Lark Event Skill 安全审计

31| `--jq <expr>` | jq expression to filter / transform each event; empty output skips the event |32| `--max-events N` | Exit after N events. Default 0 = unlimited |33| `--timeout D` | Exit after duration D (e.g. `30s`, `2m`). Default 0 = no timeout. Whichever of `--max-events` / `--timeout` fires first wins |34| `--output-dir <dir>` | Write each event as a file (relative paths only; prevents traversal) |35| `--quiet` | Suppress ready/exit markers and per-event stderr diagnostics, including drop warnings. This can hide event loss. **AI should not use this** — it removes readiness and integrity signals |36| `--as user\|bot\|auto` | Identity for the session (see lark-shared) |

2728**sender_id is open_id only**: the event payload carries no display name. Call the contact API separately if you need the sender's name.2930**`.content` shape depends on `message_type`** (this key uses a flat Custom schema; see [`events/im/message_receive.go`](../../../events/im/message_receive.go)):3132| message_type | `.content` shape | How to read |33|---|---|---|34| `text` / `post` / `image` / `file` / `audio` / `sticker` / `share_chat` / `share_user` / `media` / `system` | Human-readable text (convertlib-processed; `@mentions` resolved to display names) | Use `.content` directly |35| `interactive` (card) | Raw card JSON string (structured actions can't be losslessly flattened) | `.content \| fromjson` to get the card object |36

6162# group only63lark-cli event consume im.message.receive_v1 --as bot \64  --jq 'select(.chat_type=="group") | {chat: .chat_id, from: .sender_id, msg: .content}'65```

7879For each resolved `subscription_type`, PreConsume sends one request body:8081```json82{"subscription_type":"INVOLVED_APPROVAL"}83```8485If `subscription_type` is omitted, PreConsume sends two registration requests for that EventKey: one with `INVOLVED_APPROVAL`, then one with `MANAGED_APPROVAL`. If listening to both instance and task events, run two consumers; each consumer may omit `subscription_type` to register both relations for its own EventKey.86

8889Shutdown behavior:9091`event consume` does not call the Approval unsubscribe APIs when it exits. This applies to graceful exit, Ctrl+C / SIGTERM, stdin EOF, `--timeout`, and `--max-events`.9293To stop future delivery for a user, cancel the Approval subscription relation outside this consumer. The unsubscribe APIs are separate operations and are not called by `event consume`.94

57| Says "approvals I manage", "managed definitions", "definitions managed by me", "我管理的审批定义" | requested EventKey(s) | `MANAGED_APPROVAL` |58| Explicitly asks for both involved and managed, or says "all approval subscriptions" | requested EventKey(s), or both if EventKey is also ambiguous | omit `subscription_type`, or pass both values in one `-p` |59| Relation is ambiguous and the user wants broad coverage | requested EventKey(s), or both if EventKey is also ambiguous | omit `subscription_type` so PreConsume registers both |6061If the user's wording omits the relation and broad listening is acceptable, omit `subscription_type`. Ask only when registering both relations would be materially harmful.62

16|---|---|---|17| `task.task.update_user_access_v2` | `task:task:read` | user, bot |1819Supports `--as user` or `--as bot`.2021- `--as user`: receive task updates visible to the current user through authorship, assignment, following, or other access.22- `--as bot`: receive task updates for tasks the application is responsible for.23

3536This EventKey is single-consumer per local bus subscription: start one `event consume task.task.update_user_access_v2` process for a given app/profile/identity at a time.37