{"record":{"id":"2b8cc17eb1e88f6c","repo":"larksuite/cli","slug":"s-references-hidden-param-s-use-a-public-cano","errorCode":null,"errorMessage":"%s references hidden param --%s; use a public canonical param","messagePattern":"(.+?) references hidden param --(.+?); use a public canonical param","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shortcuts/common/typed_compile_contract.go","lineNumber":76,"sourceCode":"\nfunc compileAuthorization(definition typedAuthorizationDefinition, fields []compiledInputField, fieldByName map[string]int) error {\n\tfor identity, authorization := range definition.Identities {\n\t\tfor i, conditional := range authorization.ConditionalScopes {\n\t\t\tpath := fmt.Sprintf(\"Authorization.%s.ConditionalScopes[%d]\", identity, i)\n\t\t\tif len(conditional.Params) > 0 && conditional.When == \"\" {\n\t\t\t\treturn fmt.Errorf(\"%s.Params requires agent-readable When text\", path)\n\t\t\t}\n\t\t\tseen := make(map[string]struct{}, len(conditional.Params))\n\t\t\tfor j, param := range conditional.Params {\n\t\t\t\tif param == \"\" || param != strings.TrimSpace(param) {\n\t\t\t\t\treturn fmt.Errorf(\"%s.Params[%d] must be a non-blank trimmed param\", path, j)\n\t\t\t\t}\n\t\t\t\tfieldIndex, ok := fieldByName[param]\n\t\t\t\tif !ok {\n\t\t\t\t\treturn fmt.Errorf(\"%s references unknown param --%s\", path, param)\n\t\t\t\t}\n\t\t\t\tif fields[fieldIndex].cli.Hidden {\n\t\t\t\t\treturn fmt.Errorf(\"%s references hidden param --%s; use a public canonical param\", path, param)\n\t\t\t\t}\n\t\t\t\tif _, duplicate := seen[param]; duplicate {\n\t\t\t\t\treturn fmt.Errorf(\"%s.Params contains duplicate param --%s\", path, param)\n\t\t\t\t}\n\t\t\t\tseen[param] = struct{}{}\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validateOutput(definition typedOutputDefinition, dataShape typedValueShape) error {\n\tswitch definition.Mode {\n\tcase typedOutputGeneric, typedOutputFixedJSON:\n\tdefault:\n\t\treturn fmt.Errorf(\"Output.Mode %q is invalid\", definition.Mode)\n\t}\n\treturn nil","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/shortcuts/common/typed_compile_contract.go#L58-L94","documentation":"Thrown when a conditional scope references a param that exists but is marked Hidden in its CLI flag metadata. Conditional scope requirements must be expressed with public canonical params so agents and users can see and satisfy them.","triggerScenarios":"ConditionalScopes.Params lists a declared but cli.Hidden input field.","commonSituations":"A field was made hidden (internal/deprecated) after the authorization block referenced it; referencing internal-only flags to express scope conditions; copies from older shortcut versions where the field was public.","solutions":["Use the public canonical param that supersedes the hidden one","Expose the needed field as a public (non-hidden) input field if it is legitimately user-facing","Drop the conditional scope entry if the hidden param should not drive scope requirements"],"exampleFix":"// before\nConditionalScopes: []ConditionalScope{{Params: []string{\"--internal-token\"}, When: \"...\"}}\n// after\nConditionalScopes: []ConditionalScope{{Params: []string{\"--file-token\"}, When: \"...\"}}","handlingStrategy":"validation","validationCode":"for _, p := range cs.Params {\n  if f := fieldByName[p]; f.CLI.Hidden {\n    return fmt.Errorf(\"conditional scope uses hidden param %q\", p)\n  }\n}","typeGuard":null,"tryCatchPattern":"if err := common.CompileTypedDefinition(def); err != nil {\n  return fmt.Errorf(\"conditional scope hidden param: %w\", err)\n}","preventionTips":["When marking a field Hidden, grep authorization blocks for its name","Reference only public canonical params in scope conditions","Document hidden fields as internal in the definition comments"],"tags":["go","authorization","scopes","hidden-param"],"backgroundTag":"shortcut-definition-validation-failed","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}