fix(base): classify +form-submit as high-risk-write

[yballul-bytedance]

Summary

base +form-submit fills and submits data through a public form share link — an outward-facing, irreversible write. It was classified as write, so it ran without confirmation. This PR reclassifies it as high-risk-write so the runner's --yes confirmation gate fires before execution, consistent with +form-delete and other high-risk base commands.

Changes

• shortcuts/base/base_form_submit.go: Risk write → high-risk-write; add baseHighRiskYesTip to Tips. The runner auto-registers --yes and returns confirmation_required (exit 10) when it is missing.
• skills/lark-base/references/lark-base-form-submit.md: high-risk warning banner, --yes on all examples, --yes row in the param table, and a tip note.
• skills/lark-base/SKILL.md: note +form-submit requires --yes in the high-risk list and form-details section.
• Tests: new TestFormSubmitRequiresConfirmation unit test pins the typed confirmation_required gate; existing execute-path tests pass --yes; new tests/cli_e2e/base/base_form_submit_dryrun_test.go dry-run E2E.

Test Plan

• Unit tests pass (go test ./shortcuts/base/)
• Dry-run E2E passes (go test ./tests/cli_e2e/base/)
• gofmt -l, go vet, go mod tidy clean

Related Issues

• None

Summary by CodeRabbit

• New Features

  • Form submissions are now classified as high-risk write operations.
  • Added clearer guidance and tips for confirming form submissions.

• Bug Fixes

  • Form submissions require the --yes confirmation flag before execution.
  • Dry-run previews remain available without confirmation.

• Documentation

  • Updated form submission examples, parameters, warnings, and confirmation requirements.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Form Submit Confirmation

Layer / File(s)	Summary
High-risk shortcut configuration shortcuts/base/base_form_submit.go, shortcuts/base/base_shortcuts_test.go	BaseFormSubmit now uses the high-risk-write risk level, includes the confirmation tip, and has an updated risk assertion.
Confirmation and dry-run validation shortcuts/base/base_shortcuts_test.go, tests/cli_e2e/base/base_form_submit_dryrun_test.go	Tests require --yes for write executions, verify the typed confirmation error when omitted, and cover successful dry-run output.
Confirmation guidance skills/lark-base/SKILL.md, skills/lark-base/references/lark-base-form-submit.md	Guidance and examples document --yes for submissions and the exception for --dry-run.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• base +form-submit lacks a pre-submit human confirmation step (preview before irreversible write) #1545 — Directly covers promoting base +form-submit to a high-risk write requiring --yes.

Possibly related PRs

• larksuite/cli#374 — Updates related high-risk confirmation guidance in SKILL.md.
• larksuite/cli#759 — Modifies the BaseFormSubmit shortcut.
• larksuite/cli#775 — Changes risk-level and confirmation behavior for another write shortcut.

Suggested reviewers: liangshuo-1

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main change: reclassifying +form-submit as high-risk-write.
Description check	✅ Passed	The description follows the template with Summary, Changes, Test Plan, and Related Issues, and it covers the main changes and verification.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🚀 PR Preview Install Guide

🧰 CLI update

npm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@c352583ab7932211166230214dfc4052b8937b39

🧩 Skill update

npx skills add yballul-bytedance/cli#fix/form-subimit-high-risk -y -g

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@skills/lark-base/references/lark-base-form-submit.md`:
- Line 78: Update the `--yes` entry in the parameter table for the documented
command to state that confirmation is required only for actual execution, while
explicitly exempting `--dry-run`. Keep the existing `confirmation_required`
behavior for high-risk writes without `--yes` and ensure the wording remains
precise and machine-consumable.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 581f5ffc-b845-4fc5-bd1f-d3cf665c401c

📥 Commits

Reviewing files that changed from the base of the PR and between 78390f8 and c352583.

📒 Files selected for processing (5)

• shortcuts/base/base_form_submit.go
• shortcuts/base/base_shortcuts_test.go
• skills/lark-base/SKILL.md
• skills/lark-base/references/lark-base-form-submit.md
• tests/cli_e2e/base/base_form_submit_dryrun_test.go