test: isolate unit tests from user state

AGENTS.md

@@ -10,9 +10,10 @@
 ## Build & Test
 
 ```bash
-make build          # Build (runs fetch_meta first)
-make unit-test      # Required before PR (runs with -race where supported, e.g. amd64/arm64)
-make test           # Full: vet + unit + integration
+make build             # Build (runs fetch_meta first)
+make unit-test         # Required before PR (runs with -race where supported, e.g. amd64/arm64)
+make live-skills-test  # Opt-in real Skills CLI tests; runs with isolated user directories
+make test              # Full: vet + unit + integration
 ```
 
 ## Notification Opt-Outs

Makefile

@@ -23,7 +23,7 @@ PREFIX   ?= /usr/local
 TEST_GOARCH := $(or $(GOARCH),$(shell go env GOARCH))
 RACE_FLAG := $(if $(filter riscv64,$(TEST_GOARCH)),,-race)
 
-.PHONY: all build vet fmt-check script-test test unit-test integration-test examples-build quality-gate install uninstall clean fetch_meta gitleaks
+.PHONY: all build vet fmt-check script-test test unit-test live-skills-test integration-test examples-build quality-gate install uninstall clean fetch_meta gitleaks
 
 all: test
 
@@ -58,6 +58,11 @@ unit-test: fetch_meta
 	go test $(RACE_FLAG) -gcflags="all=-N -l" -count=1 \
 		./cmd/... ./internal/... ./shortcuts/... ./extension/...
 
+live-skills-test: fetch_meta
+	LARKSUITE_CLI_RUN_LIVE_SKILLS_TESTS=1 \
+	go test -v -count=1 ./cmd/update \
+		-run '^TestUpdateCommand_(RealSkillsSyncRewritesState|SkillsSyncColdStart)$$'
+
 # examples-build keeps the shipped plugin-SDK examples compilable. If this
 # breaks, the plugin author guide's "go build ./..." path is broken.
 examples-build:

cmd/api/api_test.go

@@ -352,6 +352,9 @@ func TestApiCmd_OutputAndPageAllConflict(t *testing.T) {
 }
 
 func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
+	dir := t.TempDir()
+	cmdutil.TestChdir(t, dir)
+
 	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app-bin", AppSecret: "test-secret-bin", Brand: core.BrandFeishu,
 	})
@@ -371,8 +374,33 @@ func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
 	if !strings.Contains(stderr.String(), "binary response detected") {
 		t.Error("expected binary response hint in stderr")
 	}
-	if !strings.Contains(stdout.String(), "saved_path") {
-		t.Error("expected saved_path in output")
+	var got map[string]interface{}
+	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
+		t.Fatalf("stdout is not JSON: %v\nstdout:\n%s", err, stdout.String())
+	}
+	savedPath, _ := got["saved_path"].(string)
+	if savedPath == "" {
+		t.Fatalf("saved_path missing from output: %#v", got)
+	}
+	// The file must land inside the temporary cwd — this pins the isolation
+	// contract: rolling back TestChdir would leave download.bin in the repo.
+	wantDir, err := filepath.EvalSymlinks(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	gotDir, err := filepath.EvalSymlinks(filepath.Dir(savedPath))
+	if err != nil {
+		t.Fatalf("saved_path %q dir not resolvable: %v", savedPath, err)
+	}
+	if gotDir != wantDir {
+		t.Errorf("saved_path %q is outside temp cwd %q", savedPath, wantDir)
+	}
+	content, err := os.ReadFile(savedPath)
+	if err != nil {
+		t.Fatalf("read saved file: %v", err)
+	}
+	if string(content) != "fake-binary-content" {
+		t.Errorf("saved file content = %q, want %q", content, "fake-binary-content")
 	}
 }
 

cmd/auth/testmain_test.go

@@ -0,0 +1,46 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package auth
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/larksuite/cli/internal/registry/registrytest"
+)
+
+// TestMain isolates auth command tests from the host machine: config, logs
+// and the registry cache are redirected to a temp dir, then the registry is
+// seeded from the tracked fixture and initialized eagerly. Domain-completion
+// tests read the registry, so without seeding a clean checkout would either
+// fail or trigger a remote metadata fetch.
+//
+// Note: os.Exit skips deferred functions, so cleanup runs explicitly after
+// m.Run before exiting.
+func TestMain(m *testing.M) {
+	root, err := os.MkdirTemp("", "lark-cli-cmd-auth-test-*")
+	if err != nil {
+		println("cmd/auth test setup: MkdirTemp failed:", err.Error())
+		os.Exit(2)
+	}
+	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", filepath.Join(root, "config")); err != nil {
+		println("cmd/auth test setup: Setenv failed:", err.Error())
+		os.RemoveAll(root)
+		os.Exit(2)
+	}
+	if err := os.Setenv("LARKSUITE_CLI_LOG_DIR", filepath.Join(root, "logs")); err != nil {
+		println("cmd/auth test setup: Setenv failed:", err.Error())
+		os.RemoveAll(root)
+		os.Exit(2)
+	}
+	if err := registrytest.Seed(root); err != nil {
+		println("cmd/auth test setup: registrytest.Seed failed:", err.Error())
+		os.RemoveAll(root)
+		os.Exit(2)
+	}
+	code := m.Run()
+	_ = os.RemoveAll(root)
+	os.Exit(code)
+}

cmd/root_integration_test.go

@@ -371,10 +371,11 @@ func TestIntegration_StrictModeUser_ProfileOverride_ShortcutExplicitBotReturnsEn
 
 func TestIntegration_StrictModeBot_ProfileOverride_ServiceExplicitUserReturnsEnvelope(t *testing.T) {
 	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", core.StrictModeBot)
-	rootCmd := buildStrictModeIntegrationRootCmd(t, f)
+	catalog := strictModeFixtureCatalog()
+	rootCmd := buildStrictModeIntegrationRootCmdWithCatalog(t, f, &catalog)
 
 	code := executeRootIntegration(t, f, rootCmd, []string{
-		"im", "chats", "get", "--params", `{"chat_id":"oc_test"}`, "--as", "user", "--dry-run",
+		"fixture", "things", "create", "--data", `{"name":"probe"}`, "--as", "user", "--dry-run",
 	})
 
 	if code != output.ExitValidation {

cmd/service/testmain_test.go

@@ -0,0 +1,39 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package service
+
+import (
+	"os"
+	"testing"
+
+	"github.com/larksuite/cli/internal/registry/registrytest"
+)
+
+// TestMain isolates service command tests from the host machine: config (and
+// the registry cache under it) is redirected to a temp dir, then the registry
+// is seeded from the tracked fixture and initialized eagerly. Tests pass on a
+// clean checkout with no network, no `make fetch_meta`, and no user cache.
+//
+// Note: os.Exit skips deferred functions, so cleanup runs explicitly after
+// m.Run before exiting.
+func TestMain(m *testing.M) {
+	root, err := os.MkdirTemp("", "lark-cli-cmd-service-test-*")
+	if err != nil {
+		println("cmd/service test setup: MkdirTemp failed:", err.Error())
+		os.Exit(2)
+	}
+	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", root); err != nil {
+		println("cmd/service test setup: Setenv failed:", err.Error())
+		os.RemoveAll(root)
+		os.Exit(2)
+	}
+	if err := registrytest.Seed(root); err != nil {
+		println("cmd/service test setup: registrytest.Seed failed:", err.Error())
+		os.RemoveAll(root)
+		os.Exit(2)
+	}
+	code := m.Run()
+	os.RemoveAll(root)
+	os.Exit(code)
+}

cmd/startup_brand_test.go

@@ -5,18 +5,42 @@ package cmd
 
 import (
 	"context"
+	"flag"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
 
+	"github.com/google/uuid"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/registry"
 )
 
+const startupBrandHelperEnv = "GO_TEST_STARTUP_BRAND_HELPER"
+
+var _ = flag.String("startup-brand-helper", "", "internal startup brand test helper nonce")
+
+func isStartupBrandHelper() bool {
+	return startupBrandHelperEnabled(os.Getenv(startupBrandHelperEnv), startupBrandHelperNonce(os.Args))
+}
+
+func startupBrandHelperEnabled(envNonce, argNonce string) bool {
+	return envNonce != "" && envNonce == argNonce
+}
+
+func startupBrandHelperNonce(args []string) string {
+	const prefix = "-startup-brand-helper="
+	for _, arg := range args {
+		if strings.HasPrefix(arg, prefix) {
+			return strings.TrimPrefix(arg, prefix)
+		}
+	}
+	return ""
+}
+
 func TestResolveStartupBrand_Precedence(t *testing.T) {
 	tmp := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", tmp)
@@ -54,7 +78,7 @@ func TestResolveStartupBrand_Precedence(t *testing.T) {
 // sync.Once, so the brand must be injected before the first catalog access.
 // It runs in a subprocess because the registry is process-global.
 func TestStartupBrandReachesRegistry_RealStartupOrder(t *testing.T) {
-	if os.Getenv("GO_TEST_STARTUP_BRAND_HELPER") == "1" {
+	if isStartupBrandHelper() {
 		// Helper: replicate Execute()'s build wiring with a lark config.
 		buildInternal(
 			context.Background(), cmdutil.InvocationContext{},
@@ -71,9 +95,11 @@ func TestStartupBrandReachesRegistry_RealStartupOrder(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	nonce := uuid.NewString()
+	t.Setenv(startupBrandHelperEnv, nonce)
 	cmd := exec.Command(os.Args[0], "-test.run", "TestStartupBrandReachesRegistry_RealStartupOrder")
+	cmd.Args = append(cmd.Args, "-startup-brand-helper="+nonce)
 	cmd.Env = append(os.Environ(),
-		"GO_TEST_STARTUP_BRAND_HELPER=1",
 		"LARKSUITE_CLI_CONFIG_DIR="+tmp,
 		"LARKSUITE_CLI_REMOTE_META=off", // no network during the subprocess build
 	)
@@ -85,3 +111,33 @@ func TestStartupBrandReachesRegistry_RealStartupOrder(t *testing.T) {
 		t.Errorf("registry brand after real startup order = %s, want lark", out)
 	}
 }
+
+func TestStartupBrandHelperRequiresMatchingCommandNonce(t *testing.T) {
+	for _, tt := range []struct {
+		name     string
+		envNonce string
+		argNonce string
+		want     bool
+	}{
+		{name: "neither set"},
+		{name: "ambient environment only", envNonce: "ambient"},
+		{name: "command argument only", argNonce: "command"},
+		{name: "mismatch", envNonce: "ambient", argNonce: "command"},
+		{name: "matching", envNonce: "nonce", argNonce: "nonce", want: true},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := startupBrandHelperEnabled(tt.envNonce, tt.argNonce); got != tt.want {
+				t.Fatalf("startupBrandHelperEnabled() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestStartupBrandHelperNonce(t *testing.T) {
+	if got := startupBrandHelperNonce([]string{"test", "-test.run", "brand"}); got != "" {
+		t.Fatalf("startupBrandHelperNonce() = %q, want empty", got)
+	}
+	if got := startupBrandHelperNonce([]string{"test", "-startup-brand-helper=nonce"}); got != "nonce" {
+		t.Fatalf("startupBrandHelperNonce() = %q, want nonce", got)
+	}
+}

cmd/testmain_test.go

@@ -0,0 +1,46 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"os"
+	"testing"
+
+	"github.com/larksuite/cli/internal/registry/registrytest"
+)
+
+// TestMain isolates command-tree tests from the host machine: config (and the
+// registry cache under it) is redirected to a temp dir, then the registry is
+// seeded from the tracked fixture and initialized eagerly. Tests pass on a
+// clean checkout with no network, no `make fetch_meta`, and no user cache.
+//
+// Note: os.Exit skips deferred functions, so cleanup runs explicitly after
+// m.Run before exiting.
+func TestMain(m *testing.M) {
+	if isStartupBrandHelper() {
+		// Re-exec helper subprocess (startup_brand_test.go): the parent test
+		// already provides an isolated config dir and disables remote metadata,
+		// and the helper must own the first registry Init to prove the startup
+		// order — do not seed or eagerly initialize here.
+		os.Exit(m.Run())
+	}
+	root, err := os.MkdirTemp("", "lark-cli-cmd-test-*")
+	if err != nil {
+		println("cmd test setup: MkdirTemp failed:", err.Error())
+		os.Exit(2)
+	}
+	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", root); err != nil {
+		println("cmd test setup: Setenv failed:", err.Error())
+		os.RemoveAll(root)
+		os.Exit(2)
+	}
+	if err := registrytest.Seed(root); err != nil {
+		println("cmd test setup: registrytest.Seed failed:", err.Error())
+		os.RemoveAll(root)
+		os.Exit(2)
+	}
+	code := m.Run()
+	os.RemoveAll(root)
+	os.Exit(code)
+}

cmd/update/testmain_test.go

@@ -0,0 +1,23 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package cmdupdate
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestMain(m *testing.M) {
+	root, err := os.MkdirTemp("", "lark-cli-update-test-*")
+	if err != nil {
+		panic(err)
+	}
+	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", filepath.Join(root, "config")); err != nil {
+		panic(err)
+	}
+	code := m.Run()
+	_ = os.RemoveAll(root)
+	os.Exit(code)
+}