How to Use Lark CLI With Codex: Create and Verify One Document

The safest way to use Lark CLI from Codex is to create one small Markdown document through Aident Loadout, capture the returned document reference, and immediately fetch it back as Markdown. The write and read-back are separate Actions. Review both schemas first, preflight the exact inputs, and treat a matching read-back as the success condition.

In this guide, Lark CLI means the public cli:lark Action surface available through Aident Loadout. It does not mean that Lark ships a general-purpose standalone shell application. Loadout gives Codex one discovery, Vault, preflight, execution, and audit pattern around the Lark operations exposed in the current catalog.

The smallest safe workflow

These names and schemas came from the live staging catalog reviewed on September 11, 2026. Rediscover them before use. A stable workflow depends on the current contract, not on a copied identifier from an old article.

The first test should use the default-location create Action only when the destination is acceptable. If the document must live in a specific folder, use the folder-specific Action from the start. Do not create a document and then improvise a move across an unreviewed folder boundary.

What you need before starting

You need:

• the installed public aident CLI;

• the intended Aident account;

• one ready Lark connection in Aident Vault;

• permission to create one test document in the selected destination;

• a short non-sensitive Markdown fixture; and

• a reviewer who can approve the exact create Action and content.

Install or update the CLI from the canonical setup guide:

Follow https://aident.ai/SETUP.md

Then check identity and connection state:

aident account auth status
aident vault vault --action status

Stop if the signed-in Aident account or ready Lark connection is not the intended one. Do not paste a Lark app secret, tenant token, user token, or exported credential into the prompt or repository.

1. Search for the create Action by job

Search the live staging catalog instead of guessing an Action name:

aident capabilities search \
  --targetEnv staging \
  --types '["action"]' \
  --query "Lark create one Docx document from Markdown at the default location" \
  --limit 5

On September 11, this search returned a create Action whose description says it creates a Lark Docx document from Markdown at the default location. Copy the full public name from your own result and inspect it:

aident capabilities get \
  --name "<current Lark create-document Action>"

The reviewed schema required one field, content. The Action was classified as a write with risk level 3. That is the right place to pause: connection readiness proves a credential is available, but it does not approve the destination or document body.

If the destination matters, run a second search:

aident capabilities search \
  --targetEnv staging \
  --types '["action"]' \
  --query "Lark create one Docx document in a specific parent folder" \
  --limit 5

The reviewed folder-specific schema required both parentToken and content. Resolve and review the intended folder token before authorizing that write. A folder display name alone is not an immutable destination.

2. Use a harmless Markdown fixture

Start with content that proves Markdown conversion without exposing customer or company data:

# Weekly launch brief

Owner: Marketing

## Decisions

- No decision recorded.

## Next actions

- Review this draft before sharing

This fixture has one heading, two sections, and two list items. It is easy to compare after creation and carries no external recipients, attachments, mentions, or sensitive source material.

Avoid using a real meeting transcript, customer list, roadmap, incident report, or credential as the first document. A successful Markdown conversion is not evidence that a broader data-handling policy is safe.

3. Preflight the exact create input

Use the exact Action selected from current discovery:

aident capabilities preflight \
  --name "<current Lark create-document Action>" \
  --input '{"content":"# Weekly launch brief\n\nOwner: Marketing\n\n## Decisions\n\n- No decision recorded.\n\n## Next actions\n\n- Review this draft before sharing."}'

The exact fixture above passed schema validation during the September 11 review and returned an estimate of 0 Aident credits, or $0.00. The folder-specific placeholder input and the later read-back placeholder also passed free preflight. No Lark document was created during this research.

Preflight proves that the payload matches the current Aident contract and exposes available risk and price gates. It does not prove that the Lark account, folder, content, or eventual sharing state is approved.

Before execution, record:

1. the connected Lark account;

2. the exact create Action;

3. whether the destination is default or one reviewed folder token;

4. the complete Markdown body;

5. the expected number of new documents, which is one; and

6. the read-back Action that will verify the result.

4. Execute once, after approval

After a person approves the identical Action and input, execute it once:

aident capabilities execute \
  --name "<current Lark create-document Action>" \
  --input '{"content":"# Weekly launch brief\n\nOwner: Marketing\n\n## Decisions\n\n- No decision recorded.\n\n## Next actions\n\n- Review this draft before sharing."}' \
  --acknowledgementScope once

Use the acknowledgement only when the CLI requests it and the displayed Action and input still match the reviewed preflight. Do not change the content between preflight and execution. Do not retry a timeout blindly: first inspect the Action receipt or destination because the provider may have accepted the write even when the client did not receive a final response.

Capture the returned document URL or token as the verification target. Do not expose unrelated response fields in logs or a pull request.

5. Fetch the new document back as Markdown

Discover the current read-back Action by job:

aident capabilities search \
  --targetEnv staging \
  --types '["action"]' \
  --query "Lark fetch one Docx document as Markdown by URL or token" \
  --limit 5

Inspect the selected result before using it:

aident capabilities get \
  --name "<current Lark fetch-document-Markdown Action>"

The September 11 schema required one document value and was classified as a read with risk level 1. Preflight the exact returned reference, then execute the same input:

aident capabilities preflight \
  --name "<current Lark fetch-document-Markdown Action>" \
  --input '{"document":"<returned document URL or token>"}'

aident capabilities execute \
  --name "<current Lark fetch-document-Markdown Action>" \
  --input '{"document":"<returned document URL or token>"}'

The test is complete only when the fetched Markdown preserves the title, owner line, both section headings, and both list items. Also confirm that exactly one document was created in the approved destination.

A practical acceptance record

Keep a small receipt instead of the whole provider payload:

This receipt separates proof from authority. Creating one document does not authorize a second document, a folder change, an append, a text replacement, an image insertion, a share-permission change, or a message send.

A prompt you can give Codex

Follow https://aident.ai/SETUP.md

Use the installed public aident CLI. Confirm the current Aident account and
Vault status, then search the staging catalog for the current Lark Action that
creates one Docx document from Markdown. Inspect the exact schema, connected
account, operation type, risk, destination behavior, and pricing.

Prepare a non-sensitive Markdown fixture with one title, two headings, and two
list items. Preflight the exact create input. Do not execute until I approve the
Action, destination, and complete Markdown body. If approved, execute once with
a one-time acknowledgement and capture the returned document reference.

Then discover and inspect the current Lark Action that fetches one document as
Markdown. Preflight and execute it only against the returned reference. Verify
that the content matches and that exactly one document exists. Stop before any
share, move, append, replacement, image insertion, message, or second write.
Never reveal or persist provider credentials or unrelated response data

Common Lark CLI failures

Search returns no Lark document Action

Remove an incorrect integration scope, keep --targetEnv staging, and search by the complete job. The unscoped September 11 search returned the relevant cli:lark Actions, while an assumed short integration scope returned no results. Use the integration ID from live discovery or Vault status rather than inventing one.

Vault says connected, but creation is denied

Connection readiness and provider authorization are different facts. Review the connected identity, Lark app permissions, destination visibility, and current consent. Do not replace the connection or paste a provider token into the shell as a shortcut.

The document appears in the wrong place

The default-location Action does not accept a folder token in the reviewed schema. If location is part of the requirement, stop and use the folder-specific create Action with a reviewed parentToken. Do not create another document until the first result is understood.

The create call times out

Treat the outcome as unknown. Check the Aident receipt and destination before retrying. A repeated create can produce a duplicate because the reviewed input schema did not expose an idempotency key.

The read-back does not match

Compare the fetched Markdown with the approved fixture. Distinguish harmless Markdown normalization from missing text, changed ordering, or an unexpected document. Preserve the mismatch and stop before editing it through another write Action.

When to move beyond the first document

Once the bounded test passes, reuse the same control pattern for a real workflow: discover, inspect, preflight, approve, execute once, and read back. A meeting-recording workflow shows how to turn a consented transcript into reviewed action items. A durable Lark Base handoff ledger is the better next step when multiple agents need explicit ownership and receipts. For the broader connection model, use How to Use Aident Loadout.

Do not generalize this document test into permission to send messages, invite collaborators, change public sharing, or process sensitive content. Each consequence needs its own exact Action, input, reviewer, and read-back.

Create one reviewed Lark document

Set up Aident Loadout, connect Lark, and preflight one document. Success means one approved document appears in the intended location and the fetched Markdown matches the fixture.

Sources

• Aident Loadout setup, reviewed September 11, 2026.

• Lark integration for Aident, reviewed September 11, 2026.

• Lark Open Platform: create a Docx document, reviewed September 11, 2026.

• Live Aident Loadout staging catalog, exact schemas, risk metadata, and three exact free preflights for Lark document create, folder create, and Markdown fetch Actions, inspected September 11, 2026.

• Google Search Console query-page rows for August 12 through September 8, 2026.

Refresh this guide when the public Aident CLI, Lark Action names or schemas, Vault connection flow, risk metadata, pricing, acknowledgement behavior, destination rules, Markdown conversion, or Lark Docx API changes.