# Feishu/Lark Scope Reference

Use this reference when setting up or debugging `lark-cli` for group summary workflows.

## Setup

- Install CLI: `npx @larksuite/cli@latest install`
- Configure app: `lark-cli config init --new`
- Health check: `lark-cli doctor`
- Auth status: `lark-cli auth status`

## Broad Authorization

Run `lark-cli auth login`, select all domains, then choose `全部权限`.

The CLI may request around 180 scopes across approval, apps, attendance, base, calendar, contact, docs, drive, im, mail, markdown, minutes, note, okr, sheets, slides, task, vc, and wiki. Feishu/Lark grants only the scopes enabled for the app and allowed by tenant/admin policy.

## Common Missing Scopes

- Send text to group: `im:message.send_as_user`
- Read group messages: `im:message.group_msg:get_as_user`, `im:message:readonly`, `im:chat:read`
- Send local PDF/file as IM attachment: `im:resource`, `im:resource:upload`, `im:message.send_as_user`
- Upload PDF to Drive fallback: `drive:file:upload`, `drive:drive.metadata:readonly`
- Search chats/messages: `im:chat:read`, `search:message`
- Download message images/files: `im:resource`

## Failure Patterns

- `missing required scope(s)`: run `lark-cli auth login --scope "<scopes>"`, then retry.
- Scope requested but not granted: likely disabled in the app, restricted by tenant/admin policy, or unavailable for the current identity.
- `Bot/User can NOT be out of the chat`: add the bot/user to the chat or use the identity already in the chat.
- File send blocked but Drive upload works: upload to Drive and send the Drive URL as text.
