@ -127,7 +127,7 @@ func authLoginRun(opts *LoginOptions) error {
 
 	// Determine UI language from saved config
 	var lang i18n.Lang
-	if multi, _ := core.LoadMultiAppConfig(); multi != nil {
+	if multi, _ := configpkg.LoadMultiAppConfig(); multi != nil {
 		if app := multi.FindApp(config.ProfileName); app != nil {
 			lang = app.Lang
 		}
@@ -393,7 +393,7 @@ func authLoginRun(opts *LoginOptions) error {
 
 // authLoginPollDeviceCode resumes the device flow by polling with a device code
 // obtained from a previous --no-wait call.
-func authLoginPollDeviceCode(opts *LoginOptions, config *core.CliConfig, msg *loginMsg, log func(string, ...interface{})) error {
+func authLoginPollDeviceCode(opts *LoginOptions, config *configpkg.CliConfig, msg *loginMsg, log func(string, ...interface{})) error {
 	f := opts.Factory
 
 	httpClient, err := f.HttpClient()
@@ -476,7 +476,7 @@ func authLoginPollDeviceCode(opts *LoginOptions, config *core.CliConfig, msg *lo
 
 // syncLoginUserToProfile persists the logged-in user info into the named profile.
 func syncLoginUserToProfile(profileName, appID, openID, userName string) error {
-	multi, err := core.LoadMultiAppConfig()
+	multi, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		return errs.NewInternalError(errs.SubtypeStorage, "load config: %v", err).WithCause(err)
 	}
@@ -486,9 +486,9 @@ func syncLoginUserToProfile(profileName, appID, openID, userName string) error {
 		return errs.NewConfigError(errs.SubtypeNotConfigured, "profile %q not found in config", profileName)
 	}
 
-	oldUsers := append([]core.AppUser(nil), app.Users...)
-	app.Users = []core.AppUser{{UserOpenId: openID, UserName: userName}}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	oldUsers := append([]configpkg.AppUser(nil), app.Users...)
+	app.Users = []configpkg.AppUser{{UserOpenId: openID, UserName: userName}}
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		return errs.NewInternalError(errs.SubtypeStorage, "save config: %v", err).WithCause(err)
 	}
 
@@ -501,7 +501,7 @@ func syncLoginUserToProfile(profileName, appID, openID, userName string) error {
 }
 
 // findProfileByName returns the AppConfig matching profileName, or nil.
-func findProfileByName(multi *core.MultiAppConfig, profileName string) *core.AppConfig {
+func findProfileByName(multi *configpkg.MultiAppConfig, profileName string) *configpkg.AppConfig {
 	for i := range multi.Apps {
 		if multi.Apps[i].ProfileName() == profileName {
 			return &multi.Apps[i]
diff --git a/cmd/auth/login_config_test.go b/cmd/auth/login_config_test.go
index 63f0095da2..fb772ac0e0 100644
--- a/cmd/auth/login_config_test.go
+++ b/cmd/auth/login_config_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 )
 
 func setupLoginConfigDir(t *testing.T) {
@@ -17,22 +17,22 @@ func setupLoginConfigDir(t *testing.T) {
 
 func TestSyncLoginUserToProfile_UpdatesOnlyTargetProfile(t *testing.T) {
 	setupLoginConfigDir(t)
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "target",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{
 				Name:  "target",
 				AppId: "app-target",
-				Users: []core.AppUser{{UserOpenId: "ou_old", UserName: "old"}},
+				Users: []configpkg.AppUser{{UserOpenId: "ou_old", UserName: "old"}},
 			},
 			{
 				Name:  "other",
 				AppId: "app-other",
-				Users: []core.AppUser{{UserOpenId: "ou_other", UserName: "other"}},
+				Users: []configpkg.AppUser{{UserOpenId: "ou_other", UserName: "other"}},
 			},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -40,7 +40,7 @@ func TestSyncLoginUserToProfile_UpdatesOnlyTargetProfile(t *testing.T) {
 		t.Fatalf("syncLoginUserToProfile() error = %v", err)
 	}
 
-	saved, err := core.LoadMultiAppConfig()
+	saved, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig() error = %v", err)
 	}
@@ -54,13 +54,13 @@ func TestSyncLoginUserToProfile_UpdatesOnlyTargetProfile(t *testing.T) {
 
 func TestSyncLoginUserToProfile_ProfileNotFoundReturnsError(t *testing.T) {
 	setupLoginConfigDir(t)
-	multi := &core.MultiAppConfig{
-		Apps: []core.AppConfig{{
+	multi := &configpkg.MultiAppConfig{
+		Apps: []configpkg.AppConfig{{
 			Name:  "default",
 			AppId: "app-default",
 		}},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
diff --git a/cmd/auth/login_strict_test.go b/cmd/auth/login_strict_test.go
index 206929bbaf..5cedf921dc 100644
--- a/cmd/auth/login_strict_test.go
+++ b/cmd/auth/login_strict_test.go
@@ -9,11 +9,11 @@ import (
 
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 )
 
 func TestAuthLogin_StrictModeBot_Blocked(t *testing.T) {
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID: "a", AppSecret: "s",
 		SupportedIdentities: uint8(extcred.SupportsBot),
 	}
@@ -39,7 +39,7 @@ func TestAuthLogin_StrictModeBot_Blocked(t *testing.T) {
 }
 
 func TestAuthLogin_StrictModeUser_Allowed(t *testing.T) {
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID: "a", AppSecret: "s",
 		SupportedIdentities: uint8(extcred.SupportsUser),
 	}
@@ -62,7 +62,7 @@ func TestAuthLogin_StrictModeUser_Allowed(t *testing.T) {
 }
 
 func TestAuthLogin_StrictModeOff_Allowed(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 
 	var called bool
 	cmd := NewCmdAuthLogin(f, func(opts *LoginOptions) error {
diff --git a/cmd/auth/login_test.go b/cmd/auth/login_test.go
index 5d82a1120a..e7fc8f3c75 100644
--- a/cmd/auth/login_test.go
+++ b/cmd/auth/login_test.go
@@ -17,7 +17,7 @@ import (
 	brandpkg "github.com/larksuite/cli/brand"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/registry"
@@ -309,7 +309,7 @@ func TestGetDomainMetadata_HasTitleAndDescription(t *testing.T) {
 }
 
 func TestAuthLoginRun_NonTerminal_NoFlags_RejectsWithHint(t *testing.T) {
-	f, _, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, stderr, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "cli_test", AppSecret: "secret", Brand: brandpkg.Feishu,
 	})
 	// TestFactory has IsTerminal=false by default
@@ -601,17 +601,17 @@ func TestAuthLoginRun_MissingRequestedScopeAlignsWithLoginSuccess(t *testing.T)
 	setupLoginConfigDir(t)
 	t.Setenv("HOME", t.TempDir())
 
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{Name: "default", AppId: "cli_test"},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
-	f, _, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, stderr, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
@@ -697,7 +697,7 @@ func TestAuthLoginRun_MissingRequestedScopeAlignsWithLoginSuccess(t *testing.T)
 	if stored.Scope != "offline_access" {
 		t.Fatalf("stored scope = %q", stored.Scope)
 	}
-	cfg, err := core.LoadMultiAppConfig()
+	cfg, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig() error = %v", err)
 	}
@@ -717,17 +717,17 @@ func TestAuthLoginRun_DeviceCodeUsesCachedRequestedScopes(t *testing.T) {
 	setupLoginConfigDir(t)
 	t.Setenv("HOME", t.TempDir())
 
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{Name: "default", AppId: "cli_test"},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
-	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, stderr, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
@@ -852,7 +852,7 @@ func TestAuthLoginRun_DeviceCodeTokenNilCleansScopeCache(t *testing.T) {
 		return &larkauth.DeviceFlowResult{OK: true, Token: nil}
 	}
 
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
@@ -891,7 +891,7 @@ func TestAuthLoginRun_JSONAbort_StdoutEventOnly_StderrEmpty(t *testing.T) {
 		return &larkauth.DeviceFlowResult{OK: false, Message: "user denied"}
 	}
 
-	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, stderr, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
@@ -957,7 +957,7 @@ func TestAuthLoginRun_JSONAbort_StdoutEventOnly_StderrEmpty(t *testing.T) {
 }
 
 func TestAuthLoginRun_JSONWriteFailure_NoWaitReturnsWriterError(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
@@ -994,7 +994,7 @@ func TestAuthLoginRun_JSONWriteFailure_NoWaitReturnsWriterError(t *testing.T) {
 }
 
 func TestAuthLoginRun_NoWaitJSONHintIncludesRawURLGuidance(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
@@ -1068,7 +1068,7 @@ func TestAuthLoginRun_NoWaitJSONHintIncludesRawURLGuidance(t *testing.T) {
 }
 
 func TestAuthLoginRun_JSONWriteFailure_DeviceAuthorizationReturnsWriterError(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
@@ -1106,7 +1106,7 @@ func TestAuthLoginRun_JSONWriteFailure_DeviceAuthorizationReturnsWriterError(t *
 }
 
 func TestAuthLoginRun_JSONDeviceAuthorizationAgentHintIncludesRawURLGuidance(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
diff --git a/cmd/auth/logout.go b/cmd/auth/logout.go
index da8d805fbf..9f39c8ead3 100644
--- a/cmd/auth/logout.go
+++ b/cmd/auth/logout.go
@@ -11,7 +11,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/secret"
 )
@@ -45,7 +45,7 @@ func NewCmdAuthLogout(f *cmdutil.Factory, runF func(*LogoutOptions) error) *cobr
 func authLogoutRun(opts *LogoutOptions) error {
 	f := opts.Factory
 
-	multi, _ := core.LoadMultiAppConfig()
+	multi, _ := configpkg.LoadMultiAppConfig()
 	if multi == nil || len(multi.Apps) == 0 {
 		if opts.JSON {
 			output.PrintJson(f.IOStreams.Out, map[string]interface{}{
@@ -95,8 +95,8 @@ func authLogoutRun(opts *LogoutOptions) error {
 		}
 	}
 
-	app.Users = []core.AppUser{}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	app.Users = []configpkg.AppUser{}
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		return errs.NewInternalError(errs.SubtypeStorage, "failed to save config: %v", err).WithCause(err)
 	}
 	if opts.JSON {
diff --git a/cmd/auth/logout_test.go b/cmd/auth/logout_test.go
index 2c8c5e553a..24c62ca103 100644
--- a/cmd/auth/logout_test.go
+++ b/cmd/auth/logout_test.go
@@ -12,17 +12,17 @@ import (
 	"github.com/larksuite/cli/brand"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/secret"
 	"github.com/zalando/go-keyring"
 )
 
-func writeLogoutConfig(t *testing.T, users []core.AppUser) {
+func writeLogoutConfig(t *testing.T, users []configpkg.AppUser) {
 	t.Helper()
-	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{
+	if err := configpkg.SaveMultiAppConfig(&configpkg.MultiAppConfig{
 		CurrentApp: "test-app",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{
 				AppId:     "test-app",
 				AppSecret: secret.PlainSecret("test-secret"),
@@ -93,7 +93,7 @@ func TestAuthLogoutRun_JSONMode_Success_WritesStdoutOnly(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_DATA_DIR", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	writeLogoutConfig(t, []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}})
+	writeLogoutConfig(t, []configpkg.AppUser{{UserOpenId: "ou_user", UserName: "tester"}})
 	if err := larkauth.SetStoredToken(&larkauth.StoredUAToken{
 		AppId:      "test-app",
 		UserOpenId: "ou_user",
@@ -129,7 +129,7 @@ func TestAuthLogoutRun_DefaultMode_KeepsTextOutput(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_DATA_DIR", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	writeLogoutConfig(t, []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}})
+	writeLogoutConfig(t, []configpkg.AppUser{{UserOpenId: "ou_user", UserName: "tester"}})
 	if err := larkauth.SetStoredToken(&larkauth.StoredUAToken{
 		AppId:      "test-app",
 		UserOpenId: "ou_user",
@@ -155,19 +155,19 @@ func TestAuthLogoutRun_RevokesTokenAndClearsLocalState(t *testing.T) {
 	setupLoginConfigDir(t)
 	t.Setenv("HOME", t.TempDir())
 
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{
 				Name:      "default",
 				AppId:     "cli_test",
 				AppSecret: secret.PlainSecret("secret"),
 				Brand:     brand.Feishu,
-				Users:     []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
+				Users:     []configpkg.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
 			},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 	if err := larkauth.SetStoredToken(&larkauth.StoredUAToken{
@@ -179,7 +179,7 @@ func TestAuthLogoutRun_RevokesTokenAndClearsLocalState(t *testing.T) {
 		t.Fatalf("SetStoredToken() error = %v", err)
 	}
 
-	f, _, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, stderr, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
@@ -212,7 +212,7 @@ func TestAuthLogoutRun_RevokesTokenAndClearsLocalState(t *testing.T) {
 	if got := larkauth.GetStoredToken("cli_test", "ou_user"); got != nil {
 		t.Fatalf("expected stored token removed, got %#v", got)
 	}
-	saved, err := core.LoadMultiAppConfig()
+	saved, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig() error = %v", err)
 	}
@@ -226,19 +226,19 @@ func TestAuthLogoutRun_FallsBackToAccessTokenWhenRefreshTokenMissing(t *testing.
 	setupLoginConfigDir(t)
 	t.Setenv("HOME", t.TempDir())
 
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{
 				Name:      "default",
 				AppId:     "cli_test",
 				AppSecret: secret.PlainSecret("secret"),
 				Brand:     brand.Feishu,
-				Users:     []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
+				Users:     []configpkg.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
 			},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 	if err := larkauth.SetStoredToken(&larkauth.StoredUAToken{
@@ -249,7 +249,7 @@ func TestAuthLogoutRun_FallsBackToAccessTokenWhenRefreshTokenMissing(t *testing.
 		t.Fatalf("SetStoredToken() error = %v", err)
 	}
 
-	f, _, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, stderr, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
@@ -282,7 +282,7 @@ func TestAuthLogoutRun_FallsBackToAccessTokenWhenRefreshTokenMissing(t *testing.
 	if got := larkauth.GetStoredToken("cli_test", "ou_user"); got != nil {
 		t.Fatalf("expected stored token removed, got %#v", got)
 	}
-	saved, err := core.LoadMultiAppConfig()
+	saved, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig() error = %v", err)
 	}
@@ -296,19 +296,19 @@ func TestAuthLogoutRun_RevokeFailureStillClearsLocalState(t *testing.T) {
 	setupLoginConfigDir(t)
 	t.Setenv("HOME", t.TempDir())
 
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{
 				Name:      "default",
 				AppId:     "cli_test",
 				AppSecret: secret.PlainSecret("secret"),
 				Brand:     brand.Feishu,
-				Users:     []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
+				Users:     []configpkg.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
 			},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 	if err := larkauth.SetStoredToken(&larkauth.StoredUAToken{
@@ -320,7 +320,7 @@ func TestAuthLogoutRun_RevokeFailureStillClearsLocalState(t *testing.T) {
 		t.Fatalf("SetStoredToken() error = %v", err)
 	}
 
-	f, _, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, stderr, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "default",
 		AppID:       "cli_test",
 		AppSecret:   "secret",
@@ -348,7 +348,7 @@ func TestAuthLogoutRun_RevokeFailureStillClearsLocalState(t *testing.T) {
 	if got := larkauth.GetStoredToken("cli_test", "ou_user"); got != nil {
 		t.Fatalf("expected stored token removed, got %#v", got)
 	}
-	saved, err := core.LoadMultiAppConfig()
+	saved, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig() error = %v", err)
 	}
diff --git a/cmd/auth/qrcode_test.go b/cmd/auth/qrcode_test.go
index b2e1d78c0b..c8ce1f7645 100644
--- a/cmd/auth/qrcode_test.go
+++ b/cmd/auth/qrcode_test.go
@@ -13,12 +13,12 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 )
 
 func TestNewCmdAuthQRCode_FlagParsing(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -46,7 +46,7 @@ func TestNewCmdAuthQRCode_FlagParsing(t *testing.T) {
 }
 
 func TestNewCmdAuthQRCode_ASCIIFlag(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
diff --git a/cmd/auth/scopes_test.go b/cmd/auth/scopes_test.go
index 2dd81c67e2..d6636ce67a 100644
--- a/cmd/auth/scopes_test.go
+++ b/cmd/auth/scopes_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 )
 
 // stubGetAppInfoErr swaps getAppInfoFn for the duration of t so authScopesRun
@@ -32,7 +32,7 @@ func stubGetAppInfoErr(t *testing.T, errToReturn error) {
 // and reach the getAppInfoFn call.
 func scopesTestFactory(t *testing.T) *ScopesOptions {
 	t.Helper()
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID:     "test-app",
 		AppSecret: "test-secret",
 		Brand:     brand.Feishu,
diff --git a/cmd/auth/status_test.go b/cmd/auth/status_test.go
index b5d32c8311..f1516940fd 100644
--- a/cmd/auth/status_test.go
+++ b/cmd/auth/status_test.go
@@ -10,12 +10,12 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
 func TestAuthStatusRun_SplitsBotAndUserIdentity(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu,
 	})
 
@@ -39,7 +39,7 @@ func TestAuthStatusRun_SplitsBotAndUserIdentity(t *testing.T) {
 }
 
 func TestAuthStatusRun_VerifyReportsBotIdentity(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu,
 	})
 	reg.Register(&httpmock.Stub{
diff --git a/cmd/config/bind.go b/cmd/config/bind.go
index 819c3c38cb..9f5d45faaf 100644
--- a/cmd/config/bind.go
+++ b/cmd/config/bind.go
@@ -14,7 +14,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/keychain"
@@ -267,7 +267,7 @@ func reconcileExistingBinding(opts *BindOptions, source, configPath string) (exi
 // enumerate candidates, pick one via the shared decision layer, and build a
 // ready-to-persist AppConfig. Adding a new bind source only requires
 // implementing SourceBinder — none of the logic below needs to change.
-func resolveAccount(opts *BindOptions, source string) (*core.AppConfig, error) {
+func resolveAccount(opts *BindOptions, source string) (*configpkg.AppConfig, error) {
 	binder, err := newBinder(source, opts)
 	if err != nil {
 		return nil, err
@@ -310,7 +310,7 @@ func resolveIdentity(opts *BindOptions) error {
 // the bind flow treats a corrupt previous config (commitBinding will
 // overwrite it cleanly).
 func hasStrictBotLock(data []byte) bool {
-	var multi core.MultiAppConfig
+	var multi configpkg.MultiAppConfig
 	if err := json.Unmarshal(data, &multi); err != nil {
 		return false
 	}
@@ -372,7 +372,7 @@ func preferredLang(requested, prior i18n.Lang) i18n.Lang {
 	return prior
 }
 
-func applyPreferences(appConfig *core.AppConfig, opts *BindOptions, prior i18n.Lang) {
+func applyPreferences(appConfig *configpkg.AppConfig, opts *BindOptions, prior i18n.Lang) {
 	switch opts.Identity {
 	case "bot-only":
 		sm := identity.StrictModeBot
@@ -392,7 +392,7 @@ func applyPreferences(appConfig *core.AppConfig, opts *BindOptions, prior i18n.L
 // wrong profile's preference into a re-bind when the workspace holds multiple
 // named profiles and the active one disagrees with Apps[0].
 func priorLang(previousConfigBytes []byte) i18n.Lang {
-	var multi core.MultiAppConfig
+	var multi configpkg.MultiAppConfig
 	if json.Unmarshal(previousConfigBytes, &multi) != nil {
 		return ""
 	}
@@ -407,8 +407,8 @@ func priorLang(previousConfigBytes []byte) i18n.Lang {
 // any), and a JSON success envelope. Cleanup runs only after the new config
 // is durably written — if anything fails earlier, the old workspace stays
 // usable.
-func commitBinding(opts *BindOptions, appConfig *core.AppConfig, previousConfigBytes []byte, source, configPath string) error {
-	multi := &core.MultiAppConfig{Apps: []core.AppConfig{*appConfig}}
+func commitBinding(opts *BindOptions, appConfig *configpkg.AppConfig, previousConfigBytes []byte, source, configPath string) error {
+	multi := &configpkg.MultiAppConfig{Apps: []configpkg.AppConfig{*appConfig}}
 
 	if err := vfs.MkdirAll(workspace.GetConfigDir(), 0700); err != nil {
 		return errs.NewInternalError(errs.SubtypeFileIO, "failed to create workspace directory: %v", err).WithCause(err)
@@ -479,8 +479,8 @@ func commitBinding(opts *BindOptions, appConfig *core.AppConfig, previousConfigB
 // the secret that ForStorage just wrote (old and new secret share the same
 // keychain key, derived from appId). Best-effort: errors are silently
 // ignored (same contract as config init's cleanup).
-func cleanupKeychainFromData(kc keychain.KeychainAccess, data []byte, keep *core.AppConfig) {
-	var multi core.MultiAppConfig
+func cleanupKeychainFromData(kc keychain.KeychainAccess, data []byte, keep *configpkg.AppConfig) {
+	var multi configpkg.MultiAppConfig
 	if err := json.Unmarshal(data, &multi); err != nil {
 		return
 	}
@@ -585,7 +585,7 @@ func tuiConflictPrompt(opts *BindOptions, source, configPath string) (string, er
 	// Build existing binding summary
 	existingSummary := fmt.Sprintf(msg.ConflictDesc, source, "?", "?", configPath)
 	if data, err := vfs.ReadFile(configPath); err == nil {
-		var multi core.MultiAppConfig
+		var multi configpkg.MultiAppConfig
 		if json.Unmarshal(data, &multi) == nil && len(multi.Apps) > 0 {
 			app := multi.Apps[0]
 			existingSummary = fmt.Sprintf(msg.ConflictDesc,
diff --git a/cmd/config/bind_test.go b/cmd/config/bind_test.go
index cd485b4ad8..dbe08f96ef 100644
--- a/cmd/config/bind_test.go
+++ b/cmd/config/bind_test.go
@@ -16,7 +16,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
@@ -233,7 +233,7 @@ func TestConfigBindRun_EmptyLangIsNoOp(t *testing.T) {
 				t.Fatalf("configBindRun(--lang %q) = %v, want nil", tc.lang, err)
 			}
 
-			multi, err := core.LoadMultiAppConfig()
+			multi, err := configpkg.LoadMultiAppConfig()
 			if err != nil {
 				t.Fatalf("LoadMultiAppConfig: %v", err)
 			}
@@ -269,7 +269,7 @@ func TestConfigBindRun_OmitLangPreservesPrior(t *testing.T) {
 		t.Fatalf("re-bind (no --lang): %v", err)
 	}
 
-	multi, err := core.LoadMultiAppConfig()
+	multi, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig: %v", err)
 	}
@@ -283,9 +283,9 @@ func TestConfigBindRun_OmitLangPreservesPrior(t *testing.T) {
 // workspace (set up via `profile add` before a re-bind), the active profile's
 // Lang must win over a sibling profile that happens to sit earlier in the slice.
 func TestPriorLang_RespectsCurrentApp(t *testing.T) {
-	multi := core.MultiAppConfig{
+	multi := configpkg.MultiAppConfig{
 		CurrentApp: "active",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{Name: "stale", AppId: "cli_stale", Lang: i18n.LangJaJP},
 			{Name: "active", AppId: "cli_active", Lang: i18n.LangEnUS},
 		},
@@ -304,8 +304,8 @@ func TestPriorLang_RespectsCurrentApp(t *testing.T) {
 // so a bind-written config (which always has exactly one app and no
 // CurrentApp field) still inherits its Lang.
 func TestPriorLang_FallsBackToFirstAppWhenCurrentUnset(t *testing.T) {
-	multi := core.MultiAppConfig{
-		Apps: []core.AppConfig{
+	multi := configpkg.MultiAppConfig{
+		Apps: []configpkg.AppConfig{
 			{AppId: "cli_only", Lang: i18n.LangJaJP},
 		},
 	}
@@ -644,7 +644,7 @@ func TestConfigBindRun_LarkChannel_Success(t *testing.T) {
 	// workspace config to verify accounts.app.tenant flowed through to the
 	// stored AppConfig.Brand field.
 	workspace.SetCurrentWorkspace(workspace.WorkspaceLarkChannel)
-	multi, err := core.LoadMultiAppConfig()
+	multi, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("load workspace config: %v", err)
 	}
@@ -691,7 +691,7 @@ func TestConfigBindRun_LarkChannel_LarkTenant(t *testing.T) {
 		t.Fatalf("expected success, got error: %v", err)
 	}
 	workspace.SetCurrentWorkspace(workspace.WorkspaceLarkChannel)
-	multi, err := core.LoadMultiAppConfig()
+	multi, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("load workspace config: %v", err)
 	}
@@ -807,14 +807,14 @@ func TestConfigShowRun_WorkspaceField(t *testing.T) {
 
 	workspace.SetCurrentWorkspace(workspace.WorkspaceLocal)
 
-	multi := &core.MultiAppConfig{
-		Apps: []core.AppConfig{{
+	multi := &configpkg.MultiAppConfig{
+		Apps: []configpkg.AppConfig{{
 			AppId:     "cli_local_test",
 			AppSecret: secret.PlainSecret("secret"),
 			Brand:     brand.Feishu,
 		}},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("save: %v", err)
 	}
 
@@ -1002,7 +1002,7 @@ func TestConfigBindRun_HermesSuccess(t *testing.T) {
 	if err != nil {
 		t.Fatalf("read config.json: %v", err)
 	}
-	var multi core.MultiAppConfig
+	var multi configpkg.MultiAppConfig
 	if err := json.Unmarshal(data, &multi); err != nil {
 		t.Fatalf("unmarshal config.json: %v", err)
 	}
@@ -1494,7 +1494,7 @@ func assertPresetApplied(t *testing.T, configPath string, wantStrict identity.St
 	if err != nil {
 		t.Fatalf("read %s: %v", configPath, err)
 	}
-	var multi core.MultiAppConfig
+	var multi configpkg.MultiAppConfig
 	if err := json.Unmarshal(data, &multi); err != nil {
 		t.Fatalf("unmarshal %s: %v", configPath, err)
 	}
@@ -1791,7 +1791,7 @@ func TestCleanupKeychainFromData_KeepsSecretSharedWithNewApp(t *testing.T) {
 	}
 
 	oldConfig := []byte(`{"apps":[{"appId":"cli_shared","appSecret":{"source":"keychain","id":"` + sharedID + `"}}]}`)
-	newApp := &core.AppConfig{
+	newApp := &configpkg.AppConfig{
 		AppId: "cli_shared",
 		AppSecret: secret.SecretInput{
 			Ref: &secret.SecretRef{Source: "keychain", ID: sharedID},
@@ -1821,7 +1821,7 @@ func TestCleanupKeychainFromData_RemovesStaleSecretWhenAppIDChanges(t *testing.T
 	}
 
 	oldConfig := []byte(`{"apps":[{"appId":"cli_old","appSecret":{"source":"keychain","id":"` + oldID + `"}}]}`)
-	newApp := &core.AppConfig{
+	newApp := &configpkg.AppConfig{
 		AppId: "cli_new",
 		AppSecret: secret.SecretInput{
 			Ref: &secret.SecretRef{Source: "keychain", ID: newID},
diff --git a/cmd/config/binder.go b/cmd/config/binder.go
index e140c5e842..f4732ddbb5 100644
--- a/cmd/config/binder.go
+++ b/cmd/config/binder.go
@@ -11,7 +11,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/openclawbind"
 	secretpkg "github.com/larksuite/cli/internal/secret"
 	"github.com/larksuite/cli/internal/vfs"
@@ -38,7 +38,7 @@ type SourceBinder interface {
 	ListCandidates() ([]Candidate, error)
 	// Build resolves secrets, persists to keychain, and returns a ready AppConfig
 	// for the chosen candidate AppID. Must be called after ListCandidates succeeds.
-	Build(appID string) (*core.AppConfig, error)
+	Build(appID string) (*configpkg.AppConfig, error)
 }
 
 // newBinder constructs the SourceBinder for the given source name.
@@ -170,7 +170,7 @@ func (b *openclawBinder) ListCandidates() ([]Candidate, error) {
 	return result, nil
 }
 
-func (b *openclawBinder) Build(appID string) (*core.AppConfig, error) {
+func (b *openclawBinder) Build(appID string) (*configpkg.AppConfig, error) {
 	if b.cfg == nil {
 		return nil, errs.NewInternalError(errs.SubtypeSDKError, "internal: Build called before ListCandidates")
 	}
@@ -204,7 +204,7 @@ func (b *openclawBinder) Build(appID string) (*core.AppConfig, error) {
 			WithCause(err)
 	}
 
-	return &core.AppConfig{
+	return &configpkg.AppConfig{
 		AppId:     selected.AppID,
 		AppSecret: stored,
 		Brand:     brand.ParseBrand(selected.Brand),
@@ -240,7 +240,7 @@ func (b *hermesBinder) ListCandidates() ([]Candidate, error) {
 	return []Candidate{{AppID: appID, Label: "default"}}, nil
 }
 
-func (b *hermesBinder) Build(appID string) (*core.AppConfig, error) {
+func (b *hermesBinder) Build(appID string) (*configpkg.AppConfig, error) {
 	if b.envMap == nil {
 		return nil, errs.NewInternalError(errs.SubtypeSDKError, "internal: Build called before ListCandidates")
 	}
@@ -260,7 +260,7 @@ func (b *hermesBinder) Build(appID string) (*core.AppConfig, error) {
 			WithCause(err)
 	}
 
-	return &core.AppConfig{
+	return &configpkg.AppConfig{
 		AppId:     appID,
 		AppSecret: stored,
 		Brand:     brand.ParseBrand(b.envMap["FEISHU_DOMAIN"]),
@@ -297,7 +297,7 @@ func (b *larkChannelBinder) ListCandidates() ([]Candidate, error) {
 	return []Candidate{{AppID: cfg.Accounts.App.ID, Label: "default"}}, nil
 }
 
-func (b *larkChannelBinder) Build(appID string) (*core.AppConfig, error) {
+func (b *larkChannelBinder) Build(appID string) (*configpkg.AppConfig, error) {
 	if b.cfg == nil {
 		return nil, errs.NewInternalError(errs.SubtypeSDKError, "internal: Build called before ListCandidates")
 	}
@@ -325,7 +325,7 @@ func (b *larkChannelBinder) Build(appID string) (*core.AppConfig, error) {
 			WithCause(err)
 	}
 
-	return &core.AppConfig{
+	return &configpkg.AppConfig{
 		AppId:     appID,
 		AppSecret: stored,
 		Brand:     brand.ParseBrand(b.cfg.Accounts.App.Tenant),
diff --git a/cmd/config/binder_test.go b/cmd/config/binder_test.go
index ee7c7e6de2..ad14478190 100644
--- a/cmd/config/binder_test.go
+++ b/cmd/config/binder_test.go
@@ -8,7 +8,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 )
 
@@ -20,10 +20,10 @@ type fakeBinder struct {
 	path string
 }
 
-func (b *fakeBinder) Name() string                                { return b.name }
-func (b *fakeBinder) ConfigPath() string                          { return b.path }
-func (b *fakeBinder) ListCandidates() ([]Candidate, error)        { return nil, nil }
-func (b *fakeBinder) Build(appID string) (*core.AppConfig, error) { return nil, nil }
+func (b *fakeBinder) Name() string                                     { return b.name }
+func (b *fakeBinder) ConfigPath() string                               { return b.path }
+func (b *fakeBinder) ListCandidates() ([]Candidate, error)             { return nil, nil }
+func (b *fakeBinder) Build(appID string) (*configpkg.AppConfig, error) { return nil, nil }
 
 // tuiUnreachable is a tuiPrompt that fails the test if called. It's the
 // guardrail that proves the non-TUI decision paths really do stay out of the
diff --git a/cmd/config/config_test.go b/cmd/config/config_test.go
index c89dd1e6ea..7d1fafada3 100644
--- a/cmd/config/config_test.go
+++ b/cmd/config/config_test.go
@@ -16,7 +16,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/keychain"
@@ -68,7 +68,7 @@ func TestConfigInitCmd_FlagParsing(t *testing.T) {
 }
 
 func TestConfigShowCmd_FlagParsing(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -110,16 +110,16 @@ func TestConfigShowRun_NotConfiguredReturnsStructuredError(t *testing.T) {
 
 func TestConfigShowRun_NoActiveProfileReturnsStructuredError(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "missing",
-		Apps: []core.AppConfig{{
+		Apps: []configpkg.AppConfig{{
 			Name:      "default",
 			AppId:     "app-default",
 			AppSecret: secret.PlainSecret("secret-default"),
 			Brand:     brand.Feishu,
 		}},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -188,10 +188,10 @@ func TestSaveInitConfig_OmitLangPreservesPrior(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	f, _, _, _ := cmdutil.TestFactory(t, nil)
 
-	existing := &core.MultiAppConfig{Apps: []core.AppConfig{
+	existing := &configpkg.MultiAppConfig{Apps: []configpkg.AppConfig{
 		{AppId: "cli_x", AppSecret: secret.PlainSecret("s"), Brand: brand.Feishu, Lang: i18n.LangJaJP},
 	}}
-	if err := core.SaveMultiAppConfig(existing); err != nil {
+	if err := configpkg.SaveMultiAppConfig(existing); err != nil {
 		t.Fatalf("seed config: %v", err)
 	}
 
@@ -199,7 +199,7 @@ func TestSaveInitConfig_OmitLangPreservesPrior(t *testing.T) {
 		t.Fatalf("saveInitConfig (no --lang): %v", err)
 	}
 
-	got, err := core.LoadMultiAppConfig()
+	got, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig: %v", err)
 	}
@@ -320,17 +320,17 @@ func TestConfigRemoveRun_SaveFailurePreservesExistingConfigAndSecrets(t *testing
 	configDir := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
 
-	multi := &core.MultiAppConfig{
-		Apps: []core.AppConfig{{
+	multi := &configpkg.MultiAppConfig{
+		Apps: []configpkg.AppConfig{{
 			AppId: "app-test",
 			AppSecret: secret.SecretInput{
 				Ref: &secret.SecretRef{Source: "keychain", ID: "appsecret:app-test"},
 			},
 			Brand: brand.Feishu,
-			Users: []core.AppUser{{UserOpenId: "ou_1", UserName: "Tester"}},
+			Users: []configpkg.AppUser{{UserOpenId: "ou_1", UserName: "Tester"}},
 		}},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -359,7 +359,7 @@ func TestConfigRemoveRun_SaveFailurePreservesExistingConfigAndSecrets(t *testing
 	if err := os.Chmod(configDir, 0700); err != nil {
 		t.Fatalf("restore Chmod(%s) error = %v", configDir, err)
 	}
-	saved, err := core.LoadMultiAppConfig()
+	saved, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig() error = %v", err)
 	}
@@ -379,8 +379,8 @@ func TestConfigRemoveRun_SaveFailurePreservesExistingConfigAndSecrets(t *testing
 func TestSaveAsProfile_RejectsProfileNameCollisionWithExistingAppID(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
-	existing := &core.MultiAppConfig{
-		Apps: []core.AppConfig{
+	existing := &configpkg.MultiAppConfig{
+		Apps: []configpkg.AppConfig{
 			{
 				Name:      "prod",
 				AppId:     "cli_prod",
@@ -430,16 +430,16 @@ func TestWrapSaveConfigError_PassesTypedValidationThrough(t *testing.T) {
 }
 
 func TestUpdateExistingProfileWithoutSecret_RejectsAppIDChange(t *testing.T) {
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "prod",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{
 				Name:      "prod",
 				AppId:     "app-old",
 				AppSecret: secret.SecretInput{Ref: &secret.SecretRef{Source: "keychain", ID: "appsecret:app-old"}},
 				Brand:     brand.Feishu,
 				Lang:      "zh",
-				Users:     []core.AppUser{{UserOpenId: "ou_1", UserName: "User"}},
+				Users:     []configpkg.AppUser{{UserOpenId: "ou_1", UserName: "User"}},
 			},
 		},
 	}
diff --git a/cmd/config/default_as.go b/cmd/config/default_as.go
index e2a673ded7..239cf969a0 100644
--- a/cmd/config/default_as.go
+++ b/cmd/config/default_as.go
@@ -8,7 +8,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/spf13/cobra"
 )
@@ -21,14 +21,14 @@ func NewCmdConfigDefaultAs(f *cmdutil.Factory) *cobra.Command {
 		Long:  "Without arguments, shows the current default identity. Pass user, bot, or auto to set a new default.",
 		Args:  cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			multi, err := core.LoadOrNotConfigured()
+			multi, err := configpkg.LoadOrNotConfigured()
 			if err != nil {
 				return err
 			}
 
 			app := multi.CurrentAppConfig(f.Invocation.Profile)
 			if app == nil {
-				return core.NoActiveProfileError()
+				return configpkg.NoActiveProfileError()
 			}
 
 			if len(args) == 0 {
@@ -46,7 +46,7 @@ func NewCmdConfigDefaultAs(f *cmdutil.Factory) *cobra.Command {
 			}
 
 			app.DefaultAs = identity.Identity(value)
-			if err := core.SaveMultiAppConfig(multi); err != nil {
+			if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 				return errs.NewInternalError(errs.SubtypeStorage, "failed to save config: %v", err).WithCause(err)
 			}
 			fmt.Fprintf(f.IOStreams.ErrOut, "Default identity set to: %s\n", value)
diff --git a/cmd/config/init.go b/cmd/config/init.go
index c7e265e82c..7fb152efbb 100644
--- a/cmd/config/init.go
+++ b/cmd/config/init.go
@@ -17,7 +17,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/output"
@@ -139,7 +139,7 @@ func (o *ConfigInitOptions) hasAnyNonInteractiveFlag() bool {
 }
 
 // cleanupOldConfig clears keychain entries (AppSecret + UAT) for all apps in existing config except the app whose AppId equals skipAppID.
-func cleanupOldConfig(existing *core.MultiAppConfig, f *cmdutil.Factory, skipAppID string) {
+func cleanupOldConfig(existing *configpkg.MultiAppConfig, f *cmdutil.Factory, skipAppID string) {
 	if existing == nil {
 		return
 	}
@@ -156,18 +156,18 @@ func cleanupOldConfig(existing *core.MultiAppConfig, f *cmdutil.Factory, skipApp
 
 // saveAsOnlyApp overwrites config.json with a single-app config.
 func saveAsOnlyApp(appId string, secret secretpkg.SecretInput, brand brandpkg.Brand, lang string) error {
-	config := &core.MultiAppConfig{
-		Apps: []core.AppConfig{{
-			AppId: appId, AppSecret: secret, Brand: brand, Lang: i18n.Lang(lang), Users: []core.AppUser{},
+	config := &configpkg.MultiAppConfig{
+		Apps: []configpkg.AppConfig{{
+			AppId: appId, AppSecret: secret, Brand: brand, Lang: i18n.Lang(lang), Users: []configpkg.AppUser{},
 		}},
 	}
-	return core.SaveMultiAppConfig(config)
+	return configpkg.SaveMultiAppConfig(config)
 }
 
 // saveInitConfig saves a new/updated app config, respecting --profile mode.
 // With profileName: appends or updates the named profile (preserves other profiles).
 // Without profileName: cleans up old config and saves as the only app.
-func saveInitConfig(profileName string, existing *core.MultiAppConfig, f *cmdutil.Factory, appId string, secret secretpkg.SecretInput, brand brandpkg.Brand, lang string) error {
+func saveInitConfig(profileName string, existing *configpkg.MultiAppConfig, f *cmdutil.Factory, appId string, secret secretpkg.SecretInput, brand brandpkg.Brand, lang string) error {
 	if profileName != "" {
 		return saveAsProfile(existing, f.Keychain, profileName, appId, secret, brand, lang)
 	}
@@ -198,10 +198,10 @@ func wrapSaveConfigError(err error) error {
 // saveAsProfile appends or updates a named profile in the config.
 // If a profile with the same name exists, it updates it; otherwise appends.
 // When updating, cleans up old keychain secrets if AppId changed.
-func saveAsProfile(existing *core.MultiAppConfig, kc keychain.KeychainAccess, profileName, appId string, secret secretpkg.SecretInput, brand brandpkg.Brand, lang string) error {
+func saveAsProfile(existing *configpkg.MultiAppConfig, kc keychain.KeychainAccess, profileName, appId string, secret secretpkg.SecretInput, brand brandpkg.Brand, lang string) error {
 	multi := existing
 	if multi == nil {
-		multi = &core.MultiAppConfig{}
+		multi = &configpkg.MultiAppConfig{}
 	}
 
 	if idx := findProfileIndexByName(multi, profileName); idx >= 0 {
@@ -211,7 +211,7 @@ func saveAsProfile(existing *core.MultiAppConfig, kc keychain.KeychainAccess, pr
 			for _, user := range multi.Apps[idx].Users {
 				auth.RemoveStoredToken(multi.Apps[idx].AppId, user.UserOpenId)
 			}
-			multi.Apps[idx].Users = []core.AppUser{}
+			multi.Apps[idx].Users = []configpkg.AppUser{}
 		}
 		multi.Apps[idx].AppId = appId
 		multi.Apps[idx].AppSecret = secret
@@ -224,19 +224,19 @@ func saveAsProfile(existing *core.MultiAppConfig, kc keychain.KeychainAccess, pr
 				WithParam("--name")
 		}
 		// Append new profile
-		multi.Apps = append(multi.Apps, core.AppConfig{
+		multi.Apps = append(multi.Apps, configpkg.AppConfig{
 			Name:      profileName,
 			AppId:     appId,
 			AppSecret: secret,
 			Brand:     brand,
 			Lang:      i18n.Lang(lang),
-			Users:     []core.AppUser{},
+			Users:     []configpkg.AppUser{},
 		})
 	}
-	return core.SaveMultiAppConfig(multi)
+	return configpkg.SaveMultiAppConfig(multi)
 }
 
-func findProfileIndexByName(multi *core.MultiAppConfig, profileName string) int {
+func findProfileIndexByName(multi *configpkg.MultiAppConfig, profileName string) int {
 	if multi == nil {
 		return -1
 	}
@@ -248,7 +248,7 @@ func findProfileIndexByName(multi *core.MultiAppConfig, profileName string) int
 	return -1
 }
 
-func findAppIndexByAppID(multi *core.MultiAppConfig, appID string) int {
+func findAppIndexByAppID(multi *configpkg.MultiAppConfig, appID string) int {
 	if multi == nil {
 		return -1
 	}
@@ -275,13 +275,13 @@ func wrapUpdateExistingProfileErr(err error) error {
 	return errs.NewInternalError(errs.SubtypeSDKError, "failed to save config: %v", err).WithCause(err)
 }
 
-func updateExistingProfileWithoutSecret(existing *core.MultiAppConfig, profileName, appID string, brand brandpkg.Brand, lang string) error {
+func updateExistingProfileWithoutSecret(existing *configpkg.MultiAppConfig, profileName, appID string, brand brandpkg.Brand, lang string) error {
 	if existing == nil {
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "App Secret cannot be empty for new configuration").
 			WithParam("--app-secret")
 	}
 
-	var app *core.AppConfig
+	var app *configpkg.AppConfig
 	if profileName != "" {
 		if idx := findProfileIndexByName(existing, profileName); idx >= 0 {
 			app = &existing.Apps[idx]
@@ -305,7 +305,7 @@ func updateExistingProfileWithoutSecret(existing *core.MultiAppConfig, profileNa
 	app.AppId = appID
 	app.Brand = brand
 	app.Lang = preferredLang(i18n.Lang(lang), app.Lang)
-	return core.SaveMultiAppConfig(existing)
+	return configpkg.SaveMultiAppConfig(existing)
 }
 
 func configInitRun(opts *ConfigInitOptions) error {
@@ -326,14 +326,14 @@ func configInitRun(opts *ConfigInitOptions) error {
 		}
 	}
 
-	existing, err := core.LoadMultiAppConfig()
+	existing, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		existing = nil // treat as empty
 	}
 
 	// Validate --profile name if set
 	if opts.ProfileName != "" {
-		if err := core.ValidateProfileName(opts.ProfileName); err != nil {
+		if err := configpkg.ValidateProfileName(opts.ProfileName); err != nil {
 			return errs.NewValidationError(errs.SubtypeInvalidArgument, "%v", err).WithCause(err)
 		}
 	}
@@ -380,7 +380,7 @@ func configInitRun(opts *ConfigInitOptions) error {
 		if result == nil {
 			return errs.NewInternalError(errs.SubtypeSDKError, "app creation returned no result")
 		}
-		existing, _ := core.LoadMultiAppConfig()
+		existing, _ := configpkg.LoadMultiAppConfig()
 		secret, err := secretpkg.ForStorage(result.AppID, secretpkg.PlainSecret(result.AppSecret), f.Keychain)
 		if err != nil {
 			return errs.NewInternalError(errs.SubtypeSDKError, "%v", err).WithCause(err)
@@ -407,7 +407,7 @@ func configInitRun(opts *ConfigInitOptions) error {
 				WithParam("--app-id")
 		}
 
-		existing, _ := core.LoadMultiAppConfig()
+		existing, _ := configpkg.LoadMultiAppConfig()
 
 		if result.AppSecret != "" {
 			// New secret provided (either from "create" or "existing" with input)
@@ -446,7 +446,7 @@ func configInitRun(opts *ConfigInitOptions) error {
 	}
 
 	// Mode 5: Legacy interactive (readline fallback)
-	firstApp := (*core.AppConfig)(nil)
+	firstApp := (*configpkg.AppConfig)(nil)
 	if existing != nil {
 		firstApp = existing.CurrentAppConfig("")
 	}
diff --git a/cmd/config/init_interactive.go b/cmd/config/init_interactive.go
index 253fbe8e58..444ca7d27a 100644
--- a/cmd/config/init_interactive.go
+++ b/cmd/config/init_interactive.go
@@ -17,7 +17,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/transport"
 )
@@ -63,8 +63,8 @@ func runInteractiveConfigInit(ctx context.Context, f *cmdutil.Factory, msg *init
 // runExistingAppForm shows a huh form for manually entering App ID / App Secret / Brand.
 func runExistingAppForm(f *cmdutil.Factory, msg *initMsg) (*configInitResult, error) {
 	// Load existing config for defaults
-	existing, _ := core.LoadMultiAppConfig()
-	var firstApp *core.AppConfig
+	existing, _ := configpkg.LoadMultiAppConfig()
+	var firstApp *configpkg.AppConfig
 	if existing != nil {
 		firstApp = existing.CurrentAppConfig("")
 	}
diff --git a/cmd/config/init_test.go b/cmd/config/init_test.go
index b6b126e1fa..b7f84a8ae8 100644
--- a/cmd/config/init_test.go
+++ b/cmd/config/init_test.go
@@ -10,7 +10,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/secret"
 )
@@ -26,8 +26,8 @@ func TestUpdateExistingProfileWithoutSecret_NilConfig_EmitsValidationError(t *te
 }
 
 func TestUpdateExistingProfileWithoutSecret_UnknownProfile_EmitsValidationError(t *testing.T) {
-	existing := &core.MultiAppConfig{
-		Apps: []core.AppConfig{{
+	existing := &configpkg.MultiAppConfig{
+		Apps: []configpkg.AppConfig{{
 			Name:      "default",
 			AppId:     "app-default",
 			AppSecret: secret.PlainSecret("secret-default"),
@@ -39,9 +39,9 @@ func TestUpdateExistingProfileWithoutSecret_UnknownProfile_EmitsValidationError(
 }
 
 func TestUpdateExistingProfileWithoutSecret_NoCurrentApp_EmitsValidationError(t *testing.T) {
-	existing := &core.MultiAppConfig{
+	existing := &configpkg.MultiAppConfig{
 		CurrentApp: "missing",
-		Apps: []core.AppConfig{{
+		Apps: []configpkg.AppConfig{{
 			Name:      "default",
 			AppId:     "app-default",
 			AppSecret: secret.PlainSecret("secret-default"),
@@ -53,8 +53,8 @@ func TestUpdateExistingProfileWithoutSecret_NoCurrentApp_EmitsValidationError(t
 }
 
 func TestUpdateExistingProfileWithoutSecret_AppIdMismatch_EmitsValidationError(t *testing.T) {
-	existing := &core.MultiAppConfig{
-		Apps: []core.AppConfig{{
+	existing := &configpkg.MultiAppConfig{
+		Apps: []configpkg.AppConfig{{
 			Name:      "default",
 			AppId:     "app-default",
 			AppSecret: secret.PlainSecret("secret-default"),
diff --git a/cmd/config/remove.go b/cmd/config/remove.go
index 436a682fbd..50d333c54a 100644
--- a/cmd/config/remove.go
+++ b/cmd/config/remove.go
@@ -9,7 +9,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/secret"
 	"github.com/spf13/cobra"
@@ -42,15 +42,15 @@ func NewCmdConfigRemove(f *cmdutil.Factory, runF func(*ConfigRemoveOptions) erro
 func configRemoveRun(opts *ConfigRemoveOptions) error {
 	f := opts.Factory
 
-	config, err := core.LoadMultiAppConfig()
+	config, err := configpkg.LoadMultiAppConfig()
 	if err != nil || config == nil || len(config.Apps) == 0 {
 		return errs.NewConfigError(errs.SubtypeNotConfigured, "not configured yet")
 	}
 
 	// Save empty config first. If this fails, keep secrets and tokens intact so the
 	// existing config can still be retried instead of ending up half-removed.
-	empty := &core.MultiAppConfig{Apps: []core.AppConfig{}}
-	if err := core.SaveMultiAppConfig(empty); err != nil {
+	empty := &configpkg.MultiAppConfig{Apps: []configpkg.AppConfig{}}
+	if err := configpkg.SaveMultiAppConfig(empty); err != nil {
 		return errs.NewInternalError(errs.SubtypeStorage, "failed to save config: %v", err).WithCause(err)
 	}
 
diff --git a/cmd/config/risk_control.go b/cmd/config/risk_control.go
index f594fcc9c8..b0c38b53e3 100644
--- a/cmd/config/risk_control.go
+++ b/cmd/config/risk_control.go
@@ -10,7 +10,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 )
 
 // NewCmdConfigRiskControl creates the workspace risk-control policy command.
@@ -29,7 +29,7 @@ opt it back in explicitly, or default to remove the explicit preference.`,
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
-			config, err := core.LoadOrNotConfigured()
+			config, err := configpkg.LoadOrNotConfigured()
 			if err != nil {
 				return err
 			}
@@ -52,7 +52,7 @@ opt it back in explicitly, or default to remove the explicit preference.`,
 					"invalid risk-control value %q, valid values: on | off | default", args[0])
 			}
 
-			if err := core.SaveMultiAppConfig(config); err != nil {
+			if err := configpkg.SaveMultiAppConfig(config); err != nil {
 				return errs.NewInternalError(errs.SubtypeStorage,
 					"failed to save risk-control policy: %v", err).WithCause(err)
 			}
@@ -64,7 +64,7 @@ opt it back in explicitly, or default to remove the explicit preference.`,
 	return cmd
 }
 
-func printRiskControl(f *cmdutil.Factory, config *core.MultiAppConfig) {
+func printRiskControl(f *cmdutil.Factory, config *configpkg.MultiAppConfig) {
 	source := "default"
 	if config.RiskControl != nil {
 		source = "workspace"
diff --git a/cmd/config/risk_control_test.go b/cmd/config/risk_control_test.go
index f349a06f54..3dc42d4dd9 100644
--- a/cmd/config/risk_control_test.go
+++ b/cmd/config/risk_control_test.go
@@ -11,16 +11,16 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/secret"
 )
 
 func TestRiskControlWorkspacePolicy(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
+	config := &configpkg.MultiAppConfig{Apps: []configpkg.AppConfig{{
 		AppId: "cli_test", AppSecret: secret.PlainSecret("secret"), Brand: brand.Feishu,
 	}}}
-	if err := core.SaveMultiAppConfig(config); err != nil {
+	if err := configpkg.SaveMultiAppConfig(config); err != nil {
 		t.Fatal(err)
 	}
 
@@ -30,7 +30,7 @@ func TestRiskControlWorkspacePolicy(t *testing.T) {
 	if err := cmd.Execute(); err != nil {
 		t.Fatalf("set off: %v", err)
 	}
-	loaded, err := core.LoadMultiAppConfig()
+	loaded, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -55,7 +55,7 @@ func TestRiskControlWorkspacePolicy(t *testing.T) {
 	if err := cmd.Execute(); err != nil {
 		t.Fatalf("set on: %v", err)
 	}
-	loaded, err = core.LoadMultiAppConfig()
+	loaded, err = configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -68,7 +68,7 @@ func TestRiskControlWorkspacePolicy(t *testing.T) {
 	if err := cmd.Execute(); err != nil {
 		t.Fatalf("reset default: %v", err)
 	}
-	loaded, err = core.LoadMultiAppConfig()
+	loaded, err = configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -88,7 +88,7 @@ func TestRiskControlWorkspacePolicy(t *testing.T) {
 
 func TestRiskControlWorkspacePolicyRejectsInvalidValue(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{Apps: []core.AppConfig{{
+	if err := configpkg.SaveMultiAppConfig(&configpkg.MultiAppConfig{Apps: []configpkg.AppConfig{{
 		AppId: "cli_test", AppSecret: secret.PlainSecret("secret"), Brand: brand.Feishu,
 	}}}); err != nil {
 		t.Fatal(err)
@@ -109,10 +109,10 @@ func TestRiskControlWorkspacePolicyRejectsInvalidValue(t *testing.T) {
 
 func TestRiskControlWorkspacePolicyAllowedWithExternalCredentials(t *testing.T) {
 	f := newConfigFactoryWithExternalProvider(t)
-	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
+	config := &configpkg.MultiAppConfig{Apps: []configpkg.AppConfig{{
 		AppId: "cli_test", AppSecret: secret.PlainSecret("secret"), Brand: brand.Feishu,
 	}}}
-	if err := core.SaveMultiAppConfig(config); err != nil {
+	if err := configpkg.SaveMultiAppConfig(config); err != nil {
 		t.Fatal(err)
 	}
 
@@ -122,7 +122,7 @@ func TestRiskControlWorkspacePolicyAllowedWithExternalCredentials(t *testing.T)
 		t.Fatalf("set off with external credentials: %v", err)
 	}
 
-	loaded, err := core.LoadMultiAppConfig()
+	loaded, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/config/show.go b/cmd/config/show.go
index 67f8e22c79..df4c8bb75b 100644
--- a/cmd/config/show.go
+++ b/cmd/config/show.go
@@ -11,7 +11,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/workspace"
 	"github.com/spf13/cobra"
@@ -44,15 +44,15 @@ func NewCmdConfigShow(f *cmdutil.Factory, runF func(*ConfigShowOptions) error) *
 func configShowRun(opts *ConfigShowOptions) error {
 	f := opts.Factory
 
-	config, err := core.LoadMultiAppConfig()
+	config, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			return core.NotConfiguredError()
+			return configpkg.NotConfiguredError()
 		}
 		return errs.NewConfigError(errs.SubtypeInvalidConfig, "failed to load config: %v", err).WithCause(err)
 	}
 	if config == nil || len(config.Apps) == 0 {
-		return core.NotConfiguredError()
+		return configpkg.NotConfiguredError()
 	}
 	app := config.CurrentAppConfig(f.Invocation.Profile)
 	if app == nil {
diff --git a/cmd/config/strict_mode.go b/cmd/config/strict_mode.go
index e2d6a88887..4b99871121 100644
--- a/cmd/config/strict_mode.go
+++ b/cmd/config/strict_mode.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/spf13/cobra"
 )
@@ -38,7 +38,7 @@ explicit user confirmation — never run on your own initiative.`,
   lark-cli config strict-mode --reset       # clear profile override`,
 		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			multi, err := core.LoadOrNotConfigured()
+			multi, err := configpkg.LoadOrNotConfigured()
 			if err != nil {
 				return err
 			}
@@ -46,20 +46,20 @@ explicit user confirmation — never run on your own initiative.`,
 			if reset {
 				app := multi.CurrentAppConfig(f.Invocation.Profile)
 				if app == nil {
-					return core.NoActiveProfileError()
+					return configpkg.NoActiveProfileError()
 				}
 				return resetStrictMode(f, multi, app, global, args)
 			}
 			if len(args) == 0 {
 				app := multi.CurrentAppConfig(f.Invocation.Profile)
 				if app == nil {
-					return core.NoActiveProfileError()
+					return configpkg.NoActiveProfileError()
 				}
 				return showStrictMode(cmd.Context(), f, multi, app)
 			}
 			app := multi.CurrentAppConfig(f.Invocation.Profile)
 			if !global && app == nil {
-				return core.NoActiveProfileError()
+				return configpkg.NoActiveProfileError()
 			}
 			return setStrictMode(f, multi, app, args[0], global)
 		},
@@ -72,7 +72,7 @@ explicit user confirmation — never run on your own initiative.`,
 	return cmd
 }
 
-func resetStrictMode(f *cmdutil.Factory, multi *core.MultiAppConfig, app *core.AppConfig, global bool, args []string) error {
+func resetStrictMode(f *cmdutil.Factory, multi *configpkg.MultiAppConfig, app *configpkg.AppConfig, global bool, args []string) error {
 	if global {
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "--reset cannot be used with --global").WithParam("--reset")
 	}
@@ -80,14 +80,14 @@ func resetStrictMode(f *cmdutil.Factory, multi *core.MultiAppConfig, app *core.A
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "--reset cannot be used with a value argument").WithParam("--reset")
 	}
 	app.StrictMode = nil
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		return errs.NewInternalError(errs.SubtypeStorage, "failed to save config: %v", err).WithCause(err)
 	}
 	fmt.Fprintln(f.IOStreams.ErrOut, "Profile strict-mode reset (inherits global)")
 	return nil
 }
 
-func showStrictMode(ctx context.Context, f *cmdutil.Factory, multi *core.MultiAppConfig, app *core.AppConfig) error {
+func showStrictMode(ctx context.Context, f *cmdutil.Factory, multi *configpkg.MultiAppConfig, app *configpkg.AppConfig) error {
 	// Runtime effective mode from credential provider chain is the source of truth.
 	runtime := f.ResolveStrictMode(ctx)
 	configMode, configSource := resolveStrictModeStatus(multi, app)
@@ -100,7 +100,7 @@ func showStrictMode(ctx context.Context, f *cmdutil.Factory, multi *core.MultiAp
 	return nil
 }
 
-func setStrictMode(f *cmdutil.Factory, multi *core.MultiAppConfig, app *core.AppConfig, value string, global bool) error {
+func setStrictMode(f *cmdutil.Factory, multi *configpkg.MultiAppConfig, app *configpkg.AppConfig, value string, global bool) error {
 	mode := identity.StrictMode(value)
 	switch mode {
 	case identity.StrictModeBot, identity.StrictModeUser, identity.StrictModeOff:
@@ -139,12 +139,12 @@ func setStrictMode(f *cmdutil.Factory, multi *core.MultiAppConfig, app *core.App
 		}
 	} else {
 		if app == nil {
-			return core.NoActiveProfileError()
+			return configpkg.NoActiveProfileError()
 		}
 		app.StrictMode = &mode
 	}
 
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		return errs.NewInternalError(errs.SubtypeStorage, "failed to save config: %v", err).WithCause(err)
 	}
 
@@ -163,14 +163,14 @@ func setStrictMode(f *cmdutil.Factory, multi *core.MultiAppConfig, app *core.App
 // strictModeRelaxLang picks the bind-message bundle whose language matches the
 // active profile's Lang setting. Falls back to bindMsgZh when no profile is
 // available (global mutation with no current app).
-func strictModeRelaxLang(app *core.AppConfig) *bindMsg {
+func strictModeRelaxLang(app *configpkg.AppConfig) *bindMsg {
 	if app != nil {
 		return getBindMsg(app.Lang)
 	}
 	return getBindMsg("")
 }
 
-func resolveStrictModeStatus(multi *core.MultiAppConfig, app *core.AppConfig) (identity.StrictMode, string) {
+func resolveStrictModeStatus(multi *configpkg.MultiAppConfig, app *configpkg.AppConfig) (identity.StrictMode, string) {
 	if app != nil && app.StrictMode != nil {
 		return *app.StrictMode, fmt.Sprintf("profile %q", app.ProfileName())
 	}
diff --git a/cmd/config/strict_mode_test.go b/cmd/config/strict_mode_test.go
index e0bfe87dad..8664b2bb3d 100644
--- a/cmd/config/strict_mode_test.go
+++ b/cmd/config/strict_mode_test.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/secret"
 )
@@ -18,21 +18,21 @@ func setupStrictModeTestConfig(t *testing.T) {
 	t.Helper()
 	dir := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
-	multi := &core.MultiAppConfig{
-		Apps: []core.AppConfig{{
+	multi := &configpkg.MultiAppConfig{
+		Apps: []configpkg.AppConfig{{
 			AppId:     "test-app",
 			AppSecret: secret.PlainSecret("secret"),
 			Brand:     brand.Feishu,
 		}},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatal(err)
 	}
 }
 
 func TestStrictMode_Show_Default(t *testing.T) {
 	setupStrictModeTestConfig(t)
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test-app", AppSecret: "secret"})
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test-app", AppSecret: "secret"})
 	cmd := NewCmdConfigStrictMode(f)
 	cmd.SetArgs([]string{})
 	if err := cmd.Execute(); err != nil {
@@ -45,13 +45,13 @@ func TestStrictMode_Show_Default(t *testing.T) {
 
 func TestStrictMode_SetBot_Profile(t *testing.T) {
 	setupStrictModeTestConfig(t)
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test-app", AppSecret: "secret"})
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test-app", AppSecret: "secret"})
 	cmd := NewCmdConfigStrictMode(f)
 	cmd.SetArgs([]string{"bot"})
 	if err := cmd.Execute(); err != nil {
 		t.Fatal(err)
 	}
-	multi, _ := core.LoadMultiAppConfig()
+	multi, _ := configpkg.LoadMultiAppConfig()
 	app := multi.CurrentAppConfig("")
 	if app.StrictMode == nil || *app.StrictMode != identity.StrictModeBot {
 		t.Error("expected StrictMode=bot on profile")
@@ -60,13 +60,13 @@ func TestStrictMode_SetBot_Profile(t *testing.T) {
 
 func TestStrictMode_SetUser_Profile(t *testing.T) {
 	setupStrictModeTestConfig(t)
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test-app", AppSecret: "secret"})
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test-app", AppSecret: "secret"})
 	cmd := NewCmdConfigStrictMode(f)
 	cmd.SetArgs([]string{"user"})
 	if err := cmd.Execute(); err != nil {
 		t.Fatal(err)
 	}
-	multi, _ := core.LoadMultiAppConfig()
+	multi, _ := configpkg.LoadMultiAppConfig()
 	app := multi.CurrentAppConfig("")
 	if app.StrictMode == nil || *app.StrictMode != identity.StrictModeUser {
 		t.Error("expected StrictMode=user on profile")
@@ -75,7 +75,7 @@ func TestStrictMode_SetUser_Profile(t *testing.T) {
 
 func TestStrictMode_SetOff_Profile(t *testing.T) {
 	setupStrictModeTestConfig(t)
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test-app", AppSecret: "secret"})
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test-app", AppSecret: "secret"})
 	cmd := NewCmdConfigStrictMode(f)
 	cmd.SetArgs([]string{"bot"})
 	cmd.Execute()
@@ -84,7 +84,7 @@ func TestStrictMode_SetOff_Profile(t *testing.T) {
 	if err := cmd.Execute(); err != nil {
 		t.Fatal(err)
 	}
-	multi, _ := core.LoadMultiAppConfig()
+	multi, _ := configpkg.LoadMultiAppConfig()
 	app := multi.CurrentAppConfig("")
 	if app.StrictMode == nil || *app.StrictMode != identity.StrictModeOff {
 		t.Error("expected StrictMode=off on profile")
@@ -93,13 +93,13 @@ func TestStrictMode_SetOff_Profile(t *testing.T) {
 
 func TestStrictMode_SetBot_Global(t *testing.T) {
 	setupStrictModeTestConfig(t)
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test-app", AppSecret: "secret"})
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test-app", AppSecret: "secret"})
 	cmd := NewCmdConfigStrictMode(f)
 	cmd.SetArgs([]string{"bot", "--global"})
 	if err := cmd.Execute(); err != nil {
 		t.Fatal(err)
 	}
-	multi, _ := core.LoadMultiAppConfig()
+	multi, _ := configpkg.LoadMultiAppConfig()
 	if multi.StrictMode != identity.StrictModeBot {
 		t.Error("expected global StrictMode=bot")
 	}
@@ -108,27 +108,27 @@ func TestStrictMode_SetBot_Global(t *testing.T) {
 func TestStrictMode_SetGlobal_DoesNotRequireActiveProfile(t *testing.T) {
 	dir := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "missing-profile",
-		Apps: []core.AppConfig{{
+		Apps: []configpkg.AppConfig{{
 			Name:      "default",
 			AppId:     "test-app",
 			AppSecret: secret.PlainSecret("secret"),
 			Brand:     brand.Feishu,
 		}},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatal(err)
 	}
 
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test-app", AppSecret: "secret"})
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test-app", AppSecret: "secret"})
 	cmd := NewCmdConfigStrictMode(f)
 	cmd.SetArgs([]string{"bot", "--global"})
 	if err := cmd.Execute(); err != nil {
 		t.Fatalf("Execute() error = %v", err)
 	}
 
-	saved, err := core.LoadMultiAppConfig()
+	saved, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig() error = %v", err)
 	}
@@ -139,7 +139,7 @@ func TestStrictMode_SetGlobal_DoesNotRequireActiveProfile(t *testing.T) {
 
 func TestStrictMode_Reset(t *testing.T) {
 	setupStrictModeTestConfig(t)
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test-app", AppSecret: "secret"})
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test-app", AppSecret: "secret"})
 	cmd := NewCmdConfigStrictMode(f)
 	cmd.SetArgs([]string{"bot"})
 	cmd.Execute()
@@ -148,7 +148,7 @@ func TestStrictMode_Reset(t *testing.T) {
 	if err := cmd.Execute(); err != nil {
 		t.Fatal(err)
 	}
-	multi, _ := core.LoadMultiAppConfig()
+	multi, _ := configpkg.LoadMultiAppConfig()
 	app := multi.CurrentAppConfig("")
 	if app.StrictMode != nil {
 		t.Errorf("expected nil StrictMode after reset, got %v", *app.StrictMode)
@@ -157,7 +157,7 @@ func TestStrictMode_Reset(t *testing.T) {
 
 func TestStrictMode_InvalidValue(t *testing.T) {
 	setupStrictModeTestConfig(t)
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test-app", AppSecret: "secret"})
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test-app", AppSecret: "secret"})
 	cmd := NewCmdConfigStrictMode(f)
 	cmd.SetArgs([]string{"on"})
 	err := cmd.Execute()
diff --git a/cmd/config/strict_mode_warning_test.go b/cmd/config/strict_mode_warning_test.go
index 62e7324ae3..b87b4e5c32 100644
--- a/cmd/config/strict_mode_warning_test.go
+++ b/cmd/config/strict_mode_warning_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 )
 
 // runStrictMode is a small helper that runs `config strict-mode <args...>` and
@@ -16,7 +16,7 @@ import (
 // new user-identity warning land.
 func runStrictMode(t *testing.T, args ...string) string {
 	t.Helper()
-	f, _, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test-app", AppSecret: "secret"})
+	f, _, stderr, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test-app", AppSecret: "secret"})
 	cmd := NewCmdConfigStrictMode(f)
 	cmd.SetArgs(args)
 	if err := cmd.Execute(); err != nil {
diff --git a/cmd/doctor/doctor.go b/cmd/doctor/doctor.go
index a960ce939b..c9b46f2224 100644
--- a/cmd/doctor/doctor.go
+++ b/cmd/doctor/doctor.go
@@ -18,7 +18,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identitydiag"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/transport"
@@ -87,7 +87,7 @@ func doctorRun(opts *DoctorOptions) error {
 	}
 
 	// ── 1. Config file ──
-	_, err := core.LoadMultiAppConfig()
+	_, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		// For "config not present" cases, prefer the workspace-aware
 		// NotConfiguredError message + hint (e.g. "openclaw context
@@ -98,7 +98,7 @@ func doctorRun(opts *DoctorOptions) error {
 		msg, hint := err.Error(), ""
 		if errors.Is(err, os.ErrNotExist) {
 			var cfgErr *errs.ConfigError
-			if errors.As(core.NotConfiguredError(), &cfgErr) {
+			if errors.As(configpkg.NotConfiguredError(), &cfgErr) {
 				msg, hint = cfgErr.Message, cfgErr.Hint
 			}
 		}
diff --git a/cmd/doctor/doctor_test.go b/cmd/doctor/doctor_test.go
index 63c4bdb4c4..ecd258b85c 100644
--- a/cmd/doctor/doctor_test.go
+++ b/cmd/doctor/doctor_test.go
@@ -16,13 +16,13 @@ import (
 	"github.com/larksuite/cli/brand"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/secret"
 )
 
 func TestNewCmdDoctor_FlagParsing(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -105,9 +105,9 @@ func TestNetworkChecks_Offline(t *testing.T) {
 
 func TestDoctorRun_SplitsBotAndMissingUserIdentity(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{
+	if err := configpkg.SaveMultiAppConfig(&configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{
 				Name:      "default",
 				AppId:     "test-app",
@@ -119,7 +119,7 @@ func TestDoctorRun_SplitsBotAndMissingUserIdentity(t *testing.T) {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu,
 	})
 	err := doctorRun(&DoctorOptions{
@@ -182,16 +182,16 @@ func (p *fakeExtProvider) ResolveToken(context.Context, extcred.TokenSpec) (*ext
 // per-identity checks already carry the source-appropriate escalation.
 func TestDoctor_ExternalProvider_IdentityReadyHintNotBlockedCommand(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{
+	if err := configpkg.SaveMultiAppConfig(&configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps:       []core.AppConfig{{Name: "default", AppId: "cli_x", AppSecret: secret.PlainSecret("secret"), Brand: brand.Feishu}},
+		Apps:       []configpkg.AppConfig{{Name: "default", AppId: "cli_x", AppSecret: secret.PlainSecret("secret"), Brand: brand.Feishu}},
 	}); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
 	// Provider serves neither identity: bot unsupported, user supported but not
 	// signed in → both unavailable → identity_ready fails.
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsUser)}
+	cfg := &configpkg.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsUser)}
 	cred := credential.NewCredentialProvider(
 		[]extcred.Provider{&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}}},
 		nil, nil,
@@ -199,7 +199,7 @@ func TestDoctor_ExternalProvider_IdentityReadyHintNotBlockedCommand(t *testing.T
 	)
 	out := &bytes.Buffer{}
 	f := &cmdutil.Factory{
-		Config:     func() (*core.CliConfig, error) { return cfg, nil },
+		Config:     func() (*configpkg.CliConfig, error) { return cfg, nil },
 		Credential: cred,
 		IOStreams:  &cmdutil.IOStreams{Out: out, ErrOut: &bytes.Buffer{}},
 	}
diff --git a/cmd/event/bus_test.go b/cmd/event/bus_test.go
index 804887cdb9..c7d5dcbed7 100644
--- a/cmd/event/bus_test.go
+++ b/cmd/event/bus_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 )
 
 // The hidden `event _bus` daemon command must exit with a typed file_io error
@@ -25,7 +25,7 @@ func TestBusCommandLoggerSetupFailureIsTypedFileIO(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "cli_bus_test", AppSecret: "secret", Brand: brand.Feishu,
 	})
 	cmd := NewCmdBus(f)
diff --git a/cmd/event/format_helpers_test.go b/cmd/event/format_helpers_test.go
index 5e4117b8a6..17b22dfeb1 100644
--- a/cmd/event/format_helpers_test.go
+++ b/cmd/event/format_helpers_test.go
@@ -11,7 +11,7 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/event/protocol"
 	"github.com/larksuite/cli/internal/output"
 )
@@ -287,7 +287,7 @@ func errorAs(err error, target interface{}) bool {
 }
 
 func TestNewCmdFactories_WireFlags(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "cli_XXXXXXXXXXXXXXXX"})
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "cli_XXXXXXXXXXXXXXXX"})
 
 	t.Run("consume", func(t *testing.T) {
 		cmd := NewCmdConsume(f)
diff --git a/cmd/event/list_test.go b/cmd/event/list_test.go
index 294a2d5470..678d709cc1 100644
--- a/cmd/event/list_test.go
+++ b/cmd/event/list_test.go
@@ -9,7 +9,7 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	eventlib "github.com/larksuite/cli/internal/event"
 
 	_ "github.com/larksuite/cli/events"
@@ -29,7 +29,7 @@ func TestEventLookup_VCMeetingLifecycleKeys(t *testing.T) {
 }
 
 func TestRunList_TextOutput(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test"})
 
 	if err := runList(f, false); err != nil {
 		t.Fatalf("runList: %v", err)
@@ -53,7 +53,7 @@ func TestRunList_TextOutput(t *testing.T) {
 }
 
 func TestRunList_JSONOutput(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test"})
 
 	if err := runList(f, true); err != nil {
 		t.Fatalf("runList json: %v", err)
diff --git a/cmd/event/runtime_test.go b/cmd/event/runtime_test.go
index de1000f930..46bb30e984 100644
--- a/cmd/event/runtime_test.go
+++ b/cmd/event/runtime_test.go
@@ -17,7 +17,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/identity"
 )
@@ -47,7 +47,7 @@ func newTestConsumeRuntime(rt http.RoundTripper) *consumeRuntime {
 			SDK:        sdk,
 			ErrOut:     io.Discard,
 			Credential: credential.NewCredentialProvider(nil, nil, &staticTokenResolver{}, nil),
-			Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
+			Config:     &configpkg.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 		},
 		accessIdentity: identity.AsBot,
 	}
diff --git a/cmd/event/schema_test.go b/cmd/event/schema_test.go
index 9d0acf82ac..c2562171dd 100644
--- a/cmd/event/schema_test.go
+++ b/cmd/event/schema_test.go
@@ -12,7 +12,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	eventlib "github.com/larksuite/cli/internal/event"
 	"github.com/larksuite/cli/internal/event/schemas"
 
@@ -43,7 +43,7 @@ type approvalSchemaJSONProperty struct {
 }
 
 func TestRunSchema_ProcessedKey_Text(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test"})
 
 	if err := runSchema(f, "im.message.receive_v1", false); err != nil {
 		t.Fatalf("runSchema: %v", err)
@@ -63,7 +63,7 @@ func TestRunSchema_ProcessedKey_Text(t *testing.T) {
 }
 
 func TestRunSchema_NativeKey_WrapsEnvelope(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test"})
 
 	if err := runSchema(f, "im.message.message_read_v1", false); err != nil {
 		t.Fatalf("runSchema: %v", err)
@@ -83,7 +83,7 @@ func TestRunSchema_NativeKey_WrapsEnvelope(t *testing.T) {
 }
 
 func TestRunSchema_UnknownKey_SuggestsAlternatives(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test"})
 
 	err := runSchema(f, "im.message.recieve_v1", false)
 	if err == nil {
@@ -99,7 +99,7 @@ func TestRunSchema_UnknownKey_SuggestsAlternatives(t *testing.T) {
 }
 
 func TestRunSchema_JSONOutput(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test"})
 
 	if err := runSchema(f, "im.message.receive_v1", true); err != nil {
 		t.Fatalf("runSchema json: %v", err)
@@ -120,7 +120,7 @@ func TestRunSchema_JSONOutput(t *testing.T) {
 }
 
 func TestRunSchema_ReceiveMessageAgentFieldsJSON(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test"})
 
 	if err := runSchema(f, "im.message.receive_v1", true); err != nil {
 		t.Fatalf("runSchema json: %v", err)
@@ -154,7 +154,7 @@ func TestRunSchema_ReceiveMessageAgentFieldsJSON(t *testing.T) {
 }
 
 func TestRunSchema_TaskUpdateUserAccessJSON(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test"})
 
 	if err := runSchema(f, "task.task.update_user_access_v2", true); err != nil {
 		t.Fatalf("runSchema json: %v", err)
@@ -193,7 +193,7 @@ func TestRunSchema_ApprovalStatusChangedJSON(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.key, func(t *testing.T) {
 			t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-			f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+			f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test"})
 
 			if err := runSchema(f, tc.key, true); err != nil {
 				t.Fatalf("runSchema json: %v", err)
@@ -241,7 +241,7 @@ func TestRunSchema_JSONOutput_VCMeetingLifecycleKeys(t *testing.T) {
 		"vc.meeting.participant_meeting_joined_v1",
 	} {
 		t.Run(key, func(t *testing.T) {
-			f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+			f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test"})
 
 			if err := runSchema(f, key, true); err != nil {
 				t.Fatalf("runSchema json: %v", err)
@@ -288,7 +288,7 @@ func TestSchema_RendersSubscriptionKeyMarker(t *testing.T) {
 		Schema: eventlib.SchemaDef{Native: &eventlib.SchemaSpec{Type: reflect.TypeOf(struct{ X string }{})}},
 	})
 
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test"})
 	if err := runSchema(f, syntheticKey, false); err != nil {
 		t.Fatalf("runSchema: %v", err)
 	}
@@ -334,7 +334,7 @@ func TestSchema_JSON_IncludesSubscriptionKey(t *testing.T) {
 		Schema:    eventlib.SchemaDef{Native: &eventlib.SchemaSpec{Type: reflect.TypeOf(struct{ X string }{})}},
 	})
 
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{AppID: "test"})
 	if err := runSchema(f, syntheticKey, true); err != nil {
 		t.Fatalf("runSchema json: %v", err)
 	}
diff --git a/cmd/global_flags.go b/cmd/global_flags.go
index b77e8f189d..c5acd29725 100644
--- a/cmd/global_flags.go
+++ b/cmd/global_flags.go
@@ -4,7 +4,7 @@
 package cmd
 
 import (
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/spf13/pflag"
 )
 
@@ -32,7 +32,7 @@ func RegisterGlobalFlags(fs *pflag.FlagSet, opts *GlobalOptions) {
 // until at least two profiles exist. Intended for the Execute entry point —
 // buildInternal must not call this directly to stay state-free.
 func isSingleAppMode() bool {
-	raw, err := core.LoadMultiAppConfig()
+	raw, err := configpkg.LoadMultiAppConfig()
 	if err != nil || raw == nil {
 		return true
 	}
diff --git a/cmd/global_flags_test.go b/cmd/global_flags_test.go
index 0c6fb7ce4a..b286762e66 100644
--- a/cmd/global_flags_test.go
+++ b/cmd/global_flags_test.go
@@ -10,7 +10,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/secret"
 	"github.com/spf13/pflag"
 )
@@ -60,7 +60,7 @@ func TestIsSingleAppMode_NoConfig(t *testing.T) {
 
 func TestIsSingleAppMode_SingleApp(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	saveAppsForTest(t, []core.AppConfig{
+	saveAppsForTest(t, []configpkg.AppConfig{
 		{Name: "default", AppId: "cli_a", AppSecret: secret.PlainSecret("x"), Brand: brand.Feishu},
 	})
 	if !isSingleAppMode() {
@@ -70,7 +70,7 @@ func TestIsSingleAppMode_SingleApp(t *testing.T) {
 
 func TestIsSingleAppMode_MultiApp(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	saveAppsForTest(t, []core.AppConfig{
+	saveAppsForTest(t, []configpkg.AppConfig{
 		{Name: "a", AppId: "cli_a", AppSecret: secret.PlainSecret("x"), Brand: brand.Feishu},
 		{Name: "b", AppId: "cli_b", AppSecret: secret.PlainSecret("y"), Brand: brand.Feishu},
 	})
@@ -103,10 +103,10 @@ func TestBuildInternal_DefaultShowsProfileFlag(t *testing.T) {
 	}
 }
 
-func saveAppsForTest(t *testing.T, apps []core.AppConfig) {
+func saveAppsForTest(t *testing.T, apps []configpkg.AppConfig) {
 	t.Helper()
-	multi := &core.MultiAppConfig{CurrentApp: apps[0].Name, Apps: apps}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	multi := &configpkg.MultiAppConfig{CurrentApp: apps[0].Name, Apps: apps}
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 }
diff --git a/cmd/profile/add.go b/cmd/profile/add.go
index de6c032506..6a256bda9b 100644
--- a/cmd/profile/add.go
+++ b/cmd/profile/add.go
@@ -15,7 +15,7 @@ import (
 	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/output"
 	secretpkg "github.com/larksuite/cli/internal/secret"
@@ -55,7 +55,7 @@ func NewCmdProfileAdd(f *cmdutil.Factory) *cobra.Command {
 }
 
 func profileAddRun(f *cmdutil.Factory, name, appID string, appSecretStdin bool, brand, lang string, useAfter bool) error {
-	if err := core.ValidateProfileName(name); err != nil {
+	if err := configpkg.ValidateProfileName(name); err != nil {
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "%v", err).
 			WithCause(err).
 			WithParam("--name")
@@ -92,12 +92,12 @@ func profileAddRun(f *cmdutil.Factory, name, appID string, appSecretStdin bool,
 	}
 
 	// Load or create config
-	multi, err := core.LoadMultiAppConfig()
+	multi, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		if !errors.Is(err, os.ErrNotExist) {
 			return errs.NewInternalError(errs.SubtypeFileIO, "failed to load config: %v", err).WithCause(err)
 		}
-		multi = &core.MultiAppConfig{}
+		multi = &configpkg.MultiAppConfig{}
 	}
 
 	// Check name uniqueness
@@ -133,13 +133,13 @@ func profileAddRun(f *cmdutil.Factory, name, appID string, appSecretStdin bool,
 	}
 
 	// Append profile
-	multi.Apps = append(multi.Apps, core.AppConfig{
+	multi.Apps = append(multi.Apps, configpkg.AppConfig{
 		Name:      name,
 		AppId:     appID,
 		AppSecret: secret,
 		Brand:     parsedBrand,
 		Lang:      i18n.Lang(lang),
-		Users:     []core.AppUser{},
+		Users:     []configpkg.AppUser{},
 	})
 
 	if useAfter {
@@ -149,7 +149,7 @@ func profileAddRun(f *cmdutil.Factory, name, appID string, appSecretStdin bool,
 		multi.CurrentApp = name
 	}
 
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		return errs.NewInternalError(errs.SubtypeStorage, "failed to save config: %v", err).WithCause(err)
 	}
 
diff --git a/cmd/profile/list.go b/cmd/profile/list.go
index 1a44625ad9..617f3433dc 100644
--- a/cmd/profile/list.go
+++ b/cmd/profile/list.go
@@ -13,7 +13,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 )
 
@@ -41,7 +41,7 @@ func NewCmdProfileList(f *cmdutil.Factory) *cobra.Command {
 }
 
 func profileListRun(f *cmdutil.Factory) error {
-	multi, err := core.LoadMultiAppConfig()
+	multi, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			output.PrintJson(f.IOStreams.Out, []profileListItem{})
diff --git a/cmd/profile/profile_test.go b/cmd/profile/profile_test.go
index f925e76413..e4f578b8e3 100644
--- a/cmd/profile/profile_test.go
+++ b/cmd/profile/profile_test.go
@@ -14,7 +14,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/secret"
@@ -77,7 +77,7 @@ func TestProfileAddRun_Lang(t *testing.T) {
 			if err := profileAddRun(f, "p", "app-p", true, "feishu", in, false); err != nil {
 				t.Fatalf("--lang %q: profileAddRun() error = %v", in, err)
 			}
-			saved, err := core.LoadMultiAppConfig()
+			saved, err := configpkg.LoadMultiAppConfig()
 			if err != nil {
 				t.Fatalf("LoadMultiAppConfig() error = %v", err)
 			}
@@ -94,7 +94,7 @@ func TestProfileAddRun_Lang(t *testing.T) {
 		if err := profileAddRun(f, "p", "app-p", true, "feishu", "", false); err != nil {
 			t.Fatalf("profileAddRun() error = %v", err)
 		}
-		saved, _ := core.LoadMultiAppConfig()
+		saved, _ := configpkg.LoadMultiAppConfig()
 		if app := saved.FindApp("p"); app == nil || app.Lang != "" {
 			t.Errorf("stored Lang = %v, want \"\" (unset)", app)
 		}
@@ -117,13 +117,13 @@ func TestProfileAddRun_Lang(t *testing.T) {
 
 func TestProfileAddRun_UseAfterUpdatesCurrentAndPrevious(t *testing.T) {
 	setupProfileConfigDir(t)
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -134,7 +134,7 @@ func TestProfileAddRun_UseAfterUpdatesCurrentAndPrevious(t *testing.T) {
 		t.Fatalf("profileAddRun() error = %v", err)
 	}
 
-	saved, err := core.LoadMultiAppConfig()
+	saved, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig() error = %v", err)
 	}
@@ -151,15 +151,15 @@ func TestProfileAddRun_UseAfterUpdatesCurrentAndPrevious(t *testing.T) {
 
 func TestProfileRemoveRun_RemovesCurrentProfileAndSwitchesToFirstRemaining(t *testing.T) {
 	setupProfileConfigDir(t)
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp:  "target",
 		PreviousApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
 			{Name: "target", AppId: "app-target", AppSecret: secret.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -168,7 +168,7 @@ func TestProfileRemoveRun_RemovesCurrentProfileAndSwitchesToFirstRemaining(t *te
 		t.Fatalf("profileRemoveRun() error = %v", err)
 	}
 
-	saved, err := core.LoadMultiAppConfig()
+	saved, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig() error = %v", err)
 	}
@@ -185,17 +185,17 @@ func TestProfileRemoveRun_RemovesCurrentProfileAndSwitchesToFirstRemaining(t *te
 
 func TestProfileRenameRun_UpdatesCurrentAndPreviousReferences(t *testing.T) {
 	setupProfileConfigDir(t)
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp:  "old",
 		PreviousApp: "old",
-		Apps: []core.AppConfig{{
+		Apps: []configpkg.AppConfig{{
 			Name:      "old",
 			AppId:     "app-old",
 			AppSecret: secret.PlainSecret("secret-old"),
 			Brand:     brand.Feishu,
 		}},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -204,7 +204,7 @@ func TestProfileRenameRun_UpdatesCurrentAndPreviousReferences(t *testing.T) {
 		t.Fatalf("profileRenameRun() error = %v", err)
 	}
 
-	saved, err := core.LoadMultiAppConfig()
+	saved, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig() error = %v", err)
 	}
@@ -221,17 +221,17 @@ func TestProfileRenameRun_UpdatesCurrentAndPreviousReferences(t *testing.T) {
 
 func TestProfileRenameRun_AllowsRenameToOwnAppID(t *testing.T) {
 	setupProfileConfigDir(t)
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp:  "old",
 		PreviousApp: "old",
-		Apps: []core.AppConfig{{
+		Apps: []configpkg.AppConfig{{
 			Name:      "old",
 			AppId:     "app-old",
 			AppSecret: secret.PlainSecret("secret-old"),
 			Brand:     brand.Feishu,
 		}},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -240,7 +240,7 @@ func TestProfileRenameRun_AllowsRenameToOwnAppID(t *testing.T) {
 		t.Fatalf("profileRenameRun() error = %v", err)
 	}
 
-	saved, err := core.LoadMultiAppConfig()
+	saved, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig() error = %v", err)
 	}
@@ -257,15 +257,15 @@ func TestProfileRenameRun_AllowsRenameToOwnAppID(t *testing.T) {
 
 func TestProfileUseRun_ToggleBackUsesPreviousProfile(t *testing.T) {
 	setupProfileConfigDir(t)
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp:  "default",
 		PreviousApp: "target",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
 			{Name: "target", AppId: "app-target", AppSecret: secret.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -274,7 +274,7 @@ func TestProfileUseRun_ToggleBackUsesPreviousProfile(t *testing.T) {
 		t.Fatalf("profileUseRun() error = %v", err)
 	}
 
-	saved, err := core.LoadMultiAppConfig()
+	saved, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		t.Fatalf("LoadMultiAppConfig() error = %v", err)
 	}
@@ -288,14 +288,14 @@ func TestProfileUseRun_ToggleBackUsesPreviousProfile(t *testing.T) {
 
 func TestProfileListRun_OutputsProfiles(t *testing.T) {
 	setupProfileConfigDir(t)
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
 			{Name: "target", AppId: "app-target", AppSecret: secret.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -341,14 +341,14 @@ func TestProfileListRun_NotConfiguredReturnsEmptyList(t *testing.T) {
 
 func TestProfileRemoveRun_SaveFailureReturnsStructuredError(t *testing.T) {
 	setupProfileConfigDir(t)
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "target",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
 			{Name: "target", AppId: "app-target", AppSecret: secret.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -366,16 +366,16 @@ func TestProfileRemoveRun_SaveFailureReturnsStructuredError(t *testing.T) {
 
 func TestProfileRenameRun_SaveFailureReturnsStructuredError(t *testing.T) {
 	setupProfileConfigDir(t)
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "old",
-		Apps: []core.AppConfig{{
+		Apps: []configpkg.AppConfig{{
 			Name:      "old",
 			AppId:     "app-old",
 			AppSecret: secret.PlainSecret("secret-old"),
 			Brand:     brand.Feishu,
 		}},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -393,14 +393,14 @@ func TestProfileRenameRun_SaveFailureReturnsStructuredError(t *testing.T) {
 
 func TestProfileUseRun_SaveFailureReturnsStructuredError(t *testing.T) {
 	setupProfileConfigDir(t)
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
 			{Name: "target", AppId: "app-target", AppSecret: secret.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -463,14 +463,14 @@ func assertValidationError(t *testing.T, err error, wantSubtype errs.Subtype, wa
 
 func saveTwoProfiles(t *testing.T) {
 	t.Helper()
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{Name: "default", AppId: "app-default", AppSecret: secret.PlainSecret("secret-default"), Brand: brand.Feishu},
 			{Name: "target", AppId: "app-target", AppSecret: secret.PlainSecret("secret-target"), Brand: brand.Lark},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 }
@@ -611,13 +611,13 @@ func TestProfileRemoveRun_ValidationErrors(t *testing.T) {
 
 	t.Run("cannot remove the only profile", func(t *testing.T) {
 		setupProfileConfigDir(t)
-		multi := &core.MultiAppConfig{
+		multi := &configpkg.MultiAppConfig{
 			CurrentApp: "solo",
-			Apps: []core.AppConfig{
+			Apps: []configpkg.AppConfig{
 				{Name: "solo", AppId: "app-solo", AppSecret: secret.PlainSecret("secret-solo"), Brand: brand.Feishu},
 			},
 		}
-		if err := core.SaveMultiAppConfig(multi); err != nil {
+		if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 			t.Fatalf("SaveMultiAppConfig() error = %v", err)
 		}
 		f, _, _, _ := cmdutil.TestFactory(t, nil)
diff --git a/cmd/profile/remove.go b/cmd/profile/remove.go
index 5b7d86cf09..033860df13 100644
--- a/cmd/profile/remove.go
+++ b/cmd/profile/remove.go
@@ -12,7 +12,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/secret"
 )
@@ -35,7 +35,7 @@ func NewCmdProfileRemove(f *cmdutil.Factory) *cobra.Command {
 }
 
 func profileRemoveRun(f *cmdutil.Factory, name string) error {
-	multi, err := core.LoadOrNotConfigured()
+	multi, err := configpkg.LoadOrNotConfigured()
 	if err != nil {
 		return err
 	}
@@ -67,7 +67,7 @@ func profileRemoveRun(f *cmdutil.Factory, name string) error {
 		multi.PreviousApp = ""
 	}
 
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		return errs.NewInternalError(errs.SubtypeStorage, "failed to save config: %v", err).WithCause(err)
 	}
 
diff --git a/cmd/profile/rename.go b/cmd/profile/rename.go
index 9506870f3b..7de7d1b22e 100644
--- a/cmd/profile/rename.go
+++ b/cmd/profile/rename.go
@@ -11,7 +11,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 )
 
@@ -30,11 +30,11 @@ func NewCmdProfileRename(f *cmdutil.Factory) *cobra.Command {
 }
 
 func profileRenameRun(f *cmdutil.Factory, oldName, newName string) error {
-	if err := core.ValidateProfileName(newName); err != nil {
+	if err := configpkg.ValidateProfileName(newName); err != nil {
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "%v", err).WithCause(err)
 	}
 
-	multi, err := core.LoadOrNotConfigured()
+	multi, err := configpkg.LoadOrNotConfigured()
 	if err != nil {
 		return err
 	}
@@ -67,7 +67,7 @@ func profileRenameRun(f *cmdutil.Factory, oldName, newName string) error {
 		multi.PreviousApp = newName
 	}
 
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		return errs.NewInternalError(errs.SubtypeStorage, "failed to save config: %v", err).WithCause(err)
 	}
 
diff --git a/cmd/profile/use.go b/cmd/profile/use.go
index 7080d52775..608c63225f 100644
--- a/cmd/profile/use.go
+++ b/cmd/profile/use.go
@@ -11,7 +11,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 )
 
@@ -33,7 +33,7 @@ func NewCmdProfileUse(f *cmdutil.Factory) *cobra.Command {
 }
 
 func profileUseRun(f *cmdutil.Factory, name string) error {
-	multi, err := core.LoadOrNotConfigured()
+	multi, err := configpkg.LoadOrNotConfigured()
 	if err != nil {
 		return err
 	}
@@ -67,7 +67,7 @@ func profileUseRun(f *cmdutil.Factory, name string) error {
 	}
 	multi.CurrentApp = targetName
 
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		return errs.NewInternalError(errs.SubtypeStorage, "failed to save config: %v", err).WithCause(err)
 	}
 
diff --git a/cmd/root_integration_test.go b/cmd/root_integration_test.go
index a7d693b612..71f1f7934b 100644
--- a/cmd/root_integration_test.go
+++ b/cmd/root_integration_test.go
@@ -19,7 +19,7 @@ import (
 	"github.com/larksuite/cli/internal/apicatalog"
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/meta"
@@ -170,9 +170,9 @@ func newStrictModeDefaultFactory(t *testing.T, profile string, mode identity.Str
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
 
 	targetMode := mode
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{
 				Name:      "default",
 				AppId:     "app-default",
@@ -188,7 +188,7 @@ func newStrictModeDefaultFactory(t *testing.T, profile string, mode identity.Str
 			},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -431,7 +431,7 @@ func TestIntegration_StrictModeBot_ProfileOverride_APIExplicitUserReturnsEnvelop
 // --- shortcut command ---
 
 func TestIntegration_Shortcut_BusinessError_OutputsEnvelope(t *testing.T) {
-	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, stderr, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "e2e-sc-err", AppSecret: "secret", Brand: brand.Feishu,
 	})
 	reg.Register(&httpmock.Stub{
diff --git a/cmd/root_test.go b/cmd/root_test.go
index 56d4d74a82..fe00d679d4 100644
--- a/cmd/root_test.go
+++ b/cmd/root_test.go
@@ -21,7 +21,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	internalauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/deprecation"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
@@ -307,7 +307,7 @@ func TestHandleRootError_DeprecatedAliasMissingFlagStructured(t *testing.T) {
 // TestHandleRootError_AuthConfigWireGolden is the wire-consistency regression
 // baseline for auth/config errors: it pins the typed envelope and exit code the
 // dispatcher produces for the two source-of-truth shapes, which are constructed
-// typed at their origin in internal/auth and internal/core.
+// typed at their origin in internal/auth and internal/configpkg.
 func TestHandleRootError_AuthConfigWireGolden(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
@@ -347,7 +347,7 @@ func TestHandleRootError_AuthConfigWireGolden(t *testing.T) {
 		errOut := &bytes.Buffer{}
 		f.IOStreams.ErrOut = errOut
 
-		exit := handleRootError(f, core.NotConfiguredError())
+		exit := handleRootError(f, configpkg.NotConfiguredError())
 		if exit != int(output.ExitAuth) {
 			t.Errorf("exit = %d, want %d (config shares ExitAuth)", exit, int(output.ExitAuth))
 		}
@@ -514,7 +514,7 @@ func TestHandleRootError_TypedAuthErrorWithLegacyCausePreserved(t *testing.T) {
 func TestApplyNeedAuthorizationHint_ServiceMethodUsesLocalScopesWhenNoUAT(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	f.ResolvedIdentity = identity.AsUser
@@ -562,7 +562,7 @@ func TestApplyNeedAuthorizationHint_ServiceMethodUsesLocalScopesWhenNoUAT(t *tes
 func TestApplyNeedAuthorizationHint_ShortcutUsesDeclaredScopesWhenNoUAT(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	f.ResolvedIdentity = identity.AsUser
@@ -587,7 +587,7 @@ func TestApplyNeedAuthorizationHint_ShortcutUsesDeclaredScopesWhenNoUAT(t *testi
 func TestApplyNeedAuthorizationHint_ShortcutIncludesConditionalScopes(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	f.ResolvedIdentity = identity.AsUser
@@ -613,7 +613,7 @@ func TestApplyNeedAuthorizationHint_ShortcutIncludesConditionalScopes(t *testing
 func TestApplyNeedAuthorizationHint_AppendsExistingHint(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	f.ResolvedIdentity = identity.AsUser
diff --git a/cmd/schema/schema_test.go b/cmd/schema/schema_test.go
index a6615270e2..7f09337b38 100644
--- a/cmd/schema/schema_test.go
+++ b/cmd/schema/schema_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 )
 
 func TestSchemaCmd_FlagParsing(t *testing.T) {
@@ -199,7 +199,7 @@ func TestSchemaCmd_NoYesForReadRisk(t *testing.T) {
 }
 
 func TestSchemaCmd_UnknownService(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -228,7 +228,7 @@ func TestSchemaCmd_UnknownService(t *testing.T) {
 // JSON-mode unknown-method path: *errs.ValidationError with
 // subtype invalid_argument and a hint listing the available methods.
 func TestSchemaCmd_UnknownMethod_TypedValidation(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
diff --git a/cmd/service/service.go b/cmd/service/service.go
index 8f54c7d19a..a559acf8b7 100644
--- a/cmd/service/service.go
+++ b/cmd/service/service.go
@@ -16,7 +16,7 @@ import (
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/cmdmeta"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/errclass"
 	identitypkg "github.com/larksuite/cli/internal/identity"
@@ -454,7 +454,7 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {
 }
 
 // checkServiceScopes pre-checks user scopes before making the API call.
-func checkServiceScopes(ctx context.Context, cred *credential.CredentialProvider, identity identitypkg.Identity, config *core.CliConfig, method meta.Method) error {
+func checkServiceScopes(ctx context.Context, cred *credential.CredentialProvider, identity identitypkg.Identity, config *configpkg.CliConfig, method meta.Method) error {
 	if ctx.Err() != nil {
 		return ctx.Err()
 	}
@@ -668,7 +668,7 @@ func buildServiceRequest(opts *ServiceMethodOptions) (client.RawApiRequest, *cmd
 	return request, nil, nil
 }
 
-func serviceDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, opts *ServiceMethodOptions) error {
+func serviceDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *configpkg.CliConfig, opts *ServiceMethodOptions) error {
 	return cmdutil.PrintDryRun(request, config, serviceDryRunOutputOptions(f, opts))
 }
 
diff --git a/cmd/service/service_paginate_test.go b/cmd/service/service_paginate_test.go
index 303fdab908..10e379aa64 100644
--- a/cmd/service/service_paginate_test.go
+++ b/cmd/service/service_paginate_test.go
@@ -17,7 +17,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
@@ -46,7 +46,7 @@ func newServicePaginateTestHarness(t *testing.T) (*client.APIClient, *bytes.Buff
 	output.PendingNotice = nil
 	t.Cleanup(func() { output.PendingNotice = previousNotice })
 
-	config := &core.CliConfig{
+	config := &configpkg.CliConfig{
 		AppID:     "test-app",
 		AppSecret: "test-secret",
 		Brand:     brand.Feishu,
diff --git a/cmd/service/service_test.go b/cmd/service/service_test.go
index 17df6ba984..730812718e 100644
--- a/cmd/service/service_test.go
+++ b/cmd/service/service_test.go
@@ -19,7 +19,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	extcs "github.com/larksuite/cli/extension/contentsafety"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/meta"
@@ -28,7 +28,7 @@ import (
 
 // ── helpers ──
 
-var testConfig = &core.CliConfig{
+var testConfig = &configpkg.CliConfig{
 	AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 }
 
@@ -133,7 +133,7 @@ func TestRegisterService_MergesExistingCommand(t *testing.T) {
 }
 
 func TestNewCmdServiceMethod_StrictModeHidesAsFlag(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu, SupportedIdentities: 2,
 	})
 
@@ -465,7 +465,7 @@ func TestServiceMethod_BotMode_Success(t *testing.T) {
 }
 
 func TestServiceMethod_BotMode_PageAll_JSON(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-page", AppSecret: "test-secret-page", Brand: brand.Feishu,
 	})
 
@@ -533,7 +533,7 @@ func TestServiceMethod_PageAll_DefaultJSONRunsContentSafety(t *testing.T) {
 	extcs.Register(provider)
 	t.Cleanup(func() { extcs.Register(nil) })
 
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-service-safety", AppSecret: "test-secret-service-safety", Brand: brand.Feishu,
 	})
 
@@ -587,7 +587,7 @@ func TestServiceMethod_PageAll_StreamFormatRunsContentSafety(t *testing.T) {
 	extcs.Register(provider)
 	t.Cleanup(func() { extcs.Register(nil) })
 
-	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, stderr, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-service-stream-safety", AppSecret: "test-secret-service-stream-safety", Brand: brand.Feishu,
 	})
 
@@ -635,7 +635,7 @@ func TestServiceMethod_PageAll_StreamFormatBlockSkipsBlockedPage(t *testing.T) {
 	extcs.Register(provider)
 	t.Cleanup(func() { extcs.Register(nil) })
 
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-service-stream-block", AppSecret: "test-secret-service-stream-block", Brand: brand.Feishu,
 	})
 
@@ -691,7 +691,7 @@ func TestServiceMethod_PageAll_StreamFormatBlockSkipsBlockedPage(t *testing.T) {
 }
 
 func TestServiceMethod_BusinessErrorReturnsTypedErrorWithoutSuccessEnvelope(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-service-err", AppSecret: "test-secret-service-err", Brand: brand.Feishu,
 	})
 
@@ -722,7 +722,7 @@ func TestServiceMethod_BusinessErrorReturnsTypedErrorWithoutSuccessEnvelope(t *t
 }
 
 func TestServiceMethod_PageAll_DefaultBusinessErrorOutputsRawResponse(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-service-pageall-err", AppSecret: "test-secret-service-pageall-err", Brand: brand.Feishu,
 	})
 
@@ -752,7 +752,7 @@ func TestServiceMethod_PageAll_DefaultBusinessErrorOutputsRawResponse(t *testing
 }
 
 func TestServiceMethod_PageAll_StreamBusinessErrorDoesNotDumpJSON(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-service-pageall-stream-err", AppSecret: "test-secret-service-pageall-stream-err", Brand: brand.Feishu,
 	})
 
@@ -798,7 +798,7 @@ func TestServiceMethod_PageAll_StreamBusinessErrorDoesNotDumpJSON(t *testing.T)
 }
 
 func TestServiceMethod_UnknownFormat_Warning(t *testing.T) {
-	f, _, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, stderr, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-fmt", AppSecret: "test-secret-fmt", Brand: brand.Feishu,
 	})
 
@@ -882,7 +882,7 @@ func TestServiceMethod_JqAndOutputConflict(t *testing.T) {
 }
 
 func TestServiceMethod_JqFilter_AppliesExpression(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-jq", AppSecret: "test-secret-jq", Brand: brand.Feishu,
 	})
 
@@ -953,7 +953,7 @@ func TestServiceMethod_JqInvalidExpression(t *testing.T) {
 }
 
 func TestServiceMethod_PageAll_WithJq(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-spjq", AppSecret: "test-secret-spjq", Brand: brand.Feishu,
 	})
 
@@ -986,7 +986,7 @@ func TestServiceMethod_PageAll_WithJq(t *testing.T) {
 }
 
 func TestServiceMethod_PageAll_WithJqBusinessErrorOutputsRawResponse(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, reg := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app-spjq-err", AppSecret: "test-secret-spjq-err", Brand: brand.Feishu,
 	})
 
diff --git a/cmd/startup_brand.go b/cmd/startup_brand.go
index 6d71f63f30..a7a0d9e5c5 100644
--- a/cmd/startup_brand.go
+++ b/cmd/startup_brand.go
@@ -8,7 +8,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/envnames"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 )
 
 // ResolveStartupBrand resolves the brand before the command tree is built, so
@@ -20,7 +20,7 @@ func ResolveStartupBrand(profile string) brand.Brand {
 	if raw := os.Getenv(envnames.CliBrand); raw != "" {
 		return brand.ParseBrand(raw)
 	}
-	if cfg, err := core.LoadMultiAppConfig(); err == nil {
+	if cfg, err := configpkg.LoadMultiAppConfig(); err == nil {
 		if app := cfg.CurrentAppConfig(profile); app != nil {
 			return brand.ParseBrand(string(app.Brand))
 		}
diff --git a/cmd/update/update.go b/cmd/update/update.go
index fecb98f9f2..417c8f4670 100644
--- a/cmd/update/update.go
+++ b/cmd/update/update.go
@@ -15,7 +15,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/selfupdate"
 	"github.com/larksuite/cli/internal/skillscheck"
@@ -180,7 +180,7 @@ func resolveSkillsBrand(f *cmdutil.Factory, errOut stdio.Writer) brand.Brand {
 	if cfg, err := f.Config(); err == nil && cfg != nil {
 		return brand.ParseBrand(string(cfg.Brand))
 	}
-	if raw, err := core.LoadMultiAppConfig(); err == nil {
+	if raw, err := configpkg.LoadMultiAppConfig(); err == nil {
 		if app := raw.CurrentAppConfig(f.Invocation.Profile); app != nil {
 			return brand.ParseBrand(string(app.Brand))
 		}
diff --git a/cmd/update/update_test.go b/cmd/update/update_test.go
index 005bb12a19..0f9a0d2268 100644
--- a/cmd/update/update_test.go
+++ b/cmd/update/update_test.go
@@ -19,7 +19,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/selfupdate"
 	"github.com/larksuite/cli/internal/skillscheck"
@@ -30,7 +30,7 @@ const runLiveSkillsTestsEnv = "LARKSUITE_CLI_RUN_LIVE_SKILLS_TESTS"
 // newTestFactory creates a test factory with minimal config.
 func newTestFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer) {
 	t.Helper()
-	f, stdout, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{})
+	f, stdout, stderr, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{})
 	return f, stdout, stderr
 }
 
@@ -1865,8 +1865,8 @@ func containsString(values []string, target string) bool {
 func TestResolveSkillsBrand_LayeredFallback(t *testing.T) {
 	// Layer 1: resolved config wins.
 	var errBuf bytes.Buffer
-	f := &cmdutil.Factory{Config: func() (*core.CliConfig, error) {
-		return &core.CliConfig{Brand: brand.Brand(" LARK ")}, nil
+	f := &cmdutil.Factory{Config: func() (*configpkg.CliConfig, error) {
+		return &configpkg.CliConfig{Brand: brand.Brand(" LARK ")}, nil
 	}}
 	if got := resolveSkillsBrand(f, &errBuf); got != brand.Lark {
 		t.Errorf("resolved-config brand = %q, want lark", got)
@@ -1880,7 +1880,7 @@ func TestResolveSkillsBrand_LayeredFallback(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(tmp, "config.json"), []byte(raw), 0600); err != nil {
 		t.Fatal(err)
 	}
-	f = &cmdutil.Factory{Config: func() (*core.CliConfig, error) { return nil, errors.New("keychain locked") }}
+	f = &cmdutil.Factory{Config: func() (*configpkg.CliConfig, error) { return nil, errors.New("keychain locked") }}
 	errBuf.Reset()
 	if got := resolveSkillsBrand(f, &errBuf); got != brand.Lark {
 		t.Errorf("raw-config brand = %q, want lark", got)
@@ -1912,7 +1912,7 @@ func TestResolveSkillsBrand_RespectsActiveProfile(t *testing.T) {
 	}
 	f := &cmdutil.Factory{
 		Invocation: cmdutil.InvocationContext{Profile: "lark-prof"},
-		Config:     func() (*core.CliConfig, error) { return nil, errors.New("keychain locked") },
+		Config:     func() (*configpkg.CliConfig, error) { return nil, errors.New("keychain locked") },
 	}
 	var errBuf bytes.Buffer
 	if got := resolveSkillsBrand(f, &errBuf); got != brand.Lark {
diff --git a/cmd/whoami/whoami.go b/cmd/whoami/whoami.go
index 23565f36fd..d24cd334e7 100644
--- a/cmd/whoami/whoami.go
+++ b/cmd/whoami/whoami.go
@@ -10,7 +10,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/identitydiag"
 	"github.com/larksuite/cli/internal/output"
@@ -124,7 +124,7 @@ func resolveSource(changedAs bool, flagAs identity.Identity, autoDetected bool,
 
 // buildResult maps the resolved identity and local diagnostics into the output.
 // ResolveAs only ever returns user or bot, so the default branch handles user.
-func buildResult(cfg *core.CliConfig, as identity.Identity, source string, diag identitydiag.Result) *whoamiResult {
+func buildResult(cfg *configpkg.CliConfig, as identity.Identity, source string, diag identitydiag.Result) *whoamiResult {
 	defaultAs := cfg.DefaultAs
 	if defaultAs == "" {
 		defaultAs = identity.AsAuto
diff --git a/cmd/whoami/whoami_test.go b/cmd/whoami/whoami_test.go
index 4985845bff..284898a14e 100644
--- a/cmd/whoami/whoami_test.go
+++ b/cmd/whoami/whoami_test.go
@@ -17,7 +17,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/identitydiag"
@@ -50,7 +50,7 @@ func TestResolveSource(t *testing.T) {
 }
 
 func TestBuildResult_UserValid(t *testing.T) {
-	cfg := &core.CliConfig{ProfileName: "my-app", AppID: "cli_x", Brand: brand.Lark, DefaultAs: identity.AsAuto}
+	cfg := &configpkg.CliConfig{ProfileName: "my-app", AppID: "cli_x", Brand: brand.Lark, DefaultAs: identity.AsAuto}
 	diag := identitydiag.Result{
 		User: identitydiag.Identity{Available: true, Status: "ready", TokenStatus: "valid", OpenID: "ou_x", UserName: "Alice"},
 	}
@@ -75,7 +75,7 @@ func TestBuildResult_UserValid(t *testing.T) {
 }
 
 func TestBuildResult_UserMissingToken(t *testing.T) {
-	cfg := &core.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: brand.Lark}
+	cfg := &configpkg.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: brand.Lark}
 	diag := identitydiag.Result{
 		User: identitydiag.Identity{Available: false, Status: "missing", Hint: "run: lark-cli auth login --help"}, // never logged in
 	}
@@ -98,7 +98,7 @@ func TestBuildResult_UserMissingToken(t *testing.T) {
 }
 
 func TestBuildResult_BotReady(t *testing.T) {
-	cfg := &core.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: brand.Feishu, DefaultAs: identity.AsBot}
+	cfg := &configpkg.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: brand.Feishu, DefaultAs: identity.AsBot}
 	diag := identitydiag.Result{
 		Bot: identitydiag.Identity{Available: true, Status: "ready"},
 	}
@@ -119,7 +119,7 @@ func TestBuildResult_BotReady(t *testing.T) {
 }
 
 func TestBuildResult_BotNotConfigured(t *testing.T) {
-	cfg := &core.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{ProfileName: "p", AppID: "cli_x", Brand: brand.Feishu}
 	diag := identitydiag.Result{
 		Bot: identitydiag.Identity{Available: false, Status: "not_configured", Hint: "run: lark-cli config --help"},
 	}
@@ -137,7 +137,7 @@ func TestBuildResult_BotNotConfigured(t *testing.T) {
 }
 
 func TestWhoami_BotJSON(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "test-profile", AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 
@@ -171,7 +171,7 @@ func TestWhoami_BotJSON(t *testing.T) {
 func TestWhoami_RejectsInvalidAs(t *testing.T) {
 	for _, bad := range []string{"admin", "USER", "bogus123", ""} {
 		t.Run("as="+bad, func(t *testing.T) {
-			f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+			f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 				ProfileName: "p", AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 			})
 			cmd := NewCmdWhoami(f)
@@ -197,11 +197,11 @@ func TestWhoami_RejectsInvalidAs(t *testing.T) {
 }
 
 func TestWhoami_ConfigErrorPropagates(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "p", AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	})
 	wantErr := fmt.Errorf("boom")
-	f.Config = func() (*core.CliConfig, error) { return nil, wantErr }
+	f.Config = func() (*configpkg.CliConfig, error) { return nil, wantErr }
 
 	cmd := NewCmdWhoami(f)
 	cmd.SetArgs([]string{"--json"})
@@ -220,7 +220,7 @@ func TestWhoami_StrictModeRejectsCrossIdentity(t *testing.T) {
 	// Bot-only account → strict mode bot. A real `--as user` call would be
 	// rejected by CheckStrictMode; whoami must reject it identically rather than
 	// previewing a user identity the next call would refuse.
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		ProfileName: "p", AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		SupportedIdentities: 2, // bot only
 	})
@@ -249,7 +249,7 @@ func (p *fakeExtProvider) ResolveToken(context.Context, extcred.TokenSpec) (*ext
 	return nil, nil // no UAT served locally; whoami runs with verify=false
 }
 
-func externalWhoamiFactory(cfg *core.CliConfig) (*cmdutil.Factory, *bytes.Buffer) {
+func externalWhoamiFactory(cfg *configpkg.CliConfig) (*cmdutil.Factory, *bytes.Buffer) {
 	cred := credential.NewCredentialProvider(
 		[]extcred.Provider{&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: cfg.AppID}}},
 		nil, nil,
@@ -257,7 +257,7 @@ func externalWhoamiFactory(cfg *core.CliConfig) (*cmdutil.Factory, *bytes.Buffer
 	)
 	out := &bytes.Buffer{}
 	f := &cmdutil.Factory{
-		Config:     func() (*core.CliConfig, error) { return cfg, nil },
+		Config:     func() (*configpkg.CliConfig, error) { return cfg, nil },
 		Credential: cred,
 		IOStreams:  &cmdutil.IOStreams{Out: out, ErrOut: &bytes.Buffer{}},
 	}
@@ -268,7 +268,7 @@ func externalWhoamiFactory(cfg *core.CliConfig) (*cmdutil.Factory, *bytes.Buffer
 // an extension provider, a signed-in user must read as available, and an
 // unavailable identity must not be told to "auth login" (which is blocked).
 func TestWhoami_ExternalProvider_UserReady(t *testing.T) {
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		ProfileName: "p", AppID: "cli_x", Brand: brand.Feishu,
 		SupportedIdentities: uint8(extcred.SupportsAll), UserOpenId: "ou_x", UserName: "Alice",
 	}
@@ -295,7 +295,7 @@ func TestWhoami_ExternalProvider_UserReady(t *testing.T) {
 }
 
 func TestWhoami_ExternalProvider_UserHintNotKeychain(t *testing.T) {
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		ProfileName: "p", AppID: "cli_x", Brand: brand.Feishu,
 		SupportedIdentities: uint8(extcred.SupportsUser), // user supported but not signed in
 	}
diff --git a/internal/auth/uat_client.go b/internal/auth/uat_client.go
index d59f2a7ad4..8d65a55c46 100644
--- a/internal/auth/uat_client.go
+++ b/internal/auth/uat_client.go
@@ -20,7 +20,7 @@ import (
 	"github.com/gofrs/flock"
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/vfs"
 	"github.com/larksuite/cli/internal/workspace"
@@ -54,7 +54,7 @@ type UATStatus struct {
 }
 
 // NewUATCallOptions creates UATCallOptions from a CLI config.
-func NewUATCallOptions(cfg *core.CliConfig, errOut io.Writer) UATCallOptions {
+func NewUATCallOptions(cfg *configpkg.CliConfig, errOut io.Writer) UATCallOptions {
 	if errOut == nil {
 		errOut = os.Stderr
 	}
diff --git a/internal/auth/uat_client_options_test.go b/internal/auth/uat_client_options_test.go
index 7729c63350..e05bd50411 100644
--- a/internal/auth/uat_client_options_test.go
+++ b/internal/auth/uat_client_options_test.go
@@ -8,12 +8,12 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/brand"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 )
 
 // TestNewUATCallOptions validates the extraction of options from CLI config.
 func TestNewUATCallOptions(t *testing.T) {
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "app123",
 		AppSecret:  "secret",
 		Brand:      brand.Lark,
diff --git a/internal/client/client.go b/internal/client/client.go
index 2cac3a61c9..7c522d868a 100644
--- a/internal/client/client.go
+++ b/internal/client/client.go
@@ -20,7 +20,7 @@ import (
 
 	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/errclass"
 	identitypkg "github.com/larksuite/cli/internal/identity"
@@ -40,7 +40,7 @@ type RawApiRequest struct {
 
 // APIClient wraps lark.Client for all Lark Open API calls.
 type APIClient struct {
-	Config     *core.CliConfig
+	Config     *configpkg.CliConfig
 	SDK        *lark.Client // All Lark API calls go through SDK
 	HTTP       *http.Client // Only for non-Lark API (OAuth, MCP, etc.)
 	ErrOut     io.Writer    // debug/progress output
diff --git a/internal/client/client_test.go b/internal/client/client_test.go
index 9e0ae3c9d3..5f6051ff6c 100644
--- a/internal/client/client_test.go
+++ b/internal/client/client_test.go
@@ -22,7 +22,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	internalauth "github.com/larksuite/cli/internal/auth"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
@@ -61,7 +61,7 @@ func newTestAPIClient(t *testing.T, rt http.RoundTripper) (*APIClient, *bytes.Bu
 		lark.WithHttpClient(httpClient),
 	)
 	testCred := credential.NewCredentialProvider(nil, nil, &staticTokenResolver{}, nil)
-	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu}
 	return &APIClient{
 		SDK:        sdk,
 		ErrOut:     errBuf,
@@ -466,7 +466,7 @@ func TestDoStream_IgnoresBaseHTTPClientTimeout(t *testing.T) {
 	ac := &APIClient{
 		HTTP:       &http.Client{Timeout: 5 * time.Millisecond},
 		Credential: credential.NewCredentialProvider(nil, nil, &staticTokenResolver{}, nil),
-		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
+		Config:     &configpkg.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 	}
 
 	resp, err := ac.DoStream(context.Background(), &larkcore.ApiReq{
@@ -501,7 +501,7 @@ func TestDoStream_TransportFailureSplitsSubtype(t *testing.T) {
 	ac := &APIClient{
 		HTTP:       &http.Client{Transport: rt},
 		Credential: credential.NewCredentialProvider(nil, nil, &staticTokenResolver{}, nil),
-		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
+		Config:     &configpkg.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 	}
 
 	_, err := ac.DoStream(context.Background(), &larkcore.ApiReq{
@@ -535,7 +535,7 @@ func TestResolveAccessToken_NoToken_ReturnsTypedAuthenticationError(t *testing.T
 	ac := &APIClient{
 		HTTP:       &http.Client{},
 		Credential: credential.NewCredentialProvider(nil, nil, &failingTokenResolver{}, nil),
-		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
+		Config:     &configpkg.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 	}
 
 	_, err := ac.resolveAccessToken(context.Background(), identity.AsUser)
@@ -575,7 +575,7 @@ func TestResolveAccessToken_NeedAuthorization_SurfacesAsTypedAuthentication(t *t
 	ac := &APIClient{
 		HTTP:       &http.Client{},
 		Credential: credential.NewCredentialProvider(nil, nil, &needAuthTokenResolver{userOpenID: "ou_test_user"}, nil),
-		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
+		Config:     &configpkg.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 	}
 
 	_, err := ac.resolveAccessToken(context.Background(), identity.AsUser)
@@ -615,7 +615,7 @@ func TestDoSDKRequest_AuthFailureSurfacesTypedAuthenticationError(t *testing.T)
 	ac := &APIClient{
 		HTTP:       &http.Client{},
 		Credential: credential.NewCredentialProvider(nil, nil, &failingTokenResolver{}, nil),
-		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
+		Config:     &configpkg.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu},
 	}
 
 	_, err := ac.DoSDKRequest(context.Background(), &larkcore.ApiReq{
diff --git a/internal/client/dostream_test.go b/internal/client/dostream_test.go
index 5048de9bc1..44c16d0e97 100644
--- a/internal/client/dostream_test.go
+++ b/internal/client/dostream_test.go
@@ -14,7 +14,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 )
@@ -22,7 +22,7 @@ import (
 func TestDoStream_HTTPErrorIncludesLogID(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
-	config := &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu}
+	config := &configpkg.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu}
 	factory, _, _, reg := cmdutil.TestFactory(t, config)
 	reg.Register(&httpmock.Stub{
 		Method:  http.MethodGet,
diff --git a/internal/cmdutil/dryrun.go b/internal/cmdutil/dryrun.go
index ad431f2ed0..d5b71fd2c0 100644
--- a/internal/cmdutil/dryrun.go
+++ b/internal/cmdutil/dryrun.go
@@ -14,7 +14,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/util"
@@ -247,7 +247,7 @@ func encodeParams(params map[string]interface{}) string {
 
 // buildDryRunPreview assembles the shared preview skeleton: HTTP method, URL,
 // query params, and the app/user context common to every dry-run.
-func buildDryRunPreview(request client.RawApiRequest, config *core.CliConfig) *DryRunAPI {
+func buildDryRunPreview(request client.RawApiRequest, config *configpkg.CliConfig) *DryRunAPI {
 	dr := NewDryRunAPI().call(request.Method, request.URL)
 	if len(request.Params) > 0 {
 		dr.Params(request.Params)
@@ -259,7 +259,7 @@ func buildDryRunPreview(request client.RawApiRequest, config *core.CliConfig) *D
 
 // PrintDryRunWithFile outputs a dry-run summary for file upload requests.
 // Instead of serializing the Formdata body, it shows file metadata.
-func PrintDryRunWithFile(request client.RawApiRequest, config *core.CliConfig, opts DryRunOutputOptions, file FileUploadMeta) error {
+func PrintDryRunWithFile(request client.RawApiRequest, config *configpkg.CliConfig, opts DryRunOutputOptions, file FileUploadMeta) error {
 	dr := buildDryRunPreview(request, config)
 	filePathDisplay := file.FilePath
 	if filePathDisplay == "" {
@@ -278,7 +278,7 @@ func PrintDryRunWithFile(request client.RawApiRequest, config *core.CliConfig, o
 
 // PrintDryRun outputs a standardised dry-run summary using DryRunAPI.
 // When format is "pretty", outputs human-readable text; otherwise JSON.
-func PrintDryRun(request client.RawApiRequest, config *core.CliConfig, opts DryRunOutputOptions) error {
+func PrintDryRun(request client.RawApiRequest, config *configpkg.CliConfig, opts DryRunOutputOptions) error {
 	dr := buildDryRunPreview(request, config)
 	if !util.IsNil(request.Data) {
 		dr.Body(request.Data)
diff --git a/internal/cmdutil/dryrun_test.go b/internal/cmdutil/dryrun_test.go
index 7f28bfe702..a21c870336 100644
--- a/internal/cmdutil/dryrun_test.go
+++ b/internal/cmdutil/dryrun_test.go
@@ -13,7 +13,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 )
 
@@ -152,7 +152,7 @@ func TestPrintDryRun_JSON(t *testing.T) {
 		Method: "GET",
 		URL:    "/open-apis/test",
 		As:     "user",
-	}, &core.CliConfig{AppID: "app123"}, DryRunOutputOptions{
+	}, &configpkg.CliConfig{AppID: "app123"}, DryRunOutputOptions{
 		Format:      "json",
 		CommandPath: "lark-cli api",
 		Identity:    identity.AsUser,
@@ -202,7 +202,7 @@ func TestPrintDryRun_Pretty(t *testing.T) {
 		URL:    "/open-apis/test",
 		Data:   map[string]interface{}{"key": "val"},
 		As:     "bot",
-	}, &core.CliConfig{AppID: "app456"}, DryRunOutputOptions{
+	}, &configpkg.CliConfig{AppID: "app456"}, DryRunOutputOptions{
 		Format:   "pretty",
 		Identity: identity.AsBot,
 		Out:      &buf,
@@ -232,7 +232,7 @@ func TestPrintDryRun_WithJqUsesEnvelope(t *testing.T) {
 		Method: "GET",
 		URL:    "/open-apis/test",
 		As:     "bot",
-	}, &core.CliConfig{AppID: "app123"}, DryRunOutputOptions{
+	}, &configpkg.CliConfig{AppID: "app123"}, DryRunOutputOptions{
 		Format:   "json",
 		JqExpr:   ".data.api[0].url",
 		Identity: identity.AsBot,
@@ -253,7 +253,7 @@ func TestPrintDryRunWithFile_JSONEnvelope(t *testing.T) {
 		Method: "POST",
 		URL:    "/open-apis/drive/v1/files/upload_all",
 		As:     "bot",
-	}, &core.CliConfig{AppID: "app123", UserOpenId: "ou_tester"}, DryRunOutputOptions{
+	}, &configpkg.CliConfig{AppID: "app123", UserOpenId: "ou_tester"}, DryRunOutputOptions{
 		Format:   "json",
 		Identity: identity.AsBot,
 		Out:      &buf,
@@ -294,7 +294,7 @@ func TestPrintDryRun_MethodTranscribedVerbatim(t *testing.T) {
 		Method: "OPTIONS",
 		URL:    "/open-apis/test",
 		As:     "bot",
-	}, &core.CliConfig{AppID: "app123"}, DryRunOutputOptions{
+	}, &configpkg.CliConfig{AppID: "app123"}, DryRunOutputOptions{
 		Format:   "json",
 		Identity: identity.AsBot,
 		Out:      &buf,
@@ -318,7 +318,7 @@ func TestPrintDryRun_EmptyConfigOmitsContext(t *testing.T) {
 	err := PrintDryRun(client.RawApiRequest{
 		Method: "GET",
 		URL:    "/open-apis/test",
-	}, &core.CliConfig{}, DryRunOutputOptions{
+	}, &configpkg.CliConfig{}, DryRunOutputOptions{
 		Format: "json",
 		Out:    &buf,
 		ErrOut: io.Discard,
diff --git a/internal/cmdutil/factory.go b/internal/cmdutil/factory.go
index 0820ced3d8..c753ecbbd0 100644
--- a/internal/cmdutil/factory.go
+++ b/internal/cmdutil/factory.go
@@ -17,7 +17,7 @@ import (
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/client"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/keychain"
@@ -31,10 +31,10 @@ type InvocationContext struct {
 }
 
 type Factory struct {
-	Config     func() (*core.CliConfig, error) // lazily loads app config from Credential
-	HttpClient func() (*http.Client, error)    // HTTP client for non-Lark API calls (with retry and security headers)
-	LarkClient func() (*lark.Client, error)    // Lark SDK client for all Open API calls
-	IOStreams  *IOStreams                      // stdin/stdout/stderr streams
+	Config     func() (*configpkg.CliConfig, error) // lazily loads app config from Credential
+	HttpClient func() (*http.Client, error)         // HTTP client for non-Lark API calls (with retry and security headers)
+	LarkClient func() (*lark.Client, error)         // Lark SDK client for all Open API calls
+	IOStreams  *IOStreams                           // stdin/stdout/stderr streams
 
 	Invocation           InvocationContext       // Immutable call context; do not mutate after Factory construction.
 	Keychain             keychain.KeychainAccess // secret storage (real keychain in prod, mock in tests)
@@ -190,7 +190,7 @@ func (f *Factory) NewAPIClient() (*client.APIClient, error) {
 
 // NewAPIClientWithConfig creates an APIClient with an explicit config.
 // Use this when the caller has already resolved the correct config.
-func (f *Factory) NewAPIClientWithConfig(cfg *core.CliConfig) (*client.APIClient, error) {
+func (f *Factory) NewAPIClientWithConfig(cfg *configpkg.CliConfig) (*client.APIClient, error) {
 	sdk, err := f.LarkClient()
 	if err != nil {
 		return nil, err
diff --git a/internal/cmdutil/factory_default.go b/internal/cmdutil/factory_default.go
index 21aa8bec6c..909dfa8746 100644
--- a/internal/cmdutil/factory_default.go
+++ b/internal/cmdutil/factory_default.go
@@ -20,7 +20,7 @@ import (
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/authlog"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/registry"
@@ -60,7 +60,7 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 
 	// Phase 0: FileIO provider (no dependency)
 	f.FileIOProvider = fileio.GetProvider()
-	workspaceConfig := core.NewConfigSnapshot()
+	workspaceConfig := configpkg.NewConfigSnapshot()
 
 	// Phase 1: HttpClient (no credential dependency)
 	f.HttpClient = cachedHttpClientFunc(f, workspaceConfig)
@@ -75,7 +75,7 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 	})
 
 	// Phase 3: Runtime config contains resolved account data only.
-	f.Config = sync.OnceValues(func() (*core.CliConfig, error) {
+	f.Config = sync.OnceValues(func() (*configpkg.CliConfig, error) {
 		acct, err := f.Credential.ResolveAccount(context.Background())
 		if err != nil {
 			return nil, err
diff --git a/internal/cmdutil/factory_default_test.go b/internal/cmdutil/factory_default_test.go
index e63184eb7e..90154cfd36 100644
--- a/internal/cmdutil/factory_default_test.go
+++ b/internal/cmdutil/factory_default_test.go
@@ -13,7 +13,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	_ "github.com/larksuite/cli/extension/credential/env"
 	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/secret"
@@ -41,9 +41,9 @@ func TestNewDefault_InvocationProfileUsedByStrictModeAndConfig(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
 
 	bot := identity.StrictModeBot
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{
 				Name:      "default",
 				AppId:     "app-default",
@@ -59,7 +59,7 @@ func TestNewDefault_InvocationProfileUsedByStrictModeAndConfig(t *testing.T) {
 			},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
@@ -88,9 +88,9 @@ func TestNewDefault_InvocationProfileMissingSticksAcrossEarlyStrictMode(t *testi
 	dir := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
 
-	multi := &core.MultiAppConfig{
+	multi := &configpkg.MultiAppConfig{
 		CurrentApp: "default",
-		Apps: []core.AppConfig{
+		Apps: []configpkg.AppConfig{
 			{
 				Name:      "default",
 				AppId:     "app-default",
@@ -99,7 +99,7 @@ func TestNewDefault_InvocationProfileMissingSticksAcrossEarlyStrictMode(t *testi
 			},
 		},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}
 
diff --git a/internal/cmdutil/factory_http_test.go b/internal/cmdutil/factory_http_test.go
index 0cea52878c..dca61ae76c 100644
--- a/internal/cmdutil/factory_http_test.go
+++ b/internal/cmdutil/factory_http_test.go
@@ -7,14 +7,14 @@ import (
 	"io"
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 )
 
 func TestCachedHttpClientFunc_ReturnsSameInstance(t *testing.T) {
 	isEnabled := false
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "test-app"})
 	f.IOStreams.ErrOut = io.Discard
-	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &configpkg.MultiAppConfig{RiskControl: &isEnabled}})
 
 	c1, err := fn()
 	if err != nil {
@@ -35,9 +35,9 @@ func TestCachedHttpClientFunc_ReturnsSameInstance(t *testing.T) {
 
 func TestCachedHttpClientFunc_HasTimeout(t *testing.T) {
 	isEnabled := false
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "test-app"})
 	f.IOStreams.ErrOut = io.Discard
-	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &configpkg.MultiAppConfig{RiskControl: &isEnabled}})
 	c, _ := fn()
 	if c.Timeout == 0 {
 		t.Error("expected non-zero timeout")
@@ -46,9 +46,9 @@ func TestCachedHttpClientFunc_HasTimeout(t *testing.T) {
 
 func TestCachedHttpClientFunc_HasRedirectPolicy(t *testing.T) {
 	isEnabled := false
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "test-app"})
 	f.IOStreams.ErrOut = io.Discard
-	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &configpkg.MultiAppConfig{RiskControl: &isEnabled}})
 	c, _ := fn()
 	if c.CheckRedirect == nil {
 		t.Error("expected CheckRedirect to be set (safeRedirectPolicy)")
diff --git a/internal/cmdutil/factory_proxy_warn_test.go b/internal/cmdutil/factory_proxy_warn_test.go
index 2f11412913..f17652a4c4 100644
--- a/internal/cmdutil/factory_proxy_warn_test.go
+++ b/internal/cmdutil/factory_proxy_warn_test.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/larksuite/cli/envnames"
 	_ "github.com/larksuite/cli/extension/credential/env" // registers the env-backed account provider
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 )
 
 // installProxyWarnSpy replaces warnIfProxied with a counter for one test and
@@ -42,10 +42,10 @@ func TestCachedHttpClientFunc_ProxyWarnGate(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			calls := installProxyWarnSpy(t)
 
-			f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
+			f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "test-app"})
 			f.IOStreams.ErrOut = io.Discard
 			f.IOStreams.StderrIsTerminal = tc.terminal
-			fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+			fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &configpkg.MultiAppConfig{RiskControl: &isEnabled}})
 			if _, err := fn(); err != nil {
 				t.Fatalf("http client init: %v", err)
 			}
diff --git a/internal/cmdutil/factory_test.go b/internal/cmdutil/factory_test.go
index 2011fe72b4..e788bd1765 100644
--- a/internal/cmdutil/factory_test.go
+++ b/internal/cmdutil/factory_test.go
@@ -15,7 +15,7 @@ import (
 	"github.com/larksuite/cli/envnames"
 	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
@@ -34,7 +34,7 @@ func newCmdWithAsFlag(asValue string, changed bool) *cobra.Command {
 // --- ResolveAs tests ---
 
 func TestResolveAs_ExplicitAs(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 	cmd := newCmdWithAsFlag("bot", true)
 
 	got := f.ResolveAs(context.Background(), cmd, identity.AsBot)
@@ -50,7 +50,7 @@ func TestResolveAs_ExplicitAs(t *testing.T) {
 }
 
 func TestResolveAs_ExplicitAsUser(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 	cmd := newCmdWithAsFlag("user", true)
 
 	got := f.ResolveAs(context.Background(), cmd, identity.AsUser)
@@ -65,7 +65,7 @@ func TestResolveAs_ExplicitAsUser(t *testing.T) {
 func TestResolveAs_ExplicitAuto_FallsToAutoDetect(t *testing.T) {
 	// --as auto explicitly: should fall through to auto-detect
 	// Config has no UserOpenId → auto-detect returns bot
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 	cmd := newCmdWithAsFlag("auto", true)
 
 	got := f.ResolveAs(context.Background(), cmd, "auto")
@@ -78,7 +78,7 @@ func TestResolveAs_ExplicitAuto_FallsToAutoDetect(t *testing.T) {
 }
 
 func TestResolveAs_DefaultAs_FromConfig(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{
 		AppID: "a", AppSecret: "s",
 		DefaultAs: "bot",
 	})
@@ -96,7 +96,7 @@ func TestResolveAs_DefaultAs_FromConfig(t *testing.T) {
 func TestResolveAs_DefaultAs_EnvDoesNotBypassConfigSource(t *testing.T) {
 	t.Setenv(envnames.CliDefaultAs, "user")
 
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 	cmd := newCmdWithAsFlag("auto", false)
 
 	got := f.ResolveAs(context.Background(), cmd, "auto")
@@ -110,7 +110,7 @@ func TestResolveAs_DefaultAs_EnvDoesNotBypassConfigSource(t *testing.T) {
 
 func TestResolveAs_DefaultAs_AutoValue_FallsToAutoDetect(t *testing.T) {
 	// default-as = "auto" should fall through to auto-detect
-	f, _, _, _ := TestFactory(t, &core.CliConfig{
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{
 		AppID: "a", AppSecret: "s",
 		DefaultAs: "auto",
 	})
@@ -127,7 +127,7 @@ func TestResolveAs_DefaultAs_AutoValue_FallsToAutoDetect(t *testing.T) {
 }
 
 func TestResolveAs_NilCmd_AutoDetect(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 
 	got := f.ResolveAs(context.Background(), nil, "auto")
 	if got != identity.AsBot {
@@ -138,7 +138,7 @@ func TestResolveAs_NilCmd_AutoDetect(t *testing.T) {
 // --- CheckIdentity tests ---
 
 func TestCheckIdentity_Supported(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 
 	err := f.CheckIdentity(identity.AsBot, []string{"bot", "user"})
 	if err != nil {
@@ -150,7 +150,7 @@ func TestCheckIdentity_Supported(t *testing.T) {
 }
 
 func TestCheckIdentity_Supported_UserOnly(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 
 	err := f.CheckIdentity(identity.AsUser, []string{"user"})
 	if err != nil {
@@ -162,7 +162,7 @@ func TestCheckIdentity_Supported_UserOnly(t *testing.T) {
 }
 
 func TestCheckIdentity_Unsupported_Explicit(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 	f.IdentityAutoDetected = false // explicit --as
 
 	err := f.CheckIdentity(identity.AsUser, []string{"bot"})
@@ -178,7 +178,7 @@ func TestCheckIdentity_Unsupported_Explicit(t *testing.T) {
 }
 
 func TestCheckIdentity_Unsupported_AutoDetected(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 	f.IdentityAutoDetected = true
 
 	err := f.CheckIdentity(identity.AsUser, []string{"bot"})
@@ -197,7 +197,7 @@ func TestCheckIdentity_Unsupported_AutoDetected(t *testing.T) {
 // --- NewAPIClient / NewAPIClientWithConfig tests ---
 
 func TestNewAPIClient(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", Brand: brand.Lark}
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", Brand: brand.Lark}
 	f, _, _, _ := TestFactory(t, cfg)
 
 	ac, err := f.NewAPIClient()
@@ -210,7 +210,7 @@ func TestNewAPIClient(t *testing.T) {
 }
 
 func TestNewAPIClientWithConfig(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", Brand: brand.Lark}
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", Brand: brand.Lark}
 	f, _, _, _ := TestFactory(t, cfg)
 
 	ac, err := f.NewAPIClientWithConfig(cfg)
@@ -229,7 +229,7 @@ func TestNewAPIClientWithConfig(t *testing.T) {
 }
 
 func TestNewAPIClientWithConfig_NilIOStreams(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", Brand: brand.Lark}
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", Brand: brand.Lark}
 	f, _, _, _ := TestFactory(t, cfg)
 	f.IOStreams = nil
 
@@ -245,14 +245,14 @@ func TestNewAPIClientWithConfig_NilIOStreams(t *testing.T) {
 // --- ResolveStrictMode tests ---
 
 func TestResolveStrictMode_Off(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 	if got := f.ResolveStrictMode(context.Background()); got != identity.StrictModeOff {
 		t.Errorf("expected off, got %q", got)
 	}
 }
 
 func TestResolveStrictMode_BotFromAccount(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2} // SupportsBot = 2
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2} // SupportsBot = 2
 	f, _, _, _ := TestFactory(t, cfg)
 	if got := f.ResolveStrictMode(context.Background()); got != identity.StrictModeBot {
 		t.Errorf("expected bot, got %q", got)
@@ -260,7 +260,7 @@ func TestResolveStrictMode_BotFromAccount(t *testing.T) {
 }
 
 func TestResolveStrictMode_UserFromAccount(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1} // SupportsUser = 1
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1} // SupportsUser = 1
 	f, _, _, _ := TestFactory(t, cfg)
 	if got := f.ResolveStrictMode(context.Background()); got != identity.StrictModeUser {
 		t.Errorf("expected user, got %q", got)
@@ -268,7 +268,7 @@ func TestResolveStrictMode_UserFromAccount(t *testing.T) {
 }
 
 func TestResolveStrictMode_BothIdentities(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 3} // SupportsAll = 3
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 3} // SupportsAll = 3
 	f, _, _, _ := TestFactory(t, cfg)
 	if got := f.ResolveStrictMode(context.Background()); got != identity.StrictModeOff {
 		t.Errorf("expected off when both supported, got %q", got)
@@ -276,7 +276,7 @@ func TestResolveStrictMode_BothIdentities(t *testing.T) {
 }
 
 func TestResolveStrictMode_NilCredential(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 	f.Credential = nil
 	if got := f.ResolveStrictMode(context.Background()); got != identity.StrictModeOff {
 		t.Errorf("expected off with nil credential, got %q", got)
@@ -286,7 +286,7 @@ func TestResolveStrictMode_NilCredential(t *testing.T) {
 // --- CheckStrictMode tests ---
 
 func TestCheckStrictMode_BotMode_BotAllowed(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2}
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2}
 	f, _, _, _ := TestFactory(t, cfg)
 	if err := f.CheckStrictMode(context.Background(), identity.AsBot); err != nil {
 		t.Errorf("bot should be allowed in bot mode, got: %v", err)
@@ -294,7 +294,7 @@ func TestCheckStrictMode_BotMode_BotAllowed(t *testing.T) {
 }
 
 func TestCheckStrictMode_BotMode_UserBlocked(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2}
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2}
 	f, _, _, _ := TestFactory(t, cfg)
 	err := f.CheckStrictMode(context.Background(), identity.AsUser)
 	if err == nil {
@@ -306,7 +306,7 @@ func TestCheckStrictMode_BotMode_UserBlocked(t *testing.T) {
 }
 
 func TestCheckStrictMode_UserMode_UserAllowed(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
 	f, _, _, _ := TestFactory(t, cfg)
 	if err := f.CheckStrictMode(context.Background(), identity.AsUser); err != nil {
 		t.Errorf("user should be allowed in user mode, got: %v", err)
@@ -314,7 +314,7 @@ func TestCheckStrictMode_UserMode_UserAllowed(t *testing.T) {
 }
 
 func TestCheckStrictMode_UserMode_BotBlocked(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
 	f, _, _, _ := TestFactory(t, cfg)
 	err := f.CheckStrictMode(context.Background(), identity.AsBot)
 	if err == nil {
@@ -323,7 +323,7 @@ func TestCheckStrictMode_UserMode_BotBlocked(t *testing.T) {
 }
 
 func TestCheckStrictMode_Off_BothAllowed(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 	if err := f.CheckStrictMode(context.Background(), identity.AsUser); err != nil {
 		t.Errorf("user should be allowed when off: %v", err)
 	}
@@ -335,7 +335,7 @@ func TestCheckStrictMode_Off_BothAllowed(t *testing.T) {
 // --- ResolveAs strict mode tests ---
 
 func TestResolveAs_StrictModeBot_ForceBot(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2}
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2}
 	f, _, _, _ := TestFactory(t, cfg)
 	cmd := newCmdWithAsFlag("auto", false)
 	got := f.ResolveAs(context.Background(), cmd, "auto")
@@ -345,7 +345,7 @@ func TestResolveAs_StrictModeBot_ForceBot(t *testing.T) {
 }
 
 func TestResolveAs_StrictModeUser_ForceUser(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
 	f, _, _, _ := TestFactory(t, cfg)
 	cmd := newCmdWithAsFlag("auto", false)
 	got := f.ResolveAs(context.Background(), cmd, "auto")
@@ -355,7 +355,7 @@ func TestResolveAs_StrictModeUser_ForceUser(t *testing.T) {
 }
 
 func TestResolveAs_StrictModeUser_PreservesExplicitBot(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
 	f, _, _, _ := TestFactory(t, cfg)
 	cmd := newCmdWithAsFlag("bot", true)
 	got := f.ResolveAs(context.Background(), cmd, identity.AsBot)
@@ -368,7 +368,7 @@ func TestResolveAs_StrictModeUser_PreservesExplicitBot(t *testing.T) {
 }
 
 func TestResolveAs_StrictModeBot_PreservesExplicitUser(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2}
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 2}
 	f, _, _, _ := TestFactory(t, cfg)
 	cmd := newCmdWithAsFlag("user", true)
 	got := f.ResolveAs(context.Background(), cmd, identity.AsUser)
@@ -381,7 +381,7 @@ func TestResolveAs_StrictModeBot_PreservesExplicitUser(t *testing.T) {
 }
 
 func TestResolveAs_StrictModeUser_ExplicitAutoForcesUser(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", SupportedIdentities: 1}
 	f, _, _, _ := TestFactory(t, cfg)
 	cmd := newCmdWithAsFlag("auto", true)
 	got := f.ResolveAs(context.Background(), cmd, identity.AsAuto)
@@ -391,7 +391,7 @@ func TestResolveAs_StrictModeUser_ExplicitAutoForcesUser(t *testing.T) {
 }
 
 func TestResolveAs_StrictModeBot_IgnoresDefaultAsUser(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "a", AppSecret: "s", DefaultAs: "user", SupportedIdentities: 2}
+	cfg := &configpkg.CliConfig{AppID: "a", AppSecret: "s", DefaultAs: "user", SupportedIdentities: 2}
 	f, _, _, _ := TestFactory(t, cfg)
 	cmd := newCmdWithAsFlag("auto", false)
 	got := f.ResolveAs(context.Background(), cmd, "auto")
diff --git a/internal/cmdutil/identity.go b/internal/cmdutil/identity.go
index 91e0dc77a2..d748b34636 100644
--- a/internal/cmdutil/identity.go
+++ b/internal/cmdutil/identity.go
@@ -7,13 +7,13 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 )
 
 // PrintIdentity outputs the current identity to stderr so callers (including AI agents)
 // can see which identity is being used for the API call.
-func PrintIdentity(w io.Writer, as identity.Identity, config *core.CliConfig, autoDetected bool) {
+func PrintIdentity(w io.Writer, as identity.Identity, config *configpkg.CliConfig, autoDetected bool) {
 	if as.IsBot() {
 		if autoDetected {
 			fmt.Fprintln(w, "[identity: bot (auto — not logged in; `auth login` for user identity)]")
diff --git a/internal/cmdutil/identity_flag_test.go b/internal/cmdutil/identity_flag_test.go
index f4d1c0fb55..149eefeb90 100644
--- a/internal/cmdutil/identity_flag_test.go
+++ b/internal/cmdutil/identity_flag_test.go
@@ -8,12 +8,12 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/spf13/cobra"
 )
 
 func TestAddAPIIdentityFlag_NonStrictMode(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 	cmd := &cobra.Command{Use: "test"}
 
 	AddAPIIdentityFlag(context.Background(), cmd, f, nil)
@@ -31,7 +31,7 @@ func TestAddAPIIdentityFlag_NonStrictMode(t *testing.T) {
 }
 
 func TestAddAPIIdentityFlag_StrictModeHidesFlagAndLocksDefault(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{
 		AppID: "a", AppSecret: "s", SupportedIdentities: 2,
 	})
 	cmd := &cobra.Command{Use: "test"}
@@ -51,7 +51,7 @@ func TestAddAPIIdentityFlag_StrictModeHidesFlagAndLocksDefault(t *testing.T) {
 }
 
 func TestAddShortcutIdentityFlag_NoDefault(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 	cmd := &cobra.Command{Use: "test"}
 
 	AddShortcutIdentityFlag(context.Background(), cmd, f, []string{"bot"})
@@ -70,7 +70,7 @@ func TestAddShortcutIdentityFlag_NoDefault(t *testing.T) {
 
 // TC-10: AuthTypes=["user"] → usage contains "identity type: user" and NOT "bot".
 func TestAddShortcutIdentityFlag_UserOnlyAuthTypes(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 	cmd := &cobra.Command{Use: "test"}
 
 	AddShortcutIdentityFlag(context.Background(), cmd, f, []string{"user"})
@@ -93,7 +93,7 @@ func TestAddShortcutIdentityFlag_UserOnlyAuthTypes(t *testing.T) {
 
 // TC-11: AuthTypes=["user","bot"] → usage == "identity type: user | bot".
 func TestAddShortcutIdentityFlag_UserBotAuthTypes(t *testing.T) {
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "a", AppSecret: "s"})
+	f, _, _, _ := TestFactory(t, &configpkg.CliConfig{AppID: "a", AppSecret: "s"})
 	cmd := &cobra.Command{Use: "test"}
 
 	AddShortcutIdentityFlag(context.Background(), cmd, f, []string{"user", "bot"})
diff --git a/internal/cmdutil/identity_test.go b/internal/cmdutil/identity_test.go
index a6a1789278..6f38d1cd04 100644
--- a/internal/cmdutil/identity_test.go
+++ b/internal/cmdutil/identity_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 )
 
@@ -30,7 +30,7 @@ func TestPrintIdentity_BotAutoDetected(t *testing.T) {
 
 func TestPrintIdentity_UserWithOpenId(t *testing.T) {
 	var buf bytes.Buffer
-	cfg := &core.CliConfig{UserOpenId: "ou_abc123"}
+	cfg := &configpkg.CliConfig{UserOpenId: "ou_abc123"}
 	PrintIdentity(&buf, identity.AsUser, cfg, false)
 	if !strings.Contains(buf.String(), "ou_abc123") {
 		t.Errorf("expected UserOpenId in output, got: %s", buf.String())
@@ -39,7 +39,7 @@ func TestPrintIdentity_UserWithOpenId(t *testing.T) {
 
 func TestPrintIdentity_UserWithoutOpenId(t *testing.T) {
 	var buf bytes.Buffer
-	PrintIdentity(&buf, identity.AsUser, &core.CliConfig{}, false)
+	PrintIdentity(&buf, identity.AsUser, &configpkg.CliConfig{}, false)
 	if !strings.Contains(buf.String(), "[identity: user]") {
 		t.Errorf("unexpected output: %s", buf.String())
 	}
diff --git a/internal/cmdutil/risk_control.go b/internal/cmdutil/risk_control.go
index 36479ca641..515079e83c 100644
--- a/internal/cmdutil/risk_control.go
+++ b/internal/cmdutil/risk_control.go
@@ -4,12 +4,12 @@
 package cmdutil
 
 import (
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/riskcontrol"
 )
 
 type workspaceConfigSource interface {
-	MultiAppConfig() (*core.MultiAppConfig, error)
+	MultiAppConfig() (*configpkg.MultiAppConfig, error)
 }
 
 // resolveSDKHostSignalSource applies workspace policy at the SDK transport
diff --git a/internal/cmdutil/risk_control_test.go b/internal/cmdutil/risk_control_test.go
index b54c4c65bc..554bceaa3c 100644
--- a/internal/cmdutil/risk_control_test.go
+++ b/internal/cmdutil/risk_control_test.go
@@ -7,15 +7,15 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 )
 
 type staticWorkspaceConfig struct {
-	config *core.MultiAppConfig
+	config *configpkg.MultiAppConfig
 	err    error
 }
 
-func (s staticWorkspaceConfig) MultiAppConfig() (*core.MultiAppConfig, error) {
+func (s staticWorkspaceConfig) MultiAppConfig() (*configpkg.MultiAppConfig, error) {
 	return s.config, s.err
 }
 
@@ -26,8 +26,8 @@ func TestResolveSDKHostSignalSource(t *testing.T) {
 		config     workspaceConfigSource
 		wantSource bool
 	}{
-		{name: "workspace default on", config: staticWorkspaceConfig{config: &core.MultiAppConfig{}}, wantSource: true},
-		{name: "workspace opt-out", config: staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &disabled}}},
+		{name: "workspace default on", config: staticWorkspaceConfig{config: &configpkg.MultiAppConfig{}}, wantSource: true},
+		{name: "workspace opt-out", config: staticWorkspaceConfig{config: &configpkg.MultiAppConfig{RiskControl: &disabled}}},
 		{name: "missing config", config: staticWorkspaceConfig{err: errors.New("file does not exist")}},
 		{name: "unreadable config", config: staticWorkspaceConfig{err: errors.New("permission denied")}},
 		{name: "nil config value", config: staticWorkspaceConfig{}},
diff --git a/internal/cmdutil/testing.go b/internal/cmdutil/testing.go
index 875d1d7668..1ba01f5b43 100644
--- a/internal/cmdutil/testing.go
+++ b/internal/cmdutil/testing.go
@@ -15,7 +15,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/vfs"
@@ -30,7 +30,7 @@ func (n *noopKeychain) Remove(service, account string) error        { return nil
 
 // TestFactory creates a Factory for testing.
 // Returns (factory, stdout buffer, stderr buffer, http mock registry).
-func TestFactory(t *testing.T, config *core.CliConfig) (*Factory, *bytes.Buffer, *bytes.Buffer, *httpmock.Registry) {
+func TestFactory(t *testing.T, config *configpkg.CliConfig) (*Factory, *bytes.Buffer, *bytes.Buffer, *httpmock.Registry) {
 	t.Helper()
 
 	reg := &httpmock.Registry{}
@@ -66,7 +66,7 @@ func TestFactory(t *testing.T, config *core.CliConfig) (*Factory, *bytes.Buffer,
 	)
 
 	f := &Factory{
-		Config:         func() (*core.CliConfig, error) { return config, nil },
+		Config:         func() (*configpkg.CliConfig, error) { return config, nil },
 		HttpClient:     func() (*http.Client, error) { return mockClient, nil },
 		LarkClient:     func() (*lark.Client, error) { return testLarkClient, nil },
 		IOStreams:      &IOStreams{In: nil, Out: stdoutBuf, ErrOut: stderrBuf},
@@ -78,7 +78,7 @@ func TestFactory(t *testing.T, config *core.CliConfig) (*Factory, *bytes.Buffer,
 }
 
 type testDefaultAcct struct {
-	config *core.CliConfig
+	config *configpkg.CliConfig
 }
 
 func (a *testDefaultAcct) ResolveAccount(ctx context.Context) (*credential.Account, error) {
diff --git a/internal/cmdutil/testing_test.go b/internal/cmdutil/testing_test.go
index e2cbddd39f..4e201272a2 100644
--- a/internal/cmdutil/testing_test.go
+++ b/internal/cmdutil/testing_test.go
@@ -9,13 +9,13 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/brand"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
 )
 
 func TestTestFactory_ReplacesGlobals(t *testing.T) {
-	config := &core.CliConfig{
+	config := &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret",
 		Brand: brand.Feishu,
 	}
diff --git a/internal/core/config.go b/internal/config/config.go
similarity index 99%
rename from internal/core/config.go
rename to internal/config/config.go
index 6c50b29405..71a70db2fc 100644
--- a/internal/core/config.go
+++ b/internal/config/config.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package config
 
 import (
 	"encoding/json"
diff --git a/internal/core/config_snapshot.go b/internal/config/config_snapshot.go
similarity index 98%
rename from internal/core/config_snapshot.go
rename to internal/config/config_snapshot.go
index 63977e7e21..96e8928600 100644
--- a/internal/core/config_snapshot.go
+++ b/internal/config/config_snapshot.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package config
 
 import (
 	"io/fs"
diff --git a/internal/core/config_snapshot_test.go b/internal/config/config_snapshot_test.go
similarity index 98%
rename from internal/core/config_snapshot_test.go
rename to internal/config/config_snapshot_test.go
index fb933ed96a..05a27bbacf 100644
--- a/internal/core/config_snapshot_test.go
+++ b/internal/config/config_snapshot_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package config
 
 import (
 	"errors"
diff --git a/internal/core/config_strict_mode_test.go b/internal/config/config_strict_mode_test.go
similarity index 99%
rename from internal/core/config_strict_mode_test.go
rename to internal/config/config_strict_mode_test.go
index 97e1540d63..1626ea770a 100644
--- a/internal/core/config_strict_mode_test.go
+++ b/internal/config/config_strict_mode_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package config
 
 import (
 	"encoding/json"
diff --git a/internal/core/config_test.go b/internal/config/config_test.go
similarity index 99%
rename from internal/core/config_test.go
rename to internal/config/config_test.go
index 5a83b02b3a..26933a451e 100644
--- a/internal/core/config_test.go
+++ b/internal/config/config_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package config
 
 import (
 	"encoding/json"
diff --git a/internal/core/notconfigured.go b/internal/config/notconfigured.go
similarity index 99%
rename from internal/core/notconfigured.go
rename to internal/config/notconfigured.go
index f68d0cba41..b29f1bba51 100644
--- a/internal/core/notconfigured.go
+++ b/internal/config/notconfigured.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package config
 
 import (
 	"errors"
diff --git a/internal/core/notconfigured_test.go b/internal/config/notconfigured_test.go
similarity index 99%
rename from internal/core/notconfigured_test.go
rename to internal/config/notconfigured_test.go
index d88074fc5e..621581c6d8 100644
--- a/internal/core/notconfigured_test.go
+++ b/internal/config/notconfigured_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package core
+package config
 
 import (
 	"errors"
diff --git a/internal/credential/credential_provider.go b/internal/credential/credential_provider.go
index 10ec0ba163..496ca14edc 100644
--- a/internal/credential/credential_provider.go
+++ b/internal/credential/credential_provider.go
@@ -13,7 +13,7 @@ import (
 
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/internal/auth"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 )
 
@@ -204,7 +204,7 @@ func (p *CredentialProvider) doResolveAccount(ctx context.Context) (*Account, er
 		p.selectedSource = defaultTokenSource{resolver: p.defaultToken}
 		return acct, nil
 	}
-	return nil, core.NotConfiguredError()
+	return nil, configpkg.NotConfiguredError()
 }
 
 // enrichUserInfo resolves user identity when extension provides a UAT.
diff --git a/internal/credential/default_provider.go b/internal/credential/default_provider.go
index fcf1124657..033a3ee467 100644
--- a/internal/credential/default_provider.go
+++ b/internal/credential/default_provider.go
@@ -12,7 +12,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/auth"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/keychain"
@@ -75,12 +75,12 @@ func NewDefaultAccountProvider(kc func() keychain.KeychainAccess, profile string
 
 func (p *DefaultAccountProvider) ResolveAccount(ctx context.Context) (*Account, error) {
 	// Load config once — used for both credentials and strict mode.
-	multi, err := core.LoadMultiAppConfig()
+	multi, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
-		return nil, core.NotConfiguredError()
+		return nil, configpkg.NotConfiguredError()
 	}
 
-	cfg, err := core.ResolveConfigFromMulti(multi, p.keychain(), p.profile)
+	cfg, err := configpkg.ResolveConfigFromMulti(multi, p.keychain(), p.profile)
 	if err != nil {
 		return nil, err
 	}
@@ -90,7 +90,7 @@ func (p *DefaultAccountProvider) ResolveAccount(ctx context.Context) (*Account,
 
 // strictModeToIdentitySupport maps the config-level strict mode to
 // the SupportedIdentities bitflag using an already-loaded MultiAppConfig.
-func strictModeToIdentitySupport(multi *core.MultiAppConfig, profileOverride string) uint8 {
+func strictModeToIdentitySupport(multi *configpkg.MultiAppConfig, profileOverride string) uint8 {
 	app := multi.CurrentAppConfig(profileOverride)
 	var mode identity.StrictMode
 	if app != nil && app.StrictMode != nil {
diff --git a/internal/credential/integration_test.go b/internal/credential/integration_test.go
index ba0f9fc058..50202cacf6 100644
--- a/internal/credential/integration_test.go
+++ b/internal/credential/integration_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/larksuite/cli/envnames"
 	extcred "github.com/larksuite/cli/extension/credential"
 	envprovider "github.com/larksuite/cli/extension/credential/env"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/identity"
@@ -91,15 +91,15 @@ func TestFullChain_ConfigStrictMode(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
 
 	botMode := identity.StrictModeBot
-	multi := &core.MultiAppConfig{
-		Apps: []core.AppConfig{{
+	multi := &configpkg.MultiAppConfig{
+		Apps: []configpkg.AppConfig{{
 			AppId:      "cfg_app",
 			AppSecret:  secret.PlainSecret("cfg_secret"),
 			Brand:      brand.Lark,
 			StrictMode: &botMode,
 		}},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatal(err)
 	}
 
@@ -132,15 +132,15 @@ func TestFullChain_LangSurvivesProductionPath(t *testing.T) {
 	t.Setenv(envnames.CliAppSecret, "")
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
-	multi := &core.MultiAppConfig{
-		Apps: []core.AppConfig{{
+	multi := &configpkg.MultiAppConfig{
+		Apps: []configpkg.AppConfig{{
 			AppId:     "cfg_app",
 			AppSecret: secret.PlainSecret("cfg_secret"),
 			Brand:     brand.Feishu,
 			Lang:      i18n.LangJaJP,
 		}},
 	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
+	if err := configpkg.SaveMultiAppConfig(multi); err != nil {
 		t.Fatalf("SaveMultiAppConfig: %v", err)
 	}
 
diff --git a/internal/credential/types.go b/internal/credential/types.go
index debe28c252..9924827715 100644
--- a/internal/credential/types.go
+++ b/internal/credential/types.go
@@ -10,14 +10,14 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	extcred "github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/i18n"
 	identitypkg "github.com/larksuite/cli/internal/identity"
 )
 
 // Account is the credential-layer view of the active runtime account.
 // It intentionally mirrors only the resolved fields needed by runtime auth
-// and identity selection, without exposing core.CliConfig as a dependency.
+// and identity selection, without exposing configpkg.CliConfig as a dependency.
 type Account struct {
 	ProfileName         string
 	AppID               string
@@ -57,7 +57,7 @@ func normalizeAccountAppSecret(secret string) string {
 }
 
 // AccountFromCliConfig copies the resolved config view into a credential.Account.
-func AccountFromCliConfig(cfg *core.CliConfig) *Account {
+func AccountFromCliConfig(cfg *configpkg.CliConfig) *Account {
 	if cfg == nil {
 		return nil
 	}
@@ -76,11 +76,11 @@ func AccountFromCliConfig(cfg *core.CliConfig) *Account {
 
 // ToCliConfig copies the credential-layer account into the downstream config
 // shape, normalizing the brand so runtime consumers never see raw casing.
-func (a *Account) ToCliConfig() *core.CliConfig {
+func (a *Account) ToCliConfig() *configpkg.CliConfig {
 	if a == nil {
 		return nil
 	}
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		ProfileName:         a.ProfileName,
 		AppID:               a.AppID,
 		AppSecret:           normalizeAccountAppSecret(a.AppSecret),
diff --git a/internal/credential/types_test.go b/internal/credential/types_test.go
index 0ddd271ea4..8c65983dfb 100644
--- a/internal/credential/types_test.go
+++ b/internal/credential/types_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/brand"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/i18n"
 )
 
@@ -47,7 +47,7 @@ func TestParseTokenType(t *testing.T) {
 }
 
 func TestAccountFromCliConfigAndBack_ReturnCopies(t *testing.T) {
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		ProfileName:         "target",
 		AppID:               "app-1",
 		AppSecret:           "secret-1",
diff --git a/internal/identitydiag/diagnostics.go b/internal/identitydiag/diagnostics.go
index f7cf954da9..83cfb9d713 100644
--- a/internal/identitydiag/diagnostics.go
+++ b/internal/identitydiag/diagnostics.go
@@ -17,7 +17,7 @@ import (
 	extcred "github.com/larksuite/cli/extension/credential"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/identity"
 )
@@ -60,7 +60,7 @@ type Identity struct {
 
 // Diagnose checks bot and user identities separately. When verify is false,
 // it only reports local readiness and skips server calls.
-func Diagnose(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConfig, verify bool) Result {
+func Diagnose(ctx context.Context, f *cmdutil.Factory, cfg *configpkg.CliConfig, verify bool) Result {
 	if ctx == nil {
 		ctx = context.Background()
 	}
@@ -89,7 +89,7 @@ func activeExternalProvider(ctx context.Context, f *cmdutil.Factory) string {
 	return name
 }
 
-func diagnoseExternal(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConfig, provider string, verify bool) Result {
+func diagnoseExternal(ctx context.Context, f *cmdutil.Factory, cfg *configpkg.CliConfig, provider string, verify bool) Result {
 	if cfg == nil || cfg.AppID == "" {
 		notConfigured := Identity{
 			Status:  StatusNotConfigured,
@@ -108,7 +108,7 @@ func diagnoseExternal(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConf
 	}
 }
 
-func diagnoseExternalBot(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConfig, provider string, supported, verify bool) Identity {
+func diagnoseExternalBot(ctx context.Context, f *cmdutil.Factory, cfg *configpkg.CliConfig, provider string, supported, verify bool) Identity {
 	if !supported {
 		return notProvidedExternally("Bot", provider)
 	}
@@ -130,7 +130,7 @@ func diagnoseExternalBot(ctx context.Context, f *cmdutil.Factory, cfg *core.CliC
 	return id
 }
 
-func diagnoseExternalUser(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConfig, provider string, supported, verify bool) Identity {
+func diagnoseExternalUser(ctx context.Context, f *cmdutil.Factory, cfg *configpkg.CliConfig, provider string, supported, verify bool) Identity {
 	if !supported {
 		return notProvidedExternally("User", provider)
 	}
@@ -189,7 +189,7 @@ func externalCredentialHint(provider string) string {
 	return fmt.Sprintf("managed by the external credential provider %q and cannot be configured via lark-cli", provider)
 }
 
-func diagnoseBot(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConfig, verify bool) Identity {
+func diagnoseBot(ctx context.Context, f *cmdutil.Factory, cfg *configpkg.CliConfig, verify bool) Identity {
 	if cfg == nil || cfg.AppID == "" {
 		return Identity{
 			Status:  StatusNotConfigured,
@@ -252,7 +252,7 @@ func diagnoseBot(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConfig, v
 	return id
 }
 
-func diagnoseUser(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConfig, verify bool) Identity {
+func diagnoseUser(ctx context.Context, f *cmdutil.Factory, cfg *configpkg.CliConfig, verify bool) Identity {
 	if cfg == nil || cfg.AppID == "" {
 		return Identity{
 			Status:  StatusNotConfigured,
@@ -339,7 +339,7 @@ func diagnoseUser(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConfig,
 	return id
 }
 
-func resolveBotToken(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConfig) (string, error) {
+func resolveBotToken(ctx context.Context, f *cmdutil.Factory, cfg *configpkg.CliConfig) (string, error) {
 	if f == nil || f.Credential == nil {
 		return "", &credential.TokenUnavailableError{Type: credential.TokenTypeTAT}
 	}
@@ -358,7 +358,7 @@ type botInfo struct {
 	AppName string
 }
 
-func fetchBotInfo(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConfig, token string) (*botInfo, error) {
+func fetchBotInfo(ctx context.Context, f *cmdutil.Factory, cfg *configpkg.CliConfig, token string) (*botInfo, error) {
 	httpClient, err := f.HttpClient()
 	if err != nil {
 		return nil, fmt.Errorf("create HTTP client: %w", err)
diff --git a/internal/identitydiag/diagnostics_test.go b/internal/identitydiag/diagnostics_test.go
index 2cc8d7a9c3..70d3e11a86 100644
--- a/internal/identitydiag/diagnostics_test.go
+++ b/internal/identitydiag/diagnostics_test.go
@@ -14,14 +14,14 @@ import (
 	extcred "github.com/larksuite/cli/extension/credential"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/zalando/go-keyring"
 )
 
 func TestDiagnose_NoUserReportsBotReadyAndUserMissing(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu}
 	f, _, _, _ := cmdutil.TestFactory(t, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -34,7 +34,7 @@ func TestDiagnose_NoUserReportsBotReadyAndUserMissing(t *testing.T) {
 }
 
 func TestDiagnose_BotIdentityNotConfigured(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test-app", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "test-app", Brand: brand.Feishu}
 	f, _, _, _ := cmdutil.TestFactory(t, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -44,7 +44,7 @@ func TestDiagnose_BotIdentityNotConfigured(t *testing.T) {
 }
 
 func TestDiagnose_VerifyBotIdentity(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	stub := &httpmock.Stub{
 		Method: http.MethodGet,
@@ -80,7 +80,7 @@ func TestDiagnose_VerifyUserIdentity(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_DATA_DIR", t.TempDir())
 
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app-user",
 		AppSecret:  "secret",
 		Brand:      brand.Feishu,
@@ -136,7 +136,7 @@ func TestDiagnose_VerifyUserIdentity(t *testing.T) {
 }
 
 func TestDiagnose_VerifyBotIdentity_HTTPErrorSurfacesEnvelope(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	reg.Register(&httpmock.Stub{
 		Method: http.MethodGet,
@@ -161,7 +161,7 @@ func TestDiagnose_VerifyBotIdentity_HTTPErrorSurfacesEnvelope(t *testing.T) {
 }
 
 func TestDiagnose_VerifyBotIdentity_BusinessErrorCode(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "test-app", AppSecret: "secret", Brand: brand.Feishu}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	reg.Register(&httpmock.Stub{
 		Method: http.MethodGet,
@@ -186,7 +186,7 @@ func TestDiagnose_VerifyUserIdentity_ServerRejects(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_DATA_DIR", t.TempDir())
 
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app-reject",
 		AppSecret:  "secret",
 		Brand:      brand.Feishu,
@@ -242,7 +242,7 @@ func TestDiagnose_UserIdentityExpired(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_DATA_DIR", t.TempDir())
 
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app-expired",
 		AppSecret:  "secret",
 		Brand:      brand.Feishu,
@@ -276,7 +276,7 @@ func TestDiagnose_UserIdentityExpired(t *testing.T) {
 func TestDiagnose_BotIdentityStrictUserOnly(t *testing.T) {
 	// SupportedIdentities = SupportsUser (1) only — bot path should be
 	// reported as not_configured even though an app secret is present.
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:               "test-app",
 		AppSecret:           "secret",
 		Brand:               brand.Feishu,
@@ -291,7 +291,7 @@ func TestDiagnose_BotIdentityStrictUserOnly(t *testing.T) {
 }
 
 func TestDiagnose_UserIdentityMissingAppConfig(t *testing.T) {
-	cfg := &core.CliConfig{Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{Brand: brand.Feishu}
 	f, _, _, _ := cmdutil.TestFactory(t, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -321,7 +321,7 @@ func TestDiagnose_UserIdentityNeedsRefresh(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_DATA_DIR", t.TempDir())
 
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app-needs-refresh",
 		AppSecret:  "secret",
 		Brand:      brand.Feishu,
@@ -369,13 +369,13 @@ func (p *fakeExtProvider) ResolveToken(context.Context, extcred.TokenSpec) (*ext
 	return p.token, nil
 }
 
-func externalFactory(prov *fakeExtProvider, cfg *core.CliConfig) *cmdutil.Factory {
+func externalFactory(prov *fakeExtProvider, cfg *configpkg.CliConfig) *cmdutil.Factory {
 	cred := credential.NewCredentialProvider(
 		[]extcred.Provider{prov}, nil, nil,
 		func() (*http.Client, error) { return nil, nil },
 	)
 	return &cmdutil.Factory{
-		Config:     func() (*core.CliConfig, error) { return cfg, nil },
+		Config:     func() (*configpkg.CliConfig, error) { return cfg, nil },
 		Credential: cred,
 		IOStreams:  &cmdutil.IOStreams{},
 	}
@@ -399,7 +399,7 @@ func assertExternalHint(t *testing.T, hint string) {
 }
 
 func TestDiagnose_External_UserReady(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsAll), UserOpenId: "ou_x", UserName: "Alice"}
+	cfg := &configpkg.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsAll), UserOpenId: "ou_x", UserName: "Alice"}
 	f := externalFactory(&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}}, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -421,7 +421,7 @@ func TestDiagnose_External_UserReady(t *testing.T) {
 }
 
 func TestDiagnose_External_UserNotSignedIn(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsAll)}
+	cfg := &configpkg.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsAll)}
 	f := externalFactory(&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}}, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -432,7 +432,7 @@ func TestDiagnose_External_UserNotSignedIn(t *testing.T) {
 }
 
 func TestDiagnose_External_BotOnly(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsBot), UserOpenId: "ou_x"}
+	cfg := &configpkg.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsBot), UserOpenId: "ou_x"}
 	f := externalFactory(&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}}, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -448,7 +448,7 @@ func TestDiagnose_External_BotOnly(t *testing.T) {
 }
 
 func TestDiagnose_External_UserOnly(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Lark, SupportedIdentities: uint8(extcred.SupportsUser), UserOpenId: "ou_x", UserName: "Bob"}
+	cfg := &configpkg.CliConfig{AppID: "cli_x", Brand: brand.Lark, SupportedIdentities: uint8(extcred.SupportsUser), UserOpenId: "ou_x", UserName: "Bob"}
 	f := externalFactory(&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}}, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, false)
@@ -462,7 +462,7 @@ func TestDiagnose_External_UserOnly(t *testing.T) {
 }
 
 func TestDiagnose_External_VerifyUserResolvesToken(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsUser), UserOpenId: "ou_x", UserName: "Alice"}
+	cfg := &configpkg.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsUser), UserOpenId: "ou_x", UserName: "Alice"}
 	f := externalFactory(&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}, token: &extcred.Token{Value: "ext-uat"}}, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, true)
@@ -472,7 +472,7 @@ func TestDiagnose_External_VerifyUserResolvesToken(t *testing.T) {
 }
 
 func TestDiagnose_External_VerifyUserTokenUnavailable(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsUser), UserOpenId: "ou_x"}
+	cfg := &configpkg.CliConfig{AppID: "cli_x", Brand: brand.Feishu, SupportedIdentities: uint8(extcred.SupportsUser), UserOpenId: "ou_x"}
 	f := externalFactory(&fakeExtProvider{name: "corp-sso", account: &extcred.Account{AppID: "cli_x"}}, cfg)
 
 	got := Diagnose(context.Background(), f, cfg, true)
diff --git a/internal/output/emitter_legacy_compat_test.go b/internal/output/emitter_legacy_compat_test.go
index 87cf46dd03..36877d9df5 100644
--- a/internal/output/emitter_legacy_compat_test.go
+++ b/internal/output/emitter_legacy_compat_test.go
@@ -24,7 +24,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	extcs "github.com/larksuite/cli/extension/contentsafety"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -404,7 +404,7 @@ func runRuntimeContextOracle(t *testing.T, data interface{}, opts runtimeOracleO
 
 	factory := &cmdutil.Factory{IOStreams: &cmdutil.IOStreams{Out: stdout, ErrOut: stderr}}
 	runtime := common.TestNewRuntimeContextForAPI(
-		context.Background(), leaf, &core.CliConfig{Brand: brand.Feishu}, factory, identity.AsBot,
+		context.Background(), leaf, &configpkg.CliConfig{Brand: brand.Feishu}, factory, identity.AsBot,
 	)
 	runtime.Format = opts.format
 	runtime.JqExpr = opts.jq
diff --git a/shortcuts/application/slash_command_list_test.go b/shortcuts/application/slash_command_list_test.go
index 00e3791b94..551957e025 100644
--- a/shortcuts/application/slash_command_list_test.go
+++ b/shortcuts/application/slash_command_list_test.go
@@ -11,14 +11,14 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
 )
 
-func appTestConfig() *core.CliConfig {
-	return &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu}
+func appTestConfig() *configpkg.CliConfig {
+	return &configpkg.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu}
 }
 
 // mountAndRun mounts the shortcut under a parent cobra command and runs it.
diff --git a/shortcuts/apps/apps_create_test.go b/shortcuts/apps/apps_create_test.go
index 9ecaab2c83..43055e0081 100644
--- a/shortcuts/apps/apps_create_test.go
+++ b/shortcuts/apps/apps_create_test.go
@@ -15,7 +15,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -26,7 +26,7 @@ func newAppsExecuteFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *http
 	t.Helper()
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/shortcuts/apps/apps_html_publish_test.go b/shortcuts/apps/apps_html_publish_test.go
index df22c44417..e2a918481f 100644
--- a/shortcuts/apps/apps_html_publish_test.go
+++ b/shortcuts/apps/apps_html_publish_test.go
@@ -18,7 +18,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -527,7 +527,7 @@ func newTOSTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Registry
 	t.Helper()
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/shortcuts/apps/apps_init_test.go b/shortcuts/apps/apps_init_test.go
index 97850c05ff..83c8df726f 100644
--- a/shortcuts/apps/apps_init_test.go
+++ b/shortcuts/apps/apps_init_test.go
@@ -20,7 +20,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/testutil/gitcmd"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -756,7 +756,7 @@ func newAppsExecuteFactoryWithStderr(t *testing.T) (*cmdutil.Factory, *bytes.Buf
 	t.Helper()
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/shortcuts/apps/apps_meta_test.go b/shortcuts/apps/apps_meta_test.go
index d79b7320e2..0d89ddac40 100644
--- a/shortcuts/apps/apps_meta_test.go
+++ b/shortcuts/apps/apps_meta_test.go
@@ -11,7 +11,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -19,7 +19,7 @@ import (
 
 func newMetaTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Registry) {
 	t.Helper()
-	cfg := &core.CliConfig{Brand: brand.Feishu, AppID: "cli_meta_test"}
+	cfg := &configpkg.CliConfig{Brand: brand.Feishu, AppID: "cli_meta_test"}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	rt := common.TestNewRuntimeContextForAPI(
 		context.Background(),
diff --git a/shortcuts/apps/apps_openapi_key_list_test.go b/shortcuts/apps/apps_openapi_key_list_test.go
index 4708a6052e..c897cf9d2c 100644
--- a/shortcuts/apps/apps_openapi_key_list_test.go
+++ b/shortcuts/apps/apps_openapi_key_list_test.go
@@ -12,7 +12,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -23,7 +23,7 @@ import (
 // bool flag 传 "true"/"false"。被本组所有命令测试复用。
 func newOpenAPIKeyRCtx(t *testing.T, flagDefs map[string]string, flags map[string]string) (*common.RuntimeContext, *bytes.Buffer, *httpmock.Registry) {
 	t.Helper()
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/shortcuts/apps/apps_release_create_test.go b/shortcuts/apps/apps_release_create_test.go
index c7b2655958..da0f5764e8 100644
--- a/shortcuts/apps/apps_release_create_test.go
+++ b/shortcuts/apps/apps_release_create_test.go
@@ -12,7 +12,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -49,7 +49,7 @@ func TestAppsReleaseCreateMeta(t *testing.T) {
 // via the returned setter helper.
 func newReleaseCreateRuntimeContext(t *testing.T, appID, branch string) (*common.RuntimeContext, *bytes.Buffer, *httpmock.Registry) {
 	t.Helper()
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/shortcuts/apps/apps_release_get_test.go b/shortcuts/apps/apps_release_get_test.go
index 59958116e6..f5192f1607 100644
--- a/shortcuts/apps/apps_release_get_test.go
+++ b/shortcuts/apps/apps_release_get_test.go
@@ -12,7 +12,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -39,7 +39,7 @@ func TestAppsReleaseGetMeta(t *testing.T) {
 // newStatusRuntimeContext builds a RuntimeContext for AppsReleaseGet.Execute tests.
 func newStatusRuntimeContext(t *testing.T, appID, releaseID string) (*common.RuntimeContext, *bytes.Buffer, *httpmock.Registry) {
 	t.Helper()
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/shortcuts/apps/apps_release_list_test.go b/shortcuts/apps/apps_release_list_test.go
index b06dc0b0c7..6345fd71ce 100644
--- a/shortcuts/apps/apps_release_list_test.go
+++ b/shortcuts/apps/apps_release_list_test.go
@@ -12,7 +12,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -49,7 +49,7 @@ func TestBuildReleaseListQuery(t *testing.T) {
 // newReleaseListRuntimeContext builds a RuntimeContext for AppsReleaseList.Execute tests.
 func newReleaseListRuntimeContext(t *testing.T, appID string) (*common.RuntimeContext, *bytes.Buffer, *httpmock.Registry) {
 	t.Helper()
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/shortcuts/apps/apps_role_common_test.go b/shortcuts/apps/apps_role_common_test.go
index de5831c49f..a82a133a60 100644
--- a/shortcuts/apps/apps_role_common_test.go
+++ b/shortcuts/apps/apps_role_common_test.go
@@ -13,7 +13,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
@@ -23,7 +23,7 @@ import (
 
 func newRoleRCtx(t *testing.T, flagDefs map[string]string, flags map[string]string) (*common.RuntimeContext, *bytes.Buffer, *httpmock.Registry) {
 	t.Helper()
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app-" + strings.ToLower(t.Name()),
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/shortcuts/apps/git_credential.go b/shortcuts/apps/git_credential.go
index 098d89ee4a..3b6d2160a5 100644
--- a/shortcuts/apps/git_credential.go
+++ b/shortcuts/apps/git_credential.go
@@ -21,7 +21,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/sparkstore"
@@ -384,7 +384,7 @@ func gitCredentialDisplayStatus(status string) string {
 	return status
 }
 
-func profileFromConfig(cfg *core.CliConfig) gitcred.ProfileContext {
+func profileFromConfig(cfg *configpkg.CliConfig) gitcred.ProfileContext {
 	if cfg == nil {
 		return gitcred.ProfileContext{}
 	}
diff --git a/shortcuts/apps/git_credential_test.go b/shortcuts/apps/git_credential_test.go
index 7f7559ba69..49d5f165ca 100644
--- a/shortcuts/apps/git_credential_test.go
+++ b/shortcuts/apps/git_credential_test.go
@@ -24,7 +24,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/sparkstore"
@@ -791,7 +791,7 @@ func TestRunGitCredentialHelperActions(t *testing.T) {
 		t.Fatalf("stderr = %q", stderr.String())
 	}
 	stderr.Reset()
-	factory.Config = func() (*core.CliConfig, error) { return nil, errors.New("config failed") }
+	factory.Config = func() (*configpkg.CliConfig, error) { return nil, errors.New("config failed") }
 	factory.IOStreams.In = bytes.NewBufferString("protocol=https\nhost=example.com\npath=/git/u/app.git\n\n")
 	if err := runGitCredentialHelper(context.Background(), factory, "app_xxx", "get"); err != nil {
 		t.Fatalf("helper config error returned error: %v", err)
@@ -799,8 +799,8 @@ func TestRunGitCredentialHelperActions(t *testing.T) {
 	if !strings.Contains(stderr.String(), "config failed") {
 		t.Fatalf("stderr = %q", stderr.String())
 	}
-	cfg = &core.CliConfig{AppID: "cli", AppSecret: "secret", Brand: brand.Feishu, UserOpenId: "ou_test"}
-	factory.Config = func() (*core.CliConfig, error) { return cfg, nil }
+	cfg = &configpkg.CliConfig{AppID: "cli", AppSecret: "secret", Brand: brand.Feishu, UserOpenId: "ou_test"}
+	factory.Config = func() (*configpkg.CliConfig, error) { return cfg, nil }
 	stderr.Reset()
 	if err := runGitCredentialHelper(context.Background(), factory, "app_xxx", "unknown"); err != nil {
 		t.Fatalf("helper unknown returned error: %v", err)
@@ -861,19 +861,19 @@ func TestFactoryIssuerBranches(t *testing.T) {
 		t.Fatalf("%s header missing", cmdutil.HeaderExecutionId)
 	}
 
-	factory.Config = func() (*core.CliConfig, error) { return nil, errors.New("config failed") }
+	factory.Config = func() (*configpkg.CliConfig, error) { return nil, errors.New("config failed") }
 	if _, err := (factoryIssuer{f: factory}).Issue(context.Background(), "app_xxx", gitcred.ProfileContext{}); err == nil {
 		t.Fatal("factory issuer config error returned nil")
 	}
 
-	factory.Config = func() (*core.CliConfig, error) {
-		return &core.CliConfig{AppID: "cli", AppSecret: "secret", Brand: brand.Feishu}, nil
+	factory.Config = func() (*configpkg.CliConfig, error) {
+		return &configpkg.CliConfig{AppID: "cli", AppSecret: "secret", Brand: brand.Feishu}, nil
 	}
 	if _, err := (factoryIssuer{f: factory}).Issue(context.Background(), "app_xxx", gitcred.ProfileContext{}); err == nil {
 		t.Fatal("factory issuer without login returned nil")
 	}
-	factory.Config = func() (*core.CliConfig, error) {
-		return &core.CliConfig{AppID: "cli", AppSecret: "secret", Brand: brand.Feishu, UserOpenId: "ou_test"}, nil
+	factory.Config = func() (*configpkg.CliConfig, error) {
+		return &configpkg.CliConfig{AppID: "cli", AppSecret: "secret", Brand: brand.Feishu, UserOpenId: "ou_test"}, nil
 	}
 	factory.LarkClient = func() (*lark.Client, error) { return nil, errors.New("sdk failed") }
 	if _, err := (factoryIssuer{f: factory}).Issue(context.Background(), "app_xxx", gitcred.ProfileContext{}); err == nil {
diff --git a/shortcuts/base/base_execute_test.go b/shortcuts/base/base_execute_test.go
index 7e0af4054a..e77c6aa5e7 100644
--- a/shortcuts/base/base_execute_test.go
+++ b/shortcuts/base/base_execute_test.go
@@ -21,7 +21,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -34,7 +34,7 @@ func newExecuteFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *httpmock
 
 func newExecuteFactoryWithUserOpenID(t *testing.T, userOpenID string) (*cmdutil.Factory, *bytes.Buffer, *httpmock.Registry) {
 	t.Helper()
-	config := &core.CliConfig{
+	config := &configpkg.CliConfig{
 		AppID:      "test-app-" + strings.ReplaceAll(strings.ToLower(t.Name()), "/", "-"),
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/shortcuts/base/base_shortcuts_test.go b/shortcuts/base/base_shortcuts_test.go
index 78c1e1118f..41231a3f0b 100644
--- a/shortcuts/base/base_shortcuts_test.go
+++ b/shortcuts/base/base_shortcuts_test.go
@@ -18,7 +18,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -62,7 +62,7 @@ func newBaseTestRuntimeWithArrays(stringFlags map[string]string, stringArrayFlag
 	for name, value := range intFlags {
 		_ = cmd.Flags().Set(name, strconv.Itoa(value))
 	}
-	return &common.RuntimeContext{Cmd: cmd, Config: &core.CliConfig{UserOpenId: "ou_test"}}
+	return &common.RuntimeContext{Cmd: cmd, Config: &configpkg.CliConfig{UserOpenId: "ou_test"}}
 }
 
 func assertBasePaginationValidation(t *testing.T, err error, param string) {
diff --git a/shortcuts/base/record_markdown_test.go b/shortcuts/base/record_markdown_test.go
index aabce5a705..f54e6fc394 100644
--- a/shortcuts/base/record_markdown_test.go
+++ b/shortcuts/base/record_markdown_test.go
@@ -18,7 +18,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	extcs "github.com/larksuite/cli/extension/contentsafety"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -40,7 +40,7 @@ func newRecordMarkdownTestRuntime(stdout, stderr *bytes.Buffer) *common.RuntimeC
 	parentCmd.AddCommand(baseCmd)
 	baseCmd.AddCommand(cmd)
 	return &common.RuntimeContext{
-		Config:  &core.CliConfig{Brand: brand.Feishu},
+		Config:  &configpkg.CliConfig{Brand: brand.Feishu},
 		Cmd:     cmd,
 		Factory: &cmdutil.Factory{IOStreams: &cmdutil.IOStreams{Out: stdout, ErrOut: stderr}},
 	}
diff --git a/shortcuts/calendar/calendar_meeting_test.go b/shortcuts/calendar/calendar_meeting_test.go
index d09c256597..ca9adbaa8d 100644
--- a/shortcuts/calendar/calendar_meeting_test.go
+++ b/shortcuts/calendar/calendar_meeting_test.go
@@ -17,7 +17,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -55,8 +55,8 @@ func calWarmTokenCache(t *testing.T) {
 	})
 }
 
-func calDefaultConfig() *core.CliConfig {
-	return &core.CliConfig{
+func calDefaultConfig() *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		UserOpenId: "ou_testuser",
 	}
diff --git a/shortcuts/calendar/calendar_test.go b/shortcuts/calendar/calendar_test.go
index 9a3004c4c3..c9d872e1b8 100644
--- a/shortcuts/calendar/calendar_test.go
+++ b/shortcuts/calendar/calendar_test.go
@@ -16,7 +16,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -77,21 +77,21 @@ func mountAndRun(t *testing.T, s common.Shortcut, args []string, f *cmdutil.Fact
 	return parent.Execute()
 }
 
-func defaultConfig() *core.CliConfig {
-	return &core.CliConfig{
+func defaultConfig() *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		UserOpenId: "ou_testuser",
 	}
 }
 
-func noLoginConfig() *core.CliConfig {
-	return &core.CliConfig{
+func noLoginConfig() *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 }
 
-func noLoginBotDefaultConfig() *core.CliConfig {
-	return &core.CliConfig{
+func noLoginBotDefaultConfig() *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		DefaultAs: "bot",
 	}
diff --git a/shortcuts/common/call_api_typed_test.go b/shortcuts/common/call_api_typed_test.go
index 8832f813fe..df1b0c2a53 100644
--- a/shortcuts/common/call_api_typed_test.go
+++ b/shortcuts/common/call_api_typed_test.go
@@ -15,14 +15,14 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 )
 
 func newCallAPITypedRuntime(t *testing.T) (*RuntimeContext, *httpmock.Registry) {
 	t.Helper()
-	cfg := &core.CliConfig{Brand: brand.Feishu, AppID: "cli_x"}
+	cfg := &configpkg.CliConfig{Brand: brand.Feishu, AppID: "cli_x"}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	rt := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+x"}, cfg, f, identity.AsUser)
 	return rt, reg
@@ -104,7 +104,7 @@ func TestCallAPITyped_Success(t *testing.T) {
 // runtime: Brand / AppID from config, Identity from the resolved caller, and
 // LarkCmd from the running command path.
 func TestAPIClassifyContext(t *testing.T) {
-	cfg := &core.CliConfig{Brand: brand.Lark, AppID: "cli_x"}
+	cfg := &configpkg.CliConfig{Brand: brand.Lark, AppID: "cli_x"}
 	rt := TestNewRuntimeContextWithIdentity(&cobra.Command{Use: "+upload"}, cfg, identity.AsUser)
 
 	cc := rt.APIClassifyContext()
@@ -121,7 +121,7 @@ func TestAPIClassifyContext(t *testing.T) {
 		t.Errorf("LarkCmd = %q, want +upload", cc.LarkCmd)
 	}
 
-	bot := TestNewRuntimeContextWithIdentity(&cobra.Command{Use: "+push"}, &core.CliConfig{Brand: brand.Feishu, AppID: "y"}, identity.AsBot)
+	bot := TestNewRuntimeContextWithIdentity(&cobra.Command{Use: "+push"}, &configpkg.CliConfig{Brand: brand.Feishu, AppID: "y"}, identity.AsBot)
 	if got := bot.APIClassifyContext().Identity; got != "bot" {
 		t.Errorf("bot Identity = %q, want bot", got)
 	}
@@ -256,7 +256,7 @@ func TestDoAPIJSONTyped_Success(t *testing.T) {
 }
 
 func TestDoAPIJSONTyped_RawClientErrorBecomesTypedInternal(t *testing.T) {
-	rt := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+x"}, &core.CliConfig{}, nil, identity.AsUser)
+	rt := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+x"}, &configpkg.CliConfig{}, nil, identity.AsUser)
 	rt.apiClientFunc = func() (*client.APIClient, error) {
 		return nil, errors.New("raw client construction error")
 	}
diff --git a/shortcuts/common/drive_media_upload_test.go b/shortcuts/common/drive_media_upload_test.go
index 2292d841f7..4b0315bb32 100644
--- a/shortcuts/common/drive_media_upload_test.go
+++ b/shortcuts/common/drive_media_upload_test.go
@@ -18,7 +18,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 )
@@ -306,7 +306,7 @@ func newDriveMediaUploadTestRuntime(t *testing.T) (*RuntimeContext, *httpmock.Re
 	t.Helper()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID: fmt.Sprintf("common-drive-media-test-%d", commonDriveMediaUploadTestSeq.Add(1)), AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
diff --git a/shortcuts/common/drive_meta_test.go b/shortcuts/common/drive_meta_test.go
index 065c0c2bd9..43d9ef2888 100644
--- a/shortcuts/common/drive_meta_test.go
+++ b/shortcuts/common/drive_meta_test.go
@@ -13,7 +13,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 )
@@ -158,7 +158,7 @@ func newDriveMetaTestRuntime(t *testing.T) (*RuntimeContext, *httpmock.Registry)
 	t.Helper()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID: fmt.Sprintf("drive-meta-test-%d", driveMetaTestSeq.Add(1)), AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
diff --git a/shortcuts/common/permission_grant_test.go b/shortcuts/common/permission_grant_test.go
index 58eff2fb3a..01692c000a 100644
--- a/shortcuts/common/permission_grant_test.go
+++ b/shortcuts/common/permission_grant_test.go
@@ -11,7 +11,7 @@ import (
 
 	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
@@ -42,7 +42,7 @@ func TestPermissionGrantPermMessageUsesAPINameOnly(t *testing.T) {
 }
 
 func TestAutoGrantStderrWarning_SkippedNoUser(t *testing.T) {
-	config := &core.CliConfig{
+	config := &configpkg.CliConfig{
 		AppID:     "perm-grant-test-skip",
 		AppSecret: "perm-grant-test-secret-skip",
 		Brand:     brandpkg.Feishu,
@@ -76,7 +76,7 @@ func TestAutoGrantStderrWarning_SkippedNoUser(t *testing.T) {
 }
 
 func TestAutoGrantStderrWarning_GrantFailed(t *testing.T) {
-	config := &core.CliConfig{
+	config := &configpkg.CliConfig{
 		AppID:      "perm-grant-test-fail",
 		AppSecret:  "perm-grant-test-secret-fail",
 		Brand:      brandpkg.Feishu,
@@ -127,7 +127,7 @@ func TestAutoGrantStderrWarning_GrantFailed(t *testing.T) {
 
 func newAnnotateRuntime(brand brandpkg.Brand, appID string) *RuntimeContext {
 	return &RuntimeContext{
-		Config: &core.CliConfig{
+		Config: &configpkg.CliConfig{
 			AppID: appID,
 			Brand: brand,
 		},
@@ -259,7 +259,7 @@ func TestAnnotateGrantPermissionError_NilArgsSafe(t *testing.T) {
 // with a mocked 99991672 response — verifies the annotated fields show up
 // in the JSON result that callers downstream consume.
 func TestAutoGrantStderrWarning_GrantFailed_AppScopeNotEnabled_Annotated(t *testing.T) {
-	config := &core.CliConfig{
+	config := &configpkg.CliConfig{
 		AppID:      "cli_app_demo",
 		AppSecret:  "secret",
 		Brand:      brandpkg.Feishu,
diff --git a/shortcuts/common/runner.go b/shortcuts/common/runner.go
index 39f2b686c1..3456289edb 100644
--- a/shortcuts/common/runner.go
+++ b/shortcuts/common/runner.go
@@ -26,7 +26,7 @@ import (
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/cmdmeta"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/i18n"
@@ -39,7 +39,7 @@ import (
 // RuntimeContext provides helpers for shortcut execution.
 type RuntimeContext struct {
 	ctx           context.Context // from cmd.Context(), propagated through the call chain
-	Config        *core.CliConfig
+	Config        *configpkg.CliConfig
 	Cmd           *cobra.Command
 	Format        string
 	JqExpr        string                            // --jq expression; empty = no filter
@@ -1018,7 +1018,7 @@ func resolveShortcutIdentity(cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut
 	return as, nil
 }
 
-func checkShortcutScopes(f *cmdutil.Factory, ctx context.Context, as identitypkg.Identity, config *core.CliConfig, scopes []string) error {
+func checkShortcutScopes(f *cmdutil.Factory, ctx context.Context, as identitypkg.Identity, config *configpkg.CliConfig, scopes []string) error {
 	if len(scopes) == 0 {
 		return nil
 	}
@@ -1036,7 +1036,7 @@ func checkShortcutScopes(f *cmdutil.Factory, ctx context.Context, as identitypkg
 		WithHint("run `lark-cli auth login --scope \"%s\"` in the background. It blocks and outputs a verification URL — retrieve the URL and open it in a browser to complete login.", strings.Join(missing, " "))
 }
 
-func newRuntimeContext(cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut, config *core.CliConfig, as identitypkg.Identity, botOnly bool) (*RuntimeContext, error) {
+func newRuntimeContext(cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut, config *configpkg.CliConfig, as identitypkg.Identity, botOnly bool) (*RuntimeContext, error) {
 	ctx := cmd.Context()
 	ctx = cmdutil.ContextWithShortcut(ctx, s.Service+":"+s.Command, uuid.New().String())
 	rctx := &RuntimeContext{ctx: ctx, Config: config, Cmd: cmd, botOnly: botOnly, resolvedAs: as, Factory: f}
diff --git a/shortcuts/common/runner_botinfo_test.go b/shortcuts/common/runner_botinfo_test.go
index 28360ae6bd..91f1143c67 100644
--- a/shortcuts/common/runner_botinfo_test.go
+++ b/shortcuts/common/runner_botinfo_test.go
@@ -12,14 +12,14 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
 // botInfoTestConfig returns a CliConfig suitable for bot info tests.
-func botInfoTestConfig(t *testing.T) *core.CliConfig {
+func botInfoTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-app",
 		AppSecret: "test-secret",
 		Brand:     brand.Feishu,
@@ -291,7 +291,7 @@ func TestFetchBotInfo_CanBotFalse(t *testing.T) {
 
 func TestBotInfo_NilFunc(t *testing.T) {
 	cmd := &cobra.Command{Use: "test"}
-	rctx := TestNewRuntimeContext(cmd, &core.CliConfig{})
+	rctx := TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	_, err := rctx.BotInfo()
 	if err == nil {
 		t.Fatal("expected error for nil botInfoFunc")
diff --git a/shortcuts/common/runner_contentsafety_test.go b/shortcuts/common/runner_contentsafety_test.go
index 8eaf366cc8..863d12c5ee 100644
--- a/shortcuts/common/runner_contentsafety_test.go
+++ b/shortcuts/common/runner_contentsafety_test.go
@@ -16,7 +16,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	extcs "github.com/larksuite/cli/extension/contentsafety"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 )
@@ -39,7 +39,7 @@ func newCSTestContext(t *testing.T) (*RuntimeContext, *bytes.Buffer, *bytes.Buff
 	parentCmd.AddCommand(cmd)
 	rctx := &RuntimeContext{
 		ctx:        context.Background(),
-		Config:     &core.CliConfig{Brand: brand.Feishu},
+		Config:     &configpkg.CliConfig{Brand: brand.Feishu},
 		Cmd:        cmd,
 		resolvedAs: identity.AsBot,
 		Factory: &cmdutil.Factory{
diff --git a/shortcuts/common/runner_identity_flag_test.go b/shortcuts/common/runner_identity_flag_test.go
index 52c22641bc..fef6e4b481 100644
--- a/shortcuts/common/runner_identity_flag_test.go
+++ b/shortcuts/common/runner_identity_flag_test.go
@@ -9,12 +9,12 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/spf13/cobra"
 )
 
 func TestShortcutMount_StrictModeHidesAsFlag(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu, SupportedIdentities: 2,
 	})
 	parent := &cobra.Command{Use: "root"}
diff --git a/shortcuts/common/runner_jq_test.go b/shortcuts/common/runner_jq_test.go
index 4308cc58c6..6e240afbb1 100644
--- a/shortcuts/common/runner_jq_test.go
+++ b/shortcuts/common/runner_jq_test.go
@@ -19,7 +19,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 )
@@ -42,7 +42,7 @@ func newJqTestContext(jqExpr, format string) (*RuntimeContext, *bytes.Buffer, *b
 
 	rctx := &RuntimeContext{
 		ctx:        context.Background(),
-		Config:     &core.CliConfig{Brand: brand.Feishu},
+		Config:     &configpkg.CliConfig{Brand: brand.Feishu},
 		Cmd:        cmd,
 		Format:     format,
 		JqExpr:     jqExpr,
@@ -225,8 +225,8 @@ func newTestShortcutCmd(s *Shortcut, f *cmdutil.Factory) *cobra.Command {
 
 func newTestFactory() *cmdutil.Factory {
 	return &cmdutil.Factory{
-		Config: func() (*core.CliConfig, error) {
-			return &core.CliConfig{
+		Config: func() (*configpkg.CliConfig, error) {
+			return &configpkg.CliConfig{
 				AppID: "test", AppSecret: "test", Brand: brand.Feishu,
 			}, nil
 		},
diff --git a/shortcuts/common/runner_lang_test.go b/shortcuts/common/runner_lang_test.go
index 9efd0eb6b3..db25c0a13c 100644
--- a/shortcuts/common/runner_lang_test.go
+++ b/shortcuts/common/runner_lang_test.go
@@ -6,7 +6,7 @@ package common
 import (
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/i18n"
 )
 
@@ -24,7 +24,7 @@ func TestRuntimeContext_Lang(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			ctx := &RuntimeContext{Config: &core.CliConfig{Lang: tt.stored}}
+			ctx := &RuntimeContext{Config: &configpkg.CliConfig{Lang: tt.stored}}
 			if got := ctx.Lang(); got != tt.want {
 				t.Errorf("Lang() with stored %q = %q, want %q", tt.stored, got, tt.want)
 			}
diff --git a/shortcuts/common/runner_partial_failure_test.go b/shortcuts/common/runner_partial_failure_test.go
index 53dd35ffc3..32296974e3 100644
--- a/shortcuts/common/runner_partial_failure_test.go
+++ b/shortcuts/common/runner_partial_failure_test.go
@@ -13,7 +13,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/output"
 )
@@ -23,7 +23,7 @@ import (
 // returned error is the typed partial-failure exit signal (ExitAPI), distinct
 // from ErrBare (the silent-exit signal).
 func TestOutPartialFailure(t *testing.T) {
-	cfg := &core.CliConfig{Brand: brand.Feishu, AppID: "cli_x"}
+	cfg := &configpkg.CliConfig{Brand: brand.Feishu, AppID: "cli_x"}
 	f, stdout, _, _ := cmdutil.TestFactory(t, cfg)
 	rt := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+push"}, cfg, f, identity.AsUser)
 
diff --git a/shortcuts/common/runner_scope_test.go b/shortcuts/common/runner_scope_test.go
index 533822a4b3..e238bca2a0 100644
--- a/shortcuts/common/runner_scope_test.go
+++ b/shortcuts/common/runner_scope_test.go
@@ -12,7 +12,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/identity"
 )
@@ -110,7 +110,7 @@ func TestCheckShortcutScopes_PropagatesContextCancellation(t *testing.T) {
 		Credential: credential.NewCredentialProvider(nil, nil, &scopeCheckTokenResolver{err: context.Canceled}, nil),
 	}
 
-	err := checkShortcutScopes(f, context.Background(), identity.AsUser, &core.CliConfig{AppID: "app-1"}, []string{"im:message:read"})
+	err := checkShortcutScopes(f, context.Background(), identity.AsUser, &configpkg.CliConfig{AppID: "app-1"}, []string{"im:message:read"})
 	if !errors.Is(err, context.Canceled) {
 		t.Fatalf("checkShortcutScopes() error = %v, want context.Canceled", err)
 	}
@@ -131,7 +131,7 @@ func TestCheckShortcutScopes_ReturnsTypedPermissionError(t *testing.T) {
 	}
 
 	required := []string{"im:message:read", "drive:drive:read", "docx:document:read"}
-	err := checkShortcutScopes(f, context.Background(), identity.AsUser, &core.CliConfig{AppID: "app-1"}, required)
+	err := checkShortcutScopes(f, context.Background(), identity.AsUser, &configpkg.CliConfig{AppID: "app-1"}, required)
 	if err == nil {
 		t.Fatal("expected error when token is missing required scopes, got nil")
 	}
@@ -172,7 +172,7 @@ func TestCheckShortcutScopes_IgnoresNonContextTokenErrors(t *testing.T) {
 		Credential: credential.NewCredentialProvider(nil, nil, &scopeCheckTokenResolver{err: errors.New("token cache unavailable")}, nil),
 	}
 
-	err := checkShortcutScopes(f, context.Background(), identity.AsUser, &core.CliConfig{AppID: "app-1"}, []string{"im:message:read"})
+	err := checkShortcutScopes(f, context.Background(), identity.AsUser, &configpkg.CliConfig{AppID: "app-1"}, []string{"im:message:read"})
 	if err != nil {
 		t.Fatalf("checkShortcutScopes() error = %v, want nil", err)
 	}
diff --git a/shortcuts/common/testing.go b/shortcuts/common/testing.go
index 4c0f71cd47..91db29e239 100644
--- a/shortcuts/common/testing.go
+++ b/shortcuts/common/testing.go
@@ -10,29 +10,29 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 )
 
 // TestNewRuntimeContext creates a RuntimeContext for testing purposes.
 // Only Cmd and Config are set; other fields (Factory, larkSDK, etc.) are nil.
-func TestNewRuntimeContext(cmd *cobra.Command, cfg *core.CliConfig) *RuntimeContext {
+func TestNewRuntimeContext(cmd *cobra.Command, cfg *configpkg.CliConfig) *RuntimeContext {
 	return &RuntimeContext{Cmd: cmd, Config: cfg}
 }
 
 // TestNewRuntimeContextWithCtx creates a RuntimeContext with an explicit context
 // for tests that invoke functions which call Ctx() (e.g. HTTP request helpers).
-func TestNewRuntimeContextWithCtx(ctx context.Context, cmd *cobra.Command, cfg *core.CliConfig) *RuntimeContext {
+func TestNewRuntimeContextWithCtx(ctx context.Context, cmd *cobra.Command, cfg *configpkg.CliConfig) *RuntimeContext {
 	return &RuntimeContext{ctx: ctx, Cmd: cmd, Config: cfg}
 }
 
 // TestNewRuntimeContextWithIdentity creates a RuntimeContext with a specific identity for testing.
-func TestNewRuntimeContextWithIdentity(cmd *cobra.Command, cfg *core.CliConfig, as identity.Identity) *RuntimeContext {
+func TestNewRuntimeContextWithIdentity(cmd *cobra.Command, cfg *configpkg.CliConfig, as identity.Identity) *RuntimeContext {
 	return &RuntimeContext{Cmd: cmd, Config: cfg, resolvedAs: as}
 }
 
 // TestNewRuntimeContextWithBotInfo creates a RuntimeContext with a pre-set BotInfo for testing.
-func TestNewRuntimeContextWithBotInfo(cmd *cobra.Command, cfg *core.CliConfig, info *BotInfo) *RuntimeContext {
+func TestNewRuntimeContextWithBotInfo(cmd *cobra.Command, cfg *configpkg.CliConfig, info *BotInfo) *RuntimeContext {
 	rctx := &RuntimeContext{Cmd: cmd, Config: cfg}
 	rctx.botInfoFunc = sync.OnceValues(func() (*BotInfo, error) {
 		return info, nil
@@ -49,7 +49,7 @@ func TestNewRuntimeContextWithBotInfo(cmd *cobra.Command, cfg *core.CliConfig, i
 // parameter keeps the helper reusable for tests that need to exercise the
 // user-identity code path (token store, auth login, etc.) without forking
 // into a second near-identical helper.
-func TestNewRuntimeContextForAPI(ctx context.Context, cmd *cobra.Command, cfg *core.CliConfig, f *cmdutil.Factory, as identity.Identity) *RuntimeContext {
+func TestNewRuntimeContextForAPI(ctx context.Context, cmd *cobra.Command, cfg *configpkg.CliConfig, f *cmdutil.Factory, as identity.Identity) *RuntimeContext {
 	return &RuntimeContext{
 		ctx:        ctx,
 		Cmd:        cmd,
diff --git a/shortcuts/common/testing_test.go b/shortcuts/common/testing_test.go
index 5d7dcd7d52..3bb3158edd 100644
--- a/shortcuts/common/testing_test.go
+++ b/shortcuts/common/testing_test.go
@@ -11,13 +11,13 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/identity"
 )
 
 func TestTestNewRuntimeContextForAPIWiresFields(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	cfg := &core.CliConfig{AppID: "self-test-app", AppSecret: "secret", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "self-test-app", AppSecret: "secret", Brand: brand.Feishu}
 	f, _, _, _ := cmdutil.TestFactory(t, cfg)
 	cmd := &cobra.Command{Use: "testing-helper"}
 
diff --git a/shortcuts/common/userids_test.go b/shortcuts/common/userids_test.go
index 7d5e2f76a9..82f2d30cae 100644
--- a/shortcuts/common/userids_test.go
+++ b/shortcuts/common/userids_test.go
@@ -7,13 +7,13 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/spf13/cobra"
 )
 
 func resolveOpenIDsTestRuntime(userOpenID string) *RuntimeContext {
 	cmd := &cobra.Command{Use: "test"}
-	cfg := &core.CliConfig{UserOpenId: userOpenID}
+	cfg := &configpkg.CliConfig{UserOpenId: userOpenID}
 	return TestNewRuntimeContext(cmd, cfg)
 }
 
diff --git a/shortcuts/contact/contact_search_user_test.go b/shortcuts/contact/contact_search_user_test.go
index 429bf16844..9569211aa1 100644
--- a/shortcuts/contact/contact_search_user_test.go
+++ b/shortcuts/contact/contact_search_user_test.go
@@ -18,7 +18,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -38,8 +38,8 @@ func newSearchUserTestCommand() *cobra.Command {
 	return cmd
 }
 
-func searchUserDefaultConfig() *core.CliConfig {
-	return &core.CliConfig{
+func searchUserDefaultConfig() *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID: "test", AppSecret: "test", Brand: brand.Feishu,
 		UserOpenId: "ou_self",
 	}
diff --git a/shortcuts/doc/doc_media_test.go b/shortcuts/doc/doc_media_test.go
index 8e68da210a..e4a43f2385 100644
--- a/shortcuts/doc/doc_media_test.go
+++ b/shortcuts/doc/doc_media_test.go
@@ -18,15 +18,15 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
-func docsTestConfigWithAppID(appID string) *core.CliConfig {
-	return &core.CliConfig{
+func docsTestConfigWithAppID(appID string) *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID: appID, AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 }
diff --git a/shortcuts/doc/docs_create_test.go b/shortcuts/doc/docs_create_test.go
index 31fe97e918..c2f40f98d6 100644
--- a/shortcuts/doc/docs_create_test.go
+++ b/shortcuts/doc/docs_create_test.go
@@ -11,7 +11,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -302,12 +302,12 @@ func TestDocsCreateRejectsLegacyV1Flags(t *testing.T) {
 
 // ── Helpers ──
 
-func docsCreateTestConfig(t *testing.T, userOpenID string) *core.CliConfig {
+func docsCreateTestConfig(t *testing.T, userOpenID string) *configpkg.CliConfig {
 	t.Helper()
 
 	replacer := strings.NewReplacer("/", "-", " ", "-")
 	suffix := replacer.Replace(strings.ToLower(t.Name()))
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:      "test-docs-create-" + suffix,
 		AppSecret:  "secret-docs-create-" + suffix,
 		Brand:      brand.Feishu,
diff --git a/shortcuts/doc/docs_fetch_v2_test.go b/shortcuts/doc/docs_fetch_v2_test.go
index 68d2750ce7..2b1bafdb92 100644
--- a/shortcuts/doc/docs_fetch_v2_test.go
+++ b/shortcuts/doc/docs_fetch_v2_test.go
@@ -14,7 +14,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
@@ -102,7 +102,7 @@ func TestBuildFetchBodyUsesRuntimeConfigLang(t *testing.T) {
 	t.Parallel()
 
 	runtime := newFetchBodyTestRuntime(context.Background())
-	runtime.Config = &core.CliConfig{Lang: "zh_cn"}
+	runtime.Config = &configpkg.CliConfig{Lang: "zh_cn"}
 
 	body := buildFetchBody(runtime)
 	if got := body["lang"]; got != "zh_cn" {
@@ -114,7 +114,7 @@ func TestBuildFetchBodyExplicitBlankLangOmitsLang(t *testing.T) {
 	t.Parallel()
 
 	runtime := newFetchBodyTestRuntime(context.Background())
-	runtime.Config = &core.CliConfig{Lang: "zh_cn"}
+	runtime.Config = &configpkg.CliConfig{Lang: "zh_cn"}
 	if err := runtime.Cmd.Flags().Set("lang", ""); err != nil {
 		t.Fatalf("set lang: %v", err)
 	}
diff --git a/shortcuts/drive/drive_import_test.go b/shortcuts/drive/drive_import_test.go
index 719adaef5f..361e39a168 100644
--- a/shortcuts/drive/drive_import_test.go
+++ b/shortcuts/drive/drive_import_test.go
@@ -14,7 +14,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	_ "github.com/larksuite/cli/internal/vfs/localfileio"
@@ -575,12 +575,12 @@ func driveImportMockEnv(t *testing.T, reg *httpmock.Registry, ticket string, pol
 // driveImportTestConfig builds a CliConfig for the import fallback tests.
 // The brand defaults to BrandFeishu when omitted; pass brand.Lark to
 // exercise the larksuite.com branch of BuildResourceURL.
-func driveImportTestConfig(suffix string, brands ...brand.Brand) *core.CliConfig {
+func driveImportTestConfig(suffix string, brands ...brand.Brand) *configpkg.CliConfig {
 	brand := brand.Feishu
 	if len(brands) > 0 {
 		brand = brands[0]
 	}
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "drive-import-fallback-" + suffix,
 		AppSecret: "test-secret",
 		Brand:     brand,
diff --git a/shortcuts/drive/drive_inspect_test.go b/shortcuts/drive/drive_inspect_test.go
index 1147a55bbf..46b8b6d838 100644
--- a/shortcuts/drive/drive_inspect_test.go
+++ b/shortcuts/drive/drive_inspect_test.go
@@ -14,7 +14,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -26,7 +26,7 @@ func TestDriveInspectValidate_EmptyURL(t *testing.T) {
 	cmd.Flags().String("url", "", "")
 	cmd.Flags().String("type", "", "")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	err := DriveInspect.Validate(context.Background(), runtime)
 	if err == nil {
 		t.Fatal("expected error for empty --url, got nil")
@@ -39,7 +39,7 @@ func TestDriveInspectValidate_UnsupportedURL(t *testing.T) {
 	cmd.Flags().String("type", "", "")
 	_ = cmd.Flags().Set("url", "https://google.com/some/page")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	err := DriveInspect.Validate(context.Background(), runtime)
 	if err == nil {
 		t.Fatal("expected error for unsupported URL, got nil")
@@ -52,7 +52,7 @@ func TestDriveInspectValidate_NonLarkHostWithLarkPath(t *testing.T) {
 	cmd.Flags().String("type", "", "")
 	_ = cmd.Flags().Set("url", "https://google.com/docx/doxcnLooksValid")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	err := DriveInspect.Validate(context.Background(), runtime)
 	if err != nil {
 		t.Fatalf("expected no error for non-Lark host with Lark-like path (host validation removed), got %v", err)
@@ -65,7 +65,7 @@ func TestDriveInspectValidate_BareTokenWithoutType(t *testing.T) {
 	cmd.Flags().String("type", "", "")
 	_ = cmd.Flags().Set("url", "doxcnBareToken")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	err := DriveInspect.Validate(context.Background(), runtime)
 	if err == nil {
 		t.Fatal("expected error for bare token without --type, got nil")
@@ -79,7 +79,7 @@ func TestDriveInspectValidate_BareTokenWithType(t *testing.T) {
 	_ = cmd.Flags().Set("url", "doxcnBareToken")
 	_ = cmd.Flags().Set("type", "docx")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	err := DriveInspect.Validate(context.Background(), runtime)
 	if err != nil {
 		t.Fatalf("expected no error, got %v", err)
@@ -93,7 +93,7 @@ func TestDriveInspectValidate_URLTypeConflict(t *testing.T) {
 	_ = cmd.Flags().Set("url", "https://xxx.feishu.cn/docx/doxcnBareToken")
 	_ = cmd.Flags().Set("type", "sheet")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	err := DriveInspect.Validate(context.Background(), runtime)
 	if err == nil {
 		t.Fatal("expected error for conflicting --type, got nil")
@@ -107,7 +107,7 @@ func TestDriveInspectValidate_BareTokenWithPathFragment(t *testing.T) {
 	_ = cmd.Flags().Set("url", "doxcnBareToken/extra")
 	_ = cmd.Flags().Set("type", "docx")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	err := DriveInspect.Validate(context.Background(), runtime)
 	if err == nil {
 		t.Fatal("expected error for bare token with path fragment, got nil")
@@ -120,7 +120,7 @@ func TestDriveInspectValidate_ValidDocxURL(t *testing.T) {
 	cmd.Flags().String("type", "", "")
 	_ = cmd.Flags().Set("url", "https://xxx.feishu.cn/docx/doxcnABC")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	err := DriveInspect.Validate(context.Background(), runtime)
 	if err != nil {
 		t.Fatalf("expected no error, got %v", err)
@@ -133,7 +133,7 @@ func TestDriveInspectValidate_ValidWikiURL(t *testing.T) {
 	cmd.Flags().String("type", "", "")
 	_ = cmd.Flags().Set("url", "https://xxx.feishu.cn/wiki/wikcnABC")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	err := DriveInspect.Validate(context.Background(), runtime)
 	if err != nil {
 		t.Fatalf("expected no error, got %v", err)
@@ -146,7 +146,7 @@ func TestDriveInspectValidate_ValidDoubaoDriveFileURL(t *testing.T) {
 	cmd.Flags().String("type", "", "")
 	_ = cmd.Flags().Set("url", "https://feishu.doubao.com/drive/file/boxcnABC")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	err := DriveInspect.Validate(context.Background(), runtime)
 	if err != nil {
 		t.Fatalf("expected no error, got %v", err)
@@ -159,7 +159,7 @@ func TestDriveInspectValidate_ValidDoubaoChatDriveFolderURL(t *testing.T) {
 	cmd.Flags().String("type", "", "")
 	_ = cmd.Flags().Set("url", "https://feishu.doubao.com/chat/drive/fldcnABC")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	err := DriveInspect.Validate(context.Background(), runtime)
 	if err != nil {
 		t.Fatalf("expected no error, got %v", err)
@@ -172,7 +172,7 @@ func TestDriveInspectValidate_ValidDoubaoDriveShareFolderURL(t *testing.T) {
 	cmd.Flags().String("type", "", "")
 	_ = cmd.Flags().Set("url", "https://feishu.doubao.com/drive/shr/fldcnABC")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	err := DriveInspect.Validate(context.Background(), runtime)
 	if err != nil {
 		t.Fatalf("expected no error, got %v", err)
@@ -187,7 +187,7 @@ func TestDriveInspectDryRun_DocxURL(t *testing.T) {
 	cmd.Flags().String("type", "", "")
 	_ = cmd.Flags().Set("url", "https://xxx.feishu.cn/docx/doxcnABC")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	dry := DriveInspect.DryRun(context.Background(), runtime)
 	if dry == nil {
 		t.Fatal("DryRun returned nil")
@@ -234,7 +234,7 @@ func TestDriveInspectDryRun_WikiURL(t *testing.T) {
 	cmd.Flags().String("type", "", "")
 	_ = cmd.Flags().Set("url", "https://xxx.feishu.cn/wiki/wikcnABC")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	dry := DriveInspect.DryRun(context.Background(), runtime)
 	if dry == nil {
 		t.Fatal("DryRun returned nil")
@@ -281,7 +281,7 @@ func TestDriveInspectDryRun_BareTokenWithType(t *testing.T) {
 	_ = cmd.Flags().Set("url", "doxcnBareToken")
 	_ = cmd.Flags().Set("type", "docx")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	dry := DriveInspect.DryRun(context.Background(), runtime)
 	if dry == nil {
 		t.Fatal("DryRun returned nil")
@@ -311,7 +311,7 @@ func TestDriveInspectDryRun_DoubaoDriveFileURL(t *testing.T) {
 	cmd.Flags().String("type", "", "")
 	_ = cmd.Flags().Set("url", "https://feishu.doubao.com/drive/file/boxcnABC")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	dry := DriveInspect.DryRun(context.Background(), runtime)
 	if dry == nil {
 		t.Fatal("DryRun returned nil")
@@ -349,7 +349,7 @@ func TestDriveInspectDryRun_DoubaoDriveShareFolderURL(t *testing.T) {
 	cmd.Flags().String("type", "", "")
 	_ = cmd.Flags().Set("url", "https://feishu.doubao.com/drive/shr/fldcnABC")
 
-	runtime := common.TestNewRuntimeContext(cmd, &core.CliConfig{})
+	runtime := common.TestNewRuntimeContext(cmd, &configpkg.CliConfig{})
 	dry := DriveInspect.DryRun(context.Background(), runtime)
 	if dry == nil {
 		t.Fatal("DryRun returned nil")
diff --git a/shortcuts/drive/drive_io_test.go b/shortcuts/drive/drive_io_test.go
index 1654b619a5..517f2d7e7d 100644
--- a/shortcuts/drive/drive_io_test.go
+++ b/shortcuts/drive/drive_io_test.go
@@ -21,7 +21,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -29,8 +29,8 @@ import (
 
 var driveTaskCheckPollMu sync.Mutex
 
-func driveTestConfig() *core.CliConfig {
-	return &core.CliConfig{
+func driveTestConfig() *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID: "drive-test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 }
@@ -78,7 +78,7 @@ func withDriveWorkingDir(t *testing.T, dir string) {
 
 func TestDriveUploadLargeFileUsesMultipart(t *testing.T) {
 	// Use a distinct AppID to avoid Lark SDK global token cache collision with other tests.
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -156,7 +156,7 @@ func TestDriveUploadLargeFileUsesMultipart(t *testing.T) {
 }
 
 func TestDriveUploadLargeFileToWikiUsesMultipart(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-large-wiki-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -233,7 +233,7 @@ func TestDriveUploadLargeFileToWikiUsesMultipart(t *testing.T) {
 }
 
 func TestDriveUploadLargeFileOverwriteUsesMultipart(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-large-overwrite-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -303,7 +303,7 @@ func TestDriveUploadLargeFileOverwriteUsesMultipart(t *testing.T) {
 }
 
 func TestDriveUploadLargeFileOverwriteReturnsVersionFromUploadFinish(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-large-overwrite-version-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -368,7 +368,7 @@ func TestDriveUploadLargeFileOverwriteReturnsVersionFromUploadFinish(t *testing.
 }
 
 func TestDriveUploadLargeFileOverwriteReturnsVersionFromUploadFinishAlias(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-large-overwrite-data-version-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -433,7 +433,7 @@ func TestDriveUploadLargeFileOverwriteReturnsVersionFromUploadFinishAlias(t *tes
 }
 
 func TestDriveUploadSmallFile(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-small-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -472,7 +472,7 @@ func TestDriveUploadSmallFile(t *testing.T) {
 }
 
 func TestDriveUploadSmallFileOverwriteUsesFileToken(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-small-overwrite-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -518,7 +518,7 @@ func TestDriveUploadSmallFileOverwriteUsesFileToken(t *testing.T) {
 }
 
 func TestDriveUploadReturnsVersionFromDataVersionAlias(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-small-data-version-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -559,7 +559,7 @@ func TestDriveUploadReturnsVersionFromDataVersionAlias(t *testing.T) {
 }
 
 func TestDriveUploadSmallFileToWiki(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-small-wiki-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -609,7 +609,7 @@ func TestDriveUploadSmallFileToWiki(t *testing.T) {
 }
 
 func TestDriveUploadUsesMetaURLForExplorerParent(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-explorer-meta-url", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -660,7 +660,7 @@ func TestDriveUploadUsesMetaURLForExplorerParent(t *testing.T) {
 }
 
 func TestDriveUploadUsesMetaURLForWikiParent(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-wiki-meta-url", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -708,7 +708,7 @@ func TestDriveUploadUsesMetaURLForWikiParent(t *testing.T) {
 }
 
 func TestDriveUploadSmallFileAPIError(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-small-err", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -744,7 +744,7 @@ func TestDriveUploadSmallFileAPIError(t *testing.T) {
 }
 
 func TestDriveUploadSmallFileNoToken(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-small-notoken", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -781,7 +781,7 @@ func TestDriveUploadSmallFileNoToken(t *testing.T) {
 }
 
 func TestDriveUploadSmallFileInvalidJSON(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-small-json", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -815,7 +815,7 @@ func TestDriveUploadSmallFileInvalidJSON(t *testing.T) {
 }
 
 func TestDriveUploadPrepareInvalidResponse(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-prepare-bad", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -861,7 +861,7 @@ func TestDriveUploadPrepareInvalidResponse(t *testing.T) {
 }
 
 func TestDriveUploadPartAPIError(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-part-err", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -923,7 +923,7 @@ func TestDriveUploadPartAPIError(t *testing.T) {
 }
 
 func TestDriveUploadPartInvalidJSON(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-part-json", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -975,7 +975,7 @@ func TestDriveUploadPartInvalidJSON(t *testing.T) {
 }
 
 func TestDriveUploadFinishNoToken(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-finish-notoken", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
@@ -1036,7 +1036,7 @@ func TestDriveUploadFinishNoToken(t *testing.T) {
 }
 
 func TestDriveUploadWithCustomName(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
+	uploadTestConfig := &configpkg.CliConfig{
 		AppID: "drive-upload-name-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
diff --git a/shortcuts/drive/drive_permission_grant_test.go b/shortcuts/drive/drive_permission_grant_test.go
index 88c9f134ee..0fdbd7f7b3 100644
--- a/shortcuts/drive/drive_permission_grant_test.go
+++ b/shortcuts/drive/drive_permission_grant_test.go
@@ -12,7 +12,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -245,12 +245,12 @@ func TestDriveUploadUserSkipsPermissionGrantAugmentation(t *testing.T) {
 	}
 }
 
-func drivePermissionGrantTestConfig(t *testing.T, userOpenID string) *core.CliConfig {
+func drivePermissionGrantTestConfig(t *testing.T, userOpenID string) *configpkg.CliConfig {
 	t.Helper()
 
 	replacer := strings.NewReplacer("/", "-", " ", "-")
 	suffix := replacer.Replace(strings.ToLower(t.Name()))
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:      "drive-permission-test-" + suffix,
 		AppSecret:  "drive-permission-secret-" + suffix,
 		Brand:      brand.Feishu,
diff --git a/shortcuts/drive/drive_push_test.go b/shortcuts/drive/drive_push_test.go
index ce5e3f8f9d..f44c760808 100644
--- a/shortcuts/drive/drive_push_test.go
+++ b/shortcuts/drive/drive_push_test.go
@@ -20,7 +20,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -1464,7 +1464,7 @@ func TestDrivePushDetectsLocalFileChangedBeforeUpload(t *testing.T) {
 		t.Fatalf("upload_all was called after local snapshot changed:\n%s", stdout.String())
 	}
 
-	problemErr := drivePushVerifyLocalSnapshot(common.TestNewRuntimeContext(&cobra.Command{Use: "drive +push"}, &core.CliConfig{}), drivePushLocalFile{
+	problemErr := drivePushVerifyLocalSnapshot(common.TestNewRuntimeContext(&cobra.Command{Use: "drive +push"}, &configpkg.CliConfig{}), drivePushLocalFile{
 		RelPath:  "missing.txt",
 		OpenPath: filepath.Join("local", "missing.txt"),
 		FileName: "missing.txt",
@@ -2100,7 +2100,7 @@ func TestDrivePushMirrorsEmptyDirectories(t *testing.T) {
 // tests (mirrors the existing TestDriveUploadLargeFileUsesMultipart
 // pattern).
 func TestDrivePushUploadsLargeFileViaMultipart(t *testing.T) {
-	pushTestConfig := &core.CliConfig{
+	pushTestConfig := &configpkg.CliConfig{
 		AppID: "drive-push-multipart-test", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, pushTestConfig)
diff --git a/shortcuts/drive/drive_sync_test.go b/shortcuts/drive/drive_sync_test.go
index 90f1436693..1080514b90 100644
--- a/shortcuts/drive/drive_sync_test.go
+++ b/shortcuts/drive/drive_sync_test.go
@@ -22,7 +22,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
@@ -192,7 +192,7 @@ func (r *driveSyncReadThenError) Read(p []byte) (int, error) {
 // and modified files use --on-conflict=remote-wins (the default) to pull the
 // remote version.
 func TestDriveSyncRemoteWinsPullsNewRemoteAndPushesNewLocal(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-remote-wins", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -313,7 +313,7 @@ func TestDriveSyncRemoteWinsPullsNewRemoteAndPushesNewLocal(t *testing.T) {
 }
 
 func TestDriveSyncAbortsAfterNewRemoteDownloadForbidden(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-forbidden", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -380,7 +380,7 @@ func TestDriveSyncAbortsAfterNewRemoteDownloadForbidden(t *testing.T) {
 // TestDriveSyncLocalWinsPushesOverRemote verifies that --on-conflict=local-wins
 // pushes the local version over the remote file.
 func TestDriveSyncLocalWinsPushesOverRemote(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-local-wins", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -455,7 +455,7 @@ func TestDriveSyncLocalWinsPushesOverRemote(t *testing.T) {
 // --on-conflict=keep-both renames the local file with a hash suffix
 // and then downloads the remote version to the original path.
 func TestDriveSyncKeepBothRenamesLocalAndPullsRemote(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-keep-both", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -557,7 +557,7 @@ func TestDriveSyncKeepBothRenamesLocalAndPullsRemote(t *testing.T) {
 // restores the original local path if the remote download fails after the
 // local file has been renamed.
 func TestDriveSyncKeepBothRollsBackRenameOnPullFailure(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-keep-both-rollback", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -627,7 +627,7 @@ func TestDriveSyncKeepBothRollsBackRenameOnPullFailure(t *testing.T) {
 // --on-conflict=ask fails before any sync writes start when stdin is not
 // available and the diff contains modified entries.
 func TestDriveSyncAskConflictFailsBeforeWritesWithoutStdin(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-ask-eof", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -721,7 +721,7 @@ func TestDriveSyncFailsOnDuplicateRemoteFiles(t *testing.T) {
 // TestDriveSyncUsesResolvedDuplicateTargetForDiff verifies that +sync computes
 // the diff against the same duplicate-remote selection used during execution.
 func TestDriveSyncUsesResolvedDuplicateTargetForDiff(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-duplicate-resolution", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -784,7 +784,7 @@ func TestDriveSyncUsesResolvedDuplicateTargetForDiff(t *testing.T) {
 // TestDriveSyncLocalWinsNestedFileUsesParentFolderToken verifies that local-wins
 // overwrites on nested files keep parent_node aligned with the file's parent.
 func TestDriveSyncLocalWinsNestedFileUsesParentFolderToken(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-local-wins-nested", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -871,7 +871,7 @@ func TestDriveSyncLocalWinsNestedFileUsesParentFolderToken(t *testing.T) {
 // during diff but removed before the push phase are surfaced as skipped items
 // instead of being silently dropped.
 func TestDriveSyncNewLocalDisappearanceIsReported(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-new-local-disappeared", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -924,7 +924,7 @@ func TestDriveSyncNewLocalDisappearanceIsReported(t *testing.T) {
 // TestDriveSyncQuickModeUsesModifiedTime verifies that --quick mode
 // classifies files by modified_time instead of SHA-256 hash.
 func TestDriveSyncQuickModeUsesModifiedTime(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-quick", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -1011,7 +1011,7 @@ func TestDriveSyncQuickModeUsesModifiedTime(t *testing.T) {
 // nature of --quick: a timestamp mismatch alone is enough to drive a real sync
 // action even when the file bytes are already identical.
 func TestDriveSyncQuickModeMTimeMismatchStillTriggersWrites(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-quick-mismatch", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -1074,7 +1074,7 @@ func TestDriveSyncQuickModeMTimeMismatchStillTriggersWrites(t *testing.T) {
 // TestDriveSyncNoChangesReportsEmptyItems verifies that when local and remote
 // are identical, +sync reports zero pulled/pushed items.
 func TestDriveSyncNoChangesReportsEmptyItems(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-no-changes", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -1455,7 +1455,7 @@ func TestDriveSyncRollbackRenamedLocalSurfacesStatFailure(t *testing.T) {
 }
 
 func TestDriveSyncAskConflictEOFDuringExecuteReportsFailedItem(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-ask-exec-eof", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -1521,7 +1521,7 @@ func TestDriveSyncAskConflictEOFDuringExecuteReportsFailedItem(t *testing.T) {
 }
 
 func TestDriveSyncAskConflictEOFDuringPlanningPreventsAnyWrites(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-ask-plan-eof", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -1619,7 +1619,7 @@ func TestDriveSyncDryRunQuickAcceptsMetadataOnlyScope(t *testing.T) {
 }
 
 func TestDriveSyncPreflightsActionScopesBeforeListing(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-download-scope-only", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, _ := cmdutil.TestFactory(t, syncTestConfig)
@@ -1669,7 +1669,7 @@ func TestDriveSyncPreflightsActionScopesBeforeListing(t *testing.T) {
 }
 
 func TestDriveSyncAskConflictSkipReportsSkippedItem(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-ask-skip", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -1725,7 +1725,7 @@ func TestDriveSyncAskConflictSkipReportsSkippedItem(t *testing.T) {
 }
 
 func TestDriveSyncReportsNewRemoteDownloadFailure(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-new-remote-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -1776,7 +1776,7 @@ func TestDriveSyncReportsNewRemoteDownloadFailure(t *testing.T) {
 }
 
 func TestDriveSyncReportsNewLocalEnsureFailure(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-new-local-ensure-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -1824,7 +1824,7 @@ func TestDriveSyncReportsNewLocalEnsureFailure(t *testing.T) {
 }
 
 func TestDriveSyncReportsNewLocalUploadFailure(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-new-local-upload-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -1872,7 +1872,7 @@ func TestDriveSyncReportsNewLocalUploadFailure(t *testing.T) {
 }
 
 func TestDriveSyncLocalWinsReportsUploadFailure(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-local-wins-upload-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -1933,7 +1933,7 @@ func TestDriveSyncLocalWinsReportsUploadFailure(t *testing.T) {
 }
 
 func TestDriveSyncKeepBothReportsRenameFailure(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-keep-both-rename-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -2263,7 +2263,7 @@ func TestDriveSyncExecuteUnknownConflictStrategySkipsModifiedFile(t *testing.T)
 }
 
 func TestDriveSyncModifiedFileDisappearingBeforeExecuteIsSkipped(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-modified-disappears", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -2323,7 +2323,7 @@ func TestDriveSyncModifiedFileDisappearingBeforeExecuteIsSkipped(t *testing.T) {
 }
 
 func TestDriveSyncRemoteWinsReportsModifiedPullFailure(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-remote-wins-pull-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -2378,7 +2378,7 @@ func TestDriveSyncRemoteWinsReportsModifiedPullFailure(t *testing.T) {
 }
 
 func TestDriveSyncKeepBothReportsRollbackFailureAfterPullError(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-keep-both-rollback-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -2468,7 +2468,7 @@ func TestDriveSyncStatusRemoteFilesUsesStableTokens(t *testing.T) {
 }
 
 func TestDriveSyncLocalWinsNestedFileReportsParentEnsureFailure(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-local-wins-parent-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -2532,7 +2532,7 @@ func TestDriveSyncLocalWinsNestedFileReportsParentEnsureFailure(t *testing.T) {
 // whose rel_path is not in pullRemoteFiles (non-file types like docx,
 // shortcuts) are silently skipped rather than causing a panic or error.
 func TestDriveSyncSkipsNonFileRemoteEntries(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-skip-nonfile", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -2699,7 +2699,7 @@ func TestDriveSyncKeepBothReportsSuffixError(t *testing.T) {
 // file has been renamed, the rollback restores the original file and
 // the failure is reported via the partial-failure signal.
 func TestDriveSyncKeepBothRollbackSucceedsOnPullFailure(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-keep-both-rollback-pull-fail", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -2775,7 +2775,7 @@ func TestDriveSyncKeepBothRollbackSucceedsOnPullFailure(t *testing.T) {
 // when remoteFile.FileToken is empty in the local-wins branch, the code
 // falls back to remoteEntriesForPush to find the existing token.
 func TestDriveSyncLocalWinsFallbackToRemoteEntriesForPush(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-local-wins-fallback", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -2852,7 +2852,7 @@ func TestDriveSyncLocalWinsFallbackToRemoteEntriesForPush(t *testing.T) {
 // TestDriveSyncCreatesEmptyLocalDirectoriesOnDrive verifies that empty local
 // directories are created on Drive during +sync, mirroring +push behavior.
 func TestDriveSyncCreatesEmptyLocalDirectoriesOnDrive(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-empty-dirs", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -2910,7 +2910,7 @@ func TestDriveSyncCreatesEmptyLocalDirectoriesOnDrive(t *testing.T) {
 // file_token returned alongside error), the reported item uses the
 // freshly returned token rather than the stale existingToken.
 func TestDriveSyncLocalWinsUsesReturnedTokenOnUploadFailure(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-local-wins-partial-token", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -2984,7 +2984,7 @@ func TestDriveSyncLocalWinsUsesReturnedTokenOnUploadFailure(t *testing.T) {
 // docx, shortcut, etc.) instead of silently attempting to upload and leaving
 // the remote in a broken mixed-type state.
 func TestDriveSyncRejectsPathTypeConflict(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-type-conflict", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
@@ -3035,7 +3035,7 @@ func TestDriveSyncRejectsPathTypeConflict(t *testing.T) {
 // which would otherwise attempt create_folder and leave the remote in a
 // broken mixed-type state.
 func TestDriveSyncRejectsLocalDirVsRemoteFileTypeConflict(t *testing.T) {
-	syncTestConfig := &core.CliConfig{
+	syncTestConfig := &configpkg.CliConfig{
 		AppID: "drive-sync-dir-vs-file-conflict", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 	f, stdout, _, reg := cmdutil.TestFactory(t, syncTestConfig)
diff --git a/shortcuts/event/processor_test.go b/shortcuts/event/processor_test.go
index 0c25fa96b7..2f62511390 100644
--- a/shortcuts/event/processor_test.go
+++ b/shortcuts/event/processor_test.go
@@ -19,7 +19,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/lockfile"
 	"github.com/larksuite/cli/shortcuts/common"
 	larkevent "github.com/larksuite/oapi-sdk-go/v3/event"
@@ -122,7 +122,7 @@ func newSubscribeTestRuntime(t *testing.T) *common.RuntimeContext {
 
 	return &common.RuntimeContext{
 		Cmd: cmd,
-		Config: &core.CliConfig{
+		Config: &configpkg.CliConfig{
 			AppID:     "cli_event_test",
 			AppSecret: "secret",
 			Brand:     brand.Feishu,
diff --git a/shortcuts/im/convert_lib/content_media_misc_test.go b/shortcuts/im/convert_lib/content_media_misc_test.go
index 9b2e493883..2660ddf7f8 100644
--- a/shortcuts/im/convert_lib/content_media_misc_test.go
+++ b/shortcuts/im/convert_lib/content_media_misc_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/brand"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -164,7 +164,7 @@ func TestResolveAppLinkDomain(t *testing.T) {
 }
 
 func TestFormatMessageItem_MessageAppLink_PassThrough(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Feishu}}
+	runtime := &common.RuntimeContext{Config: &configpkg.CliConfig{Brand: brand.Feishu}}
 	raw := map[string]interface{}{
 		"msg_type":         "text",
 		"message_id":       "om_123",
@@ -182,7 +182,7 @@ func TestFormatMessageItem_MessageAppLink_PassThrough(t *testing.T) {
 }
 
 func TestFormatMessageItem_MessageAppLink_AssembleChat(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Feishu}}
+	runtime := &common.RuntimeContext{Config: &configpkg.CliConfig{Brand: brand.Feishu}}
 	raw := map[string]interface{}{
 		"msg_type":         "text",
 		"message_id":       "om_123",
@@ -200,7 +200,7 @@ func TestFormatMessageItem_MessageAppLink_AssembleChat(t *testing.T) {
 }
 
 func TestFormatMessageItem_MessageAppLink_AssembleThread(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Lark}}
+	runtime := &common.RuntimeContext{Config: &configpkg.CliConfig{Brand: brand.Lark}}
 	raw := map[string]interface{}{
 		"msg_type":                "text",
 		"message_id":              "om_123",
@@ -223,7 +223,7 @@ func TestFormatMessageItem_MessageAppLink_AssembleThread(t *testing.T) {
 }
 
 func TestFormatMessageItem_MessageAppLink_FallbackToChatWhenThreadPositionInvalid(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Feishu}}
+	runtime := &common.RuntimeContext{Config: &configpkg.CliConfig{Brand: brand.Feishu}}
 	raw := map[string]interface{}{
 		"msg_type":                "text",
 		"message_id":              "om_123",
@@ -243,7 +243,7 @@ func TestFormatMessageItem_MessageAppLink_FallbackToChatWhenThreadPositionInvali
 }
 
 func TestFormatMessageItem_MessageAppLink_BrandUnknownDefaultsToFeishu(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Brand("other")}}
+	runtime := &common.RuntimeContext{Config: &configpkg.CliConfig{Brand: brand.Brand("other")}}
 	raw := map[string]interface{}{
 		"msg_type":         "text",
 		"message_id":       "om_123",
@@ -380,7 +380,7 @@ func TestAssembleMessageAppLink_EncodesQueryValues(t *testing.T) {
 }
 
 func TestFormatMessageItem_MessageAppLink_NonStringDoesNotLeakNull(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Feishu}}
+	runtime := &common.RuntimeContext{Config: &configpkg.CliConfig{Brand: brand.Feishu}}
 	raw := map[string]interface{}{
 		"msg_type":         "text",
 		"message_id":       "om_123",
@@ -416,7 +416,7 @@ func TestFormatMessageItem_MessageAppLink_RuntimeNilNoAssemble(t *testing.T) {
 }
 
 func TestFormatMessageItem_MessageAppLink_MissingFieldsNoPanic(t *testing.T) {
-	runtime := &common.RuntimeContext{Config: &core.CliConfig{Brand: brand.Feishu}}
+	runtime := &common.RuntimeContext{Config: &configpkg.CliConfig{Brand: brand.Feishu}}
 	raw := map[string]interface{}{
 		"msg_type":    "text",
 		"message_id":  "om_123",
diff --git a/shortcuts/im/convert_lib/runtime_test.go b/shortcuts/im/convert_lib/runtime_test.go
index ec7cde71e3..59e1630b62 100644
--- a/shortcuts/im/convert_lib/runtime_test.go
+++ b/shortcuts/im/convert_lib/runtime_test.go
@@ -15,7 +15,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -65,7 +65,7 @@ func newBotConvertlibRuntime(t *testing.T, rt http.RoundTripper) *common.Runtime
 		lark.WithLogLevel(larkcore.LogLevelError),
 		lark.WithHttpClient(httpClient),
 	)
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:     "test-app",
 		AppSecret: "test-secret",
 		Brand:     brand.Feishu,
@@ -74,7 +74,7 @@ func newBotConvertlibRuntime(t *testing.T, rt http.RoundTripper) *common.Runtime
 	runtime := &common.RuntimeContext{
 		Config: cfg,
 		Factory: &cmdutil.Factory{
-			Config:     func() (*core.CliConfig, error) { return cfg, nil },
+			Config:     func() (*configpkg.CliConfig, error) { return cfg, nil },
 			HttpClient: func() (*http.Client, error) { return httpClient, nil },
 			LarkClient: func() (*lark.Client, error) { return sdk, nil },
 			Credential: testCred,
diff --git a/shortcuts/im/helpers_network_test.go b/shortcuts/im/helpers_network_test.go
index d41730fab6..e128b0b32e 100644
--- a/shortcuts/im/helpers_network_test.go
+++ b/shortcuts/im/helpers_network_test.go
@@ -27,7 +27,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -87,7 +87,7 @@ func newBotShortcutRuntime(t *testing.T, rt http.RoundTripper) *common.RuntimeCo
 		lark.WithLogLevel(larkcore.LogLevelError),
 		lark.WithHttpClient(httpClient),
 	)
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:     "test-app",
 		AppSecret: "test-secret",
 		Brand:     brand.Feishu,
@@ -96,7 +96,7 @@ func newBotShortcutRuntime(t *testing.T, rt http.RoundTripper) *common.RuntimeCo
 	runtime := &common.RuntimeContext{
 		Config: cfg,
 		Factory: &cmdutil.Factory{
-			Config:         func() (*core.CliConfig, error) { return cfg, nil },
+			Config:         func() (*configpkg.CliConfig, error) { return cfg, nil },
 			HttpClient:     func() (*http.Client, error) { return httpClient, nil },
 			LarkClient:     func() (*lark.Client, error) { return sdk, nil },
 			Credential:     testCred,
diff --git a/shortcuts/im/im_feed_shortcut_test.go b/shortcuts/im/im_feed_shortcut_test.go
index fc597810c6..f5fe6f2dfb 100644
--- a/shortcuts/im/im_feed_shortcut_test.go
+++ b/shortcuts/im/im_feed_shortcut_test.go
@@ -16,7 +16,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
@@ -568,7 +568,7 @@ func TestImFeedShortcutListDryRunIncludesNonEmptyPageToken(t *testing.T) {
 }
 
 func TestImFeedShortcutListHelpDoesNotTreatDetailAsArgName(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{
 		AppID: "app", AppSecret: "secret", Brand: brand.Feishu,
 	})
 	parent := &cobra.Command{Use: "im"}
diff --git a/shortcuts/mail/draft/service_test.go b/shortcuts/mail/draft/service_test.go
index 7ddcfb1521..b1d58e74d0 100644
--- a/shortcuts/mail/draft/service_test.go
+++ b/shortcuts/mail/draft/service_test.go
@@ -14,7 +14,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -24,7 +24,7 @@ func draftServiceTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Re
 	keyring.MockInit()
 	t.Setenv("HOME", t.TempDir())
 
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:      "test-app",
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/shortcuts/mail/large_attachment_test.go b/shortcuts/mail/large_attachment_test.go
index 9d36bf40df..e59b02bf0e 100644
--- a/shortcuts/mail/large_attachment_test.go
+++ b/shortcuts/mail/large_attachment_test.go
@@ -13,7 +13,7 @@ import (
 	"github.com/spf13/cobra"
 
 	brandpkg "github.com/larksuite/cli/brand"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/vfs/localfileio"
 	"github.com/larksuite/cli/shortcuts/common"
 	draftpkg "github.com/larksuite/cli/shortcuts/mail/draft"
@@ -304,7 +304,7 @@ func TestEnsureLargeAttachmentCards_InjectsMissingCards(t *testing.T) {
 			Body:      []byte("<p>Hello</p>"),
 		},
 	}
-	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: brandpkg.Feishu})
+	rt := common.TestNewRuntimeContext(&cobra.Command{}, &configpkg.CliConfig{Brand: brandpkg.Feishu})
 	ensureLargeAttachmentCards(rt, snapshot)
 
 	html := string(snapshot.Body.Body)
@@ -345,7 +345,7 @@ func TestEnsureLargeAttachmentCards_NoDuplicateWhenCardExists(t *testing.T) {
 			Body:      []byte("<p>Hello</p>" + existingCard),
 		},
 	}
-	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: brandpkg.Feishu})
+	rt := common.TestNewRuntimeContext(&cobra.Command{}, &configpkg.CliConfig{Brand: brandpkg.Feishu})
 	originalHTML := string(snapshot.Body.Body)
 	ensureLargeAttachmentCards(rt, snapshot)
 
@@ -374,7 +374,7 @@ func TestEnsureLargeAttachmentCards_PartialMissing(t *testing.T) {
 			Body:      []byte("<p>Hello</p>" + existingCard),
 		},
 	}
-	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: brandpkg.Feishu})
+	rt := common.TestNewRuntimeContext(&cobra.Command{}, &configpkg.CliConfig{Brand: brandpkg.Feishu})
 	ensureLargeAttachmentCards(rt, snapshot)
 
 	html := string(snapshot.Body.Body)
@@ -426,7 +426,7 @@ func TestEnsureLargeAttachmentCards_PlainTextBodyInjectsDownloadInfo(t *testing.
 			Body:      []byte("plain text body"),
 		},
 	}
-	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: brandpkg.Feishu})
+	rt := common.TestNewRuntimeContext(&cobra.Command{}, &configpkg.CliConfig{Brand: brandpkg.Feishu})
 	ensureLargeAttachmentCards(rt, snapshot)
 
 	body := string(snapshot.Body.Body)
@@ -458,7 +458,7 @@ func TestEnsureLargeAttachmentCards_PlainTextNoDuplicate(t *testing.T) {
 			Body:      []byte(bodyWithToken),
 		},
 	}
-	rt := common.TestNewRuntimeContext(&cobra.Command{}, &core.CliConfig{Brand: brandpkg.Feishu})
+	rt := common.TestNewRuntimeContext(&cobra.Command{}, &configpkg.CliConfig{Brand: brandpkg.Feishu})
 	ensureLargeAttachmentCards(rt, snapshot)
 
 	if string(snapshot.Body.Body) != bodyWithToken {
diff --git a/shortcuts/mail/mail_shortcut_test.go b/shortcuts/mail/mail_shortcut_test.go
index 081e8f2543..ed6c676720 100644
--- a/shortcuts/mail/mail_shortcut_test.go
+++ b/shortcuts/mail/mail_shortcut_test.go
@@ -17,13 +17,13 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
-func mailTestConfig() *core.CliConfig {
-	return &core.CliConfig{
+func mailTestConfig() *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID:      "test-app",
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/shortcuts/mail/mail_signature_lang_test.go b/shortcuts/mail/mail_signature_lang_test.go
index 822c9ccd50..94d3c6ba55 100644
--- a/shortcuts/mail/mail_signature_lang_test.go
+++ b/shortcuts/mail/mail_signature_lang_test.go
@@ -6,7 +6,7 @@ package mail
 import (
 	"testing"
 
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -26,7 +26,7 @@ func TestResolveLang(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			rt := &common.RuntimeContext{Config: &core.CliConfig{Lang: tt.stored}}
+			rt := &common.RuntimeContext{Config: &configpkg.CliConfig{Lang: tt.stored}}
 			if got := resolveLang(rt); got != tt.want {
 				t.Errorf("resolveLang(stored=%q) = %q, want %q", tt.stored, got, tt.want)
 			}
diff --git a/shortcuts/mail/mail_watch_test.go b/shortcuts/mail/mail_watch_test.go
index 6eda8191e3..1c3868360e 100644
--- a/shortcuts/mail/mail_watch_test.go
+++ b/shortcuts/mail/mail_watch_test.go
@@ -19,7 +19,7 @@ import (
 	"time"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/vfs"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
@@ -865,7 +865,7 @@ func runtimeForMailWatchTest(t *testing.T, values map[string]string) *common.Run
 	}
 	return &common.RuntimeContext{
 		Cmd:    cmd,
-		Config: &core.CliConfig{AppID: "cli_test_app"},
+		Config: &configpkg.CliConfig{AppID: "cli_test_app"},
 	}
 }
 
diff --git a/shortcuts/mail/signature_compose_test.go b/shortcuts/mail/signature_compose_test.go
index 2633d44052..b97998d8da 100644
--- a/shortcuts/mail/signature_compose_test.go
+++ b/shortcuts/mail/signature_compose_test.go
@@ -14,7 +14,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -187,7 +187,7 @@ func TestAddSignatureImagesToBuilderWithImages(t *testing.T) {
 // tests that exercise signature API code paths (autoResolveSignatureID, resolveSignature).
 func newSigTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Registry) {
 	t.Helper()
-	cfg := &core.CliConfig{Brand: brand.Feishu, AppID: "cli_sigtest"}
+	cfg := &configpkg.CliConfig{Brand: brand.Feishu, AppID: "cli_sigtest"}
 	f, _, _, reg := cmdutil.TestFactory(t, cfg)
 	rt := common.TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+test"}, cfg, f, identity.AsUser)
 	return rt, reg
diff --git a/shortcuts/markdown/markdown_test.go b/shortcuts/markdown/markdown_test.go
index 74ea096768..b4e9c846e0 100644
--- a/shortcuts/markdown/markdown_test.go
+++ b/shortcuts/markdown/markdown_test.go
@@ -25,20 +25,20 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
-func markdownTestConfig() *core.CliConfig {
-	return &core.CliConfig{
+func markdownTestConfig() *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID: "markdown-test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 }
 
-func markdownPermissionTestConfig(userOpenID string) *core.CliConfig {
-	return &core.CliConfig{
+func markdownPermissionTestConfig(userOpenID string) *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID: "markdown-perm-test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		UserOpenId: userOpenID,
 	}
diff --git a/shortcuts/minutes/minutes_download_test.go b/shortcuts/minutes/minutes_download_test.go
index c144d377ec..dff06869c1 100644
--- a/shortcuts/minutes/minutes_download_test.go
+++ b/shortcuts/minutes/minutes_download_test.go
@@ -19,7 +19,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -71,8 +71,8 @@ func mountAndRun(t *testing.T, s common.Shortcut, args []string, f *cmdutil.Fact
 	return parent.Execute()
 }
 
-func defaultConfig() *core.CliConfig {
-	return &core.CliConfig{
+func defaultConfig() *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		UserOpenId: "ou_testuser",
 	}
diff --git a/shortcuts/minutes/minutes_search_test.go b/shortcuts/minutes/minutes_search_test.go
index 63b337504f..0ff59e5f09 100644
--- a/shortcuts/minutes/minutes_search_test.go
+++ b/shortcuts/minutes/minutes_search_test.go
@@ -12,7 +12,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
@@ -32,7 +32,7 @@ func newMinutesSearchTestCommand() *cobra.Command {
 }
 
 // configWithoutUserOpenID returns a test config without a resolvable user open_id.
-func configWithoutUserOpenID() *core.CliConfig {
+func configWithoutUserOpenID() *configpkg.CliConfig {
 	cfg := defaultConfig()
 	cfg.UserOpenId = ""
 	return cfg
diff --git a/shortcuts/note/note_transcript_test.go b/shortcuts/note/note_transcript_test.go
index eec65d5f36..1aa7455b98 100644
--- a/shortcuts/note/note_transcript_test.go
+++ b/shortcuts/note/note_transcript_test.go
@@ -16,7 +16,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
@@ -165,7 +165,7 @@ func TestNoteTranscriptPassesLocaleThrough(t *testing.T) {
 }
 
 func TestNoteTranscriptDefaultsLocaleFromLarkBrand(t *testing.T) {
-	config := &core.CliConfig{
+	config := &configpkg.CliConfig{
 		AppID:      "test-app-lark-locale",
 		AppSecret:  "test-secret",
 		Brand:      brand.Lark,
@@ -380,7 +380,7 @@ func TestTranscriptContextErrorPreservesCause(t *testing.T) {
 
 func noteShortcutTestFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer, *httpmock.Registry) {
 	t.Helper()
-	config := &core.CliConfig{
+	config := &configpkg.CliConfig{
 		AppID:      "test-app-" + strings.ReplaceAll(strings.ToLower(t.Name()), "/", "-"),
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
@@ -389,7 +389,7 @@ func noteShortcutTestFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *by
 	return noteShortcutTestFactoryWithConfig(t, config)
 }
 
-func noteShortcutTestFactoryWithConfig(t *testing.T, config *core.CliConfig) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer, *httpmock.Registry) {
+func noteShortcutTestFactoryWithConfig(t *testing.T, config *configpkg.CliConfig) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer, *httpmock.Registry) {
 	t.Helper()
 	return cmdutil.TestFactory(t, config)
 }
diff --git a/shortcuts/okr/okr_batch_create_test.go b/shortcuts/okr/okr_batch_create_test.go
index a005df9888..759326cb74 100644
--- a/shortcuts/okr/okr_batch_create_test.go
+++ b/shortcuts/okr/okr_batch_create_test.go
@@ -14,15 +14,15 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/spf13/cobra"
 	"github.com/tidwall/gjson"
 )
 
-func batchCreateTestConfig(t *testing.T) *core.CliConfig {
+func batchCreateTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-okr-batch-create",
 		AppSecret: "secret-okr-batch-create",
 		Brand:     brand.Feishu,
diff --git a/shortcuts/okr/okr_create_test.go b/shortcuts/okr/okr_create_test.go
index 4b114ee27c..5753a8c02f 100644
--- a/shortcuts/okr/okr_create_test.go
+++ b/shortcuts/okr/okr_create_test.go
@@ -12,15 +12,15 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/spf13/cobra"
 	"github.com/tidwall/gjson"
 )
 
-func createTestConfig(t *testing.T) *core.CliConfig {
+func createTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-okr-create",
 		AppSecret: patchTestValue(),
 		Brand:     brand.Feishu,
diff --git a/shortcuts/okr/okr_cycle_detail_test.go b/shortcuts/okr/okr_cycle_detail_test.go
index e65baf8015..ccc3444528 100644
--- a/shortcuts/okr/okr_cycle_detail_test.go
+++ b/shortcuts/okr/okr_cycle_detail_test.go
@@ -15,17 +15,17 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
 // --- helpers ---
 
-func cycleDetailTestConfig(t *testing.T) *core.CliConfig {
+func cycleDetailTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
 	replacer := strings.NewReplacer("/", "-", " ", "-")
 	suffix := replacer.Replace(strings.ToLower(t.Name()))
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-okr-detail-" + suffix,
 		AppSecret: "secret-okr-detail-" + suffix,
 		Brand:     brand.Feishu,
diff --git a/shortcuts/okr/okr_cycle_list_test.go b/shortcuts/okr/okr_cycle_list_test.go
index 496fca1faf..d5f096764a 100644
--- a/shortcuts/okr/okr_cycle_list_test.go
+++ b/shortcuts/okr/okr_cycle_list_test.go
@@ -17,17 +17,17 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
 // --- helpers ---
 
-func cycleListTestConfig(t *testing.T) *core.CliConfig {
+func cycleListTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
 	replacer := strings.NewReplacer("/", "-", " ", "-")
 	suffix := replacer.Replace(strings.ToLower(t.Name()))
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-okr-list-" + suffix,
 		AppSecret: "secret-okr-list-" + suffix,
 		Brand:     brand.Feishu,
diff --git a/shortcuts/okr/okr_image_upload_test.go b/shortcuts/okr/okr_image_upload_test.go
index a404ee1180..b2152f7bec 100644
--- a/shortcuts/okr/okr_image_upload_test.go
+++ b/shortcuts/okr/okr_image_upload_test.go
@@ -17,13 +17,13 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
-func uploadImageTestConfig(t *testing.T) *core.CliConfig {
+func uploadImageTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-okr-upload-image",
 		AppSecret: "secret-okr-upload-image",
 		Brand:     brand.Feishu,
diff --git a/shortcuts/okr/okr_indicator_update_test.go b/shortcuts/okr/okr_indicator_update_test.go
index 755b842193..a4248de8f5 100644
--- a/shortcuts/okr/okr_indicator_update_test.go
+++ b/shortcuts/okr/okr_indicator_update_test.go
@@ -13,14 +13,14 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/spf13/cobra"
 )
 
-func indicatorUpdateTestConfig(t *testing.T) *core.CliConfig {
+func indicatorUpdateTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-okr-indicator-update",
 		AppSecret: "secret-okr-indicator-update",
 		Brand:     brand.Feishu,
diff --git a/shortcuts/okr/okr_patch_test.go b/shortcuts/okr/okr_patch_test.go
index e956bdfc90..39bba585b2 100644
--- a/shortcuts/okr/okr_patch_test.go
+++ b/shortcuts/okr/okr_patch_test.go
@@ -13,14 +13,14 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/spf13/cobra"
 )
 
-func patchTestConfig(t *testing.T) *core.CliConfig {
+func patchTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "dummy",
 		AppSecret: patchTestValue(),
 		Brand:     brand.Feishu,
diff --git a/shortcuts/okr/okr_progress_create_test.go b/shortcuts/okr/okr_progress_create_test.go
index ff034fd81f..47eb66390b 100644
--- a/shortcuts/okr/okr_progress_create_test.go
+++ b/shortcuts/okr/okr_progress_create_test.go
@@ -14,13 +14,13 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
-func progressCreateTestConfig(t *testing.T) *core.CliConfig {
+func progressCreateTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-okr-progress-create",
 		AppSecret: "secret-okr-progress-create",
 		Brand:     brand.Feishu,
diff --git a/shortcuts/okr/okr_progress_delete_test.go b/shortcuts/okr/okr_progress_delete_test.go
index 3e92ec52b2..9a227c4203 100644
--- a/shortcuts/okr/okr_progress_delete_test.go
+++ b/shortcuts/okr/okr_progress_delete_test.go
@@ -12,13 +12,13 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
-func progressDeleteTestConfig(t *testing.T) *core.CliConfig {
+func progressDeleteTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-okr-progress-delete",
 		AppSecret: "secret-okr-progress-delete",
 		Brand:     brand.Feishu,
diff --git a/shortcuts/okr/okr_progress_get_test.go b/shortcuts/okr/okr_progress_get_test.go
index 719bda3575..89fe04548c 100644
--- a/shortcuts/okr/okr_progress_get_test.go
+++ b/shortcuts/okr/okr_progress_get_test.go
@@ -14,13 +14,13 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
-func progressGetTestConfig(t *testing.T) *core.CliConfig {
+func progressGetTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-okr-progress-get",
 		AppSecret: "secret-okr-progress-get",
 		Brand:     brand.Feishu,
diff --git a/shortcuts/okr/okr_progress_list_test.go b/shortcuts/okr/okr_progress_list_test.go
index 39f1120a30..0de5216cc6 100644
--- a/shortcuts/okr/okr_progress_list_test.go
+++ b/shortcuts/okr/okr_progress_list_test.go
@@ -15,13 +15,13 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
-func progressListTestConfig(t *testing.T) *core.CliConfig {
+func progressListTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-okr-progress-list",
 		AppSecret: "secret-okr-progress-list",
 		Brand:     brand.Feishu,
diff --git a/shortcuts/okr/okr_progress_update_test.go b/shortcuts/okr/okr_progress_update_test.go
index 048e7bb800..899ed9fb80 100644
--- a/shortcuts/okr/okr_progress_update_test.go
+++ b/shortcuts/okr/okr_progress_update_test.go
@@ -14,13 +14,13 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
-func progressUpdateTestConfig(t *testing.T) *core.CliConfig {
+func progressUpdateTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-okr-progress-update",
 		AppSecret: "secret-okr-progress-update",
 		Brand:     brand.Feishu,
diff --git a/shortcuts/okr/okr_reorder_test.go b/shortcuts/okr/okr_reorder_test.go
index 0276222d4a..681c1bc67d 100644
--- a/shortcuts/okr/okr_reorder_test.go
+++ b/shortcuts/okr/okr_reorder_test.go
@@ -13,7 +13,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/spf13/cobra"
 )
@@ -25,9 +25,9 @@ type testReorderItem struct {
 
 func (t testReorderItem) GetID() string { return t.id }
 
-func reorderTestConfig(t *testing.T) *core.CliConfig {
+func reorderTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-okr-reorder",
 		AppSecret: "secret-okr-reorder",
 		Brand:     brand.Feishu,
diff --git a/shortcuts/okr/okr_weight_test.go b/shortcuts/okr/okr_weight_test.go
index 716e74dd78..2a878bedd7 100644
--- a/shortcuts/okr/okr_weight_test.go
+++ b/shortcuts/okr/okr_weight_test.go
@@ -14,7 +14,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/spf13/cobra"
 )
@@ -32,10 +32,10 @@ func getWeightFloat(v interface{}) float64 {
 	}
 }
 
-func weightTestConfig(t *testing.T) *core.CliConfig {
+func weightTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:     "test-okr-weight",
 		AppSecret: "secret-okr-weight",
 		Brand:     brand.Feishu,
diff --git a/shortcuts/register_brand_guard_test.go b/shortcuts/register_brand_guard_test.go
index db286e21e9..b0177a271f 100644
--- a/shortcuts/register_brand_guard_test.go
+++ b/shortcuts/register_brand_guard_test.go
@@ -14,13 +14,13 @@ import (
 	brandpkg "github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 )
 
 func newFactoryWithBrand(brand brandpkg.Brand) *cmdutil.Factory {
 	return &cmdutil.Factory{
-		Config: func() (*core.CliConfig, error) {
-			return &core.CliConfig{Brand: brand}, nil
+		Config: func() (*configpkg.CliConfig, error) {
+			return &configpkg.CliConfig{Brand: brand}, nil
 		},
 	}
 }
diff --git a/shortcuts/register_test.go b/shortcuts/register_test.go
index a5688103ee..b44bd85f55 100644
--- a/shortcuts/register_test.go
+++ b/shortcuts/register_test.go
@@ -17,7 +17,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdmeta"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/deprecation"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
@@ -26,7 +26,7 @@ import (
 func newRegisterTestFactory(t *testing.T) *cmdutil.Factory {
 	t.Helper()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{})
+	f, _, _, _ := cmdutil.TestFactory(t, &configpkg.CliConfig{})
 	return f
 }
 
diff --git a/shortcuts/sheets/backward/lark_sheets_sheet_create_test.go b/shortcuts/sheets/backward/lark_sheets_sheet_create_test.go
index 21e12226b9..bdde382baa 100644
--- a/shortcuts/sheets/backward/lark_sheets_sheet_create_test.go
+++ b/shortcuts/sheets/backward/lark_sheets_sheet_create_test.go
@@ -14,7 +14,7 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -282,12 +282,12 @@ func TestSheetCreateTrimsPaddedBackendURL(t *testing.T) {
 	}
 }
 
-func sheetCreateTestConfig(t *testing.T, userOpenID string) *core.CliConfig {
+func sheetCreateTestConfig(t *testing.T, userOpenID string) *configpkg.CliConfig {
 	t.Helper()
 
 	replacer := strings.NewReplacer("/", "-", " ", "-")
 	suffix := replacer.Replace(strings.ToLower(t.Name()))
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:      "test-sheet-create-" + suffix,
 		AppSecret:  "secret-sheet-create-" + suffix,
 		Brand:      brand.Feishu,
diff --git a/shortcuts/sheets/backward/lark_sheets_sheet_write_image_test.go b/shortcuts/sheets/backward/lark_sheets_sheet_write_image_test.go
index 7d52afa912..aa8fffbb89 100644
--- a/shortcuts/sheets/backward/lark_sheets_sheet_write_image_test.go
+++ b/shortcuts/sheets/backward/lark_sheets_sheet_write_image_test.go
@@ -18,13 +18,13 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
-func sheetsTestConfig() *core.CliConfig {
-	return &core.CliConfig{
+func sheetsTestConfig() *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID: "sheets-test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 	}
 }
diff --git a/shortcuts/sheets/helpers_test.go b/shortcuts/sheets/helpers_test.go
index bc6c9624e8..7fc48de8f4 100644
--- a/shortcuts/sheets/helpers_test.go
+++ b/shortcuts/sheets/helpers_test.go
@@ -15,18 +15,18 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
 // testConfig returns a CliConfig wired with a stable user identity. Tests
 // keep the AppID test-prefixed so logs / metrics can spot them.
-func testConfig(t *testing.T) *core.CliConfig {
+func testConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
 	replacer := strings.NewReplacer("/", "-", " ", "-")
 	suffix := replacer.Replace(strings.ToLower(t.Name()))
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:      "test-sheets-" + suffix,
 		AppSecret:  "secret-sheets-" + suffix,
 		Brand:      brand.Feishu,
diff --git a/shortcuts/sheets/sheet_media_parent_type_test.go b/shortcuts/sheets/sheet_media_parent_type_test.go
index f1833b8830..b937e987ee 100644
--- a/shortcuts/sheets/sheet_media_parent_type_test.go
+++ b/shortcuts/sheets/sheet_media_parent_type_test.go
@@ -19,7 +19,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -149,7 +149,7 @@ func TestUploadSheetImage_FileOpenError(t *testing.T) {
 func newSheetMediaTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Registry) {
 	t.Helper()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	cfg := &core.CliConfig{
+	cfg := &configpkg.CliConfig{
 		AppID:     "test-sheets-media-" + t.Name(),
 		AppSecret: "test-secret",
 		Brand:     brand.Feishu,
diff --git a/shortcuts/slides/slides_create_test.go b/shortcuts/slides/slides_create_test.go
index 26c8aecb92..bf0f76644a 100644
--- a/shortcuts/slides/slides_create_test.go
+++ b/shortcuts/slides/slides_create_test.go
@@ -16,7 +16,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -759,11 +759,11 @@ func TestXmlEscape(t *testing.T) {
 }
 
 // slidesTestConfig returns a CliConfig for testing with the given user open ID.
-func slidesTestConfig(t *testing.T, userOpenID string) *core.CliConfig {
+func slidesTestConfig(t *testing.T, userOpenID string) *configpkg.CliConfig {
 	t.Helper()
 	replacer := strings.NewReplacer("/", "-", " ", "-")
 	suffix := replacer.Replace(strings.ToLower(t.Name()))
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:      "test-slides-create-" + suffix,
 		AppSecret:  "secret-slides-create-" + suffix,
 		Brand:      brand.Feishu,
diff --git a/shortcuts/task/task_shortcut_test.go b/shortcuts/task/task_shortcut_test.go
index 12b29769b9..e0233851fd 100644
--- a/shortcuts/task/task_shortcut_test.go
+++ b/shortcuts/task/task_shortcut_test.go
@@ -13,15 +13,15 @@ import (
 
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
-func taskTestConfig(t *testing.T) *core.CliConfig {
+func taskTestConfig(t *testing.T) *configpkg.CliConfig {
 	t.Helper()
 	suffix := strings.NewReplacer("/", "-", " ", "-", ":", "-", "\t", "-").Replace(t.Name())
-	return &core.CliConfig{
+	return &configpkg.CliConfig{
 		AppID:      "test-app-" + suffix,
 		AppSecret:  "test-secret-" + suffix,
 		Brand:      brand.Feishu,
diff --git a/shortcuts/vc/vc_notes_test.go b/shortcuts/vc/vc_notes_test.go
index 12c71ef058..634ba0a9c6 100644
--- a/shortcuts/vc/vc_notes_test.go
+++ b/shortcuts/vc/vc_notes_test.go
@@ -20,7 +20,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -73,8 +73,8 @@ func mountAndRun(t *testing.T, s common.Shortcut, args []string, f *cmdutil.Fact
 	return parent.Execute()
 }
 
-func defaultConfig() *core.CliConfig {
-	return &core.CliConfig{
+func defaultConfig() *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: brand.Feishu,
 		UserOpenId: "ou_testuser",
 	}
diff --git a/shortcuts/vc/vc_search_test.go b/shortcuts/vc/vc_search_test.go
index 11cf659949..76111bb071 100644
--- a/shortcuts/vc/vc_search_test.go
+++ b/shortcuts/vc/vc_search_test.go
@@ -15,7 +15,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -52,7 +52,7 @@ func TestUniqueIDs(t *testing.T) {
 }
 
 func TestParseTimeRange(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 	tests := []struct {
 		name    string
 		start   string
@@ -87,7 +87,7 @@ func TestParseTimeRange(t *testing.T) {
 }
 
 func TestBuildSearchBody(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 	cmd := &cobra.Command{Use: "test"}
 	cmd.Flags().String("query", "", "")
 	cmd.Flags().String("start", "", "")
@@ -121,7 +121,7 @@ func TestBuildSearchBody(t *testing.T) {
 }
 
 func TestBuildSearchBody_Empty(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 	cmd := &cobra.Command{Use: "test"}
 	cmd.Flags().String("query", "", "")
 	cmd.Flags().String("start", "", "")
@@ -318,7 +318,7 @@ func TestSearch_InvalidTimeRange(t *testing.T) {
 // ---------------------------------------------------------------------------
 
 func TestParseTimeRange_InvalidStart_TypedError(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 	cmd := &cobra.Command{Use: "test"}
 	cmd.Flags().String("start", "", "")
 	cmd.Flags().String("end", "", "")
@@ -345,7 +345,7 @@ func TestParseTimeRange_InvalidStart_TypedError(t *testing.T) {
 }
 
 func TestParseTimeRange_InvalidEnd_TypedError(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 	cmd := &cobra.Command{Use: "test"}
 	cmd.Flags().String("start", "", "")
 	cmd.Flags().String("end", "", "")
@@ -372,7 +372,7 @@ func TestParseTimeRange_InvalidEnd_TypedError(t *testing.T) {
 }
 
 func TestParseTimeRange_StartAfterEnd_TypedError(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 	cmd := &cobra.Command{Use: "test"}
 	cmd.Flags().String("start", "", "")
 	cmd.Flags().String("end", "", "")
@@ -443,7 +443,7 @@ func TestSearch_Validation_NoFilter_TypedError(t *testing.T) {
 }
 
 func TestBuildSearchParams(t *testing.T) {
-	cfg := &core.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
+	cfg := &configpkg.CliConfig{AppID: "test", AppSecret: "s", Brand: brand.Feishu}
 
 	t.Run("defaults", func(t *testing.T) {
 		cmd := &cobra.Command{Use: "test"}
diff --git a/shortcuts/whiteboard/whiteboard_export_test.go b/shortcuts/whiteboard/whiteboard_export_test.go
index c9d35c67bb..a50e00dab2 100644
--- a/shortcuts/whiteboard/whiteboard_export_test.go
+++ b/shortcuts/whiteboard/whiteboard_export_test.go
@@ -19,7 +19,7 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
@@ -696,7 +696,7 @@ func TestSaveOutputFile_InvalidFinalPathTypedError(t *testing.T) {
 
 func newExecuteFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *httpmock.Registry) {
 	t.Helper()
-	config := &core.CliConfig{
+	config := &configpkg.CliConfig{
 		AppID:      "test-app-" + strings.ReplaceAll(strings.ToLower(t.Name()), "/", "-"),
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/shortcuts/whiteboard/whiteboard_update_test.go b/shortcuts/whiteboard/whiteboard_update_test.go
index 2045b924be..fa35556a16 100644
--- a/shortcuts/whiteboard/whiteboard_update_test.go
+++ b/shortcuts/whiteboard/whiteboard_update_test.go
@@ -14,7 +14,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 	"github.com/spf13/cobra"
@@ -380,7 +380,7 @@ func TestWBUpdateDryRun(t *testing.T) {
 
 func newUpdateExecuteFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *httpmock.Registry) {
 	t.Helper()
-	config := &core.CliConfig{
+	config := &configpkg.CliConfig{
 		AppID:      "test-app-" + strings.ReplaceAll(strings.ToLower(t.Name()), "/", "-"),
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/shortcuts/wiki/wiki_move_test.go b/shortcuts/wiki/wiki_move_test.go
index 20883bcc1b..3aed7a1567 100644
--- a/shortcuts/wiki/wiki_move_test.go
+++ b/shortcuts/wiki/wiki_move_test.go
@@ -16,7 +16,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
@@ -107,7 +107,7 @@ type mockWikiMoveTokenResolver struct {
 }
 
 type wikiMoveAccountResolver struct {
-	cfg *core.CliConfig
+	cfg *configpkg.CliConfig
 }
 
 func (r *wikiMoveAccountResolver) ResolveAccount(ctx context.Context) (*credential.Account, error) {
diff --git a/shortcuts/wiki/wiki_node_create_test.go b/shortcuts/wiki/wiki_node_create_test.go
index 8affdb7400..0b983f161d 100644
--- a/shortcuts/wiki/wiki_node_create_test.go
+++ b/shortcuts/wiki/wiki_node_create_test.go
@@ -19,7 +19,7 @@ import (
 	"github.com/larksuite/cli/brand"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/identity"
@@ -101,16 +101,16 @@ func (fake *fakeWikiNodeCreateClient) CreateNode(ctx context.Context, spaceID st
 
 var wikiTestConfigSeq atomic.Int64
 
-func wikiTestConfig() *core.CliConfig {
-	return &core.CliConfig{
+func wikiTestConfig() *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID:     fmt.Sprintf("wiki-test-app-%d", wikiTestConfigSeq.Add(1)),
 		AppSecret: "test-secret",
 		Brand:     brand.Feishu,
 	}
 }
 
-func wikiPermissionTestConfig(userOpenID string) *core.CliConfig {
-	return &core.CliConfig{
+func wikiPermissionTestConfig(userOpenID string) *configpkg.CliConfig {
+	return &configpkg.CliConfig{
 		AppID:      fmt.Sprintf("wiki-permission-test-app-%d", wikiTestConfigSeq.Add(1)),
 		AppSecret:  "test-secret",
 		Brand:      brand.Feishu,
diff --git a/sidecar/server-demo/allowlist.go b/sidecar/server-demo/allowlist.go
index 9ad09e4701..497bb59728 100644
--- a/sidecar/server-demo/allowlist.go
+++ b/sidecar/server-demo/allowlist.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 
 	"github.com/larksuite/cli/brand"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/sidecar"
 )
 
@@ -29,7 +29,7 @@ func buildAllowedHosts(endpoints ...brand.Endpoints) map[string]bool {
 
 // buildAllowedIdentities returns the set of identities the sidecar is allowed to serve,
 // based on the trusted-side strict mode / SupportedIdentities configuration.
-func buildAllowedIdentities(cfg *core.CliConfig) map[string]bool {
+func buildAllowedIdentities(cfg *configpkg.CliConfig) map[string]bool {
 	ids := make(map[string]bool)
 	switch {
 	case cfg.SupportedIdentities == 0: // unknown/unset → allow both
diff --git a/sidecar/server-multi-tenant-demo/allowlist.go b/sidecar/server-multi-tenant-demo/allowlist.go
index fc83a8db1c..9c63ba9628 100644
--- a/sidecar/server-multi-tenant-demo/allowlist.go
+++ b/sidecar/server-multi-tenant-demo/allowlist.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 
 	"github.com/larksuite/cli/brand"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/sidecar"
 )
 
@@ -29,7 +29,7 @@ func buildAllowedHosts(endpoints ...brand.Endpoints) map[string]bool {
 
 // buildAllowedIdentities returns the set of identities the sidecar is allowed to serve,
 // based on the trusted-side strict mode / SupportedIdentities configuration.
-func buildAllowedIdentities(cfg *core.CliConfig) map[string]bool {
+func buildAllowedIdentities(cfg *configpkg.CliConfig) map[string]bool {
 	ids := make(map[string]bool)
 	switch {
 	case cfg.SupportedIdentities == 0: // unknown/unset → allow both
diff --git a/sidecar/server-multi-tenant-demo/auth_bridge.go b/sidecar/server-multi-tenant-demo/auth_bridge.go
index 7676611319..19aa63799c 100644
--- a/sidecar/server-multi-tenant-demo/auth_bridge.go
+++ b/sidecar/server-multi-tenant-demo/auth_bridge.go
@@ -25,7 +25,7 @@ import (
 
 	brandpkg "github.com/larksuite/cli/brand"
 	larkauth "github.com/larksuite/cli/internal/auth"
-	"github.com/larksuite/cli/internal/core"
+	configpkg "github.com/larksuite/cli/internal/config"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/vfs"
 )
@@ -331,7 +331,7 @@ func (ab *authBridge) handlePoll(w http.ResponseWriter, r *http.Request, body []
 func (ab *authBridge) handleStatus(w http.ResponseWriter, _ *http.Request, body []byte) {
 	clientID := parseClientID(body)
 
-	multi, err := core.LoadMultiAppConfig()
+	multi, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		jsonError(w, http.StatusInternalServerError, "failed to load config: "+err.Error())
 		return
@@ -418,7 +418,7 @@ func (ab *authBridge) resolveUserTokenByClient(clientName string) (string, error
 }
 
 func addUserToConfig(appID, openID, userName string) error {
-	multi, err := core.LoadMultiAppConfig()
+	multi, err := configpkg.LoadMultiAppConfig()
 	if err != nil {
 		return err
 	}
@@ -435,12 +435,12 @@ func addUserToConfig(appID, openID, userName string) error {
 			}
 		}
 		if !found {
-			multi.Apps[i].Users = append(multi.Apps[i].Users, core.AppUser{
+			multi.Apps[i].Users = append(multi.Apps[i].Users, configpkg.AppUser{
 				UserOpenId: openID,
 				UserName:   userName,
 			})
 		}
-		return core.SaveMultiAppConfig(multi)
+		return configpkg.SaveMultiAppConfig(multi)
 	}
 	return fmt.Errorf("app %s not found in config", appID)
 }

From d7cf797bddf519b418c7992f35de122d373e0a51 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 14:40:30 +0800
Subject: [PATCH 44/50] refactor(config): remove unreachable legacy loaders

---
 internal/config/config.go | 33 ---------------------------------
 1 file changed, 33 deletions(-)

diff --git a/internal/config/config.go b/internal/config/config.go
index 71a70db2fc..4d5bd3523d 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -208,21 +208,6 @@ func SaveMultiAppConfig(config *MultiAppConfig) error {
 	return validate.AtomicWrite(workspace.GetConfigPath(), append(data, '\n'), 0600)
 }
 
-// RequireConfig loads the single-app config using the default profile resolution.
-func RequireConfig(kc keychain.KeychainAccess) (*CliConfig, error) {
-	return RequireConfigForProfile(kc, "")
-}
-
-// RequireConfigForProfile loads the single-app config for a specific profile.
-// Resolution priority: profileOverride > config.CurrentApp > Apps[0].
-func RequireConfigForProfile(kc keychain.KeychainAccess, profileOverride string) (*CliConfig, error) {
-	raw, err := LoadMultiAppConfig()
-	if err != nil || raw == nil || len(raw.Apps) == 0 {
-		return nil, NotConfiguredError()
-	}
-	return ResolveConfigFromMulti(raw, kc, profileOverride)
-}
-
 // ResolveConfigFromMulti resolves a single-app config from an already-loaded MultiAppConfig.
 // This avoids re-reading the config file when the caller has already loaded it.
 func ResolveConfigFromMulti(raw *MultiAppConfig, kc keychain.KeychainAccess, profileOverride string) (*CliConfig, error) {
@@ -264,24 +249,6 @@ func ResolveConfigFromMulti(raw *MultiAppConfig, kc keychain.KeychainAccess, pro
 	return cfg, nil
 }
 
-// RequireAuth loads config and ensures a user is logged in.
-func RequireAuth(kc keychain.KeychainAccess) (*CliConfig, error) {
-	return RequireAuthForProfile(kc, "")
-}
-
-// RequireAuthForProfile loads config for a profile and ensures a user is logged in.
-func RequireAuthForProfile(kc keychain.KeychainAccess, profileOverride string) (*CliConfig, error) {
-	cfg, err := RequireConfigForProfile(kc, profileOverride)
-	if err != nil {
-		return nil, err
-	}
-	if cfg.UserOpenId == "" {
-		return nil, errs.NewAuthenticationError(errs.SubtypeTokenMissing, "not logged in").
-			WithHint("run `lark-cli auth login` in the background. It blocks and outputs a verification URL — retrieve the URL and open it in a browser to complete login.")
-	}
-	return cfg, nil
-}
-
 // formatProfileNames joins profile names for display.
 func formatProfileNames(names []string) string {
 	if len(names) == 0 {

From 5bae5bbbc294cc5c1546b394faa77e7aa554ff1a Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 14:50:25 +0800
Subject: [PATCH 45/50] fix(lint): follow the extracted brand resolver

---
 lint/domaincontract/scan.go      |  2 +-
 lint/domaincontract/scan_test.go | 12 ++++++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/lint/domaincontract/scan.go b/lint/domaincontract/scan.go
index f4a8817414..8b96323588 100644
--- a/lint/domaincontract/scan.go
+++ b/lint/domaincontract/scan.go
@@ -65,7 +65,7 @@ var allowlist = map[string]bool{
 
 // resolverPath is the resolver source; host literals are permitted only
 // inside its ResolveEndpoints function body.
-var resolverPath = filepath.FromSlash("internal/core/types.go")
+var resolverPath = filepath.FromSlash("brand/brand.go")
 
 func skipDir(name string) bool {
 	switch name {
diff --git a/lint/domaincontract/scan_test.go b/lint/domaincontract/scan_test.go
index a55ade3bb3..98a4528e6a 100644
--- a/lint/domaincontract/scan_test.go
+++ b/lint/domaincontract/scan_test.go
@@ -42,7 +42,7 @@ func writeFile(t *testing.T, root, rel, content string) {
 func TestScanRepo(t *testing.T) {
 	root := t.TempDir()
 	// Negative: the resolver may hold the literals inside ResolveEndpoints.
-	writeFile(t, root, "internal/core/types.go", "package core\n\nfunc ResolveEndpoints(b string) string {\n\treturn \"https://open.feishu.cn\"\n}\n")
+	writeFile(t, root, "brand/brand.go", "package brand\n\nfunc ResolveEndpoints(b string) string {\n\treturn \"https://open.feishu.cn\"\n}\n")
 	// Negative: non-resolver hosts + a comment reference must not trip the guard.
 	writeFile(t, root, "shortcuts/x/display.go", "package x\n\n// see https://open.feishu.cn/document/foo\nvar h = \"https://www.feishu.cn\"\nvar e = \"https://example.feishu.cn\"\nvar r = \"https://registry.npmjs.org/pkg\"\n")
 	// Negative: _test.go files may assert literals.
@@ -108,7 +108,7 @@ func TestScanRepoSDKConstants(t *testing.T) {
 // forbiddenHosts must equal the https hosts in the resolver source, both ways;
 // a resolver domain change without a guard update fails here.
 func TestForbiddenHostsMatchResolver(t *testing.T) {
-	src := filepath.Join("..", "..", "internal", "core", "types.go")
+	src := filepath.Join("..", "..", "brand", "brand.go")
 	fset := token.NewFileSet()
 	file, err := parser.ParseFile(fset, src, nil, 0)
 	if err != nil {
@@ -197,8 +197,8 @@ func TestScanRepoDotImportAndCase(t *testing.T) {
 // ResolveEndpoints body is rejected.
 func TestScanRepoResolverFunctionScope(t *testing.T) {
 	root := t.TempDir()
-	writeFile(t, root, "internal/core/types.go",
-		"package core\n\nfunc ResolveEndpoints(b string) string {\n\treturn \"https://open.feishu.cn\"\n}\n\nfunc bypass() string { return \"https://open.feishu.cn\" }\n\ntype localResolver struct{}\nfunc (localResolver) ResolveEndpoints() string { return \"https://open.feishu.cn\" }\n")
+	writeFile(t, root, "brand/brand.go",
+		"package brand\n\nfunc ResolveEndpoints(b string) string {\n\treturn \"https://open.feishu.cn\"\n}\n\nfunc bypass() string { return \"https://open.feishu.cn\" }\n\ntype localResolver struct{}\nfunc (localResolver) ResolveEndpoints() string { return \"https://open.feishu.cn\" }\n")
 
 	vs, err := ScanRepo(root)
 	if err != nil {
@@ -208,8 +208,8 @@ func TestScanRepoResolverFunctionScope(t *testing.T) {
 		t.Fatalf("got %d violations, want 2 (helper and receiver method): %+v", len(vs), vs)
 	}
 	for _, v := range vs {
-		if filepath.Base(v.File) != "types.go" {
-			t.Errorf("violation in %q, want types.go", v.File)
+		if filepath.Base(v.File) != "brand.go" {
+			t.Errorf("violation in %q, want brand.go", v.File)
 		}
 	}
 }

From f25ef0ae75b4fa62170663a0f84c05f8078755c8 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 15:36:35 +0800
Subject: [PATCH 46/50] docs: point the moved core references at their new
 packages

The internal/core split renamed or relocated every symbol these comments
name, and the sweep missed six call-outs. Two had gone self-contradictory:
internal/meta named the package internal/core while already qualifying the
type as identity.Identity, and authlog attributed its runtime-directory
indirection to a cycle through internal/core that the split removed.

Restate authlog's reason for keeping the indirection instead of promising a
follow-up: the factory-installed logger follows the detected workspace while
the Shared() fallback stays on the pre-workspace directory, so resolving the
directory inside the package would collapse that distinction.

The domaincontract rule's README still pointed host literals at
internal/core/types.go; the exemption moved to brand/brand.go with the
resolver.
---
 cmd/root.go                         |  2 +-
 extension/credential/types.go       |  7 ++++---
 internal/authlog/authlog.go         | 12 +++++++-----
 internal/keychain/keychain_other.go |  3 ++-
 internal/meta/identity.go           |  6 +++---
 lint/README.md                      |  2 +-
 6 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/cmd/root.go b/cmd/root.go
index 7e8244fd35..f0387813e1 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -237,7 +237,7 @@ func configureFlagCompletions(args []string) {
 //     render via the typed envelope writer, which lifts extension fields
 //     (missing_scopes, console_url, challenge_url, ...) to the top level.
 //     Routed by errs.CategoryOf via ExitCodeOf. Auth and config errors are
-//     constructed typed at their origin (internal/auth, internal/core), so the
+//     constructed typed at their origin (internal/auth, internal/config), so the
 //     dispatcher no longer promotes any legacy shape here.
 //  2. PartialFailure / BareError signals: the result envelope is already on
 //     stdout; honor the exit code and write nothing to stderr.
diff --git a/extension/credential/types.go b/extension/credential/types.go
index e9665c8288..95fb384e24 100644
--- a/extension/credential/types.go
+++ b/extension/credential/types.go
@@ -18,9 +18,10 @@ const (
 )
 
 // ParseBrand maps a brand string to a Brand, defaulting to BrandFeishu.
-// It lives next to the Brand constants so every credential source resolves the
-// brand the same way; duplicating the rule per provider would let one copy
-// drift when the brand set changes.
+// It forwards to the repository-root brand package so every credential source
+// and the rest of the CLI resolve the brand through one implementation;
+// re-spelling the rule here would let the two copies drift when the brand set
+// changes. It stays exported so SDK callers need not import brand directly.
 func ParseBrand(value string) Brand {
 	return brand.ParseBrand(value)
 }
diff --git a/internal/authlog/authlog.go b/internal/authlog/authlog.go
index d18d6d4103..1ffc1a5cdf 100644
--- a/internal/authlog/authlog.go
+++ b/internal/authlog/authlog.go
@@ -63,11 +63,13 @@ func New(options Options) *Logger {
 // descriptor and re-run the prune for every line written.
 //
 // SetShared is the single writer and runs once while the command factory is
-// built, which is also the only place that knows the workspace-aware runtime
-// directory. This package cannot resolve that directory itself: internal/core
-// imports internal/keychain, which imports this package, so importing core here
-// would close an import cycle. Untangling that belongs to the internal/core
-// split, after which this indirection can go away.
+// built, which is also the only place that resolves the workspace-aware runtime
+// directory. After the internal/core split, importing internal/workspace here
+// would no longer close a cycle — it is a leaf over internal/vfs — but the
+// indirection stays on purpose: a factory-installed logger follows the detected
+// workspace, while the Shared() fallback below stays on the pre-workspace
+// directory. Resolving the directory in this package would collapse that
+// distinction.
 var (
 	sharedMu        sync.Mutex
 	sharedLog       *Logger
diff --git a/internal/keychain/keychain_other.go b/internal/keychain/keychain_other.go
index d0d094dd5a..783bc8a784 100644
--- a/internal/keychain/keychain_other.go
+++ b/internal/keychain/keychain_other.go
@@ -35,7 +35,8 @@ func StorageDir(service string) string {
 	home, err := vfs.UserHomeDir()
 	if err != nil || home == "" {
 		// If home is missing, fallback to relative path and print warning.
-		// This matches the behavior in internal/core/config.go.
+		// The relative fallback matches internal/workspace.GetBaseConfigDir,
+		// which cannot warn because it has no IOStreams in scope.
 		fmt.Fprintf(os.Stderr, "warning: unable to determine home directory: %v\n", err)
 	}
 	xdgData := filepath.Join(home, ".local", "share")
diff --git a/internal/meta/identity.go b/internal/meta/identity.go
index 75ea9c05fc..23354cf03f 100644
--- a/internal/meta/identity.go
+++ b/internal/meta/identity.go
@@ -9,9 +9,9 @@ import "sort"
 // accepts. It is a distinct type so the two directions of the token<->identity
 // mapping below cannot be swapped silently — a bare string compiles on either
 // side of a string/string signature, a Token does not. The CLI identity
-// vocabulary ("bot"/"user") already has a home in internal/core (identity.Identity);
-// meta is a leaf and must not import core, so the identity side stays a plain
-// string here and is typed at the core boundary.
+// vocabulary ("bot"/"user") already has a home in internal/identity
+// (identity.Identity); meta is a leaf and must not import it, so the identity
+// side stays a plain string here and is typed at that boundary instead.
 type Token string
 
 const (
diff --git a/lint/README.md b/lint/README.md
index 79d246961f..e4f3be52ce 100644
--- a/lint/README.md
+++ b/lint/README.md
@@ -49,7 +49,7 @@ files it rejects:
   flagged.
 
 Host literals are permitted only inside the resolver's `ResolveEndpoints`
-function body (`internal/core/types.go`) and in this rule's own host list
+function body (`brand/brand.go`) and in this rule's own host list
 (`lint/domaincontract/scan.go`); a helper elsewhere in the resolver file
 returning a hardcoded host is still rejected. Comments and `_test.go` files
 are not scanned. Literals are unquoted before matching (escape sequences

From bb7342c3cc6c90ba50262ea6bd0bb64e2418b1f6 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Tue, 28 Jul 2026 16:30:30 +0800
Subject: [PATCH 47/50] docs: record what internal/core became in the source
 layout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The split left the layout table naming only the renamed config package, so
brand, workspace and identity — the three a caller reaches for most — had no
entry, and nothing said where the remaining two went. brand earns a row of its
own for a second reason: it sits at the repository root precisely so extension/
may import it.

The note under the table carries what a path table cannot. The five siblings do
not import each other, and that is the whole reason to ask for the narrow one:
a caller that only wants a config directory no longer compiles keychain, i18n
and validate along with it.
---
 AGENTS.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index e79fa3325d..d5a00b2271 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -62,10 +62,21 @@ Both notices recommend the same fix command: `lark-cli update`. The skills notic
 | `internal/credential/` | Credential provider chain (extension → default) |
 | `extension/credential/` | Plugin-facing credential interfaces and env provider |
 | `internal/client/client.go` | APIClient: DoSDKRequest, DoStream |
+| `brand/` | Brand (feishu/lark) and its endpoint hosts — repo root, so `extension/` may import it |
+| `internal/workspace/` | Workspace detection plus the config and runtime directory paths |
+| `internal/identity/` | The `--as` identity (user/bot) and the strict-mode policy |
 | `internal/config/config.go` | Multi-profile config loading/saving |
 | `internal/vfs/` | Filesystem abstraction (use `vfs.*` instead of `os.*`) |
 | `internal/validate/path.go` | Path safety validation |
 
+`internal/core` is gone. Besides the four packages above it also became
+`internal/secret` (app secret storage and resolution) and `internal/risk` (the
+read / write / high-risk-write vocabulary). Import the narrowest one you need:
+`brand`, `internal/workspace`, `internal/identity`, `internal/secret` and
+`internal/risk` do not import each other — only `internal/config` sits on top of
+them — so asking for a config directory no longer drags in keychain, i18n and
+validate.
+
 ## Who Uses This CLI
 
 This CLI's primary consumers include AI agents (Claude Code, Cursor, Gemini CLI). Your code is read by machines — error messages, output format, and flag design all directly affect agent success rates.

From 2a252d2a8045453af198e5eb215b76a9ee7b6c92 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Wed, 29 Jul 2026 15:27:20 +0800
Subject: [PATCH 48/50] fix(qualitygate): select build-tag files the union used
 to miss
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The union executed one `go list` per registered tag, so a file constrained by
`foo && bar` was selected by neither `-tags foo` nor `-tags bar`. The coverage
test only asked whether each tag name appeared in the registry, which both did,
and the remedy it printed — "union the tag" — is what produced the gap: register
the two tags separately and the file lands in no graph while every check reports
covered. A probe file under events/ importing shortcuts/common, the exact shape
events-no-shortcuts forbids, passed the whole suite that way.

Derive the configurations instead. Every //go:build line is parsed with
go/build/constraint, and each distinct expression contributes a tag set that
satisfies it, so `foo && bar` yields `-tags bar,foo` without anyone registering
anything. Platform terms stay free variables: layeringBuildTargets already
varies GOOS and GOARCH, and -tags cannot set them. Cheapest set wins, which
keeps a platform-only constraint from adding a configuration it does not need.

Deriving the sets removes both hand-kept lists, including the exclusion map that
carved out the sidecar demo tags — those now get a configuration like everything
else.

The replacement invariant is a file-level one the tag registry could not state:
every Go file in this module must be compiled by at least one executed
configuration, asked of the toolchain rather than re-derived from the model that
produced the configurations. It immediately found a second blind spot with no
custom tag in it at all: internal/riskcontrol/osmodel_other.go is constrained
`!darwin && !windows && !linux`, and all seven release targets are one of those,
so no configuration has ever compiled it. That file is recorded as out of scope
with its reason checked — an entry naming a custom tag, or one a release target
does compile, now fails.

Nested modules are skipped, since `go list ./...` does not reach into lint/ and
the rules are written against this module's import paths.

Cost: the file-level check sweeps `go list` again because the rule graph merges
packages across configurations and keeps only imports, so it can no longer say
which configuration contributed which file. The package goes from roughly 16s to
roughly 60s.
---
 internal/qualitygate/deptest/layering_test.go | 580 +++++++++++++++---
 1 file changed, 497 insertions(+), 83 deletions(-)

diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index 4bc39bb58d..5cd0da4f9f 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"go/build/constraint"
 	"io"
 	"io/fs"
 	"os"
@@ -168,6 +169,14 @@ type listedPackage struct {
 	ImportPath string
 	Imports    []string
 	Deps       []string
+	// Dir and the file lists are only read by
+	// TestLayeringBuildConfigsSelectEveryFile, which needs the toolchain's own
+	// answer to "which files did this configuration compile".
+	Dir          string
+	GoFiles      []string
+	CgoFiles     []string
+	TestGoFiles  []string
+	XTestGoFiles []string
 }
 
 type goListTarget struct {
@@ -221,20 +230,273 @@ var layeringBuildTargets = []goListTarget{
 	{GOOS: "windows", GOARCH: "arm64"},
 }
 
-// layeringBuildTags is the set of build tags whose import graphs are unioned
-// before evaluating the rules. A tag that appears in neither this list nor
-// layeringExcludedBuildTags leaves its files unscanned, so
-// TestLayeringBuildTagsCoverTheRepository requires every custom tag in the tree
-// to appear in one of them.
-var layeringBuildTags = []string{"", "authsidecar"}
+// maxBuildConstraintTerms bounds the satisfying-set search. The search is
+// exponential in the number of distinct terms in one constraint, so a
+// pathological expression would hang the suite instead of failing it.
+const maxBuildConstraintTerms = 12
+
+// layeringBuildConfigs derives the -tags values whose import graphs are unioned
+// before the rules are evaluated.
+//
+// This is derived rather than hand-kept because a list of individual tags cannot
+// express what `go list` needs. A file constrained by `foo && bar` is selected
+// by neither `-tags foo` nor `-tags bar`; only `-tags foo,bar` selects it. A
+// registry that records tag names therefore accepts "foo and bar are both
+// registered" as coverage while the file sits in no graph at all — and the
+// remedy such a registry prints ("union the tag") is what puts it there.
+//
+// Deriving the sets from the constraints removes the registry, and with it the
+// exclusion list that used to carve out the sidecar demo tags: every constraint
+// in the tree now contributes a tag set that satisfies it, so nothing is left
+// unscanned by omission.
+//
+// This derivation is trusted only as far as TestLayeringBuildConfigsSelectEveryFile
+// confirms it against the toolchain.
+func layeringBuildConfigs(t *testing.T, root string) []string {
+	t.Helper()
+	builtin := toolchainBuildTerms(t)
+
+	// The empty set stands for the files carrying no constraint at all.
+	sets := map[string]bool{"": true}
+	for _, group := range collectBuildConstraints(t, root) {
+		satisfying := satisfyingTagSets(t, group.Expr, builtin)
+		if len(satisfying) == 0 {
+			t.Errorf(
+				"build constraint %q in %v holds under no assignment; those files can never enter a graph",
+				group.Text, group.Files,
+			)
+			continue
+		}
+		// One set per constraint suffices: the rules read the union of every
+		// graph, so a file only has to be selected once. satisfyingTagSets
+		// returns the cheapest set first, which keeps a platform-only
+		// constraint from adding a configuration it does not need.
+		sets[satisfying[0]] = true
+	}
+
+	configs := make([]string, 0, len(sets))
+	for set := range sets {
+		configs = append(configs, set)
+	}
+	sort.Strings(configs)
+	return configs
+}
+
+// buildConstraintGroup is one distinct //go:build expression and the files that
+// carry it. Grouping by expression keeps the satisfying-set search proportional
+// to the number of distinct constraints rather than to the file count.
+type buildConstraintGroup struct {
+	Text  string
+	Expr  constraint.Expr
+	Files []string
+}
+
+// collectBuildConstraints parses the //go:build line of every Go file in the
+// tree. Only the header is scanned, so a constraint quoted inside a string
+// literal further down cannot register as one.
+func collectBuildConstraints(t *testing.T, root string) []buildConstraintGroup {
+	t.Helper()
+
+	byText := make(map[string]*buildConstraintGroup)
+	err := filepath.WalkDir(root, func(path string, entry fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if entry.IsDir() {
+			if skipBuildConstraintDir(entry.Name()) {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+		if !strings.HasSuffix(path, ".go") {
+			return nil
+		}
+
+		content, err := vfs.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		relative, err := filepath.Rel(root, path)
+		if err != nil {
+			return err
+		}
+		relative = filepath.ToSlash(relative)
+
+		line, found := buildConstraintLine(string(content))
+		if !found {
+			return nil
+		}
+		expr, parseErr := constraint.Parse(line)
+		if parseErr != nil {
+			t.Errorf("parse build constraint %q in %s: %v", line, relative, parseErr)
+			return nil
+		}
+
+		group := byText[line]
+		if group == nil {
+			group = &buildConstraintGroup{Text: line, Expr: expr}
+			byText[line] = group
+		}
+		if !slices.Contains(group.Files, relative) {
+			group.Files = append(group.Files, relative)
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("walk %s: %v", root, err)
+	}
+
+	groups := make([]buildConstraintGroup, 0, len(byText))
+	for _, group := range byText {
+		sort.Strings(group.Files)
+		groups = append(groups, *group)
+	}
+	sort.Slice(groups, func(i, j int) bool { return groups[i].Text < groups[j].Text })
+	return groups
+}
+
+// skipBuildConstraintDir reports directories the Go tool never builds from, so
+// files under them are not expected in any graph.
+func skipBuildConstraintDir(name string) bool {
+	return name == ".git" || name == "node_modules" || name == "testdata" ||
+		strings.HasPrefix(name, "_")
+}
+
+// isModuleRoot reports whether dir declares its own module.
+func isModuleRoot(dir string) bool {
+	_, err := vfs.Stat(filepath.Join(dir, "go.mod"))
+	return err == nil
+}
+
+// layeringUnreleasedPlatformFiles names files that no executed configuration
+// compiles because their constraint excludes every GOOS the release matrix
+// builds. The rules govern what ships, and these files enter no shipped binary,
+// so they are out of scope rather than unscanned by omission.
+//
+// The claim is checked rather than trusted:
+// TestLayeringUnreleasedPlatformFilesStayOutOfScope rejects an entry whose
+// constraint names a custom build tag — a tag set could have covered that, which
+// makes it the derivation's bug and not a platform gap — and rejects an entry
+// that some release target does compile.
+var layeringUnreleasedPlatformFiles = map[string]string{
+	"internal/riskcontrol/osmodel_other.go": "fallback for a GOOS outside the release matrix (!darwin && !windows && !linux)",
+}
+
+// buildConstraintLine returns the //go:build line from a file header. The search
+// stops at the package clause because a constraint is only a constraint above
+// it.
+func buildConstraintLine(content string) (string, bool) {
+	for _, raw := range strings.Split(content, "\n") {
+		line := strings.TrimSpace(strings.TrimSuffix(raw, "\r"))
+		if strings.HasPrefix(line, "package ") {
+			return "", false
+		}
+		if constraint.IsGoBuild(line) {
+			return line, true
+		}
+	}
+	return "", false
+}
+
+// satisfyingTagSets returns every set of custom tags under which expr can hold,
+// cheapest first, as comma-joined -tags values.
+//
+// Platform terms are free variables: layeringBuildTargets already varies GOOS
+// and GOARCH, and `-tags` cannot set them anyway. A set that only becomes
+// satisfying under a port the target matrix does not build is therefore
+// reported as covered here and caught by
+// TestLayeringBuildConfigsSelectEveryFile instead, which asks the toolchain
+// rather than this model.
+func satisfyingTagSets(t *testing.T, expr constraint.Expr, builtin map[string]bool) []string {
+	t.Helper()
+
+	terms := constraintTerms(expr)
+	if len(terms) > maxBuildConstraintTerms {
+		t.Fatalf(
+			"build constraint has %d distinct terms, more than the %d this search allows; split the constraint",
+			len(terms), maxBuildConstraintTerms,
+		)
+	}
+
+	sets := map[string]bool{}
+	for assignment := 0; assignment < 1<<len(terms); assignment++ {
+		enabled := make(map[string]bool, len(terms))
+		for i, term := range terms {
+			if assignment&(1<<i) != 0 {
+				enabled[term] = true
+			}
+		}
+		if !expr.Eval(func(tag string) bool { return enabled[tag] }) {
+			continue
+		}
+
+		custom := make([]string, 0, len(terms))
+		for _, term := range terms {
+			if enabled[term] && !isPlatformBuildTerm(term, builtin) {
+				custom = append(custom, term)
+			}
+		}
+		sort.Strings(custom)
+		sets[strings.Join(custom, ",")] = true
+	}
+
+	tagSets := make([]string, 0, len(sets))
+	for set := range sets {
+		tagSets = append(tagSets, set)
+	}
+	// Cheapest first: fewer tags, then lexicographic. Callers take the head, so
+	// this is what keeps the executed configuration count near the number of
+	// custom tags actually in use.
+	sort.Slice(tagSets, func(i, j int) bool {
+		left, right := tagSets[i], tagSets[j]
+		if leftSize, rightSize := tagSetSize(left), tagSetSize(right); leftSize != rightSize {
+			return leftSize < rightSize
+		}
+		return left < right
+	})
+	return tagSets
+}
+
+// constraintTerms returns the distinct tags named anywhere in expr.
+func constraintTerms(expr constraint.Expr) []string {
+	seen := map[string]bool{}
+	var walk func(constraint.Expr)
+	walk = func(node constraint.Expr) {
+		switch typed := node.(type) {
+		case *constraint.TagExpr:
+			seen[typed.Tag] = true
+		case *constraint.NotExpr:
+			walk(typed.X)
+		case *constraint.AndExpr:
+			walk(typed.X)
+			walk(typed.Y)
+		case *constraint.OrExpr:
+			walk(typed.X)
+			walk(typed.Y)
+		}
+	}
+	walk(expr)
+
+	terms := make([]string, 0, len(seen))
+	for term := range seen {
+		terms = append(terms, term)
+	}
+	sort.Strings(terms)
+	return terms
+}
 
-// layeringExcludedBuildTags names custom build tags deliberately left out of the
-// union. The reason is checked, not just recorded: every file carrying one of
-// these must sit outside every rule's FromPrefix, so enabling the tag cannot
-// change what the rules see.
-var layeringExcludedBuildTags = map[string]string{
-	"authsidecar_demo":              "demo binary under sidecar/, which no rule governs",
-	"authsidecar_multi_tenant_demo": "demo binary under sidecar/, which no rule governs",
+// isPlatformBuildTerm reports whether a term is one the toolchain resolves on
+// its own, which `-tags` neither needs nor is able to set.
+func isPlatformBuildTerm(term string, builtin map[string]bool) bool {
+	return builtin[term] || strings.HasPrefix(term, "go1.")
+}
+
+// tagSetSize counts the tags in a comma-joined -tags value.
+func tagSetSize(set string) int {
+	if set == "" {
+		return 0
+	}
+	return strings.Count(set, ",") + 1
 }
 
 type layeringEdge struct {
@@ -898,73 +1160,248 @@ func TestLayeringBuildTargets(t *testing.T) {
 	}
 }
 
-func TestLayeringBuildTags(t *testing.T) {
-	want := []string{"", "authsidecar"}
-	if !slices.Equal(layeringBuildTags, want) {
-		t.Fatalf("layering build tags = %q, want %q", layeringBuildTags, want)
+// TestLayeringBuildConfigs pins what the derivation currently produces. The
+// derivation is what makes the configurations correct; this literal only makes a
+// change to them visible, so adding a build tag to the tree cannot quietly
+// change what the gate executes.
+func TestLayeringBuildConfigs(t *testing.T) {
+	want := []string{"", "authsidecar", "authsidecar_demo", "authsidecar_multi_tenant_demo"}
+	got := layeringBuildConfigs(t, repoRoot(t))
+	if !slices.Equal(got, want) {
+		t.Fatalf("layering build configurations = %q, want %q", got, want)
 	}
 }
 
-// TestLayeringBuildTagsCoverTheRepository closes the gap the list above cannot
-// close on its own: comparing it against a literal only catches edits to the
-// list, never a build tag introduced somewhere else. A tag nobody added here
-// leaves its files out of every graph, and the rules go quiet on them.
-func TestLayeringBuildTagsCoverTheRepository(t *testing.T) {
+// TestLayeringBuildConfigsSelectEveryFile is the check a tag registry cannot
+// make. It asks the toolchain which files each executed configuration actually
+// compiles and fails on any Go file that no configuration selects: an import
+// edge only reaches the rules through a selected file, so an unselected file is
+// an unenforced one.
+//
+// It sweeps `go list` again rather than reusing TestPackageLayering's graph:
+// that graph merges each package across every configuration and keeps only
+// imports, so it can no longer say which configuration contributed which file.
+// The extra sweep roughly doubles this package's runtime, which is the price of
+// asking the toolchain instead of re-deriving the answer from the same model
+// that produced the configurations.
+func TestLayeringBuildConfigsSelectEveryFile(t *testing.T) {
 	root := repoRoot(t)
-	tagFiles := collectCustomBuildTags(t, root)
+	configs := layeringBuildConfigs(t, root)
+	selected := selectedGoFiles(t, root, configs)
 
-	for tag, files := range tagFiles {
-		if slices.Contains(layeringBuildTags, tag) {
+	for _, file := range moduleGoFiles(t, root) {
+		if selected[file] {
+			if _, unreleased := layeringUnreleasedPlatformFiles[file]; unreleased {
+				t.Errorf(
+					"%s is listed in layeringUnreleasedPlatformFiles but a release target compiles it; drop the entry",
+					file,
+				)
+			}
 			continue
 		}
-		reason, excluded := layeringExcludedBuildTags[tag]
-		if !excluded {
-			t.Errorf(
-				"build tag %q is used by %v but is neither unioned into layeringBuildTags nor listed in layeringExcludedBuildTags; its files are never scanned",
-				tag, files,
-			)
+		if _, unreleased := layeringUnreleasedPlatformFiles[file]; unreleased {
 			continue
 		}
+		t.Errorf(
+			"%s is compiled by none of the %d executed configurations (tags %q across %d targets); its imports never reach the layering rules",
+			file,
+			len(configs)*len(layeringBuildTargets),
+			configs,
+			len(layeringBuildTargets),
+		)
+	}
+}
 
-		// The exclusion claims the tagged code sits outside every rule. Check it,
-		// so the reason cannot quietly stop being true.
-		for _, file := range files {
-			pkg := packageImportPath(root, file)
-			for _, rule := range rules {
-				if matchesPackagePrefix(rule.FromPrefix, pkg) {
-					t.Errorf(
-						"build tag %q is excluded because %s, but %s is governed by %s; union the tag instead",
-						tag, reason, pkg, rule.Name,
-					)
-				}
+// TestLayeringUnreleasedPlatformFilesStayOutOfScope checks the reason each
+// exemption records. An exemption is only legitimate when no tag set could have
+// helped: the moment a listed file names a custom build tag, the gap belongs to
+// layeringBuildConfigs and hiding it here would restore the blind spot that
+// derivation exists to remove.
+func TestLayeringUnreleasedPlatformFilesStayOutOfScope(t *testing.T) {
+	root := repoRoot(t)
+	builtin := toolchainBuildTerms(t)
+
+	for file, reason := range layeringUnreleasedPlatformFiles {
+		content, err := vfs.ReadFile(filepath.Join(root, filepath.FromSlash(file)))
+		if err != nil {
+			t.Errorf("%s is exempt because %s but cannot be read: %v", file, reason, err)
+			continue
+		}
+		line, found := buildConstraintLine(string(content))
+		if !found {
+			t.Errorf("%s is exempt because %s but carries no build constraint", file, reason)
+			continue
+		}
+		expr := mustParseConstraint(t, line)
+
+		for _, term := range constraintTerms(expr) {
+			if !isPlatformBuildTerm(term, builtin) {
+				t.Errorf(
+					"%s is exempt because %s, but its constraint %q names the custom tag %q; a build configuration should cover it instead",
+					file, reason, line, term,
+				)
 			}
 		}
+
+		for _, target := range layeringBuildTargets {
+			if expr.Eval(targetBuildTerms(target)) {
+				t.Errorf(
+					"%s is exempt because %s, but %s/%s satisfies %q; drop the entry",
+					file, reason, target.GOOS, target.GOARCH, line,
+				)
+			}
+		}
+	}
+}
+
+// targetBuildTerms reports which constraint terms hold for one release target.
+// CGO_ENABLED=0 is what loadPackagesForTarget sets, so cgo is false here too.
+func targetBuildTerms(target goListTarget) func(string) bool {
+	unix := map[string]bool{
+		"aix": true, "android": true, "darwin": true, "dragonfly": true,
+		"freebsd": true, "hurd": true, "illumos": true, "ios": true,
+		"linux": true, "netbsd": true, "openbsd": true, "solaris": true,
+	}
+	return func(term string) bool {
+		switch term {
+		case target.GOOS, target.GOARCH, "gc":
+			return true
+		case "unix":
+			return unix[target.GOOS]
+		}
+		return strings.HasPrefix(term, "go1.")
 	}
+}
 
-	for tag := range layeringExcludedBuildTags {
-		if _, used := tagFiles[tag]; !used {
-			t.Errorf("build tag %q is listed as excluded but no file uses it; drop the entry", tag)
+// TestSatisfyingTagSetsRequiresCompoundTagsTogether is the regression for the
+// hole a per-tag registry left open. Registering "foo" and "bar" as separate
+// tags satisfies a name-based coverage check while `-tags foo` and `-tags bar`
+// each select nothing, so a file constrained by both stayed out of every graph
+// and its imports were never ruled on. The satisfying set has to name them
+// together.
+func TestSatisfyingTagSetsRequiresCompoundTagsTogether(t *testing.T) {
+	expr := mustParseConstraint(t, "//go:build foo && bar")
+
+	got := satisfyingTagSets(t, expr, map[string]bool{"linux": true, "darwin": true})
+	if want := []string{"bar,foo"}; !slices.Equal(got, want) {
+		t.Fatalf("satisfying tag sets = %q, want %q", got, want)
+	}
+
+	// The other half of the regression: the sets a per-tag registry would have
+	// executed do not select the file at all.
+	for _, single := range []string{"foo", "bar"} {
+		if expr.Eval(func(tag string) bool { return tag == single }) {
+			t.Errorf("-tags %s satisfies `foo && bar`; this test no longer describes the toolchain", single)
 		}
 	}
 }
 
-// collectCustomBuildTags maps every non-platform build tag in the tree to the
-// files that carry it. GOOS, GOARCH and toolchain terms come from the toolchain
-// itself rather than a hand-kept list, so a new port cannot look like a custom
-// tag.
-func collectCustomBuildTags(t *testing.T, root string) map[string][]string {
+// TestSatisfyingTagSetsRespectsNegation checks that a negated term is left out
+// of the set rather than enabled by having been mentioned.
+func TestSatisfyingTagSetsRespectsNegation(t *testing.T) {
+	expr := mustParseConstraint(t, "//go:build foo && !bar")
+
+	got := satisfyingTagSets(t, expr, map[string]bool{})
+	if want := []string{"foo"}; !slices.Equal(got, want) {
+		t.Fatalf("satisfying tag sets = %q, want %q", got, want)
+	}
+}
+
+// TestSatisfyingTagSetsIgnorePlatformTerms keeps platform-only constraints from
+// adding configurations. GOOS and GOARCH are varied by layeringBuildTargets and
+// cannot be set through -tags, so the empty set is the right answer.
+func TestSatisfyingTagSetsIgnorePlatformTerms(t *testing.T) {
+	builtin := map[string]bool{"darwin": true, "windows": true, "linux": true}
+	expr := mustParseConstraint(t, "//go:build !darwin && !windows && !linux")
+
+	got := satisfyingTagSets(t, expr, builtin)
+	if want := []string{""}; !slices.Equal(got, want) {
+		t.Fatalf("satisfying tag sets = %q, want %q", got, want)
+	}
+}
+
+// TestSatisfyingTagSetsPreferTheCheapestSet pins the ordering layeringBuildConfigs
+// relies on when it takes the head: a constraint an existing configuration
+// already satisfies must not introduce another one.
+func TestSatisfyingTagSetsPreferTheCheapestSet(t *testing.T) {
+	expr := mustParseConstraint(t, "//go:build foo || (bar && baz)")
+
+	got := satisfyingTagSets(t, expr, map[string]bool{})
+	if len(got) == 0 {
+		t.Fatal("no satisfying tag set for `foo || (bar && baz)`")
+	}
+	if got[0] != "foo" {
+		t.Errorf("cheapest satisfying set = %q, want %q; head selection would execute more than it needs", got[0], "foo")
+	}
+}
+
+// TestBuildConstraintLineStopsAtThePackageClause guards the header scan: a
+// //go:build line below the package clause is not a constraint, and treating one
+// as a constraint would invent build configurations from string literals.
+func TestBuildConstraintLineStopsAtThePackageClause(t *testing.T) {
+	header := "//go:build foo\n\npackage p\n\nconst sample = \"//go:build bar\"\n"
+	if line, found := buildConstraintLine(header); !found || line != "//go:build foo" {
+		t.Fatalf("build constraint line = %q, %v; want %q, true", line, found, "//go:build foo")
+	}
+
+	below := "package p\n\n//go:build bar\n"
+	if line, found := buildConstraintLine(below); found {
+		t.Fatalf("build constraint line = %q, true; want no constraint below the package clause", line)
+	}
+}
+
+func mustParseConstraint(t *testing.T, line string) constraint.Expr {
 	t.Helper()
-	builtin := toolchainBuildTerms(t)
-	constraint := regexp.MustCompile(`(?m)^//go:build (.+)$`)
-	splitter := regexp.MustCompile(`[\s()&|!,]+`)
+	expr, err := constraint.Parse(line)
+	if err != nil {
+		t.Fatalf("parse %q: %v", line, err)
+	}
+	return expr
+}
+
+// selectedGoFiles returns every module-relative Go file the toolchain compiles
+// under at least one executed configuration.
+func selectedGoFiles(t *testing.T, root string, configs []string) map[string]bool {
+	t.Helper()
+
+	selected := make(map[string]bool)
+	for _, target := range layeringBuildTargets {
+		for _, tags := range configs {
+			for _, pkg := range goListPackages(t, root, target, tags) {
+				if pkg.Dir == "" {
+					continue
+				}
+				names := slices.Concat(pkg.GoFiles, pkg.CgoFiles, pkg.TestGoFiles, pkg.XTestGoFiles)
+				for _, name := range names {
+					relative, err := filepath.Rel(root, filepath.Join(pkg.Dir, name))
+					if err != nil {
+						t.Fatalf("relativize %s in %s: %v", name, pkg.Dir, err)
+					}
+					selected[filepath.ToSlash(relative)] = true
+				}
+			}
+		}
+	}
+	return selected
+}
 
-	tags := make(map[string][]string)
+// moduleGoFiles returns every Go file in this module minus the directories the
+// Go tool never builds from, which are the files a configuration is expected to
+// select. Nested modules are skipped: `go list ./...` does not reach into them,
+// and the rules are written against this module's import paths.
+func moduleGoFiles(t *testing.T, root string) []string {
+	t.Helper()
+
+	var files []string
 	err := filepath.WalkDir(root, func(path string, entry fs.DirEntry, err error) error {
 		if err != nil {
 			return err
 		}
 		if entry.IsDir() {
-			if entry.Name() == ".git" || entry.Name() == "node_modules" {
+			if skipBuildConstraintDir(entry.Name()) {
+				return filepath.SkipDir
+			}
+			if path != root && isModuleRoot(path) {
 				return filepath.SkipDir
 			}
 			return nil
@@ -972,32 +1409,18 @@ func collectCustomBuildTags(t *testing.T, root string) map[string][]string {
 		if !strings.HasSuffix(path, ".go") {
 			return nil
 		}
-
-		content, err := vfs.ReadFile(path)
-		if err != nil {
-			return err
-		}
 		relative, err := filepath.Rel(root, path)
 		if err != nil {
 			return err
 		}
-		for _, match := range constraint.FindAllStringSubmatch(string(content), -1) {
-			for _, term := range splitter.Split(match[1], -1) {
-				if term == "" || builtin[term] || strings.HasPrefix(term, "go1.") {
-					continue
-				}
-				relative = filepath.ToSlash(relative)
-				if !slices.Contains(tags[term], relative) {
-					tags[term] = append(tags[term], relative)
-				}
-			}
-		}
+		files = append(files, filepath.ToSlash(relative))
 		return nil
 	})
 	if err != nil {
 		t.Fatalf("walk %s: %v", root, err)
 	}
-	return tags
+	sort.Strings(files)
+	return files
 }
 
 // toolchainBuildTerms returns the build constraint terms Go defines itself.
@@ -1027,16 +1450,6 @@ func toolchainBuildTerms(t *testing.T) map[string]bool {
 	return terms
 }
 
-// packageImportPath maps a file inside the module to the import path of the
-// package that holds it.
-func packageImportPath(root, relativeFile string) string {
-	dir := filepath.ToSlash(filepath.Dir(relativeFile))
-	if dir == "." {
-		return modulePath
-	}
-	return modulePath + "/" + dir
-}
-
 func TestLayeringBuildTargetsMatchGoReleaser(t *testing.T) {
 	root := repoRoot(t)
 	content, err := vfs.ReadFile(filepath.Join(root, ".goreleaser.yml"))
@@ -1598,9 +2011,10 @@ func TestGoListCommandHelperProcess(t *testing.T) {
 
 func goListPackageGraph(t *testing.T, root string) []listedPackage {
 	t.Helper()
+	configs := layeringBuildConfigs(t, root)
 	packagesByPath := make(map[string]listedPackage)
 	for _, target := range layeringBuildTargets {
-		for _, tags := range layeringBuildTags {
+		for _, tags := range configs {
 			listed := goListPackages(t, root, target, tags)
 			if len(listed) == 0 {
 				t.Fatalf(

From b39258c169f5d2bd8dda6fdf9ede925e9d6ccbcb Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Wed, 29 Jul 2026 15:27:32 +0800
Subject: [PATCH 49/50] fix(shortcuts): stop printing the import alias as the
 brand word

The internal/core split renamed the brand package and aliased the import as
brandpkg, and the sweep that rewrote `brand.` also rewrote the word ending three
sentences. One of them is user-visible: `apps --help` on Lark read "The "apps"
feature is not yet supported on the lark brandpkg." The error path a few lines
above was spelled without the trailing period and escaped the sweep, so the two
surfaces disagreed.

The brand-guard tests only exercised RunE, which --help bypasses, so nothing
covered the sentence. Pin it whole: a substring check would still pass on a
mangled tail.

The other two are comments in internal/auth.
---
 internal/auth/app_registration_test.go |  2 +-
 internal/auth/device_flow.go           |  2 +-
 shortcuts/register.go                  |  2 +-
 shortcuts/register_brand_guard_test.go | 20 ++++++++++++++++++++
 4 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/internal/auth/app_registration_test.go b/internal/auth/app_registration_test.go
index aa7543fcf9..1012906497 100644
--- a/internal/auth/app_registration_test.go
+++ b/internal/auth/app_registration_test.go
@@ -94,7 +94,7 @@ func TestRequestAppRegistration_UsesFeishuBootstrapAndConfiguredVerificationBran
 // Full Lark routing contract: Lark selects the Lark verification page, while
 // registration bootstraps on Feishu and switches only after the tenant signal.
 // The Lark credential response omits user_info, so the effective domain must
-// still determine the saved brandpkg.
+// still determine the saved brand.
 func TestRegisterAppWithDiscovery_LarkFlowUsesProtocolBootstrap(t *testing.T) {
 	var calls []string
 	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
diff --git a/internal/auth/device_flow.go b/internal/auth/device_flow.go
index 3a29b0795a..88dc37afa9 100644
--- a/internal/auth/device_flow.go
+++ b/internal/auth/device_flow.go
@@ -51,7 +51,7 @@ type OAuthEndpoints struct {
 	Token               string
 }
 
-// ResolveOAuthEndpoints resolves OAuth endpoint URLs based on brandpkg.
+// ResolveOAuthEndpoints resolves OAuth endpoint URLs based on brand.
 func ResolveOAuthEndpoints(brand brandpkg.Brand) OAuthEndpoints {
 	ep := brandpkg.ResolveEndpoints(brand)
 	return OAuthEndpoints{
diff --git a/shortcuts/register.go b/shortcuts/register.go
index 6cb628077e..09d2ad30b0 100644
--- a/shortcuts/register.go
+++ b/shortcuts/register.go
@@ -204,7 +204,7 @@ func installBrandRestrictionGuard(svc *cobra.Command, service string, brand bran
 	walk(svc)
 
 	// --help bypasses RunE, so surface the restriction in Long too.
-	svc.Long = fmt.Sprintf("The %q feature is not yet supported on the %s brandpkg.", service, brand)
+	svc.Long = fmt.Sprintf("The %q feature is not yet supported on the %s brand.", service, brand)
 }
 
 // Sheets backward-compatibility grouping.
diff --git a/shortcuts/register_brand_guard_test.go b/shortcuts/register_brand_guard_test.go
index b0177a271f..84fbdb226e 100644
--- a/shortcuts/register_brand_guard_test.go
+++ b/shortcuts/register_brand_guard_test.go
@@ -104,6 +104,26 @@ func TestBrandGuard_AppsExecutableOnFeishu(t *testing.T) {
 	}
 }
 
+// TestBrandGuard_HelpTextNamesTheBrand covers the surface the tests above cannot
+// reach: --help bypasses RunE, so the restriction is repeated in Long. A
+// package-rename sweep turned the sentence's trailing "brand." into the import
+// alias, and `apps --help` on Lark read "the lark brandpkg." until this pinned
+// the wording. Asserting the whole sentence keeps a substring check from passing
+// on a mangled tail.
+func TestBrandGuard_HelpTextNamesTheBrand(t *testing.T) {
+	program := &cobra.Command{Use: "root"}
+	RegisterShortcuts(program, newFactoryWithBrand(brandpkg.Lark))
+
+	apps := findChild(program, "apps")
+	if apps == nil {
+		t.Fatal("apps should be registered")
+	}
+	want := `The "apps" feature is not yet supported on the lark brand.`
+	if apps.Long != want {
+		t.Errorf("apps help text = %q, want %q", apps.Long, want)
+	}
+}
+
 func TestBrandGuard_DispatchHitsStubViaCobra(t *testing.T) {
 	program := &cobra.Command{Use: "root"}
 	RegisterShortcuts(program, newFactoryWithBrand(brandpkg.Lark))

From 0885ec2eae8124a72ca4586e6733079be9e678f2 Mon Sep 17 00:00:00 2001
From: shanglei <shanglei.ops@bytedance.com>
Date: Wed, 29 Jul 2026 16:20:50 +0800
Subject: [PATCH 50/50] fix(qualitygate): give both layering walks one scope
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The constraint walk descended into nested modules while the file walk skipped
them, and the two feed each other: constraints become the configurations the
file walk is measured against. A compound tag under lint/ therefore added
`-tags bar,foo` to this module's sweep — seven more `go list` runs selecting
nothing here, and a failing configuration list — over a file no walk ever
required to be selected. lint/ carries no custom tag today, so the divergence
was latent rather than broken.

One predicate now answers both walks, and a test pins it: a nested module is out
of scope, a plain package directory is not, and the module root itself stays in.
---
 internal/qualitygate/deptest/layering_test.go | 59 +++++++++++++++----
 1 file changed, 49 insertions(+), 10 deletions(-)

diff --git a/internal/qualitygate/deptest/layering_test.go b/internal/qualitygate/deptest/layering_test.go
index 5cd0da4f9f..d3cb57e280 100644
--- a/internal/qualitygate/deptest/layering_test.go
+++ b/internal/qualitygate/deptest/layering_test.go
@@ -303,7 +303,7 @@ func collectBuildConstraints(t *testing.T, root string) []buildConstraintGroup {
 			return err
 		}
 		if entry.IsDir() {
-			if skipBuildConstraintDir(entry.Name()) {
+			if skipLayeringScopeDir(root, path, entry.Name()) {
 				return filepath.SkipDir
 			}
 			return nil
@@ -355,11 +355,23 @@ func collectBuildConstraints(t *testing.T, root string) []buildConstraintGroup {
 	return groups
 }
 
-// skipBuildConstraintDir reports directories the Go tool never builds from, so
-// files under them are not expected in any graph.
-func skipBuildConstraintDir(name string) bool {
-	return name == ".git" || name == "node_modules" || name == "testdata" ||
-		strings.HasPrefix(name, "_")
+// skipLayeringScopeDir reports directories outside the scope the constraint walk
+// and the file-selection walk share: what `go list ./...` builds for this
+// module.
+//
+// One predicate rather than two, because the two walks feed each other. The
+// constraints found by one become the configurations the other is measured
+// against, so a directory in scope for one and out of scope for the other is a
+// contradiction: a constraint in a nested module would add a configuration whose
+// only justification is a file that module walk never requires to be selected.
+func skipLayeringScopeDir(root, path, name string) bool {
+	// Directories the Go tool never builds from.
+	if name == ".git" || name == "node_modules" || name == "testdata" || strings.HasPrefix(name, "_") {
+		return true
+	}
+	// Nested modules: `go list ./...` stops at them, and the rules are written
+	// against this module's import paths.
+	return path != root && isModuleRoot(path)
 }
 
 // isModuleRoot reports whether dir declares its own module.
@@ -1350,6 +1362,36 @@ func TestBuildConstraintLineStopsAtThePackageClause(t *testing.T) {
 	}
 }
 
+// TestLayeringScopeStopsAtNestedModules pins the scope both walks share. When
+// only the file walk skipped nested modules, a compound tag added under lint/
+// produced a configuration for this module's sweep — seven more `go list` runs
+// selecting nothing here, and a failing configuration list — over a file the
+// file walk never asked anyone to select.
+func TestLayeringScopeStopsAtNestedModules(t *testing.T) {
+	root := t.TempDir()
+	nested := filepath.Join(root, "lint")
+	if err := vfs.MkdirAll(nested, 0o700); err != nil {
+		t.Fatalf("create nested module dir: %v", err)
+	}
+	if err := vfs.WriteFile(filepath.Join(nested, "go.mod"), []byte("module example.com/lint\n"), 0o600); err != nil {
+		t.Fatalf("write nested go.mod: %v", err)
+	}
+	plain := filepath.Join(root, "internal")
+	if err := vfs.MkdirAll(plain, 0o700); err != nil {
+		t.Fatalf("create package dir: %v", err)
+	}
+
+	if !skipLayeringScopeDir(root, nested, "lint") {
+		t.Error("a nested module must be out of scope for both walks")
+	}
+	if skipLayeringScopeDir(root, plain, "internal") {
+		t.Error("a plain package directory must stay in scope")
+	}
+	if skipLayeringScopeDir(root, root, filepath.Base(root)) {
+		t.Error("the module root declares this module and must stay in scope")
+	}
+}
+
 func mustParseConstraint(t *testing.T, line string) constraint.Expr {
 	t.Helper()
 	expr, err := constraint.Parse(line)
@@ -1398,10 +1440,7 @@ func moduleGoFiles(t *testing.T, root string) []string {
 			return err
 		}
 		if entry.IsDir() {
-			if skipBuildConstraintDir(entry.Name()) {
-				return filepath.SkipDir
-			}
-			if path != root && isModuleRoot(path) {
+			if skipLayeringScopeDir(root, path, entry.Name()) {
 				return filepath.SkipDir
 			}
 			return nil