fix: user-identity messages to external chats fail with error 230027

Summary

Sending messages to a cross-tenant external chat with --as user fails with Feishu API error 230027.

The same user identity can send messages to internal chats and can receive messages from external chats. Our requirement is to send messages as the user identity, not as the bot identity.

Environment

• lark-cli version: 1.0.96
• Command: im +messages-send
• Identity: user
• Chat type: cross-tenant external group

Permissions and application configuration

The user has authorized:

• im:message.send_as_user
• im:message

The application version has been submitted for online release and approved. The application's external-sharing options have also been enabled:

• Allow the bot to be added to external groups
• Allow external users to start one-on-one chats with the bot

What works

1. The same user identity can send messages to internal chats.
2. The same user identity can receive/read messages from external chats.
3. The external chat can be found successfully through the chat search API.

Actual behavior

Sending a text message to the external chat with --as user fails with error 230027:

access denied for this operation

The failure persists after re-authorizing the user with the permissions listed above and after the application version was approved and released.

Important distinction: user identity vs bot identity

This issue specifically concerns sending messages with --as user.

The required behavior is for the message to be sent under the authenticated user identity. Using the bot identity is not an acceptable workaround.

Testing with --as bot produces a separate error indicating that the bot is not a member of the external chat. Adding the bot to the chat would not satisfy our requirement, because the message must be sent as the user.

Reproduction

1. Authorize a user with im:message.send_as_user and im:message.
2. Use that user identity to send a message to an internal chat and verify that it succeeds.
3. Verify that the same user identity can receive/read messages from a cross-tenant external chat.
4. Run:

lark-cli im +messages-send \
  --as user \
  --chat-id <external-chat-id> \
  --text "external chat user-send test"

5. Request
   Please clarify whether im +messages-send --as user is expected to support sending messages to cross-tenant external chats.
   If this is supported, please advise whether an additional Feishu permission, tenant policy, external-chat policy, or CLI-specific configuration is required.
   If this is not supported by the underlying Feishu API, please document the limitation clearly in the CLI.

Start at the im +messages-send --as user command implementation and trace how it handles cross-tenant chat IDs and the Feishu send-message request. Check the API's support and permission requirements for user-identity sends; done means either the command works for supported external chats or the limitation and required conditions are documented clearly.