fix(mail): add missing scopes for mail +watch

[chanthuang]

Summary

• Add mail:user_mailbox.event.mail_address:read and mail:user_mailbox:readonly to mail +watch shortcut's declared Scopes

Problem

The mail +watch shortcut was missing two scopes:

1. mail:user_mailbox.event.mail_address:read — Without it, WebSocket event payloads arrive without the mail_address field, which breaks:

   • --mailbox filtering (cannot match events to the subscribed mailbox)
   • fetchMailbox resolution (falls back to the --mailbox flag value instead of the event's actual mailbox address)

2. mail:user_mailbox:readonly — Required by fetchMailboxPrimaryEmail (GET user_mailboxes/me/profile) to resolve the mailbox address for event filtering. All other mail shortcuts that call this API (send, reply, forward, draft-create, draft-edit) already declare this scope, but +watch did not.

Test plan

• go build ./... passes
• go test ./shortcuts/mail/... ./internal/registry/... passes
• Manual: mail +watch events contain mail_address field after re-login with updated scopes

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

📝 Walkthrough

Walkthrough

Added the event-based scope mail:user_mailbox.event.mail_address:read to the scope registry and updated the MailWatch shortcut scopes to include that event scope and mail:user_mailbox:readonly (while retaining existing message read scopes).

Changes

Cohort / File(s)	Summary
Scope Registry Configuration internal/registry/scope_overrides.json	Added mail:user_mailbox.event.mail_address:read to the recommend.allow list.
MailWatch Shortcut shortcuts/mail/mail_watch.go	Updated MailWatch Scopes: added mail:user_mailbox.event.mail_address:read and mail:user_mailbox:readonly; existing message read scopes remain present.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• fix(mail): on-demand scope checks and watch event filtering #198: Modifies the MailWatch shortcut OAuth scopes in shortcuts/mail/mail_watch.go, likely overlapping scope changes.

Suggested reviewers

• infeng

Poem

🐰 A tiny hop to scope anew,
Event and mailbox added too.
MailWatch perks up its twitching ear,
Watching addresses far and near.
📫✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title accurately captures the main change: adding missing scopes to the mail watch shortcut to fix event handling.
Description check	✅ Passed	The description includes a clear summary, problem explanation, and test plan with most required sections from the template covered.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/mail-watch-event-scope

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Greptile Summary

This PR adds two missing scopes to mail +watch's declared Scopes field: mail:user_mailbox.event.mail_address:read (so WebSocket event payloads include the mail_address field needed for --mailbox filtering and fetchMailbox resolution) and mail:user_mailbox:readonly (for the profile API call that resolves the "me" mailbox). The net change to scope_overrides.json is zero — the scope was added and then reverted across the PR's three commits — so the PR description's second bullet ("Add the same scope to scope_overrides.json recommend.allow list") no longer reflects the actual diff.

Confidence Score: 5/5

Safe to merge — the core scope fix is correct and consistent with other mail shortcuts.

All findings are P2. The Scopes additions are functionally correct, runtime-enforced, and consistent with mail_send/reply/forward. The only concern is a stale PR description; the code itself is sound.

No files require special attention.

Important Files Changed

Filename	Overview
shortcuts/mail/mail_watch.go	Adds mail:user_mailbox.event.mail_address:read and mail:user_mailbox:readonly to Scopes; consistent with other mail shortcuts and correctly enforced at runtime by checkShortcutScopes.

Sequence Diagram

sequenceDiagram
    participant User
    participant CLI as lark-cli
    participant AuthStore as Auth Store
    participant WS as WebSocket API
    participant MailAPI as Mail API

    User->>CLI: mail +watch --mailbox user@example.com
    CLI->>AuthStore: checkScopePrereqs([mail:event, mail:user_mailbox.event.mail_address:read, mail:user_mailbox:readonly, ...])
    AuthStore-->>CLI: scopes present ✓
    CLI->>MailAPI: POST /mailboxes/me/event/subscribe
    CLI->>MailAPI: GET /mailboxes/me/profile (mail:user_mailbox:readonly)
    MailAPI-->>CLI: primary_email_address = user@example.com
    CLI->>WS: Connect WebSocket
    WS-->>CLI: event { mail_address, message_id } (mail:user_mailbox.event.mail_address:read)
    CLI->>CLI: filter mailAddr == mailboxFilter ✓
    CLI->>MailAPI: GET /mailboxes/user@example.com/messages/{id}
    MailAPI-->>CLI: message payload
    CLI-->>User: output message

Loading

_{Reviews (3): Last reviewed commit: "fix(mail): remove event scope from scope..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

shortcuts/mail/mail_watch.go (1)

182-210: ⚠️ Potential issue | 🟠 Major

Use vfs.* instead of os.* for filesystem operations.

Lines 182-183 use os.UserHomeDir() and line 203 uses os.MkdirAll(). As per coding guidelines, all filesystem access should use vfs.* instead of os.* to support virtual filesystem abstractions for testing and sandboxing.

📁 Proposed fix to use vfs package

Check if the vfs package is imported and available, then replace:

-			home, err := os.UserHomeDir()
+			home, err := vfs.UserHomeDir()
 			if err != nil {
 				return fmt.Errorf("cannot expand ~: %w", err)

-		if err := os.MkdirAll(outputDir, 0700); err != nil {
+		if err := vfs.MkdirAll(outputDir, 0700); err != nil {
 			return fmt.Errorf("cannot create output directory %q: %w", outputDir, err)

As per coding guidelines: Use vfs.* instead of os.* for all filesystem access.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@shortcuts/mail/mail_watch.go` around lines 182 - 210, Replace direct os
package filesystem calls with the vfs equivalents: call vfs.UserHomeDir()
instead of os.UserHomeDir(), vfs.MkdirAll(outputDir, 0700) instead of
os.MkdirAll(...), and use vfs.EvalSymlinks(outputDir) instead of
filepath.EvalSymlinks so the code honors the virtual filesystem abstraction;
keep the same error handling and assignment to outputDir, and ensure the vfs
package is imported and used around the existing logic that also calls
validate.SafeOutputPath and manipulates the outputDir variable.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@shortcuts/mail/mail_watch.go`:
- Line 84: The Scopes array in mail_watch.go is missing the required
"mail:user_mailbox:readonly" permission which causes
fetchMailboxPrimaryEmail(runtime, "me") to fail when mailbox defaults to "me";
update the Scopes slice (the Scopes: []string{...} declaration) to include
"mail:user_mailbox:readonly" alongside the existing mail scopes so the default
mailbox resolution and event filtering have the necessary readonly mailbox
access.

---

Outside diff comments:
In `@shortcuts/mail/mail_watch.go`:
- Around line 182-210: Replace direct os package filesystem calls with the vfs
equivalents: call vfs.UserHomeDir() instead of os.UserHomeDir(),
vfs.MkdirAll(outputDir, 0700) instead of os.MkdirAll(...), and use
vfs.EvalSymlinks(outputDir) instead of filepath.EvalSymlinks so the code honors
the virtual filesystem abstraction; keep the same error handling and assignment
to outputDir, and ensure the vfs package is imported and used around the
existing logic that also calls validate.SafeOutputPath and manipulates the
outputDir variable.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 850c59a6-6d50-44a6-a11e-b639e9207771

📥 Commits

Reviewing files that changed from the base of the PR and between af83e54 and b99b08e.

📒 Files selected for processing (2)

• internal/registry/scope_overrides.json
• shortcuts/mail/mail_watch.go

[github-actions]

🚀 PR Preview Install Guide

🧰 CLI update

npm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@e2220947568c4542d1c94dc5f51365d543f5b2bd

🧩 Skill update

npx skills add larksuite/cli#fix/mail-watch-event-scope -y -g