ci: trigger mergeability recalculation

chore(release): prepare v1.0.55-beta.4

.github/CODEOWNERS

@@ -1,4 +0,0 @@
-# Default code owners for all files
-# These users will be automatically requested for review on PRs.
-
-* @DingTalk-Real-AI/cli-maintainers

.github/PULL_REQUEST_TEMPLATE.md

@@ -3,15 +3,41 @@
 - What changed?
 - Why is this change needed?
 
+## Risk tier
+
+- [ ] Documentation-only: prose/assets only; no executable, generated, workflow,
+  packaging, or interface behavior changed
+- [ ] Standard: ordinary implementation change with a stable package graph
+- [ ] High-risk: workflow/policy, package graph, generated Schema/registry,
+  platform, auth/keychain, installer, packaging, release, transport, recovery,
+  or another fail-closed infrastructure change
+
 ## Verification
 
-- [ ] `make build`
-- [ ] `make lint`
-- [ ] `make test`
-- [ ] `make policy`
+Record the smallest targeted evidence that proves the changed behavior. Do not
+repeat the entire CI suite locally only to fill this checklist: CI expands the
+selected tier from documentation checks, through affected-package tests, to
+the complete high-risk suite.
+
+- [ ] Exact in-place `CHANGELOG.md`-only check (otherwise `N/A`):
+  `./scripts/policy/check-changelog-pr.sh --fast-path "$(git merge-base HEAD origin/main)" HEAD`
+- [ ] Targeted test/check commands and results:
+- [ ] Behavior evidence (test name, CLI output shape, or before/after result):
+- [ ] Documentation links/content/rendering checked (documentation-only, otherwise
+  `N/A`)
+- [ ] Full local suite run because the change is high-risk (optional for other
+  tiers; record command/result or `N/A`)
 - [ ] `./scripts/policy/check-generated-drift.sh`
+  (when generator inputs or generated artifacts may change)
 - [ ] `./scripts/policy/check-command-surface.sh --strict` (if command surface changed)
+- [ ] `./scripts/release/verify-package-managers.sh`
+  (after `make package`, if packaging or installer surfaces changed)
 
 ## Notes
 
 - Any risks, follow-up work, or intentional scope cuts
+
+The repository automatically requests one eligible peer reviewer, including
+after a new head push when another review is needed. Once the latest push has
+peer approval and all nine required checks are current and green, auto-merge
+completes the PR; authors do not need to coordinate a separate routine merge.

.github/workflows/ai-behavior-check.yml

@@ -1,8 +1,11 @@
-name: AI Behavior Check
+name: Code Admission — AI Behavior
 
 on:
   pull_request_target:
     types: [opened, synchronize, reopened, labeled, unlabeled]
+  push:
+    branches:
+      - main
 
 permissions:
   contents: read
@@ -11,7 +14,7 @@ permissions:
 
 jobs:
   ai-behavior-check:
-    name: AI Behavior Policy Evaluator
+    name: AI Behavior
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -21,75 +24,108 @@ jobs:
         uses: actions/github-script@v7
         with:
           script: |
-            const sha = context.payload.pull_request.head.sha;
+            const pullRequest = context.payload.pull_request;
+            const sha = context.eventName === 'push' ? context.sha : pullRequest.head.sha;
             const setStatus = (state, description) =>
               github.rest.repos.createCommitStatus({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 sha,
                 state,
-                context: 'AI Behavior Check',
+                context: 'AI Behavior',
                 description,
               });
 
             await setStatus('pending', 'Evaluating AI-generated PR boundaries');
 
-            const labels = context.payload.pull_request.labels.map(({ name }) => name);
-            if (!labels.includes('ai-generated')) {
-              await setStatus('success', 'Not labeled ai-generated');
-              core.notice('Not an ai-generated PR; no AI-only policy applied.');
+            if (context.eventName === 'push') {
+              await setStatus('success', 'Not applicable to the protected main push');
+              core.notice('AI Behavior is a PR policy; the main push context is sealed.');
               return;
             }
 
-            const files = await github.paginate(github.rest.pulls.listFiles, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.issue.number,
-              per_page: 100,
-            });
+            try {
+              const expectedHead = pullRequest.head.sha;
+              const expectedBase = pullRequest.base.sha;
+              const currentPull = async (phase) => {
+                const { data: pull } = await github.rest.pulls.get({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  pull_number: context.issue.number,
+                });
+                if (pull.head.sha !== expectedHead || pull.base.sha !== expectedBase) {
+                  throw new Error(
+                    `Pull request revision changed during ${phase}: ` +
+                    `expected base/head ${expectedBase}/${expectedHead}, ` +
+                    `got ${pull.base.sha}/${pull.head.sha}`
+                  );
+                }
+                return pull;
+              };
+
+              const before = await currentPull('pre-policy check');
+              const labels = before.labels.map(({ name }) => name);
+              if (!labels.includes('ai-generated')) {
+                await setStatus('success', 'Not labeled ai-generated');
+                core.notice('Not an ai-generated PR; no AI-only policy applied.');
+                return;
+              }
+
+              const files = await github.paginate(github.rest.pulls.listFiles, {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: context.issue.number,
+                per_page: 100,
+              });
+              await currentPull('post-policy check');
+
+              const maxChangedFiles = 30;
+              if (files.length > maxChangedFiles) {
+                await setStatus(
+                  'failure',
+                  `Changes ${files.length} files; limit is ${maxChangedFiles}`
+                );
+                core.setFailed(
+                  `AI-generated PR changes ${files.length} files; limit is ${maxChangedFiles}.`
+                );
+                return;
+              }
+
+              const isProtectedPath = (filename) =>
+                typeof filename === 'string' &&
+                (
+                  filename.startsWith('.github/workflows/') ||
+                  filename.startsWith('scripts/ci/') ||
+                  filename.startsWith('scripts/policy/') ||
+                  filename.startsWith('scripts/release/') ||
+                  filename === 'test/fixtures/cli-interface-baseline.txt' ||
+                  filename === '.goreleaser.yaml' ||
+                  filename === 'Makefile'
+                );
+              const protectedPaths = [...new Set(
+                files
+                  .flatMap(({ filename, previous_filename }) => [filename, previous_filename])
+                  .filter(isProtectedPath)
+              )];
+
+              if (protectedPaths.length > 0) {
+                await setStatus('failure', 'Modifies protected release/CI infrastructure');
+                core.setFailed(
+                  'AI-generated PR modifies protected release/CI infrastructure:\n' +
+                  protectedPaths.map((filename) => `  - ${filename}`).join('\n') +
+                  '\nSplit these changes into a human-owned PR with explicit review.'
+                );
+                return;
+              }
 
-            const maxChangedFiles = 30;
-            if (files.length > maxChangedFiles) {
               await setStatus(
-                'failure',
-                `Changes ${files.length} files; limit is ${maxChangedFiles}`
+                'success',
+                `Passed with ${files.length} changed files (limit ${maxChangedFiles})`
               );
-              core.setFailed(
-                `AI-generated PR changes ${files.length} files; limit is ${maxChangedFiles}.`
+              core.notice(
+                `AI behavior check passed (${files.length} changed files; limit ${maxChangedFiles}).`
               );
-              return;
+            } catch (error) {
+              await setStatus('error', 'Could not evaluate the exact pull request revision');
+              throw error;
             }
-
-            const isProtectedPath = (filename) =>
-              typeof filename === 'string' &&
-              (
-                filename.startsWith('.github/workflows/') ||
-                filename.startsWith('scripts/policy/') ||
-                filename.startsWith('scripts/release/') ||
-                filename === 'test/fixtures/cli-interface-baseline.txt' ||
-                filename === '.goreleaser.yaml' ||
-                filename === 'Makefile'
-              );
-            const protectedPaths = [...new Set(
-              files
-                .flatMap(({ filename, previous_filename }) => [filename, previous_filename])
-                .filter(isProtectedPath)
-            )];
-
-            if (protectedPaths.length > 0) {
-              await setStatus('failure', 'Modifies protected release/CI infrastructure');
-              core.setFailed(
-                'AI-generated PR modifies protected release/CI infrastructure:\n' +
-                protectedPaths.map((filename) => `  - ${filename}`).join('\n') +
-                '\nSplit these changes into a human-owned PR with explicit review.'
-              );
-              return;
-            }
-
-            await setStatus(
-              'success',
-              `Passed with ${files.length} changed files (limit ${maxChangedFiles})`
-            );
-            core.notice(
-              `AI behavior check passed (${files.length} changed files; limit ${maxChangedFiles}).`
-            );

.github/workflows/mirror-to-gitee.yml

@@ -14,6 +14,11 @@ on:
   schedule:
     - cron: '0 18 * * *'
   workflow_dispatch:
+    inputs:
+      sync_release_version:
+        description: "Sync a specific release version's assets to Gitee (e.g. v1.0.55-beta.3)"
+        required: false
+        type: string
 
 concurrency:
   group: gitee-code-mirror
@@ -23,7 +28,6 @@ jobs:
   mirror:
     runs-on: ubuntu-latest
     if: ${{ github.ref_name == github.event.repository.default_branch && github.repository_owner == 'DingTalk-Real-AI' }}
-    # GitHub Actions 不允许在 job-level if 直接引用 secrets，故先用 env 暴露再在 step 守卫。
     env:
       GITEE_TOKEN: ${{ secrets.GITEE_TOKEN }}
       GITEE_USER: ${{ secrets.GITEE_USER }}
@@ -76,3 +80,42 @@ jobs:
           # main 镜像对齐；release tag 由 release.yml 单独校验后创建，禁止在这里 force。
           git push --force "$REMOTE" 'gitee-main:refs/heads/main'
           echo "✅ 已镜像 main（含 Gitee README 本地化）到 Gitee ${GITEE_REPO}"
+
+      - name: Download GitHub Release assets
+        if: ${{ inputs.sync_release_version != '' }}
+        env:
+          VERSION: ${{ inputs.sync_release_version }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -eu
+          echo "📥 Downloading release assets for ${VERSION}"
+          mkdir -p dist
+          gh release download "$VERSION" \
+            --repo "$GITHUB_REPOSITORY" \
+            --dir dist \
+            --pattern 'dws-*' \
+            --pattern 'checksums.txt' \
+            --clobber
+          ls -la dist/
+
+      - name: Verify release artifacts
+        if: ${{ inputs.sync_release_version != '' }}
+        env:
+          VERSION: ${{ inputs.sync_release_version }}
+        run: |
+          set -eu
+          DWS_PACKAGE_DIST_DIR="$GITHUB_WORKSPACE/dist" \
+            ./scripts/release/verify-release-artifacts.sh "$VERSION"
+
+      - name: Sync release assets to Gitee
+        if: ${{ inputs.sync_release_version != '' }}
+        env:
+          VERSION: ${{ inputs.sync_release_version }}
+          GITEE_TOKEN: ${{ secrets.GITEE_TOKEN }}
+          GITEE_USER: ${{ secrets.GITEE_USER }}
+          GITEE_REPO: ${{ secrets.GITEE_REPO }}
+          DIST_DIR: ${{ github.workspace }}/dist
+        run: |
+          set -eu
+          echo "📦 Syncing release assets for ${VERSION} to Gitee ${GITEE_REPO}"
+          ./scripts/release/sync-to-gitee.sh

.github/workflows/multi-profile-e2e.yml

@@ -1,8 +1,9 @@
-name: Multi Profile E2E
+name: Main Integration — 主干集成
 
 on:
-  pull_request:
   push:
+    branches:
+      - main
   workflow_dispatch:
 
 permissions:
@@ -14,7 +15,7 @@ concurrency:
 
 jobs:
   multi-profile-e2e:
-    name: Multi Profile E2E
+    name: Multi-profile E2E
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:
@@ -36,7 +37,7 @@ jobs:
           mkdir -p .tmp-bin
           bash scripts/dev/test-multi-profile-e2e.sh --keep-workdir | tee "$MULTI_PROFILE_E2E_LOG"
           {
-            echo "### Multi Profile E2E"
+            echo "### Multi-profile E2E"
             echo "- Command: \`bash scripts/dev/test-multi-profile-e2e.sh --keep-workdir\`"
             echo "- Scope: isolated auth/profile storage, profile switch/use, one-shot profile override, CSV multi-profile aggregation, legacy migration"
             echo "- Result: passed"

.github/workflows/notify-wukong.yml

@@ -0,0 +1,38 @@
+name: Main Integration — Wukong Overlay
+
+on:
+  workflow_run:
+    workflows:
+      - CI
+    types:
+      - completed
+
+permissions: {}
+
+jobs:
+  notify-downstream:
+    name: Notify Wukong Overlay
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_branch == 'main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Trigger downstream CI
+        env:
+          UPSTREAM_SHA: ${{ github.event.workflow_run.head_sha }}
+          WUKONG_TRIGGER_TOKEN: ${{ secrets.WUKONG_TRIGGER_TOKEN }}
+          WUKONG_TRIGGER_URL: ${{ secrets.WUKONG_TRIGGER_URL }}
+        run: |
+          if [ -n "$WUKONG_TRIGGER_TOKEN" ]; then
+            curl --fail --silent --show-error \
+              -X POST \
+              -F "token=$WUKONG_TRIGGER_TOKEN" \
+              -F "ref=main" \
+              -F "variables[UPSTREAM_SHA]=$UPSTREAM_SHA" \
+              "$WUKONG_TRIGGER_URL"
+            echo "Downstream CI triggered."
+          else
+            echo "No WUKONG_TRIGGER_TOKEN configured, skipping downstream notification."
+          fi

.github/workflows/reviewer-router.yml

@@ -0,0 +1,258 @@
+name: Reviewer routing
+
+on:
+  pull_request_target:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
+
+# pull_request_target deliberately runs only this workflow from the protected
+# base branch. Never check out or execute pull-request code here.
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: reviewer-router-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  route:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Route review and enable auto-merge
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const pullNumber = context.payload.pull_request.number;
+            const eventHeadSha = context.payload.pull_request.head.sha;
+            const reviewerPool = [
+              'sczheng189',
+              'shangguanxuan633-lab',
+              'audanye-sudo',
+              'wxianfeng',
+            ];
+
+            async function getReadyEventPull(phase) {
+              const {data: currentPull} = await github.rest.pulls.get({
+                owner,
+                repo,
+                pull_number: pullNumber,
+              });
+              if (
+                currentPull.head.sha !== eventHeadSha ||
+                currentPull.state !== 'open' ||
+                currentPull.draft ||
+                currentPull.base.ref !== 'main'
+              ) {
+                core.info(
+                  `PR #${pullNumber} state or revision no longer matches this ready-main event during ${phase}; routing stopped.`,
+                );
+                return null;
+              }
+              return currentPull;
+            }
+            const pullRequest = await getReadyEventPull('initial read');
+            if (!pullRequest) {
+              return;
+            }
+            const author = pullRequest.user.login.toLowerCase();
+            const headSha = pullRequest.head.sha;
+            const latestPusher =
+              context.payload.action === 'synchronize'
+                ? context.payload.sender?.login?.toLowerCase()
+                : author;
+
+            async function routeReview() {
+              const eligible = reviewerPool.filter(
+                reviewer =>
+                  reviewer.toLowerCase() !== author &&
+                  reviewer.toLowerCase() !== latestPusher,
+              );
+              if (eligible.length === 0) {
+                core.warning(`No eligible reviewer remains for PR #${pullNumber}.`);
+                return;
+              }
+
+              const alreadyRequested =
+                (pullRequest.requested_reviewers || []).length > 0 ||
+                (pullRequest.requested_teams || []).length > 0;
+              if (alreadyRequested) {
+                core.info(`PR #${pullNumber} already has a requested reviewer; leaving it unchanged.`);
+                return;
+              }
+
+              let reviews;
+              try {
+                reviews = await github.paginate(github.rest.pulls.listReviews, {
+                  owner,
+                  repo,
+                  pull_number: pullNumber,
+                  per_page: 100,
+                });
+              } catch (error) {
+                core.warning(
+                  `Could not inspect existing reviews for PR #${pullNumber}; skipping reviewer routing to avoid a duplicate request (${error.status || 'unknown status'}).`,
+                );
+                return;
+              }
+
+              const latestDecisionByLogin = new Map();
+              for (const review of reviews) {
+                const login = review.user?.login?.toLowerCase();
+                if (
+                  !login ||
+                  !['APPROVED', 'CHANGES_REQUESTED', 'DISMISSED'].includes(
+                    review.state,
+                  )
+                ) {
+                  continue;
+                }
+                const previous = latestDecisionByLogin.get(login);
+                if (!previous || review.id > previous.id) {
+                  latestDecisionByLogin.set(login, review);
+                }
+              }
+              const currentHeadDecision = [...latestDecisionByLogin.values()].find(
+                review =>
+                  review.commit_id === headSha &&
+                  eligible.some(
+                    reviewer =>
+                      reviewer.toLowerCase() ===
+                      review.user.login.toLowerCase(),
+                  ) &&
+                  ['APPROVED', 'CHANGES_REQUESTED'].includes(review.state),
+              );
+              if (currentHeadDecision) {
+                core.info(
+                  `PR #${pullNumber} already has a ${currentHeadDecision.state} review on its current head; leaving review ownership unchanged.`,
+                );
+                return;
+              }
+
+              const loads = new Map(eligible.map(reviewer => [reviewer, 0]));
+              try {
+                const openPullRequests = await github.paginate(github.rest.pulls.list, {
+                  owner,
+                  repo,
+                  state: 'open',
+                  per_page: 100,
+                });
+                for (const openPullRequest of openPullRequests) {
+                  for (const reviewer of openPullRequest.requested_reviewers || []) {
+                    const candidate = eligible.find(
+                      login => login.toLowerCase() === reviewer.login.toLowerCase(),
+                    );
+                    if (candidate) {
+                      loads.set(candidate, loads.get(candidate) + 1);
+                    }
+                  }
+                }
+              } catch (error) {
+                core.warning(
+                  `Could not read current reviewer load; using deterministic rotation (${error.status || 'unknown status'}).`,
+                );
+              }
+
+              const offset = pullNumber % eligible.length;
+              const rotated = eligible.slice(offset).concat(eligible.slice(0, offset));
+              const tieOrder = new Map(rotated.map((reviewer, index) => [reviewer, index]));
+              const staleChangeRequester = [...latestDecisionByLogin.values()]
+                .filter(review => review.state === 'CHANGES_REQUESTED')
+                .sort((left, right) => right.id - left.id)
+                .map(review =>
+                  eligible.find(
+                    reviewer =>
+                      reviewer.toLowerCase() === review.user.login.toLowerCase(),
+                  ),
+                )
+                .find(Boolean);
+              const ranked = [...eligible].sort(
+                (left, right) =>
+                  Number(right === staleChangeRequester) -
+                    Number(left === staleChangeRequester) ||
+                  loads.get(left) - loads.get(right) ||
+                  tieOrder.get(left) - tieOrder.get(right),
+              );
+
+              for (const reviewer of ranked) {
+                try {
+                  const currentPull = await getReadyEventPull('review request');
+                  if (!currentPull) {
+                    return;
+                  }
+                  if (
+                    (currentPull.requested_reviewers || []).length > 0 ||
+                    (currentPull.requested_teams || []).length > 0
+                  ) {
+                    core.info(
+                      `PR #${pullNumber} received a reviewer while routing; leaving it unchanged.`,
+                    );
+                    return;
+                  }
+                  await github.rest.pulls.requestReviewers({
+                    owner,
+                    repo,
+                    pull_number: pullNumber,
+                    reviewers: [reviewer],
+                  });
+                  core.info(
+                    `Requested @${reviewer} for PR #${pullNumber} (open request load: ${loads.get(reviewer)}).`,
+                  );
+                  return;
+                } catch (error) {
+                  core.warning(
+                    `Could not request @${reviewer} for PR #${pullNumber}; trying the next candidate (${error.status || 'unknown status'}).`,
+                  );
+                }
+              }
+
+              core.warning(`No reviewer request could be created for PR #${pullNumber}.`);
+            }
+
+            async function enableAutoMerge() {
+              try {
+                const currentPull = await getReadyEventPull('auto-merge enable');
+                if (!currentPull) {
+                  return;
+                }
+                if (currentPull.auto_merge) {
+                  core.info(`Auto-merge is already enabled for PR #${pullNumber}.`);
+                  return;
+                }
+                await github.graphql(
+                  `mutation EnableAutoMerge($pullRequestId: ID!) {
+                    enablePullRequestAutoMerge(
+                      input: {
+                        pullRequestId: $pullRequestId
+                        mergeMethod: MERGE
+                      }
+                    ) {
+                      pullRequest {
+                        autoMergeRequest {
+                          enabledAt
+                        }
+                      }
+                    }
+                  }`,
+                  {pullRequestId: currentPull.node_id},
+                );
+                core.info(`Enabled native auto-merge for PR #${pullNumber}.`);
+              } catch (error) {
+                core.warning(
+                  `Could not enable auto-merge for PR #${pullNumber}; checks and review can continue normally (${error.message}).`,
+                );
+              }
+            }
+
+            try {
+              await routeReview();
+            } catch (error) {
+              core.warning(
+                `Reviewer routing hit an unexpected error for PR #${pullNumber}; review can still proceed manually (${error.message}).`,
+              );
+            }
+            await enableAutoMerge();

.github/workflows/withdraw-release.yml

@@ -0,0 +1,148 @@
+name: Withdraw release
+run-name: Withdraw ${{ inputs.version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Exact published version to withdraw (vX.Y.Z or vX.Y.Z-beta.N)"
+        required: true
+        type: string
+      reason:
+        description: "Public, single-line withdrawal reason (8-300 characters)"
+        required: true
+        type: string
+      confirmation:
+        description: "Type WITHDRAW followed by a space and the exact version"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+# Share the publication lock with release.yml. A withdrawal and a publication
+# must never mutate channel pointers concurrently.
+concurrency:
+  group: dws-release-publication
+  cancel-in-progress: false
+
+jobs:
+  withdraw:
+    name: Withdraw release from every distribution channel
+    environment: release-withdrawal
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    permissions:
+      actions: read
+      contents: write
+    steps:
+      - name: Verify withdrawal environment protection
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const response = await github.request(
+              "GET /repos/{owner}/{repo}/environments/{environment_name}",
+              { owner, repo, environment_name: "release-withdrawal" },
+            );
+            const reviewerRule = response.data.protection_rules.find(
+              (rule) => rule.type === "required_reviewers",
+            );
+            if (
+              !reviewerRule ||
+              reviewerRule.prevent_self_review !== true ||
+              !Array.isArray(reviewerRule.reviewers) ||
+              reviewerRule.reviewers.length === 0
+            ) {
+              core.setFailed("release-withdrawal must require a reviewer and prevent self-review");
+              return;
+            }
+            if (response.data.deployment_branch_policy?.protected_branches !== true) {
+              core.setFailed("release-withdrawal must allow only protected branches");
+            }
+            if (response.data.can_admins_bypass !== false) {
+              core.setFailed("release-withdrawal must not allow administrator bypass");
+            }
+
+      - name: Require the exact current official default-branch commit
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const expectedRepository = "DingTalk-Real-AI/dingtalk-workspace-cli";
+            const defaultBranch = context.payload.repository.default_branch;
+            if (context.eventName !== "workflow_dispatch") {
+              core.setFailed("release withdrawal accepts workflow_dispatch only");
+              return;
+            }
+            if (`${context.repo.owner}/${context.repo.repo}` !== expectedRepository) {
+              core.setFailed(`release withdrawal is restricted to ${expectedRepository}`);
+              return;
+            }
+            if (context.ref !== `refs/heads/${defaultBranch}`) {
+              core.setFailed(`release withdrawal must be dispatched from ${defaultBranch}`);
+              return;
+            }
+            const branch = await github.rest.git.getRef({
+              ...context.repo,
+              ref: `heads/${defaultBranch}`,
+            });
+            if (branch.data.object.sha !== context.sha) {
+              core.setFailed(
+                `default branch advanced to ${branch.data.object.sha}; re-dispatch from the new head`,
+              );
+            }
+
+      - name: Check out trusted withdrawal tooling
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Node.js for npm channel withdrawal
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Withdraw immutable release and roll back channels
+        id: withdrawal
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITHUB_EVENT_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          WITHDRAW_VERSION: ${{ inputs.version }}
+          WITHDRAW_REASON: ${{ inputs.reason }}
+          WITHDRAW_CONFIRMATION: ${{ inputs.confirmation }}
+          OSS_ACCESS_KEY_ID: ${{ secrets.OSS_ACCESS_KEY_ID }}
+          OSS_ACCESS_KEY_SECRET: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
+          OSS_ENDPOINT: ${{ secrets.OSS_ENDPOINT }}
+          OSS_BUCKET: ${{ secrets.OSS_BUCKET }}
+          OSS_PREFIX: ${{ secrets.OSS_PREFIX }}
+          GITEE_TOKEN: ${{ secrets.GITEE_TOKEN }}
+          GITEE_USER: ${{ secrets.GITEE_USER }}
+          GITEE_REPO: ${{ secrets.GITEE_REPO }}
+          DWS_GITEE_ENABLED: ${{ vars.ENABLE_GITEE_UPLOAD_FALLBACK == 'true' && 'true' || 'false' }}
+          HOMEBREW_PR_TOKEN: ${{ secrets.HOMEBREW_PR_TOKEN }}
+        run: |
+          ./scripts/release/withdraw-release.sh \
+            "$WITHDRAW_VERSION" \
+            "$WITHDRAW_REASON" \
+            "$WITHDRAW_CONFIRMATION"
+
+      - name: Report withdrawal boundary
+        if: ${{ always() }}
+        env:
+          VERSION: ${{ inputs.version }}
+          RESULT: ${{ steps.withdrawal.outcome }}
+        run: |
+          {
+            echo "### Release withdrawal: ${VERSION}"
+            echo
+            echo "- Workflow result: ${RESULT}"
+            echo "- Success means every configured channel was verified and the permanent withdrawn/${VERSION} tombstone remains as the version-reuse barrier."
+            echo "- Failure may occur before or after the tombstone/channel mutations; inspect the failed step and rerun the exact same inputs after fixing the cause."
+            echo "- The problem GitHub Release and original tag are removed after npm and every tag-enabled/configured mirror are rolled back, so GitHub installers stop resolving the bad version while the Homebrew rollback PR is reviewed."
+            echo "- npm is deprecated rather than unpublished; already-installed clients cannot be remotely downgraded."
+            echo "- If a Homebrew rollback PR was opened, this run remains failed until that PR is independently reviewed, merged, and the workflow is rerun."
+          } >> "$GITHUB_STEP_SUMMARY"

.gitignore

@@ -54,3 +54,15 @@ test/dev_functional/results.jsonl
 /coverage-policy.txt
 /coverage.html
 dwsbin
+
+# Local shortcut eval / real-backend capture artifacts — may contain real PII
+# (employee names/emails, userIds, conversation & message IDs). Never commit.
+/docs/shortcut-real-read-results.json
+/docs/shortcut-real-write-results.json
+/docs/shortcut-comparison.html
+/docs/shortcut-gsb-eval.*
+/scripts/run_shortcut_real_read_matrix.py
+
+# Local coverage artifacts
+coverage-shortcut.txt
+coverage-*.txt

CHANGELOG.md

@@ -6,6 +6,198 @@ The format is inspired by [Keep a Changelog](https://keepachangelog.com/) and th
 
 ## [Unreleased]
 
+### Added
+
+- **Shortcut Runtime Schema delivery** — publishes all 210 public built-in shortcuts as reviewed Agent-visible leaf tools across 16 product groups, with stable canonical identities, executable `+shortcut` CLI paths, parameter and cross-parameter constraints, selection guidance, interface metadata, and runtime-aligned safety/confirmation semantics. `dws shortcut list` remains the lightweight batch-discovery view, while leaf Schema now carries the complete Agent contract; declared string-slice defaults are also preserved consistently in Cobra and Schema.
+
+## [1.0.55-beta.4] - 2026-07-27
+
+This beta validates the shortcut projection fixes for group bots, bot search,
+and mail threads, together with hardened release delivery to Gitee and npm on
+top of the `v1.0.55-beta.3` baseline.
+
+### Fixed
+
+- **Shortcut projection fixes** (#795) — `chat +chat-bots` no longer projects a non-empty `list_group_bots` response to an empty list, `+bot-find` recognizes the `search_bots` response shape (`result.bots` entries with `botOpenDingTalkId`), and mail thread listings keep `lastUpdated` when the backend returns `lastModifiedDateTime`.
+
+### Changed
+
+- **Hardened release delivery** — the Gitee mirror workflow can synchronize a specific release's assets on demand, release lookup tolerates Gitee's HTTP 200 null-body response for missing releases, npm dist-tag verification waits through slow registry CDN propagation with incremental backoff, and beta/stable release operations are role-enforced (#791).
+
+## [1.0.55-beta.3] - 2026-07-24
+
+This beta validates the HR Brain command surface, smoother guarded release
+automation, and deterministic Markdown test coverage on top of the
+`v1.0.55-beta.2` baseline.
+
+### Added
+
+- **HR Brain (`dws hrbrain`) command surface** — adds 11 commands across three groups: `talent-pool list/detail/employees` for talent pool browsing, `profile metadata/query/labels/career/performance` for employee profile data, and `search employees/employees-structured/fields` for basic and advanced (rule-based) people search. Ships with bundled mono/multi Skill guidance (`dingtalk-hrbrain`, `cli_version: ">=1.0.54"`); `search employees-structured` validates `--origin-json` as a JSON object and `--fields` as a JSON array before dispatch.
+
+### Changed
+
+- **Smoother guarded releases** — publishes verified stable and beta Homebrew Formula updates directly from the release workflow, retries transient tag-ref visibility failures, lets an exact same-run retry reuse its sealed tag, and allows machine-verified rebuild recovery without a separate approval wait.
+
+### Fixed
+
+- **Deterministic Markdown coverage** — replaces timing-dependent temporary-file deletion tests with synchronized file-stat failures so release admission no longer flakes on scheduler timing.
+
+### Changed
+
+- **Faster guarded releases** — trusts an independently revalidated, exact `CHANGELOG.md`-only successor of an already admitted `main` commit, runs cloud planning alongside governance, and executes sealed-release automation, compatibility, and multi-profile validation in parallel with artifact compilation. Normal cloud publication no longer requires an unshareable local packaging preflight.
+- **Scoped document reads and group mentions** — `doc read --content-format jsonml` can return `outline`, `range`, `section`, or custom-tag fragments with depth and block-boundary controls; document comment create, reply, and update can mention groups through `--mentioned-open-conversation-id`.
+- **Drive overwrite uploads** — `drive upload --node <fileId>` can replace an existing Drive or document-space file, is mutually exclusive with `--folder`, supports dry-run, and requires confirmation before writing.
+- **Chat nickname clearing and cross-organization todos** — omitting `--nick` from `chat group update-nick` now clears the current user's group nickname, while `todo task list --query-all` queries todos across organizations.
+
+### Fixed
+
+- **Legacy authentication compatibility** (#756) — migrates pre-v1.0.53 global and organization-scoped login state into the identity-aware token store, including all legacy organizations, while keeping unresolved accounts isolated from exact `corpId:userId` credentials so external or no-directory identities can complete login without borrowing another user's token.
+
+## [1.0.55-beta.1] - 2026-07-23
+
+This beta validates MCP Market URL resolution, the supported Wukong local-file
+send path after retiring the legacy credential-based media upload command from
+discovery, and reliable message-read rendering for rich content, forwarded
+records, encrypted messages, and media-download ID aliases.
+
+### Added
+
+- **MCP URL resolution** — adds `dws mcp url get <mcpId>` for resolving a DingTalk MCP Market ID to the current user and organization scoped Streamable HTTP URL, while keeping the helper-only `mcp-meta` endpoint out of the public product command surface.
+
+### Changed
+
+- **Chat local-file sending** — hides the open-source-only `chat media upload` compatibility command from Help, Schema, and bundled Skills, and removes its legacy AppKey/AppSecret OAPI path. Historical argv still receives an actionable migration error. Send local images and files through `chat message send --msg-type file --file-path`; callers that already hold a mediaId may continue to use `--msg-type image --media-id`.
+
+### Fixed
+
+- **Shortcut projection silent-empty returns** (#783) — a batch of read shortcuts returned an empty list with exit 0 and no error envelope even when the underlying MCP tool returned data, so agents misread "no data". The projection resolvers now probe the real container keys (`processCodeList`, `values`, `wikiSpaces`, `itemList`, `groupList`, `recentItems`, `emailAccounts`, `deptUserList`, `labelUserList`, `roles`, `report_list`, and the grouped `get_org_labels` `labels[]`), unwrap items nested under a VO wrapper (`shiftVO` / `entityVO` / `userInfo`), and `todo +created-todos` uses the shared pager (`pageSize=20`) because the backend silently returns an empty page for `pageSize>20`. Affects contact/oa/wiki/drive/minutes/calendar/attendance/chat/report/smart shortcuts, each with a guard test asserting the real response shape projects non-empty. `scripts/shortcut_real_result.py` also gains an upper-vs-lower layer comparison so an exit-0 empty projection over a non-empty backend is scored as `projection-data-loss` in the real read-audit path rather than `real-ok`.
+- **Message-read shortcut projection** (#706) — the message-list shortcuts (`chat +chat-messages` / `+messages-list` / `+messages-list-direct` / `+at-me` / `+search-msg` / `+thread-replies`) now render card and out-of-office rich-content JSON as readable text (without ever rewriting ordinary text that merely embeds a JSON fragment), expand a forwarded chat record's nested `forwardMessages` instead of collapsing to a "[卡片]" summary, and mark undecryptable encrypted card messages as `[加密消息]`; the speaker is read from the bare `sender` key, nested `{name:…}` sender objects yield their display name, and the literal string `"null"` is treated as absent. Shared projection helpers now live in `internal/shortcut/chatmsg`. `chat message download-media` also gains `--msg-id` / `--open-message-id` aliases for its `--message-id` flag so agents copying the `openMessageId`/`msgId` output field no longer hit "unknown flag".
+
+## [1.0.54] - 2026-07-21
+
+This release promotes the validated `v1.0.54-beta.2` baseline to stable. It restores the default transport envelope for personal event output with opt-in flattening, plus Schema CLI path and plugin overlay compatibility fixes.
+
+### Changed
+
+- **Personal event output compatibility** (#743) — `event consume` once again preserves the transport envelope by default for `ndjson`/`json`/`pretty`, while retaining the existing `compact` processor. New Agent workflows opt into the event-specific top-level DTO with `--flatten`, which is mutually exclusive with `-f raw` and `--debug-raw-events`; `event schema --flatten` describes that DTO, while the default schema describes `type/event_type/data/headers` and points to `.data | fromjson`.
+
+### Fixed
+
+- **Schema CLI path compatibility** (#738) — user-facing Schema lookups once again accept space-, dot-, and slash-separated CLI paths without weakening strict canonical identity resolution.
+- **Plugin CLI overlays** (#701) — installed plugins register their manifest-authored command trees again for HTTP and stdio servers, and a plugin may now replace a hidden compatibility fallback (for example `conference`) instead of being skipped as a distribution conflict.
+
+## [1.0.54-beta.2] - 2026-07-21
+
+This beta revalidates the same `v1.0.54-beta.1` source through the cloud release path with a sealed `OSS-Mirror: deferred` policy, because the manually tagged `v1.0.54-beta.1` push run failed on the unavailable OSS mirror channel after GitHub and npm delivery.
+
+### Changed
+
+- **Release delivery only** — no source changes since `v1.0.54-beta.1`; see that section for the user-visible changes under validation (#743, #738, #701).
+
+## [1.0.54-beta.1] - 2026-07-21
+
+This beta validates the restored default transport envelope for personal event output with opt-in flattening, plus Schema CLI path and plugin overlay compatibility fixes, on top of the validated `v1.0.53-beta.7` baseline.
+
+### Changed
+
+- **Personal event output compatibility** (#743) — `event consume` once again preserves the transport envelope by default for `ndjson`/`json`/`pretty`, while retaining the existing `compact` processor. New Agent workflows opt into the event-specific top-level DTO with `--flatten`, which is mutually exclusive with `-f raw` and `--debug-raw-events`; `event schema --flatten` describes that DTO, while the default schema describes `type/event_type/data/headers` and points to `.data | fromjson`.
+
+### Fixed
+
+- **Schema CLI path compatibility** (#738) — user-facing Schema lookups once again accept space-, dot-, and slash-separated CLI paths without weakening strict canonical identity resolution.
+- **Plugin CLI overlays** (#701) — installed plugins register their manifest-authored command trees again for HTTP and stdio servers, and a plugin may now replace a hidden compatibility fallback (for example `conference`) instead of being skipped as a distribution conflict.
+
+## [1.0.53] - 2026-07-21
+
+This release promotes the validated `v1.0.53-beta.7` baseline to stable. It adds enterprise onboarding, declarative shortcuts, Sheet/Aitable writes, multi-account profiles, and broader personal IM events, while hardening authentication and the guarded release path.
+
+### Added
+
+- **Enterprise and office command coverage** — adds enterprise creation, employee invitation, and account provisioning commands; 366 declarative service shortcuts; Sheet import commands; and Aitable workflow create/update support with reviewed Schema contracts.
+- **Multiple accounts in one DingTalk organization** — profiles can distinguish accounts by organization and user, select them explicitly, and log out one account or an entire organization without overwriting another account's credentials.
+- **Expanded personal IM event subscriptions** (#651) — adds read-receipt, recall, and reaction events for one-to-one and group chats, plus specified-sender subscriptions by staff ID or OpenDingTalk ID.
+- **Official multi-platform Homebrew channel** — ships separate stable and keg-only beta Formulae for macOS and Linux across amd64 and arm64, with isolated update PRs.
+
+### Changed
+
+- **Personal event output contract** (#651) — `event consume` now emits event-specific top-level structured fields; scripts that consumed the former transport envelope must use the flat fields or select `-f raw`, while `--debug-raw-events` retains the diagnostic envelope.
+- **Guarded release lifecycle** — beta/stable publication now uses explicit promotion, immutable delivery proofs, protected recovery, and tag-bound optional OSS policy; an unprovisioned OSS mirror is sealed as `deferred` so GitHub, npm, and Homebrew are not blocked.
+- **Relaxed stable promotion contract** (#729) — a stable release still requires a delivered, non-withdrawn beta baseline in its commit history, but no longer requires a byte-identical tree with that beta; reviewed commits merged to `main` after the beta can now ship in the stable release. Local releases now accept any sealed commit contained in `main` history and push only the release tag, so `main` is never frozen during the beta-to-stable window.
+
+### Fixed
+
+- **Authentication and credential reliability** — organization-policy denials stop before mutation or polling, long-running clients reload and refresh access tokens consistently, concurrent credential writes are atomic, and Windows portable-auth commands fail before reading or writing unsupported credential bundles.
+- **Command validation and compatibility** — invalid Sheet/task targets fail locally, IM shortcuts preserve AI-tag and alias compatibility, and Aitable import uploads require and forward a positive file size.
+- **Release publication reliability** — GitHub draft publication is bound to one verified release ID and exact assets, preflight uses isolated installer worktrees, guarded local tags remain compatible, cloud planning fingerprints the actual allocated release refs, and npm channel verification waits for bounded registry propagation without moving tags.
+- **Package-manager version verification** (#735) — npm-vendored, Homebrew-installed, and packaged release binaries are now verified by searching their raw bytes for the injected version marker, so a correctly versioned stable binary is no longer rejected when the short version marker coalesces with adjacent printable linker metadata; incorrect or missing markers still fail closed.
+
+## [1.0.53-beta.7] - 2026-07-21
+
+This beta validates bounded npm channel verification after registry publication.
+
+### Fixed
+
+- **npm dist-tag eventual consistency** — Release delivery now tolerates a briefly stale `latest` or `beta` read after publishing by retrying only when npm reports a valid older version. Registry errors, invalid or incomparable tags, and channels that never converge still fail closed without moving any tag during verification.
+
+## [1.0.53-beta.6] - 2026-07-21
+
+This beta validates guarded local release compatibility and tag-bound OSS deferral so an unprovisioned mirror cannot block the primary release channels.
+
+### Changed
+
+- **Tag-bound optional OSS release mirror** — Official cloud Release runs no longer block GitHub, npm, and Homebrew delivery when an OSS bucket has not been provisioned. Cloud tags immutably record `OSS-Mirror: enabled|deferred`; publication, repair, and withdrawal consume that sealed policy instead of the current repository variable. Enabled releases remain fail-closed, while deferred releases skip the nonexistent channel and cannot be backfilled without a future audited repair proof.
+
+### Fixed
+
+- **Guarded local release compatibility** — The tag-push Release workflow now accepts the `Channel`-only annotated tags created by the guarded local release entry while continuing to reject any partial cloud-only seal metadata.
+- **Cloud release tag allocation fingerprint** — Release planning now fingerprints the actual `v*` and `withdrawn/v*` refs fetched from GitHub, matching the seal job's API view instead of hashing an empty non-wildcard ref prefix and rejecting every publish before tag creation.
+
+## [1.0.53-beta.5] - 2026-07-21
+
+This beta validates long-running access-token recovery and the faster, recoverable guarded release path introduced after v1.0.53-beta.4.
+
+### Changed
+
+- **Fast guarded beta and stable releases** — successful local release checks now leave a six-hour proof bound to the exact version, commit, repository identity, remote `main`, and stable baseline, so the subsequent guarded `--publish` invocation revalidates authority without repeating tests and packaging. A default-branch governance smoke uses the same dedicated immutable-release credential as the tag workflow before any tag is allocated.
+- **Protected existing-tag recovery** — `dws-release recover <version>` can resume a failed, unpublished annotated tag through the normal contract, build, Developer ID signing, immutable GitHub Release, Homebrew, npm, and OSS jobs. Recovery requires the exact tag object, peeled commit, failed tag-push run, typed version confirmation, and the protected `release-recovery` environment; successful runs are accepted as future beta/stable delivery evidence.
+
+### Fixed
+
+- **Long-running event authentication recovery** — personal and portal event streams resolve the current access token for every ticket request, refresh a server-rejected token with compare-and-refresh semantics, and reconnect with backoff when refresh is temporarily blocked by network failures, rate limits, or 5xx responses.
+- **Consistent access-token caching and errors** — runtime, recovery, Skill, PAT polling, and personal/portal event clients now resolve user access tokens through one expiry- and publication-aware manager, so long-running processes reload rotated credentials while keychain, refresh, parse, permission, and cancellation failures remain observable instead of being collapsed into “not authenticated.”
+- **Tag-push GitHub Release publication** — Draft publication now locks one GitHub Release database ID, verifies its exact tag, channel, notes, recovery marker, asset set, and uploaded bytes, then publishes and rechecks that same ID as immutable. Recovery runs use the trusted default-branch release helpers instead of the sealed tag's historical scripts, fixing the Draft-only `GET /releases/tags/{tag}` 404 without allowing the release identity to drift during recovery.
+- **Release preflight reliability** — source-mode installer tests now use isolated temporary checkouts and HOME directories instead of overwriting and deleting the real repository `dws` binary, release preflight explicitly rebuilds before policy checks, and the full-suite runner gives the growing script package a non-flaky five-minute per-suite budget.
+
+## [1.0.53-beta.4] - 2026-07-17
+
+This beta validates the expanded personal IM event subscriptions and the flattened `event consume` structured output introduced after v1.0.53-beta.3.
+
+### Added
+
+- **Expanded personal IM event subscriptions** (#651) — adds one-to-one and group events for message read receipts, recalls, and reactions; publishes the specified-sender receive event; and lets one-to-one/sender subscriptions target either a staff `--user` or an `--open-dingtalk-id`. Event Schema now exposes these alternatives through machine-readable parameter constraints.
+
+### Changed
+
+- **Personal event structured output is now flat** (#651) — `event consume` projects NDJSON/JSON/pretty/compact output into event-specific top-level DTOs, so consumers read fields such as `content`, `sender`, and `conversation_id` directly instead of parsing `.data | fromjson`. This is a breaking change for scripts using the former transport envelope; the original server payload remains available through `-f raw`, while `--debug-raw-events` preserves the full diagnostic envelope.
+
+## [1.0.53-beta.3] - 2026-07-17
+
+This beta validates multi-account profile support and the post-v1.0.53-beta.2 compatibility fixes for Windows portable authentication, IM shortcuts, and Aitable import uploads.
+
+### Added
+
+- **Multiple accounts in one DingTalk organization** — profiles are keyed by `corpId:userId`, `--profile` accepts organization IDs/names plus user IDs/names, and organization-only selection uses its explicitly remembered current account or asks for an exact account when ambiguous.
+
+### Changed
+
+- **Profile-scoped logout and consistent token storage** — `dws auth logout --profile` can remove one account or every account in an organization, while identity token slots remain the source of truth and legacy organization/global mirrors stay compatible without overwriting newer account credentials.
+
+### Fixed
+
+- **Windows portable-auth contract** — `dws auth export` and `dws auth import` now fail early without reading credentials, bundles, or writing files instead of claiming portable-bundle support for DPAPI-protected HKCU Registry credentials.
+- **IM shortcut message tags and compatibility aliases** (#646) — IM send shortcuts now add the same AI-sent marker as `chat message send` by default, support `--ai-tag=false` to opt out, and preserve compatible search, conversation-ID, and page-size aliases.
+- **Aitable import upload file-size validation** (#654) — `dws aitable import upload` and `dws aitable +import-upload` now require a positive `--file-size` and always send it to the upload-preparation API, preventing invalid requests without the actual file size.
+
 ## [1.0.53-beta.2] - 2026-07-16
 
 This beta validates the accumulated post-v1.0.52 command surface, release automation, and runtime hardening changes, including enterprise contact onboarding, declarative shortcuts, Sheet/Aitable writes, multi-platform Homebrew formulas, and credential and target-validation fixes.

CONTRIBUTING.md

@@ -27,7 +27,9 @@ notes that are intentionally kept out of the repository root.
 
 ## Local Checks
 
-Run the verification commands that match the surface you changed before you hand work back.
+Run the verification commands that match the surface you changed before you
+hand work back. The goal is useful, change-specific evidence, not a second
+local execution of every CI job.
 
 Common repository checks already used here include:
 
@@ -36,27 +38,63 @@ Common repository checks already used here include:
 ./scripts/policy/check-open-source-assets.sh
 go test ./...
 make test
+make test-plan
 make lint
-bash test/scripts/run_all_tests.sh --jobs 8
 ./scripts/policy/check-generated-drift.sh
 ./scripts/policy/check-command-surface.sh --strict
 ./scripts/release/verify-package-managers.sh
 git diff --check
 ```
 
+Select the PR risk tier before choosing checks:
+
+| Tier | Typical scope | Developer evidence | CI expansion |
+|---|---|---|---|
+| Documentation-only | Prose and documentation assets with no executable, generated, workflow, packaging, or interface change | Links/content/rendering plus repository asset checks | Lightweight documentation validation; all nine named contexts still report |
+| Standard | Ordinary implementation work with a stable package graph | Focused unit/integration tests and observable behavior for the changed path | Race tests for changed packages and their reverse dependencies, scope-matched HEAD/base coverage, and representative Darwin/Windows compilation |
+| High-risk | Workflow/policy, package graph, generated Schema/registry, platform, auth/keychain, installer, packaging, release, transport, recovery, or an unprovable infrastructure change | Relevant full or domain suite plus focused behavior evidence | Complete race suite, native platform tests, and all affected domain gates; protected `main` uses this tier |
+
+Classification fails closed: an incomplete diff, package add/remove/rename, or
+uncertain dependency graph selects the high-risk suite. Native changed-code
+coverage is additionally selected for platform-sensitive code.
+
 ## Pull Request Checklist
 
 1. Keep implementation and tests in sync.
-2. Run `./scripts/dev/ci-local.sh`.
-3. Run `./scripts/policy/check-command-surface.sh --strict` when command paths/flags change. CI also runs `./scripts/policy/check-command-compatibility.sh --base-ref <main-ref> --stable-ref <latest-GA-tag>` against both the target branch and latest stable release.
-4. Run `./scripts/policy/check-generated-drift.sh` when generated artifacts may change.
-5. Run `./scripts/release/verify-package-managers.sh` when packaging or installer surfaces change (run `make package` first).
-6. Update docs and `CHANGELOG.md` for behavior/interface changes.
-7. Include verification evidence in your PR description.
+2. Select the documentation-only, standard, or high-risk tier and run the
+   smallest checks that prove the change. Use `./scripts/dev/ci-local.sh` when
+   a complete local pass is warranted; it is not required for every ordinary
+   PR.
+3. Include both the commands/results and user-visible or contract-level
+   behavior evidence in the PR description.
+4. Run `./scripts/policy/check-command-surface.sh --strict` when command
+   paths/flags change. CI also runs
+   `./scripts/policy/check-command-compatibility.sh --base-ref <main-ref> --stable-ref <latest-GA-tag>`
+   against both the target branch and latest stable release.
+5. Run `./scripts/policy/check-generated-drift.sh` when generated artifacts may
+   change.
+6. Run `./scripts/release/verify-package-managers.sh` when packaging or
+   installer surfaces change (run `make package` first).
+7. Update docs and `CHANGELOG.md` for behavior/interface changes.
 
 ## Submission Flow
 
 1. Make the smallest atomic change that satisfies the task.
 2. Keep doc edits factual and limited to implemented behavior.
 3. Run the relevant verification commands.
-4. Report the validation results with the handoff.
+4. Report the validation results and risk tier with the handoff.
+5. Open a ready PR against `main`. Base-owned automation assigns one eligible
+   peer reviewer, balancing the current open-review load and excluding the
+   author. A new head push re-enters the same routing flow when the latest
+   revision still needs review.
+6. After the latest push has one peer approval and the exact nine required
+   contexts are current and green, auto-merge completes the PR. If `main`
+   advances first, strict status checks revalidate the branch; no separate
+   routine merge request is needed.
+
+Contributors without repository write access stop at the PR flow. Explicitly
+authorized collaborators with `write`, `maintain`, or `admin` access can use
+[Actions → Release](https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/actions/workflows/release.yml)
+to publish beta releases without manual approval. The same internal roles may
+start a stable release, but a different repository administrator must approve
+the `release-stable` Environment deployment before publication continues.

Formula/dingtalk-workspace-cli-beta.rb

@@ -1,33 +1,33 @@
 class DingtalkWorkspaceCliBeta < Formula
   desc "Automate DingTalk workspace tasks from the terminal (beta channel)"
   homepage "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli"
-  version "1.0.53-beta.1"
+  version "1.0.55-beta.4"
   license "Apache-2.0"
   keg_only "it is the beta channel and conflicts with dingtalk-workspace-cli"
 
   on_macos do
     if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.53-beta.1/dws-darwin-arm64.tar.gz"
-      sha256 "7fef5add684189bfef16a1731fab4883fa096115dcd645c79bf9b3918758dbcb"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.55-beta.4/dws-darwin-arm64.tar.gz"
+      sha256 "05b269fe44a125ee8b368d6228c5229950b8216872fb569741d1e30a83ce952a"
     else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.53-beta.1/dws-darwin-amd64.tar.gz"
-      sha256 "8cde0fd62849dcb52bc053022361f983953bd5a4bac1edfc96076a84636debbe"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.55-beta.4/dws-darwin-amd64.tar.gz"
+      sha256 "b0d7604299336c83b7805d3b1a47a90668f2e2f3fc54702b0e846bb2907b6170"
     end
   end
 
   on_linux do
     if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.53-beta.1/dws-linux-arm64.tar.gz"
-      sha256 "17989f94b422d6490249c5e095049a9efc1c3861176fc249d5e7eea283f5e675"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.55-beta.4/dws-linux-arm64.tar.gz"
+      sha256 "a9c1dd5c6171091a84fc18e5081c9f75d037826cd3966726545d715ce832ae31"
     else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.53-beta.1/dws-linux-amd64.tar.gz"
-      sha256 "439d6a1ffc9572ed461b77a8bb27f6ddb4d4c9ce9d58474c0180955fc8a1d8d7"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.55-beta.4/dws-linux-amd64.tar.gz"
+      sha256 "5e97ba398f5a3e15b9d235bc53f596d31a4d6b7af7bb2185b7b48beeda6a2ebb"
     end
   end
 
   resource "skills" do
-    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.53-beta.1/dws-skills.zip"
-    sha256 "a93ba8a73f2e319038a7bcb32038b9e7bd93d1e9af012a430ebf994498c140d4"
+    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.55-beta.4/dws-skills.zip"
+    sha256 "4ebc0294b65d90adb5c5d639a548b528af240e4117ccca3d388e2efb6030170a"
   end
 
   def install

Formula/dingtalk-workspace-cli.rb

@@ -1,32 +1,33 @@
 class DingtalkWorkspaceCli < Formula
   desc "Automate DingTalk workspace tasks from the terminal"
   homepage "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli"
-  version "1.0.52"
+  version "1.0.54"
   license "Apache-2.0"
 
+
   on_macos do
     if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.52/dws-darwin-arm64.tar.gz"
-      sha256 "4f6b4d064a76bcefac42feb5f356253fe43f9499b8cec9d2cdf202e7d3b9b60c"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.54/dws-darwin-arm64.tar.gz"
+      sha256 "8ae0e52cf973f6fb3df61c67a41fd11e2df417a0c815762b6060cbcb5e600c08"
     else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.52/dws-darwin-amd64.tar.gz"
-      sha256 "abc87128f4b98d0a01ea99235449031971db8fa4ce94167403e3b736c4b81e9a"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.54/dws-darwin-amd64.tar.gz"
+      sha256 "11b711b9d70dea62304bf5f8206c56b4e7ea91148dafe97fb7c0f844a2a61da3"
     end
   end
 
   on_linux do
     if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.52/dws-linux-arm64.tar.gz"
-      sha256 "0d357ef0535f99f2f63b5ecbfdee9c32448be2a2c24f3096c03126b3b7570bc5"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.54/dws-linux-arm64.tar.gz"
+      sha256 "9c7ecb4c8cd55644b2faa73f6ce7843c0279b23793e23deb5061692ea71a0cf1"
     else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.52/dws-linux-amd64.tar.gz"
-      sha256 "b7dfd9a4b3489211359261747ed0cb9c8c261434bb762ad3f76df33bdbabd5cb"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.54/dws-linux-amd64.tar.gz"
+      sha256 "8a0bc245747fc3facf98c8103c06da46852a30bff31ac93b0aa874e8c7e46db7"
     end
   end
 
   resource "skills" do
-    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.52/dws-skills.zip"
-    sha256 "0fa3c8dec500c1659e6480d6772ae901b2d12d24322dd5d7283f016024290c21"
+    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.54/dws-skills.zip"
+    sha256 "7450fd0115c75bfe6820c7099f348973d9353cca9d8d647c9cddcd70978a7ec0"
   end
 
   def install
@@ -52,6 +53,7 @@ class DingtalkWorkspaceCli < Formula
     <<~EOS
       Agent Skills are bundled in #{pkgshare}/skills/dws.
       Run `dws skill setup` to install them into your Agent directories.
+
     EOS
   end
 

Makefile

@@ -1,12 +1,14 @@
 GO ?= go
+DWS_PACKAGE_VERSION ?= 0.0.0-test
 REMOTE ?=
 PUBLISH ?= 0
 YES ?= 0
 DWS_POLICY_TMPDIR ?= $(CURDIR)/.worktrees/policy-tmp
 POLICY_GOTMPDIR ?= $(DWS_POLICY_TMPDIR)/go
 POLICY_ENV = DWS_POLICY_TMPDIR="$(DWS_POLICY_TMPDIR)" GOTMPDIR="$(POLICY_GOTMPDIR)"
+GO_SOURCE_LIST = git ls-files -z --cached --others --exclude-standard -- '*.go'
 
-.PHONY: all help build rebuild test lint fmt policy edition-test interface-integrity authoritative-interface-integrity coverage-gate coverage-gate-platform update-interface-baseline reset-interface-baseline schema-compatibility skill-command-integrity cli-smoke mock-mcp-smoke test-schema-agent-examples generate-schema generate-schema-agent-metadata generate-schema-catalog package release release-pre release-stable changelog-pre changelog-stable publish-homebrew-formula setup-hooks
+.PHONY: all help build rebuild test test-plan test-auth-legacy-compat lint format-check fmt policy edition-test interface-integrity authoritative-interface-integrity coverage-gate coverage-gate-platform update-interface-baseline reset-interface-baseline schema-compatibility skill-command-integrity cli-smoke mock-mcp-smoke test-schema-agent-examples generate-schema generate-schema-agent-metadata generate-schema-catalog package release release-pre release-stable changelog-pre changelog-stable publish-homebrew-formula setup-hooks
 
 all: setup-hooks fmt lint build test rebuild
 
@@ -14,13 +16,16 @@ help:
 	@printf "Available targets:\n"
 	@printf "  make build         - Build the dws CLI binary\n"
 	@printf "  make test          - Run the Go test suite\n"
-	@printf "  make lint          - Run formatting checks and golangci-lint when available\n"
-	@printf "  make fmt           - Format Go source files\n"
+	@printf "  make test-plan     - Verify every default Go package belongs to one CI test shard\n"
+	@printf "  make test-auth-legacy-compat - Run stable legacy authentication compatibility regressions\n"
+	@printf "  make lint          - Run formatting checks, go vet, and staticcheck\n"
+	@printf "  make format-check  - Check all repository Go source files with gofmt\n"
+	@printf "  make fmt           - Format all repository Go source files\n"
 	@printf "  make policy        - Check the built dws plus open-source and Schema policies\n"
 	@printf "  make interface-integrity - Check historical commands and help contracts still work\n"
 	@printf "  make authoritative-interface-integrity BASE_REF=<ref> - Check the Git-owned PR merge-base\n"
-	@printf "  make coverage-gate BASE_REF=<ref> - Enforce overall non-regression and changed-code coverage\n"
-	@printf "  make coverage-gate-platform BASE_REF=<ref> PROFILE=<file> - Enforce native-platform changed-code coverage\n"
+	@printf "  make coverage-gate BASE_REF=<ref> - Enforce overall non-regression and 100%% changed-code coverage\n"
+	@printf "  make coverage-gate-platform BASE_REF=<ref> PROFILE=<file> - Enforce 100%% native changed-code coverage\n"
 	@printf "  make update-interface-baseline - Add new CLI contracts without removing history\n"
 	@printf "  make reset-interface-baseline - DANGEROUS: replace all CLI compatibility history\n"
 	@printf "  make schema-compatibility BASE_REF=<ref> - Check the complete Schema contract against the PR merge-base\n"
@@ -34,8 +39,8 @@ help:
 	@printf "  make package       - Build all release artifacts locally\n"
 	@printf "  make changelog-pre VERSION=vX.Y.Z-beta.N - Prepare prerelease notes\n"
 	@printf "  make changelog-stable VERSION=vX.Y.Z FROM_BETA=vX.Y.Z-beta.N - Prepare stable notes\n"
-	@printf "  make release-pre VERSION=vX.Y.Z-beta.N [PUBLISH=1] - Validate or publish prerelease\n"
-	@printf "  make release-stable VERSION=vX.Y.Z FROM_BETA=vX.Y.Z-beta.N [PUBLISH=1] - Validate or publish stable\n"
+	@printf "  make release-pre VERSION=vX.Y.Z-beta.N - Validate prerelease; publish official releases from Actions\n"
+	@printf "  make release-stable VERSION=vX.Y.Z FROM_BETA=vX.Y.Z-beta.N - Validate stable; publish official releases from Actions\n"
 	@printf "  make publish-homebrew-formula - Push dist/homebrew/dingtalk-workspace-cli.rb to a tap repo\n"
 
 build:
@@ -45,15 +50,38 @@ rebuild:
 	@./scripts/dev/build.sh
 
 test:
-	@./test/scripts/run_all_tests.sh
+	@DWS_PACKAGE_VERSION="$(DWS_PACKAGE_VERSION)" $(GO) test -count=1 -timeout=10m ./...
+
+test-plan:
+	@./scripts/ci/test-packages.sh verify
+
+test-auth-legacy-compat:
+	@mkdir -p "$(POLICY_GOTMPDIR)"
+	@GO="$(GO)" $(POLICY_ENV) ./scripts/policy/check-auth-legacy-compat.sh
 
 lint:
 	@./scripts/dev/lint.sh
 
-fmt:
-	@find cmd internal test scripts/policy -name '*.go' -print0 2>/dev/null | xargs -0r gofmt -w
+format-check:
+	@set -eu; \
+	go_files="$$(mktemp "$${TMPDIR:-/tmp}/dws-go-files.XXXXXX")"; \
+	trap 'rm -f "$$go_files"' EXIT HUP INT TERM; \
+	$(GO_SOURCE_LIST) > "$$go_files"; \
+	unformatted="$$(xargs -0 sh -c 'if [ "$$#" -gt 0 ]; then exec gofmt -l -- "$$@"; fi' sh < "$$go_files")"; \
+	if [ -n "$$unformatted" ]; then \
+		printf '%s\n' "$$unformatted"; \
+		printf '%s\n' "Go files are not formatted. Run 'make fmt'." >&2; \
+		exit 1; \
+	fi
 
-policy:
+fmt:
+	@set -eu; \
+	go_files="$$(mktemp "$${TMPDIR:-/tmp}/dws-go-files.XXXXXX")"; \
+	trap 'rm -f "$$go_files"' EXIT HUP INT TERM; \
+	$(GO_SOURCE_LIST) > "$$go_files"; \
+	xargs -0 sh -c 'if [ "$$#" -gt 0 ]; then exec gofmt -w -- "$$@"; fi' sh < "$$go_files"
+
+policy: test-auth-legacy-compat
 	@mkdir -p "$(POLICY_GOTMPDIR)"
 	@$(POLICY_ENV) ./scripts/policy/check-open-source-assets.sh
 	@$(POLICY_ENV) ./scripts/policy/check-schema-command-registry.sh

README.md

@@ -283,16 +283,22 @@ Credentials are securely persisted after first login (Keychain). Subsequent runs
 <details>
 <summary><strong>Multiple organizations (profiles)</strong></summary>
 
-`dws` can stay logged in to several DingTalk organizations at once. Each organization is one **profile**; the current profile decides which org a command runs against (credentials are stored per organization).
+`dws` can stay logged in to several DingTalk accounts at once, including multiple accounts in the same organization. A profile is uniquely identified by `corpId:userId`; the current profile decides which identity a command runs as.
 
 ```bash
-dws auth login                              # log in to another org → adds a profile (first login becomes the primary)
-dws profile list                            # list logged-in orgs (primary / current marker, status)
-dws profile switch <name|corpId>            # switch the default org (use - to toggle back to the previous one)
-dws --profile <name|corpId> contact user search --query "..."   # run one command against a specific org, without changing the default
+dws auth login                              # add or refresh one account
+dws profile list                            # list every logged-in account
+dws profile switch <corpId:userId>          # persistently switch; use - to toggle back
+dws profile switch "<corpName>:<userName>"  # friendly input; names must be unique
+dws --profile <corpId> contact user search --query "..."        # use that org's explicitly recorded current account
+dws --profile <corpId:userId> contact user search --query "..." # use one exact account without changing the default
 ```
 
-Cross-org reads are orchestrated by the agent rather than a built-in `--all-orgs`: list the profiles, run the query per org with `--profile`, then merge. Writes default to the current org only — confirm the target org before writing across orgs.
+Selectors support `corpId:userId`, `corpId:userName`, `corpName:userId`, and `corpName:userName`. Friendly names are input aliases only; use the stable `profile` value returned by `profile list` for automation. Duplicate organization or account names fail with explicit `corpId:userId` candidates. If an organization has multiple accounts but no recorded current account, `--profile <corpId>` fails instead of choosing the first or most recently used account.
+
+`currentProfile`, `previousProfile`, and per-organization defaults are stored as exact identities. `primaryProfile` remains in JSON only for compatibility and is not used for selection. `profile list` reads status and expiry from each real identity Token without refreshing it. `auth logout --profile <corpId>` removes all local accounts in that organization; an exact selector or local profile name removes one account.
+
+Cross-org reads are orchestrated by the agent rather than a built-in `--all-orgs`: list profiles, group by `corpId`, and use the unique `isOrgCurrent=true` account for each organization. If a multi-account organization has no default, ask the user to choose an account first. Writes default to the current account — confirm both organization and account before cross-org writes.
 
 On macOS, an unreadable registered token slot blocks a new OAuth login rather than risking a mixed Keychain/file-DEK state. If normal terminal commands can still read the login while a sandbox using `DWS_DISABLE_KEYCHAIN=1` cannot, migrate the legacy and profile auth entries without exposing tokens:
 
@@ -302,7 +308,7 @@ env -u DWS_DISABLE_KEYCHAIN dws auth migrate-keychain --to file-dek --yes --form
 DWS_DISABLE_KEYCHAIN=1 dws auth status --format json
 ```
 
-The migration validates every selected auth ciphertext before writing, ignores unrelated application secrets, and can be rerun after an interrupted commit. If validation identifies genuinely damaged ciphertext, remove only the affected profile with `dws auth logout --profile <name|corpId>`, then log in again. Use `dws auth reset` only when you intend to discard every local profile.
+The migration validates every selected auth ciphertext before writing, ignores unrelated application secrets, and can be rerun after an interrupted commit. If validation identifies genuinely damaged ciphertext, remove only the affected account with `dws auth logout --profile <corpId:userId>`, or all accounts in one organization with `--profile <corpId>`, then log in again. Use `dws auth reset` only when you intend to discard every local profile.
 
 </details>
 
@@ -323,6 +329,9 @@ dws auth status   # confirm "Refresh Token: valid"
 ```
 
 The bundle includes the encrypted keychain under `~/.local/share/dws-cli` (with `auth-token.enc` and `dek`) plus required `~/.dws` config files.
+Windows export and import are intentionally rejected before credentials or
+bundles are read: Windows stores credentials as DPAPI-protected HKCU Registry
+values, and the current file-DEK bundle has no safe DPAPI-to-portable conversion.
 
 </details>
 
@@ -467,6 +476,8 @@ Env vars: `DWS_SKILL_MODE=mono|multi` (also honored by `install.sh` / `install.p
 
 `dws event consume` subscribes as the currently logged-in user over a managed Stream WebSocket and emits each event as one NDJSON line on stdout. The public catalog currently covers messages that mention the current user, one-to-one messages with a specified user, and messages in a specified group.
 
+The default `ndjson`, `json`, and `pretty` output preserves the transport envelope (`type`, `event_type`, string `data`, and `headers`) for existing scripts; `compact` retains its existing processor. Add `--flatten` to emit the stable top-level business fields used by Agent workflows. `--format` controls JSON serialization; `--flatten` controls the data structure and cannot be combined with `-f raw` or `--debug-raw-events`.
+
 > **Prerequisite**: run `dws auth login`. Personal identity is resolved from the OAuth token and cannot be supplied through command-line identity flags.
 
 For an event-focused installation, use the official convenience installer:
@@ -478,22 +489,27 @@ curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace
 ```bash
 # Inspect the public personal event catalog and schema
 dws event list
-dws event schema user_im_message_receive_o2o
+dws event schema user_im_message_receive_o2o --flatten
 
 # Listen for messages that mention the current user
-dws event consume user_im_message_receive_at -f ndjson
+dws event consume user_im_message_receive_at --flatten -f ndjson
 
 # Listen for one-to-one messages with a specified user
-dws event consume user_im_message_receive_o2o --user <userId> -f ndjson
+dws event consume user_im_message_receive_o2o --user <userId> --flatten -f ndjson
+
+# Listen by openDingtalkId (external contact, bot, or cross-organization identity)
+dws event consume user_im_message_receive_o2o --open-dingtalk-id <openDingtalkId> --flatten -f ndjson
 
 # Listen for messages in a specified group
-dws event consume user_im_message_receive_group --group <openConversationId> -f ndjson
+dws event consume user_im_message_receive_group --group <openConversationId> --flatten -f ndjson
 
 # Inspect local consumers and cancel a subscription
 dws event status
 dws event stop <subscribe_id>
 ```
 
+For one-to-one and specified-sender events, use exactly one target identity: `--user` for an internal `userId`, or `--open-dingtalk-id` for an `openDingtalkId`. The CLI does not infer or convert between these identity types.
+
 | Feature | Details |
 |---------|---------|
 | Managed lifecycle | `consume` creates or reuses the personal subscription; `stop` cancels it and cleans local state |

README_zh.md

@@ -280,16 +280,22 @@ dws auth login --client-id <your-app-key> --client-secret <your-app-secret>
 <details>
 <summary><strong>多组织（profile）</strong></summary>
 
-`dws` 可以同时登录多个钉钉组织。一个组织就是一个 **profile**，当前 profile 决定本次命令操作哪个组织（凭证按组织分别存储）。
+`dws` 可以同时登录多个钉钉账号，同一组织也能保留多个账号。一个 profile 由 `corpId + userId` 唯一确定。
 
 ```bash
-dws auth login                              # 再登录一个组织 → 新增一个 profile（首次登录的为主组织）
-dws profile list                            # 列出已登录组织（主 / 当前标记、状态）
-dws profile switch <名称|corpId>            # 切换默认组织（用 - 切回上一个）
-dws --profile <名称|corpId> contact user search --query "..."   # 单次对指定组织执行，不改默认组织
+dws auth login                              # 新增或刷新一个账号
+dws profile list                            # 列出全部账号，profile 字段是稳定的 corpId:userId
+dws profile switch <corpId:userId>          # 持久切换账号；用 - 切回上一个
+dws profile switch "组织名:用户名"          # 名称输入要求唯一
+dws --profile <corpId> contact user search --query "..."        # 使用该组织明确记录的当前账号
+dws --profile <corpId:userId> contact user search --query "..." # 单次精确指定账号，不改默认账号
 ```
 
-跨组织读取由 agent 编排，而非内置 `--all-orgs`：先 `dws profile list` 拿到组织，再对每个组织带 `--profile` 各查一遍，然后合并。写操作默认只在当前组织进行——跨组织写之前先确认目标组织。
+支持 `corpId:userId`、`corpId:userName`、`corpName:userId`、`corpName:userName`。名称只用于输入，自动化应使用 `profile list` 返回的稳定 `profile`。组织名或用户名重名时会列出候选并报错；同组织多账号但没有明确当前账号时，只传组织也会报错，不会选择第一项或最近使用账号。
+
+`currentProfile`、`previousProfile` 和组织默认账号都保存精确身份。`primaryProfile` 只为 JSON 兼容保留，不再参与选择。`profile list` 直接读取各身份 Token 计算状态和到期时间，不触发刷新。`auth logout --profile <corpId>` 退出该组织全部账号；精确选择器或本地 profile 名只退出一个账号。
+
+跨组织读取由 agent 编排，而非内置 `--all-orgs`：先 `dws profile list`，每个组织使用唯一的 `isOrgCurrent=true` 账号；若多账号组织没有默认账号，先让用户指定账号。写操作默认只在当前账号执行——跨组织写之前先确认目标组织和账号。
 
 macOS 下，如果已登记的 token slot 无法解密，为避免把系统 Keychain 和 file-DEK 写成混合状态，新的 OAuth 登录会直接拒绝。如果普通终端仍能读取登录态、只有设置 `DWS_DISABLE_KEYCHAIN=1` 的沙箱读不到，可在不暴露 token 的情况下迁移 legacy 与各 profile 的认证条目：
 
@@ -299,7 +305,7 @@ env -u DWS_DISABLE_KEYCHAIN dws auth migrate-keychain --to file-dek --yes --form
 DWS_DISABLE_KEYCHAIN=1 dws auth status --format json
 ```
 
-迁移会先验证全部认证密文再写入、忽略无关的应用密钥；提交中断后可安全重跑。如果预检确认是密文本身损坏，报错会给出对应 `corpId`；只清理这个组织可执行 `dws auth logout --profile <名称|corpId>`，再重新登录。只有确认要丢弃全部本地 profile 时才用 `dws auth reset`。
+迁移会先验证全部认证密文再写入、忽略无关的应用密钥；提交中断后可安全重跑。如果预检确认是密文本身损坏，优先使用 `dws auth logout --profile <corpId:userId>` 只清理受影响账号；只有确认要丢弃全部本地 profile 时才用 `dws auth reset`。
 
 </details>
 
@@ -464,6 +470,8 @@ DWS_SKILL_SOURCE=/path/to/skills dws skill setup --mode multi
 
 `dws event consume` 使用当前 OAuth 登录用户建立托管的 Stream WebSocket 长连接，并把每条事件以 NDJSON 一行输出到 stdout。当前公开目录包括：当前用户被 @ 的消息、与指定用户的单聊消息、指定群的消息。
 
+默认 `ndjson`、`json`、`pretty` 输出保留兼容 transport envelope（`type`、`event_type`、字符串 `data`、`headers`），`compact` 继续沿用原 processor。Agent 或新脚本显式加 `--flatten` 后，输出稳定的顶层业务字段。`--format` 控制 JSON 序列化，`--flatten` 控制数据结构，且不能与 `-f raw` 或 `--debug-raw-events` 同时使用。
+
 > **前置条件**：先运行 `dws auth login`。个人身份从 OAuth token 解析，不允许通过命令行伪造。
 
 只需要 event 能力时，可以使用官方便捷安装脚本：
@@ -475,22 +483,27 @@ curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace
 ```bash
 # 查看公开个人事件目录和 schema
 dws event list
-dws event schema user_im_message_receive_o2o
+dws event schema user_im_message_receive_o2o --flatten
 
 # 监听当前用户被 @ 的消息
-dws event consume user_im_message_receive_at -f ndjson
+dws event consume user_im_message_receive_at --flatten -f ndjson
 
 # 监听与指定用户的单聊消息
-dws event consume user_im_message_receive_o2o --user <userId> -f ndjson
+dws event consume user_im_message_receive_o2o --user <userId> --flatten -f ndjson
+
+# 使用 openDingtalkId 监听外部联系人、机器人或跨组织身份
+dws event consume user_im_message_receive_o2o --open-dingtalk-id <openDingtalkId> --flatten -f ndjson
 
 # 监听指定群的消息
-dws event consume user_im_message_receive_group --group <openConversationId> -f ndjson
+dws event consume user_im_message_receive_group --group <openConversationId> --flatten -f ndjson
 
 # 查看本地 consume，并取消指定订阅
 dws event status
 dws event stop <subscribe_id>
 ```
 
+单聊和指定发送人事件必须且只能选择一种目标身份：企业内部 `userId` 使用 `--user`，`openDingtalkId` 使用 `--open-dingtalk-id`。CLI 不会自动猜测或转换身份类型。
+
 | 特性 | 说明 |
 |------|------|
 | 自动编排 | `consume` 创建或复用个人订阅，`stop` 取消订阅并清理本地状态 |

docs/architecture.md

@@ -43,3 +43,51 @@
 - `skills/`: bundled agent skills (mono/ and multi/ layouts)
 - `test/`: CLI, integration, contract, unit, and skill E2E tests
 - `scripts/`: install scripts, policy checks, and CI helpers
+
+## Quality Pipeline
+
+Quality enforcement is layered so a pull request receives fast, deterministic
+admission feedback without pretending that downstream integration has already
+run.
+
+```mermaid
+flowchart TB
+  PR["Pull request"] --> CLASSIFY["Fail-closed risk classification"]
+  CLASSIFY --> DOCS["Documentation-only<br/>asset/content validation"]
+  CLASSIFY --> STANDARD["Standard<br/>affected + reverse-dependent race<br/>scope-matched HEAD/base coverage"]
+  CLASSIFY --> HIGH["High-risk / main<br/>full race + native tests"]
+  DOCS --> CA["CI"]
+  STANDARD --> CA
+  HIGH --> CA
+  subgraph CA_CHECKS["Nine required contexts"]
+    L["Lint"]
+    T["Test"]
+    C["Coverage"]
+    P["Policy"]
+    E["Edition"]
+    I["Interface Integrity"]
+    A["AI Behavior"]
+    S["CLI Smoke"]
+    M["Mock MCP"]
+  end
+  CA --> CA_CHECKS
+  CA_CHECKS --> MAIN["Protected main"]
+  MAIN --> MP["Main Integration — 主干集成<br/>Multi-profile E2E"]
+  MAIN --> PLATFORM["Risk-selected / release native platform validation"]
+  MP --> RELEASE["Release delivery"]
+  PLATFORM --> RELEASE
+```
+
+All nine named contexts are produced for every tier. Domain-specific helpers
+run when their owned surface is affected; otherwise the corresponding context
+records an explicit unaffected success. Standard code changes still receive
+representative Darwin/Windows compilation. High-risk PRs and protected `main`
+run the complete race and native test suites, while platform-sensitive diffs
+also receive native changed-code coverage.
+
+Review orchestration is also base-owned: it requests one eligible peer without
+executing PR code, re-routes an updated head when needed, and auto-merge
+completes only after the latest push has peer approval plus the current
+revision's nine strict contexts. Complete Multi-profile E2E remains downstream
+of PR admission. See [`docs/ci-pr-gates.md`](ci-pr-gates.md) for the exact
+classification, context, reviewer, and ruleset contract.

docs/automation.md

@@ -62,23 +62,73 @@ make lint
 git diff --check
 ```
 
-## Homebrew Formula PR Automation
+## Homebrew Formula Delivery
 
-Official tag releases require the repository Actions secret
-`HOMEBREW_PR_TOKEN`. The `DingTalk-Real-AI` organization currently does not
-allow fine-grained personal access tokens to target this repository, so use a
-classic personal access token owned by a maintainer or release-bot account with
-only the `public_repo` scope. Do not reuse a broad developer token.
+Official releases use the Release workflow's built-in `GITHUB_TOKEN` to update
+exactly one tracked Formula after the immutable GitHub assets and their
+checksums have passed verification. The publisher validates the rendered Ruby,
+commits only the configured Formula path, never force-pushes `main`, and retries
+from a fresh clone up to three times when `main` advances concurrently. Normal
+stable and beta releases do not create a Formula PR or run a permission
+canary. The workflow uses the existing repository-scoped
+`HOMEBREW_PR_TOKEN` release identity because GitHub does not allow its built-in
+Actions App to bypass this repository's rulesets. That identity is the sole
+user bypass actor on the two default-branch rulesets. The workflow creates the
+nine Code Admission checks for the Formula-only commit only after proving its
+sole parent already has all nine successful checks and the committed Formula
+exactly matches this release's verified bytes.
 
-Store the non-expiring token as the `HOMEBREW_PR_TOKEN` repository Actions
-secret. Replace it immediately if it is exposed, its owner loses repository
-access, or the release-bot ownership changes. The Release workflow uses this
-dedicated token only to push an `automation/homebrew-*` branch and open the
-stable or beta Formula PR. It does not push Formula changes directly to `main`.
-No maintainer environment variable is required when creating a tag. Using the
-built-in `GITHUB_TOKEN` is insufficient because organization policy prevents
-Actions from creating pull requests, and its generated PR events may require
-separate workflow approval.
+Keep `HOMEBREW_PR_TOKEN` repository-scoped with `Contents: write` and
+`Pull requests: write` (the latter remains necessary for withdrawal rollback),
+keep its owner as the designated ruleset bypass actor, and do not reuse
+`RELEASE_GOVERNANCE_TOKEN`. The workflow and publisher provide the Formula-only
+path restriction; GitHub rulesets do not infer that restriction from the token.
+
+## Release Governance and Recovery
+
+Store `RELEASE_GOVERNANCE_TOKEN` as a dedicated Actions secret with only
+repository `Administration: read`. The immutable-releases REST endpoint is an
+administration setting and cannot be read by the workflow's built-in
+`GITHUB_TOKEN`. Both the default-branch governance preflight and the tag
+contract use this same credential so a missing or expired identity is detected
+before an irreversible tag is created.
+
+Recovery is restricted to an existing annotated tag whose exact tag object,
+commit, sealed metadata, original failed run/attempt, requester identity and
+Release state all match; it then reuses the normal release jobs without a
+second-person environment approval. A same-run “Re-run failed jobs” is even
+lighter: the seal job may adopt an existing tag only when its complete
+authority matches that run and its original attempt is not newer than the
+current attempt. Do not put publication secrets in temporary branches or
+create ad-hoc recovery workflows.
+
+Cloud-sealed releases mirror to OSS only when the repository variable
+`ENABLE_OSS_MIRROR` is exactly `true`. Leave the variable unset while no Bucket
+is provisioned; GitHub, npm, and Homebrew delivery can then complete without
+running the OSS step. Once enabled, missing credentials, an invalid Bucket, or
+an upload failure remains fail-closed. The cloud tag immutably records the
+decision as `OSS-Mirror: enabled|deferred`; publication and withdrawal consume
+that sealed value instead of the variable's later state. Deferred releases
+cannot use `repair_oss_version`; enabling OSS applies to later release tags
+until an audited immutable repair marker is implemented.
+
+If an immutable GitHub Release and npm package were delivered but an enabled
+downstream China mirror failed, dispatch the normal `Release` workflow from the
+protected default branch with exactly one of `repair_gitee_version` or
+`repair_oss_version`. Channel repair accepts a fully successful exact release,
+or a failed exact-tag run only when its latest attempt completed the release
+contract, build, Apple signature, immutable GitHub publication, and npm
+delivery checks for the exact tagged commit. OSS repair additionally requires
+the tag's sealed policy to be `enabled`. It then downloads and re-verifies the
+immutable assets before invoking only the selected mirror. For a failed
+release, an OSS repair requires the OSS step itself to be the recorded failure.
+A Gitee repair accepts either a failed Gitee job or a Gitee job that was
+skipped behind that OSS failure; the latter is an explicit Gitee backfill and
+does not claim that OSS has been repaired. Gitee repair requires `GITEE_TOKEN`,
+`GITEE_USER`, and `GITEE_REPO`; OSS repair requires `OSS_ACCESS_KEY_ID`,
+`OSS_ACCESS_KEY_SECRET`, `OSS_ENDPOINT`, and `OSS_BUCKET` (with optional
+`OSS_PREFIX`) as Actions secrets. Missing credentials fail the selected repair
+closed.
 
 ## Handoff Checklist
 

docs/ci-pr-gates.md

@@ -1,119 +1,218 @@
-# Pull request quality gates
+# CI — PR 合入门禁
 
-The repository defines five focused checks in addition to its existing CI:
+The pull-request admission layer has exactly nine required external contexts:
 
-- **Interface Integrity** enforces backwards compatibility. Every historical
-  command path and alias must still resolve, every historical command must
-  still render `-h`, and historical flags must keep their type and shorthand.
-  New commands, aliases, and flags are allowed. The same job compares the full
-  complete `dws schema --all` contract with the PR merge-base, blocking removed
-  products/tools/parameters, incompatible parameter or interface mappings,
-  constraint drift, and safety-semantic drift. It also checks that executable
-  `dws ...` references in `skills/**/*.md` resolve to real commands.
-  Help compatibility covers command/alias/flag spelling, flag type and
-  shorthand; descriptive prose may evolve without breaking the gate.
-- **Coverage** runs unit tests on every pull request and prints both overall and
-  changed-code statement coverage. During the migration to the 80% repository
-  target, overall coverage may not regress from a profile generated from the
-  merge-base with the same test command, while changed production Go
-  statements must meet 80%. Linux, Windows, and macOS each generate a native
-  coverage profile for changed packages and enforce the threshold against
-  changed files buildable on that platform, so build-tagged source cannot be
-  hidden by an Ubuntu-only profile. Overall non-regression allows 0.1 percentage point of measurement
-  variance to avoid failing unchanged code on test-path noise. Set
-  `COVERAGE_ENFORCE_OVERALL=true` once repository coverage reaches 80% to make
-  the overall target fail closed as well.
-- **CLI Smoke** builds the release binary, reads the root command list from the
-  structured Interface contract, and renders offline help for every public
-  top-level command. It rejects Cobra's unknown-command root-help fallback and
-  fails when the checked-in development fixture is stale.
-- **Mock MCP Smoke** runs the existing HTTP and stdio MCP lifecycle tests
-  (`Initialize -> ListTools -> CallTool`).
-- **AI Behavior Check** applies to pull requests labeled `ai-generated`. It
-  limits the change to 30 files and blocks release/CI infrastructure changes,
-  including policy implementations and the checked-in Interface fixture.
-  It uses `pull_request_target` without checking out PR code, so the policy
-  cannot be bypassed by changing the workflow in the same pull request. The
-  evaluator writes an `AI Behavior Check` commit status to the PR head SHA so
-  GitHub rulesets can require it.
+| Required context | Contract |
+|---|---|
+| `Lint` | Stable PR revision/risk classification plus applicable formatting, `go vet`, and Actionlint |
+| `Test` | Tier-selected race/unit/release-script tests plus representative cross-platform compilation |
+| `Coverage` | Scope-matched overall non-regression and 100% changed-code coverage |
+| `Policy` | Repository policy and the fail-closed CHANGELOG contract |
+| `Edition` | Edition contract tests |
+| `Interface Integrity` | CLI, Schema, Skill, and stable-release compatibility |
+| `AI Behavior` | Base-owned policy for PRs labeled `ai-generated` |
+| `CLI Smoke` | Offline help for every public top-level command |
+| `Mock MCP` | HTTP and stdio MCP lifecycle smoke tests |
 
-## Running the compatibility gates
+The workflow display name is `CI`. Parallel helper
+jobs may implement `Test` and `Coverage`, but they are not ruleset contexts.
+Do not require an aggregate alias or a downstream integration check in place of
+the nine contracts above.
 
-Run:
+`AI Behavior` is evaluated by a `pull_request_target` workflow that never
+checks out or executes PR code. It writes the exact `AI Behavior` status to the
+current PR head. Its Files API read is bracketed by base/head revision checks,
+so a synchronize race fails closed. The same workflow supplies a successful
+`AI Behavior` check run on protected `main` pushes for release governance.
+
+## Exact CHANGELOG-only fast path
+
+A pull request qualifies only when GitHub reports exactly one changed file,
+that file is an in-place modification of `CHANGELOG.md`, and the base and head
+both retain it as a regular non-executable `100644` blob. Add, delete, rename,
+symlink, executable-mode, and second-file changes do not qualify.
+
+`Lint` classifies the Files API result only after verifying that the API's base
+and head equal the event revision both before and after pagination. `Policy`
+checks out GitHub's PR merge ref and verifies its parents:
+
+```text
+HEAD^1 = pull_request.base.sha
+HEAD^2 = pull_request.head.sha
+```
+
+It then runs:
+
+```sh
+./scripts/policy/check-changelog-pr.sh \
+  --fast-path "$PR_BASE_SHA" HEAD
+```
+
+Because the verified PR diff contains only `CHANGELOG.md`, the validator and
+its policy dependencies in that merge tree are byte-for-byte the current base
+versions. Validation targets the synthetic merge tree, not the feature-branch
+tree, so a stale branch cannot supply an older validator or combine with newer
+base notes into an invalid final CHANGELOG.
+
+All nine admission contexts are still emitted and must succeed. Expensive
+implementation helpers are skipped; the named contexts record that their code
+surface is unaffected.
+
+The protected `main` push keeps that fast path only when all of these
+fail-closed conditions hold:
+
+- the event is a non-forced update of the existing `refs/heads/main`;
+- the event `after` SHA is the exact workflow SHA, and both event SHAs are
+  complete, non-zero commit IDs;
+- GitHub's comparison reports the previous main tip as the unique linear merge
+  base, with no commits behind it;
+- the complete resulting tree diff is exactly one in-place modification of
+  `CHANGELOG.md`;
+- the previous main tip already has successful GitHub Actions checks for all
+  nine Code Admission contexts.
+
+`Policy` then independently checks out the pushed revision and runs the same
+`check-changelog-pr.sh --fast-path` contract from the event's `before` SHA to
+its `after` SHA. If identity, ancestry, file scope, tree mode, CHANGELOG
+content, or predecessor admission cannot be proved, classification falls back
+to the complete main admission suite. A source change can therefore never
+inherit the CHANGELOG-only result.
+
+Any PR that touches `CHANGELOG.md` but also changes another file runs the same
+content contract in `Policy` with `--content-only`. That mode permits the
+second file but still rejects invalid dates or versions, missing bullets,
+placeholder `TODO`/`TBD`, unmanaged-section changes, and unsafe tree modes.
+Adding a second file therefore cannot bypass CHANGELOG validation.
+
+## Risk tiers and downstream boundaries
+
+`Lint` resolves the complete base/head diff before any helper is skipped.
+Unknown or truncated input fails closed into the high-risk tier.
+
+| Tier | Selection | Admission work |
+|---|---|---|
+| Documentation-only | Only prose/documentation assets; no executable, generated, workflow, packaging, or interface surface | Documentation and repository-asset validation; expensive code helpers skip while every required context still succeeds |
+| Standard | Ordinary code change with a stable package graph | Race tests for changed Go packages and their reverse dependencies; candidate and merge-base coverage over the same impacted scope and `coverpkg`; representative Darwin/Windows compilation |
+| High-risk / protected `main` | Workflow/policy, package add/remove/rename, generated Schema/registry, platform, auth/keychain, installer, packaging, release, transport, recovery, or an unprovable infrastructure classification | Complete race suite and full native macOS/Windows tests, plus every affected domain gate |
+
+Domain helpers (`Edition`, `Interface Integrity`, `CLI Smoke`, and `Mock MCP`,
+for example) execute their substantive suites when the diff can affect that
+contract or when the high-risk tier is selected. Otherwise their stable named
+contexts still report a successful, explicit unaffected result. Release-script
+tests follow the same impact rule. This preserves the ruleset contract without
+charging every developer for unrelated work.
+
+Platform-sensitive changes additionally run native changed-code coverage.
+Protected `main` always runs native tests; generic portable changes are held to
+the Linux changed-code gate rather than being forced to manufacture
+platform-only coverage.
+
+Complete `Multi-profile E2E` is not a PR admission context. It belongs to the
+`Main Integration — 主干集成` workflow and runs only after a push to `main` (or
+an explicit manual dispatch). A failing downstream run remains a real
+regression and must be repaired, but it must not be represented by a synthetic
+successful PR check.
+
+```mermaid
+flowchart TB
+  PR["Pull request"] --> ADMISSION["CI"]
+  ADMISSION --> L["Lint"]
+  ADMISSION --> T["Test"]
+  ADMISSION --> C["Coverage"]
+  ADMISSION --> P["Policy"]
+  ADMISSION --> E["Edition"]
+  ADMISSION --> I["Interface Integrity"]
+  ADMISSION --> A["AI Behavior"]
+  ADMISSION --> S["CLI Smoke"]
+  ADMISSION --> M["Mock MCP"]
+  ADMISSION --> MAIN["Protected main"]
+  MAIN --> NATIVE["Full native platform matrix"]
+  MAIN --> E2E["Multi-profile E2E"]
+  MAIN --> RELEASE["Release delivery"]
+```
+
+## Review ownership and auto-merge
+
+A base-owned `pull_request_target` workflow routes newly opened, updated,
+reopened, or newly ready PRs targeting `main` to one eligible peer reviewer. It
+does not check out or execute PR code, excludes both the author and the known
+latest pusher, and balances the open requested-review load across the reviewed
+maintainer pool. A current-head approval or change request is preserved; after
+a new push, stale activity does not suppress a fresh request, and an
+outstanding change requester is preferred for continuity.
+
+The branch ruleset keeps one human approval and all nine strict required
+contexts, and requires someone other than the latest pusher to approve after
+the most recent head update. Repository auto-merge is enabled for ready PRs,
+so a PR merges after that approval and the current revision's nine checks are
+green. If `main` advances, strict checks rerun before merge. The reviewer
+router is orchestration, not a quality context, and must not be added to the
+ruleset.
+
+## Running focused gates locally
+
+Run the contracts relevant to the change. Ordinary contributors are not
+expected to repeat every CI job locally:
 
 ```sh
 make build
+make policy
 make interface-integrity
 make authoritative-interface-integrity BASE_REF=<merge-base>
 make schema-compatibility BASE_REF=<merge-base>
 make skill-command-integrity
 make cli-smoke
-# Run on the corresponding native runner with its generated profile:
-make coverage-gate-platform BASE_REF=<merge-base> PROFILE=<coverage-profile>
+make mock-mcp-smoke
+go test -v -count=1 ./pkg/editiontest/...
 ```
 
-`make coverage-gate` is the enforcement step, not a profile generator. It
-expects the candidate, policy, and merge-base profiles (`coverage.txt`,
-`coverage-policy.txt`, and `coverage-base.txt`) produced by the preceding CI
-steps. A clean local checkout can reproduce the Linux/overall CI gate with:
+For an exact CHANGELOG-only branch:
 
 ```sh
 base_ref=$(git merge-base HEAD origin/main)
-root=$(pwd)
-base_worktree=$(mktemp -d "${TMPDIR:-/tmp}/dws-coverage-base.XXXXXX")
-rmdir "$base_worktree"
-cleanup() { git worktree remove --force "$base_worktree" >/dev/null 2>&1 || true; }
-trap cleanup EXIT HUP INT TERM
-
-go test -count=1 -coverprofile=coverage.txt -covermode=atomic \
-  ./ ./cmd/... ./internal/... ./skills/...
-go test -count=1 -coverprofile=coverage-policy.txt -covermode=atomic \
-  ./pkg/... ./scripts/policy/...
-git worktree add --detach "$base_worktree" "$base_ref"
-(
-  cd "$base_worktree"
-  go test -count=1 -coverprofile="$root/coverage-base.txt" -covermode=atomic \
-    ./ ./cmd/... ./internal/... ./skills/...
-)
-make coverage-gate BASE_REF="$base_ref"
+./scripts/policy/check-changelog-pr.sh --fast-path "$base_ref" HEAD
 ```
 
-The native-platform target likewise expects `PROFILE` to have already been
-generated on that operating system. CI owns those generation steps; copying
-only either enforcement command into a clean checkout is intentionally an
-incomplete invocation.
+`make coverage-gate` is an enforcement step, not a profile generator. For a
+standard PR, CI derives changed packages and their reverse-dependency test
+closure, then generates candidate and merge-base profiles with the same test
+scope and `coverpkg`. High-risk and protected-main runs use the complete
+profiles. Supporting and (when platform-selected) native profiles are
+generated before the aggregate `Coverage` context evaluates them. The
+aggregate and native gates require 100% coverage for changed executable Go
+statements. Overall coverage remains an unrounded, zero-tolerance,
+scope-matched merge-base non-regression check. Candidate and baseline profiles
+are evaluated by the same block-deduplicating checker; supporting policy and
+shortcut profiles contribute to changed-code coverage only. The checked-in
+badge is presentation only and is never read as a gate input.
 
-CI derives the authoritative Interface snapshots from both the PR merge-base
-and the latest reachable stable release tag. The complete Schema snapshot comes
-from the PR merge-base, which contains the registry-first Schema introduced on
-`main`. The candidate branch cannot bless a breaking change by editing a
-fixture. Schema additions are allowed; historical products, tools, parameters,
-parameter mappings, positional execution fields, constraints, and safety
-semantics remain protected. Positional descriptions are documentation and may
-change without breaking compatibility.
-
-`make update-interface-baseline` still extends the local checked-in Interface
-fixture used by `make interface-integrity`. Updates are monotonic: they add new
-commands and flags without removing history.
-
-For an intentional compatibility reset at a major-version boundary, run
-`make reset-interface-baseline`. This replaces all CLI compatibility history
-with the current command tree and must receive explicit human review.
+Compatibility checks derive authoritative Interface snapshots from the PR
+merge-base and the latest reachable stable release. The candidate cannot bless
+a breaking change by editing a fixture. Schema additions are allowed;
+historical products, tools, parameters, mappings, positional execution fields,
+constraints, and safety semantics remain protected.
 
 ## Required GitHub repository settings
 
-Create a ruleset for `main` that requires pull requests and code-owner review,
-then mark these aggregate status checks as required:
+The `main` quality ruleset must enable strict required-status-check policy
+(`strict_required_status_checks_policy=true`) so a PR is revalidated whenever
+`main` advances. It must require these exact contexts and no legacy aliases:
 
-- `CI Gate`
-- `Multi Profile E2E`
-- `AI Behavior Check`
+- `Lint`
+- `Test`
+- `Coverage`
+- `Policy`
+- `Edition`
+- `Interface Integrity`
+- `AI Behavior`
+- `CLI Smoke`
+- `Mock MCP`
 
-`CI Gate` fails closed unless every first-layer CI job succeeds, including
-lint, tests, native Linux/Windows/macOS coverage, policy,
-Interface/Schema/Skill integrity, and smoke tests. Requiring the aggregate
-check keeps repository rules stable when an internal job is renamed or split.
+Do not require helper jobs, `Multi-profile E2E`, or an aggregate admission
+alias. Update ruleset contexts only after the new names have appeared on the
+protected branch, so a rename cannot silently remove enforcement or leave an
+unproducible required context.
 
-The `ai-generated` label must be applied by the PR-creation automation or by a
-maintainer; GitHub cannot infer reliably whether a human-authored PR contains
-AI-generated code.
+The branch ruleset also requires one approval after the latest push. Enable
+repository auto-merge and automatic head-branch deletion; keep the base-owned
+reviewer router outside the required-context list.

docs/event-subprocess-contract.md

@@ -1,10 +1,8 @@
 # Event consume — AI subprocess contract
 
-Aligns `dws event consume` with the "AI subprocess contract" that
-`lark-cli event consume` exposes, so any orchestrator (Claude Code's
-Monitor, a bash bridge, systemd, an agent plugin) can drive it with zero
-ambiguity: know when it is ready, stop it cleanly, and machine-read why it
-exited.
+Defines the stable `dws event consume` subprocess contract so an
+orchestrator can determine when the consumer is ready, stop it cleanly,
+and machine-read why it exited.
 
 Scope of this branch: the four **contract** items below. Reconnect
 resilience (keeping the stream alive across a transient upstream drop) is
@@ -16,7 +14,6 @@ tracked separately and intentionally out of scope here.
 - `--duration D` — wall-clock budget (exit 0). Kept as `--duration`, NOT
   aliased to `--timeout`: the global `--timeout` is the HTTP request
   timeout (int seconds) and would collide (different type and meaning).
-  Docs note the lark-cli name difference.
 - Bus idle-shutdown fires only with **zero** consumers, so a connected
   consumer is never idle-killed.
 - SIGINT/SIGTERM already cancel the run context and return cleanly.
@@ -28,7 +25,7 @@ tracked separately and intentionally out of scope here.
 On connect, emit a fixed stderr line **before** any stdout event:
 
 ```
-[event] ready event_key=<key> bus_pid=<pid>
+[event] ready event_key=<key> bus_pid=<pid> subscribe_id=<id>
 ```
 
 Parents block on stderr until this line, then read stdout. Suppressed
@@ -75,7 +72,7 @@ or runtime failure (permissions, network, params) = non-zero, with no
 
 ### 4. Cleanup on exit (no `kill -9`)
 
-Ownership-based, matching lark-cli:
+Ownership-based cleanup:
 - If this run **created** the subscription (no `--subscribe-id`), a clean
   exit (SIGTERM / SIGINT / stdin-EOF / limit / timeout) **unsubscribes**
   it server-side and sends Bye.

docs/releasing.md

@@ -1,10 +1,63 @@
 # 发布手册（预发 / 正式）
 
-发布只走一条链路：本地脚本负责封板、验证并推送 annotated tag；GitHub Actions 负责构建和发布最终产物。不要直接运行 `goreleaser release`，也不要手工补打或移动 tag。
+发布只走一条受控链路：GitHub Actions 的 `Release` workflow 负责版本分配、封板、构建、签名和下游发布；Homebrew Formula 在不可变 Release 资产及 checksum 通过校验后，由同一 workflow 直接写入 `main`，不再创建二次 PR。本地 `dws-release` 仍是兼容入口，但不再要求某一台固定电脑承担打包；不要直接运行 `goreleaser release`，也不要手工补打、移动或复用 tag。
 
-发布前必须完成平台治理：目标 GitHub 仓库已启用 immutable releases，`main` 要求 `CI Gate`，操作机已安装并登录 `gh`。本地脚本会在封 tag 前通过 API 检查 immutable releases、当前 SHA 的 `CI Gate` 和在途 Release；`v*` tag ruleset 仍需仓库管理员预先配置并由操作人确认。
+发布前必须完成平台治理：目标 GitHub 仓库已启用 immutable releases，`main` 精确要求 `CI` workflow 的九个 context：`Lint`、`Test`、`Coverage`、`Policy`、`Edition`、`Interface Integrity`、`AI Behavior`、`CLI Smoke`、`Mock MCP`。云端入口会在封 tag 前检查 immutable releases、当前 SHA 的全部九个 context、Environment 保护规则和在途 Release；`v*` tag ruleset 仍需仓库管理员预先配置。
 
-## 日常只用一个入口
+## 推荐入口：GitHub 云端发布
+
+入口页面是 [GitHub Actions → Release](https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/actions/workflows/release.yml)。在仓库页面依次点击 `Actions` → `Release` → `Run workflow` 即可操作；不需要通过 Agent 或本地机器触发。
+
+只有得到该仓库明确授权、最终权限为 `write`、`maintain` 或 `admin` 的协作者可以运行发布操作，workflow 还会对发起人和重新运行者做同样的权限复核。没有仓库写权限的外部贡献者以及仅有 `read` / `triage` 权限的成员不能规划或发布版本。两个渠道的授权边界如下：
+
+- beta：上述任一内部成员都可以直接规划和发布，不需要人工审批。
+- stable：上述任一内部成员都可以规划并发起发布；完成只读规划和治理检查后，workflow 会在 `release-stable` Environment 等待另一名仓库管理员通过 `Review deployments` 签收。申请人不能批准自己的请求，批准后原 run 自动继续，无需重新触发。
+
+基于当时最新的 `main` 发起发布：
+
+1. 在上述 `Release` 页面选择 `Run workflow`，分支必须是默认分支 `main`。
+2. `release_operation=plan`，选择 `release_channel=beta|stable`；仅在开始新 beta 线时选择 `release_bump=patch|minor|major`。
+3. workflow summary 会给出唯一的下一版本。把对应的精确 `CHANGELOG.md` 章节通过 PR 合入 `main`。
+4. 再次运行，改为 `release_operation=publish`。beta 会直接进入自动化发布；stable 会在封 tag 前等待管理员签收。
+
+`plan` 是纯只读操作，不创建 tag、预留版本号或生成包。CHANGELOG 合入期间若另一个发布先占用了该版本，`publish` 会重新分配并因 CHANGELOG 章节不匹配而拒绝，需要重新 plan。`publish` 会先再次确认 dispatch SHA 仍是当前 `main`、Code Admission 和平台治理均通过，再由唯一的 write job 使用 GitHub API 原子创建 annotated tag；同一次 run 随即进入既有的跨平台构建、GitHub/npm、可选 OSS/Gitee 发布和 Homebrew 直交付 DAG。内置 `GITHUB_TOKEN` 创建的 tag 不依赖第二条 workflow 被再次触发。
+
+为缩短封板前后的关键路径，`publish` 的只读版本规划会与平台治理检查并行，seal 仍严格等待二者成功；plan 在 candidate annotated tag 上验证过的 contract 和 stable/beta baseline 会绑定进 seal，并由 seal 后的 tag authority 检查复用。Code Admission 状态与 immutable-releases 治理仍会在 seal 后再次读取，避免 preflight 与发布之间的状态变化被忽略。随后三类只读门禁（release automation、命令兼容性、multi-profile E2E）与 GoReleaser 构建并行；Node/archive 等仅供后处理使用的工具也延后到构建完成后安装。并行和已验证结果复用只改变调度，不降低发布门禁：任何一条验证失败都会阻止 GitHub Release、npm、镜像和 Homebrew 发布，delivery proof 也要求三条验证 job 全部成功。
+
+OSS 镜像默认不参与发布 DAG，适用于尚未创建 Bucket 的仓库。云端封板会把当时的仓库变量 `ENABLE_OSS_MIRROR=true` 记录为不可变 tag 元数据 `OSS-Mirror: enabled`，否则记录为 `deferred`；后续发布和撤回只读取该 sealed policy，不读取变量的当前值。`enabled` 继续对缺失凭据、无效 Bucket、上传、pointer 和撤回失败保持 fail-closed；`deferred` 明确跳过不存在的渠道。为避免补发后撤回遗漏，deferred 版本暂不接受 `repair_oss_version`，启用 OSS 只影响后续新 tag，直到补齐可审计的不可变 repair 证明。
+
+## 自动版本规则
+
+- beta：如果存在尚未封正式版的最高版本线，自动取 `beta.N+1`；否则从最新已分配正式版按所选 patch/minor/major 开新线并取 `beta.1`。
+- stable：先锁定最高开放版本线上的最新已分配 beta，再要求它已成功交付且未撤回；不会跳过失败/撤回的最新 beta 去选择更早版本。正式版 core 与该 beta 完全相同。
+- `vX.Y.Z`、`vX.Y.Z-beta.N` 一经分配就永久占用。撤回时创建 `withdrawn/v...` 墓碑，原编号永不复用。
+- 例如撤回 `v1.0.53-beta.5` 后，下一 beta 是 `v1.0.53-beta.6`；撤回正式版 `v1.0.53` 后，下一 patch 修复线是 `v1.0.54-beta.1`，验证后再发布 `v1.0.54`。
+- 如果最新 beta 已撤回，禁止直接用更早 beta 晋级正式版；必须先构建下一个 beta。
+
+## 全平台撤回与回滚
+
+已公开版本出现问题时，在 GitHub Actions 运行 `Withdraw release`，分支必须选择当前默认分支 `main`，并填写：
+
+- `version`：精确版本，例如 `v1.0.53` 或 `v1.0.53-beta.5`。
+- `reason`：8–300 字符的单行公开原因。
+- `confirmation`：精确输入 `WITHDRAW <version>`，例如 `WITHDRAW v1.0.53`。
+
+该 workflow 使用与发布相同的串行 publication lock，并进入受保护的 `release-withdrawal` environment。它只接受已经由 Release workflow 完整交付的 public immutable release，自动选择同一渠道中最新的、更早且未撤回的完整版本作为回退目标，然后按以下顺序执行：
+
+1. 先创建永久 annotated tag `withdrawn/<version>`，记录原 tag object、commit、原因、申请人和 workflow run。这个墓碑是版本号永久占用记录，永不移动、永不删除。
+2. 先验证 Homebrew Formula；若它仍指向问题版本，先创建回退 PR，再继续其他渠道撤回。这样 PR 创建失败时只留下可安全续跑的墓碑，不会先造成渠道分裂。若 Formula 尚未指向问题版本或已经处于安全版本，则直接校验。
+3. GitHub Release 先标记为 withdrawn；npm 精确版本执行 `deprecate`，并把 `latest` / `beta` dist-tag 回退；只有目标 tag 封存了 `OSS-Mirror: enabled` 时，OSS 才会先补齐回退版本资产，再移动 `latest.txt` / `beta.txt` 并删除问题版本目录；启用 Gitee 时同样先补齐回退 Release，再删除问题 Release 和 tag。
+4. npm 以及目标 tag 启用或发布时配置的镜像渠道均已验证安全后，删除 GitHub 上的问题 Release 和原 `v...` tag，并验证 `/releases/latest` 对正式版回到安全版本。若本次创建了 Homebrew PR，run 最后故意保持失败，直到另一名维护者审核合入；合入后，从新的 `main` 使用完全相同的 version、reason 和 confirmation 重跑并完成。永久 `withdrawn/v...` 墓碑始终保留。
+
+GitHub、npm、OSS、Gitee 和 Homebrew 的“回滚”指新的安装、升级和渠道解析不再拿到问题版本。已经装到用户电脑上的二进制无法被服务端强制降级；用户必须重新安装回退版本、安装后续修复版，或使用 CLI 自带的本地 rollback 能力。npm 不执行 `unpublish`：问题版本保留明确的弃用警告，但 `latest` / `beta` 不再指向它；即使 registry 允许删除，已发布过的版本号也不会重新使用。
+
+撤回前必须存在同一渠道中更早、完整交付且未撤回的安全版本；若目标是该渠道第一个版本、没有安全候选，workflow 会在创建墓碑或修改任何渠道前 fail closed，需要先决定明确的替代策略。CLI 本地 rollback 也只有在本机仍保留上一次升级备份时可用。
+
+撤回以“精确版本”为单位，不会因为正式版曾由某个 beta 晋级就隐式级联修改另一个渠道。若同一缺陷同时存在于正式版及其 beta，应先撤回正式版，再撤回对应 beta，并分别使用各自的精确确认串；每次都只会把该渠道回退到自己的安全候选。
+
+撤回正式版 `v1.0.53` 后，`v1.0.53` 仍被墓碑视为已分配。下一次 patch 发布从 `v1.0.54-beta.1` 开始，验证后晋级 `v1.0.54`。撤回 `v1.0.53-beta.5` 后，同一开放版本线继续为 `v1.0.53-beta.6`；不会退回或复用 `beta.5`。
+
+## 兼容入口：本地发布
 
 安装发布 Skill 后直接运行：
 
@@ -18,18 +71,20 @@ dws-release
 dws-release config --remote origin
 ```
 
-之后命令按仓库状态自动走到正确步骤：缺少精确 CHANGELOG 章节时只生成模板并停止；补全、提交并合入 `main` 后，再运行同一条命令就会安全快进本地 `main` 并执行完整预检。若同名 remote 后续被改指向其他仓库会直接拒绝。只有显式增加 `--publish` 才会进入 tag 发布，且底层仍要求最终版本确认。
+之后命令按仓库状态自动走到正确步骤：缺少精确 CHANGELOG 章节时只生成模板并停止；补全、提交并合入 `main` 后，再运行同一条命令就会安全快进本地 `main` 并执行完整预检。若同名 remote 后续被改指向其他仓库会直接拒绝。官方仓库不再接受本地 `--publish`，命令会直接提示上述 Actions 页面；本地入口不能绕过 beta/stable 的统一授权。
+
+Release workflow 不再监听新建的 `v*` tag；直接推 tag 不会发布 GitHub Release、npm 或镜像渠道。所有新 beta/stable 都必须从云端页面进入统一授权和审计链路；历史失败版本仍可通过受保护的 recovery 兼容处理。
 
 ## 发布模型
 
 ```text
 main 上的候选代码 + beta CHANGELOG
   → vX.Y.Z-beta.N（预发验证）
-  → 只允许补正式 CHANGELOG，源码不得再变化
-  → vX.Y.Z（正式发布）
+  → 补正式 CHANGELOG；允许继续通过 PR 合入新 commit
+  → vX.Y.Z（正式发布，封板提交必须包含该 beta 提交）
 ```
 
-正式版必须显式指定本次验证过的 beta。脚本会比较两者：除 `CHANGELOG.md` 外只要有任何文件变化，就拒绝正式发布。这样预发测过的代码、命令树和正式发布的代码是同一份。
+云端入口自动选择本次最新、已交付且未撤回的 beta；本地入口必须显式指定。流水线要求该 beta 已成功交付、未撤回，且 beta 提交必须位于正式发布封板提交的历史中——不能跳过 beta 直接发正式版，但允许在 beta 之后把经过 review 合入 `main` 的 commit 一起发布。
 
 ## 预发发布
 
@@ -45,13 +100,7 @@ dws-release v1.2.3-beta.1
 dws-release v1.2.3-beta.1
 ```
 
-预检包含测试、策略检查、旧正式版命令树兼容检查、全平台打包、npm 安装验证，以及 macOS 环境下的 Homebrew 安装验证。通过后发布：
-
-```bash
-dws-release v1.2.3-beta.1 --publish
-```
-
-命令会在所有预检完成后要求再次输入完整版本号。统一入口不提供跳过确认的参数。
+预检包含测试、策略检查、旧正式版命令树兼容检查、全平台打包、npm 安装验证，以及 macOS 环境下的 Homebrew 安装验证。它还会从默认分支触发一次无发布权限的 `Release governance preflight`，用正式流水线相同的身份检查该精确 commit 的九个 Code Admission context 和 immutable releases。通过后回到上述 Actions 页面选择 beta 和 `release_operation=publish`；云端会重新绑定当前 `main`，然后直接进入 beta 自动发布，不需要人工审批或输入确认短语。
 
 ## 正式发布
 
@@ -61,14 +110,13 @@ beta 验证通过后，运行正式版入口：
 dws-release v1.2.3 --from-beta v1.2.3-beta.1
 ```
 
-首次运行只生成正式版 CHANGELOG 并停止。补全内容、删除 `TODO`，提交后通过 PR 合入 `main`；重新运行同一条命令做完整预检，确认后增加 `--publish`：
+首次运行只生成正式版 CHANGELOG 并停止。补全内容、删除 `TODO`，提交后通过 PR 合入 `main`；重新运行同一条命令做完整预检：
 
 ```bash
 dws-release v1.2.3 --from-beta v1.2.3-beta.1
-dws-release v1.2.3 --from-beta v1.2.3-beta.1 --publish
 ```
 
-`FROM_BETA` 不会自动推断，并会写入 stable annotated tag 的 `From-Beta` 元数据，CI 会再次读取和验证。
+预检通过后，在 Actions 页面选择 stable 和 `release_operation=publish`。云端入口会按上述规则唯一选择 beta，并把它写入 stable annotated tag 的 `From-Beta` 元数据；在创建 tag 前必须由另一名仓库管理员签收。
 
 ## CHANGELOG 契约
 
@@ -86,28 +134,69 @@ dws-release v1.2.3 --from-beta v1.2.3-beta.1 --publish
 
 ## CI/CD 保证
 
-- 只接受 `vX.Y.Z-beta.N` 和 `vX.Y.Z`，且新版本必须高于上一正式版。这里的“上一正式版”必须同时具备公开非草稿 GitHub Release 和同 tag/commit 的成功 Release workflow；只有 tag、没有交付成功的孤儿版本会阻断后续发布，要求先重跑补齐。历史版本若曾通过专用 recovery workflow 完成交付，只能使用仓库内 `delivered-stable-recoveries.json` 中精确到 tag、commit、run、workflow SHA 与 attempt 的 reviewed 证据；验证仍要求 release、Darwin 签名和最终发布三个 job 全部成功，不能接受任意 workflow_dispatch。
-- tag 必须是 annotated tag；本地脚本在推送前重新确认 HEAD 与远端 `main` 完全一致，CI 允许其后 `main` 前进，但要求封板提交仍位于 `main` 历史中。
+- 只接受 `vX.Y.Z-beta.N` 和 `vX.Y.Z`，且新版本必须高于上一正式版。这里的“上一正式版”必须同时具备公开非草稿 GitHub Release 和同 tag/commit 的成功 Release workflow；只有 tag、没有交付成功的孤儿版本会阻断后续发布，要求走机器核验恢复补齐。云端 tag 会固定 `Release-Run`、requester、commit 和版本分配指纹，交付验证按该精确 run/attempt 及完整 job graph 取证，不接受任意 `workflow_dispatch`。历史版本若曾通过专用 recovery workflow 完成交付，只能使用仓库内 `delivered-stable-recoveries.json` 中精确到 tag、commit、run、workflow SHA 与 attempt 的 reviewed 证据。
+- tag 必须由云端 seal job 创建为 annotated tag；封板提交必须已通过 PR 合入并包含在远端 `main` 历史中。流水线允许其后 `main` 继续前进，但始终要求封板提交位于 `main` 历史中。
 - 日常 CI 和发布前都会对比“最新已交付正式版”的完整命令树；若长时间预检期间该 baseline 发生变化，会针对新的 baseline 重新比较。
 - GoReleaser 只构建；Darwin 重签、checksums 重算和 npm 安装验证通过后，才统一上传 GitHub Release 的最终产物。
 - 六个平台归档会逐个解包并核验二进制内嵌版本；公开资产集合、checksums 集合和 npm tarball integrity 都必须精确一致。npm tarball 固定由 npm `10.9.2` 打包，避免重跑时因 runner 自带 npm 漂移产生不同字节。
-- stable 发布到 npm `latest`，更新 OSS `latest.txt` 和共享安装脚本；prerelease 发布到 npm `beta`，只更新 OSS `beta.txt`，不会覆盖稳定入口。
-- Release workflow 使用一个最多容纳 100 个 pending run 的串行 publication queue；本地入口仍要求上一条 Release 完成后才能封下一个 tag。
-- 本地 tag push 失败时会删除本次新建的本地 tag。tag 一旦成功推送，后续发布归 CI 所有，禁止改 tag 指向或复用版本号。
+- stable 发布到 npm `latest`；prerelease 发布到 npm `beta`。启用 `ENABLE_OSS_MIRROR=true` 后，stable 同步 OSS `latest.txt` 和共享安装脚本，prerelease 只同步 OSS `beta.txt`，不会覆盖稳定入口。
+- Release workflow 使用一个最多容纳 100 个 pending run 的串行 publication queue；版本规划、云端封板、发布、恢复、修复和撤回共享同一发布锁。
+- 云端 seal 创建远端 tag 后，后续发布归同一 run 所有；发布中途失败时先重跑同一 run 的失败 jobs，必须跨 run 时走机器核验恢复，禁止改 tag 指向或复用版本号。只有已经公开版本经过受保护的全渠道撤回并留下永久 `withdrawn/...` 墓碑后，撤回 workflow 才会在最后一步删除原 tag。
 
 npm 补发只允许从默认分支触发 Release workflow 的 `repair_npm_version`。它只支持启用 immutable releases 后、由本流水线成功产出的公开 immutable release：目标必须是 `main` 历史中的 annotated tag，并且同 commit 的 `Build immutable GitHub Release` job 已成功。即使后续 npm 分发失败，这个独立的产物封存边界仍可作为补发依据。补发会用目标 commit 的 npm 模板重组包，逐平台核验资产和二进制版本，再发布到隔离的 `backfill` dist-tag，不会回滚 `latest` / `beta`。历史 mutable release 不进入自动补发路径，避免把可被替换的资产带入 npm。
 
-OSS/Gitee 分发失败时直接重跑该 tag 的 `Publish npm and mirrors` failed job；各步会复用 immutable GitHub 资产并保持 channel 单调。独立 Gitee release workflow 和本地直发脚本已停用，避免绕开 publication queue 或用重新构建的不同字节覆盖镜像。
+已启用的 OSS 或 Gitee 分发失败且 GitHub immutable Release、npm 已交付时，从受保护的默认分支触发
+Release workflow，并且只填写 `repair_oss_version` 或 `repair_gitee_version` 之一。channel
+repair 会精确绑定失败 tag run 的最新 attempt，且 OSS repair 要求 tag 的 sealed policy 为 `enabled`；contract、构建、Developer ID 签名、
+immutable GitHub 发布和 npm delivery 必须全部成功，且只能有一个 OSS/Gitee 下游失败，
+随后才会下载并重新校验原始资产、修复所选镜像。OSS repair 必须匹配失败的 OSS step；
+Gitee repair 还允许其 job 因该 OSS 失败而 skipped，此时只代表 Gitee backfill 成功，
+不会把仍未修复的 OSS 标成成功。该证据不能用于 beta → stable 或
+stable baseline，后两者仍要求整条 Release 成功或受保护 recovery 成功。不要重跑旧
+attempt 的单个 failed job，以免在 attempts 之间拼接交付证据。独立 Gitee release
+workflow 和本地直发脚本已停用，避免绕开 publication queue 或用重新构建的不同字节覆盖镜像。
 
-OSS 的 `latest.txt` / `beta.txt` 当前是镜像频道元数据；仓库内安装器仍从 GitHub/Gitee 解析版本，不能把 OSS pointer 当成已接入的安装通道。
+## 既有 tag 的紧急恢复
 
-Homebrew 当前只属于本机预检/手工公式通道：预检会在当前 macOS 架构真实安装，但 Release workflow 不发布 tap，CI 生成的单主机公式也不应当作 Darwin 双架构正式交付。正式自动交付范围是 GitHub Release、npm、OSS，以及显式开启时的 Gitee fallback；Homebrew 双架构 tap 发布需另立需求。
+云端封板或本地 tag push 已成功、但 Release workflow 失败且 GitHub Release 尚未公开时，不要新建临时 workflow、移动 tag 或跳过门禁。在最新且干净的 `main` worktree 运行：
+
+```bash
+dws-release recover v1.2.3-beta.1
+```
+
+命令会自动解析 annotated tag object、peeled commit，以及 tag 绑定的失败云端 run 或最近一次匹配的失败 tag-push run；也可以用 `--failed-run <run-id>` 精确指定。确认完整版本号后，它从默认分支触发受保护的恢复模式并等待完成。恢复模式必须满足：
+
+- 输入精确绑定原 annotated tag object、commit 和失败的 sealed `Release` run；云端 run 还必须与 tag 内的 run ID、attempt、requester 完全一致，commit 必须仍在 `main` 历史中。
+- 目标只允许不存在 GitHub Release 或仍为 Draft；已经公开的版本不能全量重建：单个下游故障走对应的 channel repair，版本本身有问题则走受保护的全平台 withdrawal。
+- 恢复不再进入人工审批 environment。workflow 会机器核验 tag object、commit、原失败 run/attempt、请求人、完整 seal metadata、`main` 祖先关系以及 Release 状态；任一事实不一致都会在构建前 fail closed。
+- 恢复复用正常的 contract、构建、Developer ID 签名、资产校验、immutable 发布、Homebrew、npm，以及已启用的 OSS jobs，不存在 recovery 专用 publisher 或门禁跳过。
+- 如果 GitHub Release 已在 recovery 中封存、后续 Homebrew/npm 校验发生瞬时失败，只重跑该 run 的 failed jobs；流水线仅在隐藏 run marker、tag object、commit 和 finalized artifact 字节全部精确一致时复用公开 Release。
+
+成功的默认分支恢复 run 会成为后续 beta → stable 和 stable baseline 验证的可审计交付证据；历史临时分支恢复仍只接受 reviewed manifest 中的固定证据。
+
+seal job 写入 tag 后如果只因 GitHub API 瞬时 404/429/5xx 或后续 job 失败，可直接使用 GitHub 的 “Re-run failed jobs”。同一 run 会精确复用原 release-plan；seal 只在 version、tag object、commit、channel、beta 来源、OSS policy、请求人、run ID 和完整 message 全部匹配且原 attempt 不大于当前 attempt 时认领已有 tag。不同 run 或任一字段不匹配时不会认领。GitHub Release 尚未公开且必须跨 run 重建时走上述机器核验 recovery；已经公开且仅 npm/OSS/Gitee 某一渠道失败时走对应 repair；版本内容本身有问题时走 withdrawal。
+
+OSS 的 `latest.txt` / `beta.txt` 是镜像频道元数据；当前仓库安装器仍主要从 GitHub/Gitee 解析版本。启用 OSS 后，发布和撤回把它作为受控分发渠道处理，保证一旦外部消费者接入该 pointer，也不会继续解析到已撤回版本；未启用时两条流程都明确跳过不存在的 OSS 渠道。
+
+Release workflow 会生成 Darwin/Linux 双架构 Formula，并在不可变资产逐个校验后，由 `HOMEBREW_PR_TOKEN` 所属的受控发布身份只提交对应 stable 或 beta Formula 文件到 `main`，不再创建二次发布 PR；并发 `main` 更新会以全新 clone 最多重试三次，绝不 force push。该身份的提交不会依赖另一轮 CI 来补齐证明：workflow 只在确认该 commit 单父、唯一改动为目标 Formula、内容与本次已验证产物逐字节一致，且父 commit 九项 Code Admission 全绿后，直接为 Formula-only commit 封存同名九项成功 checks，避免下一次发布因缺失 contexts 被卡住。撤回 workflow 暂时仍使用相同模板和回退版本 checksums 打开反向 PR；问题 GitHub Release 会先被移除以阻止新安装，永久墓碑和 workflow 日志承担审计/续跑依据。
 
 ## 平台治理前置
 
-仓库管理员还需要在 GitHub 平台配置两项不可由脚本替代的规则：
+仓库管理员还需要在 GitHub 平台配置以下不可由脚本替代的规则：
 
-- `main` 必须要求精确的 `CI Gate`；tag workflow 也会通过 Checks API 再确认该封板 SHA 已通过。
+- `main` 必须精确要求 `Lint`、`Test`、`Coverage`、`Policy`、`Edition`、`Interface Integrity`、`AI Behavior`、`CLI Smoke`、`Mock MCP` 九个 Code Admission context；Release workflow 也会通过 Checks API 再确认该封板 SHA 上九项全部成功。
 - 必须启用 immutable releases；它只保护启用后发布的 release，因此应在第一次使用新流水线前配置。为 `v*` 增加 tag ruleset，限制创建权限，并在 release 发布前保护 tag 的短暂窗口。
+- tag ruleset 还必须覆盖 `withdrawn/v*`：只允许受保护的撤回 workflow 创建墓碑，禁止更新或删除墓碑；同时应允许 Release workflow 创建新的 `v*`，允许撤回 workflow 在全部渠道回退后删除精确的问题 `v*`。若组织级规则阻止这两个 workflow 的预期动作，发布或撤回会 fail closed，不能靠手工移动 tag 绕过。
+- 配置 `RELEASE_GOVERNANCE_TOKEN` Actions secret，只授予目标仓库 `Administration: read`；内置 `GITHUB_TOKEN` 不具备 immutable-releases API 所需的仓库治理权限。每次本地预检和云端发布都使用这一个身份进行 fail-closed 验证。
+- 配置 `APPLE_CERTIFICATE_P12_BASE64`、`APPLE_CERTIFICATE_PASSWORD` 和具备发布权限的 `NPM_TOKEN`；撤回还要求该 npm 身份能够执行 `deprecate` 和修改 dist-tag。
+- 启用 OSS 镜像时，先创建有效 Bucket，再设置仓库变量 `ENABLE_OSS_MIRROR=true`，并配置 `OSS_ACCESS_KEY_ID`、`OSS_ACCESS_KEY_SECRET`、`OSS_ENDPOINT`、`OSS_BUCKET`，按需配置 `OSS_PREFIX`。启用后发布保持 fail-closed；撤回身份必须能够补齐安全版本资产、写 `latest.txt` / `beta.txt` 并删除问题版本前缀。尚未 provision Bucket 时保持该变量未设置或不等于 `true`，新 tag 会封存 `OSS-Mirror: deferred` 并跳过 OSS；该版本不能通过现有 repair 流程事后改成启用。
+- 若启用 Gitee fallback，设置 `ENABLE_GITEE_UPLOAD_FALLBACK=true`，并配置 `GITEE_TOKEN`、`GITEE_USER`、`GITEE_REPO`；该身份必须能够创建和删除目标仓库的 Release 与 tag。
+- 正常 Homebrew 发布使用现有的 `HOMEBREW_PR_TOKEN` 直接提交 Formula-only commit，不再创建 Homebrew PR，也不跑权限 canary。GitHub 不允许内置 Actions App 作为当前仓库 ruleset 的 bypass actor，因此两个默认分支 ruleset 都只给该 token 所属的指定发布管理员用户 `always` bypass；仓库脚本仍会限制提交路径、校验 Ruby、禁止 force push，并在并发更新时重新基于最新 `main`。
+- `HOMEBREW_PR_TOKEN` 应保持仓库范围的 `Contents: write` 与 `Pull requests: write` 权限；后者仅供撤回流程创建回退 PR。不要与 `RELEASE_GOVERNANCE_TOKEN` 复用，并定期审计 token owner 与 ruleset bypass actor 一致。
+- 创建 `release-beta` environment，只允许受保护分支且不配置 required reviewer；仓库内部 `write`、`maintain`、`admin` 成员的 beta 发布会直接通过该边界。
+- 创建 `release-stable` environment，只允许受保护分支，以仓库管理员为 required reviewer，禁止申请人自审并关闭管理员绕过。内部成员可以发起 stable，但必须由另一名管理员签收后才能封 tag 和写入任何发布渠道。
+- Release workflow 会在封 tag 前回读并验证上述两套 Environment 规则；规则缺失、stable reviewer 不再是仓库管理员、或 beta 被误加人工审批时都会 fail closed。
+- 创建 `release-withdrawal` environment，只允许受保护分支，设置至少一名 required reviewer、禁止申请人自审并关闭管理员绕过。撤回 workflow 会通过 API 复核这些规则；任何一项缺失都会在触碰 npm、OSS、Gitee、Homebrew 或 GitHub Release 前失败。
+- 仓库或组织的 Actions 策略必须允许 `Release` 与 `Withdraw release` workflow 的 `GITHUB_TOKEN` 获得各 job 声明的权限；正常发布由 `HOMEBREW_PR_TOKEN` 更新两个受控 Formula 路径，内置 token 只承担 workflow 自身声明的封板与校验写入。若撤回凭证采用 environment secret，确认 `release-withdrawal` 审批完成后能够读取撤回所需的 npm、OSS、Gitee 和 Homebrew 凭证。
 
-immutable releases 或 `CI Gate` 缺失时，发布脚本会自动拒绝封 tag。tag ruleset 可能来自组织层，脚本不自动推断其最终作用范围；管理员确认不能省略，脚本约定也不能替代平台强制。
+immutable releases，或任一 Code Admission context 缺失、未成功时，发布脚本会自动拒绝封 tag。tag ruleset 可能来自组织层，脚本不自动推断其最终作用范围；管理员确认不能省略，脚本约定也不能替代平台强制。

internal/app/access_token_manager_test.go

@@ -0,0 +1,223 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
+)
+
+type tokenManagerSnapshotProvider struct {
+	load func() (*authpkg.TokenData, error)
+}
+
+func (p tokenManagerSnapshotProvider) GetAccessToken(context.Context) (string, error) {
+	data, err := p.load()
+	if err != nil || data == nil {
+		return "", err
+	}
+	return data.AccessToken, nil
+}
+
+func (p tokenManagerSnapshotProvider) GetTokenSnapshot(context.Context) (*authpkg.TokenData, error) {
+	return p.load()
+}
+
+type tokenManagerLegacyGetter struct {
+	token string
+	err   error
+}
+
+func (g tokenManagerLegacyGetter) GetToken() (string, string, error) {
+	return g.token, "file", g.err
+}
+
+func installTokenManagerFakes(t *testing.T, load func() (*authpkg.TokenData, error)) {
+	t.Helper()
+	oldProvider, oldLegacy := newAccessTokenProvider, newLegacyTokenManager
+	oldEdition := edition.Get()
+	edition.Override(&edition.Hooks{})
+	newAccessTokenProvider = func(string) accessTokenGetter {
+		return tokenManagerSnapshotProvider{load: load}
+	}
+	newLegacyTokenManager = func(string) legacyTokenGetter {
+		return tokenManagerLegacyGetter{err: authpkg.ErrTokenDataNotFound}
+	}
+	t.Cleanup(func() {
+		newAccessTokenProvider, newLegacyTokenManager = oldProvider, oldLegacy
+		edition.Override(oldEdition)
+	})
+}
+
+func TestCrossPlatformCoverageTokenManagerCachesUntilMarkerRevisionChanges(t *testing.T) {
+	configDir := t.TempDir()
+	if err := authpkg.WriteTokenMarker(configDir); err != nil {
+		t.Fatal(err)
+	}
+	var calls atomic.Int32
+	token := "token-a"
+	installTokenManagerFakes(t, func() (*authpkg.TokenData, error) {
+		calls.Add(1)
+		return &authpkg.TokenData{AccessToken: token, ExpiresAt: time.Now().Add(time.Hour)}, nil
+	})
+
+	manager := NewTokenManager()
+	first, err := manager.Get(context.Background(), configDir, "")
+	if err != nil || first.AccessToken != "token-a" {
+		t.Fatalf("first token = %#v, %v", first, err)
+	}
+	second, err := manager.Get(context.Background(), configDir, "")
+	if err != nil || second.AccessToken != "token-a" || calls.Load() != 1 {
+		t.Fatalf("cached token = %#v, %v, calls=%d", second, err, calls.Load())
+	}
+
+	token = "token-b"
+	if err := authpkg.WriteTokenMarker(configDir); err != nil {
+		t.Fatal(err)
+	}
+	rotated, err := manager.Get(context.Background(), configDir, "")
+	if err != nil || rotated.AccessToken != "token-b" || calls.Load() != 2 {
+		t.Fatalf("rotated token = %#v, %v, calls=%d", rotated, err, calls.Load())
+	}
+}
+
+func TestCrossPlatformCoverageTokenManagerDoesNotCacheWithoutExpiryOrRevision(t *testing.T) {
+	configDir := t.TempDir()
+	var calls atomic.Int32
+	installTokenManagerFakes(t, func() (*authpkg.TokenData, error) {
+		calls.Add(1)
+		return &authpkg.TokenData{AccessToken: "token"}, nil
+	})
+	manager := NewTokenManager()
+	for range 2 {
+		if _, err := manager.Get(context.Background(), configDir, ""); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if calls.Load() != 2 {
+		t.Fatalf("provider calls = %d, want 2", calls.Load())
+	}
+}
+
+func TestCrossPlatformCoverageTokenManagerTreatsMalformedMarkerAsUncacheable(t *testing.T) {
+	configDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(configDir, "token.json"), []byte("{"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	var calls atomic.Int32
+	installTokenManagerFakes(t, func() (*authpkg.TokenData, error) {
+		calls.Add(1)
+		return &authpkg.TokenData{AccessToken: "token", ExpiresAt: time.Now().Add(time.Hour)}, nil
+	})
+	manager := NewTokenManager()
+	for range 2 {
+		if snapshot, err := manager.Get(context.Background(), configDir, ""); err != nil || snapshot.AccessToken != "token" {
+			t.Fatalf("snapshot = %#v, error = %v", snapshot, err)
+		}
+	}
+	if calls.Load() != 2 {
+		t.Fatalf("provider calls = %d, want 2", calls.Load())
+	}
+}
+
+func TestCrossPlatformCoverageTokenManagerDoesNotCacheOpaqueEditionStorageWithProviderFallback(t *testing.T) {
+	configDir := t.TempDir()
+	if err := authpkg.WriteTokenMarker(configDir); err != nil {
+		t.Fatal(err)
+	}
+	var calls atomic.Int32
+	installTokenManagerFakes(t, func() (*authpkg.TokenData, error) {
+		calls.Add(1)
+		return &authpkg.TokenData{AccessToken: "token", ExpiresAt: time.Now().Add(time.Hour)}, nil
+	})
+	edition.Override(&edition.Hooks{
+		LoadToken: func(string) ([]byte, error) { return nil, nil },
+		TokenProvider: func(_ context.Context, fallback func() (string, error)) (string, error) {
+			return fallback()
+		},
+	})
+	manager := NewTokenManager()
+	for range 2 {
+		if _, err := manager.Get(context.Background(), configDir, ""); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if calls.Load() != 2 {
+		t.Fatalf("provider calls = %d, want 2", calls.Load())
+	}
+}
+
+func TestCrossPlatformCoverageTokenManagerCoalescesConcurrentLoads(t *testing.T) {
+	configDir := t.TempDir()
+	if err := authpkg.WriteTokenMarker(configDir); err != nil {
+		t.Fatal(err)
+	}
+	var calls atomic.Int32
+	release := make(chan struct{})
+	installTokenManagerFakes(t, func() (*authpkg.TokenData, error) {
+		calls.Add(1)
+		<-release
+		return &authpkg.TokenData{AccessToken: "token", ExpiresAt: time.Now().Add(time.Hour)}, nil
+	})
+	manager := NewTokenManager()
+	const workers = 8
+	var wg sync.WaitGroup
+	wg.Add(workers)
+	errs := make(chan error, workers)
+	for range workers {
+		go func() {
+			defer wg.Done()
+			_, err := manager.Get(context.Background(), configDir, "")
+			errs <- err
+		}()
+	}
+	for calls.Load() == 0 {
+		time.Sleep(time.Millisecond)
+	}
+	close(release)
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	if calls.Load() != 1 {
+		t.Fatalf("provider calls = %d, want 1", calls.Load())
+	}
+}
+
+func TestCrossPlatformCoverageTokenManagerPreservesProviderFailure(t *testing.T) {
+	configDir := t.TempDir()
+	want := errors.New("keychain permission denied")
+	installTokenManagerFakes(t, func() (*authpkg.TokenData, error) { return nil, want })
+	_, err := NewTokenManager().Get(context.Background(), configDir, "")
+	if !errors.Is(err, want) {
+		t.Fatalf("error = %v, want cause %v", err, want)
+	}
+	if errors.Is(err, authpkg.ErrTokenDataNotFound) {
+		t.Fatalf("provider failure was misclassified as missing credentials: %v", err)
+	}
+}
+
+func TestCrossPlatformCoverageTokenResolutionErrorOnlyClassifiesTrueMissingCredential(t *testing.T) {
+	missing := tokenResolutionError(authpkg.ErrTokenDataNotFound)
+	var typed interface{ Unwrap() error }
+	if !errors.As(missing, &typed) || !errors.Is(missing, authpkg.ErrTokenDataNotFound) {
+		t.Fatalf("missing error = %v", missing)
+	}
+	want := errors.New("decrypt failed")
+	if got := tokenResolutionError(want); !errors.Is(got, want) || errors.Is(got, authpkg.ErrTokenDataNotFound) {
+		t.Fatalf("storage error = %v", got)
+	}
+	if got := tokenResolutionError(context.Canceled); !errors.Is(got, context.Canceled) {
+		t.Fatalf("cancellation = %v", got)
+	}
+}

internal/app/access_token_resolve.go

@@ -21,19 +21,61 @@ import (
 	"log/slog"
 	"path/filepath"
 	"strings"
+	"sync"
+	"time"
 
 	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 )
 
+const accessTokenRefreshWindow = 5 * time.Minute
+
 type legacyTokenGetter interface {
 	GetToken() (string, string, error)
 }
 
+type accessTokenSnapshotGetter interface {
+	GetTokenSnapshot(context.Context) (*authpkg.TokenData, error)
+}
+
+// AccessTokenSnapshot is the minimal bearer view needed by the process cache.
+// Refresh-token material never leaves the auth package.
+type AccessTokenSnapshot struct {
+	AccessToken string
+	ExpiresAt   time.Time
+	Source      string
+}
+
+type tokenManagerKey struct {
+	configDir string
+	profile   string
+}
+
+type tokenManagerEntry struct {
+	mu       sync.Mutex
+	snapshot AccessTokenSnapshot
+	revision string
+}
+
+// TokenManager is the only process cache for user access tokens. Cache entries
+// are isolated by config directory and profile, expiry-aware, and invalidated
+// by the credential publication marker written by auth storage.
+type TokenManager struct {
+	mu      sync.Mutex
+	entries map[tokenManagerKey]*tokenManagerEntry
+	now     func() time.Time
+}
+
+func NewTokenManager() *TokenManager {
+	return &TokenManager{entries: make(map[tokenManagerKey]*tokenManagerEntry), now: time.Now}
+}
+
+var runtimeTokenManager = NewTokenManager()
+
 var (
 	newAccessTokenProvider = func(configDir string) accessTokenGetter {
-		disc := slog.New(slog.NewTextHandler(io.Discard, nil))
-		provider := authpkg.NewOAuthProvider(configDir, disc)
+		discard := slog.New(slog.NewTextHandler(io.Discard, nil))
+		provider := authpkg.NewOAuthProvider(configDir, discard)
 		configureOAuthProviderCompatibility(provider, configDir)
 		return provider
 	}
@@ -44,55 +86,218 @@ var (
 	}
 )
 
-// resolveAccessTokenFromDir loads OAuth then legacy token from configDir, applying
-// the same host compatibility hooks as MCP. It mirrors the former body of
-// getCachedRuntimeToken (excluding process-level cache and timing).
-func resolveAccessTokenFromDir(ctx context.Context, configDir string) (string, error) {
-	provider := newAccessTokenProvider(configDir)
-	token, tokenErr := provider.GetAccessToken(ctx)
-	if tokenErr == nil && strings.TrimSpace(token) != "" {
-		return strings.TrimSpace(token), nil
-	}
-	if tokenErr != nil && errors.Is(tokenErr, authpkg.ErrTokenDecryption) {
-		return "", tokenErr
-	}
-	manager := newLegacyTokenManager(configDir)
-	if leg, _, err := manager.GetToken(); err == nil && strings.TrimSpace(leg) != "" {
-		return strings.TrimSpace(leg), nil
-	}
-	return "", nil
-}
-
-// ResolveAuxiliaryAccessToken resolves a bearer token for HTTP clients that should
-// align with MCP tool calls. Non-empty explicitToken wins. When configDir matches
-// the active edition config directory, the same process-cached path as MCP is used.
-// Otherwise tokens are loaded from configDir with host compatibility hooks applied.
-func ResolveAuxiliaryAccessToken(ctx context.Context, configDir, explicitToken string) (string, error) {
-	if t := strings.TrimSpace(explicitToken); t != "" {
-		return t, nil
+// Get resolves an access token for the active runtime profile.
+func (m *TokenManager) Get(ctx context.Context, configDir, explicitToken string) (AccessTokenSnapshot, error) {
+	if token := strings.TrimSpace(explicitToken); token != "" {
+		return AccessTokenSnapshot{AccessToken: token, Source: "explicit"}, nil
 	}
 	if strings.TrimSpace(configDir) == "" {
-		return "", fmt.Errorf("config directory is empty")
+		return AccessTokenSnapshot{}, fmt.Errorf("config directory is empty")
 	}
-	if filepath.Clean(configDir) == filepath.Clean(defaultConfigDir()) {
-		if tok := resolveRuntimeAuthToken(ctx, ""); tok != "" {
-			return tok, nil
+	key := tokenManagerKey{
+		configDir: canonicalTokenConfigDir(configDir),
+		profile:   strings.TrimSpace(authpkg.RuntimeProfile()),
+	}
+	entry := m.entry(key)
+	entry.mu.Lock()
+	defer entry.mu.Unlock()
+
+	now := time.Now()
+	if m != nil && m.now != nil {
+		now = m.now()
+	}
+	revision, present, err := authpkg.ReadTokenMarkerRevision(configDir)
+	if err != nil {
+		return AccessTokenSnapshot{}, err
+	}
+	if tokenSnapshotUsable(entry.snapshot, now) && present && revision != "" && revision == entry.revision {
+		return entry.snapshot, nil
+	}
+
+	// Treat the marker and credential as one optimistic snapshot. A concurrent
+	// login/refresh between the reads causes a retry instead of caching stale A
+	// under the publication marker for B.
+	for attempt := 0; attempt < 4; attempt++ {
+		beforeRevision, beforePresent, err := authpkg.ReadTokenMarkerRevision(configDir)
+		if err != nil {
+			return AccessTokenSnapshot{}, err
 		}
-		return "", noCredentialsError()
+		snapshot, err := resolveTokenSnapshotWithEdition(ctx, configDir, key.profile)
+		if err != nil {
+			return AccessTokenSnapshot{}, err
+		}
+		afterRevision, afterPresent, err := authpkg.ReadTokenMarkerRevision(configDir)
+		if err != nil {
+			return AccessTokenSnapshot{}, err
+		}
+		if beforePresent != afterPresent || beforeRevision != afterRevision {
+			continue
+		}
+		if strings.TrimSpace(snapshot.AccessToken) == "" {
+			return AccessTokenSnapshot{}, noCredentialsError()
+		}
+		if tokenSnapshotUsable(snapshot, now) && afterPresent && afterRevision != "" {
+			entry.snapshot = snapshot
+			entry.revision = afterRevision
+		} else {
+			entry.snapshot = AccessTokenSnapshot{}
+			entry.revision = ""
+		}
+		return snapshot, nil
 	}
-	tok, err := resolveAccessTokenFromDir(ctx, configDir)
+	return AccessTokenSnapshot{}, fmt.Errorf("token publication changed repeatedly while resolving credentials")
+}
+
+func (m *TokenManager) entry(key tokenManagerKey) *tokenManagerEntry {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.entries == nil {
+		m.entries = make(map[tokenManagerKey]*tokenManagerEntry)
+	}
+	entry := m.entries[key]
+	if entry == nil {
+		entry = &tokenManagerEntry{}
+		m.entries[key] = entry
+	}
+	return entry
+}
+
+func (m *TokenManager) Invalidate() {
+	if m == nil {
+		return
+	}
+	m.mu.Lock()
+	m.entries = make(map[tokenManagerKey]*tokenManagerEntry)
+	m.mu.Unlock()
+}
+
+func resolveTokenSnapshotWithEdition(ctx context.Context, configDir, profile string) (AccessTokenSnapshot, error) {
+	hooks := edition.Get()
+	opaqueStorage := hooks.LoadToken != nil || hooks.SaveToken != nil || hooks.DeleteToken != nil
+	provider := hooks.TokenProvider
+	if provider == nil {
+		snapshot, err := resolveAccessTokenSnapshotFromDir(ctx, configDir, profile)
+		if err != nil {
+			return AccessTokenSnapshot{}, err
+		}
+		// Opaque edition storage hooks have no publication-revision contract.
+		// Resolve them on every logical request instead of caching a token that
+		// may be replaced outside the default auth store.
+		if opaqueStorage {
+			snapshot.ExpiresAt = time.Time{}
+		}
+		return snapshot, nil
+	}
+	var fallbackSnapshot AccessTokenSnapshot
+	var fallbackCalled bool
+	token, err := provider(ctx, func() (string, error) {
+		fallbackCalled = true
+		var fallbackErr error
+		fallbackSnapshot, fallbackErr = resolveAccessTokenSnapshotFromDir(ctx, configDir, profile)
+		if fallbackErr != nil {
+			return "", fallbackErr
+		}
+		return fallbackSnapshot.AccessToken, nil
+	})
+	if err != nil {
+		return AccessTokenSnapshot{}, fmt.Errorf("edition token provider: %w", err)
+	}
+	token = strings.TrimSpace(token)
+	if token == "" {
+		return AccessTokenSnapshot{}, noCredentialsError()
+	}
+	if fallbackCalled && token == fallbackSnapshot.AccessToken {
+		if opaqueStorage {
+			fallbackSnapshot.ExpiresAt = time.Time{}
+		}
+		return fallbackSnapshot, nil
+	}
+	// Edition providers expose no lifetime metadata, so resolve them on every
+	// logical request instead of recreating a process-lifetime string cache.
+	return AccessTokenSnapshot{AccessToken: token, Source: "edition"}, nil
+}
+
+func resolveAccessTokenSnapshotFromDir(ctx context.Context, configDir, profile string) (AccessTokenSnapshot, error) {
+	provider := newAccessTokenProvider(configDir)
+	if snapshotProvider, ok := provider.(accessTokenSnapshotGetter); ok {
+		data, err := snapshotProvider.GetTokenSnapshot(ctx)
+		if err == nil && data != nil && strings.TrimSpace(data.AccessToken) != "" {
+			return AccessTokenSnapshot{
+				AccessToken: strings.TrimSpace(data.AccessToken),
+				ExpiresAt:   data.ExpiresAt,
+				Source:      "oauth",
+			}, nil
+		}
+		if err != nil && !errors.Is(err, authpkg.ErrTokenDataNotFound) {
+			return AccessTokenSnapshot{}, err
+		}
+		if strings.TrimSpace(profile) != "" {
+			return AccessTokenSnapshot{}, authpkg.ErrTokenDataNotFound
+		}
+		return resolveLegacyToken(configDir, err)
+	}
+
+	token, err := provider.GetAccessToken(ctx)
+	if err == nil && strings.TrimSpace(token) != "" {
+		return AccessTokenSnapshot{AccessToken: strings.TrimSpace(token), Source: "oauth_compat"}, nil
+	}
+	if err != nil && !errors.Is(err, authpkg.ErrTokenDataNotFound) {
+		return AccessTokenSnapshot{}, err
+	}
+	if strings.TrimSpace(profile) != "" {
+		return AccessTokenSnapshot{}, authpkg.ErrTokenDataNotFound
+	}
+	return resolveLegacyToken(configDir, err)
+}
+
+func resolveLegacyToken(configDir string, oauthErr error) (AccessTokenSnapshot, error) {
+	token, source, err := newLegacyTokenManager(configDir).GetToken()
+	if err == nil && strings.TrimSpace(token) != "" {
+		return AccessTokenSnapshot{AccessToken: strings.TrimSpace(token), Source: source}, nil
+	}
+	if err != nil && !errors.Is(err, authpkg.ErrTokenDataNotFound) {
+		return AccessTokenSnapshot{}, err
+	}
+	if oauthErr != nil {
+		return AccessTokenSnapshot{}, oauthErr
+	}
+	return AccessTokenSnapshot{}, authpkg.ErrTokenDataNotFound
+}
+
+func resolveAccessTokenFromDir(ctx context.Context, configDir string) (string, error) {
+	snapshot, err := resolveAccessTokenSnapshotFromDir(ctx, configDir, authpkg.RuntimeProfile())
 	if err != nil {
 		return "", err
 	}
-	if tok != "" {
-		return tok, nil
+	return snapshot.AccessToken, nil
+}
+
+// ResolveAuxiliaryAccessToken resolves every non-runner bearer token through
+// the same TokenManager used by MCP tool calls.
+func ResolveAuxiliaryAccessToken(ctx context.Context, configDir, explicitToken string) (string, error) {
+	snapshot, err := runtimeTokenManager.Get(ctx, configDir, explicitToken)
+	if err != nil {
+		return "", err
 	}
-	return "", noCredentialsError()
+	return snapshot.AccessToken, nil
+}
+
+func tokenSnapshotUsable(snapshot AccessTokenSnapshot, now time.Time) bool {
+	return strings.TrimSpace(snapshot.AccessToken) != "" &&
+		!snapshot.ExpiresAt.IsZero() &&
+		now.Before(snapshot.ExpiresAt.Add(-accessTokenRefreshWindow))
+}
+
+func canonicalTokenConfigDir(configDir string) string {
+	if absolute, err := filepath.Abs(configDir); err == nil {
+		return filepath.Clean(absolute)
+	}
+	return filepath.Clean(configDir)
 }
 
 func noCredentialsError() error {
 	if edition.Get().IsEmbedded {
-		return fmt.Errorf("认证信息已失效，请重新认证")
+		return fmt.Errorf("认证信息已失效，请重新认证: %w", authpkg.ErrTokenDataNotFound)
 	}
-	return fmt.Errorf("no credentials found, run: dws auth login")
+	return fmt.Errorf("no credentials found, run: dws auth login: %w", authpkg.ErrTokenDataNotFound)
 }

internal/app/access_token_resolve_test.go

@@ -5,7 +5,15 @@ package app
 
 import (
 	"context"
+	"errors"
+	"net/http"
+	"path/filepath"
+	"strings"
 	"testing"
+	"time"
+
+	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/keychain"
 )
 
 func TestResolveAuxiliaryAccessToken_explicitToken(t *testing.T) {
@@ -24,3 +32,48 @@ func TestResolveAuxiliaryAccessToken_emptyConfigDir(t *testing.T) {
 		t.Fatal("expected error for empty config directory")
 	}
 }
+
+func TestResolveAccessTokenFromDirPreservesRefreshFailure(t *testing.T) {
+	root := t.TempDir()
+	configDir := filepath.Join(root, "config")
+	t.Setenv(keychain.DisableKeychainEnv, "1")
+	t.Setenv(keychain.StorageDirEnv, filepath.Join(root, "keychain"))
+
+	if err := authpkg.SaveTokenData(configDir, &authpkg.TokenData{
+		AccessToken:  "expired-access",
+		RefreshToken: "refresh-token",
+		ExpiresAt:    time.Now().Add(-time.Hour),
+		RefreshExpAt: time.Now().Add(24 * time.Hour),
+		CorpID:       "corp_refresh",
+		UserID:       "user_refresh",
+		ClientID:     "client_refresh",
+		Source:       "mcp",
+	}); err != nil {
+		t.Fatalf("SaveTokenData() error = %v", err)
+	}
+
+	originalTransport := http.DefaultTransport
+	t.Cleanup(func() {
+		http.DefaultTransport = originalTransport
+	})
+	http.DefaultTransport = refreshFailureRoundTripFunc(func(*http.Request) (*http.Response, error) {
+		return nil, errors.New("refresh endpoint rejected token")
+	})
+
+	token, err := resolveAccessTokenFromDir(context.Background(), configDir)
+	if token != "" {
+		t.Fatalf("token = %q, want empty", token)
+	}
+	if err == nil {
+		t.Fatal("resolveAccessTokenFromDir() error = nil")
+	}
+	if !strings.Contains(err.Error(), "refresh endpoint rejected token") {
+		t.Fatalf("error = %q, want original refresh failure", err)
+	}
+}
+
+type refreshFailureRoundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f refreshFailureRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}

internal/app/app_small_coverage_test.go

@@ -34,6 +34,10 @@ func (g fakeAccessTokenGetter) GetAccessToken(context.Context) (string, error) {
 	return g.token, g.err
 }
 
+func (g fakeAccessTokenGetter) ForceRefreshRejectedToken(context.Context, string) (string, error) {
+	return g.token, g.err
+}
+
 type fakeLegacyTokenGetter struct {
 	token string
 	err   error
@@ -212,11 +216,19 @@ func TestCrossPlatformCoverageConfigAndTokenSeamsCoverage(t *testing.T) {
 	if _, err := resolveAccessTokenFromDir(context.Background(), "unused"); !errors.Is(err, authpkg.ErrTokenDecryption) {
 		t.Fatalf("decryption error = %v", err)
 	}
-	newAccessTokenProvider = func(string) accessTokenGetter { return fakeAccessTokenGetter{err: errors.New("missing")} }
+	newAccessTokenProvider = func(string) accessTokenGetter {
+		return fakeAccessTokenGetter{err: authpkg.ErrTokenDataNotFound}
+	}
 	newLegacyTokenManager = func(string) legacyTokenGetter { return fakeLegacyTokenGetter{token: " legacy "} }
 	if got, err := resolveAccessTokenFromDir(context.Background(), "unused"); err != nil || got != "legacy" {
 		t.Fatalf("legacy token = %q, %v", got, err)
 	}
+	authpkg.SetRuntimeProfile("corp:user")
+	t.Cleanup(func() { authpkg.SetRuntimeProfile("") })
+	if got, err := resolveAccessTokenFromDir(context.Background(), "unused"); got != "" || !errors.Is(err, authpkg.ErrTokenDataNotFound) {
+		t.Fatalf("explicit profile fallback = token %q error %v, want profile error", got, err)
+	}
+	authpkg.SetRuntimeProfile("")
 	newAccessTokenProvider = func(string) accessTokenGetter { return fakeAccessTokenGetter{err: errors.New("load")} }
 	newLegacyTokenManager = func(string) legacyTokenGetter { return fakeLegacyTokenGetter{err: errors.New("missing")} }
 	edition.Override(&edition.Hooks{})
@@ -240,10 +252,10 @@ func TestCrossPlatformCoverageConfigAndTokenSeamsCoverage(t *testing.T) {
 }
 
 func TestCrossPlatformCoverageForceRefreshAndStdioFailureCoverage(t *testing.T) {
-	oldMark, oldFactory := markAccessTokenStale, newRefreshProvider
+	oldLoad, oldFactory := loadRefreshTokenData, newRefreshProvider
 	oldStop := stopStdio
 	t.Cleanup(func() {
-		markAccessTokenStale, newRefreshProvider = oldMark, oldFactory
+		loadRefreshTokenData, newRefreshProvider = oldLoad, oldFactory
 		stopStdio = oldStop
 		stdioMu.Lock()
 		stdioClients = make(map[string]*transport.StdioClient)
@@ -251,11 +263,13 @@ func TestCrossPlatformCoverageForceRefreshAndStdioFailureCoverage(t *testing.T)
 	})
 	fail := errors.New("failure")
 	_ = oldFactory(t.TempDir())
-	markAccessTokenStale = func(string) error { return fail }
+	loadRefreshTokenData = func(string) (*authpkg.TokenData, error) { return nil, fail }
 	if _, err := ForceRefreshAccessToken(context.Background(), "config"); !errors.Is(err, fail) {
-		t.Fatalf("mark stale error = %v", err)
+		t.Fatalf("load rejected token error = %v", err)
+	}
+	loadRefreshTokenData = func(string) (*authpkg.TokenData, error) {
+		return &authpkg.TokenData{AccessToken: "rejected"}, nil
 	}
-	markAccessTokenStale = func(string) error { return nil }
 	for _, tc := range []struct {
 		getter fakeAccessTokenGetter
 		want   string
@@ -264,7 +278,7 @@ func TestCrossPlatformCoverageForceRefreshAndStdioFailureCoverage(t *testing.T)
 		{getter: fakeAccessTokenGetter{token: "  "}, want: "empty"},
 		{getter: fakeAccessTokenGetter{token: " refreshed "}},
 	} {
-		newRefreshProvider = func(string) accessTokenGetter { return tc.getter }
+		newRefreshProvider = func(string) rejectedAccessTokenRefresher { return tc.getter }
 		got, err := ForceRefreshAccessToken(context.Background(), "config")
 		if tc.want != "" && (err == nil || !strings.Contains(err.Error(), tc.want)) {
 			t.Fatalf("refresh error = %v, want %q", err, tc.want)

internal/app/audit_command.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/audit"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/output"
 	"github.com/spf13/cobra"
 )
 
@@ -117,9 +118,29 @@ func newAuditVerifyCommand() *cobra.Command {
 				}
 			}
 
-			valid, brokenAt, err := auditVerify(target)
-			if err != nil {
-				return fmt.Errorf("校验失败: %w", err)
+			valid, brokenAt, verifyErr := auditVerify(target)
+			if output.ResolveFormat(cmd, output.FormatTable) == output.FormatJSON {
+				if verifyErr != nil && brokenAt == 0 {
+					return fmt.Errorf("校验失败: %w", verifyErr)
+				}
+				payload := map[string]any{
+					"valid":    valid,
+					"file":     target,
+					"brokenAt": brokenAt,
+				}
+				if verifyErr != nil {
+					payload["reason"] = verifyErr.Error()
+				}
+				if err := output.WriteCommandPayload(cmd, payload, output.FormatTable); err != nil {
+					return err
+				}
+				if !valid {
+					auditExit(1)
+				}
+				return nil
+			}
+			if verifyErr != nil {
+				return fmt.Errorf("校验失败: %w", verifyErr)
 			}
 			if valid {
 				fmt.Printf("✓ %s 哈希链完整（全部通过）\n", filepath.Base(target))

internal/app/audit_output_contract_test.go

@@ -0,0 +1,65 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+
+package app
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+func executeAuditVerifyJSON(t *testing.T, verify func(string) (bool, int, error)) (map[string]any, int, error) {
+	t.Helper()
+	previousVerify, previousExit := auditVerify, auditExit
+	t.Cleanup(func() {
+		auditVerify, auditExit = previousVerify, previousExit
+	})
+	auditVerify = verify
+	exitCode := 0
+	auditExit = func(code int) { exitCode = code }
+
+	root := &cobra.Command{Use: "dws"}
+	root.SilenceErrors = true
+	root.SilenceUsage = true
+	root.PersistentFlags().String("format", "json", "output format")
+	root.AddCommand(newAuditVerifyCommand())
+	var stdout bytes.Buffer
+	root.SetOut(&stdout)
+	root.SetArgs([]string{"verify", "--file", "/tmp/audit.jsonl"})
+	err := root.Execute()
+
+	var payload map[string]any
+	if decodeErr := json.Unmarshal(stdout.Bytes(), &payload); decodeErr != nil {
+		t.Fatalf("audit verify stdout must be one JSON document: %v\n%s", decodeErr, stdout.String())
+	}
+	return payload, exitCode, err
+}
+
+func TestCrossPlatformCoverageAuditVerifyJSONOutputIsSingleDocument(t *testing.T) {
+	payload, exitCode, err := executeAuditVerifyJSON(t, func(string) (bool, int, error) {
+		return true, 0, nil
+	})
+	if err != nil || exitCode != 0 {
+		t.Fatalf("audit verify returned err=%v exit=%d", err, exitCode)
+	}
+	if payload["valid"] != true || payload["file"] != "/tmp/audit.jsonl" || payload["brokenAt"] != float64(0) {
+		t.Fatalf("unexpected audit payload: %#v", payload)
+	}
+}
+
+func TestCrossPlatformCoverageAuditVerifyBrokenJSONIncludesReasonBeforeExit(t *testing.T) {
+	payload, exitCode, err := executeAuditVerifyJSON(t, func(string) (bool, int, error) {
+		return false, 3, errors.New("prev_hash mismatch")
+	})
+	if err != nil || exitCode != 1 {
+		t.Fatalf("broken audit verify returned err=%v exit=%d", err, exitCode)
+	}
+	if payload["valid"] != false || payload["brokenAt"] != float64(3) || payload["reason"] != "prev_hash mismatch" {
+		t.Fatalf("unexpected broken audit payload: %#v", payload)
+	}
+}

internal/app/auth_command.go

@@ -30,6 +30,7 @@ import (
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/helpers"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/keychain"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/logging"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pat"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
@@ -39,12 +40,14 @@ import (
 )
 
 type authLoginConfig struct {
-	Token        string
-	Force        bool
-	Device       bool
-	Recommend    bool
-	Yes          bool
-	TargetCorpID string
+	Token                          string
+	Force                          bool
+	Device                         bool
+	Recommend                      bool
+	Yes                            bool
+	TargetCorpID                   string
+	HistoryProfileSelector         string
+	HistoryProfileSelectorExplicit bool
 }
 
 type authLoginGuideAction string
@@ -85,7 +88,7 @@ func buildAuthCommand(patCaller edition.ToolCaller) *cobra.Command {
 		newAuthMigrateKeychainCommand(),
 		newAuthExportCommand(),
 		newAuthImportCommand(),
-		newAuthExchangeCommand(),
+		newAuthExchangeCommand(patCaller),
 		newAuthResetCommand(),
 	)
 	return cmd
@@ -146,6 +149,12 @@ func newAuthLoginCommand(patCaller edition.ToolCaller) *cobra.Command {
 				provider := authpkg.NewDeviceFlowProvider(configDir, nil)
 				provider.Output = cmd.ErrOrStderr()
 				provider.NoBrowser, _ = cmd.Flags().GetBool("no-browser")
+				provider.IdentityEnricher = func(ctx context.Context, data *authpkg.TokenData) error {
+					return enrichAuthLoginProfileFromContact(ctx, configDir, patCaller, data, authLoginHistoryHint{
+						Selector: cfg.HistoryProfileSelector,
+						Explicit: cfg.HistoryProfileSelectorExplicit,
+					})
+				}
 				tokenData, err = authDeviceLogin(provider, loginCtx)
 				if err != nil {
 					return apperrors.NewAuth(fmt.Sprintf("device authorization failed: %v", err))
@@ -158,6 +167,12 @@ func newAuthLoginCommand(patCaller edition.ToolCaller) *cobra.Command {
 				provider.Output = cmd.ErrOrStderr()
 				provider.NoBrowser, _ = cmd.Flags().GetBool("no-browser")
 				provider.TargetCorpID = cfg.TargetCorpID
+				provider.IdentityEnricher = func(ctx context.Context, data *authpkg.TokenData) error {
+					return enrichAuthLoginProfileFromContact(ctx, configDir, patCaller, data, authLoginHistoryHint{
+						Selector: cfg.HistoryProfileSelector,
+						Explicit: cfg.HistoryProfileSelectorExplicit,
+					})
+				}
 				configureOAuthProviderCompatibility(provider, configDir)
 				tokenData, err = authOAuthLogin(provider, loginCtx, authLoginForcesAuthorization(cfg))
 				if err != nil {
@@ -167,17 +182,25 @@ func newAuthLoginCommand(patCaller edition.ToolCaller) *cobra.Command {
 
 			ResetRuntimeTokenCache()
 			clearCompatCache()
-			if tokenData != nil && strings.TrimSpace(tokenData.CorpID) != "" {
-				_ = enrichAuthLoginProfileFromContact(cmd.Context(), configDir, patCaller, tokenData)
-				ResetRuntimeTokenCache()
-				clearCompatCache()
-			}
-
 			w := cmd.OutOrStdout()
+			postLoginSelector := authpkg.TokenProfileSelector(tokenData)
+			if tokenData != nil && strings.TrimSpace(tokenData.CorpID) != "" && strings.TrimSpace(tokenData.UserID) == "" {
+				if profiles, loadErr := authLoadProfiles(configDir); loadErr == nil && profiles != nil {
+					for i := range profiles.Profiles {
+						profile := profiles.Profiles[i]
+						if strings.TrimSpace(profile.CorpID) == strings.TrimSpace(tokenData.CorpID) && strings.TrimSpace(profile.UserID) == "" {
+							postLoginSelector = profileCLISelector(profile, profiles)
+							break
+						}
+					}
+				}
+			}
 			runPostLoginAuthorization := func() error {
 				if !recommendAuthMode {
 					return nil
 				}
+				restoreProfile := replaceRuntimeProfile(postLoginSelector)
+				defer restoreProfile()
 				recommendScopeMode := pat.LoginRecommendScopeRecommended
 				var initialPlan *pat.LoginRecommendPlan
 				if postLoginTUIMode {
@@ -284,7 +307,7 @@ var (
 	migrateKeychainToFileDEK         = authpkg.MigrateKeychainToFileDEK
 	authMigrateTarget                = func(cmd *cobra.Command) (string, error) { return cmd.Flags().GetString("to") }
 	authRunForm                      = (*huh.Form).Run
-	authSaveTokenData                = authpkg.SaveTokenData
+	authSaveTokenData                = authpkg.SaveLoginTokenData
 	authSaveAppConfig                = authpkg.SaveAppConfig
 	authDeviceLogin                  = func(provider *authpkg.DeviceFlowProvider, ctx context.Context) (*authpkg.TokenData, error) {
 		return provider.Login(ctx)
@@ -303,7 +326,10 @@ var (
 	authRunLoginRecommend       = pat.RunLoginRecommendAuthorizationWithOptions
 	authRunDirectPATWait        = runDirectPATAuthCheckWaitOnly
 	authResolveProfile          = authpkg.ResolveProfile
+	authResolveProfileDeletion  = authpkg.ResolveProfileDeletionScope
 	authRevokeToken             = authpkg.RevokeTokenRemote
+	authRevokeTokenForData      = authpkg.RevokeTokenRemoteForData
+	authLoadTokenForProfile     = authpkg.LoadTokenDataForProfile
 	authDeleteProfileToken      = authpkg.DeleteTokenDataForProfile
 	authEnsureProfilesMigration = authpkg.EnsureProfilesMigration
 	authLoadProfiles            = authpkg.LoadProfiles
@@ -423,9 +449,10 @@ func newAuthLogoutCommand() *cobra.Command {
 		Short: "清除认证信息（默认退出所有组织）",
 		Long: `清除本机钉钉登录态。
 
-默认退出所有已登录组织 profile；指定 --profile 时只退出该组织，不影响其他组织。`,
+默认退出全部账号。--profile 传组织时退出该组织全部账号；传精确账号或本地 profile 名时只退出一个账号。`,
 		Example: `  dws auth logout
   dws auth logout --profile <corpId>
+  dws auth logout --profile <corpId>:<userId>
   dws auth logout --profile "钉钉"`,
 		DisableAutoGenTag: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -455,7 +482,7 @@ func newAuthLogoutCommand() *cobra.Command {
 			return nil
 		},
 	}
-	cmd.Flags().String("profile", "", "指定要退出的 profile 名或 corpId")
+	cmd.Flags().String("profile", "", "指定组织或账号：corpId、corpName、corpId:userId、corpId:userName、corpName:userId、corpName:userName 或本地 profile 名")
 	return cmd
 }
 
@@ -468,7 +495,8 @@ func newAuthStatusCommand() *cobra.Command {
 指定 --profile 时只读取并刷新被选中的 token slot，不会修改 currentProfile。`,
 		Example: `  dws auth status
   dws auth status --profile <corpId>
-  dws auth status --profile "钉钉"
+  dws auth status --profile <corpId>:<userId>
+  dws auth status --profile "钉钉:孙博文"
   dws auth status --profile <corpId> --format json`,
 		DisableAutoGenTag: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -477,6 +505,19 @@ func newAuthStatusCommand() *cobra.Command {
 			if err != nil {
 				return apperrors.NewInternal("failed to read --profile")
 			}
+			profileSelector = strings.TrimSpace(profileSelector)
+			if profileSelector != "" {
+				selected, resolveErr := authpkg.ResolveProfile(configDir, profileSelector)
+				if resolveErr != nil {
+					return apperrors.NewValidation(resolveErr.Error())
+				}
+				if selected == nil {
+					return apperrors.NewValidation(fmt.Sprintf("profile %q not found", profileSelector))
+				}
+				if strings.TrimSpace(selected.UserID) != "" {
+					profileSelector = authpkg.ProfileSelector(*selected)
+				}
+			}
 			restoreProfile := pushRuntimeProfile(profileSelector)
 			defer restoreProfile()
 
@@ -484,6 +525,7 @@ func newAuthStatusCommand() *cobra.Command {
 			refreshed := false
 			var tokenData *authpkg.TokenData
 			var statusErr error
+			var refreshFailure error
 			provider := authpkg.NewOAuthProvider(configDir, nil)
 			configureOAuthProviderCompatibility(provider, configDir)
 			if data, err := authOAuthStatus(provider); err == nil {
@@ -498,18 +540,27 @@ func newAuthStatusCommand() *cobra.Command {
 							refreshed = true
 						}
 					} else if edition.Get().AutoPurgeToken {
+						refreshFailure = refreshErr
 						_ = authDeleteTokenData(configDir)
 					} else if tokenData != nil {
-						_ = authMarkProfileStatus(configDir, tokenData.CorpID, authpkg.ProfileStatusExpired)
+						refreshFailure = refreshErr
+						markSelector := profileSelector
+						if markSelector == "" {
+							markSelector = authpkg.StableTokenProfileSelector(configDir, tokenData)
+						}
+						_ = authMarkProfileStatus(configDir, markSelector, authpkg.ProfileStatusExpired)
 					}
 				}
-				if authStatusAuthenticated(tokenData) {
+				if refreshFailure == nil && authStatusAuthenticated(tokenData) {
 					authenticated = true
 				}
 			} else {
 				statusErr = err
 			}
 			diagnostic := authStatusDiagnosticFromError(statusErr)
+			if refreshFailure != nil {
+				diagnostic = authStatusRefreshDiagnostic(refreshFailure)
+			}
 
 			// Check if JSON output is requested
 			format, _ := cmd.Root().PersistentFlags().GetString("format")
@@ -554,7 +605,7 @@ func newAuthStatusCommand() *cobra.Command {
 			return nil
 		},
 	}
-	cmd.Flags().String("profile", "", "指定要查看的 profile 名或 corpId")
+	cmd.Flags().String("profile", "", "指定组织或账号：corpId、corpName、corpId:userId、corpId:userName、corpName:userId、corpName:userName 或本地 profile 名")
 	return cmd
 }
 
@@ -618,13 +669,40 @@ func newAuthMigrateKeychainCommand() *cobra.Command {
 }
 
 func logoutOneProfile(_ *cobra.Command, ctx context.Context, configDir, selector string) error {
-	if _, err := authResolveProfile(configDir, selector); err != nil {
+	selected, exact, err := authResolveProfileDeletion(configDir, selector)
+	if err != nil {
 		return apperrors.NewValidation(err.Error())
 	}
-	restoreProfile := pushRuntimeProfile(selector)
-	defer restoreProfile()
-	_ = authRevokeToken(ctx)
-	if err := authDeleteProfileToken(configDir, selector); err != nil {
+	if selected == nil {
+		return apperrors.NewValidation(fmt.Sprintf("profile %q not found", selector))
+	}
+	stableSelector := selected.CorpID
+	if exact {
+		if strings.TrimSpace(selected.UserID) == "" {
+			// A blank historical profile can coexist with exact accounts in the
+			// same organization. Preserve the exact local-name selector; reducing
+			// it to corpId would log out the entire organization.
+			stableSelector = strings.TrimSpace(selector)
+		} else {
+			stableSelector = authpkg.ProfileSelector(*selected)
+		}
+		if data, loadErr := authLoadTokenForProfile(configDir, stableSelector); loadErr == nil {
+			_ = authRevokeTokenForData(ctx, data)
+		}
+	} else if cfg, loadErr := authLoadProfiles(configDir); loadErr == nil {
+		for _, profile := range cfg.Profiles {
+			if profile.CorpID != selected.CorpID {
+				continue
+			}
+			if data, tokenErr := authLoadTokenForProfile(configDir, profileCLISelector(profile, cfg)); tokenErr == nil {
+				_ = authRevokeTokenForData(ctx, data)
+			}
+		}
+	}
+	if err := authDeleteProfileToken(configDir, stableSelector); err != nil {
+		if strings.Contains(err.Error(), "not found") {
+			return apperrors.NewValidation(err.Error())
+		}
 		return apperrors.NewInternal(fmt.Sprintf("failed to clear token data: %v", err))
 	}
 	return nil
@@ -642,9 +720,9 @@ func logoutAllProfiles(_ *cobra.Command, ctx context.Context, configDir string)
 		_ = authRevokeToken(ctx)
 	} else {
 		for _, profile := range cfg.Profiles {
-			restoreProfile := pushRuntimeProfile(profile.CorpID)
-			_ = authRevokeToken(ctx)
-			restoreProfile()
+			if data, tokenErr := authLoadTokenForProfile(configDir, profileCLISelector(profile, cfg)); tokenErr == nil {
+				_ = authRevokeTokenForData(ctx, data)
+			}
 		}
 	}
 	if err := authDeleteAllTokenData(configDir); err != nil {
@@ -665,7 +743,19 @@ func pushRuntimeProfile(selector string) func() {
 	}
 }
 
+func replaceRuntimeProfile(selector string) func() {
+	previous := authpkg.RuntimeProfile()
+	authpkg.SetRuntimeProfile(strings.TrimSpace(selector))
+	return func() {
+		authpkg.SetRuntimeProfile(previous)
+	}
+}
+
 func newAuthExportCommand() *cobra.Command {
+	return newAuthExportCommandWithSupport(authpkg.PortableExportSupportError)
+}
+
+func newAuthExportCommandWithSupport(supportError func() error) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "export",
 		Short: "导出可迁移认证包",
@@ -690,6 +780,9 @@ func newAuthExportCommand() *cobra.Command {
 			if !asBase64 && output == "" {
 				return apperrors.NewValidation("--output is required unless --base64 is used")
 			}
+			if err := supportError(); err != nil {
+				return apperrors.NewValidation(err.Error())
+			}
 			if !authPortableExportSupported() {
 				return apperrors.NewValidation(fmt.Sprintf(
 					"macOS 导出认证包需要 file-DEK 模式；请先设置 %s=1 并运行 dws auth status 验证，只有提示密钥不匹配且确认可丢弃旧登录态时，才执行 dws auth reset 后重新登录",
@@ -733,6 +826,10 @@ func newAuthExportCommand() *cobra.Command {
 }
 
 func newAuthImportCommand() *cobra.Command {
+	return newAuthImportCommandWithSupport(authpkg.PortableImportSupportError)
+}
+
+func newAuthImportCommandWithSupport(supportError func() error) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "import",
 		Short: "导入可迁移认证包",
@@ -761,7 +858,9 @@ func newAuthImportCommand() *cobra.Command {
 			if err != nil {
 				return apperrors.NewInternal("failed to read --force")
 			}
-
+			if err := supportError(); err != nil {
+				return apperrors.NewValidation(err.Error())
+			}
 			configDir := defaultConfigDir()
 			if !force && authPortableTargetPopulated(configDir) {
 				return apperrors.NewValidation("检测到已有登录态，请使用 --force 确认覆盖")
@@ -797,7 +896,7 @@ func newAuthImportCommand() *cobra.Command {
 	return cmd
 }
 
-func newAuthExchangeCommand() *cobra.Command {
+func newAuthExchangeCommand(caller edition.ToolCaller) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:               "exchange",
 		Short:             "Exchange an authorization code for credentials",
@@ -819,6 +918,9 @@ func newAuthExchangeCommand() *cobra.Command {
 
 			configDir := defaultConfigDir()
 			provider := authpkg.NewOAuthProvider(configDir, nil)
+			provider.IdentityEnricher = func(ctx context.Context, data *authpkg.TokenData) error {
+				return enrichAuthLoginProfileFromContact(ctx, configDir, caller, data)
+			}
 			configureOAuthProviderCompatibility(provider, configDir)
 			exchangeCtx, cancel := context.WithTimeout(cmd.Context(), time.Minute)
 			defer cancel()
@@ -1137,17 +1239,33 @@ func resolveAuthLoginConfig(cmd *cobra.Command) (authLoginConfig, error) {
 		yes, _ = cmd.Root().PersistentFlags().GetBool("yes")
 		profileSelector, _ = cmd.Root().PersistentFlags().GetString("profile")
 	}
-	targetCorpID, err := resolveAuthLoginTargetCorpID(defaultConfigDir(), profileSelector)
+	targetCorpID, historyProfileSelector, historyProfileSelectorExplicit, err := resolveAuthLoginTarget(defaultConfigDir(), profileSelector)
 	if err != nil {
 		return authLoginConfig{}, err
 	}
+	flow := "oauth"
+	if strings.TrimSpace(token) != "" {
+		flow = "token"
+	} else if device {
+		flow = "device"
+	}
+	logging.AuthDebug(
+		"auth.login.request",
+		"flow", flow,
+		"profile_selector", strings.TrimSpace(profileSelector),
+		"target_corp_id", targetCorpID,
+		"history_profile_selector", historyProfileSelector,
+		"recommend", recommend,
+	)
 	return authLoginConfig{
-		Token:        strings.TrimSpace(token),
-		Force:        force,
-		Device:       device,
-		Recommend:    recommend,
-		Yes:          yes,
-		TargetCorpID: targetCorpID,
+		Token:                          strings.TrimSpace(token),
+		Force:                          force,
+		Device:                         device,
+		Recommend:                      recommend,
+		Yes:                            yes,
+		TargetCorpID:                   targetCorpID,
+		HistoryProfileSelector:         historyProfileSelector,
+		HistoryProfileSelectorExplicit: historyProfileSelectorExplicit,
 	}, nil
 }
 
@@ -1156,17 +1274,57 @@ func authLoginForcesAuthorization(_ authLoginConfig) bool {
 }
 
 func resolveAuthLoginTargetCorpID(configDir, selector string) (string, error) {
+	targetCorpID, _, _, err := resolveAuthLoginTarget(configDir, selector)
+	return targetCorpID, err
+}
+
+// resolveAuthLoginTarget keeps the authorization target separate from the
+// local identity hint used only when contact cannot resolve the logged-in
+// account. An implicit current profile must never constrain a fresh OAuth
+// authorization to that profile's organization.
+func resolveAuthLoginTarget(configDir, selector string) (targetCorpID, historySelector string, explicit bool, err error) {
 	selector = strings.TrimSpace(selector)
 	if selector == "" {
-		return "", nil
+		if profile, resolveErr := authResolveProfile(configDir, ""); resolveErr == nil && profile != nil {
+			return "", authLoginHistorySelector(configDir, profile), false, nil
+		}
+		return "", "", false, nil
 	}
 	if profile, err := authResolveProfile(configDir, selector); err == nil && profile != nil {
-		return strings.TrimSpace(profile.CorpID), nil
+		historySelector := authLoginHistorySelector(configDir, profile)
+		_, _, identityExact := authpkg.ParseIdentitySelector(selector)
+		if selector != strings.TrimSpace(profile.CorpID) && selector != strings.TrimSpace(profile.CorpName) {
+			identityExact = true
+		}
+		return strings.TrimSpace(profile.CorpID), historySelector, identityExact, nil
+	}
+	if _, _, exact := authpkg.ParseIdentitySelector(selector); exact || strings.Contains(selector, ":") {
+		return "", "", true, apperrors.NewValidation(fmt.Sprintf("profile %q not found", selector))
 	}
 	if strings.HasPrefix(selector, "ding") {
-		return selector, nil
+		// A known organization that failed resolution is ambiguous (for
+		// example, two local accounts without an org-current pointer), not a
+		// request to invent a new corpId.
+		if cfg, loadErr := authLoadProfiles(configDir); loadErr == nil && cfg != nil {
+			for i := range cfg.Profiles {
+				if strings.TrimSpace(cfg.Profiles[i].CorpID) == selector {
+					return "", "", true, apperrors.NewValidation(fmt.Sprintf("profile %q is ambiguous; use an exact corpId:userId selector", selector))
+				}
+			}
+		}
+		return selector, "", false, nil
 	}
-	return "", apperrors.NewValidation(fmt.Sprintf("profile %q not found", selector))
+	return "", "", true, apperrors.NewValidation(fmt.Sprintf("profile %q not found", selector))
+}
+
+func authLoginHistorySelector(configDir string, profile *authpkg.Profile) string {
+	if profile == nil {
+		return ""
+	}
+	if cfg, err := authLoadProfiles(configDir); err == nil && cfg != nil {
+		return authpkg.ProfileSelectionSelector(*profile, cfg)
+	}
+	return authpkg.ProfileSelector(*profile)
 }
 
 type contactProfileIdentity struct {
@@ -1176,57 +1334,306 @@ type contactProfileIdentity struct {
 	UserName string
 }
 
-func enrichAuthLoginProfileFromContact(ctx context.Context, configDir string, caller edition.ToolCaller, data *authpkg.TokenData) error {
-	if caller == nil || data == nil {
+type authLoginHistoryHint struct {
+	Selector string
+	Explicit bool
+}
+
+type tokenOverrideToolCaller interface {
+	CallToolWithToken(ctx context.Context, token, productID, toolName string, args map[string]any) (*edition.ToolResult, error)
+}
+
+func enrichAuthLoginProfileFromContact(
+	ctx context.Context,
+	configDir string,
+	caller edition.ToolCaller,
+	data *authpkg.TokenData,
+	hints ...authLoginHistoryHint,
+) error {
+	if data == nil {
 		return nil
 	}
 	corpID := strings.TrimSpace(data.CorpID)
 	if corpID == "" {
 		return nil
 	}
+	logging.AuthDebug(
+		"auth.login.identity.lookup.start",
+		"corp_id", corpID,
+		"user_id", strings.TrimSpace(data.UserID),
+		"user_name", strings.TrimSpace(data.UserName),
+		"corp_name", strings.TrimSpace(data.CorpName),
+	)
 	if strings.TrimSpace(data.CorpName) != "" && strings.TrimSpace(data.UserID) != "" && strings.TrimSpace(data.UserName) != "" {
+		logging.AuthDebug(
+			"auth.login.identity.lookup.result",
+			"source", "token_exchange",
+			"corp_id", corpID,
+			"user_id", strings.TrimSpace(data.UserID),
+			"user_name", strings.TrimSpace(data.UserName),
+			"corp_name", strings.TrimSpace(data.CorpName),
+		)
+		return nil
+	}
+	hint := authLoginHistoryHint{}
+	if len(hints) > 0 {
+		hint = hints[0]
+	}
+	tryHistory := func() bool {
+		reused, historyErr := enrichAuthLoginProfileFromHistory(configDir, data, hint)
+		if historyErr != nil {
+			logging.AuthDebug(
+				"auth.login.identity.history.error",
+				"corp_id", corpID,
+				"error", historyErr,
+			)
+		}
+		return reused
+	}
+	if caller == nil {
+		if strings.TrimSpace(data.UserID) == "" {
+			tryHistory()
+		}
 		return nil
 	}
 
-	restoreProfile := pushRuntimeProfile(corpID)
-	defer restoreProfile()
-	ResetRuntimeTokenCache()
-
-	result, err := caller.CallTool(ctx, "contact", "get_current_user_profile", map[string]any{
-		"profile": corpID,
-	})
+	var (
+		result *edition.ToolResult
+		err    error
+	)
+	if tokenCaller, ok := caller.(tokenOverrideToolCaller); ok && strings.TrimSpace(data.AccessToken) != "" {
+		result, err = tokenCaller.CallToolWithToken(ctx, data.AccessToken, "contact", "get_current_user_profile", nil)
+	} else {
+		if strings.TrimSpace(data.UserID) == "" {
+			tryHistory()
+		}
+		return nil
+	}
 	if err != nil {
-		return err
-	}
-	identity, ok := contactProfileIdentityFromToolResult(result)
-	if !ok {
+		logging.AuthDebug(
+			"auth.login.identity.lookup.error",
+			"corp_id", corpID,
+			"existing_user_id", strings.TrimSpace(data.UserID),
+			"error", err,
+		)
+		if strings.TrimSpace(data.UserID) != "" {
+			return nil
+		}
+		tryHistory()
 		return nil
 	}
+	identity, ok := contactProfileIdentityFromToolResult(result, corpID)
+	if !ok {
+		logging.AuthDebug("auth.login.identity.lookup.empty", "corp_id", corpID)
+		if strings.TrimSpace(data.UserID) == "" {
+			tryHistory()
+		}
+		return nil
+	}
+	logging.AuthDebug(
+		"auth.login.identity.lookup.result",
+		"source", "contact.get_current_user_profile",
+		"corp_id", strings.TrimSpace(identity.CorpID),
+		"user_id", strings.TrimSpace(identity.UserID),
+		"user_name", strings.TrimSpace(identity.UserName),
+		"corp_name", strings.TrimSpace(identity.CorpName),
+	)
 	if identity.CorpID != "" && identity.CorpID != corpID {
-		return fmt.Errorf("contact profile corpId %q does not match login corpId %q", identity.CorpID, corpID)
+		logging.AuthDebug(
+			"auth.login.identity.lookup.mismatch",
+			"login_corp_id", corpID,
+			"contact_corp_id", strings.TrimSpace(identity.CorpID),
+		)
+		if strings.TrimSpace(data.UserID) == "" {
+			tryHistory()
+		}
+		return nil
 	}
 
 	updated := *data
+	exchangeUserID := strings.TrimSpace(data.UserID)
 	if identity.CorpName != "" {
 		updated.CorpName = identity.CorpName
 	}
-	if identity.UserID != "" {
+	if exchangeUserID == "" && identity.UserID != "" {
 		updated.UserID = identity.UserID
 	}
-	if identity.UserName != "" {
+	if identity.UserName != "" && (exchangeUserID == "" || identity.UserID == "" || identity.UserID == exchangeUserID) {
 		updated.UserName = identity.UserName
 	}
+	if strings.TrimSpace(updated.UserID) == "" {
+		reused, historyErr := enrichAuthLoginProfileFromHistory(configDir, &updated, hint)
+		if historyErr != nil {
+			logging.AuthDebug(
+				"auth.login.identity.history.error",
+				"corp_id", corpID,
+				"error", historyErr,
+			)
+		}
+		if reused {
+			*data = updated
+			return nil
+		}
+	}
 	if updated.CorpName == data.CorpName && updated.UserID == data.UserID && updated.UserName == data.UserName {
+		logging.AuthDebug(
+			"auth.login.identity.resolved",
+			"corp_id", corpID,
+			"user_id", strings.TrimSpace(data.UserID),
+			"user_name", strings.TrimSpace(data.UserName),
+			"changed", false,
+		)
 		return nil
 	}
-	if err := authSaveTokenData(configDir, &updated); err != nil {
-		return err
-	}
 	*data = updated
+	logging.AuthDebug(
+		"auth.login.identity.resolved",
+		"corp_id", strings.TrimSpace(data.CorpID),
+		"user_id", strings.TrimSpace(data.UserID),
+		"user_name", strings.TrimSpace(data.UserName),
+		"changed", true,
+	)
 	return nil
 }
 
-func contactProfileIdentityFromToolResult(result *edition.ToolResult) (contactProfileIdentity, bool) {
+// enrichAuthLoginProfileFromHistory recovers display metadata when the contact
+// service cannot describe an external-worker account. Historical profile
+// selection is never proof of the user who completed a fresh authorization:
+// only the token exchange or contact service may supply UserID.
+//
+// An explicit profile remains useful as a storage/selection hint. Keeping it in
+// LegacyOrgScopedProfile prevents the login from switching the process-global
+// current profile while SaveTokenData publishes the UID-less credential to the
+// unresolved organization slot. A historical blank profile is updated in
+// place; an exact historical profile and its token remain untouched.
+func enrichAuthLoginProfileFromHistory(configDir string, data *authpkg.TokenData, hints ...authLoginHistoryHint) (bool, error) {
+	if data == nil || strings.TrimSpace(data.UserID) != "" {
+		return false, nil
+	}
+	corpID := strings.TrimSpace(data.CorpID)
+	if corpID == "" {
+		return false, nil
+	}
+	cfg, err := authLoadProfiles(configDir)
+	if err != nil {
+		return false, err
+	}
+	if cfg == nil {
+		return false, nil
+	}
+	sameCorp := make([]*authpkg.Profile, 0, len(cfg.Profiles))
+	for i := range cfg.Profiles {
+		profile := &cfg.Profiles[i]
+		if strings.TrimSpace(profile.CorpID) != corpID {
+			continue
+		}
+		sameCorp = append(sameCorp, profile)
+	}
+	if len(sameCorp) == 0 {
+		return false, nil
+	}
+
+	hint := authLoginHistoryHint{}
+	if len(hints) > 0 {
+		hint = hints[0]
+	}
+	var candidate *authpkg.Profile
+	if hint.Explicit {
+		candidate = historicalProfileForSelector(corpID, hint.Selector, sameCorp)
+		if candidate == nil {
+			// An explicit account is a hard identity boundary. If that exact
+			// historical hint no longer matches the token's organization, do
+			// not silently substitute org-current, sole, or global-current.
+			return false, nil
+		}
+	} else if len(sameCorp) > 1 {
+		// Organization-current is a storage preference, not proof of which user
+		// completed a fresh authorization. With multiple accounts, only an exact
+		// user selection may be used when the token/contact response has no UID.
+		return false, nil
+	} else {
+		candidate = sameCorp[0]
+	}
+
+	updated := *data
+	if hint.Explicit {
+		updated.LegacyOrgScopedProfile = strings.TrimSpace(hint.Selector)
+	}
+	if strings.TrimSpace(updated.CorpName) == "" {
+		updated.CorpName = strings.TrimSpace(candidate.CorpName)
+	}
+	if strings.TrimSpace(updated.UserName) == "" {
+		updated.UserName = strings.TrimSpace(candidate.UserName)
+	}
+	*data = updated
+	logging.AuthDebug(
+		"auth.login.identity.resolved",
+		"source", "local_profile_history_display_only",
+		"corp_id", corpID,
+		"user_id", updated.UserID,
+		"user_name", updated.UserName,
+		"corp_name", updated.CorpName,
+		"identity_proven", false,
+	)
+	return true, nil
+}
+
+func historicalProfileForSelector(corpID, selector string, profiles []*authpkg.Profile) *authpkg.Profile {
+	selector = strings.TrimSpace(selector)
+	if selector == "" {
+		return nil
+	}
+	cfg := &authpkg.ProfilesConfig{Profiles: make([]authpkg.Profile, 0, len(profiles))}
+	for _, profile := range profiles {
+		if profile != nil {
+			cfg.Profiles = append(cfg.Profiles, *profile)
+		}
+	}
+	var stableMatch *authpkg.Profile
+	for _, profile := range profiles {
+		if profile == nil || strings.TrimSpace(profile.CorpID) != strings.TrimSpace(corpID) ||
+			authpkg.ProfileSelectionSelector(*profile, cfg) != selector {
+			continue
+		}
+		if stableMatch != nil {
+			return nil
+		}
+		stableMatch = profile
+	}
+	if stableMatch != nil {
+		return stableMatch
+	}
+	if selectedCorpID, userID, exact := authpkg.ParseIdentitySelector(selector); exact {
+		if strings.TrimSpace(selectedCorpID) != strings.TrimSpace(corpID) {
+			return nil
+		}
+		for _, profile := range profiles {
+			if profile != nil && strings.TrimSpace(profile.UserID) == strings.TrimSpace(userID) {
+				return profile
+			}
+		}
+		return nil
+	}
+	var named *authpkg.Profile
+	for _, profile := range profiles {
+		if profile == nil || strings.TrimSpace(profile.Name) != selector {
+			continue
+		}
+		if named != nil {
+			return nil
+		}
+		named = profile
+	}
+	if named != nil {
+		return named
+	}
+	if selector == strings.TrimSpace(corpID) && len(profiles) == 1 {
+		return profiles[0]
+	}
+	return nil
+}
+
+func contactProfileIdentityFromToolResult(result *edition.ToolResult, expectedCorpIDs ...string) (contactProfileIdentity, bool) {
 	if result == nil {
 		return contactProfileIdentity{}, false
 	}
@@ -1234,14 +1641,14 @@ func contactProfileIdentityFromToolResult(result *edition.ToolResult) (contactPr
 		if strings.TrimSpace(block.Text) == "" {
 			continue
 		}
-		if identity, ok := contactProfileIdentityFromJSON([]byte(block.Text)); ok {
+		if identity, ok := contactProfileIdentityFromJSON([]byte(block.Text), expectedCorpIDs...); ok {
 			return identity, true
 		}
 	}
 	return contactProfileIdentity{}, false
 }
 
-func contactProfileIdentityFromJSON(data []byte) (contactProfileIdentity, bool) {
+func contactProfileIdentityFromJSON(data []byte, expectedCorpIDs ...string) (contactProfileIdentity, bool) {
 	var payload struct {
 		Result []struct {
 			OrgEmployeeModel struct {
@@ -1249,6 +1656,7 @@ func contactProfileIdentityFromJSON(data []byte) (contactProfileIdentity, bool)
 				OrgName     string `json:"orgName"`
 				UserID      string `json:"userId"`
 				UserIDLower string `json:"userid"`
+				OrgUserID   string `json:"orgUserId"`
 				OrgUserName string `json:"orgUserName"`
 				Name        string `json:"name"`
 			} `json:"orgEmployeeModel"`
@@ -1260,14 +1668,40 @@ func contactProfileIdentityFromJSON(data []byte) (contactProfileIdentity, bool)
 	if len(payload.Result) == 0 {
 		return contactProfileIdentity{}, false
 	}
-	org := payload.Result[0].OrgEmployeeModel
-	identity := contactProfileIdentity{
-		CorpID:   strings.TrimSpace(org.CorpID),
-		CorpName: strings.TrimSpace(org.OrgName),
-		UserID:   firstNonEmptyString(org.UserID, org.UserIDLower),
-		UserName: firstNonEmptyString(org.OrgUserName, org.Name),
+	identities := make([]contactProfileIdentity, 0, len(payload.Result))
+	for i := range payload.Result {
+		org := payload.Result[i].OrgEmployeeModel
+		identity := contactProfileIdentity{
+			CorpID:   strings.TrimSpace(org.CorpID),
+			CorpName: strings.TrimSpace(org.OrgName),
+			UserID:   firstNonEmptyString(org.UserID, org.UserIDLower, org.OrgUserID),
+			UserName: firstNonEmptyString(org.OrgUserName, org.Name),
+		}
+		if identity.CorpID != "" || identity.CorpName != "" || identity.UserID != "" || identity.UserName != "" {
+			identities = append(identities, identity)
+		}
 	}
-	return identity, identity.CorpID != "" || identity.CorpName != "" || identity.UserID != "" || identity.UserName != ""
+	if len(identities) == 0 {
+		return contactProfileIdentity{}, false
+	}
+	expectedCorpID := ""
+	if len(expectedCorpIDs) > 0 {
+		expectedCorpID = strings.TrimSpace(expectedCorpIDs[0])
+	}
+	if expectedCorpID != "" {
+		for _, identity := range identities {
+			if identity.CorpID == expectedCorpID {
+				return identity, true
+			}
+		}
+		// Older contact responses omit corpId. A single result is still
+		// unambiguous; multiple organization records without a target match
+		// must fall back to local history instead of choosing result[0].
+		if len(payload.Result) != 1 {
+			return contactProfileIdentity{}, false
+		}
+	}
+	return identities[0], true
 }
 
 func firstNonEmptyString(values ...string) string {
@@ -1351,6 +1785,17 @@ func authStatusDiagnosticFromError(err error) *authStatusDiagnostic {
 	}
 }
 
+func authStatusRefreshDiagnostic(err error) *authStatusDiagnostic {
+	if err == nil {
+		return nil
+	}
+	return &authStatusDiagnostic{
+		Reason:  "token_refresh_failed",
+		Message: fmt.Sprintf("Token 刷新失败: %v", err),
+		Hint:    "请重新运行 dws auth login 完成授权。",
+	}
+}
+
 func writeAuthStatusJSON(w io.Writer, authenticated, refreshed bool, data *authpkg.TokenData, diagnostic *authStatusDiagnostic) error {
 	resp := authStatusResponse{
 		Success:       true,

internal/app/auth_command_full_coverage_test.go

@@ -28,6 +28,9 @@ type authCoverageCaller struct {
 func (c *authCoverageCaller) CallTool(context.Context, string, string, map[string]any) (*edition.ToolResult, error) {
 	return c.result, c.err
 }
+func (c *authCoverageCaller) CallToolWithToken(ctx context.Context, _ string, productID, toolName string, args map[string]any) (*edition.ToolResult, error) {
+	return c.CallTool(ctx, productID, toolName, args)
+}
 func (*authCoverageCaller) Format() string { return "json" }
 func (*authCoverageCaller) DryRun() bool   { return false }
 func (*authCoverageCaller) Fields() string { return "" }
@@ -67,12 +70,16 @@ func authCoverageRunLogin(t *testing.T, caller edition.ToolCaller, format string
 
 func TestCrossPlatformCoverageAuthCoverageFormsParentAndTargets(t *testing.T) {
 	oldEdition := edition.Get()
+	oldClientID := authpkg.ClientID()
+	oldClientSecret := authpkg.ClientSecret()
 	oldRunForm := authRunForm
 	oldPrompt := authLoginManualCredentialsPrompt
 	oldSaveConfig := authSaveAppConfig
 	oldResolve := authResolveProfile
 	t.Cleanup(func() {
 		edition.Override(oldEdition)
+		authpkg.SetClientID(oldClientID)
+		authpkg.SetClientSecret(oldClientSecret)
 		authRunForm = oldRunForm
 		authLoginManualCredentialsPrompt = oldPrompt
 		authSaveAppConfig = oldSaveConfig
@@ -255,7 +262,10 @@ func TestCrossPlatformCoverageAuthCoverageLoginFlows(t *testing.T) {
 	if _, _, err := authCoverageRunLogin(t, nil, "table", true, map[string]string{"device": "true"}); err == nil {
 		t.Fatal("device error should propagate")
 	}
-	authDeviceLogin = func(*authpkg.DeviceFlowProvider, context.Context) (*authpkg.TokenData, error) {
+	authDeviceLogin = func(provider *authpkg.DeviceFlowProvider, _ context.Context) (*authpkg.TokenData, error) {
+		if provider.IdentityEnricher == nil {
+			t.Error("device login missing shared identity enricher")
+		}
 		return &authpkg.TokenData{AccessToken: "a", ExpiresAt: time.Now().Add(time.Hour)}, nil
 	}
 	if _, _, err := authCoverageRunLogin(t, nil, "table", true, map[string]string{"device": "true", "no-browser": "true"}); err != nil {
@@ -268,7 +278,10 @@ func TestCrossPlatformCoverageAuthCoverageLoginFlows(t *testing.T) {
 	if _, _, err := authCoverageRunLogin(t, nil, "table", true, nil); err == nil {
 		t.Fatal("oauth error should propagate")
 	}
-	authOAuthLogin = func(*authpkg.OAuthProvider, context.Context, bool) (*authpkg.TokenData, error) {
+	authOAuthLogin = func(provider *authpkg.OAuthProvider, _ context.Context, _ bool) (*authpkg.TokenData, error) {
+		if provider.IdentityEnricher == nil {
+			t.Error("OAuth login missing shared identity enricher")
+		}
 		return &authpkg.TokenData{
 			AccessToken: "a", ExpiresAt: time.Now().Add(time.Hour), RefreshToken: "r", RefreshExpAt: time.Now().Add(48 * time.Hour),
 			CorpName: "Corp", CorpID: "ding1", UserName: "User", UserID: "u",
@@ -349,18 +362,26 @@ func TestCrossPlatformCoverageAuthCoverageContactEnrichment(t *testing.T) {
 	if err := enrichAuthLoginProfileFromContact(ctx, "cfg", &authCoverageCaller{}, complete); err != nil {
 		t.Fatal(err)
 	}
-	if err := enrichAuthLoginProfileFromContact(ctx, "cfg", &authCoverageCaller{err: errors.New("call")}, &authpkg.TokenData{CorpID: "ding"}); err == nil {
-		t.Fatal("caller error should propagate")
+	if err := enrichAuthLoginProfileFromContact(ctx, "cfg", &authCoverageCaller{err: errors.New("call")}, &authpkg.TokenData{CorpID: "ding"}); err != nil {
+		t.Fatalf("contact failure must remain best effort: %v", err)
+	}
+	if err := enrichAuthLoginProfileFromContact(
+		ctx,
+		"cfg",
+		&authCoverageCaller{err: errors.New("call")},
+		&authpkg.TokenData{CorpID: "ding", UserID: "known", AccessToken: "token"},
+	); err != nil {
+		t.Fatalf("optional contact metadata failure with known userId = %v", err)
 	}
 	for _, text := range []string{"", "not-json", `{"result":[]}`, `{"result":[{"orgEmployeeModel":{}}]}`} {
 		caller := &authCoverageCaller{result: &edition.ToolResult{Content: []edition.ContentBlock{{Text: text}}}}
-		if err := enrichAuthLoginProfileFromContact(ctx, "cfg", caller, &authpkg.TokenData{CorpID: "ding"}); err != nil {
+		if err := enrichAuthLoginProfileFromContact(ctx, "cfg", caller, &authpkg.TokenData{CorpID: "ding", AccessToken: "token"}); err != nil {
 			t.Fatalf("invalid contact %q: %v", text, err)
 		}
 	}
 	mismatch := &authCoverageCaller{result: &edition.ToolResult{Content: []edition.ContentBlock{{Text: `{"result":[{"orgEmployeeModel":{"corpId":"other"}}]}`}}}}
-	if err := enrichAuthLoginProfileFromContact(ctx, "cfg", mismatch, &authpkg.TokenData{CorpID: "ding"}); err == nil {
-		t.Fatal("corp mismatch should fail")
+	if err := enrichAuthLoginProfileFromContact(ctx, "cfg", mismatch, &authpkg.TokenData{CorpID: "ding", AccessToken: "token"}); err != nil {
+		t.Fatalf("contact corp mismatch must remain best effort: %v", err)
 	}
 	same := &authCoverageCaller{result: &edition.ToolResult{Content: []edition.ContentBlock{{Text: `{"result":[{"orgEmployeeModel":{"corpId":"ding","orgName":"Corp","userid":"u","name":"User"}}]}`}}}}
 	if err := enrichAuthLoginProfileFromContact(ctx, "cfg", same, complete); err != nil {
@@ -371,14 +392,29 @@ func TestCrossPlatformCoverageAuthCoverageContactEnrichment(t *testing.T) {
 		t.Fatal(err)
 	}
 	authSaveTokenData = func(string, *authpkg.TokenData) error { return errors.New("save") }
-	if err := enrichAuthLoginProfileFromContact(ctx, "cfg", same, &authpkg.TokenData{CorpID: "ding"}); err == nil {
-		t.Fatal("enrichment save should fail")
-	}
-	authSaveTokenData = func(string, *authpkg.TokenData) error { return nil }
-	data := &authpkg.TokenData{CorpID: "ding"}
+	data := &authpkg.TokenData{CorpID: "ding", AccessToken: "token"}
 	if err := enrichAuthLoginProfileFromContact(ctx, "cfg", same, data); err != nil || data.CorpName != "Corp" || data.UserID != "u" {
 		t.Fatalf("enriched = %#v, %v", data, err)
 	}
+	known := &authpkg.TokenData{CorpID: "ding", UserID: "exchange-user", AccessToken: "token"}
+	differentContactUser := &authCoverageCaller{result: &edition.ToolResult{Content: []edition.ContentBlock{{Text: `{"result":[{"orgEmployeeModel":{"corpId":"ding","orgName":"Corp","userid":"other-user","name":"Other User"}}]}`}}}}
+	if err := enrichAuthLoginProfileFromContact(ctx, "cfg", differentContactUser, known); err != nil {
+		t.Fatal(err)
+	}
+	if known.UserID != "exchange-user" || known.UserName != "" || known.CorpName != "Corp" {
+		t.Fatalf("token-exchange identity was overwritten: %#v", known)
+	}
+	multiOrg := &authCoverageCaller{result: &edition.ToolResult{Content: []edition.ContentBlock{{Text: `{"result":[{"orgEmployeeModel":{"corpId":"other","userid":"other-user"}},{"orgEmployeeModel":{"corpId":"ding","orgName":"Target Corp","userid":"target-user","name":"Target User"}}]}`}}}}
+	multiOrgData := &authpkg.TokenData{CorpID: "ding", AccessToken: "token"}
+	if err := enrichAuthLoginProfileFromContact(ctx, "cfg", multiOrg, multiOrgData); err != nil || multiOrgData.UserID != "target-user" || multiOrgData.CorpName != "Target Corp" {
+		t.Fatalf("multi-org contact selection = %#v, %v", multiOrgData, err)
+	}
+	if _, ok := contactProfileIdentityFromJSON(
+		[]byte(`{"result":[{"orgEmployeeModel":{"corpId":"other-a","userid":"user-a"}},{"orgEmployeeModel":{"corpId":"other-b","userid":"user-b"}}]}`),
+		"ding",
+	); ok {
+		t.Fatal("multiple nonmatching organizations must not select an arbitrary contact identity")
+	}
 	if _, ok := contactProfileIdentityFromToolResult(nil); ok {
 		t.Fatal("nil result should not parse")
 	}
@@ -387,6 +423,570 @@ func TestCrossPlatformCoverageAuthCoverageContactEnrichment(t *testing.T) {
 	}
 }
 
+func TestCrossPlatformCoverageContactFailureReusesOnlySameCorpHistoricalDisplayMetadata(t *testing.T) {
+	configDir := t.TempDir()
+	if err := authpkg.SaveProfiles(configDir, &authpkg.ProfilesConfig{
+		Version: 1,
+		Profiles: []authpkg.Profile{{
+			CorpID:   "ding_ecological_worker",
+			CorpName: "Historical Corp",
+			UserID:   "external-user",
+			UserName: "Historical Worker",
+		}},
+	}); err != nil {
+		t.Fatalf("SaveProfiles() error = %v", err)
+	}
+
+	for _, tc := range []struct {
+		name     string
+		caller   edition.ToolCaller
+		wantCorp string
+	}{
+		{
+			name: "contact business error",
+			caller: &authCoverageCaller{err: apperrors.NewAPI(
+				"business error: success=false",
+				apperrors.WithReason("business_error"),
+			)},
+			wantCorp: "Fresh Corp",
+		},
+		{
+			name:     "contact has no identity",
+			caller:   &authCoverageCaller{result: &edition.ToolResult{Content: []edition.ContentBlock{{Text: `{"success":false}`}}}},
+			wantCorp: "Fresh Corp",
+		},
+		{
+			name: "contact identity is missing user id",
+			caller: &authCoverageCaller{result: &edition.ToolResult{Content: []edition.ContentBlock{{
+				Text: `{"result":[{"orgEmployeeModel":{"corpId":"ding_ecological_worker","orgName":"Contact Corp"}}]}`,
+			}}}},
+			wantCorp: "Contact Corp",
+		},
+		{
+			name:     "ordinary contact error",
+			caller:   &authCoverageCaller{err: errors.New("network failure")},
+			wantCorp: "Fresh Corp",
+		},
+		{
+			name: "other contact business error",
+			caller: &authCoverageCaller{err: apperrors.NewAPI(
+				"permission denied",
+				apperrors.WithReason("business_error"),
+			)},
+			wantCorp: "Fresh Corp",
+		},
+		{
+			name:     "contact caller unavailable",
+			caller:   nil,
+			wantCorp: "Fresh Corp",
+		},
+		{
+			name: "contact returns another organization",
+			caller: &authCoverageCaller{result: &edition.ToolResult{Content: []edition.ContentBlock{{
+				Text: `{"result":[{"orgEmployeeModel":{"corpId":"ding_other","userid":"other-user"}}]}`,
+			}}}},
+			wantCorp: "Fresh Corp",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			data := &authpkg.TokenData{
+				AccessToken:  "new-access",
+				RefreshToken: "new-refresh",
+				CorpID:       "ding_ecological_worker",
+				CorpName:     "Fresh Corp",
+			}
+			if err := enrichAuthLoginProfileFromContact(context.Background(), configDir, tc.caller, data); err != nil {
+				t.Fatalf("contact failure blocked historical identity recovery: %v", err)
+			}
+			if data.UserID != "" || data.UserName != "Historical Worker" {
+				t.Fatalf("historical metadata supplied UID evidence: %#v", data)
+			}
+			if data.CorpName != tc.wantCorp {
+				t.Fatalf("corp name = %q, want %q", data.CorpName, tc.wantCorp)
+			}
+			if data.AccessToken != "new-access" || data.RefreshToken != "new-refresh" {
+				t.Fatalf("new token material was changed: %#v", data)
+			}
+		})
+	}
+}
+
+func TestCrossPlatformCoverageContactFailureDoesNotGuessHistoricalIdentity(t *testing.T) {
+	businessErr := apperrors.NewAPI(
+		"business error: success=false",
+		apperrors.WithReason("business_error"),
+	)
+	for _, tc := range []struct {
+		name     string
+		corpID   string
+		profiles []authpkg.Profile
+		callErr  error
+	}{
+		{
+			name:   "same corp has two identities",
+			corpID: "ding_ecological_worker",
+			profiles: []authpkg.Profile{
+				{CorpID: "ding_ecological_worker", UserID: "external-user"},
+				{CorpID: "ding_ecological_worker", UserID: "external-user-b"},
+			},
+			callErr: businessErr,
+		},
+		{
+			name:   "same corp has one identity and one blank profile",
+			corpID: "ding_ecological_worker",
+			profiles: []authpkg.Profile{
+				{CorpID: "ding_ecological_worker", UserID: "external-user"},
+				{CorpID: "ding_ecological_worker"},
+			},
+			callErr: businessErr,
+		},
+		{
+			name:   "identity belongs to another corp",
+			corpID: "ding_ecological_worker",
+			profiles: []authpkg.Profile{
+				{CorpID: "ding_other", UserID: "external-user"},
+			},
+			callErr: businessErr,
+		},
+		{
+			name:    "no historical identity",
+			corpID:  "ding_ecological_worker",
+			callErr: businessErr,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			configDir := t.TempDir()
+			if err := authpkg.SaveProfiles(configDir, &authpkg.ProfilesConfig{Version: 2, Profiles: tc.profiles}); err != nil {
+				t.Fatalf("SaveProfiles() error = %v", err)
+			}
+			data := &authpkg.TokenData{AccessToken: "new-access", CorpID: tc.corpID}
+			err := enrichAuthLoginProfileFromContact(
+				context.Background(),
+				configDir,
+				&authCoverageCaller{err: tc.callErr},
+				data,
+			)
+			if err != nil {
+				t.Fatalf("contact failure must not block unresolved legacy login: %v", err)
+			}
+			if data.UserID != "" {
+				t.Fatalf("ambiguous/cross-corp identity was reused: %#v", data)
+			}
+		})
+	}
+}
+
+func TestCrossPlatformCoverageContactHistoryFallbackEdges(t *testing.T) {
+	for _, data := range []*authpkg.TokenData{
+		nil,
+		{UserID: "known"},
+		{},
+	} {
+		reused, err := enrichAuthLoginProfileFromHistory(t.TempDir(), data)
+		if reused || err != nil {
+			t.Fatalf("ineligible history fallback = %v, %v", reused, err)
+		}
+	}
+
+	configDir := t.TempDir()
+	if err := authpkg.SaveProfiles(configDir, &authpkg.ProfilesConfig{
+		Version: 2,
+		Profiles: []authpkg.Profile{{
+			CorpID:   "ding_external",
+			CorpName: "Historical Corp",
+			UserID:   "external-user",
+			UserName: "Historical Worker",
+		}},
+	}); err != nil {
+		t.Fatalf("SaveProfiles() error = %v", err)
+	}
+	data := &authpkg.TokenData{CorpID: "ding_external"}
+	reused, err := enrichAuthLoginProfileFromHistory(configDir, data)
+	if err != nil || !reused {
+		t.Fatalf("history fallback = %v, %v", reused, err)
+	}
+	if data.CorpName != "Historical Corp" || data.UserName != "Historical Worker" || data.UserID != "" {
+		t.Fatalf("history metadata = %#v", data)
+	}
+
+	corruptDir := t.TempDir()
+	if err := os.Mkdir(authpkg.ProfilesPath(corruptDir), 0o700); err != nil {
+		t.Fatalf("create unreadable profiles path: %v", err)
+	}
+	if reused, err := enrichAuthLoginProfileFromHistory(corruptDir, &authpkg.TokenData{CorpID: "ding_external"}); reused || err == nil {
+		t.Fatalf("corrupt history fallback = %v, %v; want load error", reused, err)
+	}
+
+	businessErr := apperrors.NewAPI(
+		"business error: success=false",
+		apperrors.WithReason("business_error"),
+	)
+	for _, tc := range []struct {
+		name   string
+		caller *authCoverageCaller
+	}{
+		{
+			name:   "contact business error",
+			caller: &authCoverageCaller{err: businessErr},
+		},
+		{
+			name:   "contact has no identity",
+			caller: &authCoverageCaller{result: &edition.ToolResult{}},
+		},
+		{
+			name: "contact identity is missing user id",
+			caller: &authCoverageCaller{result: &edition.ToolResult{Content: []edition.ContentBlock{{
+				Text: `{"result":[{"orgEmployeeModel":{"corpId":"ding_external"}}]}`,
+			}}}},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			err := enrichAuthLoginProfileFromContact(
+				context.Background(),
+				corruptDir,
+				tc.caller,
+				&authpkg.TokenData{CorpID: "ding_external", AccessToken: "new-access"},
+			)
+			if err != nil {
+				t.Fatalf("best-effort contact/history lookup blocked login: %v", err)
+			}
+		})
+	}
+}
+
+func TestCrossPlatformCoverageAuthLoginConfigPreservesHistoryIdentityHint(t *testing.T) {
+	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
+	oldResolve := authResolveProfile
+	oldLoad := authLoadProfiles
+	t.Cleanup(func() {
+		authResolveProfile = oldResolve
+		authLoadProfiles = oldLoad
+	})
+
+	explicit := &authpkg.Profile{CorpID: "ding_same", UserID: "user_2", Name: "second"}
+	current := &authpkg.Profile{CorpID: "ding_current", UserID: "current_user"}
+	authResolveProfile = func(_ string, selector string) (*authpkg.Profile, error) {
+		switch selector {
+		case "ding_same:user_2":
+			clone := *explicit
+			return &clone, nil
+		case "external-worker":
+			return &authpkg.Profile{Name: "external-worker", CorpID: "ding_external"}, nil
+		case "":
+			clone := *current
+			return &clone, nil
+		default:
+			return nil, errors.New("missing")
+		}
+	}
+	authLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
+		return &authpkg.ProfilesConfig{}, nil
+	}
+
+	cmd := newAuthLoginCommand(nil)
+	root, _, _ := authCoverageRoot(cmd, "table", true)
+	if err := root.PersistentFlags().Set("profile", "ding_same:user_2"); err != nil {
+		t.Fatal(err)
+	}
+	cfg, err := resolveAuthLoginConfig(cmd)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.TargetCorpID != "ding_same" || cfg.HistoryProfileSelector != "ding_same:user_2" || !cfg.HistoryProfileSelectorExplicit {
+		t.Fatalf("explicit login config = %#v", cfg)
+	}
+	if target, hint, exact, err := resolveAuthLoginTarget("cfg", "external-worker"); err != nil ||
+		target != "ding_external" || hint != "ding_external" || !exact {
+		t.Fatalf("blank-userId profile target = %q/%q/%v, %v", target, hint, exact, err)
+	}
+
+	if err := root.PersistentFlags().Set("profile", ""); err != nil {
+		t.Fatal(err)
+	}
+	cfg, err = resolveAuthLoginConfig(cmd)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.TargetCorpID != "" || cfg.HistoryProfileSelector != "ding_current:current_user" || cfg.HistoryProfileSelectorExplicit {
+		t.Fatalf("implicit login config constrained authorization target: %#v", cfg)
+	}
+
+	if _, _, _, err := resolveAuthLoginTarget("cfg", "ding_same:missing"); err == nil {
+		t.Fatal("missing exact profile must not be reinterpreted as a corpId")
+	}
+	if target, hint, explicitHint, err := resolveAuthLoginTarget("cfg", "ding_new"); err != nil || target != "ding_new" || hint != "" || explicitHint {
+		t.Fatalf("new organization target = %q/%q/%v, %v", target, hint, explicitHint, err)
+	}
+	authLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
+		return &authpkg.ProfilesConfig{Profiles: []authpkg.Profile{
+			{CorpID: "ding_ambiguous", UserID: "user_1"},
+			{CorpID: "ding_ambiguous", UserID: "user_2"},
+		}}, nil
+	}
+	if _, _, _, err := resolveAuthLoginTarget("cfg", "ding_ambiguous"); err == nil {
+		t.Fatal("ambiguous known organization must require an exact profile")
+	}
+}
+
+func TestCrossPlatformCoverageOAuthAndDeviceKeepFreshUnknownIdentityIsolatedFromExactHistory(t *testing.T) {
+	oldResolve := authResolveProfile
+	oldLoad := authLoadProfiles
+	oldDevice := authDeviceLogin
+	oldOAuth := authOAuthLogin
+	oldInteractive := authLoginInteractiveTerminal
+	t.Cleanup(func() {
+		authResolveProfile = oldResolve
+		authLoadProfiles = oldLoad
+		authDeviceLogin = oldDevice
+		authOAuthLogin = oldOAuth
+		authLoginInteractiveTerminal = oldInteractive
+	})
+
+	authResolveProfile = authpkg.ResolveProfile
+	authLoadProfiles = authpkg.LoadProfiles
+	authLoginInteractiveTerminal = func() bool { return false }
+	t.Cleanup(func() { authpkg.SetRuntimeProfile("") })
+
+	for _, flow := range []string{"oauth", "device"} {
+		t.Run(flow, func(t *testing.T) {
+			configDir := t.TempDir()
+			keychainDir := t.TempDir()
+			t.Setenv("DWS_CONFIG_DIR", configDir)
+			t.Setenv(keychain.DisableKeychainEnv, "1")
+			t.Setenv(keychain.StorageDirEnv, keychainDir)
+			// StorageDirEnv isolates file-backed keychains, while Windows uses
+			// DPAPI-protected HKCU values. Give every flow its own namespace so
+			// OAuth/device fixtures cannot leak into each other or later tests.
+			t.Setenv(keychain.TestNamespaceEnv, keychainDir)
+			t.Cleanup(func() {
+				if err := keychain.RemoveAuthTokenEntries(keychain.Service); err != nil {
+					t.Errorf("clean auth keychain fixture: %v", err)
+				}
+			})
+			authpkg.SetRuntimeProfile("")
+
+			const (
+				corpID        = "ding_same"
+				historicalUID = "user_a"
+				exactSelector = corpID + ":" + historicalUID
+			)
+			oldToken := &authpkg.TokenData{
+				AccessToken:  "old-user-a-access",
+				RefreshToken: "old-user-a-refresh",
+				ExpiresAt:    time.Now().Add(time.Hour),
+				RefreshExpAt: time.Now().Add(24 * time.Hour),
+				CorpID:       corpID,
+				CorpName:     "Same Corp",
+				UserID:       historicalUID,
+				UserName:     "Historical User A",
+			}
+			if err := authpkg.SaveTokenData(configDir, oldToken); err != nil {
+				t.Fatalf("persist historical exact identity: %v", err)
+			}
+
+			caller := &authCoverageCaller{err: errors.New("contact unavailable")}
+			var enriched *authpkg.TokenData
+			freshToken := func() *authpkg.TokenData {
+				return &authpkg.TokenData{
+					AccessToken:  "fresh-user-b-access-" + flow,
+					RefreshToken: "fresh-user-b-refresh-" + flow,
+					ExpiresAt:    time.Now().Add(time.Hour),
+					RefreshExpAt: time.Now().Add(24 * time.Hour),
+					CorpID:       corpID,
+				}
+			}
+			persistUnknown := func(ctx context.Context, identityEnricher func(context.Context, *authpkg.TokenData) error) (*authpkg.TokenData, error) {
+				if identityEnricher == nil {
+					return nil, errors.New("missing identity enricher")
+				}
+				data := freshToken()
+				if err := identityEnricher(ctx, data); err != nil {
+					return nil, err
+				}
+				enriched = data
+				if data.UserID != "" {
+					return nil, fmt.Errorf("historical profile supplied unproven userId %q", data.UserID)
+				}
+				if err := authpkg.SaveTokenData(configDir, data); err != nil {
+					return nil, err
+				}
+				return data, nil
+			}
+
+			flags := map[string]string{"profile": exactSelector}
+			switch flow {
+			case "device":
+				flags["device"] = "true"
+				authDeviceLogin = func(provider *authpkg.DeviceFlowProvider, ctx context.Context) (*authpkg.TokenData, error) {
+					return persistUnknown(ctx, provider.IdentityEnricher)
+				}
+			case "oauth":
+				authOAuthLogin = func(provider *authpkg.OAuthProvider, ctx context.Context, _ bool) (*authpkg.TokenData, error) {
+					if provider.TargetCorpID != corpID {
+						return nil, fmt.Errorf("OAuth target corp = %q", provider.TargetCorpID)
+					}
+					return persistUnknown(ctx, provider.IdentityEnricher)
+				}
+			}
+			if _, _, err := authCoverageRunLogin(t, caller, "table", true, flags); err != nil {
+				t.Fatalf("%s login with unresolved fresh identity: %v", flow, err)
+			}
+			if enriched == nil || enriched.UserID != "" ||
+				enriched.LegacyOrgScopedProfile != exactSelector ||
+				enriched.CorpName != "Same Corp" ||
+				enriched.UserName != "Historical User A" {
+				t.Fatalf("%s history hint became identity evidence: %#v", flow, enriched)
+			}
+
+			historical, err := authpkg.LoadTokenDataForProfile(configDir, exactSelector)
+			if err != nil {
+				t.Fatalf("load historical exact identity: %v", err)
+			}
+			if historical.AccessToken != oldToken.AccessToken || historical.UserID != historicalUID {
+				t.Fatalf("historical exact slot was overwritten: %#v", historical)
+			}
+
+			profiles, err := authpkg.LoadProfiles(configDir)
+			if err != nil {
+				t.Fatalf("load profiles: %v", err)
+			}
+			var unresolved *authpkg.Profile
+			for i := range profiles.Profiles {
+				profile := &profiles.Profiles[i]
+				if profile.CorpID == corpID && profile.UserID == "" {
+					unresolved = profile
+					break
+				}
+			}
+			if unresolved == nil {
+				t.Fatalf("fresh UID-less token did not create an unresolved profile: %#v", profiles.Profiles)
+			}
+			unresolvedSelector := authpkg.ProfileSelectionSelector(*unresolved, profiles)
+			if unresolvedSelector == "" || unresolvedSelector == exactSelector {
+				t.Fatalf("unresolved selector = %q", unresolvedSelector)
+			}
+			fresh, err := authpkg.LoadTokenDataForProfile(configDir, unresolvedSelector)
+			if err != nil {
+				t.Fatalf("load fresh unresolved identity: %v", err)
+			}
+			if fresh.AccessToken != "fresh-user-b-access-"+flow || fresh.UserID != "" {
+				t.Fatalf("fresh token was not isolated in unresolved org slot: %#v", fresh)
+			}
+		})
+	}
+}
+
+func TestCrossPlatformCoverageHistoricalIdentityPriorityAndBlankUserID(t *testing.T) {
+	oldLoad := authLoadProfiles
+	t.Cleanup(func() { authLoadProfiles = oldLoad })
+	authLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) { return nil, nil }
+	if reused, err := enrichAuthLoginProfileFromHistory("cfg", &authpkg.TokenData{CorpID: "ding_same"}); reused || err != nil {
+		t.Fatalf("nil history registry = reused=%v err=%v", reused, err)
+	}
+
+	cfg := &authpkg.ProfilesConfig{
+		CurrentProfile: "ding_same:user_1",
+		OrgCurrentProfiles: map[string]string{
+			"ding_same": "ding_same:user_2",
+		},
+		Profiles: []authpkg.Profile{
+			{CorpID: "ding_same", CorpName: "Same Corp", UserID: "user_1", UserName: "First"},
+			{CorpID: "ding_same", CorpName: "Same Corp", UserID: "user_2", UserName: "Second"},
+		},
+	}
+	authLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) { return cfg, nil }
+
+	explicitData := &authpkg.TokenData{CorpID: "ding_same"}
+	reused, err := enrichAuthLoginProfileFromHistory("cfg", explicitData, authLoginHistoryHint{Selector: "ding_same:user_1", Explicit: true})
+	if err != nil || !reused || explicitData.UserID != "" ||
+		explicitData.LegacyOrgScopedProfile != "ding_same:user_1" ||
+		explicitData.CorpName != "Same Corp" || explicitData.UserName != "First" {
+		t.Fatalf("explicit history selection = %#v, reused=%v err=%v", explicitData, reused, err)
+	}
+	mismatchedHintData := &authpkg.TokenData{CorpID: "ding_same"}
+	reused, err = enrichAuthLoginProfileFromHistory("cfg", mismatchedHintData, authLoginHistoryHint{Selector: "ding_other:user_9", Explicit: true})
+	if err != nil || reused || mismatchedHintData.UserID != "" {
+		t.Fatalf("cross-corp explicit hint reused another identity: %#v, reused=%v err=%v", mismatchedHintData, reused, err)
+	}
+	orgCurrentData := &authpkg.TokenData{CorpID: "ding_same"}
+	reused, err = enrichAuthLoginProfileFromHistory("cfg", orgCurrentData)
+	if err != nil || reused || orgCurrentData.UserID != "" {
+		t.Fatalf("implicit multi-account org-current was treated as identity proof: %#v, reused=%v err=%v", orgCurrentData, reused, err)
+	}
+
+	cfg.Profiles = []authpkg.Profile{cfg.Profiles[1]}
+	soleData := &authpkg.TokenData{CorpID: "ding_same"}
+	reused, err = enrichAuthLoginProfileFromHistory("cfg", soleData)
+	if err != nil || !reused || soleData.UserID != "" ||
+		soleData.CorpName != "Same Corp" || soleData.UserName != "Second" {
+		t.Fatalf("sole history selection = %#v, reused=%v err=%v", soleData, reused, err)
+	}
+
+	cfg.Profiles = []authpkg.Profile{
+		{CorpID: "ding_same", CorpName: "Same Corp", UserID: "user_1", UserName: "First"},
+		{CorpID: "ding_same", CorpName: "Same Corp", UserID: "user_2", UserName: "Second"},
+	}
+	cfg.OrgCurrentProfiles = nil
+	currentData := &authpkg.TokenData{CorpID: "ding_same"}
+	reused, err = enrichAuthLoginProfileFromHistory("cfg", currentData)
+	if err != nil || reused || currentData.UserID != "" {
+		t.Fatalf("implicit multi-account current was treated as identity proof: %#v, reused=%v err=%v", currentData, reused, err)
+	}
+
+	cfg.CurrentProfile = ""
+	ambiguousData := &authpkg.TokenData{CorpID: "ding_same"}
+	reused, err = enrichAuthLoginProfileFromHistory("cfg", ambiguousData)
+	if err != nil || reused || ambiguousData.UserID != "" {
+		t.Fatalf("ambiguous history selection = %#v, reused=%v err=%v", ambiguousData, reused, err)
+	}
+
+	cfg.Profiles = []authpkg.Profile{{
+		Name: "external-worker", CorpID: "ding_same", CorpName: "Legacy Corp", UserName: "Legacy Worker",
+	}}
+	blankData := &authpkg.TokenData{CorpID: "ding_same"}
+	reused, err = enrichAuthLoginProfileFromHistory("cfg", blankData, authLoginHistoryHint{Selector: "external-worker", Explicit: true})
+	if err != nil || !reused || blankData.UserID != "" || blankData.LegacyOrgScopedProfile != "external-worker" || blankData.CorpName != "Legacy Corp" || blankData.UserName != "Legacy Worker" {
+		t.Fatalf("blank-userId history selection = %#v, reused=%v err=%v", blankData, reused, err)
+	}
+	contactBlankData := &authpkg.TokenData{CorpID: "ding_same", AccessToken: "new-token"}
+	if err := enrichAuthLoginProfileFromContact(
+		context.Background(),
+		"cfg",
+		&authCoverageCaller{err: errors.New("contact unavailable")},
+		contactBlankData,
+		authLoginHistoryHint{Selector: "external-worker", Explicit: true},
+	); err != nil {
+		t.Fatalf("blank-userId history must keep contact best effort: %v", err)
+	}
+	if contactBlankData.LegacyOrgScopedProfile != "external-worker" {
+		t.Fatalf("blank-userId contact fallback did not authorize the historical organization slot: %#v", contactBlankData)
+	}
+
+	profiles := []*authpkg.Profile{
+		nil,
+		{Name: "duplicate", CorpID: "ding_same", UserID: "user_1"},
+		{Name: "duplicate", CorpID: "ding_same", UserID: "user_2"},
+	}
+	for _, tc := range []struct {
+		name     string
+		selector string
+		profiles []*authpkg.Profile
+		want     *authpkg.Profile
+	}{
+		{name: "empty selector", selector: "", profiles: profiles},
+		{name: "missing exact identity", selector: "ding_same:missing", profiles: profiles},
+		{name: "duplicate name", selector: "duplicate", profiles: profiles},
+		{name: "unmatched name", selector: "not-found", profiles: profiles},
+		{name: "sole organization selector", selector: "ding_same", profiles: profiles[1:2], want: profiles[1]},
+	} {
+		t.Run("selector "+tc.name, func(t *testing.T) {
+			if got := historicalProfileForSelector("ding_same", tc.selector, tc.profiles); got != tc.want {
+				t.Fatalf("historicalProfileForSelector(%q) = %#v, want %#v", tc.selector, got, tc.want)
+			}
+		})
+	}
+}
+
 func TestCrossPlatformCoverageAuthCoverageDefaultSeamClosures(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
@@ -394,6 +994,7 @@ func TestCrossPlatformCoverageAuthCoverageDefaultSeamClosures(t *testing.T) {
 	device := authpkg.NewDeviceFlowProvider(configDir, nil)
 	_, _ = authDeviceLogin(device, ctx)
 	oauth := authpkg.NewOAuthProvider(configDir, nil)
+	oauth.NoBrowser = true
 	_, _ = authOAuthStatus(oauth)
 	_, _ = authOAuthAccessToken(oauth, ctx)
 	_, _ = authOAuthLogin(oauth, ctx, true)
@@ -409,7 +1010,10 @@ func TestCrossPlatformCoverageAuthCoverageStatusAndLogout(t *testing.T) {
 	oldDelete := authDeleteTokenData
 	oldMark := authMarkProfileStatus
 	oldResolve := authResolveProfile
+	oldResolveDeletion := authResolveProfileDeletion
 	oldRevoke := authRevokeToken
+	oldRevokeForData := authRevokeTokenForData
+	oldLoadTokenForProfile := authLoadTokenForProfile
 	oldDeleteProfile := authDeleteProfileToken
 	oldMigrate := authEnsureProfilesMigration
 	oldLoadProfiles := authLoadProfiles
@@ -421,7 +1025,10 @@ func TestCrossPlatformCoverageAuthCoverageStatusAndLogout(t *testing.T) {
 		authDeleteTokenData = oldDelete
 		authMarkProfileStatus = oldMark
 		authResolveProfile = oldResolve
+		authResolveProfileDeletion = oldResolveDeletion
 		authRevokeToken = oldRevoke
+		authRevokeTokenForData = oldRevokeForData
+		authLoadTokenForProfile = oldLoadTokenForProfile
 		authDeleteProfileToken = oldDeleteProfile
 		authEnsureProfilesMigration = oldMigrate
 		authLoadProfiles = oldLoadProfiles
@@ -510,20 +1117,51 @@ func TestCrossPlatformCoverageAuthCoverageStatusAndLogout(t *testing.T) {
 		t.Fatalf("mark-expired = %v, marked=%v", err, marked)
 	}
 
-	authResolveProfile = func(string, string) (*authpkg.Profile, error) { return nil, errors.New("missing") }
+	authResolveProfileDeletion = func(string, string) (*authpkg.Profile, bool, error) { return nil, false, errors.New("missing") }
 	if err := logoutOneProfile(nil, context.Background(), "cfg", "x"); err == nil {
 		t.Fatal("missing profile should fail")
 	}
-	authResolveProfile = func(string, string) (*authpkg.Profile, error) { return &authpkg.Profile{CorpID: "ding"}, nil }
-	authRevokeToken = func(context.Context) error { return errors.New("ignored") }
-	authDeleteProfileToken = func(string, string) error { return errors.New("delete") }
+	authResolveProfileDeletion = func(string, string) (*authpkg.Profile, bool, error) {
+		return &authpkg.Profile{CorpID: "ding", UserID: "user"}, true, nil
+	}
+	authLoadTokenForProfile = func(string, string) (*authpkg.TokenData, error) {
+		return &authpkg.TokenData{CorpID: "ding", UserID: "user"}, nil
+	}
+	authRevokeTokenForData = func(context.Context, *authpkg.TokenData) error { return errors.New("ignored") }
+	var deletedSelector string
+	authDeleteProfileToken = func(_ string, selector string) error {
+		deletedSelector = selector
+		return errors.New("delete")
+	}
 	if err := logoutOneProfile(nil, context.Background(), "cfg", "x"); err == nil {
 		t.Fatal("profile delete should fail")
 	}
-	authDeleteProfileToken = func(string, string) error { return nil }
+	if deletedSelector != "ding:user" {
+		t.Fatalf("exact deletion selector = %q, want stable identity selector", deletedSelector)
+	}
+	authDeleteProfileToken = func(_ string, selector string) error {
+		deletedSelector = selector
+		return nil
+	}
 	if err := logoutOneProfile(nil, context.Background(), "cfg", "x"); err != nil {
 		t.Fatal(err)
 	}
+	if deletedSelector != "ding:user" {
+		t.Fatalf("exact deletion selector = %q, want stable identity selector", deletedSelector)
+	}
+
+	authResolveProfileDeletion = func(string, string) (*authpkg.Profile, bool, error) {
+		return &authpkg.Profile{CorpID: "ding", UserID: "user"}, false, nil
+	}
+	authLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
+		return &authpkg.ProfilesConfig{Profiles: []authpkg.Profile{{CorpID: "ding", UserID: "user"}}}, nil
+	}
+	if err := logoutOneProfile(nil, context.Background(), "cfg", "organization-name"); err != nil {
+		t.Fatal(err)
+	}
+	if deletedSelector != "ding" {
+		t.Fatalf("organization deletion selector = %q, want stable corpId", deletedSelector)
+	}
 
 	authEnsureProfilesMigration = func(string) error { return errors.New("migrate") }
 	if err := logoutAllProfiles(nil, context.Background(), "cfg"); err == nil {
@@ -536,6 +1174,10 @@ func TestCrossPlatformCoverageAuthCoverageStatusAndLogout(t *testing.T) {
 	}
 	revokes := 0
 	authRevokeToken = func(context.Context) error { revokes++; return nil }
+	authRevokeTokenForData = func(context.Context, *authpkg.TokenData) error { revokes++; return nil }
+	authLoadTokenForProfile = func(string, string) (*authpkg.TokenData, error) {
+		return &authpkg.TokenData{AccessToken: "token"}, nil
+	}
 	authLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) { return nil, nil }
 	authDeleteAllTokenData = func(string) error { return nil }
 	if err := logoutAllProfiles(nil, context.Background(), "cfg"); err != nil || revokes != 1 {
@@ -618,7 +1260,7 @@ func TestCrossPlatformCoverageAuthCoveragePortableExchangeAndReset(t *testing.T)
 		authDeleteAppConfig = oldDeleteConfig
 	})
 
-	export := newAuthExportCommand()
+	export := newAuthExportCommandWithSupport(func() error { return nil })
 	badString := &cobra.Command{}
 	badString.Flags().Bool("output", false, "")
 	if err := export.RunE(badString, nil); err == nil {
@@ -658,7 +1300,7 @@ func TestCrossPlatformCoverageAuthCoveragePortableExchangeAndReset(t *testing.T)
 	if err := export.RunE(export, nil); err != nil {
 		t.Fatal(err)
 	}
-	export = newAuthExportCommand()
+	export = newAuthExportCommandWithSupport(func() error { return nil })
 	_, out, _ := authCoverageRoot(export, "table", false)
 	_ = export.Flags().Set("base64", "true")
 	export.SetOut(&appFailWriter{err: errors.New("stdout")})
@@ -676,7 +1318,7 @@ func TestCrossPlatformCoverageAuthCoveragePortableExchangeAndReset(t *testing.T)
 		t.Fatal(err)
 	}
 
-	importCmd := newAuthImportCommand()
+	importCmd := newAuthImportCommandWithSupport(func() error { return nil })
 	badInput := &cobra.Command{}
 	badInput.Flags().Bool("input", false, "")
 	if err := importCmd.RunE(badInput, nil); err == nil {
@@ -695,7 +1337,7 @@ func TestCrossPlatformCoverageAuthCoveragePortableExchangeAndReset(t *testing.T)
 	if err := importCmd.RunE(badForce, nil); err == nil {
 		t.Fatal("invalid force flag should fail")
 	}
-	_, out, _ = authCoverageRoot(importCmd, "table", false)
+	_, _, _ = authCoverageRoot(importCmd, "table", false)
 	if err := importCmd.RunE(importCmd, nil); err == nil {
 		t.Fatal("missing input should fail")
 	}
@@ -734,7 +1376,7 @@ func TestCrossPlatformCoverageAuthCoveragePortableExchangeAndReset(t *testing.T)
 		t.Fatal(err)
 	}
 
-	exchange := newAuthExchangeCommand()
+	exchange := newAuthExchangeCommand(nil)
 	badCode := &cobra.Command{}
 	badCode.Flags().Bool("code", false, "")
 	if err := exchange.RunE(badCode, nil); err == nil {

internal/app/auth_command_test.go

@@ -20,9 +20,11 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 	"time"
@@ -58,7 +60,7 @@ func TestAuthExportImportBase64RoundTrip(t *testing.T) {
 		return err
 	}
 
-	exportCmd := newAuthExportCommand()
+	exportCmd := newAuthExportCommandWithSupport(func() error { return nil })
 	var exported bytes.Buffer
 	exportCmd.SetOut(&exported)
 	exportCmd.SetErr(&bytes.Buffer{})
@@ -84,7 +86,7 @@ func TestAuthExportImportBase64RoundTrip(t *testing.T) {
 		return authpkg.PortableImportReport{}, err
 	}
 
-	importCmd := newAuthImportCommand()
+	importCmd := newAuthImportCommandWithSupport(func() error { return nil })
 	importCmd.SetOut(&bytes.Buffer{})
 	importCmd.SetErr(&bytes.Buffer{})
 	importCmd.SetArgs([]string{"--input", inputPath, "--base64"})
@@ -96,6 +98,269 @@ func TestAuthExportImportBase64RoundTrip(t *testing.T) {
 	}
 }
 
+func TestCrossPlatformCoverageAuthExportUnsupportedBackendIsValidationError(t *testing.T) {
+	exportCmd := newAuthExportCommandWithSupport(func() error {
+		return errors.New("portable auth export is unavailable for the test backend")
+	})
+	exportCmd.SetOut(&bytes.Buffer{})
+	exportCmd.SetErr(&bytes.Buffer{})
+	exportCmd.SetArgs([]string{"--base64"})
+
+	err := exportCmd.Execute()
+	if err == nil {
+		t.Fatal("auth export should reject an unsupported credential backend")
+	}
+	var appErr *apperrors.Error
+	if !errors.As(err, &appErr) || appErr.Category != apperrors.CategoryValidation {
+		t.Fatalf("expected validation error, got %T: %v", err, err)
+	}
+	if !strings.Contains(err.Error(), "test backend") {
+		t.Fatalf("error = %v, want backend-specific reason", err)
+	}
+}
+
+func TestCrossPlatformCoverageAuthExportRejectsWindowsDPAPIBackend(t *testing.T) {
+	if runtime.GOOS != "windows" {
+		t.Skip("Windows DPAPI contract requires a native Windows runner")
+	}
+	t.Cleanup(CloseFileLogger)
+
+	exportCmd := NewRootCommand()
+	exportCmd.SetOut(&bytes.Buffer{})
+	exportCmd.SetErr(&bytes.Buffer{})
+	exportCmd.SetArgs([]string{"auth", "export", "--base64"})
+
+	err := exportCmd.Execute()
+	if err == nil {
+		t.Fatal("auth export should reject the Windows DPAPI backend")
+	}
+	var appErr *apperrors.Error
+	if !errors.As(err, &appErr) || appErr.Category != apperrors.CategoryValidation {
+		t.Fatalf("expected validation error, got %T: %v", err, err)
+	}
+	for _, want := range []string{"Windows", "DPAPI", "HKCU"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Fatalf("error = %v, want substring %q", err, want)
+		}
+	}
+}
+
+func TestCrossPlatformCoverageAuthImportUnsupportedBackendIsValidationErrorBeforeReadingInput(t *testing.T) {
+	root := t.TempDir()
+	configDir := filepath.Join(root, ".dws")
+	keychainDir := filepath.Join(root, "keychain")
+	t.Setenv("DWS_CONFIG_DIR", configDir)
+	t.Setenv(keychain.StorageDirEnv, keychainDir)
+
+	importCmd := newAuthImportCommandWithSupport(func() error {
+		return errors.New("portable auth import is unavailable for the test backend")
+	})
+	importCmd.SetOut(&bytes.Buffer{})
+	importCmd.SetErr(&bytes.Buffer{})
+	importCmd.SetArgs([]string{"--input", filepath.Join(root, "missing-bundle.tar.gz")})
+
+	err := importCmd.Execute()
+	if err == nil {
+		t.Fatal("auth import should reject an unsupported credential backend")
+	}
+	var appErr *apperrors.Error
+	if !errors.As(err, &appErr) || appErr.Category != apperrors.CategoryValidation {
+		t.Fatalf("expected validation error, got %T: %v", err, err)
+	}
+	if !strings.Contains(err.Error(), "test backend") {
+		t.Fatalf("error = %v, want backend-specific reason", err)
+	}
+	for _, path := range []string{configDir, keychainDir} {
+		if _, statErr := os.Stat(path); !os.IsNotExist(statErr) {
+			t.Fatalf("unsupported import touched %s: stat error = %v", path, statErr)
+		}
+	}
+}
+
+func TestCrossPlatformCoverageAuthImportRejectsWindowsDPAPIBackend(t *testing.T) {
+	if runtime.GOOS != "windows" {
+		t.Skip("Windows DPAPI contract requires a native Windows runner")
+	}
+
+	root := t.TempDir()
+	// NewRootCommand initializes the normal CLI file logger below configDir.
+	// Register its cleanup after TempDir so the Windows handle is closed before
+	// testing removes the temporary directory.
+	t.Cleanup(CloseFileLogger)
+	configDir := filepath.Join(root, ".dws")
+	keychainDir := filepath.Join(root, "keychain")
+	inputPath := filepath.Join(root, "bundle.tar.gz")
+	if err := os.WriteFile(inputPath, []byte("the capability guard must run before this input is read"), 0o600); err != nil {
+		t.Fatalf("write input sentinel error = %v", err)
+	}
+	t.Setenv("DWS_CONFIG_DIR", configDir)
+	t.Setenv(keychain.StorageDirEnv, keychainDir)
+	// Windows stores credentials in HKCU rather than StorageDirEnv. Use a
+	// fresh registry namespace so this zero-state assertion cannot inherit a
+	// token from an earlier test in the same package binary.
+	t.Setenv(keychain.TestNamespaceEnv, root)
+	t.Cleanup(func() {
+		if err := keychain.RemoveAuthTokenEntries(keychain.Service); err != nil {
+			t.Errorf("clean import guard keychain fixture: %v", err)
+		}
+	})
+
+	importCmd := NewRootCommand()
+	importCmd.SetOut(&bytes.Buffer{})
+	importCmd.SetErr(&bytes.Buffer{})
+	importCmd.SetArgs([]string{"auth", "import", "--input", inputPath})
+
+	err := importCmd.Execute()
+	if err == nil {
+		t.Fatal("auth import should reject the Windows DPAPI backend")
+	}
+	var appErr *apperrors.Error
+	if !errors.As(err, &appErr) || appErr.Category != apperrors.CategoryValidation {
+		t.Fatalf("expected validation error, got %T: %v", err, err)
+	}
+	for _, want := range []string{"Windows", "DPAPI", "HKCU"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Fatalf("error = %v, want substring %q", err, want)
+		}
+	}
+	// The root command may create configDir/logs as part of normal CLI startup.
+	// The capability guard must still run before any auth state is imported.
+	for _, path := range []string{
+		keychainDir,
+		authpkg.ProfilesPath(configDir),
+		filepath.Join(configDir, "app.json"),
+		filepath.Join(configDir, "token.json"),
+	} {
+		if _, statErr := os.Stat(path); !os.IsNotExist(statErr) {
+			t.Fatalf("unsupported Windows import touched %s: stat error = %v", path, statErr)
+		}
+	}
+}
+
+func TestCrossPlatformCoverageAuthImportRejectsWindowsDPAPIBackendWithPopulatedCredentialBeforeRead(t *testing.T) {
+	if runtime.GOOS != "windows" {
+		t.Skip("Windows DPAPI contract requires a native Windows runner")
+	}
+
+	previous, previousErr := authpkg.LoadTokenDataKeychain()
+	if previousErr != nil && !errors.Is(previousErr, authpkg.ErrTokenDataNotFound) {
+		t.Fatalf("capture existing Windows credential: %v", previousErr)
+	}
+	hadPrevious := previousErr == nil
+	t.Cleanup(func() {
+		if hadPrevious {
+			_ = authpkg.SaveTokenDataKeychain(previous)
+		} else {
+			_ = authpkg.DeleteTokenDataKeychain()
+		}
+	})
+
+	want := &authpkg.TokenData{
+		AccessToken:  "windows-existing-access",
+		RefreshToken: "windows-existing-refresh",
+		RefreshExpAt: time.Now().Add(24 * time.Hour),
+		CorpID:       "windows-existing-corp",
+	}
+	if err := authpkg.SaveTokenDataKeychain(want); err != nil {
+		t.Fatalf("seed cleanup-scoped Windows DPAPI credential: %v", err)
+	}
+
+	originalTarget := authPortableTargetPopulated
+	originalRead := authReadFile
+	targetChecks := 0
+	bundleReads := 0
+	authPortableTargetPopulated = func(configDir string) bool {
+		targetChecks++
+		return originalTarget(configDir)
+	}
+	authReadFile = func(path string) ([]byte, error) {
+		bundleReads++
+		return originalRead(path)
+	}
+	t.Cleanup(func() {
+		authPortableTargetPopulated = originalTarget
+		authReadFile = originalRead
+	})
+
+	root := t.TempDir()
+	inputPath := filepath.Join(root, "bundle.tar.gz")
+	if err := os.WriteFile(inputPath, []byte("unsupported Windows import must not read this bundle"), 0o600); err != nil {
+		t.Fatalf("write bundle sentinel: %v", err)
+	}
+	t.Setenv("DWS_CONFIG_DIR", filepath.Join(root, ".dws"))
+
+	importCmd := newAuthImportCommand()
+	importCmd.SetOut(&bytes.Buffer{})
+	importCmd.SetErr(&bytes.Buffer{})
+	importCmd.SetArgs([]string{"--input", inputPath})
+	err := importCmd.Execute()
+	if err == nil {
+		t.Fatal("auth import should reject a populated Windows DPAPI backend")
+	}
+	var appErr *apperrors.Error
+	if !errors.As(err, &appErr) || appErr.Category != apperrors.CategoryValidation {
+		t.Fatalf("expected validation error, got %T: %v", err, err)
+	}
+	for _, required := range []string{"Windows", "DPAPI", "HKCU"} {
+		if !strings.Contains(err.Error(), required) {
+			t.Fatalf("error = %v, want substring %q", err, required)
+		}
+	}
+	if strings.Contains(err.Error(), "--force") {
+		t.Fatalf("unsupported Windows import suggested impossible --force remediation: %v", err)
+	}
+	if targetChecks != 0 || bundleReads != 0 {
+		t.Fatalf("unsupported Windows import inspected credentials/bundle: target_checks=%d bundle_reads=%d", targetChecks, bundleReads)
+	}
+
+	got, err := authpkg.LoadTokenDataKeychain()
+	if err != nil {
+		t.Fatalf("reload Windows DPAPI credential after rejection: %v", err)
+	}
+	if got.AccessToken != want.AccessToken || got.RefreshToken != want.RefreshToken || got.CorpID != want.CorpID {
+		t.Fatalf("Windows auth state changed after rejected import: got=%#v want=%#v", got, want)
+	}
+}
+
+func TestCrossPlatformCoverageAuthImportRequiresForceWhenPopulated(t *testing.T) {
+	t.Setenv(keychain.DisableKeychainEnv, "1")
+	root := t.TempDir()
+	t.Cleanup(CloseFileLogger)
+	configDir := filepath.Join(root, ".dws")
+	t.Setenv(keychain.StorageDirEnv, filepath.Join(root, "keychain"))
+	t.Setenv("DWS_CONFIG_DIR", configDir)
+
+	if err := authpkg.SaveTokenData(configDir, &authpkg.TokenData{
+		AccessToken:  "existing",
+		RefreshToken: "existing-refresh",
+		RefreshExpAt: time.Now().Add(24 * time.Hour),
+	}); err != nil {
+		t.Fatalf("SaveTokenData() error = %v", err)
+	}
+
+	bundlePath := filepath.Join(root, "bundle.tar.gz")
+	if err := os.WriteFile(bundlePath, []byte("not-a-real-bundle"), 0o600); err != nil {
+		t.Fatalf("write bundle stub error = %v", err)
+	}
+
+	importCmd := newAuthImportCommandWithSupport(func() error { return nil })
+	var stderr bytes.Buffer
+	importCmd.SetOut(&bytes.Buffer{})
+	importCmd.SetErr(&stderr)
+	importCmd.SetArgs([]string{"--input", bundlePath})
+	err := importCmd.Execute()
+	if err == nil {
+		t.Fatal("auth import without --force should fail when auth exists")
+	}
+	var appErr *apperrors.Error
+	if !errors.As(err, &appErr) || appErr.Category != apperrors.CategoryValidation {
+		t.Fatalf("expected validation error, got %T: %v", err, err)
+	}
+	if !strings.Contains(err.Error(), "--force") {
+		t.Fatalf("error = %v, want --force hint", err)
+	}
+}
+
 func TestAuthImportRequiresForceWhenPopulated(t *testing.T) {
 	originalTarget := authPortableTargetPopulated
 	authPortableTargetPopulated = func(string) bool { return true }
@@ -110,10 +375,9 @@ func TestAuthImportRequiresForceWhenPopulated(t *testing.T) {
 		t.Fatalf("write bundle stub error = %v", err)
 	}
 
-	importCmd := newAuthImportCommand()
-	var stderr bytes.Buffer
+	importCmd := newAuthImportCommandWithSupport(func() error { return nil })
 	importCmd.SetOut(&bytes.Buffer{})
-	importCmd.SetErr(&stderr)
+	importCmd.SetErr(&bytes.Buffer{})
 	importCmd.SetArgs([]string{"--input", bundlePath})
 	err := importCmd.Execute()
 	if err == nil {
@@ -244,7 +508,7 @@ func TestAuthStatusDiagnosticReportsCiphertextKeyMismatch(t *testing.T) {
 	}
 }
 
-func TestAuthStatusRefreshFailureLeavesStoredTokenIntact(t *testing.T) {
+func TestAuthStatusRefreshFailureReportsUnauthenticatedDiagnostic(t *testing.T) {
 	// Isolate keychain storage to a per-test directory so the saved
 	// token can't leak into other test packages running in parallel.
 	t.Setenv(keychain.StorageDirEnv, t.TempDir())
@@ -263,6 +527,9 @@ func TestAuthStatusRefreshFailureLeavesStoredTokenIntact(t *testing.T) {
 		ExpiresAt:    time.Now().Add(-time.Hour),
 		RefreshExpAt: time.Now().Add(24 * time.Hour),
 		CorpID:       "dingcorp",
+		UserID:       "user-dingcorp",
+		ClientID:     "client-dingcorp",
+		Source:       "mcp",
 	})
 	if err != nil {
 		t.Skipf("SaveTokenData() unavailable in this environment: %v", err)
@@ -280,7 +547,7 @@ func TestAuthStatusRefreshFailureLeavesStoredTokenIntact(t *testing.T) {
 	var out bytes.Buffer
 	cmd.SetOut(&out)
 	cmd.SetErr(&out)
-	cmd.SetArgs([]string{"auth", "status"})
+	cmd.SetArgs([]string{"--format", "json", "auth", "status"})
 
 	if err := cmd.Execute(); err != nil {
 		t.Fatalf("Execute() error = %v\noutput:\n%s", err, out.String())
@@ -291,8 +558,18 @@ func TestAuthStatusRefreshFailureLeavesStoredTokenIntact(t *testing.T) {
 		t.Fatal("secure token data should remain in keychain after refresh failure")
 	}
 
-	if !bytes.Contains(out.Bytes(), []byte("\"authenticated\"")) {
-		t.Fatalf("output should still report authenticated status:\n%s", out.String())
+	var resp authStatusResponse
+	if err := json.Unmarshal(out.Bytes(), &resp); err != nil {
+		t.Fatalf("Unmarshal() error = %v\noutput:\n%s", err, out.String())
+	}
+	if resp.Authenticated {
+		t.Fatalf("authenticated = true after refresh failure: %+v", resp)
+	}
+	if resp.Reason != "token_refresh_failed" {
+		t.Fatalf("reason = %q, want token_refresh_failed: %+v", resp.Reason, resp)
+	}
+	if !strings.Contains(resp.Message, "refresh failed") {
+		t.Fatalf("message = %q, want original refresh failure", resp.Message)
 	}
 }
 
@@ -340,8 +617,35 @@ func TestAuthStatusProfileOverrideDoesNotSwitchCurrentProfile(t *testing.T) {
 	if err != nil {
 		t.Fatalf("LoadProfiles() error = %v", err)
 	}
-	if cfg.CurrentProfile != "corp_secondary" {
-		t.Fatalf("currentProfile = %q, want unchanged corp_secondary", cfg.CurrentProfile)
+	if cfg.CurrentProfile != "corp_secondary:user-corp_secondary" {
+		t.Fatalf("currentProfile = %q, want unchanged exact secondary identity", cfg.CurrentProfile)
+	}
+}
+
+func TestAuthStatusRejectsAmbiguousProfileSelector(t *testing.T) {
+	first := authLogoutTestToken("corp_first")
+	first.CorpName = "Shared Org"
+	second := authLogoutTestToken("corp_second")
+	second.CorpName = "Shared Org"
+	setupAuthLogoutProfiles(t, first, second)
+
+	cmd := NewRootCommand()
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SetErr(&out)
+	cmd.SetArgs([]string{"--format", "json", "auth", "status", "--profile", "Shared Org"})
+	err := cmd.Execute()
+	if err == nil {
+		t.Fatalf("auth status accepted ambiguous profile selector\noutput:\n%s", out.String())
+	}
+	var appErr *apperrors.Error
+	if !errors.As(err, &appErr) || appErr.Category != apperrors.CategoryValidation {
+		t.Fatalf("error = %T %v, want validation error", err, err)
+	}
+	for _, candidate := range []string{"corp_first", "corp_second"} {
+		if !strings.Contains(err.Error(), candidate) {
+			t.Fatalf("error = %q, want candidate %q", err.Error(), candidate)
+		}
 	}
 }
 
@@ -515,8 +819,8 @@ func TestAuthLogoutProfileDeletesOnlySelectedProfile(t *testing.T) {
 	if err != nil {
 		t.Fatalf("LoadProfiles() error = %v", err)
 	}
-	if cfg.PrimaryProfile != "corp_secondary" || cfg.CurrentProfile != "corp_secondary" {
-		t.Fatalf("profiles pointers = primary %q current %q, want corp_secondary/corp_secondary", cfg.PrimaryProfile, cfg.CurrentProfile)
+	if cfg.PrimaryProfile != "" || cfg.CurrentProfile != "corp_secondary:user-corp_secondary" {
+		t.Fatalf("profiles pointers = primary %q current %q", cfg.PrimaryProfile, cfg.CurrentProfile)
 	}
 	if len(cfg.Profiles) != 1 || cfg.Profiles[0].CorpID != "corp_secondary" {
 		t.Fatalf("profiles = %#v, want only corp_secondary retained", cfg.Profiles)
@@ -536,6 +840,102 @@ func TestAuthLogoutProfileDeletesOnlySelectedProfile(t *testing.T) {
 	}
 }
 
+func TestAuthLogoutExactProfilePreservesSameCorpAccount(t *testing.T) {
+	first := authLogoutTestToken("corp_same")
+	first.UserID = "user_1"
+	second := authLogoutTestToken("corp_same")
+	second.AccessToken = "access-second"
+	second.RefreshToken = "refresh-second"
+	second.UserID = "user_2"
+	configDir := setupAuthLogoutProfiles(t, first, second)
+
+	originalTransport := http.DefaultTransport
+	t.Cleanup(func() {
+		http.DefaultTransport = originalTransport
+	})
+	http.DefaultTransport = roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		return nil, errors.New("remote revoke disabled in unit test")
+	})
+
+	cmd := NewRootCommand()
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SetErr(&out)
+	cmd.SetArgs([]string{"auth", "logout", "--profile", "corp_same:user_2"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("auth logout exact profile error = %v\noutput:\n%s", err, out.String())
+	}
+	cfg, err := authpkg.LoadProfiles(configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() error = %v", err)
+	}
+	if len(cfg.Profiles) != 1 || cfg.Profiles[0].UserID != "user_1" {
+		t.Fatalf("profiles = %#v, want only user_1 retained", cfg.Profiles)
+	}
+	if authpkg.TokenDataExistsKeychainForIdentity("corp_same", "user_2") {
+		t.Fatal("selected identity token should be deleted")
+	}
+	loaded, err := authpkg.LoadTokenDataForProfile(configDir, "corp_same")
+	if err != nil {
+		t.Fatalf("LoadTokenDataForProfile(org) error = %v", err)
+	}
+	if loaded.UserID != "user_1" || loaded.AccessToken != first.AccessToken {
+		t.Fatalf("org current token = %#v, want retained user_1", loaded)
+	}
+}
+
+func TestAuthLogoutLocalProfileNameRevokesOnlySelectedAccount(t *testing.T) {
+	first := authLogoutTestToken("corp_same")
+	first.UserID = "user_1"
+	first.UserName = "账号一"
+	second := authLogoutTestToken("corp_same")
+	second.AccessToken = "access-second"
+	second.RefreshToken = "refresh-second"
+	second.UserID = "user_2"
+	second.UserName = "账号二"
+	configDir := setupAuthLogoutProfiles(t, first, second)
+
+	cfg, err := authpkg.LoadProfiles(configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() error = %v", err)
+	}
+	var selector string
+	for _, profile := range cfg.Profiles {
+		if profile.UserID == "user_2" {
+			selector = profile.Name
+		}
+	}
+	if selector == "" || selector == second.CorpName {
+		t.Fatalf("second local profile name = %q, want unique non-org alias", selector)
+	}
+
+	requests := 0
+	originalTransport := http.DefaultTransport
+	t.Cleanup(func() {
+		http.DefaultTransport = originalTransport
+	})
+	http.DefaultTransport = roundTripFunc(func(*http.Request) (*http.Response, error) {
+		requests++
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Header:     make(http.Header),
+			Body:       io.NopCloser(strings.NewReader("")),
+		}, nil
+	})
+
+	cmd := NewRootCommand()
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SetErr(&out)
+	cmd.SetArgs([]string{"auth", "logout", "--profile", selector})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("auth logout local profile error = %v\noutput:\n%s", err, out.String())
+	}
+	if requests != 1 {
+		t.Fatalf("remote revoke requests = %d, want 1", requests)
+	}
+}
+
 func TestAuthLoginPostLoginTUIModeRespectsRecommendAndFormat(t *testing.T) {
 	newRoot := func(t *testing.T) *cobra.Command {
 		t.Helper()
@@ -621,8 +1021,15 @@ func TestLoginRecommendProductLabelMatchesTUITarget(t *testing.T) {
 }
 
 func TestResolveAuthLoginConfigReadsInheritedYes(t *testing.T) {
+	t.Setenv("DWS_DEBUG_AUTH", "1")
+	var logs bytes.Buffer
+	previousLogger := slog.Default()
+	slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, &slog.HandlerOptions{Level: slog.LevelDebug})))
+	t.Cleanup(func() { slog.SetDefault(previousLogger) })
+
 	root := &cobra.Command{Use: "dws"}
 	root.PersistentFlags().Bool("yes", false, "")
+	root.PersistentFlags().String("profile", "", "")
 	login := &cobra.Command{Use: "login"}
 	login.Flags().String("token", "", "")
 	login.Flags().Bool("device", false, "")
@@ -647,6 +1054,11 @@ func TestResolveAuthLoginConfigReadsInheritedYes(t *testing.T) {
 	if !cfg.Yes {
 		t.Fatal("Yes = false, want true")
 	}
+	if got := logs.String(); !strings.Contains(got, `"msg":"auth.login.request"`) ||
+		!strings.Contains(got, `"profile_selector":""`) ||
+		!strings.Contains(got, `"target_corp_id":""`) {
+		t.Fatalf("login request diagnostic log missing selector resolution:\n%s", got)
+	}
 }
 
 func TestAuthLoginForcesAuthorizationByDefault(t *testing.T) {
@@ -697,6 +1109,12 @@ func TestAuthLoginRecommendSkipsPostLoginTUI(t *testing.T) {
 		`{"success":true,"data":{"items":[{"scope":"calendar.event:read","productCode":"calendar","productName":"日历"}],"selectedScopes":["calendar.event:read"]}}`,
 		`{"success":true,"data":{"grantedScopes":["calendar.event:read"]}}`,
 	}}
+	authpkg.SetRuntimeProfile("corp_old:user_old")
+	t.Cleanup(func() { authpkg.SetRuntimeProfile("") })
+	var authorizationProfiles []string
+	fake.beforeCall = func(string) {
+		authorizationProfiles = append(authorizationProfiles, authpkg.RuntimeProfile())
+	}
 	cmd := newAuthLoginCommand(fake)
 	var out bytes.Buffer
 	cmd.SetOut(&out)
@@ -715,6 +1133,61 @@ func TestAuthLoginRecommendSkipsPostLoginTUI(t *testing.T) {
 	if got := fake.args[0]["recommend"]; got != true {
 		t.Fatalf("--recommend plan recommend = %#v, want true", got)
 	}
+	for _, profile := range authorizationProfiles {
+		if profile != "" {
+			t.Fatalf("manual token post-login profile = %q, want empty runtime selector", profile)
+		}
+	}
+	if got := authpkg.RuntimeProfile(); got != "corp_old:user_old" {
+		t.Fatalf("runtime profile after authorization = %q, want restored selector", got)
+	}
+}
+
+func TestAuthLoginRecommendUsesNewExactIdentity(t *testing.T) {
+	t.Setenv(keychain.DisableKeychainEnv, "1")
+	t.Setenv(keychain.StorageDirEnv, t.TempDir())
+	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
+
+	oldOAuthLogin := authOAuthLogin
+	oldInteractive := authLoginInteractiveTerminal
+	t.Cleanup(func() {
+		authOAuthLogin = oldOAuthLogin
+		authLoginInteractiveTerminal = oldInteractive
+		authpkg.SetRuntimeProfile("")
+	})
+	authLoginInteractiveTerminal = func() bool { return false }
+	authOAuthLogin = func(*authpkg.OAuthProvider, context.Context, bool) (*authpkg.TokenData, error) {
+		return &authpkg.TokenData{
+			AccessToken: "new-token",
+			CorpID:      "corp_same",
+			UserID:      "user_new",
+			ExpiresAt:   time.Now().Add(time.Hour),
+		}, nil
+	}
+	fake := &authLoginRecommendSequenceCaller{responses: []string{
+		`{"success":true,"data":{"items":[],"selectedScopes":[]}}`,
+	}}
+	var authorizationProfiles []string
+	fake.beforeCall = func(string) {
+		authorizationProfiles = append(authorizationProfiles, authpkg.RuntimeProfile())
+	}
+	authpkg.SetRuntimeProfile("corp_same:user_old")
+
+	cmd := newAuthLoginCommand(fake)
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(io.Discard)
+	cmd.SetArgs([]string{"--recommend"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("auth login --recommend error = %v", err)
+	}
+	for _, profile := range authorizationProfiles {
+		if profile != "corp_same:user_new" {
+			t.Fatalf("post-login authorization profile = %q, want new exact identity", profile)
+		}
+	}
+	if got := authpkg.RuntimeProfile(); got != "corp_same:user_old" {
+		t.Fatalf("runtime profile after authorization = %q, want restored old identity", got)
+	}
 }
 
 func TestAuthLoginDefaultTUIModeSkipsSelectorWhenAllGranted(t *testing.T) {
@@ -939,7 +1412,7 @@ func TestAuthLoginDefaultTUIRunsAfterLoginTokenSaved(t *testing.T) {
 	}
 }
 
-func TestEnrichAuthLoginProfileFromContactPersistsCorpName(t *testing.T) {
+func TestEnrichAuthLoginProfileFromContactBeforePersist(t *testing.T) {
 	t.Setenv(keychain.DisableKeychainEnv, "1")
 	t.Setenv(keychain.StorageDirEnv, t.TempDir())
 	configDir := t.TempDir()
@@ -954,12 +1427,8 @@ func TestEnrichAuthLoginProfileFromContactPersistsCorpName(t *testing.T) {
 		ClientID:     "client-id",
 		Source:       "mcp",
 	}
-	if err := authpkg.SaveTokenData(configDir, token); err != nil {
-		t.Fatalf("SaveTokenData() error = %v", err)
-	}
-
 	fake := &authLoginRecommendSequenceCaller{responses: []string{
-		`{"success":true,"result":[{"orgEmployeeModel":{"corpId":"ding32fff839a3e0105d","orgName":"钉钉（中国）信息技术有限公司","userId":"011352590165863362195","orgUserName":"玄玦(主用钉)"}}]}`,
+		`{"success":true,"result":[{"isAdmin":false,"orgEmployeeModel":{"jobNumber":"202397","orgId":null,"orgName":"钉钉（中国）信息技术有限公司","orgUserId":"011352590165863362195","orgUserName":"玄玦(主用钉)"}}]}`,
 	}}
 	if err := enrichAuthLoginProfileFromContact(context.Background(), configDir, fake, token); err != nil {
 		t.Fatalf("enrichAuthLoginProfileFromContact() error = %v", err)
@@ -970,6 +1439,16 @@ func TestEnrichAuthLoginProfileFromContactPersistsCorpName(t *testing.T) {
 	if token.UserID != "011352590165863362195" || token.UserName != "玄玦(主用钉)" {
 		t.Fatalf("token user identity = (%q, %q), want contact result", token.UserID, token.UserName)
 	}
+	cfg, err := authpkg.LoadProfiles(configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() before persist error = %v", err)
+	}
+	if len(cfg.Profiles) != 0 {
+		t.Fatalf("identity enrichment persisted token early: %#v", cfg.Profiles)
+	}
+	if err := authpkg.SaveTokenData(configDir, token); err != nil {
+		t.Fatalf("SaveTokenData() error = %v", err)
+	}
 
 	loaded, err := authpkg.LoadTokenDataForProfile(configDir, "ding32fff839a3e0105d")
 	if err != nil {
@@ -981,8 +1460,50 @@ func TestEnrichAuthLoginProfileFromContactPersistsCorpName(t *testing.T) {
 	if len(fake.tools) != 1 || fake.tools[0] != "get_current_user_profile" {
 		t.Fatalf("tool calls = %v, want get_current_user_profile", fake.tools)
 	}
-	if got := fake.args[0]["profile"]; got != "ding32fff839a3e0105d" {
-		t.Fatalf("contact profile arg = %#v, want ding32fff839a3e0105d", got)
+	if len(fake.args[0]) != 0 {
+		t.Fatalf("contact profile args = %#v, want no arguments", fake.args[0])
+	}
+	if len(fake.tokens) != 1 || fake.tokens[0] != "access-token" {
+		t.Fatalf("token overrides = %v, want access-token", fake.tokens)
+	}
+}
+
+func TestEnrichAuthLoginProfileLogsIdentityResolutionWithoutCredentials(t *testing.T) {
+	t.Setenv("DWS_DEBUG_AUTH", "1")
+	var logs bytes.Buffer
+	previousLogger := slog.Default()
+	slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, &slog.HandlerOptions{Level: slog.LevelDebug})))
+	t.Cleanup(func() { slog.SetDefault(previousLogger) })
+
+	token := &authpkg.TokenData{
+		AccessToken:  "secret-access-token",
+		RefreshToken: "secret-refresh-token",
+		CorpID:       "ding_same_corp",
+	}
+	fake := &authLoginRecommendSequenceCaller{responses: []string{
+		`{"success":true,"result":[{"orgEmployeeModel":{"corpId":"ding_same_corp","orgName":"同一组织","userId":"user_two","orgUserName":"账号二"}}]}`,
+	}}
+
+	if err := enrichAuthLoginProfileFromContact(context.Background(), t.TempDir(), fake, token); err != nil {
+		t.Fatalf("enrichAuthLoginProfileFromContact() error = %v", err)
+	}
+
+	got := logs.String()
+	for _, want := range []string{
+		`"msg":"auth.login.identity.lookup.start"`,
+		`"msg":"auth.login.identity.lookup.result"`,
+		`"corp_id":"ding_same_corp"`,
+		`"user_id":"user_two"`,
+		`"user_name":"账号二"`,
+	} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("diagnostic logs missing %q:\n%s", want, got)
+		}
+	}
+	for _, secret := range []string{"secret-access-token", "secret-refresh-token"} {
+		if strings.Contains(got, secret) {
+			t.Fatalf("diagnostic logs exposed credential %q:\n%s", secret, got)
+		}
 	}
 }
 
@@ -996,6 +1517,7 @@ type authLoginRecommendSequenceCaller struct {
 	responses  []string
 	tools      []string
 	args       []map[string]any
+	tokens     []string
 	beforeCall func(toolName string)
 }
 
@@ -1017,6 +1539,11 @@ func (f *authLoginRecommendSequenceCaller) CallTool(_ context.Context, _ string,
 	return &edition.ToolResult{Content: []edition.ContentBlock{{Type: "text", Text: response}}}, nil
 }
 
+func (f *authLoginRecommendSequenceCaller) CallToolWithToken(ctx context.Context, token, productID, toolName string, args map[string]any) (*edition.ToolResult, error) {
+	f.tokens = append(f.tokens, token)
+	return f.CallTool(ctx, productID, toolName, args)
+}
+
 func (f *authLoginRecommendSequenceCaller) Format() string { return "table" }
 
 func (f *authLoginRecommendSequenceCaller) DryRun() bool { return false }

internal/app/auth_legacy_platform_coverage_test.go

@@ -0,0 +1,307 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"context"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+	"time"
+
+	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pat"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
+)
+
+func TestCrossPlatformCoverageAuthLoginUsesStableBlankProfileForPostLoginAuthorization(t *testing.T) {
+	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
+	oldOAuth := authOAuthLogin
+	oldLoadProfiles := authLoadProfiles
+	oldRecommend := authRunLoginRecommend
+	oldInteractive := authLoginInteractiveTerminal
+	oldResolve := authResolveProfile
+	t.Cleanup(func() {
+		authOAuthLogin = oldOAuth
+		authLoadProfiles = oldLoadProfiles
+		authRunLoginRecommend = oldRecommend
+		authLoginInteractiveTerminal = oldInteractive
+		authResolveProfile = oldResolve
+	})
+
+	const corpID = "corp_post_login_blank"
+	cfg := &authpkg.ProfilesConfig{Profiles: []authpkg.Profile{
+		{Name: "Fixture Organization", CorpID: corpID, CorpName: "Fixture Organization"},
+		{Name: "Exact Fixture", CorpID: corpID, CorpName: "Fixture Organization", UserID: "identity_exact"},
+	}}
+	wantSelector := authpkg.ProfileSelectionSelector(cfg.Profiles[0], cfg)
+	if wantSelector == "" || wantSelector == corpID {
+		t.Fatalf("blank selector = %q, want a stable account selector", wantSelector)
+	}
+	authResolveProfile = func(string, string) (*authpkg.Profile, error) {
+		return nil, errors.New("no implicit profile")
+	}
+	authLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) { return cfg, nil }
+	authOAuthLogin = func(*authpkg.OAuthProvider, context.Context, bool) (*authpkg.TokenData, error) {
+		return &authpkg.TokenData{
+			AccessToken: "new-access",
+			ExpiresAt:   time.Now().Add(time.Hour),
+			CorpID:      corpID,
+		}, nil
+	}
+	authLoginInteractiveTerminal = func() bool { return false }
+	seenSelector := ""
+	authRunLoginRecommend = func(context.Context, edition.ToolCaller, io.Writer, pat.LoginRecommendOptions) error {
+		seenSelector = authpkg.RuntimeProfile()
+		return nil
+	}
+	if _, _, err := authCoverageRunLogin(t, nil, "table", true, map[string]string{"recommend": "true"}); err != nil {
+		t.Fatalf("blank-profile login error = %v", err)
+	}
+	if seenSelector != wantSelector {
+		t.Fatalf("post-login runtime selector = %q, want %q", seenSelector, wantSelector)
+	}
+}
+
+func TestCrossPlatformCoverageAuthStatusAndLogoutPreserveExactSelectors(t *testing.T) {
+	t.Run("status canonicalizes a known identity", func(t *testing.T) {
+		configDir := t.TempDir()
+		t.Setenv("DWS_CONFIG_DIR", configDir)
+		const exactSelector = "corp_status_fixture:identity_status_fixture"
+		if err := authpkg.SaveProfiles(configDir, &authpkg.ProfilesConfig{
+			Version: 2,
+			Profiles: []authpkg.Profile{{
+				Name:   "Status Fixture",
+				CorpID: "corp_status_fixture",
+				UserID: "identity_status_fixture",
+			}},
+		}); err != nil {
+			t.Fatalf("SaveProfiles() error = %v", err)
+		}
+
+		oldStatus := authOAuthStatus
+		t.Cleanup(func() { authOAuthStatus = oldStatus })
+		seenSelector := ""
+		authOAuthStatus = func(*authpkg.OAuthProvider) (*authpkg.TokenData, error) {
+			seenSelector = authpkg.RuntimeProfile()
+			return &authpkg.TokenData{
+				AccessToken: "access",
+				ExpiresAt:   time.Now().Add(time.Hour),
+				CorpID:      "corp_status_fixture",
+				UserID:      "identity_status_fixture",
+			}, nil
+		}
+		cmd := newAuthStatusCommand()
+		_, _, _ = authCoverageRoot(cmd, "table", false)
+		if err := cmd.Flags().Set("profile", " Status Fixture "); err != nil {
+			t.Fatal(err)
+		}
+		if err := cmd.RunE(cmd, nil); err != nil {
+			t.Fatalf("auth status error = %v", err)
+		}
+		if seenSelector != exactSelector {
+			t.Fatalf("status runtime selector = %q, want %q", seenSelector, exactSelector)
+		}
+	})
+
+	t.Run("logout keeps a blank local selector", func(t *testing.T) {
+		oldResolve := authResolveProfileDeletion
+		oldLoad := authLoadTokenForProfile
+		oldRevoke := authRevokeTokenForData
+		oldDelete := authDeleteProfileToken
+		t.Cleanup(func() {
+			authResolveProfileDeletion = oldResolve
+			authLoadTokenForProfile = oldLoad
+			authRevokeTokenForData = oldRevoke
+			authDeleteProfileToken = oldDelete
+		})
+
+		const selector = "legacy-external-worker"
+		authResolveProfileDeletion = func(string, string) (*authpkg.Profile, bool, error) {
+			return &authpkg.Profile{CorpID: "corp_logout_blank"}, true, nil
+		}
+		loadedSelector := ""
+		authLoadTokenForProfile = func(_ string, got string) (*authpkg.TokenData, error) {
+			loadedSelector = got
+			return &authpkg.TokenData{CorpID: "corp_logout_blank"}, nil
+		}
+		authRevokeTokenForData = func(context.Context, *authpkg.TokenData) error { return nil }
+		deletedSelector := ""
+		authDeleteProfileToken = func(_ string, got string) error {
+			deletedSelector = got
+			return nil
+		}
+
+		if err := logoutOneProfile(nil, context.Background(), "cfg", "  "+selector+"  "); err != nil {
+			t.Fatalf("logoutOneProfile() error = %v", err)
+		}
+		if loadedSelector != selector || deletedSelector != selector {
+			t.Fatalf("blank logout selectors = load %q delete %q, want %q", loadedSelector, deletedSelector, selector)
+		}
+	})
+}
+
+func TestCrossPlatformCoverageAuthHistorySelectorRemainingBranches(t *testing.T) {
+	if got := authLoginHistorySelector("cfg", nil); got != "" {
+		t.Fatalf("nil history selector = %q", got)
+	}
+
+	oldLoad := authLoadProfiles
+	t.Cleanup(func() { authLoadProfiles = oldLoad })
+	authLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
+		return nil, errors.New("profiles unavailable")
+	}
+	profile := &authpkg.Profile{CorpID: "corp_history", UserID: "identity_history"}
+	if got := authLoginHistorySelector("cfg", profile); got != "corp_history:identity_history" {
+		t.Fatalf("history selector fallback = %q", got)
+	}
+
+	duplicateA := &authpkg.Profile{CorpID: "corp_history", UserID: "duplicate_identity"}
+	duplicateB := &authpkg.Profile{CorpID: "corp_history", UserID: "duplicate_identity"}
+	if got := historicalProfileForSelector(
+		"corp_history",
+		"corp_history:duplicate_identity",
+		[]*authpkg.Profile{duplicateA, duplicateB},
+	); got != nil {
+		t.Fatalf("duplicate stable identity selected %#v", got)
+	}
+
+	// Whitespace keeps the raw selector from matching the stable string while
+	// ParseIdentitySelector still resolves its components.
+	exactFallback := &authpkg.Profile{CorpID: "corp_history", UserID: "fallback_identity"}
+	if got := historicalProfileForSelector(
+		"corp_history",
+		"corp_history : fallback_identity",
+		[]*authpkg.Profile{exactFallback},
+	); got != exactFallback {
+		t.Fatalf("exact history fallback = %#v, want %#v", got, exactFallback)
+	}
+}
+
+func TestCrossPlatformCoverageProfileSwitchLegacyBlankAndNormalizedIdentityPointers(t *testing.T) {
+	t.Run("one legacy blank name", func(t *testing.T) {
+		profiles := []authpkg.Profile{
+			{Name: "Fixture Organization", CorpID: "corp_profile_fixture", CorpName: "Fixture Organization"},
+			{Name: "Exact Fixture", CorpID: "corp_profile_fixture", CorpName: "Fixture Organization", UserID: "identity_exact"},
+		}
+		cfg := &authpkg.ProfilesConfig{Profiles: profiles}
+		if got := profileSwitchProfileIndex(profiles, "Fixture Organization", cfg); got != 0 {
+			t.Fatalf("legacy blank profile index = %d, want 0", got)
+		}
+	})
+
+	t.Run("duplicate legacy names fall through to blank-name compatibility", func(t *testing.T) {
+		profiles := []authpkg.Profile{
+			{Name: "duplicate-legacy", CorpID: "corp_profile_fixture"},
+			{Name: "duplicate-legacy", CorpID: "corp_profile_fixture"},
+		}
+		cfg := &authpkg.ProfilesConfig{Profiles: profiles}
+		if got := profileSwitchProfileIndex(profiles, "duplicate-legacy", cfg); got != 0 {
+			t.Fatalf("duplicate legacy fallback index = %d, want 0", got)
+		}
+	})
+
+	t.Run("normalized exact identity", func(t *testing.T) {
+		profiles := []authpkg.Profile{{CorpID: "corp_profile_fixture", UserID: "identity_exact"}}
+		cfg := &authpkg.ProfilesConfig{Profiles: profiles}
+		if got := profileSwitchProfileIndex(profiles, "corp_profile_fixture : identity_exact", cfg); got != 0 {
+			t.Fatalf("normalized exact profile index = %d, want 0", got)
+		}
+		if got := profileSwitchProfileIndex(profiles, "corp_profile_fixture : missing", cfg); got != -1 {
+			t.Fatalf("missing normalized exact profile index = %d, want -1", got)
+		}
+	})
+}
+
+func TestCrossPlatformCoverageRuntimeRunnerPreservesBlankSelectorInSingleAndMultiRuns(t *testing.T) {
+	exact := authLogoutTestToken("corp_runner_blank")
+	exact.UserID = "identity_exact_runner"
+	other := authLogoutTestToken("corp_runner_other")
+	configDir := setupAuthLogoutProfiles(t, exact, other)
+	blank := authLogoutTestToken("corp_runner_blank")
+	blank.AccessToken = "access-unresolved-runner"
+	blank.RefreshToken = "refresh-unresolved-runner"
+	blank.UserID = ""
+	blank.UserName = ""
+	if err := authpkg.SaveTokenData(configDir, blank); err != nil {
+		t.Fatalf("SaveTokenData(blank) error = %v", err)
+	}
+	cfg, err := authpkg.LoadProfiles(configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() error = %v", err)
+	}
+	blankSelector := ""
+	for _, profile := range cfg.Profiles {
+		if profile.CorpID == blank.CorpID && profile.UserID == "" {
+			blankSelector = authpkg.ProfileSelectionSelector(profile, cfg)
+			break
+		}
+	}
+	if blankSelector == "" || blankSelector == blank.CorpID {
+		t.Fatalf("blank runner selector = %q, want exact local selector", blankSelector)
+	}
+
+	runner := &runtimeRunner{fallback: multiProfileFallbackRunner{}}
+	invocation := executor.Invocation{
+		Kind:             "helper_invocation",
+		CanonicalProduct: "contact",
+		Tool:             "get_current_user_profile",
+	}
+	authpkg.SetRuntimeProfile(blankSelector)
+	result, err := runner.Run(context.Background(), invocation)
+	if err != nil {
+		t.Fatalf("single blank Run() error = %v", err)
+	}
+	content := result.Response["content"].(map[string]any)
+	if got := content["runtimeProfile"]; got != blankSelector {
+		t.Fatalf("single blank runtime profile = %#v, want %q", got, blankSelector)
+	}
+	if got := authpkg.RuntimeProfile(); got != blankSelector {
+		t.Fatalf("single blank runtime restoration = %q, want %q", got, blankSelector)
+	}
+
+	authpkg.SetRuntimeProfile(blankSelector + ",corp_runner_other")
+	result, err = runner.Run(context.Background(), invocation)
+	if err != nil {
+		t.Fatalf("multi blank Run() error = %v", err)
+	}
+	entries := result.Response["content"].(map[string]any)["profiles"].([]any)
+	if len(entries) != 2 {
+		t.Fatalf("multi blank profiles = %#v, want two", entries)
+	}
+	first := entries[0].(map[string]any)
+	if first["selector"] != blankSelector || first["profile"] != blankSelector || first["userId"] != "" {
+		t.Fatalf("multi blank first entry = %#v", first)
+	}
+}
+
+func TestCrossPlatformCoveragePersonalBusSelectorCanonicalFallback(t *testing.T) {
+	authpkg.SetRuntimeProfile("")
+	t.Cleanup(func() { authpkg.SetRuntimeProfile("") })
+	identity := personal.Identity{
+		CorpID:   "corp_event_fallback",
+		UserID:   "identity_event_fallback",
+		SourceID: "open",
+	}
+	if got := personalBusProfileSelector(t.TempDir(), identity); got != "corp_event_fallback:identity_event_fallback" {
+		t.Fatalf("personal bus fallback selector = %q", got)
+	}
+	args := personalBusSpawnArgs(identity, "", "", "   ")
+	if got := strings.Join(args, " "); !strings.Contains(got, "--profile corp_event_fallback:identity_event_fallback") {
+		t.Fatalf("personal bus default profile args = %q", got)
+	}
+}

internal/app/auth_login_persistence_boundary_test.go

@@ -0,0 +1,107 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/keychain"
+)
+
+func TestPATFreshAuthorizationSaveUsesLoginIsolationBoundary(t *testing.T) {
+	configDir := t.TempDir()
+	t.Setenv(keychain.DisableKeychainEnv, "1")
+	t.Setenv(keychain.StorageDirEnv, t.TempDir())
+	const (
+		corpID = "corp_pat_login_boundary"
+		userID = "exact-user"
+	)
+	cfg := &authpkg.ProfilesConfig{
+		Version: 2,
+		Profiles: []authpkg.Profile{
+			{Name: "External Account", CorpID: corpID, CorpName: "PAT Boundary Organization"},
+			{Name: "Exact Account", CorpID: corpID, CorpName: "PAT Boundary Organization", UserID: userID},
+		},
+	}
+	blankSelector := authpkg.ProfileSelectionSelector(cfg.Profiles[0], cfg)
+	cfg.CurrentProfile = blankSelector
+	cfg.PrimaryProfile = blankSelector
+	if err := authpkg.SaveProfiles(configDir, cfg); err != nil {
+		t.Fatalf("SaveProfiles() error = %v", err)
+	}
+	blank := &authpkg.TokenData{AccessToken: "existing-unresolved", CorpID: corpID, CorpName: "PAT Boundary Organization"}
+	exact := &authpkg.TokenData{AccessToken: "existing-exact", CorpID: corpID, CorpName: "PAT Boundary Organization", UserID: userID}
+	if err := authpkg.SaveTokenDataKeychainForCorpID(corpID, blank); err != nil {
+		t.Fatalf("save unresolved token: %v", err)
+	}
+	if err := authpkg.SaveTokenDataKeychainForIdentity(corpID, userID, exact); err != nil {
+		t.Fatalf("save exact token: %v", err)
+	}
+	previousRuntimeProfile := authpkg.RuntimeProfile()
+	authpkg.SetRuntimeProfile("")
+	t.Cleanup(func() { authpkg.SetRuntimeProfile(previousRuntimeProfile) })
+
+	fresh := &authpkg.TokenData{AccessToken: "pat-fresh-unknown", CorpID: corpID, CorpName: "PAT Boundary Organization"}
+	err := patSaveTokenData(configDir, fresh)
+	if err == nil || !strings.Contains(err.Error(), "fresh UID-less token") {
+		t.Fatalf("patSaveTokenData() error = %v, want unresolved-sibling protection", err)
+	}
+	persisted, loadErr := authpkg.LoadTokenDataKeychainForCorpID(corpID)
+	if loadErr != nil || persisted.AccessToken != blank.AccessToken || persisted.UserID != "" {
+		t.Fatalf("PAT save changed unresolved sibling: token=%#v err=%v", persisted, loadErr)
+	}
+}
+
+func TestManualLoginSaveRepairsHalfMigratedGlobalBeforeOverwrite(t *testing.T) {
+	configDir := t.TempDir()
+	t.Setenv(keychain.DisableKeychainEnv, "1")
+	t.Setenv(keychain.StorageDirEnv, t.TempDir())
+	const (
+		corpID = "corp_manual_login_boundary"
+		userID = "legacy-user"
+	)
+	selector := corpID + ":" + userID
+	if err := authpkg.SaveProfiles(configDir, &authpkg.ProfilesConfig{
+		Version:        2,
+		CurrentProfile: selector,
+		Profiles: []authpkg.Profile{{
+			Name: "Legacy Exact Account", CorpID: corpID, CorpName: "Manual Boundary Organization", UserID: userID,
+		}},
+	}); err != nil {
+		t.Fatalf("SaveProfiles() error = %v", err)
+	}
+	legacy := &authpkg.TokenData{AccessToken: "only-legacy-copy", CorpID: corpID, CorpName: "Manual Boundary Organization"}
+	if err := authpkg.SaveTokenDataKeychain(legacy); err != nil {
+		t.Fatalf("save half-migrated global: %v", err)
+	}
+	manual := &authpkg.TokenData{AccessToken: "manual-default", ExpiresAt: time.Now().Add(time.Hour)}
+	if err := authSaveTokenData(configDir, manual); err != nil {
+		t.Fatalf("authSaveTokenData(manual) error = %v", err)
+	}
+	org, err := authpkg.LoadTokenDataKeychainForCorpID(corpID)
+	if err != nil || org.AccessToken != legacy.AccessToken || org.UserID != "" {
+		t.Fatalf("organization repair = %#v, %v", org, err)
+	}
+	identity, err := authpkg.LoadTokenDataKeychainForIdentity(corpID, userID)
+	if err != nil || identity.AccessToken != legacy.AccessToken || identity.UserID != userID {
+		t.Fatalf("identity repair = %#v, %v", identity, err)
+	}
+	global, err := authpkg.LoadTokenDataKeychain()
+	if err != nil || global.AccessToken != manual.AccessToken || global.CorpID != "" {
+		t.Fatalf("manual global = %#v, %v", global, err)
+	}
+}

internal/app/auth_refresh_retry.go

@@ -15,6 +15,15 @@ package app
 
 import (
 	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"strings"
+
+	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/logging"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/authretry"
 )
 
 // authRetryingKey marks a context that has already attempted one
@@ -23,8 +32,35 @@ import (
 // to the user instead.
 type authRetryingKeyType struct{}
 
+type authRefreshFailureError struct {
+	rejection error
+	refresh   error
+}
+
+func (e *authRefreshFailureError) Error() string {
+	return "automatic access token refresh failed"
+}
+
+func (e *authRefreshFailureError) Unwrap() []error {
+	if e == nil {
+		return nil
+	}
+	return []error{e.rejection, e.refresh}
+}
+
 var authRetryingKey = authRetryingKeyType{}
 
+var (
+	runnerForceRefreshRejectedAccessToken = forceRefreshRejectedAccessToken
+	runnerExecuteAuthRetry                func(*runtimeRunner, context.Context, string, executor.Invocation) (executor.Result, error)
+)
+
+func init() {
+	runnerExecuteAuthRetry = func(r *runtimeRunner, ctx context.Context, endpoint string, invocation executor.Invocation) (executor.Result, error) {
+		return r.executeInvocation(ctx, endpoint, invocation)
+	}
+}
+
 // IsAuthRetrying reports whether the current context is already inside an
 // AuthRefreshRequired retry. Mirrors IsPatRetrying.
 func IsAuthRetrying(ctx context.Context) bool {
@@ -34,3 +70,103 @@ func IsAuthRetrying(ctx context.Context) bool {
 	v, _ := ctx.Value(authRetryingKey).(bool)
 	return v
 }
+
+func withAuthRetrying(ctx context.Context) context.Context {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	return context.WithValue(ctx, authRetryingKey, true)
+}
+
+func authRefreshLogger() *slog.Logger {
+	if logger := FileLoggerInstance(); logger != nil {
+		return logger
+	}
+	return slog.Default()
+}
+
+func (r *runtimeRunner) managesRuntimeOAuth(hasPluginAuth bool) bool {
+	if r == nil || hasPluginAuth {
+		return false
+	}
+	return r.globalFlags == nil || strings.TrimSpace(r.globalFlags.Token) == ""
+}
+
+// retryAuthRefreshRequired consumes only the explicit edition marker. It does
+// not infer retryability from free text, generic auth categories, HTTP 403, or
+// ordinary business errors.
+func (r *runtimeRunner) retryAuthRefreshRequired(
+	ctx context.Context,
+	endpoint string,
+	invocation executor.Invocation,
+	rejectedAccessToken string,
+	markerErr error,
+	hasPluginAuth bool,
+) (executor.Result, error, bool) {
+	marker, marked := authretry.As(markerErr)
+	if !marked {
+		return executor.Result{}, nil, false
+	}
+	cause := marker.Cause
+	if cause == nil {
+		cause = markerErr
+	}
+
+	// Explicit --token and plugin credentials are not backed by the default
+	// OAuth refresh store. Preserve the overlay cause without mutating an
+	// unrelated persisted login.
+	if !r.managesRuntimeOAuth(hasPluginAuth) {
+		return executor.Result{}, cause, true
+	}
+	if IsAuthRetrying(ctx) {
+		authRefreshLogger().Warn("auth.runtime.refresh.retry_exhausted",
+			"product", invocation.CanonicalProduct,
+			"tool", invocation.Tool,
+		)
+		return executor.Result{}, cause, true
+	}
+
+	if _, err := runnerForceRefreshRejectedAccessToken(ctx, defaultConfigDir(), rejectedAccessToken); err != nil {
+		// Keep every log credential-safe. The returned error chain retains the
+		// complete cause for in-process diagnosis; even DWS_DEBUG_AUTH must not
+		// serialize an OAuth response body or other attacker-controlled text.
+		authRefreshLogger().Warn("auth.runtime.refresh.failed",
+			"product", invocation.CanonicalProduct,
+			"tool", invocation.Tool,
+			"stage", "force_refresh_rejected_token",
+			"error_type", fmt.Sprintf("%T", err),
+		)
+		logging.AuthDebug("auth.runtime.refresh.failed.detail",
+			"product", invocation.CanonicalProduct,
+			"tool", invocation.Tool,
+			"stage", "force_refresh_rejected_token",
+			"error_type", fmt.Sprintf("%T", err),
+		)
+		combined := &authRefreshFailureError{rejection: cause, refresh: err}
+		return executor.Result{}, apperrors.NewAuth(
+			"automatic access token refresh failed",
+			apperrors.WithOperation("auth/token/refresh"),
+			apperrors.WithReason("auth_refresh_failed"),
+			apperrors.WithHint("本地凭证已保留；可稍后重试，若持续失败请查看认证诊断日志。"),
+			apperrors.WithCause(combined),
+		), true
+	}
+
+	logging.AuthDebug("auth.runtime.refresh.succeeded",
+		"product", invocation.CanonicalProduct,
+		"tool", invocation.Tool,
+	)
+	result, err := runnerExecuteAuthRetry(r, withAuthRetrying(ctx), endpoint, invocation)
+	return result, err, true
+}
+
+// isRefreshableTransportAuthError deliberately excludes HTTP/RPC 403 and
+// generic CategoryAuth values. OnAuthError may request a refresh only for an
+// exact transport-level unauthorized signal.
+func isRefreshableTransportAuthError(err error) bool {
+	var typed *apperrors.Error
+	if !errors.As(err, &typed) || typed.Category != apperrors.CategoryAuth {
+		return false
+	}
+	return typed.Reason == "http_401" || typed.RPCCode == 401
+}

internal/app/auth_refresh_retry_runner_test.go

@@ -0,0 +1,354 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"log/slog"
+	"strings"
+	"testing"
+
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/audit"
+	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
+	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/authretry"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
+)
+
+func installAuthRefreshRunnerSeams(t *testing.T) {
+	t.Helper()
+	previousHooks := edition.Get()
+	previousCall := runnerCallTool
+	previousPreflight := runnerPreflightDocDownload
+	previousRefresh := runnerForceRefreshRejectedAccessToken
+	previousRetry := runnerExecuteAuthRetry
+	previousCapture := runnerCaptureRuntimeFailure
+	previousProfile := authpkg.RuntimeProfile()
+
+	pluginAuthMu.Lock()
+	previousPlugins := pluginAuthRegistry
+	pluginAuthRegistry = make(map[string]*PluginAuth)
+	pluginAuthMu.Unlock()
+
+	runnerPreflightDocDownload = func(*runtimeRunner, context.Context, *transport.Client, string, executor.Invocation) error {
+		return nil
+	}
+	runnerCaptureRuntimeFailure = func(executor.Invocation, error, error) {}
+	authpkg.SetRuntimeProfile("")
+	runtimeTokenManager.Invalidate()
+	t.Setenv("DWS_CONFIG_DIR", "")
+	t.Setenv("DWS_DEBUG_AUTH", "0")
+
+	t.Cleanup(func() {
+		edition.Override(previousHooks)
+		runnerCallTool = previousCall
+		runnerPreflightDocDownload = previousPreflight
+		runnerForceRefreshRejectedAccessToken = previousRefresh
+		runnerExecuteAuthRetry = previousRetry
+		runnerCaptureRuntimeFailure = previousCapture
+		authpkg.SetRuntimeProfile(previousProfile)
+		runtimeTokenManager.Invalidate()
+		pluginAuthMu.Lock()
+		pluginAuthRegistry = previousPlugins
+		pluginAuthMu.Unlock()
+	})
+}
+
+func authRefreshTestRunner(flags *GlobalFlags) *runtimeRunner {
+	return &runtimeRunner{
+		transport:   transport.NewClient(nil),
+		globalFlags: flags,
+		auditSink:   audit.NopSink{},
+	}
+}
+
+func authRefreshTestInvocation() executor.Invocation {
+	return executor.Invocation{
+		CanonicalProduct: "auth-retry-test-product",
+		Tool:             "test_tool",
+		Params:           map[string]any{"value": "safe"},
+	}
+}
+
+func authRefreshTokenHooks(configDir string, token *string, classify func(map[string]any) error) *edition.Hooks {
+	return &edition.Hooks{
+		ConfigDir: func() string { return configDir },
+		TokenProvider: func(context.Context, func() (string, error)) (string, error) {
+			return *token, nil
+		},
+		ClassifyToolResult: classify,
+	}
+}
+
+func TestCrossPlatformCoverageRunnerRetriesEditionAuthMarkerOnce(t *testing.T) {
+	installAuthRefreshRunnerSeams(t)
+	configDir := t.TempDir()
+	token := "old-access"
+	rejection := apperrors.NewAuth("server rejected access token", apperrors.WithReason("access_token_rejected"))
+	edition.Override(authRefreshTokenHooks(configDir, &token, func(content map[string]any) error {
+		if expired, _ := content["expired"].(bool); expired {
+			return &authretry.AuthRefreshRequired{Cause: rejection}
+		}
+		return nil
+	}))
+
+	var callTokens []string
+	runnerCallTool = func(client *transport.Client, _ context.Context, _, _ string, _ map[string]any) (transport.ToolCallResult, error) {
+		callTokens = append(callTokens, client.AuthToken)
+		if len(callTokens) == 1 {
+			return transport.ToolCallResult{Content: map[string]any{"expired": true}}, nil
+		}
+		return transport.ToolCallResult{Content: map[string]any{"value": "ok"}}, nil
+	}
+	refreshCalls := 0
+	runnerForceRefreshRejectedAccessToken = func(_ context.Context, gotDir, rejected string) (string, error) {
+		refreshCalls++
+		if gotDir != configDir || rejected != "old-access" {
+			t.Fatalf("refresh input = dir %q token %q", gotDir, rejected)
+		}
+		token = "new-access"
+		return token, nil
+	}
+
+	result, err := authRefreshTestRunner(nil).executeInvocation(context.Background(), "https://example.test", authRefreshTestInvocation())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if refreshCalls != 1 || len(callTokens) != 2 || callTokens[0] != "old-access" || callTokens[1] != "new-access" {
+		t.Fatalf("refreshes=%d call tokens=%v", refreshCalls, callTokens)
+	}
+	content, _ := result.Response["content"].(map[string]any)
+	if content["value"] != "ok" || content["success"] != true {
+		t.Fatalf("result content = %#v", content)
+	}
+}
+
+func TestCrossPlatformCoverageRunnerRefreshFailurePreservesBothCausesAndSafeLog(t *testing.T) {
+	installAuthRefreshRunnerSeams(t)
+	t.Setenv("DWS_DEBUG_AUTH", "1")
+	configDir := t.TempDir()
+	token := "old-access"
+	rejection := apperrors.NewAuth("server rejected access token", apperrors.WithReason("access_token_rejected"))
+	edition.Override(authRefreshTokenHooks(configDir, &token, func(map[string]any) error {
+		return &authretry.AuthRefreshRequired{Cause: rejection}
+	}))
+	runnerCallTool = func(*transport.Client, context.Context, string, string, map[string]any) (transport.ToolCallResult, error) {
+		return transport.ToolCallResult{Content: map[string]any{"expired": true}}, nil
+	}
+	refreshErr := errors.New(`oauth refresh response parse failed: body={"access_token":"access-token-secret","refresh_token":"refresh-token-secret","uid":"uid-secret-value"}`)
+	runnerForceRefreshRejectedAccessToken = func(context.Context, string, string) (string, error) {
+		return "", refreshErr
+	}
+
+	var logs bytes.Buffer
+	previousLogger := slog.Default()
+	slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, &slog.HandlerOptions{Level: slog.LevelDebug})))
+	t.Cleanup(func() { slog.SetDefault(previousLogger) })
+
+	_, err := authRefreshTestRunner(nil).executeInvocation(context.Background(), "https://example.test", authRefreshTestInvocation())
+	if !errors.Is(err, rejection) || !errors.Is(err, refreshErr) {
+		t.Fatalf("error = %v, want rejection and refresh causes", err)
+	}
+	var typed *apperrors.Error
+	if !errors.As(err, &typed) || typed.Category != apperrors.CategoryAuth || typed.Reason != "auth_refresh_failed" || typed.Operation != "auth/token/refresh" {
+		t.Fatalf("refresh envelope = %#v", typed)
+	}
+	var rendered bytes.Buffer
+	if printErr := apperrors.PrintJSON(&rendered, err); printErr != nil {
+		t.Fatal(printErr)
+	}
+	for _, want := range []string{`"category": "auth"`, `"reason": "auth_refresh_failed"`, `"operation": "auth/token/refresh"`} {
+		if !strings.Contains(rendered.String(), want) {
+			t.Fatalf("structured stderr missing %s: %s", want, rendered.String())
+		}
+	}
+	for _, secret := range []string{"access-token-secret", "refresh-token-secret", "uid-secret-value"} {
+		if strings.Contains(err.Error(), secret) || strings.Contains(logs.String(), secret) || strings.Contains(rendered.String(), secret) {
+			t.Fatalf("auth output leaked %q: error=%q logs=%s stderr=%s", secret, err, logs.String(), rendered.String())
+		}
+	}
+	for _, want := range []string{"auth.runtime.refresh.failed", "auth.runtime.refresh.failed.detail", "force_refresh_rejected_token", "error_type"} {
+		if !strings.Contains(logs.String(), want) {
+			t.Fatalf("safe refresh log missing %q: %s", want, logs.String())
+		}
+	}
+}
+
+func TestCrossPlatformCoverageRunnerSecondEditionMarkerReturnsSecondCause(t *testing.T) {
+	installAuthRefreshRunnerSeams(t)
+	configDir := t.TempDir()
+	token := "old-access"
+	firstCause := errors.New("first rejection")
+	secondCause := errors.New("second rejection")
+	edition.Override(authRefreshTokenHooks(configDir, &token, func(content map[string]any) error {
+		attempt, _ := content["attempt"].(int)
+		if attempt == 1 {
+			return &authretry.AuthRefreshRequired{Cause: firstCause}
+		}
+		return &authretry.AuthRefreshRequired{Cause: secondCause}
+	}))
+	calls := 0
+	runnerCallTool = func(*transport.Client, context.Context, string, string, map[string]any) (transport.ToolCallResult, error) {
+		calls++
+		return transport.ToolCallResult{Content: map[string]any{"attempt": calls}}, nil
+	}
+	refreshCalls := 0
+	runnerForceRefreshRejectedAccessToken = func(context.Context, string, string) (string, error) {
+		refreshCalls++
+		token = "new-access"
+		return token, nil
+	}
+
+	_, err := authRefreshTestRunner(nil).executeInvocation(context.Background(), "https://example.test", authRefreshTestInvocation())
+	if !errors.Is(err, secondCause) || errors.Is(err, firstCause) {
+		t.Fatalf("error = %v, want only second rejection cause", err)
+	}
+	if calls != 2 || refreshCalls != 1 {
+		t.Fatalf("calls=%d refreshes=%d", calls, refreshCalls)
+	}
+}
+
+func TestCrossPlatformCoverageRunnerOnAuthErrorOnlyRetriesExactUnauthorized(t *testing.T) {
+	t.Run("http 401 marker retries once", func(t *testing.T) {
+		installAuthRefreshRunnerSeams(t)
+		configDir := t.TempDir()
+		token := "old-access"
+		rejection := errors.New("transport rejected token")
+		hookCalls := 0
+		hooks := authRefreshTokenHooks(configDir, &token, nil)
+		hooks.OnAuthError = func(string, error) error {
+			hookCalls++
+			return &authretry.AuthRefreshRequired{Cause: rejection}
+		}
+		edition.Override(hooks)
+		calls := 0
+		var callTokens []string
+		runnerCallTool = func(client *transport.Client, _ context.Context, _, _ string, _ map[string]any) (transport.ToolCallResult, error) {
+			calls++
+			callTokens = append(callTokens, client.AuthToken)
+			if calls == 1 {
+				return transport.ToolCallResult{}, apperrors.NewAuth("unauthorized", apperrors.WithReason("http_401"))
+			}
+			return transport.ToolCallResult{Content: map[string]any{"value": "ok"}}, nil
+		}
+		refreshCalls := 0
+		runnerForceRefreshRejectedAccessToken = func(context.Context, string, string) (string, error) {
+			refreshCalls++
+			token = "new-access"
+			return token, nil
+		}
+
+		if _, err := authRefreshTestRunner(nil).executeInvocation(context.Background(), "https://example.test", authRefreshTestInvocation()); err != nil {
+			t.Fatal(err)
+		}
+		if hookCalls != 1 || refreshCalls != 1 || calls != 2 || strings.Join(callTokens, ",") != "old-access,new-access" {
+			t.Fatalf("hook=%d refresh=%d calls=%d tokens=%v", hookCalls, refreshCalls, calls, callTokens)
+		}
+	})
+
+	for _, tc := range []struct {
+		name string
+		err  error
+	}{
+		{name: "http 403", err: apperrors.NewAuth("forbidden", apperrors.WithReason("http_403"))},
+		{name: "ordinary auth", err: apperrors.NewAuth("load failed", apperrors.WithReason("auth_load_failed"))},
+	} {
+		t.Run(tc.name+" does not enter hook", func(t *testing.T) {
+			installAuthRefreshRunnerSeams(t)
+			configDir := t.TempDir()
+			token := "old-access"
+			hookCalls := 0
+			hooks := authRefreshTokenHooks(configDir, &token, nil)
+			hooks.OnAuthError = func(string, error) error {
+				hookCalls++
+				return &authretry.AuthRefreshRequired{Cause: errors.New("must not run")}
+			}
+			edition.Override(hooks)
+			runnerCallTool = func(*transport.Client, context.Context, string, string, map[string]any) (transport.ToolCallResult, error) {
+				return transport.ToolCallResult{}, tc.err
+			}
+			refreshCalls := 0
+			runnerForceRefreshRejectedAccessToken = func(context.Context, string, string) (string, error) {
+				refreshCalls++
+				return "", nil
+			}
+
+			_, err := authRefreshTestRunner(nil).executeInvocation(context.Background(), "https://example.test", authRefreshTestInvocation())
+			if !errors.Is(err, tc.err) || hookCalls != 0 || refreshCalls != 0 {
+				t.Fatalf("error=%v hook=%d refresh=%d", err, hookCalls, refreshCalls)
+			}
+		})
+	}
+}
+
+func TestCrossPlatformCoverageRunnerDoesNotRefreshExplicitTokenMarker(t *testing.T) {
+	installAuthRefreshRunnerSeams(t)
+	rejection := errors.New("explicit token rejected")
+	edition.Override(&edition.Hooks{ClassifyToolResult: func(map[string]any) error {
+		return &authretry.AuthRefreshRequired{Cause: rejection}
+	}})
+	calls := 0
+	runnerCallTool = func(*transport.Client, context.Context, string, string, map[string]any) (transport.ToolCallResult, error) {
+		calls++
+		return transport.ToolCallResult{Content: map[string]any{"expired": true}}, nil
+	}
+	refreshCalls := 0
+	runnerForceRefreshRejectedAccessToken = func(context.Context, string, string) (string, error) {
+		refreshCalls++
+		return "", nil
+	}
+
+	_, err := authRefreshTestRunner(&GlobalFlags{Token: "explicit-token"}).executeInvocation(context.Background(), "https://example.test", authRefreshTestInvocation())
+	if !errors.Is(err, rejection) || calls != 1 || refreshCalls != 0 {
+		t.Fatalf("error=%v calls=%d refresh=%d", err, calls, refreshCalls)
+	}
+}
+
+func TestCrossPlatformCoverageRunnerRetriesPreflightEditionMarkerOnce(t *testing.T) {
+	installAuthRefreshRunnerSeams(t)
+	configDir := t.TempDir()
+	token := "old-access"
+	rejection := errors.New("preflight token rejected")
+	edition.Override(authRefreshTokenHooks(configDir, &token, nil))
+	preflightCalls := 0
+	runnerPreflightDocDownload = func(*runtimeRunner, context.Context, *transport.Client, string, executor.Invocation) error {
+		preflightCalls++
+		if preflightCalls == 1 {
+			return &authretry.AuthRefreshRequired{Cause: rejection}
+		}
+		return nil
+	}
+	toolCalls := 0
+	runnerCallTool = func(*transport.Client, context.Context, string, string, map[string]any) (transport.ToolCallResult, error) {
+		toolCalls++
+		return transport.ToolCallResult{Content: map[string]any{"value": "ok"}}, nil
+	}
+	refreshCalls := 0
+	runnerForceRefreshRejectedAccessToken = func(context.Context, string, string) (string, error) {
+		refreshCalls++
+		token = "new-access"
+		return token, nil
+	}
+
+	if _, err := authRefreshTestRunner(nil).executeInvocation(context.Background(), "https://example.test", authRefreshTestInvocation()); err != nil {
+		t.Fatal(err)
+	}
+	if preflightCalls != 2 || toolCalls != 1 || refreshCalls != 1 {
+		t.Fatalf("preflights=%d tools=%d refreshes=%d", preflightCalls, toolCalls, refreshCalls)
+	}
+}

internal/app/auth_registry.go

@@ -49,6 +49,15 @@ func RegisterPluginAuth(productID string, auth *PluginAuth) {
 	pluginAuthRegistry[productID] = auth
 }
 
+// ClearPluginAuth removes credentials for a plugin product. Registration uses
+// this before applying an accepted descriptor so a descriptor without custom
+// auth cannot inherit stale credentials from an earlier root construction.
+func ClearPluginAuth(productID string) {
+	pluginAuthMu.Lock()
+	defer pluginAuthMu.Unlock()
+	delete(pluginAuthRegistry, productID)
+}
+
 // LookupPluginAuth returns the authentication credentials registered
 // for the given product ID, or nil if none exists.
 func LookupPluginAuth(productID string) (*PluginAuth, bool) {

internal/app/blank_profile_selector_regression_test.go

@@ -0,0 +1,144 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"testing"
+
+	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
+)
+
+func blankProfileSelectorAppFixture(blankName, corpName string) *authpkg.ProfilesConfig {
+	const (
+		corpID      = "corp_selector_fixture"
+		exactUserID = "identity_exact_fixture"
+	)
+	exactSelector := corpID + ":" + exactUserID
+	cfg := &authpkg.ProfilesConfig{
+		Version:         2,
+		PrimaryProfile:  exactSelector,
+		PreviousProfile: exactSelector,
+		OrgCurrentProfiles: map[string]string{
+			corpID: exactSelector,
+		},
+		Profiles: []authpkg.Profile{
+			{
+				Name:     "Exact Fixture Account",
+				CorpID:   corpID,
+				CorpName: corpName,
+				UserID:   exactUserID,
+				UserName: "Exact Fixture Account",
+				Status:   authpkg.ProfileStatusActive,
+			},
+			{
+				Name:     blankName,
+				CorpID:   corpID,
+				CorpName: corpName,
+				Status:   authpkg.ProfileStatusActive,
+			},
+		},
+	}
+	cfg.CurrentProfile = authpkg.ProfileSelectionSelector(cfg.Profiles[1], cfg)
+	return cfg
+}
+
+func captureProfileListSelectors(t *testing.T, cfg *authpkg.ProfilesConfig) ([]string, []profileView) {
+	t.Helper()
+	originalLoadToken := profileLoadTokenData
+	selectors := make([]string, 0, len(cfg.Profiles))
+	profileLoadTokenData = func(_ string, selector string) (*authpkg.TokenData, error) {
+		selectors = append(selectors, selector)
+		return nil, authpkg.ErrTokenDataNotFound
+	}
+	t.Cleanup(func() { profileLoadTokenData = originalLoadToken })
+	views := profileViews("unused-config-dir", cfg)
+	return selectors, views
+}
+
+func TestCrossPlatformCoverageBlankProfileNameMatchingCorpNameRoundTripsThroughListAndTUI(t *testing.T) {
+	cfg := blankProfileSelectorAppFixture("Fixture Organization", "Fixture Organization")
+	blank := cfg.Profiles[1]
+	blankSelector := authpkg.ProfileSelectionSelector(blank, cfg)
+
+	if blankSelector == blank.Name || blankSelector == blank.CorpID {
+		t.Fatalf("unsafe blank selector = %q, want reserved exact selector", blankSelector)
+	}
+	if got := profileCLISelector(blank, cfg); got != blankSelector {
+		t.Errorf("profileCLISelector(blank) = %q, want %q", got, blankSelector)
+	}
+	if got := profileSwitchProfileIndex(cfg.Profiles, cfg.CurrentProfile, cfg); got != 1 {
+		t.Errorf("profileSwitchProfileIndex(blank current) = %d, want 1", got)
+	}
+	model := newProfileSwitchTUIModel(cfg, cfg.CurrentProfile)
+	if model.selected != 1 {
+		t.Errorf("TUI selected index = %d, want blank profile index 1", model.selected)
+	}
+	if got := model.selectedCorpID(); got != blankSelector {
+		t.Errorf("TUI selected selector = %q, want %q", got, blankSelector)
+	}
+
+	selectors, views := captureProfileListSelectors(t, cfg)
+	if len(selectors) != 2 || selectors[0] != cfg.PreviousProfile || selectors[1] != blankSelector {
+		t.Errorf("profile list token selectors = %#v, want exact then %q", selectors, blankSelector)
+	}
+	if len(views) != 2 {
+		t.Fatalf("profile list views = %#v, want two entries", views)
+	}
+	if views[0].IsCurrent {
+		t.Error("exact account should not be marked current when blank local selector is current")
+	}
+	if views[1].Profile != blankSelector || !views[1].IsCurrent {
+		t.Errorf("blank list view = %#v, want local selector marked current", views[1])
+	}
+}
+
+func TestCrossPlatformCoverageBlankProfileNameContainingColonWinsOverIdentityParsingInListAndTUI(t *testing.T) {
+	cfg := blankProfileSelectorAppFixture("legacy:outsourced", "Fixture Organization")
+	blank := cfg.Profiles[1]
+	blankSelector := authpkg.ProfileSelectionSelector(blank, cfg)
+
+	if blankSelector == blank.Name {
+		t.Fatalf("colon-containing name leaked as selector %q", blankSelector)
+	}
+	if _, _, parsedAsIdentity := authpkg.ParseIdentitySelector(blankSelector); parsedAsIdentity {
+		t.Fatalf("stable blank selector %q was parsed as an identity", blankSelector)
+	}
+	if got := profileCLISelector(blank, cfg); got != blankSelector {
+		t.Errorf("profileCLISelector(colon blank) = %q, want %q", got, blankSelector)
+	}
+	if got := profileSwitchProfileIndex(cfg.Profiles, cfg.CurrentProfile, cfg); got != 1 {
+		t.Errorf("profileSwitchProfileIndex(colon blank current) = %d, want 1", got)
+	}
+	model := newProfileSwitchTUIModel(cfg, cfg.CurrentProfile)
+	if model.selected != 1 {
+		t.Errorf("TUI selected index = %d, want colon-name blank profile index 1", model.selected)
+	}
+	if got := model.selectedCorpID(); got != blankSelector {
+		t.Errorf("TUI selected selector = %q, want %q", got, blankSelector)
+	}
+
+	selectors, views := captureProfileListSelectors(t, cfg)
+	if len(selectors) != 2 || selectors[0] != cfg.PreviousProfile || selectors[1] != blankSelector {
+		t.Errorf("profile list token selectors = %#v, want exact then %q", selectors, blankSelector)
+	}
+	if len(views) != 2 {
+		t.Fatalf("profile list views = %#v, want two entries", views)
+	}
+	if views[0].IsCurrent {
+		t.Error("exact account should not be marked current when colon-name blank selector is current")
+	}
+	if views[1].Profile != blankSelector || !views[1].IsCurrent {
+		t.Errorf("colon-name blank list view = %#v, want local selector marked current", views[1])
+	}
+}

internal/app/coverage_edges_test.go

@@ -74,6 +74,19 @@ func TestCrossPlatformCoverageToolCallerAdapterCoverage(t *testing.T) {
 		t.Fatal("adapter flags were not forwarded")
 	}
 	adapter.flags.DryRun = false
+	if _, err := (*toolCallerAdapter)(nil).CallToolWithToken(context.Background(), "token", "doc", "get", nil); err == nil {
+		t.Fatal("nil adapter token override succeeded")
+	}
+	authpkg.SetRuntimeProfile("saved-profile")
+	adapter.flags.Token = "saved-token"
+	runner.result = executor.Result{Response: map[string]any{"content": []any{map[string]any{"type": "text", "text": "ok"}}}}
+	if _, err := adapter.CallToolWithToken(context.Background(), "temporary-token", "doc", "get", nil); err != nil {
+		t.Fatal(err)
+	}
+	if adapter.flags.Token != "saved-token" || authpkg.RuntimeProfile() != "saved-profile" {
+		t.Fatal("token override state was not restored")
+	}
+	authpkg.SetRuntimeProfile("")
 
 	runner.err = errors.New("runner failure")
 	if _, err := adapter.CallTool(context.Background(), "doc", "get", map[string]any{"x": 1}); !errors.Is(err, runner.err) {
@@ -541,7 +554,7 @@ func TestCrossPlatformCoverageRecoveryRuntimeHTTP(t *testing.T) {
 	defer server.Close()
 	SetDynamicServers([]mcptypes.ServerDescriptor{{Endpoint: server.URL, CLI: mcptypes.CLIOverlay{ID: "devdoc", Tools: []mcptypes.CLITool{{Name: "search_open_platform_docs_rag"}}}}})
 	t.Cleanup(func() { SetDynamicServers(nil) })
-	runtime := &recoveryRuntime{transport: transport.NewClient(server.Client())}
+	runtime := &recoveryRuntime{transport: transport.NewClient(server.Client()), flags: &GlobalFlags{Token: "token"}}
 	got, err := runtime.Search(context.Background(), "query", recovery.RecoveryContext{ToolName: "search"})
 	if err != nil || got.DocSearch.Status != "success" || len(got.KBHits) == 0 {
 		t.Fatalf("recovery search = %#v %v", got, err)
@@ -1456,20 +1469,17 @@ func TestCrossPlatformCoveragePersonalEventPureCoverage(t *testing.T) {
 	if !ok {
 		t.Fatal("mention definition missing")
 	}
-	if err := renderPersonalSchema(io.Discard, def, ""); err != nil {
+	if err := renderPersonalSchema(io.Discard, def, "", false); err != nil {
 		t.Fatal(err)
 	}
-	if err := renderPersonalSchema(io.Discard, def, "yaml"); err == nil {
+	if err := renderPersonalSchema(io.Discard, def, "yaml", true); err == nil {
 		t.Fatal("unsupported schema format succeeded")
 	}
-	for _, key := range []string{"", "unknown", personal.EventMention} {
+	for _, key := range []string{"", "unknown", personal.EventMention, personal.EventFromUser} {
 		if err := ensurePublicPersonalEvent(key); err != nil {
 			t.Fatalf("public event %q: %v", key, err)
 		}
 	}
-	if err := ensurePublicPersonalEvent(personal.EventFromUser); err == nil {
-		t.Fatal("private event accepted")
-	}
 
 	var cfg consume.Config
 	applyPersonalConsumeFilters(nil, personalConsumeOptions{}, "", "")
@@ -1604,7 +1614,7 @@ func TestCrossPlatformCoveragePersonalSubscriptionAndSourceCoverage(t *testing.T
 		{"lookup", personalConsumeOptions{SubscribeID: "existing"}, true},
 		{"create", personalConsumeOptions{EventKey: personal.EventMention, Name: "name", FilterJSON: `{"field":"content","op":"eq","value":"x"}`, QueryCSV: "a,b", TTL: time.Minute}, true},
 		{"missing", personalConsumeOptions{}, false},
-		{"private", personalConsumeOptions{EventKey: personal.EventFromUser, UserID: "u"}, false},
+		{"sender", personalConsumeOptions{EventKey: personal.EventFromUser, UserID: "u"}, true},
 		{"bad-rule", personalConsumeOptions{EventKey: personal.EventMention, Rule: "other"}, false},
 		{"bad-filter", personalConsumeOptions{EventKey: personal.EventMention, FilterJSON: "{"}, false},
 	} {
@@ -1618,7 +1628,7 @@ func TestCrossPlatformCoveragePersonalSubscriptionAndSourceCoverage(t *testing.T
 			}
 		})
 	}
-	if createCount != 1 {
+	if createCount != 2 {
 		t.Fatalf("create count = %d", createCount)
 	}
 
@@ -1640,6 +1650,8 @@ func TestCrossPlatformCoveragePersonalSubscriptionAndSourceCoverage(t *testing.T
 }
 
 func TestCrossPlatformCoveragePersonalEventCommandRuntimeCoverage(t *testing.T) {
+	authpkg.SetRuntimeProfile("")
+	t.Cleanup(func() { authpkg.SetRuntimeProfile("") })
 	configDir := setupPersonalIdentityToken(t, &authpkg.TokenData{
 		AccessToken: "access", RefreshToken: "refresh", ExpiresAt: time.Now().Add(time.Hour),
 		CorpID: "corp", UserID: "user", ClientID: "client",
@@ -2000,6 +2012,31 @@ func TestCrossPlatformCoverageProfileCommandAndModelCoverage(t *testing.T) {
 	if err := authpkg.SaveProfiles(configDir, cfg); err != nil {
 		t.Fatal(err)
 	}
+	for _, profile := range cfg.Profiles {
+		data := &authpkg.TokenData{
+			AccessToken: "token-" + profile.CorpID,
+			CorpID:      profile.CorpID,
+			UserID:      profile.UserID,
+		}
+		var err error
+		if profile.UserID == "" {
+			err = authpkg.SaveTokenDataKeychainForCorpID(profile.CorpID, data)
+		} else {
+			err = authpkg.SaveTokenDataKeychainForIdentity(profile.CorpID, profile.UserID, data)
+		}
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	t.Cleanup(func() {
+		for _, profile := range cfg.Profiles {
+			if profile.UserID == "" {
+				_ = authpkg.DeleteTokenDataKeychainForCorpID(profile.CorpID)
+			} else {
+				_ = authpkg.DeleteTokenDataKeychainForIdentity(profile.CorpID, profile.UserID)
+			}
+		}
+	})
 	oldInteractive := profileSwitchInteractiveTerminal
 	oldSelector := profileSwitchSelector
 	t.Cleanup(func() {
@@ -2094,15 +2131,11 @@ func TestCrossPlatformCoverageProfileCommandAndModelCoverage(t *testing.T) {
 	}
 
 	_ = profileSwitchSortedProfiles(cfg.Profiles)
-	for _, raw := range []string{"", "bad", now.Format(time.RFC3339)} {
-		_, _ = parseProfileSwitchTime(raw)
-	}
 	for _, p := range cfg.Profiles {
-		_, _ = profileSwitchSortTime(p)
 		_ = profileSwitchOptionLabel(p, cfg)
 		_, _ = profileSwitchProfileCells(p, cfg)
 	}
-	_ = profileSwitchProfileIndex(cfg.Profiles, "missing")
+	_ = profileSwitchProfileIndex(cfg.Profiles, "missing", cfg)
 	_ = profileSwitchBorder("a", "b", "c")
 	_ = profileSwitchTableLine("org", "status")
 	_ = profileSwitchStyledTableLine("org", "status", profileSwitchNormalRowStyle())
@@ -2116,9 +2149,9 @@ func TestCrossPlatformCoverageProfileCommandAndModelCoverage(t *testing.T) {
 	_ = profileSwitchTitleStyle()
 	_ = profileSwitchMutedStyle()
 
-	writeProfileListTable(io.Discard, nil)
-	writeProfileListTable(io.Discard, cfg)
-	if err := writeProfileListJSON(io.Discard, cfg); err != nil || writeProfileUseJSON(io.Discard, nil, nil) != nil || writeProfileUseJSON(io.Discard, &cfg.Profiles[0], cfg) != nil {
+	writeProfileListTable(io.Discard, "", nil)
+	writeProfileListTable(io.Discard, "", cfg)
+	if err := writeProfileListJSON(io.Discard, "", cfg); err != nil || writeProfileUseJSON(io.Discard, nil, nil) != nil || writeProfileUseJSON(io.Discard, &cfg.Profiles[0], cfg) != nil {
 		t.Fatal("profile JSON write failed")
 	}
 	_ = profileUseMessage(nil)
@@ -2126,8 +2159,8 @@ func TestCrossPlatformCoverageProfileCommandAndModelCoverage(t *testing.T) {
 		_ = profileUseMessage(&p)
 		_ = profileOrgName(p)
 	}
-	_ = profileViews(nil)
-	_ = profileViews(cfg)
+	_ = profileViews("", nil)
+	_ = profileViews("", cfg)
 	for _, limit := range []int{0, 2, 5, 40} {
 		_ = clipProfileCell("abcdefgh", limit)
 		_ = clipProfileDisplayCell("中文abcdefgh", limit)

internal/app/coverage_more_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -164,7 +165,7 @@ func TestCrossPlatformCoverageRawAPIAndTokenCoverage(t *testing.T) {
 	}
 	newAccessTokenProvider = func(string) accessTokenGetter { return fakeAccessTokenGetter{} }
 	missing := t.TempDir()
-	if got, err := resolveAccessTokenFromDir(context.Background(), missing); err != nil || got != "" {
+	if got, err := resolveAccessTokenFromDir(context.Background(), missing); got != "" || !errors.Is(err, authpkg.ErrTokenDataNotFound) {
 		t.Fatalf("missing access token = %q, %v", got, err)
 	}
 	if _, err := ResolveAuxiliaryAccessToken(context.Background(), missing, ""); err == nil {

internal/app/event_command.go

@@ -56,6 +56,7 @@ var (
 	eventNewEventSource        = newEventSource
 	eventNewDingtalkSource     = source.New
 	eventResolveAccessToken    = ResolveAuxiliaryAccessToken
+	eventForceRefreshRejected  = forceRefreshRejectedAccessToken
 	eventBusRun                = bus.Run
 	eventReadyFDFromEnv        = busctl.ReadyFDFromEnv
 	eventResolvePersonal       = resolvePersonalEventIdentity
@@ -111,6 +112,7 @@ func newEventConsumeCommand() *cobra.Command {
 		dryRun       bool
 		foreground   bool
 		asIdentity   string
+		flatten      bool
 		personalOpts personalConsumeOptions
 		streamOpts   eventStreamTicketOptions
 	)
@@ -126,7 +128,11 @@ func newEventConsumeCommand() *cobra.Command {
   json            每事件多行美化 JSON（必须配 --max-events 或 --duration）
   pretty          同 json，未来加颜色
   raw             仅 SDK 原始 payload，无外层封装
-  compact         扁平化 + 解析嵌套 + 抽取语义字段（Agent 友好）
+  compact         单行紧凑 JSON；不传 --flatten 时沿用原 compact processor
+
+数据结构：
+  ndjson/json/pretty 默认保持 transport envelope（type/event_type/data/headers）
+  --flatten          结构化格式输出稳定的顶层业务字段，适合 Agent / 脚本直接消费
 
 默认使用当前 OAuth 登录态自动创建/复用个人订阅并建立个人长连接；非默认组织加
 --profile。连上后 stderr 打就绪行 [event] ready，等它出现再读 stdout；停机用
@@ -143,6 +149,7 @@ SIGTERM、关 stdin，或先用 dws event stop <subscribe_id> --dry-run 预览
 			}
 			if as == "user" {
 				personalOpts.EventKey = firstArg(args)
+				personalOpts.Flatten = flatten
 				personalOpts.Common = commonConsumeOptions{
 					EventTypes: eventTypes,
 					Filter:     filter,
@@ -166,6 +173,7 @@ SIGTERM、关 stdin，或先用 dws event stop <subscribe_id> --dry-run 预览
 				return fmt.Errorf("event consume: --debug-raw-events is only supported with --as user")
 			}
 			if err := rejectChangedFlags(c, "user",
+				"flatten",
 				"subscribe-id",
 				"rule",
 				"name",
@@ -174,6 +182,7 @@ SIGTERM、关 stdin，或先用 dws event stop <subscribe_id> --dry-run 预览
 				"ttl",
 				"ephemeral",
 				"user",
+				"open-dingtalk-id",
 				"group",
 				"personal-event-base-url",
 			); err != nil {
@@ -278,6 +287,8 @@ SIGTERM、关 stdin，或先用 dws event stop <subscribe_id> --dry-run 预览
 		"提示 bus 客户端期望 compact 渲染（语义透传，bus 仍按原 payload 投递）")
 	f.StringVarP(&formatRaw, "format", "f", "ndjson",
 		"输出格式 (ndjson/json/pretty/raw/compact)；事件流默认 ndjson")
+	f.BoolVar(&flatten, "flatten", false,
+		"将个人事件 transport envelope 投影为稳定的顶层业务字段")
 	f.StringVar(&outputDir, "output-dir", "",
 		"每事件写一个文件到该目录 ({type}_{id}_{ts}.json)；与 stdout 互斥")
 	f.StringArrayVar(&routesRaw, "route", nil,
@@ -312,7 +323,9 @@ SIGTERM、关 stdin，或先用 dws event stop <subscribe_id> --dry-run 预览
 			"或从外部先用 dws event stop <subscribe_id> --dry-run 预览、确认后加 --yes（会一并退订）；"+
 			"请勿 kill -9（会跳过退订、泄漏服务端订阅）")
 	f.StringVar(&personalOpts.UserID, "user", "",
-		"个人单聊对端 userId")
+		"单聊对端或指定发送人的 userId（与 --open-dingtalk-id 二选一）")
+	f.StringVar(&personalOpts.OpenDingTalkID, "open-dingtalk-id", "",
+		"单聊对端或指定发送人的 openDingtalkId（与 --user 二选一）")
 	f.StringVar(&personalOpts.GroupID, "group", "",
 		"group 规则：openConversationId")
 	f.StringVar(&personalOpts.ControlBaseURL, "personal-event-base-url", "",
@@ -410,7 +423,7 @@ func eventStreamBusID(streamOpts eventStreamTicketOptions) string {
 	return "portal-ticket-normal:" + sourceID
 }
 
-func newEventSource(ctx context.Context, configDir, clientID, clientSecret string, streamOpts eventStreamTicketOptions) (*source.DingtalkSource, error) {
+func newEventSource(_ context.Context, configDir, clientID, clientSecret string, streamOpts eventStreamTicketOptions) (*source.DingtalkSource, error) {
 	if !streamOpts.enabled() {
 		return eventNewDingtalkSource(source.Config{
 			ClientID:     clientID,
@@ -418,14 +431,6 @@ func newEventSource(ctx context.Context, configDir, clientID, clientSecret strin
 		})
 	}
 
-	token, err := eventResolveAccessToken(ctx, configDir, "")
-	if err != nil {
-		return nil, fmt.Errorf("event stream ticket: resolve user token: %w", err)
-	}
-	if strings.TrimSpace(token) == "" {
-		return nil, errors.New("event stream ticket: empty user token")
-	}
-
 	portalClientID := clientID
 	portalClientSecret := clientSecret
 	if streamOpts.usesPortalNormalMode() {
@@ -437,8 +442,13 @@ func newEventSource(ctx context.Context, configDir, clientID, clientSecret strin
 		ClientID:     portalClientID,
 		ClientSecret: portalClientSecret,
 		PortalTicket: &source.PortalTicketConfig{
-			TicketURL:    eventStreamTicketURL(streamOpts.TicketURL),
-			AccessToken:  token,
+			TicketURL: eventStreamTicketURL(streamOpts.TicketURL),
+			AccessTokenProvider: func(ctx context.Context) (string, error) {
+				return eventResolveAccessToken(ctx, configDir, "")
+			},
+			ForceRefreshToken: func(ctx context.Context, rejectedToken string) (string, error) {
+				return eventForceRefreshRejected(ctx, configDir, rejectedToken)
+			},
 			SourceID:     eventStreamSourceID(streamOpts.SourceID),
 			Mode:         streamOpts.Mode,
 			ClientID:     portalClientID,

internal/app/event_command_full_coverage_test.go

@@ -132,14 +132,18 @@ func TestCrossPlatformCoverageEventSourcesAndForegroundCoverage(t *testing.T) {
 	if _, err := newEventSource(context.Background(), "config", "client", "secret", eventStreamTicketOptions{}); err != nil {
 		t.Fatal(err)
 	}
-	eventResolveAccessToken = func(context.Context, string, string) (string, error) { return "", fail }
 	stream := eventStreamTicketOptions{Mode: "custom"}
-	if _, err := newEventSource(context.Background(), "config", "client", "secret", stream); !errors.Is(err, fail) {
-		t.Fatalf("stream token error = %v", err)
+	var captured source.Config
+	eventNewDingtalkSource = func(cfg source.Config, _ ...source.SourceOption) (*source.DingtalkSource, error) {
+		captured = cfg
+		return &source.DingtalkSource{}, nil
 	}
-	eventResolveAccessToken = func(context.Context, string, string) (string, error) { return " ", nil }
-	if _, err := newEventSource(context.Background(), "config", "client", "secret", stream); err == nil {
-		t.Fatal("empty stream token succeeded")
+	eventResolveAccessToken = func(context.Context, string, string) (string, error) { return "", fail }
+	if _, err := newEventSource(context.Background(), "config", "client", "secret", stream); err != nil {
+		t.Fatalf("stream source construction = %v", err)
+	}
+	if _, err := captured.PortalTicket.AccessTokenProvider(context.Background()); !errors.Is(err, fail) {
+		t.Fatalf("stream token provider error = %v", err)
 	}
 	eventResolveAccessToken = func(context.Context, string, string) (string, error) { return "token", nil }
 	for _, mode := range []string{"custom", "normal"} {

internal/app/event_force_refresh_wire_test.go

@@ -0,0 +1,47 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/source"
+)
+
+// TestCrossPlatformCoverageNewEventSourceWiresForceRefreshRejectedToken asserts the portal ticket
+// source receives a ForceRefreshToken callback that forwards the actual
+// rejected token into the app-level compare-and-refresh chain.
+func TestCrossPlatformCoverageNewEventSourceWiresForceRefreshRejectedToken(t *testing.T) {
+	oldNew, oldRefresh := eventNewDingtalkSource, eventForceRefreshRejected
+	t.Cleanup(func() { eventNewDingtalkSource, eventForceRefreshRejected = oldNew, oldRefresh })
+
+	var captured source.Config
+	eventNewDingtalkSource = func(cfg source.Config, _ ...source.SourceOption) (*source.DingtalkSource, error) {
+		captured = cfg
+		return &source.DingtalkSource{}, nil
+	}
+	var gotDir, gotRejected string
+	eventForceRefreshRejected = func(_ context.Context, configDir, rejectedToken string) (string, error) {
+		gotDir, gotRejected = configDir, rejectedToken
+		return "fresh", nil
+	}
+	if _, err := newEventSource(context.Background(), "config-dir", "client", "secret", eventStreamTicketOptions{Mode: "custom"}); err != nil {
+		t.Fatal(err)
+	}
+	if captured.PortalTicket == nil || captured.PortalTicket.ForceRefreshToken == nil {
+		t.Fatal("ForceRefreshToken not wired into portal ticket config")
+	}
+	tok, err := captured.PortalTicket.ForceRefreshToken(context.Background(), "rejected-token")
+	if err != nil || tok != "fresh" {
+		t.Fatalf("force refresh = %q, %v", tok, err)
+	}
+	if gotDir != "config-dir" || gotRejected != "rejected-token" {
+		t.Fatalf("wiring passed dir %q rejected %q", gotDir, gotRejected)
+	}
+
+	fail := errors.New("refresh failed")
+	eventForceRefreshRejected = func(context.Context, string, string) (string, error) { return "", fail }
+	if _, err := captured.PortalTicket.ForceRefreshToken(context.Background(), "x"); !errors.Is(err, fail) {
+		t.Fatalf("refresh error = %v", err)
+	}
+}

internal/app/event_personal_command.go

@@ -37,6 +37,7 @@ import (
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/consume"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/source"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 	"github.com/spf13/cobra"
@@ -60,6 +61,7 @@ type commonConsumeOptions struct {
 type personalConsumeOptions struct {
 	Common           commonConsumeOptions
 	EventKey         string
+	Flatten          bool
 	DebugRawEvents   bool
 	SubscribeID      string
 	Rule             string
@@ -69,6 +71,7 @@ type personalConsumeOptions struct {
 	TTL              time.Duration
 	Ephemeral        bool
 	UserID           string
+	OpenDingTalkID   string
 	GroupID          string
 	ControlBaseURL   string
 	StreamTicketMode string
@@ -129,6 +132,7 @@ var (
 	personalFindProcess                 = os.FindProcess
 	personalSignalProcess               = (*os.Process).Signal
 	personalResolveAuxiliaryAccessToken = ResolveAuxiliaryAccessToken
+	personalForceRefreshRejectedToken   = forceRefreshRejectedAccessToken
 	personalLoadTokenData               = authpkg.LoadTokenData
 	personalClientID                    = authpkg.ClientID
 	personalResolveAppCredentialsStrict = authpkg.ResolveAppCredentialsStrict
@@ -137,6 +141,7 @@ var (
 func newEventSchemaCommand() *cobra.Command {
 	var asIdentity string
 	var formatRaw string
+	var flatten bool
 	cmd := &cobra.Command{
 		Use:               "schema <event_key>",
 		Short:             "显示事件 schema",
@@ -154,11 +159,12 @@ func newEventSchemaCommand() *cobra.Command {
 			if !def.Public {
 				return personal.PublicAvailabilityError(args[0])
 			}
-			return renderPersonalSchema(c.OutOrStdout(), def, formatRaw)
+			return renderPersonalSchema(c.OutOrStdout(), def, formatRaw, flatten)
 		},
 	}
 	cmd.Flags().StringVar(&asIdentity, "as", "user", "事件身份: user")
 	cmd.Flags().StringVarP(&formatRaw, "format", "f", "json", "输出格式: json")
+	cmd.Flags().BoolVar(&flatten, "flatten", false, "显示 --flatten 消费模式对应的顶层业务字段 schema")
 	hideEventInternalFlags(cmd, "as")
 	cli.AnnotateRuntimePositionals(cmd, cli.RuntimeSchemaPositional{
 		Name:        "event_key",
@@ -186,7 +192,7 @@ func runPersonalEventList(c *cobra.Command, opts personalListOptions) error {
 	return tw.Flush()
 }
 
-func renderPersonalSchema(w io.Writer, def personal.Definition, format string) error {
+func renderPersonalSchema(w io.Writer, def personal.Definition, format string, flatten bool) error {
 	format = strings.ToLower(strings.TrimSpace(format))
 	if format == "" {
 		format = "json"
@@ -196,7 +202,7 @@ func renderPersonalSchema(w io.Writer, def personal.Definition, format string) e
 	}
 	enc := json.NewEncoder(w)
 	enc.SetIndent("", "  ")
-	return enc.Encode(personal.BuildSchemaDocument(def))
+	return enc.Encode(personal.BuildSchemaDocumentForMode(def, flatten))
 }
 
 func runPersonalEventConsume(c *cobra.Command, opts personalConsumeOptions) error {
@@ -204,20 +210,6 @@ func runPersonalEventConsume(c *cobra.Command, opts personalConsumeOptions) erro
 	if err := ensurePublicPersonalEvent(opts.EventKey); err != nil {
 		return err
 	}
-	configDir := defaultConfigDir()
-	identity, err := personalResolveEventIdentity(ctx, configDir, opts.StreamSourceID)
-	if err != nil {
-		return fmt.Errorf("event consume --as user: %w", err)
-	}
-	identityHash := dwsevent.IdentityHash(identity.Key())
-	editionName := editionNameOrDefault()
-	workDir := eventWorkDir(configDir, editionName, dwsevent.SourceKindPersonalStream, identityHash)
-	ipcEndpoint := defaultIPCEndpoint(workDir, editionName, dwsevent.SourceKindPersonalStream, identityHash)
-
-	routes, err := consume.ParseRoutes(opts.Common.RoutesRaw)
-	if err != nil {
-		return fmt.Errorf("event consume --as user: %w", err)
-	}
 	rawFormat := ""
 	if f := c.Flags().Lookup("format"); f != nil && f.Changed {
 		rawFormat = opts.Common.FormatRaw
@@ -226,20 +218,46 @@ func runPersonalEventConsume(c *cobra.Command, opts personalConsumeOptions) erro
 	if fellback && !opts.Common.Quiet {
 		fmt.Fprintf(c.ErrOrStderr(), "WARN: --format %q has no meaning for event stream; using ndjson\n", rawFormat)
 	}
+	if err := validatePersonalEventOutputMode(opts.Flatten, opts.DebugRawEvents, normalised); err != nil {
+		return fmt.Errorf("event consume --as user: %w", err)
+	}
+	projector := personalEventProjector(opts.DebugRawEvents, opts.Flatten)
 
+	configDir := defaultConfigDir()
+	identity, err := personalResolveEventIdentity(ctx, configDir, opts.StreamSourceID)
+	if err != nil {
+		return fmt.Errorf("event consume --as user: %w", err)
+	}
+	identityHash := dwsevent.IdentityHash(identity.Key())
+	editionName := editionNameOrDefault()
+	workDir := eventWorkDir(configDir, editionName, dwsevent.SourceKindPersonalStream, identityHash)
+	ipcEndpoint := defaultIPCEndpoint(workDir, editionName, dwsevent.SourceKindPersonalStream, identityHash)
+	spawnProfileSelector := personalBusProfileSelector(configDir, identity)
+
+	routes, err := consume.ParseRoutes(opts.Common.RoutesRaw)
+	if err != nil {
+		return fmt.Errorf("event consume --as user: %w", err)
+	}
 	if opts.Common.DryRun {
+		if strings.TrimSpace(opts.SubscribeID) == "" {
+			if err := validatePersonalSubscriptionOptions(opts); err != nil {
+				return fmt.Errorf("event consume --as user: %w", err)
+			}
+		}
 		cfg := consume.Config{
 			WorkDir:        workDir,
 			IPCEndpoint:    ipcEndpoint,
 			ClientID:       identity.ClientID,
-			SpawnExtraArgs: personalBusSpawnArgs(identity, opts.StreamTicketMode, personalEventStreamTicketURL(opts.StreamTicketURL, configDir)),
+			SpawnExtraArgs: personalBusSpawnArgs(identity, opts.StreamTicketMode, personalEventStreamTicketURL(opts.StreamTicketURL, configDir), spawnProfileSelector),
 			Compact:        opts.Common.Compact,
 			MaxEvents:      opts.Common.MaxEvents,
 			Duration:       opts.Common.Duration,
 			EventKey:       opts.EventKey,
 			Format:         normalised,
+			Flatten:        opts.Flatten,
 			OutputDir:      opts.Common.OutputDir,
 			Routes:         routes,
+			Projector:      projector,
 			Stderr:         c.ErrOrStderr(),
 			Quiet:          opts.Common.Quiet,
 			Foreground:     opts.Common.Foreground,
@@ -250,7 +268,7 @@ func runPersonalEventConsume(c *cobra.Command, opts personalConsumeOptions) erro
 		return personalConsumeRun(ctx, cfg)
 	}
 
-	client := personal.NewClient(personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity)
+	client := newPersonalEventControlClient(configDir, personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity)
 	sub, eventKey, ruleType, err := personalEnsureSubscription(ctx, client, identity, opts)
 	if err != nil {
 		return fmt.Errorf("event consume --as user: %w", err)
@@ -272,8 +290,8 @@ func runPersonalEventConsume(c *cobra.Command, opts personalConsumeOptions) erro
 		_ = personalDeleteSubscription(client, context.Background(), sub.SubscribeID)
 		_ = personalRemoveRunStates(workDir, []string{sub.SubscribeID})
 	}
-	// Ownership-based cleanup (AI-subprocess contract, aligned with
-	// lark-cli): a subscription this run CREATED is unsubscribed on exit
+	// Ownership-based cleanup: a subscription this run CREATED is
+	// unsubscribed on exit
 	// (any exit — SIGTERM / stdin-EOF / limit / timeout / error), so nothing
 	// leaks server-side. A subscription REUSED via --subscribe-id is left
 	// intact — the caller owns its lifecycle. --ephemeral forces cleanup
@@ -284,22 +302,25 @@ func runPersonalEventConsume(c *cobra.Command, opts personalConsumeOptions) erro
 	}
 
 	cfg := consume.Config{
-		WorkDir:        workDir,
-		IPCEndpoint:    ipcEndpoint,
-		ClientID:       identity.ClientID,
-		SpawnExtraArgs: personalBusSpawnArgs(identity, opts.StreamTicketMode, opts.StreamTicketURL),
-		Compact:        opts.Common.Compact,
-		MaxEvents:      opts.Common.MaxEvents,
-		Duration:       opts.Common.Duration,
-		EventKey:       eventKey,
-		Format:         normalised,
-		OutputDir:      opts.Common.OutputDir,
-		Routes:         routes,
-		Stdout:         c.OutOrStdout(),
-		Stderr:         c.ErrOrStderr(),
-		Quiet:          opts.Common.Quiet,
-		Foreground:     opts.Common.Foreground,
-		Force:          opts.Common.Force,
+		WorkDir:          workDir,
+		IPCEndpoint:      ipcEndpoint,
+		ClientID:         identity.ClientID,
+		SpawnExtraArgs:   personalBusSpawnArgs(identity, opts.StreamTicketMode, opts.StreamTicketURL, spawnProfileSelector),
+		Compact:          opts.Common.Compact,
+		MaxEvents:        opts.Common.MaxEvents,
+		Duration:         opts.Common.Duration,
+		EventKey:         eventKey,
+		Format:           normalised,
+		Flatten:          opts.Flatten,
+		OutputDir:        opts.Common.OutputDir,
+		Routes:           routes,
+		Projector:        projector,
+		ReadySubscribeID: sub.SubscribeID,
+		Stdout:           c.OutOrStdout(),
+		Stderr:           c.ErrOrStderr(),
+		Quiet:            opts.Common.Quiet,
+		Foreground:       opts.Common.Foreground,
+		Force:            opts.Common.Force,
 	}
 	// Arm the stdin-EOF shutdown watcher only for a pipe-style, unbounded
 	// run (see shouldWatchStdinEOF).
@@ -354,6 +375,29 @@ func runPersonalEventConsume(c *cobra.Command, opts personalConsumeOptions) erro
 	return err
 }
 
+func personalEventProjector(debugRawEvents, flatten bool) consume.Projector {
+	if debugRawEvents {
+		return func(ev transport.Event) (any, error) { return ev, nil }
+	}
+	if flatten {
+		return personal.ProjectOutput
+	}
+	return nil
+}
+
+func validatePersonalEventOutputMode(flatten, debugRawEvents bool, format consume.Format) error {
+	if !flatten {
+		return nil
+	}
+	if debugRawEvents {
+		return fmt.Errorf("--flatten and --debug-raw-events are mutually exclusive")
+	}
+	if format == consume.FormatRaw {
+		return fmt.Errorf("--flatten and --format raw are mutually exclusive")
+	}
+	return nil
+}
+
 func applyPersonalConsumeFilters(cfg *consume.Config, opts personalConsumeOptions, subscribeID, eventKey string) {
 	if cfg == nil {
 		return
@@ -369,6 +413,19 @@ func applyPersonalConsumeFilters(cfg *consume.Config, opts personalConsumeOption
 	cfg.SubscribeID = strings.TrimSpace(subscribeID)
 }
 
+func validatePersonalSubscriptionOptions(opts personalConsumeOptions) error {
+	if _, _, err := personal.BuildRuleParam(opts.EventKey, personal.RuleOptions{
+		RuleType:       opts.Rule,
+		UserID:         opts.UserID,
+		OpenDingTalkID: opts.OpenDingTalkID,
+		GroupID:        opts.GroupID,
+	}); err != nil {
+		return err
+	}
+	_, _, err := personal.BuildFilter(opts.FilterJSON, opts.QueryCSV)
+	return err
+}
+
 func ensurePersonalSubscription(ctx context.Context, client *personal.Client, identity personal.Identity, opts personalConsumeOptions) (*personal.Subscription, string, string, error) {
 	if strings.TrimSpace(opts.SubscribeID) != "" {
 		sub, err := personalGetSubscription(client, ctx, opts.SubscribeID)
@@ -398,9 +455,10 @@ func ensurePersonalSubscription(ctx context.Context, client *personal.Client, id
 		return nil, "", "", err
 	}
 	ruleType, ruleParam, err := personal.BuildRuleParam(opts.EventKey, personal.RuleOptions{
-		RuleType: opts.Rule,
-		UserID:   opts.UserID,
-		GroupID:  opts.GroupID,
+		RuleType:       opts.Rule,
+		UserID:         opts.UserID,
+		OpenDingTalkID: opts.OpenDingTalkID,
+		GroupID:        opts.GroupID,
 	})
 	if err != nil {
 		return nil, "", "", err
@@ -466,7 +524,7 @@ func runPersonalEventStatus(c *cobra.Command, opts personalStatusOptions) error
 	if status == "" || status == "all" {
 		status = ""
 	}
-	subs, err := personalListSubscriptions(personal.NewClient(personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity), ctx, personal.ListOptions{
+	subs, err := personalListSubscriptions(newPersonalEventControlClient(configDir, personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity), ctx, personal.ListOptions{
 		Status:      status,
 		EventKey:    opts.EventKey,
 		SubscribeID: opts.SubscribeID,
@@ -581,7 +639,7 @@ func runPersonalEventStop(c *cobra.Command, opts personalStopOptions) error {
 	if err != nil {
 		return fmt.Errorf("event stop --as user: %w", err)
 	}
-	client := personal.NewClient(personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity)
+	client := newPersonalEventControlClient(configDir, personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity)
 	for _, id := range subscribeIDs {
 		if err := personalDeleteSubscription(client, ctx, id); err != nil {
 			return fmt.Errorf("event stop --as user: cancel subscription %s: %w", id, err)
@@ -691,7 +749,10 @@ func resolvePersonalEventIdentity(ctx context.Context, configDir string, sourceI
 	if err != nil {
 		return personal.Identity{}, err
 	}
-	tokenData, _ := personalLoadTokenData(configDir)
+	tokenData, err := personalLoadTokenData(configDir)
+	if err != nil && !errors.Is(err, authpkg.ErrTokenDataNotFound) {
+		return personal.Identity{}, fmt.Errorf("load OAuth identity metadata: %w", err)
+	}
 	var corpID, userID, clientID, refreshToken string
 	if tokenData != nil {
 		corpID = tokenData.CorpID
@@ -737,6 +798,15 @@ func resolvePersonalEventIdentity(ctx context.Context, configDir string, sourceI
 	}, nil
 }
 
+func newPersonalEventControlClient(configDir, baseURL string, identity personal.Identity) *personal.Client {
+	identity.AccessToken = ""
+	client := personal.NewClient(baseURL, identity)
+	client.AccessTokenProvider = func(ctx context.Context) (string, error) {
+		return personalResolveAuxiliaryAccessToken(ctx, configDir, "")
+	}
+	return client
+}
+
 func personalTokenSubject(kind, token string) string {
 	token = strings.TrimSpace(token)
 	if token == "" {
@@ -785,7 +855,12 @@ func newPersonalStreamSource(ctx context.Context, opts personalStreamSourceOptio
 	}
 	_ = ctx
 	return source.NewPersonal(source.PersonalConfig{
-		AccessToken:  opts.Identity.AccessToken,
+		AccessTokenProvider: func(ctx context.Context) (string, error) {
+			return personalResolveAuxiliaryAccessToken(ctx, opts.ConfigDir, "")
+		},
+		ForceRefreshToken: func(ctx context.Context, rejectedToken string) (string, error) {
+			return personalForceRefreshRejectedToken(ctx, opts.ConfigDir, rejectedToken)
+		},
 		ClientID:     clientID,
 		ClientSecret: clientSecret,
 		SourceID:     opts.Identity.SourceID,
@@ -795,20 +870,57 @@ func newPersonalStreamSource(ctx context.Context, opts personalStreamSourceOptio
 	})
 }
 
-func personalBusSpawnArgs(identity personal.Identity, ticketMode, ticketURL string) []string {
+func personalBusProfileSelector(configDir string, identity personal.Identity) string {
+	// The parent already resolved and loaded this selector. Preserve it before
+	// consulting identity metadata: personal event discovery can fill an empty
+	// token userId from runtime defaults, and that inferred value must not turn a
+	// historical unresolved account into a different exact same-corp account in
+	// the detached child.
+	if selector := strings.TrimSpace(authpkg.RuntimeProfile()); selector != "" {
+		return selector
+	}
+	if cfg, err := authpkg.LoadProfiles(configDir); err == nil && cfg != nil {
+		// With no explicit process-local override, LoadTokenData selected the
+		// persisted current profile. Prefer that selection over the enriched
+		// identity: $currentUserId may describe an exact same-corp account even
+		// though the token came from the historical unresolved profile.
+		currentSelector := strings.TrimSpace(cfg.CurrentProfile)
+		for i := range cfg.Profiles {
+			profile := cfg.Profiles[i]
+			selector := authpkg.ProfileSelectionSelector(profile, cfg)
+			if selector == currentSelector &&
+				(strings.TrimSpace(identity.CorpID) == "" || strings.TrimSpace(profile.CorpID) == strings.TrimSpace(identity.CorpID)) {
+				return selector
+			}
+		}
+		for i := range cfg.Profiles {
+			profile := cfg.Profiles[i]
+			if strings.TrimSpace(profile.CorpID) == strings.TrimSpace(identity.CorpID) &&
+				strings.TrimSpace(profile.UserID) == strings.TrimSpace(identity.UserID) {
+				return authpkg.ProfileSelectionSelector(profile, cfg)
+			}
+		}
+	}
+	return authpkg.ProfileSelector(authpkg.Profile{
+		CorpID: identity.CorpID,
+		UserID: identity.UserID,
+	})
+}
+
+func personalBusSpawnArgs(identity personal.Identity, ticketMode, ticketURL string, profileSelectors ...string) []string {
 	args := []string{
 		"--source-kind", string(dwsevent.SourceKindPersonalStream),
 		"--stream-source-id", identity.SourceID,
 	}
-	// Forward the organization so the detached _bus child resolves
-	// credentials for the SAME profile the parent used. Without this the
-	// child falls back to the default profile's token slot and fails to
-	// authenticate the personal stream for a non-default `--profile`
-	// (symptom: "bus child reported startup failure on ready pipe", no
-	// bus.log). --profile accepts a corpId; the root pre-parses it into the
-	// runtime profile before the _bus handler resolves the identity.
+	// Forward the exact account so the detached _bus child resolves the same
+	// credentials as the parent, including when one organization has multiple
+	// logged-in users.
 	if cid := strings.TrimSpace(identity.CorpID); cid != "" {
-		args = append(args, "--profile", cid)
+		profileSelector := authpkg.ProfileSelector(authpkg.Profile{CorpID: identity.CorpID, UserID: identity.UserID})
+		if len(profileSelectors) > 0 && strings.TrimSpace(profileSelectors[0]) != "" {
+			profileSelector = strings.TrimSpace(profileSelectors[0])
+		}
+		args = append(args, "--profile", profileSelector)
 	}
 	if strings.TrimSpace(ticketMode) != "" {
 		args = append(args, "--stream-ticket-mode", ticketMode)

internal/app/event_personal_debug_test.go

@@ -19,10 +19,12 @@ import (
 
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/consume"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
+	"github.com/spf13/cobra"
 )
 
 func TestApplyPersonalConsumeFiltersDebugRawEvents(t *testing.T) {
-	cfg := consume.Config{}
+	cfg := consume.Config{EventKey: personal.EventSingleChat, ReadySubscribeID: "sub-1"}
 	opts := personalConsumeOptions{
 		DebugRawEvents: true,
 		Common: commonConsumeOptions{
@@ -34,6 +36,9 @@ func TestApplyPersonalConsumeFiltersDebugRawEvents(t *testing.T) {
 	if cfg.EventTypes != nil || cfg.Filter != "" || cfg.SubscribeID != "" {
 		t.Fatalf("raw debug filters = eventTypes=%#v filter=%q subscribeID=%q, want catch-all", cfg.EventTypes, cfg.Filter, cfg.SubscribeID)
 	}
+	if cfg.EventKey != personal.EventSingleChat || cfg.ReadySubscribeID != "sub-1" {
+		t.Fatalf("raw debug cleared ready identity: eventKey=%q subscribeID=%q", cfg.EventKey, cfg.ReadySubscribeID)
+	}
 }
 
 func TestApplyPersonalConsumeFiltersDefault(t *testing.T) {
@@ -48,6 +53,94 @@ func TestApplyPersonalConsumeFiltersDefault(t *testing.T) {
 	}
 }
 
+func TestPersonalEventProjectorSelectsExplicitModes(t *testing.T) {
+	if personalEventProjector(false, false) != nil {
+		t.Fatal("default personal consume should preserve transport envelope")
+	}
+	if personalEventProjector(false, true) == nil {
+		t.Fatal("flatten personal consume projector = nil")
+	}
+	projector := personalEventProjector(true, false)
+	if projector == nil {
+		t.Fatal("debug raw personal consume projector = nil")
+	}
+	ev := transport.Event{
+		EventID: "raw-event",
+		Data:    `{"payload":{"uid":100001,"bizid":"internal-bizid"}}`,
+		Headers: map[string]string{"TOPIC": "raw"},
+	}
+	projected, err := projector(ev)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, ok := projected.(transport.Event); !ok || got.EventID != ev.EventID || got.Data != ev.Data || got.Headers["TOPIC"] != "raw" {
+		t.Fatalf("debug raw projection = %#v", projected)
+	}
+}
+
+func TestEventConsumeFlattenRejectsRawModesBeforeIdentityResolution(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		args []string
+		want string
+	}{
+		{
+			name: "raw format",
+			args: []string{personal.EventMention, "--flatten", "--format", "raw"},
+			want: "--flatten and --format raw are mutually exclusive",
+		},
+		{
+			name: "raw debug",
+			args: []string{personal.EventMention, "--flatten", "--debug-raw-events"},
+			want: "--flatten and --debug-raw-events are mutually exclusive",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv("DWS_CONFIG_DIR", t.TempDir())
+			cmd := newEventConsumeCommand()
+			cmd.SilenceUsage = true
+			cmd.SilenceErrors = true
+			cmd.SetArgs(tc.args)
+			err := cmd.Execute()
+			if err == nil || !strings.Contains(err.Error(), tc.want) {
+				t.Fatalf("Execute() error = %v, want %q", err, tc.want)
+			}
+			if strings.Contains(err.Error(), "login") || strings.Contains(err.Error(), "token") {
+				t.Fatalf("output-mode validation ran after identity resolution: %v", err)
+			}
+		})
+	}
+}
+
+func TestValidatePersonalEventOutputModeAllowsFlattenStructuredFormats(t *testing.T) {
+	for _, format := range []consume.Format{consume.FormatNDJSON, consume.FormatJSON, consume.FormatPretty, consume.FormatCompact} {
+		if err := validatePersonalEventOutputMode(true, false, format); err != nil {
+			t.Fatalf("validatePersonalEventOutputMode(true, false, %q) error = %v", format, err)
+		}
+	}
+}
+
+func TestEventConsumeFlattenFlagIsForwarded(t *testing.T) {
+	oldRun := eventRunPersonalConsume
+	t.Cleanup(func() { eventRunPersonalConsume = oldRun })
+
+	var got personalConsumeOptions
+	eventRunPersonalConsume = func(_ *cobra.Command, opts personalConsumeOptions) error {
+		got = opts
+		return nil
+	}
+	cmd := newEventConsumeCommand()
+	cmd.SilenceUsage = true
+	cmd.SilenceErrors = true
+	cmd.SetArgs([]string{personal.EventMention, "--flatten", "--format", "compact"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	if !got.Flatten || got.Common.FormatRaw != "compact" {
+		t.Fatalf("forwarded options = %#v", got)
+	}
+}
+
 func TestEventConsumeDebugRawEventsRequiresUserMode(t *testing.T) {
 	cmd := newEventConsumeCommand()
 	cmd.SilenceUsage = true
@@ -72,7 +165,7 @@ func TestEventConsumeAsAppRejectedBeforeEventKeyValidation(t *testing.T) {
 
 func TestEventConsumePersonalParamSpecFlags(t *testing.T) {
 	cmd := newEventConsumeCommand()
-	for _, name := range []string{"user", "group", "query"} {
+	for _, name := range []string{"user", "open-dingtalk-id", "group", "query"} {
 		if cmd.Flags().Lookup(name) == nil {
 			t.Fatalf("flag --%s is not registered", name)
 		}
@@ -84,6 +177,7 @@ func TestEventConsumePersonalParamSpecFlags(t *testing.T) {
 		"sender-union-id",
 		"open-conversation-id",
 		"keyword",
+		"odid",
 	} {
 		if cmd.Flags().Lookup(name) != nil {
 			t.Fatalf("retired flag --%s is still registered", name)
@@ -99,6 +193,7 @@ func TestEventConsumeRetiredPersonalFlagsAreUnknown(t *testing.T) {
 		"sender-union-id",
 		"open-conversation-id",
 		"keyword",
+		"odid",
 	} {
 		t.Run(name, func(t *testing.T) {
 			cmd := newEventConsumeCommand()
@@ -115,7 +210,8 @@ func TestEventConsumeRetiredPersonalFlagsAreUnknown(t *testing.T) {
 
 func TestEventConsumeAsAppRejectedBeforePersonalParamSpecFlags(t *testing.T) {
 	for _, args := range [][]string{
-		{"--as", "app", "--user", "507971"},
+		{"--as", "app", "--user", "test-user-001"},
+		{"--as", "app", "--open-dingtalk-id", "open-user-1"},
 		{"--as", "app", "--group", "cid"},
 		{"--as", "app", "--query", "报警"},
 	} {

internal/app/event_personal_force_refresh_wire_test.go

@@ -0,0 +1,54 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	dwsevent "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
+)
+
+// TestCrossPlatformCoverageNewPersonalStreamSourceWiresForceRefreshRejectedToken asserts the
+// personal stream source receives a ForceRefreshToken callback that forwards
+// the rejected token into the app-level compare-and-refresh chain.
+func TestCrossPlatformCoverageNewPersonalStreamSourceWiresForceRefreshRejectedToken(t *testing.T) {
+	oldAux := personalResolveAuxiliaryAccessToken
+	oldRefresh := personalForceRefreshRejectedToken
+	t.Cleanup(func() {
+		personalResolveAuxiliaryAccessToken = oldAux
+		personalForceRefreshRejectedToken = oldRefresh
+	})
+	personalResolveAuxiliaryAccessToken = func(context.Context, string, string) (string, error) {
+		return "old-token", nil
+	}
+	refreshErr := errors.New("refresh rejected")
+	var gotDir, gotRejected string
+	personalForceRefreshRejectedToken = func(_ context.Context, configDir, rejectedToken string) (string, error) {
+		gotDir, gotRejected = configDir, rejectedToken
+		return "", refreshErr
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusUnauthorized)
+	}))
+	defer srv.Close()
+
+	src, err := newPersonalStreamSource(context.Background(), personalStreamSourceOptions{
+		ConfigDir: "config-dir",
+		Identity:  personal.Identity{ClientID: "client", SourceID: "source"},
+		TicketURL: srv.URL,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The 401 ticket response routes the rejected token through the wired
+	// ForceRefreshToken; the unknown refresh failure stays fatal.
+	if err := src.Start(context.Background(), func(*dwsevent.RawEvent) {}); !errors.Is(err, refreshErr) {
+		t.Fatalf("Start() error = %v, want wrapped refresh error", err)
+	}
+	if gotDir != "config-dir" || gotRejected != "old-token" {
+		t.Fatalf("refresh wiring got dir %q rejected %q", gotDir, gotRejected)
+	}
+}

internal/app/event_personal_full_coverage_test.go

@@ -57,8 +57,8 @@ func TestCrossPlatformCoveragePersonalEventRemainingSchemaAndSubscriptionCoverag
 	personalGetSubscription = func(*personal.Client, context.Context, string) (*personal.Subscription, error) {
 		return &personal.Subscription{EventKey: personal.EventFromUser}, nil
 	}
-	if _, _, _, err := ensurePersonalSubscription(context.Background(), client, personal.Identity{}, personalConsumeOptions{SubscribeID: "sub"}); err == nil {
-		t.Fatal("private subscription event succeeded")
+	if _, key, rule, err := ensurePersonalSubscription(context.Background(), client, personal.Identity{}, personalConsumeOptions{SubscribeID: "sub"}); err != nil || key != personal.EventFromUser || rule != "sender" {
+		t.Fatalf("sender subscription = %q %q, %v", key, rule, err)
 	}
 	personalGetSubscription = func(*personal.Client, context.Context, string) (*personal.Subscription, error) {
 		return &personal.Subscription{EventKey: personal.EventMention}, nil

internal/app/event_personal_output_test.go

@@ -18,7 +18,9 @@ import (
 	"encoding/json"
 	"strings"
 	"testing"
+	"time"
 
+	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
 	"github.com/spf13/cobra"
 )
@@ -43,8 +45,18 @@ func TestPersonalEventListHidesSchemaIDs(t *testing.T) {
 			}
 			got := out.String()
 			assertPersonalOutputHidesSchemaIDs(t, got)
-			if strings.Contains(got, personal.EventFromUser) {
-				t.Fatalf("list output exposed hidden event %s: %s", personal.EventFromUser, got)
+			for _, eventKey := range []string{
+				personal.EventFromUser,
+				personal.EventReadO2O,
+				personal.EventReadGroup,
+				personal.EventRecallO2O,
+				personal.EventRecallGroup,
+				personal.EventReactionO2O,
+				personal.EventReactionGroup,
+			} {
+				if !strings.Contains(got, eventKey) {
+					t.Fatalf("list output missing %s: %s", eventKey, got)
+				}
 			}
 		})
 	}
@@ -64,8 +76,8 @@ func TestEventListDefaultsToUser(t *testing.T) {
 	if !strings.Contains(got, personal.EventSingleChat) || !strings.Contains(got, "EVENT_KEY") {
 		t.Fatalf("list output = %s, want personal event catalog", got)
 	}
-	if strings.Contains(got, personal.EventFromUser) {
-		t.Fatalf("list output exposed hidden event %s: %s", personal.EventFromUser, got)
+	if !strings.Contains(got, personal.EventFromUser) {
+		t.Fatalf("list output missing public event %s: %s", personal.EventFromUser, got)
 	}
 	if strings.Contains(got, "CLIENT_ID") || strings.Contains(got, "ClientSecret") {
 		t.Fatalf("list default appears to use legacy application output: %s", got)
@@ -176,7 +188,44 @@ func TestPersonalEventSchemaHidesSchemaIDs(t *testing.T) {
 	}
 }
 
-func TestPersonalEventSchemaUsesSingleJSONSchema(t *testing.T) {
+func TestPersonalEventSchemaDefaultsToTransportEnvelope(t *testing.T) {
+	cmd := newEventSchemaCommand()
+	cmd.SilenceUsage = true
+	cmd.SilenceErrors = true
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SetArgs([]string{personal.EventSingleChat})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	var doc map[string]any
+	if err := json.Unmarshal(out.Bytes(), &doc); err != nil {
+		t.Fatalf("schema output is not JSON: %v\n%s", err, out.String())
+	}
+	if doc["jq_root_path"] != ".data | fromjson" {
+		t.Fatalf("jq_root_path = %#v, want .data | fromjson", doc["jq_root_path"])
+	}
+	schema, ok := doc["schema"].(map[string]any)
+	if !ok {
+		t.Fatalf("schema = %#v, want object", doc["schema"])
+	}
+	props, ok := schema["properties"].(map[string]any)
+	if !ok {
+		t.Fatalf("schema.properties = %#v, want object", schema["properties"])
+	}
+	for _, field := range []string{"type", "seq", "event_type", "data", "headers", "subscribe_id"} {
+		if _, ok := props[field]; !ok {
+			t.Fatalf("default envelope schema missing %q: %#v", field, props)
+		}
+	}
+	for _, field := range []string{"content", "sender", "conversation_id", "timestamp"} {
+		if _, ok := props[field]; ok {
+			t.Fatalf("default envelope schema unexpectedly contains flat field %q", field)
+		}
+	}
+}
+
+func TestPersonalEventFlattenedSchemaUsesSingleJSONSchema(t *testing.T) {
 	for _, eventKey := range []string{
 		personal.EventMention,
 		personal.EventSingleChat,
@@ -188,7 +237,7 @@ func TestPersonalEventSchemaUsesSingleJSONSchema(t *testing.T) {
 			cmd.SilenceErrors = true
 			var out bytes.Buffer
 			cmd.SetOut(&out)
-			cmd.SetArgs([]string{eventKey})
+			cmd.SetArgs([]string{eventKey, "--flatten"})
 			if err := cmd.Execute(); err != nil {
 				t.Fatalf("Execute() error = %v", err)
 			}
@@ -246,8 +295,8 @@ func TestPersonalEventSchemaUsesSingleJSONSchema(t *testing.T) {
 					t.Fatalf("schema output for %s leaked %q: %s", eventKey, leaked, got)
 				}
 			}
-			if doc["jq_root_path"] != ".data | fromjson" {
-				t.Fatalf("jq_root_path = %#v, want .data | fromjson", doc["jq_root_path"])
+			if doc["jq_root_path"] != "." {
+				t.Fatalf("jq_root_path = %#v, want .", doc["jq_root_path"])
 			}
 			schema, ok := doc["schema"].(map[string]any)
 			if !ok {
@@ -264,6 +313,80 @@ func TestPersonalEventSchemaUsesSingleJSONSchema(t *testing.T) {
 	}
 }
 
+func TestPersonalActionEventSchemaMatchesFlatOutput(t *testing.T) {
+	tests := []struct {
+		eventKeys  []string
+		properties []string
+	}{
+		{
+			eventKeys: []string{personal.EventReadO2O, personal.EventReadGroup},
+			properties: []string{
+				"type", "event_id", "timestamp", "subscribe_id", "message_id",
+				"conversation_id", "reader", "reader_open_dingtalk_id", "sender",
+				"sender_open_dingtalk_id", "read_time", "event_time",
+			},
+		},
+		{
+			eventKeys: []string{personal.EventRecallO2O, personal.EventRecallGroup},
+			properties: []string{
+				"type", "event_id", "timestamp", "subscribe_id", "message_id",
+				"conversation_id", "recaller", "recaller_open_dingtalk_id", "sender",
+				"sender_open_dingtalk_id", "recall_time", "event_time",
+			},
+		},
+		{
+			eventKeys: []string{personal.EventReactionO2O, personal.EventReactionGroup},
+			properties: []string{
+				"type", "event_id", "timestamp", "subscribe_id", "message_id",
+				"conversation_id", "operator", "operator_open_dingtalk_id", "reaction_name",
+				"reaction_text", "operation_type", "operation_time", "sender",
+				"sender_open_dingtalk_id", "event_time",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		for _, eventKey := range tt.eventKeys {
+			t.Run(eventKey, func(t *testing.T) {
+				cmd := newEventSchemaCommand()
+				cmd.SilenceUsage = true
+				cmd.SilenceErrors = true
+				var out bytes.Buffer
+				cmd.SetOut(&out)
+				cmd.SetArgs([]string{eventKey, "--flatten"})
+				if err := cmd.Execute(); err != nil {
+					t.Fatal(err)
+				}
+				var doc map[string]any
+				if err := json.Unmarshal(out.Bytes(), &doc); err != nil {
+					t.Fatalf("schema output is not JSON: %v\n%s", err, out.String())
+				}
+				if doc["event_key"] != eventKey || doc["jq_root_path"] != "." {
+					t.Fatalf("schema metadata = %#v", doc)
+				}
+				schema, ok := doc["schema"].(map[string]any)
+				if !ok {
+					t.Fatalf("schema = %#v", doc["schema"])
+				}
+				properties, ok := schema["properties"].(map[string]any)
+				if !ok || len(properties) != len(tt.properties) {
+					t.Fatalf("schema.properties = %#v, want exactly %d flat fields", schema["properties"], len(tt.properties))
+				}
+				for _, field := range tt.properties {
+					if _, ok := properties[field]; !ok {
+						t.Fatalf("schema missing %q: %#v", field, properties)
+					}
+				}
+				for _, internal := range []string{"payload", "uid", "corpid", "clientId", "filterSubId", "bizid"} {
+					if _, ok := properties[internal]; ok {
+						t.Fatalf("schema exposed internal property %q", internal)
+					}
+				}
+			})
+		}
+	}
+}
+
 func TestEventSchemaDefaultsToUser(t *testing.T) {
 	cmd := newEventSchemaCommand()
 	cmd.SilenceUsage = true
@@ -281,40 +404,152 @@ func TestEventSchemaDefaultsToUser(t *testing.T) {
 	if doc["event_key"] != personal.EventSingleChat {
 		t.Fatalf("event_key = %#v, want %s", doc["event_key"], personal.EventSingleChat)
 	}
+	if doc["jq_root_path"] != ".data | fromjson" {
+		t.Fatalf("jq_root_path = %#v, want default envelope path", doc["jq_root_path"])
+	}
 }
 
-func TestPersonalEventFromUserIsNotPubliclyAvailable(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		cmd  *cobra.Command
-		args []string
-	}{
-		{
-			name: "schema",
-			cmd:  newEventSchemaCommand(),
-			args: []string{personal.EventFromUser},
-		},
-		{
-			name: "consume",
-			cmd:  newEventConsumeCommand(),
-			args: []string{personal.EventFromUser, "--user", "507971", "--dry-run"},
-		},
-		{
-			name: "status",
-			cmd:  newEventStatusCommand(),
-			args: []string{"--event", personal.EventFromUser},
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			tc.cmd.SilenceUsage = true
-			tc.cmd.SilenceErrors = true
-			tc.cmd.SetArgs(tc.args)
-			err := tc.cmd.Execute()
-			if err == nil || !strings.Contains(err.Error(), "event "+personal.EventFromUser+" is not publicly available yet") {
-				t.Fatalf("Execute() error = %v, want not publicly available", err)
-			}
-		})
+func TestPersonalEventFromUserIsPubliclyAvailable(t *testing.T) {
+	if err := ensurePublicPersonalEvent(personal.EventFromUser); err != nil {
+		t.Fatalf("ensurePublicPersonalEvent() error = %v", err)
 	}
+
+	schemaCmd := newEventSchemaCommand()
+	schemaCmd.SilenceUsage = true
+	schemaCmd.SilenceErrors = true
+	var schemaOut bytes.Buffer
+	schemaCmd.SetOut(&schemaOut)
+	schemaCmd.SetArgs([]string{personal.EventFromUser})
+	if err := schemaCmd.Execute(); err != nil {
+		t.Fatalf("schema Execute() error = %v", err)
+	}
+	var doc map[string]any
+	if err := json.Unmarshal(schemaOut.Bytes(), &doc); err != nil {
+		t.Fatalf("schema output is not JSON: %v\n%s", err, schemaOut.String())
+	}
+	if doc["event_key"] != personal.EventFromUser || doc["rule_type"] != "sender" {
+		t.Fatalf("schema document = %#v", doc)
+	}
+
+	configDir := setupPersonalIdentityToken(t, &authpkg.TokenData{
+		AccessToken:  "access-1",
+		RefreshToken: "refresh-1",
+		ExpiresAt:    time.Now().Add(time.Hour),
+		RefreshExpAt: time.Now().Add(24 * time.Hour),
+		CorpID:       "corp-1",
+		UserID:       "user-1",
+		ClientID:     "client-1",
+	})
+	t.Setenv("DWS_CONFIG_DIR", configDir)
+
+	consumeCmd := newEventConsumeCommand()
+	consumeCmd.SilenceUsage = true
+	consumeCmd.SilenceErrors = true
+	consumeCmd.SetArgs([]string{personal.EventFromUser, "--user", "test-user-001", "--dry-run"})
+	if err := consumeCmd.Execute(); err != nil {
+		t.Fatalf("consume dry-run Execute() error = %v", err)
+	}
+	openIDConsumeCmd := newEventConsumeCommand()
+	openIDConsumeCmd.SilenceUsage = true
+	openIDConsumeCmd.SilenceErrors = true
+	openIDConsumeCmd.SetArgs([]string{personal.EventFromUser, "--open-dingtalk-id", "open-user-1", "--dry-run"})
+	if err := openIDConsumeCmd.Execute(); err != nil {
+		t.Fatalf("consume openDingtalkId dry-run Execute() error = %v", err)
+	}
+
+	conflictingTargetCmd := newEventConsumeCommand()
+	conflictingTargetCmd.SilenceUsage = true
+	conflictingTargetCmd.SilenceErrors = true
+	conflictingTargetCmd.SetArgs([]string{personal.EventFromUser, "--user", "test-user-001", "--open-dingtalk-id", "open-user-1", "--dry-run"})
+	err := conflictingTargetCmd.Execute()
+	if err == nil || !strings.Contains(err.Error(), "--user and --open-dingtalk-id are mutually exclusive for "+personal.EventFromUser) {
+		t.Fatalf("conflicting target identity error = %v", err)
+	}
+
+	groupOpenIDCmd := newEventConsumeCommand()
+	groupOpenIDCmd.SilenceUsage = true
+	groupOpenIDCmd.SilenceErrors = true
+	groupOpenIDCmd.SetArgs([]string{personal.EventInChat, "--group", "cid-1", "--open-dingtalk-id", "open-user-1", "--dry-run"})
+	err = groupOpenIDCmd.Execute()
+	if err == nil || !strings.Contains(err.Error(), "--open-dingtalk-id is not supported for "+personal.EventInChat+"; use --group") {
+		t.Fatalf("group openDingtalkId error = %v", err)
+	}
+
+	missingUserCmd := newEventConsumeCommand()
+	missingUserCmd.SilenceUsage = true
+	missingUserCmd.SilenceErrors = true
+	missingUserCmd.SetArgs([]string{personal.EventFromUser})
+	err = missingUserCmd.Execute()
+	if err == nil || !strings.Contains(err.Error(), "one of --user or --open-dingtalk-id is required for "+personal.EventFromUser) {
+		t.Fatalf("missing target identity error = %v", err)
+	}
+}
+
+func TestEventConsumeCobraSchemaIncludesOpenDingTalkID(t *testing.T) {
+	root := NewRootCommand()
+	root.SilenceUsage = true
+	root.SilenceErrors = true
+	var out bytes.Buffer
+	root.SetOut(&out)
+	root.SetArgs([]string{"schema", "event consume"})
+	if err := root.Execute(); err != nil {
+		t.Fatalf("schema event consume Execute() error = %v", err)
+	}
+	var doc map[string]any
+	if err := json.Unmarshal(out.Bytes(), &doc); err != nil {
+		t.Fatalf("schema output is not JSON: %v\n%s", err, out.String())
+	}
+	params, ok := doc["parameters"].(map[string]any)
+	if !ok {
+		t.Fatalf("schema parameters = %#v", doc["parameters"])
+	}
+	if _, ok := params["open-dingtalk-id"]; !ok {
+		t.Fatalf("schema parameters missing open-dingtalk-id: %#v", params)
+	}
+	if _, ok := params["odid"]; ok {
+		t.Fatalf("schema parameters unexpectedly include odid alias: %#v", params)
+	}
+	if _, ok := params["flatten"]; !ok {
+		t.Fatalf("schema parameters missing flatten: %#v", params)
+	}
+	for _, name := range []string{"user", "open-dingtalk-id", "group"} {
+		param, ok := params[name].(map[string]any)
+		if !ok {
+			t.Fatalf("schema parameter %s = %#v", name, params[name])
+		}
+		if got, exists := param["required_when"]; exists {
+			t.Fatalf("schema parameter %s unexpectedly declares required_when = %#v", name, got)
+		}
+	}
+	constraints, ok := doc["constraints"].(map[string]any)
+	if !ok {
+		t.Fatalf("schema constraints = %#v", doc["constraints"])
+	}
+	assertJSONConstraintGroup := func(field string, want []string) {
+		t.Helper()
+		groups, ok := constraints[field].([]any)
+		if !ok {
+			t.Fatalf("schema constraint %s = %#v", field, constraints[field])
+		}
+		for _, rawGroup := range groups {
+			group, ok := rawGroup.([]any)
+			if !ok || len(group) != len(want) {
+				continue
+			}
+			matched := true
+			for i := range want {
+				if group[i] != want[i] {
+					matched = false
+					break
+				}
+			}
+			if matched {
+				return
+			}
+		}
+		t.Fatalf("schema constraint %s = %#v, missing %#v", field, groups, want)
+	}
+	assertJSONConstraintGroup("require_one_of", []string{"event_key", "subscribe-id"})
 }
 
 func TestPersonalEventSchemaRejectsTableFormat(t *testing.T) {

internal/app/event_profile_selector_compat_test.go

@@ -0,0 +1,121 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"testing"
+
+	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
+)
+
+func TestPersonalBusProfileSelectorUsesDefaultBlankCurrentBeforeRuntimeEnrichedIdentity(t *testing.T) {
+	configDir, cfg, blankSelector, exactSelector := seedPersonalBusProfileSelectorConfig(t)
+	cfg.CurrentProfile = blankSelector
+	cfg.OrgCurrentProfiles = map[string]string{cfg.Profiles[0].CorpID: exactSelector}
+	if err := authpkg.SaveProfiles(configDir, cfg); err != nil {
+		t.Fatalf("SaveProfiles() error = %v", err)
+	}
+	authpkg.SetRuntimeProfile("")
+	t.Cleanup(func() { authpkg.SetRuntimeProfile("") })
+
+	identityAfterRuntimeEnrichment := personal.Identity{
+		CorpID: cfg.Profiles[0].CorpID,
+		UserID: cfg.Profiles[1].UserID,
+	}
+	if got := personalBusProfileSelector(configDir, identityAfterRuntimeEnrichment); got != blankSelector {
+		t.Fatalf("personalBusProfileSelector() = %q, want default blank selector %q", got, blankSelector)
+	}
+}
+
+func TestPersonalBusProfileSelectorUsesDefaultExactCurrent(t *testing.T) {
+	configDir, cfg, _, exactSelector := seedPersonalBusProfileSelectorConfig(t)
+	cfg.CurrentProfile = exactSelector
+	cfg.OrgCurrentProfiles = map[string]string{cfg.Profiles[0].CorpID: exactSelector}
+	if err := authpkg.SaveProfiles(configDir, cfg); err != nil {
+		t.Fatalf("SaveProfiles() error = %v", err)
+	}
+	authpkg.SetRuntimeProfile("")
+	t.Cleanup(func() { authpkg.SetRuntimeProfile("") })
+
+	identity := personal.Identity{CorpID: cfg.Profiles[1].CorpID, UserID: cfg.Profiles[1].UserID}
+	if got := personalBusProfileSelector(configDir, identity); got != exactSelector {
+		t.Fatalf("personalBusProfileSelector() = %q, want default exact selector %q", got, exactSelector)
+	}
+}
+
+func TestPersonalBusProfileSelectorPrefersExplicitRuntimeSelector(t *testing.T) {
+	configDir, cfg, blankSelector, _ := seedPersonalBusProfileSelectorConfig(t)
+	cfg.CurrentProfile = blankSelector
+	if err := authpkg.SaveProfiles(configDir, cfg); err != nil {
+		t.Fatalf("SaveProfiles() error = %v", err)
+	}
+
+	const explicitSelector = "corp_explicit:user_explicit"
+	authpkg.SetRuntimeProfile(explicitSelector)
+	t.Cleanup(func() { authpkg.SetRuntimeProfile("") })
+
+	identity := personal.Identity{CorpID: cfg.Profiles[1].CorpID, UserID: cfg.Profiles[1].UserID}
+	if got := personalBusProfileSelector(configDir, identity); got != explicitSelector {
+		t.Fatalf("personalBusProfileSelector() = %q, want explicit selector %q", got, explicitSelector)
+	}
+}
+
+func TestCrossPlatformCoveragePersonalBusProfileSelectorFallsBackToMatchingIdentity(t *testing.T) {
+	configDir, cfg, _, exactSelector := seedPersonalBusProfileSelectorConfig(t)
+	cfg.Profiles = append(cfg.Profiles, authpkg.Profile{
+		Name:     "Other Current",
+		CorpID:   "corp_event_other_fixture",
+		CorpName: "Other Fixture Organization",
+		UserID:   "identity_event_other_fixture",
+	})
+	cfg.CurrentProfile = authpkg.ProfileSelectionSelector(cfg.Profiles[2], cfg)
+	if err := authpkg.SaveProfiles(configDir, cfg); err != nil {
+		t.Fatalf("SaveProfiles() error = %v", err)
+	}
+	authpkg.SetRuntimeProfile("")
+	t.Cleanup(func() { authpkg.SetRuntimeProfile("") })
+
+	identity := personal.Identity{CorpID: cfg.Profiles[1].CorpID, UserID: cfg.Profiles[1].UserID}
+	if got := personalBusProfileSelector(configDir, identity); got != exactSelector {
+		t.Fatalf("personalBusProfileSelector() = %q, want identity fallback %q", got, exactSelector)
+	}
+}
+
+func seedPersonalBusProfileSelectorConfig(t *testing.T) (string, *authpkg.ProfilesConfig, string, string) {
+	t.Helper()
+	configDir := t.TempDir()
+	cfg := &authpkg.ProfilesConfig{
+		Version: 2,
+		Profiles: []authpkg.Profile{
+			{
+				Name:     "External Fixture",
+				CorpID:   "corp_event_current_fixture",
+				CorpName: "Fixture Organization",
+			},
+			{
+				Name:     "Exact Fixture",
+				CorpID:   "corp_event_current_fixture",
+				CorpName: "Fixture Organization",
+				UserID:   "identity_runtime_enriched_fixture",
+			},
+		},
+	}
+	blankSelector := authpkg.ProfileSelectionSelector(cfg.Profiles[0], cfg)
+	exactSelector := authpkg.ProfileSelectionSelector(cfg.Profiles[1], cfg)
+	if blankSelector == "" || blankSelector == cfg.Profiles[0].CorpID {
+		t.Fatalf("blank selector = %q, want stable account selector", blankSelector)
+	}
+	return configDir, cfg, blankSelector, exactSelector
+}

internal/app/event_registration_test.go

@@ -13,14 +13,18 @@ import (
 func TestEventCommandRemainsVisibleAsBuiltInPublicGroup(t *testing.T) {
 	root := &cobra.Command{Use: "dws"}
 	event := newEventCommand()
+	markdown := &cobra.Command{Use: "markdown"}
 	unregistered := &cobra.Command{Use: "unregistered", Run: func(*cobra.Command, []string) {}}
-	root.AddCommand(event, unregistered)
+	root.AddCommand(event, markdown, unregistered)
 
 	hideNonDirectRuntimeCommands(root)
 
 	if event.Hidden {
 		t.Fatal("built-in event command was hidden by the direct-runtime visibility filter")
 	}
+	if markdown.Hidden {
+		t.Fatal("locally routed markdown command was hidden by the direct-runtime visibility filter")
+	}
 	if !unregistered.Hidden {
 		t.Fatal("control command outside the built-in/direct-runtime sets remained visible")
 	}

internal/app/event_stdin_gate_test.go

@@ -17,7 +17,9 @@ import (
 	"testing"
 	"time"
 
+	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/keychain"
 )
 
 // A bounded run never arms the stdin-EOF watcher, regardless of stdin
@@ -41,17 +43,18 @@ func TestShouldWatchStdinEOF_BoundedIsNeverArmed(t *testing.T) {
 func TestPersonalBusSpawnArgs_ForwardsProfile(t *testing.T) {
 	args := personalBusSpawnArgs(personal.Identity{
 		CorpID:   "dinga626d60c1128d449",
+		UserID:   "user_123",
 		SourceID: "open",
 	}, "", "")
 	found := false
 	for i := 0; i+1 < len(args); i++ {
-		if args[i] == "--profile" && args[i+1] == "dinga626d60c1128d449" {
+		if args[i] == "--profile" && args[i+1] == "dinga626d60c1128d449:user_123" {
 			found = true
 			break
 		}
 	}
 	if !found {
-		t.Errorf("spawn args must forward --profile <corpId>; got %v", args)
+		t.Errorf("spawn args must forward --profile <corpId>:<userId>; got %v", args)
 	}
 
 	// No CorpID → no --profile appended (avoid an empty flag value).
@@ -62,3 +65,100 @@ func TestPersonalBusSpawnArgs_ForwardsProfile(t *testing.T) {
 		}
 	}
 }
+
+func TestCrossPlatformCoveragePersonalBusSpawnArgsPreservesReservedBlankProfile(t *testing.T) {
+	configDir := t.TempDir()
+	t.Setenv(keychain.DisableKeychainEnv, "1")
+	t.Setenv(keychain.StorageDirEnv, t.TempDir())
+	cfg := &authpkg.ProfilesConfig{
+		Version: 2,
+		OrgCurrentProfiles: map[string]string{
+			"corp_event_fixture": "corp_event_fixture:identity_exact_fixture",
+		},
+		Profiles: []authpkg.Profile{
+			{
+				Name:     "Fixture Organization",
+				CorpID:   "corp_event_fixture",
+				CorpName: "Fixture Organization",
+			},
+			{
+				Name:     "Exact Fixture Account",
+				CorpID:   "corp_event_fixture",
+				CorpName: "Fixture Organization",
+				UserID:   "identity_exact_fixture",
+			},
+		},
+	}
+	blankSelector := authpkg.ProfileSelectionSelector(cfg.Profiles[0], cfg)
+	cfg.PrimaryProfile = blankSelector
+	cfg.CurrentProfile = blankSelector
+	if err := authpkg.SaveProfiles(configDir, cfg); err != nil {
+		t.Fatalf("SaveProfiles() error = %v", err)
+	}
+	blankToken := &authpkg.TokenData{
+		AccessToken: "parent-blank-token",
+		CorpID:      "corp_event_fixture",
+		CorpName:    "Fixture Organization",
+	}
+	exactToken := &authpkg.TokenData{
+		AccessToken: "other-exact-token",
+		CorpID:      "corp_event_fixture",
+		CorpName:    "Fixture Organization",
+		UserID:      "identity_exact_fixture",
+	}
+	if err := authpkg.SaveTokenDataKeychainForCorpID(blankToken.CorpID, blankToken); err != nil {
+		t.Fatalf("save parent blank token: %v", err)
+	}
+	if err := authpkg.SaveTokenDataKeychainForIdentity(exactToken.CorpID, exactToken.UserID, exactToken); err != nil {
+		t.Fatalf("save other exact token: %v", err)
+	}
+
+	// Runtime identity enrichment points at the exact sibling, but the parent
+	// already loaded the persisted blank current profile.
+	identity := personal.Identity{
+		CorpID:   "corp_event_fixture",
+		UserID:   "identity_exact_fixture",
+		SourceID: "open",
+	}
+	selector := personalBusProfileSelector(configDir, identity)
+	want := blankSelector
+	if selector != want || selector == identity.CorpID {
+		t.Fatalf("personalBusProfileSelector(blank) = %q, want reserved %q", selector, want)
+	}
+	args := personalBusSpawnArgs(identity, "", "", selector)
+	forwardedSelector := ""
+	for i := 0; i+1 < len(args); i++ {
+		if args[i] == "--profile" && args[i+1] == want {
+			forwardedSelector = args[i+1]
+			break
+		}
+	}
+	if forwardedSelector == "" {
+		t.Fatalf("spawn args did not preserve reserved blank selector: %v", args)
+	}
+	parentToken, err := authpkg.LoadTokenDataForProfile(configDir, selector)
+	if err != nil {
+		t.Fatalf("load parent token: %v", err)
+	}
+	authpkg.SetRuntimeProfile(forwardedSelector)
+	t.Cleanup(func() { authpkg.SetRuntimeProfile("") })
+	childToken, err := authpkg.LoadTokenData(configDir)
+	if err != nil {
+		t.Fatalf("load detached child token: %v", err)
+	}
+	if parentToken.AccessToken != blankToken.AccessToken ||
+		childToken.AccessToken != parentToken.AccessToken ||
+		childToken.UserID != "" {
+		t.Fatalf("parent/child token drift: parent=%#v child=%#v", parentToken, childToken)
+	}
+
+	authpkg.SetRuntimeProfile(want)
+	inferredExact := personal.Identity{
+		CorpID:   "corp_event_fixture",
+		UserID:   "identity_exact_fixture",
+		SourceID: "open",
+	}
+	if got := personalBusProfileSelector(configDir, inferredExact); got != want {
+		t.Fatalf("runtime blank selector changed after inferred userId: got %q, want %q", got, want)
+	}
+}

internal/app/flags.go

@@ -47,7 +47,7 @@ func bindPersistentFlags(cmd *cobra.Command, flags *GlobalFlags) {
 	cmd.PersistentFlags().BoolVar(&flags.Mock, "mock", false, "使用 Mock 数据 (开发调试用)")
 	cmd.PersistentFlags().StringVarP(&flags.Output, "output", "o", "", "Write command output to a file")
 	_ = cmd.PersistentFlags().MarkHidden("output")
-	cmd.PersistentFlags().StringVar(&flags.Profile, "profile", "", "一次性指定本次命令使用的组织 profile 名或 corpId；多个按 CSV 逗号分隔，如 corpA,corpB")
+	cmd.PersistentFlags().StringVar(&flags.Profile, "profile", "", "一次性指定组织或账号；支持 corpId/corpName 与 userId/userName 组合，推荐使用 profile list 返回的 corpId:userId；多个按 CSV 逗号分隔")
 	cmd.PersistentFlags().IntVar(&flags.Timeout, "timeout", 30, "HTTP 请求超时时间 (秒)")
 	cmd.PersistentFlags().StringVar(&flags.Token, "token", "", "Override the configured API token")
 	_ = cmd.PersistentFlags().MarkHidden("token")

internal/app/force_refresh.go

@@ -27,9 +27,13 @@ type accessTokenGetter interface {
 	GetAccessToken(context.Context) (string, error)
 }
 
+type rejectedAccessTokenRefresher interface {
+	ForceRefreshRejectedToken(context.Context, string) (string, error)
+}
+
 var (
-	markAccessTokenStale = authpkg.MarkAccessTokenStale
-	newRefreshProvider   = func(configDir string) accessTokenGetter {
+	loadRefreshTokenData = authpkg.LoadTokenData
+	newRefreshProvider   = func(configDir string) rejectedAccessTokenRefresher {
 		disc := slog.New(slog.NewTextHandler(io.Discard, nil))
 		provider := authpkg.NewOAuthProvider(configDir, disc)
 		configureOAuthProviderCompatibility(provider, configDir)
@@ -42,26 +46,33 @@ var (
 // server-side rejection (HTTP 401 or business code such as
 // TOKEN_VERIFIED_FAILED) on what locally appeared to be a still-valid token.
 //
-// Steps:
-//  1. MarkAccessTokenStale rewrites ExpiresAt to a past instant so
-//     OAuthProvider.GetAccessToken's fast-path will miss.
-//  2. NewOAuthProvider + GetAccessToken triggers lockedRefresh, which uses the
-//     existing dual-layer lock (process + file) to serialize concurrent
-//     refresh attempts across goroutines and processes.
-//  3. ResetRuntimeTokenCache clears the per-process sync.Once cache so the
-//     next resolveAuthToken call re-reads from disk.
-//
-// Existing OAuthProvider.GetAccessToken behaviour is unchanged; this helper
-// is the only entry point that orchestrates "force refresh" semantics.
+// It snapshots the current access token, then delegates to the OAuth
+// provider's dual-locked compare-and-refresh operation. If another caller has
+// already rotated the token, that newer token is reused without another
+// refresh request.
 func ForceRefreshAccessToken(ctx context.Context, configDir string) (string, error) {
 	if strings.TrimSpace(configDir) == "" {
 		return "", fmt.Errorf("config directory is empty")
 	}
-	if err := markAccessTokenStale(configDir); err != nil {
-		return "", fmt.Errorf("mark access token stale: %w", err)
+	data, err := loadRefreshTokenData(configDir)
+	if err != nil {
+		return "", err
+	}
+	if data == nil || strings.TrimSpace(data.AccessToken) == "" {
+		return "", fmt.Errorf("stored access token is empty")
+	}
+	return forceRefreshRejectedAccessToken(ctx, configDir, data.AccessToken)
+}
+
+func forceRefreshRejectedAccessToken(ctx context.Context, configDir, rejectedAccessToken string) (string, error) {
+	if strings.TrimSpace(configDir) == "" {
+		return "", fmt.Errorf("config directory is empty")
+	}
+	if strings.TrimSpace(rejectedAccessToken) == "" {
+		return "", fmt.Errorf("rejected access token is empty")
 	}
 	provider := newRefreshProvider(configDir)
-	tok, err := provider.GetAccessToken(ctx)
+	tok, err := provider.ForceRefreshRejectedToken(ctx, rejectedAccessToken)
 	if err != nil {
 		return "", err
 	}

internal/app/legacy.go

@@ -27,21 +27,27 @@ import (
 	"github.com/spf13/cobra"
 )
 
-func newLegacyPublicCommands(runner executor.Runner, caller edition.ToolCaller) []*cobra.Command {
+func newLegacyPublicCommands(runner executor.Runner, caller edition.ToolCaller, loadUserShortcuts bool) []*cobra.Command {
 	injectStaticServers()
 	helpers.InitDeps(caller)
 	commands := helpers.NewPublicCommands(runner)
 	// Load user-defined shortcuts (~/.dws/shortcuts/*.yaml) BEFORE compiling the
 	// command tree, so distilled high-frequency operations mount alongside the
 	// built-ins. Conflicts with built-ins are skipped inside Load.
-	if _, err := userdef.Load(); err != nil {
-		slog.Warn("shortcut: failed to load user-defined shortcuts", "error", err)
+	if loadUserShortcuts {
+		if _, err := userdef.Load(); err != nil {
+			slog.Warn("shortcut: failed to load user-defined shortcuts", "error", err)
+		}
 	}
 	// Built-in + user shortcuts (`dws <service> +<command>`) share the same
 	// command tree; mergeTopLevelCommands folds each shortcut's service parent
 	// into the matching helper command so the `+leaf` sits alongside existing
 	// subcommands.
-	commands = append(commands, builtin.Commands()...)
+	if loadUserShortcuts {
+		commands = append(commands, builtin.Commands()...)
+	} else {
+		commands = append(commands, builtin.BaseCommands()...)
+	}
 	return mergeTopLevelCommands(commands)
 }
 

internal/app/mcp_url_command.go

@@ -0,0 +1,108 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
+	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/output"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
+	"github.com/spf13/cobra"
+)
+
+const (
+	mcpMetaServerID = "mcp-meta"
+	mcpMetaURLTool  = "get_mcp_server_url"
+)
+
+func newMCPURLGroup(caller edition.ToolCaller) *cobra.Command {
+	group := &cobra.Command{
+		Use:               "url",
+		Short:             "管理 MCP 服务连接地址",
+		Args:              cobra.NoArgs,
+		DisableAutoGenTag: true,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			return cmd.Help()
+		},
+	}
+	group.AddCommand(newMCPURLGetCommand(caller))
+	return group
+}
+
+func newMCPURLGetCommand(caller edition.ToolCaller) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "get <mcpId>",
+		Short: "按 mcpId 获取 MCP 的 Streamable HTTP 服务地址",
+		Long: "输入 MCP 市场 mcpId，返回以当前用户和组织身份访问该 MCP 的 " +
+			"Streamable HTTP 服务地址。\n\n" +
+			"安全提示：返回的 mcpURL 和 mcpJSON 可能包含身份凭据，仅限个人使用，" +
+			"请勿分享到群聊、文档、邮件、代码仓库或日志。",
+		Example: "  dws mcp url get 2480\n" +
+			"  dws mcp url get 2480 --format json",
+		Args:              cobra.ExactArgs(1),
+		DisableAutoGenTag: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if caller == nil {
+				return fmt.Errorf("MCP tool caller is not configured")
+			}
+			mcpID := strings.TrimSpace(args[0])
+			if mcpID == "" {
+				return fmt.Errorf("mcpId 不能为空")
+			}
+
+			result, err := caller.CallTool(cmd.Context(), mcpMetaServerID, mcpMetaURLTool, map[string]any{
+				"mcpId": mcpID,
+			})
+			if err != nil {
+				return fmt.Errorf("获取 MCP 服务地址: %w", err)
+			}
+			return writeMCPURLResult(cmd, result)
+		},
+	}
+	cli.AnnotateRuntimePositionals(cmd, cli.RuntimeSchemaPositional{
+		Name:        "mcp_id",
+		Type:        "string",
+		Description: "钉钉 MCP 市场中的 mcpId",
+		Required:    true,
+		Index:       0,
+	})
+	return cmd
+}
+
+func writeMCPURLResult(cmd *cobra.Command, result *edition.ToolResult) error {
+	if result == nil {
+		return fmt.Errorf("MCP 元服务返回空结果")
+	}
+	// get_mcp_server_url returns one JSON document in its first non-empty text
+	// block. Other block types and trailing blocks are intentionally ignored.
+	for _, block := range result.Content {
+		if block.Type != "text" || strings.TrimSpace(block.Text) == "" {
+			continue
+		}
+		if err := apperrors.ClassifyMCPResponseText(block.Text); err != nil {
+			return err
+		}
+
+		var payload any
+		if err := json.Unmarshal([]byte(block.Text), &payload); err != nil {
+			return fmt.Errorf("MCP 元服务返回了无效 JSON: %w", err)
+		}
+		return output.WriteCommandPayload(cmd, payload, output.FormatJSON)
+	}
+	return fmt.Errorf("MCP 元服务返回空结果")
+}

internal/app/mcp_url_command_test.go

@@ -0,0 +1,194 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+
+	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
+	"github.com/spf13/cobra"
+)
+
+type mcpURLTestCaller struct {
+	productID string
+	toolName  string
+	args      map[string]any
+	result    *edition.ToolResult
+	err       error
+}
+
+func (c *mcpURLTestCaller) CallTool(_ context.Context, productID, toolName string, args map[string]any) (*edition.ToolResult, error) {
+	c.productID = productID
+	c.toolName = toolName
+	c.args = args
+	return c.result, c.err
+}
+
+func (*mcpURLTestCaller) Format() string { return "json" }
+func (*mcpURLTestCaller) DryRun() bool   { return false }
+func (*mcpURLTestCaller) Fields() string { return "" }
+func (*mcpURLTestCaller) JQ() string     { return "" }
+
+func executeMCPURLCommand(t *testing.T, caller edition.ToolCaller, args ...string) (string, error) {
+	t.Helper()
+	root := &cobra.Command{Use: "mcp", SilenceErrors: true, SilenceUsage: true}
+	root.AddCommand(newMCPURLGroup(caller))
+	var out bytes.Buffer
+	root.SetOut(&out)
+	root.SetErr(&out)
+	root.SetArgs(args)
+	err := root.ExecuteContext(t.Context())
+	return out.String(), err
+}
+
+func TestMCPURLGetCallsMetaServerAndPreservesResponse(t *testing.T) {
+	const response = `{"result":{"mcpURL":"https://example.test/mcp?key=one&token=two","mcpJSON":{"transport":"streamable-http"},"name":"Example"}}`
+	caller := &mcpURLTestCaller{
+		result: &edition.ToolResult{Content: []edition.ContentBlock{{Type: "text", Text: response}}},
+	}
+
+	out, err := executeMCPURLCommand(t, caller, "url", "get", " 10043 ")
+	if err != nil {
+		t.Fatalf("execute mcp url get: %v", err)
+	}
+	if caller.productID != mcpMetaServerID {
+		t.Fatalf("productID = %q, want %q", caller.productID, mcpMetaServerID)
+	}
+	if caller.toolName != mcpMetaURLTool {
+		t.Fatalf("toolName = %q, want %q", caller.toolName, mcpMetaURLTool)
+	}
+	if got := caller.args["mcpId"]; got != "10043" {
+		t.Fatalf("mcpId = %#v, want %q", got, "10043")
+	}
+
+	var payload map[string]any
+	if err := json.Unmarshal([]byte(out), &payload); err != nil {
+		t.Fatalf("output is not JSON: %v\n%s", err, out)
+	}
+	result, ok := payload["result"].(map[string]any)
+	if !ok {
+		t.Fatalf("output result = %#v", payload["result"])
+	}
+	if got := result["mcpURL"]; got != "https://example.test/mcp?key=one&token=two" {
+		t.Fatalf("result.mcpURL = %#v", got)
+	}
+}
+
+func TestMCPURLGetRejectsBlankID(t *testing.T) {
+	_, err := executeMCPURLCommand(t, &mcpURLTestCaller{}, "url", "get", "   ")
+	if err == nil || !strings.Contains(err.Error(), "mcpId 不能为空") {
+		t.Fatalf("error = %v, want blank mcpId error", err)
+	}
+}
+
+func TestMCPURLGroupShowsHelp(t *testing.T) {
+	out, err := executeMCPURLCommand(t, nil, "url")
+	if err != nil {
+		t.Fatalf("execute mcp url: %v", err)
+	}
+	if !strings.Contains(out, "get") {
+		t.Fatalf("help output does not list get command:\n%s", out)
+	}
+}
+
+func TestMCPURLGetRejectsMissingCaller(t *testing.T) {
+	_, err := executeMCPURLCommand(t, nil, "url", "get", "10043")
+	if err == nil || !strings.Contains(err.Error(), "caller is not configured") {
+		t.Fatalf("error = %v, want missing caller error", err)
+	}
+}
+
+func TestMCPURLGetPropagatesCallError(t *testing.T) {
+	caller := &mcpURLTestCaller{err: errors.New("permission denied")}
+	_, err := executeMCPURLCommand(t, caller, "url", "get", "10043")
+	if err == nil || !strings.Contains(err.Error(), "permission denied") {
+		t.Fatalf("error = %v, want call error", err)
+	}
+}
+
+func TestMCPURLGetRejectsInvalidJSON(t *testing.T) {
+	caller := &mcpURLTestCaller{
+		result: &edition.ToolResult{Content: []edition.ContentBlock{{Type: "text", Text: "not-json"}}},
+	}
+	_, err := executeMCPURLCommand(t, caller, "url", "get", "10043")
+	if err == nil || !strings.Contains(err.Error(), "无效 JSON") {
+		t.Fatalf("error = %v, want invalid JSON error", err)
+	}
+}
+
+func TestMCPURLGetRejectsEmptyResults(t *testing.T) {
+	tests := []struct {
+		name   string
+		result *edition.ToolResult
+	}{
+		{name: "nil result"},
+		{
+			name: "no usable text content",
+			result: &edition.ToolResult{Content: []edition.ContentBlock{
+				{Type: "image", Text: "ignored"},
+				{Type: "text", Text: "   "},
+			}},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			caller := &mcpURLTestCaller{result: tt.result}
+			_, err := executeMCPURLCommand(t, caller, "url", "get", "10043")
+			if err == nil || !strings.Contains(err.Error(), "返回空结果") {
+				t.Fatalf("error = %v, want empty result error", err)
+			}
+		})
+	}
+}
+
+func TestMCPURLGetClassifiesBusinessError(t *testing.T) {
+	caller := &mcpURLTestCaller{
+		result: &edition.ToolResult{Content: []edition.ContentBlock{{
+			Type: "text",
+			Text: `{"success":false,"errorMsg":"搜索内容不能为空"}`,
+		}}},
+	}
+	_, err := executeMCPURLCommand(t, caller, "url", "get", "10043")
+	if err == nil {
+		t.Fatal("expected classified business error")
+	}
+	var typed *apperrors.Error
+	if !errors.As(err, &typed) || typed.Reason != "business_error" {
+		t.Fatalf("error = %#v, want classified business error", err)
+	}
+}
+
+func TestRootRegistersMCPURLGet(t *testing.T) {
+	root := NewRootCommand(t.Context())
+	mcp, _, err := root.Find([]string{"mcp"})
+	if err != nil {
+		t.Fatalf("find mcp: %v", err)
+	}
+	if mcp.Hidden {
+		t.Fatal("mcp command must be public when it contains reviewed public helpers")
+	}
+	cmd, _, err := root.Find([]string{"mcp", "url", "get"})
+	if err != nil {
+		t.Fatalf("find mcp url get: %v", err)
+	}
+	if got := cmd.CommandPath(); got != "dws mcp url get" {
+		t.Fatalf("command path = %q, want %q", got, "dws mcp url get")
+	}
+}

internal/app/multi_profile_runner_test.go

@@ -50,8 +50,9 @@ func TestRuntimeRunnerAggregatesCommaSeparatedProfiles(t *testing.T) {
 			t.Fatalf("profiles[%d].ok = %#v, want true", i, entry["ok"])
 		}
 		resultPayload := entry["result"].(map[string]any)
-		if resultPayload["runtimeProfile"] != wantCorpID {
-			t.Fatalf("profiles[%d].result.runtimeProfile = %#v, want %q", i, resultPayload["runtimeProfile"], wantCorpID)
+		wantProfile := wantCorpID + ":user-" + wantCorpID
+		if resultPayload["runtimeProfile"] != wantProfile {
+			t.Fatalf("profiles[%d].result.runtimeProfile = %#v, want %q", i, resultPayload["runtimeProfile"], wantProfile)
 		}
 	}
 }
@@ -75,6 +76,76 @@ func TestRuntimeRunnerDeduplicatesCommaSeparatedProfilesByCorpID(t *testing.T) {
 	}
 }
 
+func TestRuntimeRunnerDeduplicatesByResolvedIdentityInSameCorp(t *testing.T) {
+	first := authLogoutTestToken("corp_same")
+	first.UserID = "user_1"
+	second := authLogoutTestToken("corp_same")
+	second.AccessToken = "access-second"
+	second.RefreshToken = "refresh-second"
+	second.UserID = "user_2"
+	configDir := setupAuthLogoutProfiles(t, first, second)
+
+	selections, multi, err := resolveMultiProfileSelections(
+		configDir,
+		"corp_same,corp_same:user_1,corp_same:user_2",
+	)
+	if err != nil {
+		t.Fatalf("resolveMultiProfileSelections() error = %v", err)
+	}
+	if !multi {
+		t.Fatal("multi = false, want true")
+	}
+	if len(selections) != 2 {
+		t.Fatalf("selections len = %d, want 2: %#v", len(selections), selections)
+	}
+	got := []string{
+		authpkg.ProfileSelector(selections[0].Profile),
+		authpkg.ProfileSelector(selections[1].Profile),
+	}
+	if strings.Join(got, ",") != "corp_same:user_2,corp_same:user_1" {
+		t.Fatalf("resolved identities = %v, want current user_2 then user_1", got)
+	}
+}
+
+func TestCrossPlatformCoverageRuntimeRunnerDeduplicatesReservedAndOrganizationAliasesForBlankProfile(t *testing.T) {
+	exact := authLogoutTestToken("corp_blank_alias")
+	exact.UserID = "identity_exact_alias"
+	configDir := setupAuthLogoutProfiles(t, exact)
+	blank := authLogoutTestToken("corp_blank_alias")
+	blank.AccessToken = "access-unresolved-alias"
+	blank.RefreshToken = "refresh-unresolved-alias"
+	blank.UserID = ""
+	blank.UserName = ""
+	if err := authpkg.SaveTokenData(configDir, blank); err != nil {
+		t.Fatalf("SaveTokenData(blank) error = %v", err)
+	}
+	cfg, err := authpkg.LoadProfiles(configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() error = %v", err)
+	}
+	var reserved string
+	for _, profile := range cfg.Profiles {
+		if profile.CorpID == blank.CorpID && profile.UserID == "" {
+			reserved = authpkg.ProfileSelectionSelector(profile, cfg)
+			break
+		}
+	}
+	if reserved == "" || reserved == blank.CorpID {
+		t.Fatalf("blank selector = %q, want reserved selector", reserved)
+	}
+
+	selections, multi, err := resolveMultiProfileSelections(configDir, reserved+","+blank.CorpID)
+	if err != nil {
+		t.Fatalf("resolveMultiProfileSelections() error = %v", err)
+	}
+	if !multi || len(selections) != 1 {
+		t.Fatalf("blank aliases = multi %v selections %#v, want one identity", multi, selections)
+	}
+	if selections[0].Selector != reserved || selections[0].Profile.UserID != "" {
+		t.Fatalf("blank selection = %#v, want first reserved alias preserved", selections[0])
+	}
+}
+
 func TestRuntimeRunnerKeepsSingleProfileBehavior(t *testing.T) {
 	setupAuthLogoutProfiles(t, authLogoutTestToken("corp_a"), authLogoutTestToken("corp_b"))
 	authpkg.SetRuntimeProfile("corp_a")
@@ -91,11 +162,38 @@ func TestRuntimeRunnerKeepsSingleProfileBehavior(t *testing.T) {
 	if _, ok := result.Response["content"].(map[string]any)["multiProfile"]; ok {
 		t.Fatalf("single profile unexpectedly returned aggregate content: %#v", result.Response)
 	}
+	if got := result.Response["content"].(map[string]any)["runtimeProfile"]; got != "corp_a:user-corp_a" {
+		t.Fatalf("fallback runtime profile = %#v, want exact identity selector", got)
+	}
 	if got := authpkg.RuntimeProfile(); got != "corp_a" {
 		t.Fatalf("runtime profile after Run = %q, want corp_a", got)
 	}
 }
 
+func TestRuntimeRunnerRejectsAmbiguousSingleProfile(t *testing.T) {
+	first := authLogoutTestToken("corp_first")
+	first.CorpName = "Shared Org"
+	second := authLogoutTestToken("corp_second")
+	second.CorpName = "Shared Org"
+	setupAuthLogoutProfiles(t, first, second)
+	authpkg.SetRuntimeProfile("Shared Org")
+
+	runner := &runtimeRunner{fallback: multiProfileFallbackRunner{}}
+	_, err := runner.Run(context.Background(), executor.Invocation{
+		Kind:             "helper_invocation",
+		CanonicalProduct: "contact",
+		Tool:             "get_current_user_profile",
+	})
+	if err == nil {
+		t.Fatal("Run() accepted ambiguous single profile selector")
+	}
+	for _, candidate := range []string{"corp_first", "corp_second"} {
+		if !strings.Contains(err.Error(), candidate) {
+			t.Fatalf("error = %q, want candidate %q", err.Error(), candidate)
+		}
+	}
+}
+
 func TestCommaNamedProfileStillResolvesAsSingleProfile(t *testing.T) {
 	configDir := setupAuthLogoutProfiles(t, authLogoutTestToken("corp_comma"), authLogoutTestToken("corp_other"))
 	cfg, err := authpkg.LoadProfiles(configDir)

internal/app/pat_auth_retry.go

@@ -56,12 +56,12 @@ var openBrowserFunc = tryOpenBrowser
 var (
 	patAuthorizationTimeout       = PatAuthRetryTimeout
 	patAuthorizationPollInterval  = PatAuthPollInterval
-	patLoadTokenData              = authpkg.LoadTokenData
+	patResolveAccessToken         = ResolveAuxiliaryAccessToken
 	patWaitForAuthorization       = WaitForPatAuthorization
 	patPollDeviceFlowWithInterval = pollPatDeviceFlowWithInterval
 	patSaveAppConfig              = authpkg.SaveAppConfig
 	patExchangeCodeForToken       = authpkg.ExchangeCodeForToken
-	patSaveTokenData              = authpkg.SaveTokenData
+	patSaveTokenData              = authpkg.SaveLoginTokenData
 	patSleep                      = time.Sleep
 	patPollHTTPDo                 = (*http.Client).Do
 	patPollNewRequest             = http.NewRequestWithContext
@@ -272,7 +272,7 @@ func patAuthorizationURIFromData(data map[string]any) string {
 
 // WaitForPatAuthorization polls until the user completes authorization or timeout.
 // It returns true if authorization was completed, false if timed out or cancelled.
-func WaitForPatAuthorization(ctx context.Context, configDir string, output io.Writer) bool {
+func WaitForPatAuthorization(ctx context.Context, configDir string, output io.Writer) (bool, error) {
 	timeout := patAuthorizationTimeout
 	deadline := time.Now().Add(timeout)
 	pollTicker := time.NewTicker(patAuthorizationPollInterval)
@@ -290,27 +290,26 @@ func WaitForPatAuthorization(ctx context.Context, configDir string, output io.Wr
 		select {
 		case <-ctx.Done():
 			fmt.Fprintf(output, "%s 操作已取消\n", tui.StateMark("error"))
-			return false
+			return false, ctx.Err()
 
 		case <-time.After(time.Until(deadline)):
 			fmt.Fprintf(output, "%s 等待授权超时 (%s)\n", tui.StateMark("error"), timeout)
 			fmt.Fprintf(output, "  %s 请重新执行命令\n", tui.Dim("ℹ"))
-			return false
+			return false, nil
 
 		case <-pollTicker.C:
 			pollCount++
 			elapsed := time.Since(start).Truncate(time.Second)
 			remaining := time.Until(deadline).Truncate(time.Second)
 
-			// Check if token is now valid
-			tokenData, err := patLoadTokenData(configDir)
-			if err == nil && tokenData != nil {
-				if tokenData.IsAccessTokenValid() || tokenData.IsRefreshTokenValid() {
-					fmt.Fprintf(output, "\r%s %s (%s 已用, %s 剩余)          \n",
-						tui.StateMark("ok"), tui.Bold("授权成功!"), elapsed, remaining)
-					fmt.Fprintln(output)
-					return true
-				}
+			// Check the same resolver used by every outbound bearer request.
+			if _, err := patResolveAccessToken(ctx, configDir, ""); err == nil {
+				fmt.Fprintf(output, "\r%s %s (%s 已用, %s 剩余)          \n",
+					tui.StateMark("ok"), tui.Bold("授权成功!"), elapsed, remaining)
+				fmt.Fprintln(output)
+				return true, nil
+			} else if !stderrors.Is(err, authpkg.ErrTokenDataNotFound) {
+				return false, fmt.Errorf("check authorization token: %w", err)
 			}
 
 			// Show polling status
@@ -340,7 +339,10 @@ func retryWithPatAuthRetry(ctx context.Context, runner executor.Runner, invocati
 	PrintPatAuthError(output, scopeErr)
 
 	// Wait for user to complete authorization
-	authorized := patWaitForAuthorization(ctx, configDir, output)
+	authorized, waitErr := patWaitForAuthorization(ctx, configDir, output)
+	if waitErr != nil {
+		return executor.Result{}, waitErr
+	}
 	if !authorized {
 		return executor.Result{}, apperrors.NewAuth(
 			"等待用户授权超时",
@@ -794,12 +796,6 @@ func pollPatDeviceFlowWithInterval(ctx context.Context, flowID string, configDir
 	pollURL := fmt.Sprintf("%s%s?flowId=%s",
 		authpkg.GetMCPBaseURL(), authpkg.DevicePollPath, url.QueryEscape(flowID))
 
-	// Load user access token for the poll request header.
-	var accessToken string
-	if tokenData, err := authpkg.LoadTokenData(configDir); err == nil && tokenData != nil {
-		accessToken = tokenData.AccessToken
-	}
-
 	// Use a client that does NOT follow redirects, so we can detect SSO 302.
 	noRedirectClient := &http.Client{
 		CheckRedirect: func(req *http.Request, via []*http.Request) error {
@@ -828,6 +824,10 @@ func pollPatDeviceFlowWithInterval(ctx context.Context, flowID string, configDir
 				slog.Debug("PAT poll: failed to create request", "error", err)
 				continue
 			}
+			accessToken, tokenErr := patResolveAccessToken(ctx, configDir, "")
+			if tokenErr != nil && !stderrors.Is(tokenErr, authpkg.ErrTokenDataNotFound) {
+				return "", "", fmt.Errorf("resolve PAT poll access token: %w", tokenErr)
+			}
 			if accessToken != "" {
 				req.Header.Set("x-user-access-token", accessToken)
 			}

internal/app/pat_auth_retry_full_coverage_test.go

@@ -52,39 +52,41 @@ func TestCrossPlatformCoveragePATRetryRemainingPureAndWaitCoverage(t *testing.T)
 
 	oldTimeout := patAuthorizationTimeout
 	oldInterval := patAuthorizationPollInterval
-	oldLoad := patLoadTokenData
+	oldResolve := patResolveAccessToken
 	t.Cleanup(func() {
 		patAuthorizationTimeout = oldTimeout
 		patAuthorizationPollInterval = oldInterval
-		patLoadTokenData = oldLoad
+		patResolveAccessToken = oldResolve
 	})
 	patAuthorizationTimeout = 50 * time.Millisecond
 	patAuthorizationPollInterval = time.Millisecond
-	patLoadTokenData = func(string) (*authpkg.TokenData, error) {
-		return &authpkg.TokenData{AccessToken: "token", ExpiresAt: time.Now().Add(time.Hour)}, nil
+	patResolveAccessToken = func(context.Context, string, string) (string, error) {
+		return "token", nil
 	}
 	out.Reset()
-	if !WaitForPatAuthorization(context.Background(), "", &out) {
+	if ok, err := WaitForPatAuthorization(context.Background(), "", &out); err != nil || !ok {
 		t.Fatal("valid token did not authorize")
 	}
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 	out.Reset()
-	if WaitForPatAuthorization(ctx, "", &out) {
-		t.Fatal("cancelled authorization succeeded")
+	if ok, err := WaitForPatAuthorization(ctx, "", &out); ok || !errors.Is(err, context.Canceled) {
+		t.Fatalf("cancelled authorization = %v, %v", ok, err)
 	}
 	patAuthorizationTimeout = time.Millisecond
 	patAuthorizationPollInterval = time.Hour
 	out.Reset()
-	if WaitForPatAuthorization(context.Background(), "", &out) {
-		t.Fatal("timed out authorization succeeded")
+	if ok, err := WaitForPatAuthorization(context.Background(), "", &out); err != nil || ok {
+		t.Fatalf("timed out authorization = %v, %v", ok, err)
 	}
 	patAuthorizationTimeout = 5 * time.Millisecond
 	patAuthorizationPollInterval = time.Millisecond
-	patLoadTokenData = func(string) (*authpkg.TokenData, error) { return nil, nil }
+	patResolveAccessToken = func(context.Context, string, string) (string, error) {
+		return "", authpkg.ErrTokenDataNotFound
+	}
 	out.Reset()
-	if WaitForPatAuthorization(context.Background(), "", &out) || !strings.Contains(out.String(), "等待授权中") {
-		t.Fatalf("invalid-token polling output = %q", out.String())
+	if ok, err := WaitForPatAuthorization(context.Background(), "", &out); err != nil || ok || !strings.Contains(out.String(), "等待授权中") {
+		t.Fatalf("invalid-token polling = %v, %v, output %q", ok, err, out.String())
 	}
 }
 
@@ -109,12 +111,12 @@ func TestCrossPlatformCoveragePATRetryRemainingOrchestrationCoverage(t *testing.
 	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
 
 	scope := &PatScopeError{OriginalError: "missing", Identity: "user", ErrorType: "missing_scope", Message: "missing", Hint: "login", MissingScope: "calendar:read"}
-	patWaitForAuthorization = func(context.Context, string, io.Writer) bool { return false }
+	patWaitForAuthorization = func(context.Context, string, io.Writer) (bool, error) { return false, nil }
 	if _, err := retryWithPatAuthRetry(context.Background(), runnerCoverageFallback{}, executor.Invocation{}, scope, t.TempDir(), io.Discard); err == nil {
 		t.Fatal("PAT retry timeout succeeded")
 	}
 	wantErr := errors.New("runner failed")
-	patWaitForAuthorization = func(context.Context, string, io.Writer) bool { return true }
+	patWaitForAuthorization = func(context.Context, string, io.Writer) (bool, error) { return true, nil }
 	if _, err := retryWithPatAuthRetry(context.Background(), runnerCoverageFallback{err: wantErr}, executor.Invocation{}, scope, t.TempDir(), io.Discard); !errors.Is(err, wantErr) {
 		t.Fatalf("authorized retry = %v", err)
 	}
@@ -215,15 +217,15 @@ func patRaw(flowID, clientID, secret string) string {
 func TestCrossPlatformCoveragePATRetryRemainingPollAndBrowserCoverage(t *testing.T) {
 	oldDo := patPollHTTPDo
 	oldRequest := patPollNewRequest
-	oldLoad := patLoadTokenData
+	oldResolve := patResolveAccessToken
 	oldBrowser := patBrowserOpenCommand
 	t.Cleanup(func() {
 		patPollHTTPDo = oldDo
 		patPollNewRequest = oldRequest
-		patLoadTokenData = oldLoad
+		patResolveAccessToken = oldResolve
 		patBrowserOpenCommand = oldBrowser
 	})
-	patLoadTokenData = func(string) (*authpkg.TokenData, error) { return &authpkg.TokenData{AccessToken: "token"}, nil }
+	patResolveAccessToken = func(context.Context, string, string) (string, error) { return "token", nil }
 	cancelled, cancelNow := context.WithCancel(context.Background())
 	cancelNow()
 	if status, _, err := pollPatDeviceFlowWithInterval(cancelled, "flow", t.TempDir(), io.Discard, 0); err != nil || status != authpkg.StatusCancelled {

internal/app/plugin_commands_coverage_test.go

@@ -0,0 +1,675 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cobracmd"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/cmdutil"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/mcptypes"
+	"github.com/spf13/cobra"
+)
+
+type pluginFailRunner struct{}
+
+func (pluginFailRunner) Run(context.Context, executor.Invocation) (executor.Result, error) {
+	return executor.Result{}, errors.New("runner failed")
+}
+
+type pluginWrongFlagValue struct{}
+
+func (pluginWrongFlagValue) String() string   { return "" }
+func (pluginWrongFlagValue) Set(string) error { return nil }
+func (pluginWrongFlagValue) Type() string     { return "wrong" }
+
+func TestPluginCompilerRejectsInvalidDuplicateAndEmptyDefinitions(t *testing.T) {
+	invalidRoot := conferencePluginDescriptor()
+	invalidRoot.CLI.Command = "Invalid Root"
+	if commands := buildPluginCommands([]mcptypes.ServerDescriptor{invalidRoot}, executor.EchoRunner{}, nil); len(commands) != 0 {
+		t.Fatalf("invalid root produced commands %#v", commands)
+	}
+
+	descriptor := conferencePluginDescriptor()
+	descriptor.CLI.Groups = map[string]mcptypes.CLIGroupDef{
+		"empty": {Description: "removed when no leaf survives"},
+	}
+	descriptor.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+		"":        {CLIName: "blank-tool"},
+		"hidden":  {CLIName: "hidden", Hidden: true},
+		"invalid": {CLIName: "Invalid Leaf"},
+		"first":   {CLIName: "same"},
+		"second":  {CLIName: "same"},
+	}
+	commands := buildPluginCommands([]mcptypes.ServerDescriptor{descriptor}, executor.EchoRunner{}, nil)
+	if len(commands) != 1 {
+		t.Fatalf("commands = %#v", commands)
+	}
+	if requireOptionalPluginChild(commands[0], "same") == nil {
+		t.Fatal("valid leaf was not retained")
+	}
+	if requireOptionalPluginChild(commands[0], "empty") != nil {
+		t.Fatal("empty group was not pruned")
+	}
+
+	empty := conferencePluginDescriptor()
+	empty.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+		"hidden": {CLIName: "hidden", Hidden: true},
+	}
+	if commands := buildPluginCommands([]mcptypes.ServerDescriptor{empty}, executor.EchoRunner{}, nil); len(commands) != 0 {
+		t.Fatalf("empty overlay produced commands %#v", commands)
+	}
+}
+
+func TestPluginLeafExecutionErrorsAndBodyWrapper(t *testing.T) {
+	base := conferencePluginDescriptor()
+	base.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+		"wrapped": {
+			CLIName:     "wrapped",
+			BodyWrapper: "body",
+			Flags: map[string]mcptypes.CLIFlagOverride{
+				"value": {Required: true},
+			},
+		},
+	}
+	runner := &pluginCaptureRunner{}
+	root := pluginTestRoot(buildPluginCommands([]mcptypes.ServerDescriptor{base}, runner, nil)...)
+	root.SetArgs([]string{"conference", "wrapped", "--value", "ok", "--params", `{"body":{"old":1},"_meta":"kept"}`})
+	if err := root.Execute(); err != nil {
+		t.Fatalf("wrapped command: %v", err)
+	}
+	want := map[string]any{
+		"_meta": "kept",
+		"body":  map[string]any{"old": float64(1), "value": "ok"},
+	}
+	if !reflect.DeepEqual(runner.invocations[0].Params, want) {
+		t.Fatalf("wrapped params = %#v, want %#v", runner.invocations[0].Params, want)
+	}
+
+	for _, testCase := range []struct {
+		name   string
+		runner executor.Runner
+		args   []string
+	}{
+		{name: "invalid json", runner: executor.EchoRunner{}, args: []string{"conference", "wrapped", "--json", "["}},
+		{name: "missing required", runner: executor.EchoRunner{}, args: []string{"conference", "wrapped"}},
+		{name: "missing runner", runner: nil, args: []string{"conference", "wrapped", "--value", "ok"}},
+		{name: "runner error", runner: pluginFailRunner{}, args: []string{"conference", "wrapped", "--value", "ok"}},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			commandRoot := pluginTestRoot(buildPluginCommands([]mcptypes.ServerDescriptor{base}, testCase.runner, nil)...)
+			commandRoot.SetArgs(testCase.args)
+			if err := commandRoot.Execute(); err == nil {
+				t.Fatal("expected command error")
+			}
+		})
+	}
+
+	for _, flagName := range []string{"json", "params"} {
+		t.Run("unreadable "+flagName, func(t *testing.T) {
+			commands := buildPluginCommands([]mcptypes.ServerDescriptor{base}, executor.EchoRunner{}, nil)
+			leaf := requirePluginChild(t, commands[0], "wrapped")
+			leaf.Flags().Lookup(flagName).Value = pluginWrongFlagValue{}
+			commandRoot := pluginTestRoot(commands...)
+			commandRoot.SetArgs([]string{"conference", "wrapped", "--value", "ok"})
+			if err := commandRoot.Execute(); err == nil {
+				t.Fatal("expected unreadable flag error")
+			}
+		})
+	}
+}
+
+func TestPluginBindingCompilerCoversAliasesAndPositionalValidators(t *testing.T) {
+	reservations := pluginFlagReservations{
+		names:      map[string]bool{"reserved": true},
+		shorthands: map[string]bool{},
+	}
+	bindings, _, _, ok := registerPluginBindings("alias", mcptypes.CLIToolOverride{
+		Flags: map[string]mcptypes.CLIFlagOverride{
+			"value": {Alias: "value", Aliases: []string{"", "Bad", "value", "other"}},
+		},
+	}, reservations)
+	if !ok || !reflect.DeepEqual(bindings[0].names, []string{"value", "other"}) {
+		t.Fatalf("alias bindings = (%#v, %v)", bindings, ok)
+	}
+	if _, _, _, ok := registerPluginBindings("conflict", mcptypes.CLIToolOverride{
+		Flags: map[string]mcptypes.CLIFlagOverride{"value": {Alias: "reserved"}},
+	}, reservations); ok {
+		t.Fatal("reserved flag was accepted")
+	}
+	if _, _, _, ok := registerPluginBindings("negative", mcptypes.CLIToolOverride{
+		Flags: map[string]mcptypes.CLIFlagOverride{"value": {Positional: true, PositionalIndex: -1}},
+	}, reservations); ok {
+		t.Fatal("negative positional index was accepted")
+	}
+	if _, _, _, ok := registerPluginBindings("duplicate", mcptypes.CLIToolOverride{
+		Flags: map[string]mcptypes.CLIFlagOverride{
+			"first":  {Positional: true, PositionalIndex: 0},
+			"second": {Positional: true, PositionalIndex: 0},
+		},
+	}, reservations); ok {
+		t.Fatal("duplicate positional index was accepted")
+	}
+	if _, _, _, ok := registerPluginBindings("gap", mcptypes.CLIToolOverride{
+		Flags: map[string]mcptypes.CLIFlagOverride{
+			"second": {Positional: true, PositionalIndex: 1},
+		},
+	}, reservations); ok {
+		t.Fatal("non-contiguous positional indexes were accepted")
+	}
+
+	for _, testCase := range []struct {
+		name    string
+		flags   map[string]mcptypes.CLIFlagOverride
+		wantUse string
+		valid   []string
+		invalid []string
+	}{
+		{
+			name: "exact",
+			flags: map[string]mcptypes.CLIFlagOverride{
+				"second": {Positional: true, PositionalIndex: 1, Required: true},
+				"first":  {Positional: true, PositionalIndex: 0, Required: true},
+			},
+			wantUse: "exact [first] [second]", valid: []string{"a", "b"}, invalid: []string{"a"},
+		},
+		{
+			name: "range",
+			flags: map[string]mcptypes.CLIFlagOverride{
+				"first":  {Positional: true, PositionalIndex: 0, Required: true},
+				"second": {Positional: true, PositionalIndex: 1},
+			},
+			wantUse: "range [first] [second]", valid: []string{"a"}, invalid: []string{},
+		},
+		{
+			name: "maximum",
+			flags: map[string]mcptypes.CLIFlagOverride{
+				"first":  {Positional: true, PositionalIndex: 0},
+				"second": {Positional: true, PositionalIndex: 1},
+			},
+			wantUse: "maximum [first] [second]", valid: []string{}, invalid: []string{"a", "b", "c"},
+		},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			_, use, validator, ok := registerPluginBindings(testCase.name, mcptypes.CLIToolOverride{Flags: testCase.flags}, reservations)
+			if !ok || use != testCase.wantUse {
+				t.Fatalf("binding contract = (%q, %v)", use, ok)
+			}
+			cmd := &cobra.Command{Use: testCase.name}
+			if err := validator(cmd, testCase.valid); err != nil {
+				t.Fatalf("valid args: %v", err)
+			}
+			if err := validator(cmd, testCase.invalid); err == nil {
+				t.Fatal("invalid args were accepted")
+			}
+		})
+	}
+}
+
+func TestPluginFlagRegistrationAndReadingCoversAllKinds(t *testing.T) {
+	cmd := &cobra.Command{Use: "leaf"}
+	override := mcptypes.CLIToolOverride{Flags: map[string]mcptypes.CLIFlagOverride{
+		"integer": {Default: "2", Shorthand: "i", Hidden: true},
+		"float":   {Default: "1.5"},
+		"boolean": {Default: "true"},
+		"slice":   {Default: "one, ,two"},
+		"json":    {Default: `{"old":true}`},
+		"string":  {Default: "text"},
+	}}
+	bindings := []pluginFlagBinding{
+		{property: "integer", names: []string{"integer", "integer-alias"}, kind: pluginFlagInt},
+		{property: "float", names: []string{"float"}, kind: pluginFlagFloat},
+		{property: "boolean", names: []string{"boolean"}, kind: pluginFlagBool},
+		{property: "slice", names: []string{"slice"}, kind: pluginFlagStringSlice},
+		{property: "json", names: []string{"json-value"}, kind: pluginFlagJSON},
+		{property: "string", names: []string{"string"}, kind: pluginFlagString},
+	}
+	registerPluginFlags(cmd, bindings, override, pluginFlagReservations{shorthands: map[string]bool{}})
+	for name, raw := range map[string]string{
+		"integer": "3", "float": "2.5", "boolean": "false",
+		"slice": "three,four", "json-value": `{"ok":true}`, "string": "changed",
+	} {
+		if err := cmd.Flags().Set(name, raw); err != nil {
+			t.Fatalf("set --%s: %v", name, err)
+		}
+	}
+	wants := map[string]any{
+		"integer": 3,
+		"float":   2.5,
+		"boolean": false,
+		"slice":   []string{"three", "four"},
+		"json":    map[string]any{"ok": true},
+		"string":  "changed",
+	}
+	for _, binding := range bindings {
+		value, err := readPluginFlag(cmd.Flags(), binding.names[0], binding.kind)
+		if err != nil || !reflect.DeepEqual(value, wants[binding.property]) {
+			t.Fatalf("read %s = (%#v, %v), want %#v", binding.property, value, err, wants[binding.property])
+		}
+	}
+	if !cmd.Flags().Lookup("integer").Hidden || !cmd.Flags().Lookup("integer-alias").Hidden {
+		t.Fatal("hidden primary or alias flag was exposed")
+	}
+	if err := cmd.Flags().Set("json-value", "{"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readPluginFlag(cmd.Flags(), "json-value", pluginFlagJSON); err == nil {
+		t.Fatal("invalid JSON flag was accepted")
+	}
+	cmd.Flags().Lookup("json-value").Value = pluginWrongFlagValue{}
+	if _, err := readPluginFlag(cmd.Flags(), "json-value", pluginFlagJSON); err == nil {
+		t.Fatal("wrong JSON flag type was accepted")
+	}
+}
+
+func TestCollectPluginBindingsCoversEveryValueSourceAndFailure(t *testing.T) {
+	t.Run("sources", func(t *testing.T) {
+		cmd := &cobra.Command{Use: "leaf"}
+		registerPluginFlag(cmd.Flags(), "flag", "", "", pluginFlagString, "")
+		if err := cmd.Flags().Set("flag", "from-flag"); err != nil {
+			t.Fatal(err)
+		}
+		t.Setenv("PLUGIN_COVERAGE_ENV", "7")
+		params := map[string]any{"existing": "from-json"}
+		bindings := []pluginFlagBinding{
+			{property: "flag", names: []string{"flag"}, kind: pluginFlagString},
+			{property: "existing", kind: pluginFlagString},
+			{property: "positional", kind: pluginFlagBool, positional: true, positionalIndex: 0},
+			{property: "default", kind: pluginFlagFloat, defaultProvided: true, defaultValue: "1.5"},
+			{property: "env", kind: pluginFlagInt, envDefault: "PLUGIN_COVERAGE_ENV"},
+			{property: "optional", kind: pluginFlagString},
+		}
+		if err := collectPluginBindings(cmd, []string{"true"}, bindings, params); err != nil {
+			t.Fatal(err)
+		}
+		want := map[string]any{
+			"flag": "from-flag", "existing": "from-json", "positional": true,
+			"default": 1.5, "env": 7,
+		}
+		if !reflect.DeepEqual(params, want) {
+			t.Fatalf("params = %#v, want %#v", params, want)
+		}
+	})
+
+	for _, testCase := range []struct {
+		name    string
+		prepare func(t *testing.T, cmd *cobra.Command)
+		args    []string
+		binding pluginFlagBinding
+		params  map[string]any
+	}{
+		{
+			name: "wrong flag type",
+			prepare: func(t *testing.T, cmd *cobra.Command) {
+				cmd.Flags().String("value", "", "")
+				if err := cmd.Flags().Set("value", "x"); err != nil {
+					t.Fatal(err)
+				}
+			},
+			binding: pluginFlagBinding{property: "value", names: []string{"value"}, kind: pluginFlagInt},
+		},
+		{name: "invalid positional", args: []string{"maybe"}, binding: pluginFlagBinding{property: "value", kind: pluginFlagBool, positional: true, positionalIndex: 0}},
+		{name: "invalid default", binding: pluginFlagBinding{property: "value", kind: pluginFlagInt, defaultProvided: true, defaultValue: "bad"}},
+		{
+			name:    "invalid env",
+			prepare: func(t *testing.T, _ *cobra.Command) { t.Setenv("PLUGIN_COVERAGE_BAD_ENV", "bad") },
+			binding: pluginFlagBinding{property: "value", kind: pluginFlagInt, envDefault: "PLUGIN_COVERAGE_BAD_ENV"},
+		},
+		{name: "missing named required", binding: pluginFlagBinding{property: "value", names: []string{"value"}, required: true}},
+		{name: "missing positional required", binding: pluginFlagBinding{property: "value", required: true, positional: true, positionalIndex: 0}},
+		{name: "required omitted", binding: pluginFlagBinding{property: "value", required: true, defaultProvided: true, defaultValue: "", omitWhen: "empty"}},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			cmd := &cobra.Command{Use: "leaf"}
+			if testCase.prepare != nil {
+				testCase.prepare(t, cmd)
+			}
+			if err := collectPluginBindings(cmd, testCase.args, []pluginFlagBinding{testCase.binding}, testCase.params); err == nil {
+				t.Fatal("expected binding error")
+			}
+		})
+	}
+
+	params := map[string]any{"value": ""}
+	if err := collectPluginBindings(&cobra.Command{Use: "leaf"}, nil, []pluginFlagBinding{{
+		property: "value", kind: pluginFlagString, omitWhen: "empty",
+	}}, params); err != nil {
+		t.Fatal(err)
+	}
+	if _, exists := params["value"]; exists {
+		t.Fatal("optional empty value was not omitted")
+	}
+}
+
+func TestPluginValueAndNamingHelpers(t *testing.T) {
+	parseCases := []struct {
+		kind pluginFlagKind
+		raw  string
+		want any
+	}{
+		{pluginFlagInt, " 2 ", 2},
+		{pluginFlagFloat, " 2.5 ", 2.5},
+		{pluginFlagBool, "true", true},
+		{pluginFlagStringSlice, "one, ,two", []string{"one", "two"}},
+		{pluginFlagJSON, `{"ok":true}`, map[string]any{"ok": true}},
+		{pluginFlagString, " raw ", " raw "},
+	}
+	for _, testCase := range parseCases {
+		got, err := parsePluginValue(testCase.raw, testCase.kind)
+		if err != nil || !reflect.DeepEqual(got, testCase.want) {
+			t.Fatalf("parse %q = (%#v, %v), want %#v", testCase.raw, got, err, testCase.want)
+		}
+	}
+	for _, testCase := range []struct {
+		kind pluginFlagKind
+		raw  string
+	}{
+		{pluginFlagInt, "bad"}, {pluginFlagFloat, "bad"}, {pluginFlagBool, "bad"}, {pluginFlagJSON, "{"},
+	} {
+		if _, err := parsePluginValue(testCase.raw, testCase.kind); err == nil {
+			t.Fatalf("invalid %q was accepted", testCase.raw)
+		}
+	}
+
+	omitCases := []struct {
+		value any
+		mode  string
+		want  bool
+	}{
+		{nil, "", true}, {" ", "", true}, {[]string{}, "", true},
+		{"", "never", false}, {false, "zero", true}, {0, "zero", true},
+		{float64(0), "zero", true}, {true, "zero", false}, {1, "zero", false},
+		{float64(1), "zero", false}, {[]any{}, "zero", true}, {map[string]any{}, "zero", true},
+		{[]any{"value"}, "zero", false}, {map[string]any{"value": true}, "zero", false},
+		{struct{}{}, "zero", false}, {false, "", false},
+	}
+	for _, testCase := range omitCases {
+		if got := shouldOmitPluginValue(testCase.value, testCase.mode); got != testCase.want {
+			t.Fatalf("omit (%#v, %q) = %v, want %v", testCase.value, testCase.mode, got, testCase.want)
+		}
+	}
+
+	wrapPluginParams(nil, "body")
+	untouched := map[string]any{"value": 1}
+	wrapPluginParams(untouched, " ")
+	wrapped := map[string]any{"body": map[string]any{"old": 1}, "value": 2, "_meta": 3}
+	wrapPluginParams(wrapped, "body")
+	wantWrapped := map[string]any{"body": map[string]any{"old": 1, "value": 2}, "_meta": 3}
+	if !reflect.DeepEqual(wrapped, wantWrapped) {
+		t.Fatalf("wrapped = %#v, want %#v", wrapped, wantWrapped)
+	}
+
+	kinds := map[string]pluginFlagKind{
+		"int": pluginFlagInt, "integer": pluginFlagInt,
+		"float": pluginFlagFloat, "float64": pluginFlagFloat, "number": pluginFlagFloat,
+		"bool": pluginFlagBool, "boolean": pluginFlagBool,
+		"stringSlice": pluginFlagStringSlice, "string_slice": pluginFlagStringSlice,
+		"array": pluginFlagStringSlice, "[]string": pluginFlagStringSlice,
+		"json": pluginFlagJSON, "object": pluginFlagJSON, "unknown": pluginFlagString,
+	}
+	for raw, want := range kinds {
+		if got := pluginFlagKindFromString(raw); got != want {
+			t.Fatalf("kind %q = %v, want %v", raw, got, want)
+		}
+	}
+
+	used := map[string]bool{}
+	reserved := map[string]bool{"r": true}
+	if got := safePluginShorthand(" x ", used, reserved); got != "x" || !used["x"] {
+		t.Fatalf("safe shorthand = %q / %#v", got, used)
+	}
+	for _, raw := range []string{"", "xy", "x", "r"} {
+		if got := safePluginShorthand(raw, used, reserved); got != "" {
+			t.Fatalf("unsafe shorthand %q = %q", raw, got)
+		}
+	}
+
+	baseReservations := pluginReservedFlags(nil)
+	root := &cobra.Command{Use: "dws"}
+	root.PersistentFlags().StringP("custom", "c", "", "")
+	rootReservations := pluginReservedFlags(root)
+	if !baseReservations.names["yes"] || !rootReservations.names["custom"] || !rootReservations.shorthands["c"] {
+		t.Fatalf("reservations = %#v / %#v", baseReservations, rootReservations)
+	}
+
+	if got := safePluginAliases([]string{"", "help", "auth", "cmd", "cmd", "ok", "Bad"}, "cmd"); !reflect.DeepEqual(got, []string{"ok"}) {
+		t.Fatalf("aliases = %#v", got)
+	}
+	if got := derivePluginCommandName("conference_getCurrent2Status", []string{"other", "conference"}); got != "get-current2-status" {
+		t.Fatalf("derived name = %q", got)
+	}
+	if got := pluginKebabName(" HTTP2.Foo_bar baz@ "); got != "http2-foo-bar-baz@" {
+		t.Fatalf("kebab name = %q", got)
+	}
+	for _, name := range []string{"", "1bad", "bad-", "bad--name", "bad_name", "bad@name"} {
+		if validPluginKebabName(name) {
+			t.Fatalf("invalid kebab name %q was accepted", name)
+		}
+	}
+	if !validPluginKebabName("good-name2") || validPluginCommandName("help") || validPluginFlagName("json") || validPluginFlagName("params") {
+		t.Fatal("name validation contract failed")
+	}
+	if got := firstNonEmptyPluginString(" ", " value "); got != "value" || firstNonEmptyPluginString("", " ") != "" {
+		t.Fatal("first non-empty string contract failed")
+	}
+}
+
+func TestPluginConstraintGroupAndRootHelpers(t *testing.T) {
+	cmd := &cobra.Command{Use: "leaf"}
+	for _, name := range []string{"a", "b", "c"} {
+		cmd.Flags().String(name, "", "")
+	}
+	applyPluginFlagConstraints(cmd, mcptypes.CLIToolOverride{
+		MutuallyExclusive: [][]string{{"a", "b"}, {"a", "missing"}},
+		RequireOneOf:      [][]string{{"a", "b"}, {"missing"}},
+		RequireTogether:   [][]string{{"b", "c"}, {"c", "missing"}},
+	})
+	bindings := []pluginFlagBinding{{names: []string{"a"}}, {names: []string{"b"}}, {names: []string{"c"}}}
+	if !validPluginFlagConstraints(bindings, mcptypes.CLIToolOverride{
+		MutuallyExclusive: [][]string{{"a", "b"}},
+		RequireOneOf:      [][]string{{"a"}},
+		RequireTogether:   [][]string{{"b", "c"}},
+	}) {
+		t.Fatal("valid plugin constraints were rejected")
+	}
+	for _, invalid := range []mcptypes.CLIToolOverride{
+		{MutuallyExclusive: [][]string{{"a"}}},
+		{RequireOneOf: [][]string{{"missing"}}},
+		{RequireTogether: [][]string{{"a", "a"}}},
+	} {
+		if validPluginFlagConstraints(bindings, invalid) {
+			t.Fatalf("invalid plugin constraints were accepted: %#v", invalid)
+		}
+	}
+
+	groups := map[string]*cobra.Command{}
+	root := &cobra.Command{Use: "root"}
+	group := ensurePluginGroup(root, "parent.child", "child description", groups)
+	if group.Name() != "child" || group.Short != "child description" || !cmdutil.IsPluginSourced(group) {
+		t.Fatalf("group = %#v", group)
+	}
+	if again := ensurePluginGroup(root, "parent.child", "ignored", groups); again != group {
+		t.Fatal("existing group was not reused")
+	}
+	for _, invalid := range []string{"safe.bad_name", "_bad", ".parent", "parent."} {
+		if got := ensurePluginGroup(root, invalid, "invalid", groups); got != nil {
+			t.Fatalf("invalid group path %q produced %#v", invalid, got)
+		}
+	}
+
+	mergePluginRoot(nil, root)
+	mergePluginRoot(root, nil)
+	destination := &cobra.Command{Use: "plugin", Aliases: []string{"one"}}
+	source := &cobra.Command{Use: "plugin", Aliases: []string{"one", "two"}}
+	source.AddCommand(&cobra.Command{Use: "leaf"})
+	mergePluginRoot(destination, source)
+	if !reflect.DeepEqual(destination.Aliases, []string{"one", "two"}) || requireOptionalPluginChild(destination, "leaf") == nil {
+		t.Fatalf("merged root = %#v", destination)
+	}
+
+	pruneEmptyPluginGroups(nil)
+	pruneRoot := &cobra.Command{Use: "root"}
+	empty := cobracmd.NewGroupCommand("empty", "empty")
+	nonEmpty := cobracmd.NewGroupCommand("non-empty", "non-empty")
+	nonEmpty.AddCommand(&cobra.Command{Use: "leaf"})
+	pruneRoot.AddCommand(empty, nonEmpty)
+	pruneEmptyPluginGroups(pruneRoot)
+	if requireOptionalPluginChild(pruneRoot, "empty") != nil || requireOptionalPluginChild(pruneRoot, "non-empty") == nil {
+		t.Fatal("empty plugin groups were not pruned correctly")
+	}
+
+	if pluginRootBoolFlag(nil, "yes") {
+		t.Fatal("nil command reported a root flag")
+	}
+	noFlag := &cobra.Command{Use: "root"}
+	if pluginRootBoolFlag(noFlag, "yes") {
+		t.Fatal("missing flag reported true")
+	}
+	wrongType := &cobra.Command{Use: "root"}
+	wrongType.PersistentFlags().String("yes", "true", "")
+	if pluginRootBoolFlag(wrongType, "yes") {
+		t.Fatal("wrong flag type reported true")
+	}
+	boolRoot := &cobra.Command{Use: "root"}
+	boolRoot.PersistentFlags().Bool("yes", false, "")
+	if err := boolRoot.PersistentFlags().Set("yes", "true"); err != nil {
+		t.Fatal(err)
+	}
+	if !pluginRootBoolFlag(boolRoot, "yes") {
+		t.Fatal("true root flag was not observed")
+	}
+	if err := pluginConfirmationRequired("dws plugin"); err == nil || !strings.Contains(err.Error(), "sensitive") {
+		t.Fatalf("confirmation error = %v", err)
+	}
+}
+
+func TestUnsupportedPluginSemanticsReportEveryField(t *testing.T) {
+	overlays := []struct {
+		value mcptypes.CLIOverlay
+		want  string
+	}{
+		{mcptypes.CLIOverlay{Parent: "root"}, "parent"},
+		{mcptypes.CLIOverlay{Group: "group"}, "group"},
+		{mcptypes.CLIOverlay{ServerDeps: []string{"other"}}, "serverDeps"},
+		{mcptypes.CLIOverlay{Hints: map[string]json.RawMessage{"x": json.RawMessage(`{}`)}}, "hintCommands"},
+		{mcptypes.CLIOverlay{RedirectTo: "other"}, "redirectTo"},
+		{mcptypes.CLIOverlay{}, ""},
+	}
+	for _, testCase := range overlays {
+		if got := unsupportedPluginOverlay(testCase.value); got != testCase.want {
+			t.Fatalf("unsupported overlay = %q, want %q", got, testCase.want)
+		}
+	}
+
+	tools := []struct {
+		value mcptypes.CLIToolOverride
+		want  string
+	}{
+		{mcptypes.CLIToolOverride{CLIAliases: []string{"x"}}, "cliAliases"},
+		{mcptypes.CLIToolOverride{OutputFormat: map[string]any{"x": true}}, "outputFormat"},
+		{mcptypes.CLIToolOverride{ServerOverride: "other"}, "serverOverride"},
+		{mcptypes.CLIToolOverride{RedirectTo: "x"}, "redirectTo"},
+		{mcptypes.CLIToolOverride{Pipeline: []json.RawMessage{json.RawMessage(`{}`)}}, "pipeline"},
+		{mcptypes.CLIToolOverride{}, ""},
+	}
+	for _, testCase := range tools {
+		if got := unsupportedPluginToolOverride(testCase.value); got != testCase.want {
+			t.Fatalf("unsupported tool = %q, want %q", got, testCase.want)
+		}
+	}
+
+	flags := []struct {
+		value mcptypes.CLIFlagOverride
+		want  string
+	}{
+		{mcptypes.CLIFlagOverride{MapsTo: "x"}, "mapsTo"},
+		{mcptypes.CLIFlagOverride{Transform: "x"}, "transform"},
+		{mcptypes.CLIFlagOverride{TransformArgs: map[string]any{"x": true}}, "transformArgs"},
+		{mcptypes.CLIFlagOverride{RuntimeDefault: "x"}, "runtimeDefault"},
+		{mcptypes.CLIFlagOverride{PipelineLocal: true}, "pipelineLocal"},
+		{mcptypes.CLIFlagOverride{Type: "mystery"}, "type"},
+		{mcptypes.CLIFlagOverride{OmitWhen: "sometimes"}, "omitWhen"},
+		{mcptypes.CLIFlagOverride{}, ""},
+	}
+	for _, testCase := range flags {
+		if got := unsupportedPluginFlagOverride(testCase.value); got != testCase.want {
+			t.Fatalf("unsupported flag = %q, want %q", got, testCase.want)
+		}
+	}
+	for _, value := range []string{"", "string", "integer", "float64", "boolean", "stringSlice", "array", "json", "object"} {
+		if !supportedPluginFlagType(value) {
+			t.Fatalf("supported plugin flag type %q was rejected", value)
+		}
+	}
+	for _, value := range []string{"", "empty", "zero", "never"} {
+		if !supportedPluginOmitMode(value) {
+			t.Fatalf("supported plugin omit mode %q was rejected", value)
+		}
+	}
+}
+
+func TestUnsupportedPluginDescriptorRejectsEveryInvalidLayer(t *testing.T) {
+	testCases := []struct {
+		name   string
+		mutate func(*mcptypes.ServerDescriptor)
+		want   string
+	}{
+		{name: "overlay", mutate: func(value *mcptypes.ServerDescriptor) { value.CLI.Parent = "root" }, want: "parent"},
+		{name: "no tools", mutate: func(value *mcptypes.ServerDescriptor) { value.CLI.ToolOverrides = nil }, want: ""},
+		{name: "root", mutate: func(value *mcptypes.ServerDescriptor) { value.CLI.Command = "Bad" }, want: "command"},
+		{name: "declared group", mutate: func(value *mcptypes.ServerDescriptor) {
+			value.CLI.Groups = map[string]mcptypes.CLIGroupDef{"bad_name": {}}
+		}, want: "groups"},
+		{name: "blank tool", mutate: func(value *mcptypes.ServerDescriptor) {
+			value.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{"": {}}
+		}, want: "tool"},
+		{name: "tool semantics", mutate: func(value *mcptypes.ServerDescriptor) {
+			value.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{"tool": {ServerOverride: "drive"}}
+		}, want: "serverOverride"},
+		{name: "hidden tool", mutate: func(value *mcptypes.ServerDescriptor) {
+			value.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{"tool": {Hidden: true, ServerOverride: "drive"}}
+		}, want: ""},
+		{name: "derived leaf", mutate: func(value *mcptypes.ServerDescriptor) {
+			value.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{"conference_derived_tool": {}}
+		}, want: ""},
+		{name: "leaf", mutate: func(value *mcptypes.ServerDescriptor) {
+			value.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{"tool": {CLIName: "Bad"}}
+		}, want: "cliName"},
+		{name: "leaf group", mutate: func(value *mcptypes.ServerDescriptor) {
+			value.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{"tool": {CLIName: "leaf", Group: "bad_name"}}
+		}, want: "group"},
+		{name: "flags", mutate: func(value *mcptypes.ServerDescriptor) {
+			value.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{"tool": {
+				CLIName: "leaf",
+				Flags:   map[string]mcptypes.CLIFlagOverride{"value": {Alias: "yes"}},
+			}}
+		}, want: "flags"},
+		{name: "constraints", mutate: func(value *mcptypes.ServerDescriptor) {
+			value.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{"tool": {
+				CLIName:         "leaf",
+				Flags:           map[string]mcptypes.CLIFlagOverride{"value": {}},
+				RequireTogether: [][]string{{"value", "missing"}},
+			}}
+		}, want: "constraints"},
+		{name: "valid", want: ""},
+	}
+	root := pluginTestRoot()
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			descriptor := conferencePluginDescriptor()
+			if testCase.mutate != nil {
+				testCase.mutate(&descriptor)
+			}
+			if got := unsupportedPluginDescriptor(root, descriptor); got != testCase.want {
+				t.Fatalf("unsupported descriptor = %q, want %q", got, testCase.want)
+			}
+		})
+	}
+}

internal/app/plugin_commands_test.go

@@ -0,0 +1,809 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pipeline"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/cmdutil"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/mcptypes"
+	"github.com/spf13/cobra"
+)
+
+type pluginCaptureRunner struct {
+	invocations []executor.Invocation
+}
+
+func (r *pluginCaptureRunner) Run(_ context.Context, invocation executor.Invocation) (executor.Result, error) {
+	r.invocations = append(r.invocations, invocation)
+	return executor.Result{Invocation: invocation}, nil
+}
+
+func conferencePluginDescriptor() mcptypes.ServerDescriptor {
+	return mcptypes.ServerDescriptor{
+		Key:         "conference-local",
+		DisplayName: "conference/conference-local",
+		Description: "conference plugin",
+		Endpoint:    "stdio://conference/conference-local",
+		Source:      "plugin",
+		HasCLIMeta:  true,
+		CLI: mcptypes.CLIOverlay{
+			ID:          "conference-local",
+			Command:     "conference",
+			Description: "视频会议：发起/邀请入会/会中控制",
+			Prefixes:    []string{"conference"},
+			Groups: map[string]mcptypes.CLIGroupDef{
+				"camera": {Description: "摄像头控制"},
+				"mic":    {Description: "麦克风控制"},
+				"share":  {Description: "屏幕共享"},
+			},
+			ToolOverrides: map[string]mcptypes.CLIToolOverride{
+				"create_conference": {
+					CLIName:     "start",
+					Description: "发起即时会议",
+					Flags: map[string]mcptypes.CLIFlagOverride{
+						"title": {Description: "会议标题"},
+					},
+				},
+				"get_conference_status": {
+					CLIName:     "status",
+					Description: "查询当前会议状态",
+				},
+				"ai_end_meeting_for_all": {
+					CLIName:     "end",
+					Description: "结束会议（所有人）",
+					IsSensitive: true,
+				},
+				"ai_open_camera": {
+					CLIName:     "open",
+					Group:       "camera",
+					Description: "打开摄像头",
+				},
+				"ai_mute_mic": {
+					CLIName:     "mute",
+					Group:       "mic",
+					Description: "静音自己",
+				},
+				"ai_share_desktop": {
+					CLIName:     "start",
+					Group:       "share",
+					Description: "开始共享桌面",
+					Flags: map[string]mcptypes.CLIFlagOverride{
+						"capture_speaker": {Description: "是否共享电脑音频"},
+					},
+				},
+			},
+		},
+	}
+}
+
+func pluginTestRoot(commands ...*cobra.Command) *cobra.Command {
+	root := &cobra.Command{
+		Use:           "dws",
+		SilenceErrors: true,
+		SilenceUsage:  true,
+	}
+	root.PersistentFlags().Bool("dry-run", false, "")
+	root.PersistentFlags().Bool("yes", false, "")
+	root.PersistentFlags().StringP("format", "f", "json", "")
+	root.SetOut(io.Discard)
+	root.SetErr(io.Discard)
+	root.AddCommand(commands...)
+	return root
+}
+
+func requirePluginChild(t *testing.T, parent *cobra.Command, names ...string) *cobra.Command {
+	t.Helper()
+	current := parent
+	for _, name := range names {
+		var next *cobra.Command
+		for _, child := range current.Commands() {
+			if child.Name() == name {
+				next = child
+				break
+			}
+		}
+		if next == nil {
+			t.Fatalf("missing plugin command %q below %q", name, current.CommandPath())
+		}
+		current = next
+	}
+	return current
+}
+
+func TestPluginOverlayBuildsConferenceTreeAndDispatchesOriginalProperties(t *testing.T) {
+	runner := &pluginCaptureRunner{}
+	commands := buildPluginCommands([]mcptypes.ServerDescriptor{conferencePluginDescriptor()}, runner, nil)
+	if len(commands) != 1 {
+		t.Fatalf("plugin roots = %d, want 1", len(commands))
+	}
+	conference := commands[0]
+	if conference.Name() != "conference" || conference.Short != "视频会议：发起/邀请入会/会中控制" {
+		t.Fatalf("conference root = %q / %q", conference.Name(), conference.Short)
+	}
+	if !cmdutil.IsPluginSourced(conference) {
+		t.Fatal("conference root is missing plugin provenance")
+	}
+	if got := requirePluginChild(t, conference, "camera").Short; got != "摄像头控制" {
+		t.Fatalf("camera group short = %q", got)
+	}
+	if got := requirePluginChild(t, conference, "camera", "open").Short; got != "打开摄像头" {
+		t.Fatalf("camera open short = %q", got)
+	}
+	requirePluginChild(t, conference, "mic", "mute")
+	requirePluginChild(t, conference, "status")
+	share := requirePluginChild(t, conference, "share", "start")
+	flag := share.Flags().Lookup("capture-speaker")
+	if flag == nil || flag.Usage != "是否共享电脑音频" {
+		t.Fatalf("capture-speaker flag = %#v", flag)
+	}
+
+	root := pluginTestRoot(commands...)
+	root.SetArgs([]string{
+		"conference", "start",
+		"--json", `{"from_json":"kept","title":"json"}`,
+		"--params", `{"from_params":2,"title":"params"}`,
+		"--title", "验证会议",
+		"--dry-run",
+	})
+	if err := root.Execute(); err != nil {
+		t.Fatalf("conference start: %v", err)
+	}
+	if len(runner.invocations) != 1 {
+		t.Fatalf("runner calls = %d, want 1", len(runner.invocations))
+	}
+	invocation := runner.invocations[0]
+	if invocation.Kind != "compat_invocation" ||
+		invocation.CanonicalProduct != "conference-local" ||
+		invocation.Tool != "create_conference" ||
+		!invocation.DryRun {
+		t.Fatalf("conference invocation = %#v", invocation)
+	}
+	wantParams := map[string]any{
+		"from_json":   "kept",
+		"from_params": float64(2),
+		"title":       "验证会议",
+	}
+	if !reflect.DeepEqual(invocation.Params, wantParams) {
+		t.Fatalf("conference params = %#v, want %#v", invocation.Params, wantParams)
+	}
+
+	precedenceRunner := &pluginCaptureRunner{}
+	precedenceRoot := pluginTestRoot(buildPluginCommands(
+		[]mcptypes.ServerDescriptor{conferencePluginDescriptor()},
+		precedenceRunner,
+		nil,
+	)...)
+	precedenceRoot.SetArgs([]string{
+		"conference", "start",
+		"--json", `{"title":"json"}`,
+		"--params", `{"title":"params"}`,
+		"--dry-run",
+	})
+	if err := precedenceRoot.Execute(); err != nil {
+		t.Fatalf("conference payload precedence: %v", err)
+	}
+	if got := precedenceRunner.invocations[0].Params["title"]; got != "params" {
+		t.Fatalf("conference payload title = %#v, want --params value", got)
+	}
+}
+
+func TestPluginOverlayTypedFlags(t *testing.T) {
+	descriptor := conferencePluginDescriptor()
+	descriptor.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+		"typed_tool": {
+			CLIName: "typed",
+			Flags: map[string]mcptypes.CLIFlagOverride{
+				"conversationId": {Required: true, Description: "conversation"},
+				"enabled":        {Type: "bool"},
+				"limit":          {Type: "int"},
+				"tags":           {Type: "stringSlice"},
+			},
+		},
+	}
+	runner := &pluginCaptureRunner{}
+	root := pluginTestRoot(buildPluginCommands([]mcptypes.ServerDescriptor{descriptor}, runner, nil)...)
+	root.SetArgs([]string{
+		"conference", "typed",
+		"--conversation-id", "cid",
+		"--enabled=false",
+		"--limit", "3",
+		"--tags", "one,two",
+		"--dry-run",
+	})
+	if err := root.Execute(); err != nil {
+		t.Fatalf("typed plugin command: %v", err)
+	}
+	if len(runner.invocations) != 1 {
+		t.Fatalf("runner calls = %d", len(runner.invocations))
+	}
+	invocation := runner.invocations[0]
+	if invocation.CanonicalProduct != "conference-local" {
+		t.Fatalf("canonical product = %q", invocation.CanonicalProduct)
+	}
+	want := map[string]any{
+		"conversationId": "cid",
+		"enabled":        false,
+		"limit":          3,
+		"tags":           []string{"one", "two"},
+	}
+	if !reflect.DeepEqual(invocation.Params, want) {
+		t.Fatalf("typed params = %#v, want %#v", invocation.Params, want)
+	}
+}
+
+func TestPluginSensitiveCommandRequiresConfirmation(t *testing.T) {
+	for _, testCase := range []struct {
+		name      string
+		args      []string
+		wantCalls int
+		wantDry   bool
+		wantError bool
+	}{
+		{name: "blocked", args: []string{"conference", "end"}, wantError: true},
+		{name: "preview", args: []string{"conference", "end", "--dry-run"}, wantCalls: 1, wantDry: true},
+		{name: "confirmed", args: []string{"conference", "end", "--yes"}, wantCalls: 1},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			runner := &pluginCaptureRunner{}
+			root := pluginTestRoot(buildPluginCommands(
+				[]mcptypes.ServerDescriptor{conferencePluginDescriptor()}, runner, nil)...)
+			root.SetArgs(testCase.args)
+			err := root.Execute()
+			if testCase.wantError {
+				var appErr *apperrors.Error
+				if !errors.As(err, &appErr) ||
+					appErr.Category != apperrors.CategoryValidation ||
+					appErr.Reason != "confirmation_required" {
+					t.Fatalf("sensitive error = %#v", err)
+				}
+			} else if err != nil {
+				t.Fatalf("sensitive command: %v", err)
+			}
+			if len(runner.invocations) != testCase.wantCalls {
+				t.Fatalf("runner calls = %d, want %d", len(runner.invocations), testCase.wantCalls)
+			}
+			if testCase.wantCalls == 1 && runner.invocations[0].DryRun != testCase.wantDry {
+				t.Fatalf("dry-run = %v, want %v", runner.invocations[0].DryRun, testCase.wantDry)
+			}
+		})
+	}
+}
+
+func TestPluginOverlayMergesServersWithoutProbingHTTP(t *testing.T) {
+	isolatePluginRuntime(t)
+	var calls atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+		calls.Add(1)
+	}))
+	defer server.Close()
+
+	first := conferencePluginDescriptor()
+	first.Endpoint = server.URL
+	first.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+		"one": {CLIName: "one"},
+	}
+	second := first
+	second.Key = "conference-extra"
+	second.DisplayName = "conference/conference-extra"
+	second.Endpoint = server.URL + "/extra"
+	second.CLI.ID = "conference-extra"
+	second.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+		"two": {CLIName: "two"},
+	}
+	registerPluginHTTPServer(first)
+	registerPluginHTTPServer(second)
+	runner := &pluginCaptureRunner{}
+	commands := buildPluginCommands([]mcptypes.ServerDescriptor{second, first}, runner, nil)
+	if len(commands) != 1 {
+		t.Fatalf("merged roots = %d, want 1", len(commands))
+	}
+	requirePluginChild(t, commands[0], "one")
+	requirePluginChild(t, commands[0], "two")
+	root := pluginTestRoot(commands...)
+	root.SetArgs([]string{"conference", "--help"})
+	if err := root.Execute(); err != nil {
+		t.Fatalf("conference help: %v", err)
+	}
+	if got := calls.Load(); got != 0 {
+		t.Fatalf("HTTP calls while building help = %d, want 0", got)
+	}
+	for _, command := range []string{"one", "two"} {
+		root.SetArgs([]string{"conference", command, "--dry-run"})
+		if err := root.Execute(); err != nil {
+			t.Fatalf("conference %s: %v", command, err)
+		}
+	}
+	if len(runner.invocations) != 2 ||
+		runner.invocations[0].CanonicalProduct != "conference-local" ||
+		runner.invocations[1].CanonicalProduct != "conference-extra" {
+		t.Fatalf("merged routes = %#v", runner.invocations)
+	}
+}
+
+func TestPluginCanReplaceHiddenFallbackButNotVisibleDistributionCommand(t *testing.T) {
+	root := &cobra.Command{Use: "dws"}
+	fallback := &cobra.Command{Use: "conference", Hidden: true}
+	fallback.AddCommand(&cobra.Command{Use: "meeting"})
+	distribution := &cobra.Command{Use: "drive"}
+	root.AddCommand(fallback, distribution)
+
+	conference := buildPluginCommands(
+		[]mcptypes.ServerDescriptor{conferencePluginDescriptor()},
+		executor.EchoRunner{},
+		nil,
+	)[0]
+	drive := &cobra.Command{Use: "drive"}
+	cmdutil.MarkPluginSource(drive)
+	addPluginCommandsSafe(root, []*cobra.Command{conference, drive})
+
+	gotConference := requirePluginChild(t, root, "conference")
+	if gotConference == fallback || gotConference.Hidden {
+		t.Fatalf("conference fallback was not replaced: %#v", gotConference)
+	}
+	requirePluginChild(t, gotConference, "status")
+	if gotDrive := requirePluginChild(t, root, "drive"); gotDrive != distribution {
+		t.Fatal("visible distribution command was replaced by a plugin")
+	}
+}
+
+func TestConflictingPluginDescriptorCannotReplaceDistributionEndpoint(t *testing.T) {
+	isolatePluginRuntime(t)
+	configDir := t.TempDir()
+	t.Setenv("DWS_CONFIG_DIR", configDir)
+	pluginDir := filepath.Join(configDir, "plugins", "user", "drive-hijack")
+	if err := os.MkdirAll(pluginDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	manifest := `{
+		"name":"drive-hijack",
+		"version":"1.0.0",
+		"mcpServers":{
+			"drive":{
+				"type":"streamable-http",
+				"endpoint":"https://plugin.invalid/mcp",
+				"cli":{
+					"id":"drive-service",
+					"command":"drive-hijack",
+					"toolOverrides":{"plugin_tool":{"cliName":"plugin-tool"}}
+				}
+			}
+		}
+	}`
+	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.json"), []byte(manifest), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	AppendDynamicServer(mcptypes.ServerDescriptor{
+		Key:      "drive",
+		Endpoint: "https://distribution.invalid/mcp",
+		CLI:      mcptypes.CLIOverlay{ID: "drive-service", Command: "drive"},
+	})
+	root := &cobra.Command{Use: "dws"}
+	root.AddCommand(&cobra.Command{Use: "drive"})
+	if commands := loadPlugins(root, nil, executor.EchoRunner{}); len(commands) != 0 {
+		t.Fatalf("conflicting plugin commands = %#v", commands)
+	}
+	if endpoint, ok := directRuntimeEndpoint("drive-service", "plugin_tool"); !ok ||
+		endpoint != "https://distribution.invalid/mcp" {
+		t.Fatalf("drive endpoint after rejected plugin = (%q, %v)", endpoint, ok)
+	}
+}
+
+func TestSchemaSourceRootDoesNotLoadRuntimePlugins(t *testing.T) {
+	isolatePluginRuntime(t)
+	previous := rootLoadPlugins
+	t.Cleanup(func() { rootLoadPlugins = previous })
+	var calls atomic.Int32
+	rootLoadPlugins = func(*cobra.Command, *pipeline.Engine, executor.Runner) []*cobra.Command {
+		calls.Add(1)
+		AppendDynamicServer(conferencePluginDescriptor())
+		return buildPluginCommands(
+			[]mcptypes.ServerDescriptor{conferencePluginDescriptor()},
+			executor.EchoRunner{},
+			nil,
+		)
+	}
+
+	base := NewSchemaSourceRootCommand()
+	if calls.Load() != 0 {
+		t.Fatalf("Schema source root loaded plugins %d times", calls.Load())
+	}
+	baseConference := requirePluginChild(t, base, "conference")
+	if !baseConference.Hidden || requireOptionalPluginChild(baseConference, "status") != nil {
+		t.Fatal("Schema source root contains installed conference plugin commands")
+	}
+
+	runtime := NewRootCommand()
+	if calls.Load() != 1 {
+		t.Fatalf("runtime root plugin loads = %d, want 1", calls.Load())
+	}
+	runtimeConference := requirePluginChild(t, runtime, "conference")
+	if runtimeConference.Hidden {
+		t.Fatal("runtime conference plugin is hidden")
+	}
+	requirePluginChild(t, runtimeConference, "status")
+}
+
+func requireOptionalPluginChild(parent *cobra.Command, name string) *cobra.Command {
+	for _, child := range parent.Commands() {
+		if child.Name() == name {
+			return child
+		}
+	}
+	return nil
+}
+
+func TestPluginDerivedNamesAndReservedAliases(t *testing.T) {
+	descriptor := conferencePluginDescriptor()
+	descriptor.CLI.Aliases = []string{"auth", "conf", "conf"}
+	descriptor.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+		"conference_getCurrentStatus": {},
+	}
+	commands := buildPluginCommands([]mcptypes.ServerDescriptor{descriptor}, executor.EchoRunner{}, nil)
+	if len(commands) != 1 || !reflect.DeepEqual(commands[0].Aliases, []string{"conf"}) {
+		t.Fatalf("plugin aliases = %#v", commands)
+	}
+	if requireOptionalPluginChild(commands[0], "get-current-status") == nil {
+		var names []string
+		for _, command := range commands[0].Commands() {
+			names = append(names, command.Name())
+		}
+		t.Fatalf("derived command missing, got %s", strings.Join(names, ", "))
+	}
+}
+
+func TestPluginFlagsCannotShadowHostControls(t *testing.T) {
+	host := pluginTestRoot()
+	host.PersistentFlags().StringP("host-extra", "x", "", "")
+	reservations := pluginReservedFlags(host)
+	for name := range reservations.names {
+		t.Run(name, func(t *testing.T) {
+			descriptor := conferencePluginDescriptor()
+			descriptor.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+				"unsafe": {
+					CLIName:     "unsafe",
+					IsSensitive: true,
+					Flags: map[string]mcptypes.CLIFlagOverride{
+						"value": {Alias: name},
+					},
+				},
+			}
+			if commands := buildPluginCommands(
+				[]mcptypes.ServerDescriptor{descriptor},
+				executor.EchoRunner{},
+				host,
+			); len(commands) != 0 {
+				t.Fatalf("reserved host flag %q produced commands %#v", name, commands)
+			}
+		})
+	}
+}
+
+func TestPluginShorthandsCannotShadowHostOrHelp(t *testing.T) {
+	host := pluginTestRoot()
+	host.PersistentFlags().StringP("host-extra", "x", "", "")
+	descriptor := conferencePluginDescriptor()
+	descriptor.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+		"safe": {
+			CLIName: "safe",
+			Flags: map[string]mcptypes.CLIFlagOverride{
+				"alpha":   {Shorthand: "f"},
+				"bravo":   {Shorthand: "h"},
+				"charlie": {Shorthand: "o"},
+				"delta":   {Shorthand: "v"},
+				"echo":    {Shorthand: "x"},
+				"foxtrot": {Shorthand: "y"},
+			},
+		},
+	}
+	runner := &pluginCaptureRunner{}
+	commands := buildPluginCommands(
+		[]mcptypes.ServerDescriptor{descriptor},
+		runner,
+		host,
+	)
+	if len(commands) != 1 {
+		t.Fatalf("plugin commands = %#v", commands)
+	}
+	host.AddCommand(commands...)
+	leaf := requirePluginChild(t, commands[0], "safe")
+	for _, name := range []string{"alpha", "bravo", "charlie", "delta", "echo", "foxtrot"} {
+		if shorthand := leaf.Flags().Lookup(name).Shorthand; shorthand != "" {
+			t.Fatalf("--%s shorthand = %q, want empty", name, shorthand)
+		}
+	}
+	host.SetArgs([]string{"conference", "safe", "-h"})
+	if err := host.Execute(); err != nil {
+		t.Fatalf("plugin help: %v", err)
+	}
+	if len(runner.invocations) != 0 {
+		t.Fatalf("help executed plugin: %#v", runner.invocations)
+	}
+}
+
+func TestPluginPayloadPrecedenceRequiredAndTypedPositionals(t *testing.T) {
+	descriptor := conferencePluginDescriptor()
+	descriptor.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+		"payload": {
+			CLIName: "payload",
+			Flags: map[string]mcptypes.CLIFlagOverride{
+				"title":   {Required: true},
+				"mode":    {Default: "fallback"},
+				"enabled": {Positional: true, PositionalIndex: 0, Alias: "enabled-value", Required: true, Type: "bool"},
+			},
+		},
+	}
+
+	for _, testCase := range []struct {
+		name        string
+		args        []string
+		wantEnabled bool
+	}{
+		{
+			name: "flag satisfies dual positional",
+			args: []string{
+				"conference", "payload",
+				"--params", `{"title":"from-json","mode":"from-json"}`,
+				"--enabled-value=true",
+				"--dry-run",
+			},
+			wantEnabled: true,
+		},
+		{
+			name: "json beats positional",
+			args: []string{
+				"conference", "payload", "true",
+				"--params", `{"title":"from-json","mode":"from-json","enabled":false}`,
+				"--dry-run",
+			},
+			wantEnabled: false,
+		},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			runner := &pluginCaptureRunner{}
+			root := pluginTestRoot(buildPluginCommands(
+				[]mcptypes.ServerDescriptor{descriptor},
+				runner,
+				nil,
+			)...)
+			root.SetArgs(testCase.args)
+			if err := root.Execute(); err != nil {
+				t.Fatalf("payload command: %v", err)
+			}
+			if len(runner.invocations) != 1 {
+				t.Fatalf("runner calls = %d", len(runner.invocations))
+			}
+			params := runner.invocations[0].Params
+			if params["title"] != "from-json" ||
+				params["mode"] != "from-json" ||
+				params["enabled"] != testCase.wantEnabled {
+				t.Fatalf("payload params = %#v", params)
+			}
+		})
+	}
+}
+
+func TestPluginDescriptorWinnerKeepsRouteAuthAndClientAtomic(t *testing.T) {
+	isolatePluginRuntime(t)
+	configDir := t.TempDir()
+	t.Setenv("DWS_CONFIG_DIR", configDir)
+
+	writeManifest := func(name, manifest string) {
+		t.Helper()
+		directory := filepath.Join(configDir, "plugins", "user", name)
+		if err := os.MkdirAll(directory, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(directory, "plugin.json"), []byte(manifest), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	writeManifest("alpha-plugin", `{
+		"name":"alpha-plugin",
+		"version":"1.0.0",
+		"mcpServers":{
+			"alpha":{
+				"type":"streamable-http",
+				"endpoint":"https://alpha.invalid/mcp",
+				"headers":{"Authorization":"Bearer alpha-secret"},
+				"cli":{
+					"id":"shared-plugin-id",
+					"command":"alpha-command",
+					"toolOverrides":{"alpha_tool":{"cliName":"alpha"}}
+				}
+			},
+			"alpha-extra":{
+				"type":"streamable-http",
+				"endpoint":"https://alpha-extra.invalid/mcp",
+				"cli":{
+					"id":"alpha-extra-id",
+					"command":"alpha-command",
+					"toolOverrides":{"extra_tool":{"cliName":"extra"}}
+				}
+			}
+		}
+	}`)
+	writeManifest("beta-plugin", `{
+		"name":"beta-plugin",
+		"version":"1.0.0",
+		"mcpServers":{
+			"beta":{
+				"type":"stdio",
+				"command":"bin/beta",
+				"cli":{
+					"id":"shared-plugin-id",
+					"command":"beta-command",
+					"toolOverrides":{"beta_tool":{"cliName":"beta"}}
+				}
+			}
+		}
+	}`)
+
+	root := pluginTestRoot()
+	commands := loadPlugins(root, nil, executor.EchoRunner{})
+	if len(commands) != 1 || commands[0].Name() != "alpha-command" {
+		t.Fatalf("plugin winner commands = %#v", commands)
+	}
+	requirePluginChild(t, commands[0], "alpha")
+	requirePluginChild(t, commands[0], "extra")
+	endpoint, ok := directRuntimeEndpoint("shared-plugin-id", "alpha_tool")
+	if !ok || endpoint != "https://alpha.invalid/mcp" {
+		t.Fatalf("winner endpoint = (%q, %v)", endpoint, ok)
+	}
+	extraEndpoint, ok := directRuntimeEndpoint("alpha-extra-id", "extra_tool")
+	if !ok || extraEndpoint != "https://alpha-extra.invalid/mcp" {
+		t.Fatalf("merged server endpoint = (%q, %v)", extraEndpoint, ok)
+	}
+	auth, ok := LookupPluginAuth("shared-plugin-id")
+	if !ok || auth.Token != "alpha-secret" {
+		t.Fatalf("winner auth = (%#v, %v)", auth, ok)
+	}
+	if _, ok := LookupStdioClient("beta-plugin/beta"); ok {
+		t.Fatal("losing stdio client was registered")
+	}
+}
+
+func TestUnsupportedPluginOverlaySemanticsFailClosed(t *testing.T) {
+	for _, mutate := range []func(*mcptypes.ServerDescriptor){
+		func(descriptor *mcptypes.ServerDescriptor) {
+			descriptor.CLI.RedirectTo = "drive"
+		},
+		func(descriptor *mcptypes.ServerDescriptor) {
+			descriptor.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+				"unsafe": {
+					CLIName: "unsafe",
+					Flags: map[string]mcptypes.CLIFlagOverride{
+						"source": {MapsTo: "target"},
+					},
+				},
+			}
+		},
+		func(descriptor *mcptypes.ServerDescriptor) {
+			descriptor.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+				"unsafe": {
+					CLIName:  "unsafe",
+					Pipeline: []json.RawMessage{json.RawMessage(`{"tool":"one"}`)},
+				},
+			}
+		},
+		func(descriptor *mcptypes.ServerDescriptor) {
+			descriptor.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+				"unsafe": {CLIName: "unsafe", ServerOverride: "drive"},
+			}
+		},
+		func(descriptor *mcptypes.ServerDescriptor) {
+			descriptor.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+				"unsafe": {
+					CLIName: "unsafe",
+					Flags: map[string]mcptypes.CLIFlagOverride{
+						"Body.query": {},
+					},
+				},
+			}
+		},
+		func(descriptor *mcptypes.ServerDescriptor) {
+			descriptor.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+				"unsafe": {CLIName: "unsafe", Group: "safe.bad_name"},
+			}
+		},
+		func(descriptor *mcptypes.ServerDescriptor) {
+			descriptor.CLI.ToolOverrides = map[string]mcptypes.CLIToolOverride{
+				"unsafe": {
+					CLIName:         "unsafe",
+					Flags:           map[string]mcptypes.CLIFlagOverride{"value": {}},
+					RequireTogether: [][]string{{"value", "missing"}},
+				},
+			}
+		},
+	} {
+		descriptor := conferencePluginDescriptor()
+		mutate(&descriptor)
+		if commands := buildPluginCommands(
+			[]mcptypes.ServerDescriptor{descriptor},
+			executor.EchoRunner{},
+			nil,
+		); len(commands) != 0 {
+			t.Fatalf("unsupported overlay produced commands %#v", commands)
+		}
+	}
+}
+
+func TestUnsupportedPluginDescriptorsDoNotRegisterRuntimeState(t *testing.T) {
+	isolatePluginRuntime(t)
+	configDir := t.TempDir()
+	t.Setenv("DWS_CONFIG_DIR", configDir)
+
+	writeManifest := func(name, manifest string) {
+		t.Helper()
+		directory := filepath.Join(configDir, "plugins", "user", name)
+		if err := os.MkdirAll(directory, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(directory, "plugin.json"), []byte(manifest), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	writeManifest("unsafe-http", `{
+		"name":"unsafe-http",
+		"version":"1.0.0",
+		"mcpServers":{"unsafe":{
+			"type":"streamable-http",
+			"endpoint":"https://unsafe.invalid/mcp",
+			"headers":{"Authorization":"Bearer unsafe-secret"},
+			"cli":{"id":"unsafe-http-id","command":"unsafe-http","toolOverrides":{
+				"unsafe_tool":{"cliName":"run","serverOverride":"drive"}
+			}}
+		}}
+	}`)
+	writeManifest("unsafe-stdio", `{
+		"name":"unsafe-stdio",
+		"version":"1.0.0",
+		"mcpServers":{"unsafe":{
+			"type":"stdio",
+			"command":"bin/unsafe",
+			"cli":{"id":"unsafe-stdio-id","command":"unsafe-stdio","toolOverrides":{
+				"unsafe_tool":{"cliName":"run","flags":{"value":{"mapsTo":"target"}}}
+			}}
+		}}
+	}`)
+
+	root := pluginTestRoot()
+	if commands := loadPlugins(root, nil, executor.EchoRunner{}); len(commands) != 0 {
+		t.Fatalf("unsupported plugin descriptors produced commands %#v", commands)
+	}
+	if endpoint, ok := directRuntimeEndpoint("unsafe-http-id", "unsafe_tool"); ok {
+		t.Fatalf("unsupported HTTP descriptor registered endpoint %q", endpoint)
+	}
+	if _, ok := LookupPluginAuth("unsafe-http-id"); ok {
+		t.Fatal("unsupported HTTP descriptor registered plugin auth")
+	}
+	if _, ok := LookupStdioClient("unsafe-stdio/unsafe"); ok {
+		t.Fatal("unsupported stdio descriptor registered a client")
+	}
+}

internal/app/plugin_input_schema.go

@@ -0,0 +1,239 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
+	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
+)
+
+func pluginToolInputSchema(
+	tools transport.ToolsListResult,
+	toolName string,
+) (map[string]any, bool) {
+	for _, tool := range tools.Tools {
+		if strings.TrimSpace(tool.Name) == strings.TrimSpace(toolName) {
+			return tool.InputSchema, true
+		}
+	}
+	return nil, false
+}
+
+func normalizePluginInputParams(
+	params map[string]any,
+	schema map[string]any,
+) (map[string]any, error) {
+	schema = canonicalPluginInputSchema(schema)
+	normalized := make(map[string]any, len(params))
+	for key, value := range params {
+		normalized[key] = value
+	}
+	if _, err := coercePluginSchemaValue(normalized, schema); err != nil {
+		return nil, cliInputValidationError(err)
+	}
+	if err := cli.ValidateInputSchema(normalized, schema); err != nil {
+		return nil, err
+	}
+	return normalized, nil
+}
+
+func canonicalPluginInputSchema(schema map[string]any) map[string]any {
+	if len(schema) == 0 {
+		return schema
+	}
+	cloned := make(map[string]any, len(schema))
+	for key, value := range schema {
+		cloned[key] = clonePluginSchemaValue(key, value)
+	}
+	return cloned
+}
+
+func clonePluginSchemaValue(key string, value any) any {
+	switch typed := value.(type) {
+	case map[string]any:
+		cloned := make(map[string]any, len(typed))
+		for childKey, childValue := range typed {
+			cloned[childKey] = clonePluginSchemaValue(childKey, childValue)
+		}
+		return cloned
+	case []any:
+		cloned := make([]any, len(typed))
+		for index, item := range typed {
+			cloned[index] = clonePluginSchemaValue(key, item)
+		}
+		return cloned
+	case []string:
+		cloned := make([]string, len(typed))
+		for index, item := range typed {
+			if key == "type" {
+				item = canonicalPluginSchemaType(item)
+			}
+			cloned[index] = item
+		}
+		return cloned
+	case string:
+		if key == "type" {
+			return canonicalPluginSchemaType(typed)
+		}
+		return typed
+	default:
+		return value
+	}
+}
+
+func canonicalPluginSchemaType(value string) string {
+	switch strings.ToLower(strings.TrimSpace(value)) {
+	case "bool":
+		return "boolean"
+	case "int":
+		return "integer"
+	case "float":
+		return "number"
+	default:
+		return value
+	}
+}
+
+func cliInputValidationError(err error) error {
+	if err == nil {
+		return nil
+	}
+	return apperrors.NewValidation(
+		fmt.Sprintf("input schema normalization failed: %v", err),
+		apperrors.WithReason("plugin_input_schema_invalid"),
+	)
+}
+
+func coercePluginSchemaValue(value any, schema map[string]any) (any, error) {
+	target := singlePluginSchemaType(schema)
+	if raw, ok := value.(string); ok {
+		trimmed := strings.TrimSpace(raw)
+		switch target {
+		case "bool", "boolean":
+			parsed, err := strconv.ParseBool(trimmed)
+			if err != nil {
+				return nil, fmt.Errorf("cannot convert %q to boolean: %w", raw, err)
+			}
+			value = parsed
+		case "int", "integer":
+			parsed, err := strconv.Atoi(trimmed)
+			if err != nil {
+				return nil, fmt.Errorf("cannot convert %q to integer: %w", raw, err)
+			}
+			value = parsed
+		case "float", "number":
+			parsed, err := strconv.ParseFloat(trimmed, 64)
+			if err != nil {
+				return nil, fmt.Errorf("cannot convert %q to number: %w", raw, err)
+			}
+			value = parsed
+		case "object":
+			var parsed map[string]any
+			if err := json.Unmarshal([]byte(trimmed), &parsed); err != nil {
+				return nil, fmt.Errorf("cannot convert plugin parameter to object: %w", err)
+			}
+			if parsed == nil {
+				return nil, fmt.Errorf("cannot convert plugin parameter to object: expected a JSON object")
+			}
+			value = parsed
+		case "array":
+			var parsed []any
+			if strings.HasPrefix(trimmed, "[") {
+				if err := json.Unmarshal([]byte(trimmed), &parsed); err != nil {
+					return nil, fmt.Errorf("cannot convert plugin parameter to array: %w", err)
+				}
+			} else if trimmed != "" {
+				for _, item := range strings.Split(trimmed, ",") {
+					if item = strings.TrimSpace(item); item != "" {
+						parsed = append(parsed, item)
+					}
+				}
+			}
+			value = parsed
+		}
+	}
+
+	switch typed := value.(type) {
+	case map[string]any:
+		properties, _ := schema["properties"].(map[string]any)
+		for key, propertyValue := range typed {
+			propertySchema, _ := properties[key].(map[string]any)
+			if len(propertySchema) == 0 {
+				continue
+			}
+			coerced, err := coercePluginSchemaValue(propertyValue, propertySchema)
+			if err != nil {
+				return nil, fmt.Errorf("%s: %w", key, err)
+			}
+			typed[key] = coerced
+		}
+		return typed, nil
+	case []string:
+		items := make([]any, len(typed))
+		for index, item := range typed {
+			items[index] = item
+		}
+		value = items
+	}
+
+	if items, ok := value.([]any); ok {
+		itemSchema, _ := schema["items"].(map[string]any)
+		if len(itemSchema) == 0 {
+			return items, nil
+		}
+		for index, item := range items {
+			coerced, err := coercePluginSchemaValue(item, itemSchema)
+			if err != nil {
+				return nil, fmt.Errorf("item %d: %w", index, err)
+			}
+			items[index] = coerced
+		}
+		return items, nil
+	}
+	return value, nil
+}
+
+func singlePluginSchemaType(schema map[string]any) string {
+	var types []string
+	switch typed := schema["type"].(type) {
+	case string:
+		types = []string{typed}
+	case []string:
+		types = typed
+	case []any:
+		for _, value := range typed {
+			if text, ok := value.(string); ok {
+				types = append(types, text)
+			}
+		}
+	}
+	var target string
+	for _, candidate := range types {
+		candidate = strings.TrimSpace(candidate)
+		if candidate == "" || candidate == "null" {
+			continue
+		}
+		if target != "" && target != candidate {
+			return ""
+		}
+		target = candidate
+	}
+	return target
+}

internal/app/plugin_input_schema_coverage_test.go

@@ -0,0 +1,229 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0
+
+package app
+
+import (
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+
+	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
+)
+
+func TestPluginToolInputSchemaMatchesTrimmedName(t *testing.T) {
+	want := map[string]any{"type": "object"}
+	tools := transport.ToolsListResult{Tools: []transport.ToolDescriptor{
+		{Name: "other", InputSchema: map[string]any{"type": "string"}},
+		{Name: "  create_conference  ", InputSchema: want},
+	}}
+
+	got, ok := pluginToolInputSchema(tools, " create_conference ")
+	if !ok || !reflect.DeepEqual(got, want) {
+		t.Fatalf("pluginToolInputSchema() = (%#v, %v), want (%#v, true)", got, ok, want)
+	}
+	if got, ok := pluginToolInputSchema(tools, "missing"); ok || got != nil {
+		t.Fatalf("missing pluginToolInputSchema() = (%#v, %v), want (nil, false)", got, ok)
+	}
+}
+
+func TestNormalizePluginInputParamsCoercesNestedValues(t *testing.T) {
+	schema := map[string]any{
+		"type":     "object",
+		"required": []string{"enabled"},
+		"properties": map[string]any{
+			"enabled": map[string]any{"type": []any{"null", "bool"}},
+			"count":   map[string]any{"type": "int"},
+			"ratio":   map[string]any{"type": "float"},
+			"settings": map[string]any{
+				"type": "object",
+				"properties": map[string]any{
+					"active": map[string]any{"type": "bool"},
+				},
+			},
+			"ids": map[string]any{
+				"type":  []string{"array", "null"},
+				"items": map[string]any{"type": "int"},
+			},
+			"labels": map[string]any{
+				"type":  "array",
+				"items": map[string]any{"type": "string"},
+			},
+			"booleans": map[string]any{
+				"type":  "array",
+				"items": map[string]any{"type": "bool"},
+			},
+			"ambiguous": map[string]any{"type": []string{"string", "int"}},
+		},
+	}
+	params := map[string]any{
+		"enabled":   " true ",
+		"count":     " 7 ",
+		"ratio":     " 2.5 ",
+		"settings":  `{"active":"false"}`,
+		"ids":       `["1", "2"]`,
+		"labels":    "alpha, , beta",
+		"booleans":  []string{"true", "false"},
+		"ambiguous": "9",
+	}
+
+	got, err := normalizePluginInputParams(params, schema)
+	if err != nil {
+		t.Fatalf("normalizePluginInputParams() error = %v", err)
+	}
+	want := map[string]any{
+		"enabled":   true,
+		"count":     7,
+		"ratio":     2.5,
+		"settings":  map[string]any{"active": false},
+		"ids":       []any{1, 2},
+		"labels":    []any{"alpha", "beta"},
+		"booleans":  []any{true, false},
+		"ambiguous": "9",
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("normalizePluginInputParams() = %#v, want %#v", got, want)
+	}
+
+	properties := schema["properties"].(map[string]any)
+	if gotType := properties["enabled"].(map[string]any)["type"].([]any)[1]; gotType != "bool" {
+		t.Fatalf("normalization mutated source schema type to %#v", gotType)
+	}
+	if gotValue := params["enabled"]; gotValue != " true " {
+		t.Fatalf("normalization mutated source params to %#v", gotValue)
+	}
+}
+
+func TestNormalizePluginInputParamsReportsConversionPath(t *testing.T) {
+	tests := []struct {
+		name        string
+		value       any
+		fieldSchema map[string]any
+		wantText    string
+	}{
+		{name: "boolean", value: "sometimes", fieldSchema: map[string]any{"type": "bool"}, wantText: "cannot convert"},
+		{name: "integer", value: "1.5", fieldSchema: map[string]any{"type": "int"}, wantText: "integer"},
+		{name: "number", value: "many", fieldSchema: map[string]any{"type": "float"}, wantText: "number"},
+		{name: "object", value: "{", fieldSchema: map[string]any{"type": "object"}, wantText: "object"},
+		{name: "null object", value: "null", fieldSchema: map[string]any{"type": "object"}, wantText: "expected a JSON object"},
+		{name: "array", value: "[", fieldSchema: map[string]any{"type": "array"}, wantText: "array"},
+		{
+			name:  "nested property",
+			value: `{"active":"sometimes"}`,
+			fieldSchema: map[string]any{
+				"type": "object",
+				"properties": map[string]any{
+					"active": map[string]any{"type": "bool"},
+				},
+			},
+			wantText: "field: active:",
+		},
+		{
+			name:  "array item",
+			value: "1,not-an-int",
+			fieldSchema: map[string]any{
+				"type":  "array",
+				"items": map[string]any{"type": "int"},
+			},
+			wantText: "item 1",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			schema := map[string]any{
+				"type":       "object",
+				"properties": map[string]any{"field": tt.fieldSchema},
+			}
+			_, err := normalizePluginInputParams(map[string]any{"field": tt.value}, schema)
+			if err == nil {
+				t.Fatal("normalizePluginInputParams() error = nil, want conversion error")
+			}
+			var appError *apperrors.Error
+			if !errors.As(err, &appError) ||
+				appError.Category != apperrors.CategoryValidation ||
+				appError.Reason != "plugin_input_schema_invalid" {
+				t.Fatalf("conversion error = %#v, want categorized plugin schema validation error", err)
+			}
+			if !strings.Contains(err.Error(), tt.wantText) {
+				t.Fatalf("conversion error = %q, want text %q", err, tt.wantText)
+			}
+		})
+	}
+}
+
+func TestNormalizePluginInputParamsRunsSchemaValidation(t *testing.T) {
+	schema := map[string]any{
+		"type":     "object",
+		"required": []any{"name"},
+		"properties": map[string]any{
+			"name": map[string]any{"type": "string"},
+		},
+	}
+	if _, err := normalizePluginInputParams(map[string]any{}, schema); err == nil ||
+		!strings.Contains(err.Error(), "$.name is required") {
+		t.Fatalf("required-field validation error = %v", err)
+	}
+}
+
+func TestPluginInputSchemaHelperEdges(t *testing.T) {
+	if got := canonicalPluginInputSchema(nil); got != nil {
+		t.Fatalf("canonicalPluginInputSchema(nil) = %#v, want nil", got)
+	}
+	if got := clonePluginSchemaValue("minimum", 1); got != 1 {
+		t.Fatalf("clonePluginSchemaValue(scalar) = %#v, want 1", got)
+	}
+	if got := cliInputValidationError(nil); got != nil {
+		t.Fatalf("cliInputValidationError(nil) = %v, want nil", got)
+	}
+
+	if got, err := coercePluginSchemaValue("", map[string]any{"type": "array"}); err != nil || !reflect.DeepEqual(got, []any(nil)) {
+		t.Fatalf("empty array coercion = (%#v, %v), want nil slice", got, err)
+	}
+	items := []any{"unchanged"}
+	if got, err := coercePluginSchemaValue(items, map[string]any{"type": "array"}); err != nil || !reflect.DeepEqual(got, items) {
+		t.Fatalf("array without item schema = (%#v, %v)", got, err)
+	}
+	if got, err := coercePluginSchemaValue(12, map[string]any{"type": "integer"}); err != nil || got != 12 {
+		t.Fatalf("non-string scalar coercion = (%#v, %v), want (12, nil)", got, err)
+	}
+	unknown := map[string]any{"unknown": "unchanged"}
+	if got, err := coercePluginSchemaValue(unknown, map[string]any{
+		"type":       "object",
+		"properties": map[string]any{},
+	}); err != nil || !reflect.DeepEqual(got, unknown) {
+		t.Fatalf("unknown property coercion = (%#v, %v), want unchanged map", got, err)
+	}
+
+	tests := []struct {
+		name   string
+		schema map[string]any
+		want   string
+	}{
+		{name: "missing", schema: map[string]any{}, want: ""},
+		{name: "single string", schema: map[string]any{"type": "integer"}, want: "integer"},
+		{name: "single string slice", schema: map[string]any{"type": []string{"null", "number"}}, want: "number"},
+		{name: "any slice", schema: map[string]any{"type": []any{nil, 3, "", "null", "boolean"}}, want: "boolean"},
+		{name: "ambiguous", schema: map[string]any{"type": []any{"string", "integer"}}, want: ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := singlePluginSchemaType(tt.schema); got != tt.want {
+				t.Fatalf("singlePluginSchemaType(%#v) = %q, want %q", tt.schema, got, tt.want)
+			}
+		})
+	}
+
+	for raw, want := range map[string]string{
+		" BOOL ": "boolean",
+		"Int":    "integer",
+		"FLOAT":  "number",
+		"custom": "custom",
+	} {
+		if got := canonicalPluginSchemaType(raw); got != want {
+			t.Errorf("canonicalPluginSchemaType(%q) = %q, want %q", raw, got, want)
+		}
+	}
+}

internal/app/plugin_input_schema_test.go

@@ -0,0 +1,109 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"context"
+	"errors"
+	"reflect"
+	"testing"
+
+	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
+)
+
+func TestPluginStdioExecutionNormalizesAndValidatesLiveSchema(t *testing.T) {
+	isolatePluginRuntime(t)
+	previousInit := runnerStdioEnsureInitialized
+	previousList := runnerStdioListTools
+	previousCall := runnerStdioCallTool
+	t.Cleanup(func() {
+		runnerStdioEnsureInitialized = previousInit
+		runnerStdioListTools = previousList
+		runnerStdioCallTool = previousCall
+	})
+
+	client := transport.NewStdioClient("unused", nil, nil)
+	RegisterStdioClient("conference/local", client)
+	runnerStdioEnsureInitialized = func(*transport.StdioClient, context.Context) error {
+		return nil
+	}
+	runnerStdioListTools = func(*transport.StdioClient, context.Context) (transport.ToolsListResult, error) {
+		return transport.ToolsListResult{
+			Tools: []transport.ToolDescriptor{{
+				Name: "create_conference",
+				InputSchema: map[string]any{
+					"type":     "object",
+					"required": []any{"title"},
+					"properties": map[string]any{
+						"title":           map[string]any{"type": "string"},
+						"capture_speaker": map[string]any{"type": "bool"},
+					},
+					"additionalProperties": false,
+				},
+			}},
+		}, nil
+	}
+	var calledParams map[string]any
+	runnerStdioCallTool = func(
+		_ *transport.StdioClient,
+		_ context.Context,
+		_ string,
+		params map[string]any,
+	) (transport.ToolCallResult, error) {
+		calledParams = params
+		return transport.ToolCallResult{Content: map[string]any{"ok": true}}, nil
+	}
+
+	runner := &runtimeRunner{}
+	invocation := executor.Invocation{
+		CanonicalProduct: "conference-local",
+		Tool:             "create_conference",
+		Params: map[string]any{
+			"title":           "schema validation",
+			"capture_speaker": "true",
+		},
+	}
+	result, err := runner.executeInvocation(
+		context.Background(),
+		"stdio://conference/local",
+		invocation,
+	)
+	if err != nil {
+		t.Fatalf("stdio plugin execution: %v", err)
+	}
+	wantParams := map[string]any{
+		"title":           "schema validation",
+		"capture_speaker": true,
+	}
+	if !reflect.DeepEqual(calledParams, wantParams) ||
+		!reflect.DeepEqual(result.Invocation.Params, wantParams) {
+		t.Fatalf("normalized wire params = %#v, result = %#v", calledParams, result.Invocation.Params)
+	}
+
+	calledParams = nil
+	invocation.Params = map[string]any{"capture_speaker": "true"}
+	_, err = runner.executeInvocation(
+		context.Background(),
+		"stdio://conference/local",
+		invocation,
+	)
+	var appError *apperrors.Error
+	if !errors.As(err, &appError) ||
+		appError.Category != apperrors.CategoryValidation ||
+		calledParams != nil {
+		t.Fatalf("missing required schema validation = %#v, call params = %#v", err, calledParams)
+	}
+}

internal/app/plugin_registration_residual_test.go

@@ -0,0 +1,369 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pipeline"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/plugin"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/shortcut/userdef"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/cmdutil"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/mcptypes"
+	"github.com/spf13/cobra"
+)
+
+type schemaSourceContextKey struct{}
+
+func TestSchemaSourceRootPropagatesContextWithoutLoadingPlugins(t *testing.T) {
+	previous := rootLoadPlugins
+	t.Cleanup(func() { rootLoadPlugins = previous })
+
+	pluginLoads := 0
+	rootLoadPlugins = func(*cobra.Command, *pipeline.Engine, executor.Runner) []*cobra.Command {
+		pluginLoads++
+		return nil
+	}
+	wantContext := context.WithValue(context.Background(), schemaSourceContextKey{}, "schema")
+	root := NewSchemaSourceRootCommand(wantContext)
+	if root.Context() != wantContext {
+		t.Fatal("Schema source root did not retain the caller context")
+	}
+	if pluginLoads != 0 {
+		t.Fatalf("Schema source root loaded runtime plugins %d times", pluginLoads)
+	}
+}
+
+func TestCollectPluginServerCandidatesSortsAndSkipsInvalidStdio(t *testing.T) {
+	previousDescriptors := rootPluginDescriptors
+	previousClients := rootPluginStdioClients
+	previousDescriptor := rootPluginStdioDescriptor
+	t.Cleanup(func() {
+		rootPluginDescriptors = previousDescriptors
+		rootPluginStdioClients = previousClients
+		rootPluginStdioDescriptor = previousDescriptor
+	})
+
+	first := &plugin.Plugin{Manifest: plugin.Manifest{Name: "first"}}
+	second := &plugin.Plugin{Manifest: plugin.Manifest{Name: "second"}}
+	wantContext := &plugin.UserContext{UserID: "user", CorpID: "corp"}
+	client := transport.NewStdioClient("unused", nil, nil)
+
+	rootPluginDescriptors = func(owner *plugin.Plugin) []mcptypes.ServerDescriptor {
+		if owner == first {
+			return []mcptypes.ServerDescriptor{{Key: "same"}, {Key: " beta "}}
+		}
+		return []mcptypes.ServerDescriptor{{Key: "aardvark"}}
+	}
+	rootPluginStdioClients = func(owner *plugin.Plugin, gotContext *plugin.UserContext) []plugin.StdioServerClient {
+		if gotContext != wantContext {
+			t.Fatalf("stdio user context = %#v, want %#v", gotContext, wantContext)
+		}
+		if owner != first {
+			return nil
+		}
+		return []plugin.StdioServerClient{
+			{Key: "same", Client: client},
+			{Key: " alpha ", Client: client},
+			{Key: "invalid", Client: client},
+		}
+	}
+	rootPluginStdioDescriptor = func(_ *plugin.Plugin, stdio plugin.StdioServerClient) (mcptypes.ServerDescriptor, bool) {
+		if stdio.Key == "invalid" {
+			return mcptypes.ServerDescriptor{}, false
+		}
+		return mcptypes.ServerDescriptor{Key: stdio.Key}, true
+	}
+
+	candidates := collectPluginServerCandidates([]*plugin.Plugin{first, second}, wantContext)
+	if len(candidates) != 5 {
+		t.Fatalf("candidate count = %d, want 5", len(candidates))
+	}
+	gotKeys := make([]string, 0, len(candidates))
+	gotKinds := make([]string, 0, len(candidates))
+	for _, candidate := range candidates {
+		gotKeys = append(gotKeys, candidate.descriptor.Key)
+		if candidate.stdioClient == nil {
+			gotKinds = append(gotKinds, "http")
+		} else {
+			gotKinds = append(gotKinds, "stdio")
+			if candidate.stdioClient.Client != client {
+				t.Fatal("stdio candidate did not retain its client")
+			}
+		}
+	}
+	if want := []string{" alpha ", " beta ", "same", "same", "aardvark"}; !reflect.DeepEqual(gotKeys, want) {
+		t.Fatalf("candidate keys = %#v, want %#v", gotKeys, want)
+	}
+	if want := []string{"stdio", "http", "http", "stdio", "http"}; !reflect.DeepEqual(gotKinds, want) {
+		t.Fatalf("candidate transports = %#v, want %#v", gotKinds, want)
+	}
+}
+
+func TestPluginDescriptorBlankIdentityAndDistributionOwnership(t *testing.T) {
+	isolatePluginRuntime(t)
+
+	blank := mcptypes.ServerDescriptor{
+		Key: " ",
+		CLI: mcptypes.CLIOverlay{
+			ID:      " ",
+			Command: " ",
+			Aliases: []string{"", "  "},
+		},
+	}
+	if claims := pluginDescriptorIdentityClaims(blank); len(claims) != 0 {
+		t.Fatalf("blank descriptor claims = %#v, want none", claims)
+	}
+	if rootName := pluginDescriptorRootName(blank); rootName != "" {
+		t.Fatalf("blank descriptor root = %q", rootName)
+	}
+	owner := &plugin.Plugin{Manifest: plugin.Manifest{Name: "blank"}}
+	accepted := selectPluginServerCandidates(
+		&cobra.Command{Use: "dws"},
+		[]pluginServerCandidate{
+			{owner: owner, descriptor: mcptypes.ServerDescriptor{CLI: mcptypes.CLIOverlay{Skip: true}}},
+			{owner: owner, descriptor: blank},
+		},
+	)
+	if len(accepted) != 1 {
+		t.Fatalf("blank descriptor candidates = %#v, want one accepted candidate", accepted)
+	}
+
+	if distributionRootOwns(nil, "visible") {
+		t.Fatal("nil root claimed a command")
+	}
+	root := &cobra.Command{Use: "dws"}
+	visible := &cobra.Command{Use: "visible", Aliases: []string{" visible-alias "}}
+	hiddenFallback := &cobra.Command{Use: "conference", Hidden: true}
+	hiddenOwned := &cobra.Command{Use: "hidden-owned", Hidden: true}
+	pluginOwned := &cobra.Command{Use: "plugin-owned", Aliases: []string{"plugin-alias"}}
+	cmdutil.MarkPluginSource(pluginOwned)
+	root.AddCommand(visible, hiddenFallback, hiddenOwned, pluginOwned)
+
+	for _, name := range []string{"visible", "visible-alias", "hidden-owned"} {
+		if !distributionRootOwns(root, name) {
+			t.Errorf("distribution root did not claim %q", name)
+		}
+	}
+	for _, name := range []string{"conference", "plugin-owned", "plugin-alias", "missing"} {
+		if distributionRootOwns(root, name) {
+			t.Errorf("distribution root unexpectedly claimed %q", name)
+		}
+	}
+}
+
+func TestReplaceableFallbackIdentitySurvivesDistributionConflictChecks(t *testing.T) {
+	isolatePluginRuntime(t)
+	SetDynamicServers([]mcptypes.ServerDescriptor{
+		{
+			Key:      "conference",
+			Endpoint: "https://example.com/conference/mcp",
+			CLI:      mcptypes.CLIOverlay{ID: "conference"},
+		},
+		{
+			Key:      "chat",
+			Endpoint: "https://example.com/chat/mcp",
+			CLI:      mcptypes.CLIOverlay{ID: "chat"},
+		},
+	})
+
+	root := &cobra.Command{Use: "dws"}
+	root.AddCommand(&cobra.Command{Use: "conference", Hidden: true})
+	distributionProducts := DirectRuntimeProductIDs()
+
+	conferenceDescriptor := mcptypes.ServerDescriptor{
+		Key:         "conference-local",
+		DisplayName: "conference/conference-local",
+		CLI:         mcptypes.CLIOverlay{ID: "conference-local", Command: "conference"},
+	}
+	if pluginDescriptorConflictsWithDistribution(root, conferenceDescriptor, distributionProducts) {
+		t.Fatal("replaceable fallback identity blocked plugin server selection")
+	}
+
+	chatDescriptor := mcptypes.ServerDescriptor{
+		Key:         "chat-local",
+		DisplayName: "chat/chat-local",
+		CLI:         mcptypes.CLIOverlay{ID: "chat-local", Command: "chat"},
+	}
+	if !pluginDescriptorConflictsWithDistribution(root, chatDescriptor, distributionProducts) {
+		t.Fatal("non-replaceable distribution product no longer conflicts")
+	}
+
+	reservedDescriptor := mcptypes.ServerDescriptor{
+		Key:         "auth-local",
+		DisplayName: "auth/auth-local",
+		CLI:         mcptypes.CLIOverlay{ID: "auth-local", Command: "auth"},
+	}
+	if !pluginDescriptorConflictsWithDistribution(root, reservedDescriptor, distributionProducts) {
+		t.Fatal("reserved command name no longer conflicts")
+	}
+
+	first := &plugin.Plugin{Manifest: plugin.Manifest{Name: "conference"}}
+	second := &plugin.Plugin{Manifest: plugin.Manifest{Name: "other"}}
+	accepted := selectPluginServerCandidates(root, []pluginServerCandidate{
+		{owner: first, descriptor: conferenceDescriptor},
+		{
+			owner: second,
+			descriptor: mcptypes.ServerDescriptor{
+				Key:         "conference-other",
+				DisplayName: "other/conference-other",
+				CLI:         mcptypes.CLIOverlay{ID: "conference-other", Command: "conference"},
+			},
+		},
+	})
+	if len(accepted) != 1 {
+		t.Fatalf("accepted candidates = %d, want the first conference plugin only", len(accepted))
+	}
+	if accepted[0].owner != first {
+		t.Fatalf("accepted owner = %q, want the first conference plugin", accepted[0].owner.Manifest.Name)
+	}
+}
+
+func TestAddPluginCommandsSafeFiltersConflictingAliases(t *testing.T) {
+	root := &cobra.Command{Use: "dws"}
+	root.AddCommand(&cobra.Command{Use: "taken"})
+	command := &cobra.Command{
+		Use:     "extension",
+		Aliases: []string{"", "extension", "auth", "taken", "shared", " shared ", " okay "},
+	}
+	addPluginCommandsSafe(root, []*cobra.Command{
+		command,
+		{Use: "shared"},
+		{Use: "other", Aliases: []string{"extension"}},
+	})
+
+	if want := []string{"shared", "okay"}; !reflect.DeepEqual(command.Aliases, want) {
+		t.Fatalf("filtered aliases = %#v, want %#v", command.Aliases, want)
+	}
+	if child := findDirectChild(root, "shared"); child != nil {
+		t.Fatal("an accepted alias was also registered as a plugin primary command")
+	}
+	other := findDirectChild(root, "other")
+	if other == nil || len(other.Aliases) != 0 {
+		t.Fatalf("later plugin aliases = %#v", other)
+	}
+}
+
+func TestStdioRunnerReportsToolsListFailureAndMissingTool(t *testing.T) {
+	isolatePluginRuntime(t)
+	previousInit := runnerStdioEnsureInitialized
+	previousList := runnerStdioListTools
+	previousCall := runnerStdioCallTool
+	t.Cleanup(func() {
+		runnerStdioEnsureInitialized = previousInit
+		runnerStdioListTools = previousList
+		runnerStdioCallTool = previousCall
+	})
+
+	client := transport.NewStdioClient("unused", nil, nil)
+	RegisterStdioClient("plugin/server", client)
+	runnerStdioEnsureInitialized = func(*transport.StdioClient, context.Context) error { return nil }
+	toolCalls := 0
+	runnerStdioCallTool = func(*transport.StdioClient, context.Context, string, map[string]any) (transport.ToolCallResult, error) {
+		toolCalls++
+		return transport.ToolCallResult{}, nil
+	}
+	runner := &runtimeRunner{}
+	invocation := executor.Invocation{CanonicalProduct: "overlay-id", Tool: "wanted"}
+
+	listFailure := errors.New("list failed")
+	runnerStdioListTools = func(*transport.StdioClient, context.Context) (transport.ToolsListResult, error) {
+		return transport.ToolsListResult{}, listFailure
+	}
+	_, err := runner.executeStdioInvocationAtEndpoint(context.Background(), "stdio://plugin/server", invocation)
+	assertPluginRuntimeError(t, err, apperrors.CategoryAPI, "tools/list", "stdio_tools_list_error")
+
+	runnerStdioListTools = func(*transport.StdioClient, context.Context) (transport.ToolsListResult, error) {
+		return transport.ToolsListResult{Tools: []transport.ToolDescriptor{{Name: "other"}}}, nil
+	}
+	_, err = runner.executeStdioInvocationAtEndpoint(context.Background(), "stdio://plugin/server", invocation)
+	assertPluginRuntimeError(t, err, apperrors.CategoryValidation, "", "plugin_tool_not_found")
+	if toolCalls != 0 {
+		t.Fatalf("tools/call attempts after tools/list failures = %d", toolCalls)
+	}
+}
+
+func TestStdioManifestDescriptorAndRegistrationFailClosed(t *testing.T) {
+	isolatePluginRuntime(t)
+	p := &plugin.Plugin{
+		Manifest: plugin.Manifest{
+			Name: "broken-plugin",
+			MCPServers: map[string]*plugin.MCPServer{
+				"local": {CLI: json.RawMessage(`{`)},
+			},
+		},
+	}
+	server := plugin.StdioServerClient{
+		Key:    "local",
+		Client: transport.NewStdioClient("unused", nil, nil),
+	}
+	if descriptor, ok := stdioServerDescriptorFromManifest(p, server); ok || !reflect.ValueOf(descriptor).IsZero() {
+		t.Fatalf("invalid descriptor = (%#v, %v), want zero, false", descriptor, ok)
+	}
+	if descriptor := registerStdioServerFromManifest(p, server); !reflect.ValueOf(descriptor).IsZero() {
+		t.Fatalf("invalid registered descriptor = %#v, want zero", descriptor)
+	}
+	if _, ok := LookupStdioClient("broken-plugin/local"); ok {
+		t.Fatal("invalid stdio manifest registered a client")
+	}
+}
+
+func TestLegacyCommandsContinueWhenUserShortcutLoadFails(t *testing.T) {
+	configDir := t.TempDir()
+	t.Setenv("DWS_CONFIG_DIR", configDir)
+	shortcutDir := filepath.Join(configDir, "shortcuts")
+	if err := os.MkdirAll(shortcutDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(shortcutDir, "broken.yaml"), []byte("version: ["), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, loadErrors := userdef.Load(); len(loadErrors) == 0 {
+		t.Fatal("malformed shortcut fixture did not fail to load")
+	}
+
+	runner := executor.EchoRunner{}
+	caller := newToolCallerAdapter(runner, &GlobalFlags{})
+	if commands := newLegacyPublicCommands(runner, caller, true); len(commands) == 0 {
+		t.Fatal("legacy commands were dropped after a user shortcut load error")
+	}
+}
+
+func findDirectChild(root *cobra.Command, name string) *cobra.Command {
+	for _, command := range root.Commands() {
+		if command.Name() == name {
+			return command
+		}
+	}
+	return nil
+}
+
+func assertPluginRuntimeError(
+	t *testing.T,
+	err error,
+	wantCategory apperrors.Category,
+	wantOperation string,
+	wantReason string,
+) {
+	t.Helper()
+	var appError *apperrors.Error
+	if !errors.As(err, &appError) {
+		t.Fatalf("runtime error = %#v, want structured app error", err)
+	}
+	if appError.Category != wantCategory ||
+		appError.Operation != wantOperation ||
+		appError.Reason != wantReason {
+		t.Fatalf("runtime error = %#v, want category=%q operation=%q reason=%q", appError, wantCategory, wantOperation, wantReason)
+	}
+}

internal/app/plugin_registration_test.go

@@ -5,6 +5,7 @@
 package app
 
 import (
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
@@ -12,6 +13,7 @@ import (
 	"sync/atomic"
 	"testing"
 
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/plugin"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/mcptypes"
@@ -35,6 +37,11 @@ func isolatePluginRuntime(t *testing.T) {
 	stdioClients = make(map[string]*transport.StdioClient)
 	stdioMu.Unlock()
 
+	pluginAuthMu.Lock()
+	previousPluginAuth := pluginAuthRegistry
+	pluginAuthRegistry = make(map[string]*PluginAuth)
+	pluginAuthMu.Unlock()
+
 	t.Cleanup(func() {
 		StopAllStdioClients()
 		dynamicMu.Lock()
@@ -46,6 +53,9 @@ func isolatePluginRuntime(t *testing.T) {
 		stdioMu.Lock()
 		stdioClients = previousStdio
 		stdioMu.Unlock()
+		pluginAuthMu.Lock()
+		pluginAuthRegistry = previousPluginAuth
+		pluginAuthMu.Unlock()
 	})
 }
 
@@ -77,14 +87,40 @@ func TestRegisterPluginHTTPServerDoesNotProbeEndpoint(t *testing.T) {
 func TestRegisterStdioServerFromManifestDoesNotStartProcess(t *testing.T) {
 	isolatePluginRuntime(t)
 	marker := t.TempDir() + "/started"
+	pluginRoot := t.TempDir()
+	if err := os.WriteFile(pluginRoot+"/overlay.json", []byte(`{
+		"id":"local",
+		"command":"lazy-stdio",
+		"groups":{"health":{"description":"health checks"}},
+		"toolOverrides":{"ping":{"cliName":"ping","group":"health"}}
+	}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
 	client := transport.NewStdioClient("/bin/sh", []string{
 		"-c", fmt.Sprintf("printf started > %q", marker),
 	}, nil)
 	p := &plugin.Plugin{
-		Manifest: plugin.Manifest{Name: "lazy-stdio", Description: "lazy stdio test"},
-		Root:     t.TempDir(),
+		Manifest: plugin.Manifest{
+			Name:        "lazy-stdio",
+			Description: "lazy stdio test",
+			MCPServers: map[string]*plugin.MCPServer{
+				"local": {
+					Type:    "stdio",
+					Command: "unused",
+					CLI:     json.RawMessage(`"overlay.json"`),
+				},
+			},
+		},
+		Root: pluginRoot,
 	}
 	descriptor := registerStdioServerFromManifest(p, plugin.StdioServerClient{Key: "local", Client: client})
+	commands := buildPluginCommands([]mcptypes.ServerDescriptor{descriptor}, executor.EchoRunner{}, nil)
+	root := pluginTestRoot(commands...)
+	root.SetArgs([]string{"lazy-stdio", "--help"})
+	if err := root.Execute(); err != nil {
+		t.Fatalf("lazy stdio help: %v", err)
+	}
+	requirePluginChild(t, commands[0], "health", "ping")
 
 	if _, err := os.Stat(marker); !os.IsNotExist(err) {
 		t.Fatalf("stdio process started during registration: stat error = %v", err)

internal/app/plugin_stdio_overlay.go

@@ -14,10 +14,7 @@
 package app
 
 import (
-	"encoding/json"
 	"log/slog"
-	"os"
-	"path/filepath"
 
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/plugin"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/mcptypes"
@@ -33,50 +30,26 @@ import (
 // When no CLI metadata is present, a minimal overlay keyed by the server
 // name is returned so callers can still build an identity descriptor.
 func resolveStdioOverlay(p *plugin.Plugin, sc plugin.StdioServerClient) mcptypes.CLIOverlay {
-	serverID := sc.Key
-	overlay := mcptypes.CLIOverlay{
-		ID:      serverID,
-		Command: serverID,
-	}
-	srv, ok := p.Manifest.MCPServers[sc.Key]
-	if !ok || len(srv.CLI) == 0 {
-		return overlay
-	}
-
-	cliData := srv.CLI
-	// A JSON string is interpreted as a relative path to an external
-	// overlay file (e.g. "overlay.json") anchored at the plugin root.
-	if len(cliData) > 0 && cliData[0] == '"' {
-		var cliPath string
-		if err := json.Unmarshal(cliData, &cliPath); err == nil && cliPath != "" {
-			absPath := filepath.Join(p.Root, cliPath)
-			if fileData, readErr := os.ReadFile(absPath); readErr == nil {
-				cliData = fileData
-			} else {
-				slog.Warn("plugin: failed to read CLI overlay file",
-					"plugin", p.Manifest.Name, "path", absPath, "error", readErr)
-			}
+	overlay, ok := p.ResolveCLIOverlay(sc.Key)
+	if !ok {
+		return mcptypes.CLIOverlay{
+			ID:      sc.Key,
+			Command: sc.Key,
+			Skip:    true,
 		}
 	}
-	if err := json.Unmarshal(cliData, &overlay); err != nil {
-		slog.Warn("plugin: failed to parse CLI overlay for stdio server",
-			"plugin", p.Manifest.Name, "server", sc.Key, "error", err)
-	}
-	if overlay.ID == "" {
-		overlay.ID = serverID
-	}
-	if overlay.Command == "" {
-		overlay.Command = serverID
-	}
 	return overlay
 }
 
-// registerStdioServerFromManifest registers an endpoint descriptor and an
-// unstarted client from versioned plugin metadata. Tool discovery is not part
-// of command-tree construction; execution starts and initializes the client.
-func registerStdioServerFromManifest(p *plugin.Plugin, sc plugin.StdioServerClient) mcptypes.ServerDescriptor {
-	overlay := resolveStdioOverlay(p, sc)
-	descriptor := mcptypes.ServerDescriptor{
+func stdioServerDescriptorFromManifest(
+	p *plugin.Plugin,
+	sc plugin.StdioServerClient,
+) (mcptypes.ServerDescriptor, bool) {
+	overlay, ok := p.ResolveCLIOverlay(sc.Key)
+	if !ok {
+		return mcptypes.ServerDescriptor{}, false
+	}
+	return mcptypes.ServerDescriptor{
 		Key:         sc.Key,
 		DisplayName: p.Manifest.Name + "/" + sc.Key,
 		Description: p.Manifest.Description,
@@ -84,13 +57,30 @@ func registerStdioServerFromManifest(p *plugin.Plugin, sc plugin.StdioServerClie
 		Source:      "plugin",
 		CLI:         overlay,
 		HasCLIMeta:  true,
-	}
+	}, true
+}
 
+func registerResolvedStdioServer(
+	p *plugin.Plugin,
+	sc plugin.StdioServerClient,
+	descriptor mcptypes.ServerDescriptor,
+) {
 	AppendDynamicServer(descriptor)
 	RegisterStdioClient(p.Manifest.Name+"/"+sc.Key, sc.Client)
 
 	slog.Debug("plugin: stdio server registered from manifest",
 		"plugin", p.Manifest.Name, "server", sc.Key,
-		"toolOverrides", len(overlay.ToolOverrides))
+		"toolOverrides", len(descriptor.CLI.ToolOverrides))
+}
+
+// registerStdioServerFromManifest registers an endpoint descriptor and an
+// unstarted client from versioned plugin metadata. Tool discovery is not part
+// of command-tree construction; execution starts and initializes the client.
+func registerStdioServerFromManifest(p *plugin.Plugin, sc plugin.StdioServerClient) mcptypes.ServerDescriptor {
+	descriptor, ok := stdioServerDescriptorFromManifest(p, sc)
+	if !ok {
+		return mcptypes.ServerDescriptor{}
+	}
+	registerResolvedStdioServer(p, sc, descriptor)
 	return descriptor
 }

internal/app/profile_command.go

@@ -18,7 +18,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"sort"
 	"strings"
 	"time"
 
@@ -34,15 +33,17 @@ func newProfileCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "profile",
 		Short: "组织 profile 管理",
-		Long: `管理本机已登录的钉钉组织 profile。
+		Long: `管理本机已登录的钉钉账号 profile。
 
-每个 profile 对应一个已授权组织。业务命令可通过全局 --profile 临时指定组织，
-profile switch/use 才会持久修改默认组织上下文。`,
+每个 profile 由 corpId + userId 唯一确定，同一组织可保存多个账号。业务命令可通过
+全局 --profile 临时指定组织或账号，profile switch/use 才会持久修改默认账号。`,
 		Example: `  dws profile list
   dws profile switch
   dws profile switch <corpId>
+  dws profile switch <corpId>:<userId>
+  dws profile switch "<corpName>:<userName>"
   dws profile switch -
-  dws --profile <corpId> contact user get-self`,
+  dws --profile <corpId>:<userId> contact user get-self`,
 		Args:              cobra.NoArgs,
 		TraverseChildren:  true,
 		DisableAutoGenTag: true,
@@ -58,8 +59,8 @@ func newProfileListCommand() *cobra.Command {
 	return &cobra.Command{
 		Use:     "list",
 		Aliases: []string{"ls"},
-		Short:   "列出已登录组织 profile",
-		Long:    "列出本机已登录的所有组织 profile，包含当前组织、主组织、组织名、corpId、状态和用户信息。",
+		Short:   "列出全部已登录账号 profile",
+		Long:    "列出本机全部已登录账号。状态和到期时间直接读取各身份 Token，列表本身不会刷新 Token。",
 		Example: `  dws profile list
   dws profile list --format json`,
 		Args:              cobra.NoArgs,
@@ -75,9 +76,9 @@ func newProfileListCommand() *cobra.Command {
 			}
 			format, _ := cmd.Root().PersistentFlags().GetString("format")
 			if strings.EqualFold(strings.TrimSpace(format), "json") {
-				return writeProfileListJSON(cmd.OutOrStdout(), cfg)
+				return writeProfileListJSON(cmd.OutOrStdout(), configDir, cfg)
 			}
-			writeProfileListTable(cmd.OutOrStdout(), cfg)
+			writeProfileListTable(cmd.OutOrStdout(), configDir, cfg)
 			return nil
 		},
 	}
@@ -85,9 +86,9 @@ func newProfileListCommand() *cobra.Command {
 
 func newProfileUseCommand() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "use [name|corpId|-]",
-		Short: "切换当前组织 profile（兼容 profile switch）",
-		Long:  "兼容命令，语义等同于 dws profile switch。可用组织名、profile 名、corpId 或 - 切回上一个组织。",
+		Use:   "use [profile-selector|-]",
+		Short: "切换当前账号 profile（兼容 profile switch）",
+		Long:  "兼容命令，语义等同于 dws profile switch。选择器支持组织 ID/名称、账号 ID/名称组合或本地 profile 名；- 切回上一个账号。",
 		Example: `  dws profile use <corpId>
   dws profile use --name "钉钉"
   dws profile use -`,
@@ -103,18 +104,21 @@ func newProfileUseCommand() *cobra.Command {
 
 func newProfileSwitchCommand() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "switch [name|corpId|-]",
-		Short: "切换当前组织 profile",
-		Long: `切换默认组织 profile，并记录 previousProfile 以支持 dws profile switch - 快速切回。
+		Use:   "switch [profile-selector|-]",
+		Short: "切换当前账号 profile",
+		Long: `切换默认账号 profile，并记录 previousProfile 以支持 dws profile switch - 快速切回。
 
-不带参数时，交互终端会展示组织选择器；非交互环境请显式传入组织名、profile 名或 corpId。
-需要只影响单次业务命令时，请使用全局 --profile。`,
+选择器支持 corpId:userId、corpId:userName、corpName:userId、corpName:userName，
+也兼容单独的 corpId、唯一 corpName 和本地 profile 名。组织或账号名称重名时会报错，
+要求改用稳定的 corpId:userId。不带参数时交互选择；单次执行请使用全局 --profile。`,
 		Example: `  dws profile switch
   dws profile switch <corpId>
+  dws profile switch <corpId>:<userId>
+  dws profile switch "<corpName>:<userName>"
   dws profile switch --corpId <corpId>
   dws profile switch --name "钉钉"
   dws profile switch -
-  dws --profile <corpId> contact user get-self`,
+  dws --profile <corpId>:<userId> contact user get-self`,
 		Args:              cobra.MaximumNArgs(1),
 		DisableAutoGenTag: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -142,6 +146,7 @@ var (
 	profileSwitchTUIRunner           = runProfileSwitchTUI
 	profileEnsureProfilesMigration   = authpkg.EnsureProfilesMigration
 	profileLoadProfiles              = authpkg.LoadProfiles
+	profileLoadTokenData             = authpkg.LoadTokenDataForProfile
 	profileUsePrevious               = authpkg.UsePreviousProfile
 	profileSetCurrent                = authpkg.SetCurrentProfile
 	profileRunTeaProgram             = (*tea.Program).Run
@@ -247,7 +252,7 @@ func switchProfileAndWrite(cmd *cobra.Command, configDir, selector string, usedT
 
 func selectProfileSwitchProfile(cmd *cobra.Command, configDir string) (string, error) {
 	if !profileSwitchInteractiveTerminal() {
-		return "", apperrors.NewValidation("profile selector required in non-interactive mode; use dws profile switch <name|corpId>")
+		return "", apperrors.NewValidation("profile selector required in non-interactive mode; use dws profile switch <corpId|corpId:userId|corpName:userName>")
 	}
 	if err := profileEnsureProfilesMigration(configDir); err != nil {
 		return "", apperrors.NewInternal(fmt.Sprintf("failed to migrate profiles: %v", err))
@@ -261,10 +266,7 @@ func selectProfileSwitchProfile(cmd *cobra.Command, configDir string) (string, e
 	}
 	choice := strings.TrimSpace(cfg.CurrentProfile)
 	if choice == "" {
-		choice = strings.TrimSpace(cfg.PrimaryProfile)
-	}
-	if choice == "" {
-		choice = cfg.Profiles[0].CorpID
+		choice = authpkg.ProfileSelectionSelector(cfg.Profiles[0], cfg)
 	}
 	return profileSwitchTUIRunner(cmd, cfg, choice)
 }
@@ -306,7 +308,7 @@ func newProfileSwitchTUIModel(cfg *authpkg.ProfilesConfig, selectedCorpID string
 	if cfg != nil {
 		model.profiles = profileSwitchSortedProfiles(cfg.Profiles)
 	}
-	model.selected = profileSwitchProfileIndex(model.profiles, selectedCorpID)
+	model.selected = profileSwitchProfileIndex(model.profiles, selectedCorpID, cfg)
 	if model.selected < 0 {
 		model.selected = 0
 	}
@@ -315,40 +317,7 @@ func newProfileSwitchTUIModel(cfg *authpkg.ProfilesConfig, selectedCorpID string
 }
 
 func profileSwitchSortedProfiles(profiles []authpkg.Profile) []authpkg.Profile {
-	sorted := append([]authpkg.Profile(nil), profiles...)
-	sort.SliceStable(sorted, func(i, j int) bool {
-		left, leftOK := profileSwitchSortTime(sorted[i])
-		right, rightOK := profileSwitchSortTime(sorted[j])
-		if leftOK && rightOK && !left.Equal(right) {
-			return left.After(right)
-		}
-		if leftOK != rightOK {
-			return leftOK
-		}
-		return false
-	})
-	return sorted
-}
-
-func profileSwitchSortTime(p authpkg.Profile) (time.Time, bool) {
-	for _, raw := range []string{p.LastLoginAt, p.UpdatedAt, p.LastUsedAt} {
-		if t, ok := parseProfileSwitchTime(raw); ok {
-			return t, true
-		}
-	}
-	return time.Time{}, false
-}
-
-func parseProfileSwitchTime(raw string) (time.Time, bool) {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return time.Time{}, false
-	}
-	t, err := time.Parse(time.RFC3339, raw)
-	if err != nil {
-		return time.Time{}, false
-	}
-	return t, true
+	return append([]authpkg.Profile(nil), profiles...)
 }
 
 func (m profileSwitchTUIModel) Init() tea.Cmd {
@@ -459,17 +428,59 @@ func (m profileSwitchTUIModel) selectedCorpID() string {
 	if m.selected < 0 || m.selected >= len(m.profiles) {
 		return ""
 	}
-	return strings.TrimSpace(m.profiles[m.selected].CorpID)
+	selected := m.profiles[m.selected]
+	return authpkg.ProfileSelectionSelector(selected, &authpkg.ProfilesConfig{Profiles: m.profiles})
 }
 
-func profileSwitchProfileIndex(profiles []authpkg.Profile, corpID string) int {
-	corpID = strings.TrimSpace(corpID)
-	for i, p := range profiles {
-		if strings.TrimSpace(p.CorpID) == corpID {
+func profileSwitchProfileIndex(profiles []authpkg.Profile, selector string, cfg *authpkg.ProfilesConfig) int {
+	selector = strings.TrimSpace(selector)
+	for i, profile := range profiles {
+		if authpkg.ProfileSelectionSelector(profile, cfg) == selector {
 			return i
 		}
 	}
-	return -1
+	// Accept an old current/previous pointer long enough for the migration path
+	// to canonicalize it. Only an unresolved profile in a multi-account
+	// organization qualifies, so ordinary exact account names cannot capture an
+	// identity selector that contains ':'.
+	legacyBlank := -1
+	for i, profile := range profiles {
+		if strings.TrimSpace(profile.UserID) != "" || strings.TrimSpace(profile.Name) != selector ||
+			profileCountForCorp(cfg, profile.CorpID) <= 1 {
+			continue
+		}
+		if legacyBlank >= 0 {
+			legacyBlank = -1
+			break
+		}
+		legacyBlank = i
+	}
+	if legacyBlank >= 0 {
+		return legacyBlank
+	}
+	if corpID, userID, exact := authpkg.ParseIdentitySelector(selector); exact {
+		for i, p := range profiles {
+			if strings.TrimSpace(p.CorpID) == corpID && strings.TrimSpace(p.UserID) == userID {
+				return i
+			}
+		}
+		return -1
+	}
+	fallback := -1
+	for i, p := range profiles {
+		if strings.TrimSpace(p.UserID) == "" && strings.TrimSpace(p.Name) == selector {
+			return i
+		}
+		if strings.TrimSpace(p.CorpID) == selector {
+			if fallback < 0 {
+				fallback = i
+			}
+			if profileIsOrgCurrent(p, cfg) {
+				return i
+			}
+		}
+	}
+	return fallback
 }
 
 func profileSwitchOptionLabel(p authpkg.Profile, cfg *authpkg.ProfilesConfig) string {
@@ -481,11 +492,29 @@ func profileSwitchOptionLabel(p authpkg.Profile, cfg *authpkg.ProfilesConfig) st
 }
 
 func profileSwitchProfileCells(p authpkg.Profile, cfg *authpkg.ProfilesConfig) (string, string) {
-	return profileOrgName(p), profileSwitchProfileStatus(p, cfg)
+	orgName := profileOrgName(p)
+	if cfg != nil {
+		sameCorp := 0
+		for _, candidate := range cfg.Profiles {
+			if candidate.CorpID == p.CorpID {
+				sameCorp++
+			}
+		}
+		if sameCorp > 1 {
+			user := strings.TrimSpace(p.UserName)
+			if user == "" {
+				user = strings.TrimSpace(p.UserID)
+			}
+			if user != "" {
+				orgName += " / " + user
+			}
+		}
+	}
+	return orgName, profileSwitchProfileStatus(p, cfg)
 }
 
 func profileSwitchProfileStatus(p authpkg.Profile, cfg *authpkg.ProfilesConfig) string {
-	if cfg != nil && p.CorpID == cfg.CurrentProfile {
+	if cfg != nil && profileSelectorSelectsProfile(cfg.CurrentProfile, p, cfg, profileIsOrgCurrent(p, cfg), profileCountForCorp(cfg, p.CorpID) <= 1) {
 		return "当前组织"
 	}
 	return ""
@@ -575,6 +604,7 @@ type profileUseResponse struct {
 }
 
 type profileView struct {
+	Profile           string   `json:"profile"`
 	CorpID            string   `json:"corpId"`
 	CorpName          string   `json:"corpName"`
 	UserID            string   `json:"userId,omitempty"`
@@ -588,15 +618,16 @@ type profileView struct {
 	LastUsedAt        string   `json:"lastUsedAt,omitempty"`
 	IsPrimary         bool     `json:"isPrimary"`
 	IsCurrent         bool     `json:"isCurrent"`
+	IsOrgCurrent      bool     `json:"isOrgCurrent"`
 }
 
-func writeProfileListJSON(w io.Writer, cfg *authpkg.ProfilesConfig) error {
+func writeProfileListJSON(w io.Writer, configDir string, cfg *authpkg.ProfilesConfig) error {
 	resp := profileListResponse{
 		Success:         true,
 		PrimaryProfile:  cfg.PrimaryProfile,
 		CurrentProfile:  cfg.CurrentProfile,
 		PreviousProfile: cfg.PreviousProfile,
-		Profiles:        profileViews(cfg),
+		Profiles:        profileViews(configDir, cfg),
 	}
 	enc := json.NewEncoder(w)
 	enc.SetIndent("", "  ")
@@ -612,44 +643,51 @@ func writeProfileUseJSON(w io.Writer, profile *authpkg.Profile, cfg *authpkg.Pro
 			primaryProfile = cfg.PrimaryProfile
 			currentProfile = cfg.CurrentProfile
 		}
-		resp.Profile = profileViewFromProfile(*profile, primaryProfile, currentProfile)
+		resp.Profile = profileViewFromProfile(
+			*profile,
+			cfg,
+			primaryProfile,
+			currentProfile,
+			profileCountForCorp(cfg, profile.CorpID) <= 1,
+			nil,
+		)
 	}
 	enc := json.NewEncoder(w)
 	enc.SetIndent("", "  ")
 	return enc.Encode(resp)
 }
 
-func writeProfileListTable(w io.Writer, cfg *authpkg.ProfilesConfig) {
+func writeProfileListTable(w io.Writer, configDir string, cfg *authpkg.ProfilesConfig) {
 	if cfg == nil || len(cfg.Profiles) == 0 {
 		fmt.Fprintln(w, "未找到已登录 profile")
 		return
 	}
-	fmt.Fprintf(w, "%-3s %-3s %-28s %-34s %-10s %s\n", "CUR", "PRI", "ORG_NAME", "CORP_ID", "STATUS", "USER")
+	fmt.Fprintf(w, "%-3s %-28s %-34s %-10s %s\n", "CUR", "ORG_NAME", "CORP_ID", "STATUS", "USER")
 	for _, p := range cfg.Profiles {
+		selector := profileCLISelector(p, cfg)
+		view := profileViewFromProfile(
+			p,
+			cfg,
+			cfg.PrimaryProfile,
+			cfg.CurrentProfile,
+			profileCountForCorp(cfg, p.CorpID) == 1,
+			loadProfileTokenState(configDir, p, selector),
+		)
 		current := ""
-		if p.CorpID == cfg.CurrentProfile {
+		if view.IsCurrent {
 			current = "*"
 		}
-		primary := ""
-		if p.CorpID == cfg.PrimaryProfile {
-			primary = "*"
-		}
 		user := p.UserName
 		if user == "" {
 			user = p.UserID
 		}
-		status := p.Status
-		if status == "" {
-			status = authpkg.ProfileStatusActive
-		}
 		fmt.Fprintf(
 			w,
-			"%-3s %-3s %-28s %-34s %-10s %s\n",
+			"%-3s %-28s %-34s %-10s %s\n",
 			current,
-			primary,
 			clipProfileCell(profileOrgName(p), 28),
 			clipProfileCell(p.CorpID, 34),
-			status,
+			view.Status,
 			user,
 		)
 	}
@@ -677,19 +715,41 @@ func profileOrgName(p authpkg.Profile) string {
 	return strings.TrimSpace(p.CorpID)
 }
 
-func profileViews(cfg *authpkg.ProfilesConfig) []profileView {
+type profileTokenState struct {
+	Status       string
+	ExpiresAt    string
+	RefreshExpAt string
+}
+
+func profileViews(configDir string, cfg *authpkg.ProfilesConfig) []profileView {
 	if cfg == nil {
 		return nil
 	}
 	views := make([]profileView, 0, len(cfg.Profiles))
 	for _, p := range cfg.Profiles {
-		views = append(views, profileViewFromProfile(p, cfg.PrimaryProfile, cfg.CurrentProfile))
+		selector := profileCLISelector(p, cfg)
+		views = append(views, profileViewFromProfile(
+			p,
+			cfg,
+			cfg.PrimaryProfile,
+			cfg.CurrentProfile,
+			profileCountForCorp(cfg, p.CorpID) == 1,
+			loadProfileTokenState(configDir, p, selector),
+		))
 	}
 	return views
 }
 
-func profileViewFromProfile(p authpkg.Profile, primaryProfile, currentProfile string) profileView {
-	return profileView{
+func profileViewFromProfile(
+	p authpkg.Profile,
+	cfg *authpkg.ProfilesConfig,
+	primaryProfile, currentProfile string,
+	onlyAccountInOrg bool,
+	tokenState *profileTokenState,
+) profileView {
+	isOrgCurrent := profileIsOrgCurrent(p, cfg)
+	view := profileView{
+		Profile:           profileCLISelector(p, cfg),
 		CorpID:            p.CorpID,
 		CorpName:          profileOrgName(p),
 		UserID:            p.UserID,
@@ -701,9 +761,85 @@ func profileViewFromProfile(p authpkg.Profile, primaryProfile, currentProfile st
 		RefreshExpAt:      p.RefreshExpAt,
 		LastLoginAt:       p.LastLoginAt,
 		LastUsedAt:        p.LastUsedAt,
-		IsPrimary:         p.CorpID == primaryProfile,
-		IsCurrent:         p.CorpID == currentProfile,
+		IsPrimary:         profileSelectorSelectsProfile(primaryProfile, p, cfg, isOrgCurrent, onlyAccountInOrg),
+		IsCurrent:         profileSelectorSelectsProfile(currentProfile, p, cfg, isOrgCurrent, onlyAccountInOrg),
+		IsOrgCurrent:      isOrgCurrent,
 	}
+	if tokenState != nil {
+		view.Status = tokenState.Status
+		view.ExpiresAt = tokenState.ExpiresAt
+		view.RefreshExpAt = tokenState.RefreshExpAt
+	}
+	return view
+}
+
+func loadProfileTokenState(configDir string, profile authpkg.Profile, selectors ...string) *profileTokenState {
+	selector := authpkg.ProfileSelector(profile)
+	if len(selectors) > 0 && strings.TrimSpace(selectors[0]) != "" {
+		selector = strings.TrimSpace(selectors[0])
+	}
+	data, err := profileLoadTokenData(configDir, selector)
+	if errors.Is(err, authpkg.ErrTokenDataNotFound) || (err == nil && data == nil) {
+		return &profileTokenState{Status: authpkg.ProfileStatusRevoked}
+	}
+	if err != nil {
+		return &profileTokenState{Status: authpkg.ProfileStatusUnavailable}
+	}
+	status := authpkg.ProfileStatusExpired
+	if data.IsAccessTokenValid() {
+		status = authpkg.ProfileStatusActive
+	}
+	return &profileTokenState{
+		Status:       status,
+		ExpiresAt:    profileTokenTime(data.ExpiresAt),
+		RefreshExpAt: profileTokenTime(data.RefreshExpAt),
+	}
+}
+
+func profileCLISelector(profile authpkg.Profile, cfg *authpkg.ProfilesConfig) string {
+	return authpkg.ProfileSelectionSelector(profile, cfg)
+}
+
+func profileTokenTime(value time.Time) string {
+	if value.IsZero() {
+		return ""
+	}
+	return value.Format(time.RFC3339)
+}
+
+func profileSelectorSelectsProfile(selector string, profile authpkg.Profile, cfg *authpkg.ProfilesConfig, isOrgCurrent, onlyAccountInOrg bool) bool {
+	selector = strings.TrimSpace(selector)
+	if selector == authpkg.ProfileSelectionSelector(profile, cfg) {
+		return true
+	}
+	if corpID, userID, exact := authpkg.ParseIdentitySelector(selector); exact {
+		return corpID == strings.TrimSpace(profile.CorpID) && userID == strings.TrimSpace(profile.UserID)
+	}
+	return selector == strings.TrimSpace(profile.CorpID) && (isOrgCurrent || onlyAccountInOrg)
+}
+
+func profileCountForCorp(cfg *authpkg.ProfilesConfig, corpID string) int {
+	if cfg == nil {
+		return 0
+	}
+	count := 0
+	for _, profile := range cfg.Profiles {
+		if strings.TrimSpace(profile.CorpID) == strings.TrimSpace(corpID) {
+			count++
+		}
+	}
+	return count
+}
+
+func profileIsOrgCurrent(profile authpkg.Profile, cfg *authpkg.ProfilesConfig) bool {
+	if cfg == nil {
+		return false
+	}
+	selector := strings.TrimSpace(cfg.OrgCurrentProfiles[strings.TrimSpace(profile.CorpID)])
+	if corpID, userID, exact := authpkg.ParseIdentitySelector(selector); exact {
+		return corpID == strings.TrimSpace(profile.CorpID) && userID == strings.TrimSpace(profile.UserID)
+	}
+	return profileCountForCorp(cfg, profile.CorpID) == 1
 }
 
 func clipProfileCell(value string, limit int) string {

internal/app/profile_command_test.go

@@ -16,9 +16,11 @@ package app
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"strings"
 	"testing"
+	"time"
 
 	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
 	tea "github.com/charmbracelet/bubbletea"
@@ -80,8 +82,10 @@ func TestProfileListRootCommandJSONIncludesCorpName(t *testing.T) {
 	if !resp.Success {
 		t.Fatal("success = false, want true")
 	}
-	if resp.PrimaryProfile != "corp_primary" || resp.CurrentProfile != "corp_secondary" || resp.PreviousProfile != "corp_primary" {
-		t.Fatalf("profile pointers = primary %q current %q previous %q, want corp_primary/corp_secondary/corp_primary", resp.PrimaryProfile, resp.CurrentProfile, resp.PreviousProfile)
+	if resp.PrimaryProfile != "" ||
+		resp.CurrentProfile != "corp_secondary:user-corp_secondary" ||
+		resp.PreviousProfile != "corp_primary:user-corp_primary" {
+		t.Fatalf("profile pointers = primary %q current %q previous %q", resp.PrimaryProfile, resp.CurrentProfile, resp.PreviousProfile)
 	}
 	if len(resp.Profiles) != 2 {
 		t.Fatalf("profiles len = %d, want 2", len(resp.Profiles))
@@ -96,6 +100,181 @@ func TestProfileListRootCommandJSONIncludesCorpName(t *testing.T) {
 	}
 }
 
+func TestProfileListRootCommandJSONIncludesAllAccountsInSameCorp(t *testing.T) {
+	first := authLogoutTestToken("corp_same")
+	first.UserID = "user_1"
+	first.UserName = "账号一"
+	second := authLogoutTestToken("corp_same")
+	second.AccessToken = "access-second"
+	second.RefreshToken = "refresh-second"
+	second.UserID = "user_2"
+	second.UserName = "账号二"
+	setupAuthLogoutProfiles(t, first, second)
+
+	cmd := NewRootCommand()
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SetErr(&out)
+	cmd.SetArgs([]string{"--format", "json", "profile", "list"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("profile list --format json error = %v\noutput:\n%s", err, out.String())
+	}
+	var resp profileListResponse
+	if err := json.Unmarshal(out.Bytes(), &resp); err != nil {
+		t.Fatalf("Unmarshal() error = %v\noutput:\n%s", err, out.String())
+	}
+	if len(resp.Profiles) != 2 {
+		t.Fatalf("profiles len = %d, want 2: %#v", len(resp.Profiles), resp.Profiles)
+	}
+	got := make(map[string]profileView, len(resp.Profiles))
+	for _, profile := range resp.Profiles {
+		got[profile.Profile] = profile
+	}
+	if _, ok := got["corp_same:user_1"]; !ok {
+		t.Fatalf("profiles missing corp_same:user_1: %#v", resp.Profiles)
+	}
+	current, ok := got["corp_same:user_2"]
+	if !ok {
+		t.Fatalf("profiles missing corp_same:user_2: %#v", resp.Profiles)
+	}
+	if !current.IsOrgCurrent || !current.IsCurrent || current.IsPrimary {
+		t.Fatalf("last login account markers = %#v, want org-current/current and deprecated primary=false", current)
+	}
+	if got["corp_same:user_1"].IsOrgCurrent {
+		t.Fatalf("older account unexpectedly marked org current: %#v", got["corp_same:user_1"])
+	}
+}
+
+func TestProfileListUsesRealIdentityTokenState(t *testing.T) {
+	token := authLogoutTestToken("corp_real")
+	token.ExpiresAt = time.Date(2026, 7, 16, 17, 38, 0, 0, time.Local)
+	token.RefreshExpAt = time.Date(2026, 8, 16, 17, 38, 0, 0, time.Local)
+	configDir := setupAuthLogoutProfiles(t, token)
+
+	cfg, err := authpkg.LoadProfiles(configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() error = %v", err)
+	}
+	cfg.Profiles[0].Status = authpkg.ProfileStatusActive
+	cfg.Profiles[0].ExpiresAt = "2026-07-16T22:29:00+08:00"
+	cfg.Profiles[0].RefreshExpAt = "2026-09-16T22:29:00+08:00"
+	if err := authpkg.SaveProfiles(configDir, cfg); err != nil {
+		t.Fatalf("SaveProfiles() error = %v", err)
+	}
+
+	cmd := NewRootCommand()
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SetErr(&out)
+	cmd.SetArgs([]string{"--format", "json", "profile", "list"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("profile list error = %v\noutput:\n%s", err, out.String())
+	}
+	var resp profileListResponse
+	if err := json.Unmarshal(out.Bytes(), &resp); err != nil {
+		t.Fatalf("Unmarshal() error = %v\noutput:\n%s", err, out.String())
+	}
+	if len(resp.Profiles) != 1 {
+		t.Fatalf("profiles len = %d, want 1", len(resp.Profiles))
+	}
+	got := resp.Profiles[0]
+	if got.ExpiresAt != token.ExpiresAt.Format(time.RFC3339) {
+		t.Fatalf("expiresAt = %q, want real token %q", got.ExpiresAt, token.ExpiresAt.Format(time.RFC3339))
+	}
+	if got.RefreshExpAt != token.RefreshExpAt.Format(time.RFC3339) {
+		t.Fatalf("refreshExpAt = %q, want real token %q", got.RefreshExpAt, token.RefreshExpAt.Format(time.RFC3339))
+	}
+	if got.Status != authpkg.ProfileStatusExpired {
+		t.Fatalf("status = %q, want expired", got.Status)
+	}
+}
+
+func TestProfileListDistinguishesMissingAndUnavailableTokenState(t *testing.T) {
+	originalLoad := profileLoadTokenData
+	t.Cleanup(func() { profileLoadTokenData = originalLoad })
+	profile := authpkg.Profile{CorpID: "corp", UserID: "user"}
+
+	profileLoadTokenData = func(string, string) (*authpkg.TokenData, error) {
+		return nil, authpkg.ErrTokenDataNotFound
+	}
+	if state := loadProfileTokenState("cfg", profile); state.Status != authpkg.ProfileStatusRevoked {
+		t.Fatalf("missing token status = %q, want revoked", state.Status)
+	}
+
+	profileLoadTokenData = func(string, string) (*authpkg.TokenData, error) {
+		return nil, errors.New("keychain unavailable")
+	}
+	if state := loadProfileTokenState("cfg", profile); state.Status != authpkg.ProfileStatusUnavailable {
+		t.Fatalf("unavailable token status = %q, want unavailable", state.Status)
+	}
+}
+
+func TestProfileListCurrentFlagsUseStoredExactSelectors(t *testing.T) {
+	first := authLogoutTestToken("corp_same")
+	first.UserID = "user_1"
+	first.UserName = "账号一"
+	second := authLogoutTestToken("corp_same")
+	second.AccessToken = "access-second"
+	second.RefreshToken = "refresh-second"
+	second.UserID = "user_2"
+	second.UserName = "账号二"
+	configDir := setupAuthLogoutProfiles(t, first, second)
+
+	cfg, err := authpkg.LoadProfiles(configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() error = %v", err)
+	}
+	cfg.PrimaryProfile = ""
+	cfg.CurrentProfile = "corp_same:user_1"
+	cfg.OrgCurrentProfiles["corp_same"] = "corp_same:user_1"
+	if err := authpkg.SaveProfiles(configDir, cfg); err != nil {
+		t.Fatalf("SaveProfiles() error = %v", err)
+	}
+
+	cmd := NewRootCommand()
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SetErr(&out)
+	cmd.SetArgs([]string{"--format", "json", "profile", "list"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("profile list error = %v\noutput:\n%s", err, out.String())
+	}
+	var resp profileListResponse
+	if err := json.Unmarshal(out.Bytes(), &resp); err != nil {
+		t.Fatalf("Unmarshal() error = %v\noutput:\n%s", err, out.String())
+	}
+	got := make(map[string]profileView, len(resp.Profiles))
+	for _, profile := range resp.Profiles {
+		got[profile.Profile] = profile
+	}
+	if !got["corp_same:user_1"].IsCurrent || !got["corp_same:user_1"].IsOrgCurrent {
+		t.Fatalf("first account flags = %#v, want current and org current", got["corp_same:user_1"])
+	}
+	if got["corp_same:user_2"].IsCurrent || got["corp_same:user_2"].IsOrgCurrent {
+		t.Fatalf("second account flags = %#v, want neither current nor org current", got["corp_same:user_2"])
+	}
+	if got["corp_same:user_1"].IsPrimary || got["corp_same:user_2"].IsPrimary {
+		t.Fatalf("deprecated isPrimary should be false without primaryProfile: %#v", got)
+	}
+}
+
+func TestProfileListTableOmitsDeprecatedPrimaryColumn(t *testing.T) {
+	setupAuthLogoutProfiles(t, authLogoutTestToken("corp_table"))
+
+	cmd := NewRootCommand()
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SetErr(&out)
+	cmd.SetArgs([]string{"profile", "list"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("profile list error = %v\noutput:\n%s", err, out.String())
+	}
+	header := strings.SplitN(out.String(), "\n", 2)[0]
+	if strings.Contains(header, "PRI") {
+		t.Fatalf("profile list header still contains deprecated PRI column: %q", header)
+	}
+}
+
 func TestProfileUseRootCommandSwitchesOrganizationAndLegacyMirror(t *testing.T) {
 	configDir := setupAuthLogoutProfiles(t,
 		authLogoutTestToken("corp_primary"),
@@ -118,8 +297,9 @@ func TestProfileUseRootCommandSwitchesOrganizationAndLegacyMirror(t *testing.T)
 	if err != nil {
 		t.Fatalf("LoadProfiles() error = %v", err)
 	}
-	if cfg.CurrentProfile != "corp_primary" || cfg.PreviousProfile != "corp_secondary" {
-		t.Fatalf("profile pointers = current %q previous %q, want corp_primary/corp_secondary", cfg.CurrentProfile, cfg.PreviousProfile)
+	if cfg.CurrentProfile != "corp_primary:user-corp_primary" ||
+		cfg.PreviousProfile != "corp_secondary:user-corp_secondary" {
+		t.Fatalf("profile pointers = current %q previous %q", cfg.CurrentProfile, cfg.PreviousProfile)
 	}
 	legacyToken, err := authpkg.LoadTokenData(configDir)
 	if err != nil {
@@ -145,8 +325,9 @@ func TestProfileUseRootCommandSwitchesOrganizationAndLegacyMirror(t *testing.T)
 	if err != nil {
 		t.Fatalf("LoadProfiles() error = %v", err)
 	}
-	if cfg.CurrentProfile != "corp_secondary" || cfg.PreviousProfile != "corp_primary" {
-		t.Fatalf("profile pointers = current %q previous %q, want corp_secondary/corp_primary", cfg.CurrentProfile, cfg.PreviousProfile)
+	if cfg.CurrentProfile != "corp_secondary:user-corp_secondary" ||
+		cfg.PreviousProfile != "corp_primary:user-corp_primary" {
+		t.Fatalf("profile pointers = current %q previous %q", cfg.CurrentProfile, cfg.PreviousProfile)
 	}
 	legacyToken, err = authpkg.LoadTokenData(configDir)
 	if err != nil {
@@ -178,8 +359,9 @@ func TestProfileSwitchRootCommandSwitchesPrimaryOrganizationAndLegacyMirror(t *t
 	if err != nil {
 		t.Fatalf("LoadProfiles() error = %v", err)
 	}
-	if cfg.CurrentProfile != "corp_primary" || cfg.PreviousProfile != "corp_secondary" {
-		t.Fatalf("profile pointers = current %q previous %q, want corp_primary/corp_secondary", cfg.CurrentProfile, cfg.PreviousProfile)
+	if cfg.CurrentProfile != "corp_primary:user-corp_primary" ||
+		cfg.PreviousProfile != "corp_secondary:user-corp_secondary" {
+		t.Fatalf("profile pointers = current %q previous %q", cfg.CurrentProfile, cfg.PreviousProfile)
 	}
 	legacyToken, err := authpkg.LoadTokenData(configDir)
 	if err != nil {
@@ -209,8 +391,8 @@ func TestProfileSwitchRootCommandSupportsCorpIDFlag(t *testing.T) {
 	if err != nil {
 		t.Fatalf("LoadProfiles() error = %v", err)
 	}
-	if cfg.CurrentProfile != "corp_primary" {
-		t.Fatalf("currentProfile = %q, want corp_primary", cfg.CurrentProfile)
+	if cfg.CurrentProfile != "corp_primary:user-corp_primary" {
+		t.Fatalf("currentProfile = %q, want corp_primary:user-corp_primary", cfg.CurrentProfile)
 	}
 
 	cmd = NewRootCommand()
@@ -226,8 +408,8 @@ func TestProfileSwitchRootCommandSupportsCorpIDFlag(t *testing.T) {
 	if err != nil {
 		t.Fatalf("LoadProfiles() error = %v", err)
 	}
-	if cfg.CurrentProfile != "corp_secondary" {
-		t.Fatalf("currentProfile = %q, want corp_secondary", cfg.CurrentProfile)
+	if cfg.CurrentProfile != "corp_secondary:user-corp_secondary" {
+		t.Fatalf("currentProfile = %q, want corp_secondary:user-corp_secondary", cfg.CurrentProfile)
 	}
 }
 
@@ -287,8 +469,8 @@ func TestProfileSwitchNoArgsUsesTUISelector(t *testing.T) {
 	if err != nil {
 		t.Fatalf("LoadProfiles() error = %v", err)
 	}
-	if cfg.CurrentProfile != "corp_primary" {
-		t.Fatalf("currentProfile = %q, want corp_primary", cfg.CurrentProfile)
+	if cfg.CurrentProfile != "corp_primary:user-corp_primary" {
+		t.Fatalf("currentProfile = %q, want corp_primary:user-corp_primary", cfg.CurrentProfile)
 	}
 }
 
@@ -358,7 +540,7 @@ func TestProfileSwitchTUIViewUsesFixedOuterTable(t *testing.T) {
 	}
 }
 
-func TestProfileSwitchTUISortsLatestLoggedInProfilesFirst(t *testing.T) {
+func TestProfileSwitchTUIPreservesStoredOrderInsteadOfSortingByTime(t *testing.T) {
 	cfg := &authpkg.ProfilesConfig{
 		PrimaryProfile: "old",
 		CurrentProfile: "old",
@@ -370,7 +552,7 @@ func TestProfileSwitchTUISortsLatestLoggedInProfilesFirst(t *testing.T) {
 	}
 	model := newProfileSwitchTUIModel(cfg, "old")
 	gotOrder := []string{model.profiles[0].CorpID, model.profiles[1].CorpID, model.profiles[2].CorpID}
-	wantOrder := []string{"new", "fallback", "old"}
+	wantOrder := []string{"old", "new", "fallback"}
 	if strings.Join(gotOrder, ",") != strings.Join(wantOrder, ",") {
 		t.Fatalf("profile order = %v, want %v", gotOrder, wantOrder)
 	}
@@ -507,8 +689,8 @@ func TestProfileUseNoArgsUsesTUISelector(t *testing.T) {
 	if err != nil {
 		t.Fatalf("LoadProfiles() error = %v", err)
 	}
-	if cfg.CurrentProfile != "corp_primary" {
-		t.Fatalf("currentProfile = %q, want corp_primary", cfg.CurrentProfile)
+	if cfg.CurrentProfile != "corp_primary:user-corp_primary" {
+		t.Fatalf("currentProfile = %q, want corp_primary:user-corp_primary", cfg.CurrentProfile)
 	}
 }
 
@@ -549,7 +731,7 @@ func TestWriteProfileListTableIncludesCorpName(t *testing.T) {
 		},
 	}
 	var buf bytes.Buffer
-	writeProfileListTable(&buf, cfg)
+	writeProfileListTable(&buf, "", cfg)
 	out := buf.String()
 	for _, want := range []string{
 		"ORG_NAME",

internal/app/profile_full_coverage_test.go

@@ -105,7 +105,7 @@ func TestCrossPlatformCoverageProfileRemainingCoverage(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
-	if len(choices) != 3 || choices[0] != "current" || choices[1] != "primary" || choices[2] != "first" {
+	if len(choices) != 3 || choices[0] != "current" || choices[1] != "first" || choices[2] != "first" {
 		t.Fatalf("profile choices = %#v", choices)
 	}
 

internal/app/recovery_command.go

@@ -333,7 +333,11 @@ func (r *recoveryRuntime) CallToolDirect(ctx context.Context, serverID, toolName
 	if err != nil {
 		return nil, err
 	}
-	tc := r.transport.WithAuth(resolveRuntimeAuthToken(ctx, recoveryRuntimeToken(r.flags)), resolveIdentityHeaders())
+	authToken, err := resolveRuntimeAuthToken(ctx, recoveryRuntimeToken(r.flags))
+	if err != nil {
+		return nil, tokenResolutionError(err)
+	}
+	tc := r.transport.WithAuth(authToken, resolveIdentityHeaders())
 	result, err := tc.CallTool(ctx, endpoint, toolName, args)
 	if err != nil {
 		return nil, err

internal/app/root.go

@@ -23,7 +23,9 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
+	"sort"
 	"strings"
+	"sync"
 	"syscall"
 	"time"
 
@@ -68,7 +70,8 @@ var (
 	rootPluginDescriptors           = (*plugin.Plugin).ToServerDescriptors
 	rootPluginStdioClients          = (*plugin.Plugin).StdioClients
 	rootRegisterPluginHTTPServer    = registerPluginHTTPServer
-	rootRegisterStdioManifest       = registerStdioServerFromManifest
+	rootPluginStdioDescriptor       = stdioServerDescriptorFromManifest
+	rootRegisterResolvedStdioServer = registerResolvedStdioServer
 	rootPluginLoadHooks             = (*plugin.Plugin).LoadHooks
 	rootPluginSyncSkills            = plugin.SyncSkills
 	rootAuthLoadTokenData           = authpkg.LoadTokenData
@@ -305,13 +308,28 @@ func NewRootCommand(ctx ...context.Context) *cobra.Command {
 	if len(ctx) > 0 && ctx[0] != nil {
 		rootCtx = ctx[0]
 	}
-	return NewRootCommandWithEngine(rootCtx, nil)
+	return newRootCommandWithEngine(rootCtx, nil, true)
+}
+
+// NewSchemaSourceRootCommand constructs the distribution-owned command tree
+// used by Schema generation and command-surface policy. Installed plugins and
+// user-defined shortcuts must not change the reviewed embedded Schema.
+func NewSchemaSourceRootCommand(ctx ...context.Context) *cobra.Command {
+	var rootCtx context.Context
+	if len(ctx) > 0 && ctx[0] != nil {
+		rootCtx = ctx[0]
+	}
+	return newRootCommandWithEngine(rootCtx, nil, false)
 }
 
 // NewRootCommandWithEngine constructs the root CLI command with an
 // optional pipeline engine for input correction. When engine is nil,
 // no pipeline processing is applied.
 func NewRootCommandWithEngine(rootCtx context.Context, engine *pipeline.Engine) *cobra.Command {
+	return newRootCommandWithEngine(rootCtx, engine, true)
+}
+
+func newRootCommandWithEngine(rootCtx context.Context, engine *pipeline.Engine, loadRuntimeExtensions bool) *cobra.Command {
 	if rootCtx == nil {
 		rootCtx = context.Background()
 	}
@@ -367,11 +385,16 @@ func NewRootCommandWithEngine(rootCtx context.Context, engine *pipeline.Engine)
 
 	schemaCmd := newSchemaCommand(loader)
 	mcpCmd := newMCPCommand(rootCtx, loader, runner, engine)
-	mcpCmd.Hidden = true
+	// The legacy dynamic MCP surface remains disabled, but reviewed static MCP
+	// helpers registered below are part of the public CLI and Schema surface.
+	mcpCmd.Hidden = false
+	mcpCmd.Short = "管理 MCP 服务连接信息"
+	mcpCmd.Long = "管理经过审核并纳入 Schema 的 MCP 服务连接辅助能力。"
 	// Wrap the caller so every MCP tool call's shape is recorded to the local
 	// usage log (privacy-preserving; see internal/shortcut/usage). Powers
 	// `dws shortcut stats` and future high-frequency shortcut distillation.
 	patCaller := newRecordingToolCaller(newToolCallerAdapter(runner, flags))
+	mcpCmd.AddCommand(newMCPURLGroup(patCaller))
 
 	utilityCommands := []*cobra.Command{
 		newAuthCommand(patCaller),
@@ -395,16 +418,9 @@ func NewRootCommandWithEngine(rootCtx context.Context, engine *pipeline.Engine)
 	}
 	root.AddCommand(utilityCommands...)
 
-	root.AddCommand(newLegacyPublicCommands(runner, patCaller)...)
+	root.AddCommand(newLegacyPublicCommands(runner, patCaller, loadRuntimeExtensions)...)
 	root.AddCommand(newLegacyHiddenCommands(runner)...)
 
-	// --- Plugin loading: runs AFTER legacy commands so plugin endpoints can
-	// be appended on top of the static endpoint registry.
-	pluginCmds := rootLoadPlugins(engine, runner)
-	if len(pluginCmds) > 0 {
-		addPluginCommandsSafe(root, pluginCmds)
-	}
-
 	// PAT authorization commands (open-source core)
 	pat.RegisterCommands(root, patCaller)
 
@@ -413,6 +429,15 @@ func NewRootCommandWithEngine(rootCtx context.Context, engine *pipeline.Engine)
 		fn(root, caller)
 		deduplicateCommands(root)
 	}
+	if loadRuntimeExtensions {
+		// Resolve plugins only after the complete distribution command tree is
+		// present, so endpoint and Cobra conflict checks see PAT and edition
+		// commands as well as the open-source base.
+		pluginCmds := rootLoadPlugins(root, engine, runner)
+		if len(pluginCmds) > 0 {
+			addPluginCommandsSafe(root, pluginCmds)
+		}
+	}
 	hideNonDirectRuntimeCommands(root)
 	configureRootHelp(root)
 	// Set custom flag error handler for better UX
@@ -599,6 +624,7 @@ func hideNonDirectRuntimeCommands(root *cobra.Command) {
 		"profile":    true,
 		"version":    true,
 		"help":       true,
+		"markdown":   true,
 		"recovery":   true,
 		"schema":     true,
 		"mcp":        true,
@@ -630,12 +656,17 @@ var reservedCommands = map[string]bool{
 	"schema": true, "mcp": true, "help": true,
 }
 
+var replaceablePluginFallbacks = map[string]bool{
+	"conference": true,
+}
+
 // addPluginCommandsSafe registers plugin commands with conflict detection.
 //
 // Rules:
 //   - Plugin vs reserved (auth/plugin/cache/...) → reject, warn
 //   - Plugin vs plugin (same name)               → reject later one, warn
-//   - Plugin vs Market dynamic command            → allow, plugin wins
+//   - Plugin vs hidden compatibility fallback     → allow, plugin wins
+//   - Plugin vs visible distribution command      → reject, warn
 func addPluginCommandsSafe(root *cobra.Command, pluginCmds []*cobra.Command) {
 	// Build index of existing commands before plugin registration.
 	existing := make(map[string]bool)
@@ -663,17 +694,47 @@ func addPluginCommandsSafe(root *cobra.Command, pluginCmds []*cobra.Command) {
 		}
 		pluginSeen[name] = true
 
-		// Rule 3: plugin vs Market — plugin wins, remove the old one.
+		// An alias must not bypass the same protections applied to primary
+		// plugin command names or shadow another root command.
+		filteredAliases := make([]string, 0, len(cmd.Aliases))
+		for _, rawAlias := range cmd.Aliases {
+			alias := strings.TrimSpace(rawAlias)
+			if alias == "" || alias == name || reservedCommands[alias] ||
+				existing[alias] || pluginSeen[alias] {
+				if alias != "" {
+					slog.Warn("plugin: command alias conflicts with an existing command, skipping",
+						"command", name, "alias", alias)
+				}
+				continue
+			}
+			pluginSeen[alias] = true
+			filteredAliases = append(filteredAliases, alias)
+		}
+		cmd.Aliases = filteredAliases
+
+		// Rule 3: an installed plugin may replace a hidden compatibility
+		// fallback (for example conference), but never a visible distribution
+		// command that participates in the reviewed base interface.
 		if existing[name] {
 			for _, old := range root.Commands() {
 				if old.Name() == name {
+					if !old.Hidden || !replaceablePluginFallbacks[name] ||
+						cmdutil.IsPluginSourced(old) {
+						slog.Warn("plugin: command conflicts with a visible distribution command, skipping",
+							"command", name)
+						cmd = nil
+						break
+					}
 					root.RemoveCommand(old)
-					slog.Debug("plugin: overriding Market command",
+					slog.Debug("plugin: overriding hidden compatibility command",
 						"command", name)
 					break
 				}
 			}
 		}
+		if cmd == nil {
+			continue
+		}
 
 		root.AddCommand(cmd)
 	}
@@ -748,7 +809,10 @@ func validateOptionalPath(flagName, path string) error {
 
 // fileLogger holds the package-level file logger for diagnostics.
 // It is initialized by configureLogLevel and closed by CloseFileLogger.
-var fileLogger *logging.FileLogger
+var (
+	fileLoggerMu sync.Mutex
+	fileLogger   *logging.FileLogger
+)
 
 // configureLogLevel sets the global slog level based on --debug and --verbose flags
 // and initializes the file logger for diagnostics.
@@ -770,18 +834,24 @@ func configureLogLevel(flags *GlobalFlags) {
 
 	// Initialize file logger — writes to ~/.dws/logs/dws.log at DEBUG level
 	// regardless of stderr level. All slog calls are captured for diagnostics.
-	// A previously closed rotating writer may have been reopened by slog calls
-	// made while constructing another root command, so close it before replacing
-	// the package pointer during reentrant executions.
-	CloseFileLogger()
-	fileLogger = logging.Setup(defaultConfigDir())
-	fileHandler := slog.NewJSONHandler(fileLogger.Writer(), &slog.HandlerOptions{Level: slog.LevelDebug})
+	logger := logging.Setup(defaultConfigDir())
+	fileHandler := slog.NewJSONHandler(logger.Writer(), &slog.HandlerOptions{Level: slog.LevelDebug})
+	defaultLogger := slog.New(logging.NewMultiHandler(stderrHandler, fileHandler))
 
-	slog.SetDefault(slog.New(logging.NewMultiHandler(stderrHandler, fileHandler)))
+	fileLoggerMu.Lock()
+	defer fileLoggerMu.Unlock()
+	previous := fileLogger
+	fileLogger = logger
+	slog.SetDefault(defaultLogger)
+	if previous != nil {
+		_ = previous.Close()
+	}
 }
 
 // FileLoggerInstance returns the package-level file logger, or nil if not initialized.
 func FileLoggerInstance() *slog.Logger {
+	fileLoggerMu.Lock()
+	defer fileLoggerMu.Unlock()
 	if fileLogger == nil {
 		return nil
 	}
@@ -790,15 +860,32 @@ func FileLoggerInstance() *slog.Logger {
 
 // CloseFileLogger flushes and closes the file logger.
 func CloseFileLogger() {
+	fileLoggerMu.Lock()
+	defer fileLoggerMu.Unlock()
 	if fileLogger != nil {
-		fileLogger.Close()
+		_ = fileLogger.Close()
+		fileLogger = nil
 	}
 }
 
 // loadPlugins registers versioned plugin manifests, stdio clients, hooks, and
 // skills. It deliberately does not initialize MCP transports or call
 // tools/list while constructing the command tree.
-func loadPlugins(engine *pipeline.Engine, _ executor.Runner) []*cobra.Command {
+type pluginServerCandidate struct {
+	owner       *plugin.Plugin
+	order       int
+	descriptor  mcptypes.ServerDescriptor
+	stdioClient *plugin.StdioServerClient
+}
+
+type pluginIdentityOwner struct {
+	plugin    *plugin.Plugin
+	serverKey string
+	rootName  string
+	shareable bool
+}
+
+func loadPlugins(root *cobra.Command, engine *pipeline.Engine, runner executor.Runner) []*cobra.Command {
 	pluginLoader := plugin.NewLoader(RawVersion())
 
 	// 0a. Inject plugin config values from settings.json as environment
@@ -825,25 +912,34 @@ func loadPlugins(engine *pipeline.Engine, _ executor.Runner) []*cobra.Command {
 
 	// 2. Load dev plugins (registered via `dws plugin dev`)
 	devPlugins := rootPluginLoadDev(pluginLoader)
+	sortPluginsForRegistration(userPlugins)
+	sortPluginsForRegistration(devPlugins)
 
 	allPlugins := append(userPlugins, devPlugins...)
+	descriptorsByPlugin := make(map[*plugin.Plugin][]mcptypes.ServerDescriptor, len(allPlugins))
 
-	// 3. Register HTTP descriptors and authentication from the manifest.
-	for _, p := range allPlugins {
-		for _, srv := range rootPluginDescriptors(p) {
-			rootRegisterPluginHTTPServer(srv)
+	// 3. Resolve every descriptor once, then choose identity winners before
+	// mutating endpoint, auth, or stdio-client registries. This keeps the
+	// visible command and its transport owned by the same plugin.
+	candidates := collectPluginServerCandidates(allPlugins, userCtx)
+	accepted := selectPluginServerCandidates(root, candidates)
+	for _, candidate := range accepted {
+		if candidate.stdioClient != nil {
+			rootRegisterResolvedStdioServer(
+				candidate.owner,
+				*candidate.stdioClient,
+				candidate.descriptor,
+			)
+		} else {
+			rootRegisterPluginHTTPServer(candidate.descriptor)
 		}
+		descriptorsByPlugin[candidate.owner] = append(
+			descriptorsByPlugin[candidate.owner],
+			candidate.descriptor,
+		)
 	}
 
-	// 4. Register stdio descriptors and unstarted clients. The subprocess is
-	// started and initialized only when a command is actually executed.
-	for _, p := range allPlugins {
-		for _, sc := range rootPluginStdioClients(p, userCtx) {
-			rootRegisterStdioManifest(p, sc)
-		}
-	}
-
-	// 5. Register plugin hooks into pipeline engine
+	// 4. Register plugin hooks into pipeline engine
 	if engine != nil {
 		for _, p := range allPlugins {
 			hooksCfg, err := rootPluginLoadHooks(p)
@@ -861,7 +957,7 @@ func loadPlugins(engine *pipeline.Engine, _ executor.Runner) []*cobra.Command {
 		}
 	}
 
-	// 7. Sync plugin skills to agent directories
+	// 5. Sync plugin skills to agent directories
 	rootPluginSyncSkills(allPlugins)
 
 	if len(allPlugins) > 0 {
@@ -871,11 +967,228 @@ func loadPlugins(engine *pipeline.Engine, _ executor.Runner) []*cobra.Command {
 		)
 	}
 
-	return nil
+	var pluginCommands []*cobra.Command
+	for _, p := range allPlugins {
+		// Build each plugin independently. addPluginCommandsSafe deliberately
+		// resolves cross-plugin root conflicts with first-plugin-wins semantics.
+		pluginCommands = append(pluginCommands, buildPluginCommands(descriptorsByPlugin[p], runner, root)...)
+	}
+	return pluginCommands
+}
+
+func sortPluginsForRegistration(plugins []*plugin.Plugin) {
+	sort.SliceStable(plugins, func(i, j int) bool {
+		left := strings.TrimSpace(plugins[i].Manifest.Name) + "\x00" + strings.TrimSpace(plugins[i].Root)
+		right := strings.TrimSpace(plugins[j].Manifest.Name) + "\x00" + strings.TrimSpace(plugins[j].Root)
+		return left < right
+	})
+}
+
+func collectPluginServerCandidates(
+	plugins []*plugin.Plugin,
+	userCtx *plugin.UserContext,
+) []pluginServerCandidate {
+	var candidates []pluginServerCandidate
+	for order, owner := range plugins {
+		for _, descriptor := range rootPluginDescriptors(owner) {
+			candidates = append(candidates, pluginServerCandidate{
+				owner:      owner,
+				order:      order,
+				descriptor: descriptor,
+			})
+		}
+		for _, stdioClient := range rootPluginStdioClients(owner, userCtx) {
+			descriptor, ok := rootPluginStdioDescriptor(owner, stdioClient)
+			if !ok {
+				continue
+			}
+			clientCopy := stdioClient
+			candidates = append(candidates, pluginServerCandidate{
+				owner:       owner,
+				order:       order,
+				descriptor:  descriptor,
+				stdioClient: &clientCopy,
+			})
+		}
+	}
+	sort.SliceStable(candidates, func(i, j int) bool {
+		if candidates[i].order != candidates[j].order {
+			return candidates[i].order < candidates[j].order
+		}
+		left := strings.TrimSpace(candidates[i].descriptor.Key)
+		right := strings.TrimSpace(candidates[j].descriptor.Key)
+		if left != right {
+			return left < right
+		}
+		return candidates[i].stdioClient == nil && candidates[j].stdioClient != nil
+	})
+	return candidates
+}
+
+func selectPluginServerCandidates(
+	root *cobra.Command,
+	candidates []pluginServerCandidate,
+) []pluginServerCandidate {
+	distributionProducts := DirectRuntimeProductIDs()
+	owners := make(map[string]pluginIdentityOwner)
+	for identity := range distributionProducts {
+		if replaceablePluginFallbacks[identity] {
+			continue
+		}
+		owners[identity] = pluginIdentityOwner{serverKey: "distribution"}
+	}
+
+	accepted := make([]pluginServerCandidate, 0, len(candidates))
+	for _, candidate := range candidates {
+		descriptor := candidate.descriptor
+		if descriptor.CLI.Skip {
+			continue
+		}
+		if reason := unsupportedPluginDescriptor(root, descriptor); reason != "" {
+			slog.Warn("plugin: descriptor CLI semantics are unsupported, skipping",
+				"plugin", candidate.owner.Manifest.Name,
+				"server", descriptor.Key,
+				"field", reason)
+			continue
+		}
+		if pluginDescriptorConflictsWithDistribution(root, descriptor, distributionProducts) {
+			continue
+		}
+		claims := pluginDescriptorIdentityClaims(descriptor)
+		conflict := ""
+		for identity, shareable := range claims {
+			existing, exists := owners[identity]
+			if !exists {
+				continue
+			}
+			rootName := pluginDescriptorRootName(descriptor)
+			if shareable && existing.shareable &&
+				existing.plugin == candidate.owner &&
+				existing.rootName == rootName {
+				continue
+			}
+			conflict = identity
+			break
+		}
+		if conflict != "" {
+			slog.Warn("plugin: descriptor identity already owned, skipping",
+				"plugin", candidate.owner.Manifest.Name,
+				"server", descriptor.Key,
+				"identity", conflict)
+			continue
+		}
+		rootName := pluginDescriptorRootName(descriptor)
+		for identity, shareable := range claims {
+			if existing, exists := owners[identity]; exists &&
+				shareable && existing.shareable &&
+				existing.plugin == candidate.owner &&
+				existing.rootName == rootName {
+				continue
+			}
+			owners[identity] = pluginIdentityOwner{
+				plugin:    candidate.owner,
+				serverKey: descriptor.Key,
+				rootName:  rootName,
+				shareable: shareable,
+			}
+		}
+		accepted = append(accepted, candidate)
+	}
+	return accepted
+}
+
+func pluginDescriptorIdentityClaims(descriptor mcptypes.ServerDescriptor) map[string]bool {
+	claims := make(map[string]bool)
+	canonicalID := firstNonEmptyPluginString(descriptor.CLI.ID, descriptor.Key)
+	if canonicalID != "" {
+		claims[canonicalID] = false
+	}
+	for _, identity := range append(
+		[]string{pluginDescriptorRootName(descriptor)},
+		descriptor.CLI.Aliases...,
+	) {
+		identity = strings.TrimSpace(identity)
+		if identity == "" {
+			continue
+		}
+		if _, exists := claims[identity]; !exists {
+			claims[identity] = true
+		}
+	}
+	return claims
+}
+
+func pluginDescriptorRootName(descriptor mcptypes.ServerDescriptor) string {
+	return firstNonEmptyPluginString(
+		descriptor.CLI.Command,
+		descriptor.CLI.ID,
+		descriptor.Key,
+	)
+}
+
+func pluginDescriptorConflictsWithDistribution(
+	root *cobra.Command,
+	descriptor mcptypes.ServerDescriptor,
+	distributionProducts map[string]bool,
+) bool {
+	candidates := append(
+		[]string{
+			firstNonEmptyPluginString(descriptor.CLI.ID, descriptor.Key),
+			pluginDescriptorRootName(descriptor),
+		},
+		descriptor.CLI.Aliases...,
+	)
+	for _, candidate := range candidates {
+		candidate = strings.TrimSpace(candidate)
+		if candidate == "" {
+			continue
+		}
+		if !reservedCommands[candidate] && replaceablePluginFallbacks[candidate] {
+			// The distribution ships only a hidden compatibility fallback for
+			// this name; plugins may claim it and the later command merge in
+			// addPluginCommandsSafe still rejects visible non-fallback owners.
+			continue
+		}
+		if reservedCommands[candidate] ||
+			distributionProducts[candidate] ||
+			distributionRootOwns(root, candidate) {
+			slog.Warn("plugin: descriptor conflicts with a distribution command, skipping",
+				"plugin", descriptor.DisplayName,
+				"server", descriptor.Key,
+				"identity", candidate)
+			return true
+		}
+	}
+	return false
+}
+
+func distributionRootOwns(root *cobra.Command, name string) bool {
+	if root == nil {
+		return false
+	}
+	for _, command := range root.Commands() {
+		if cmdutil.IsPluginSourced(command) {
+			continue
+		}
+		if command.Name() == name {
+			if command.Hidden && replaceablePluginFallbacks[name] {
+				return false
+			}
+			return true
+		}
+		for _, alias := range command.Aliases {
+			if strings.TrimSpace(alias) == name {
+				return true
+			}
+		}
+	}
+	return false
 }
 
 func registerPluginHTTPServer(srv mcptypes.ServerDescriptor) {
 	AppendDynamicServer(srv)
+	productID := firstNonEmptyPluginString(srv.CLI.ID, srv.Key)
+	ClearPluginAuth(productID)
 	if len(srv.AuthHeaders) > 0 {
 		registerPluginAuthFromHeaders(srv)
 	}
@@ -904,10 +1217,7 @@ func registerPluginAuthFromHeaders(srv mcptypes.ServerDescriptor) {
 		host := parsed.Hostname()
 		trustedDomains = []string{host, "*." + host}
 	}
-	productID := strings.TrimSpace(srv.CLI.ID)
-	if productID == "" {
-		productID = srv.Key
-	}
+	productID := firstNonEmptyPluginString(srv.CLI.ID, srv.Key)
 	RegisterPluginAuth(productID, &PluginAuth{
 		Token:          authToken,
 		ExtraHeaders:   extraHeaders,

internal/app/root_full_coverage_test.go

@@ -75,7 +75,7 @@ func TestCrossPlatformCoverageRootConstructionHooksAndVersionCoverage(t *testing
 		version, buildTime, gitCommit = oldVersion, oldBuild, oldCommit
 	})
 
-	rootLoadPlugins = func(*pipeline.Engine, executor.Runner) []*cobra.Command {
+	rootLoadPlugins = func(*cobra.Command, *pipeline.Engine, executor.Runner) []*cobra.Command {
 		return []*cobra.Command{{Use: "plugin-added", Run: func(*cobra.Command, []string) {}}}
 	}
 	preRunCalled := false
@@ -236,7 +236,8 @@ func TestCrossPlatformCoverageRootLoadPluginsRemainingCoverage(t *testing.T) {
 	oldDescriptors := rootPluginDescriptors
 	oldStdioClients := rootPluginStdioClients
 	oldHTTP := rootRegisterPluginHTTPServer
-	oldStdio := rootRegisterStdioManifest
+	oldStdioDescriptor := rootPluginStdioDescriptor
+	oldStdioRegister := rootRegisterResolvedStdioServer
 	oldHooks := rootPluginLoadHooks
 	oldSync := rootPluginSyncSkills
 	oldToken := rootAuthLoadTokenData
@@ -247,7 +248,8 @@ func TestCrossPlatformCoverageRootLoadPluginsRemainingCoverage(t *testing.T) {
 		rootPluginDescriptors = oldDescriptors
 		rootPluginStdioClients = oldStdioClients
 		rootRegisterPluginHTTPServer = oldHTTP
-		rootRegisterStdioManifest = oldStdio
+		rootPluginStdioDescriptor = oldStdioDescriptor
+		rootRegisterResolvedStdioServer = oldStdioRegister
 		rootPluginLoadHooks = oldHooks
 		rootPluginSyncSkills = oldSync
 		rootAuthLoadTokenData = oldToken
@@ -264,9 +266,17 @@ func TestCrossPlatformCoverageRootLoadPluginsRemainingCoverage(t *testing.T) {
 	}
 	rootPluginDescriptors = func(p *plugin.Plugin) []mcptypes.ServerDescriptor {
 		if p == p1 {
-			return []mcptypes.ServerDescriptor{{Key: "http", Endpoint: "https://example.test"}}
+			return []mcptypes.ServerDescriptor{{
+				Key: "http", Endpoint: "https://example.test",
+				CLI: mcptypes.CLIOverlay{
+					ID: "http", Command: "one-http",
+					ToolOverrides: map[string]mcptypes.CLIToolOverride{
+						"ping": {CLIName: "ping"},
+					},
+				},
+			}}
 		}
-		return []mcptypes.ServerDescriptor{{Key: "no-cli", Endpoint: "https://example.test"}}
+		return []mcptypes.ServerDescriptor{{Key: p.Manifest.Name + "-no-cli", Endpoint: "https://example.test"}}
 	}
 	client := transport.NewStdioClient("ignored", nil, nil)
 	rootPluginStdioClients = func(p *plugin.Plugin, uc *plugin.UserContext) []plugin.StdioServerClient {
@@ -278,9 +288,23 @@ func TestCrossPlatformCoverageRootLoadPluginsRemainingCoverage(t *testing.T) {
 	httpCount := 0
 	stdioCount := 0
 	rootRegisterPluginHTTPServer = func(mcptypes.ServerDescriptor) { httpCount++ }
-	rootRegisterStdioManifest = func(*plugin.Plugin, plugin.StdioServerClient) mcptypes.ServerDescriptor {
+	rootPluginStdioDescriptor = func(*plugin.Plugin, plugin.StdioServerClient) (mcptypes.ServerDescriptor, bool) {
+		return mcptypes.ServerDescriptor{
+			Key: "local",
+			CLI: mcptypes.CLIOverlay{
+				ID: "local", Command: "one-stdio",
+				ToolOverrides: map[string]mcptypes.CLIToolOverride{
+					"pong": {CLIName: "pong"},
+				},
+			},
+		}, true
+	}
+	rootRegisterResolvedStdioServer = func(
+		*plugin.Plugin,
+		plugin.StdioServerClient,
+		mcptypes.ServerDescriptor,
+	) {
 		stdioCount++
-		return mcptypes.ServerDescriptor{}
 	}
 	rootPluginLoadHooks = func(p *plugin.Plugin) (*plugin.HooksConfig, error) {
 		switch p {
@@ -294,7 +318,8 @@ func TestCrossPlatformCoverageRootLoadPluginsRemainingCoverage(t *testing.T) {
 	}
 	synced := false
 	rootPluginSyncSkills = func([]*plugin.Plugin) { synced = true }
-	if got := loadPlugins(pipeline.NewEngine(), runnerCoverageFallback{}); got != nil {
+	got := loadPlugins(nil, pipeline.NewEngine(), runnerCoverageFallback{})
+	if len(got) != 2 || got[0].Name() != "one-http" || got[1].Name() != "one-stdio" {
 		t.Fatalf("loaded plugin commands = %#v", got)
 	}
 	if httpCount != 3 || stdioCount != 1 || !synced {

internal/app/root_help_test.go

@@ -15,11 +15,14 @@ package app
 
 import (
 	"bytes"
+	stderrors "errors"
 	"io"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
+	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 	"github.com/spf13/cobra"
 )
@@ -75,7 +78,14 @@ func TestRootKeepsMainBranchChatCompatibilityCommands(t *testing.T) {
 		}
 	}
 
-	mediaUpload := mustFindCommand(t, root, "chat", "media", "upload")
+	mediaGroup := mustFindCommand(t, root, "chat", "media")
+	if mediaGroup.Deprecated == "" || mediaGroup.Hidden || !mediaGroup.Runnable() {
+		t.Fatalf("chat media compatibility contract: deprecated=%q hidden=%v runnable=%v", mediaGroup.Deprecated, mediaGroup.Hidden, mediaGroup.Runnable())
+	}
+	mediaUpload := mustFindCommand(t, mediaGroup, "upload")
+	if mediaUpload.Deprecated == "" || mediaUpload.Hidden || !mediaUpload.Runnable() {
+		t.Fatalf("chat media upload compatibility contract: deprecated=%q hidden=%v runnable=%v", mediaUpload.Deprecated, mediaUpload.Hidden, mediaUpload.Runnable())
+	}
 	for _, flag := range []string{"file", "type"} {
 		if mediaUpload.Flags().Lookup(flag) == nil {
 			t.Fatalf("chat media upload missing --%s", flag)
@@ -88,6 +98,113 @@ func TestRootKeepsMainBranchChatCompatibilityCommands(t *testing.T) {
 	mustFindCommand(t, root, "conference", "meeting", "reserve")
 }
 
+func TestChatHelpAndSchemaHideRetiredMediaUpload(t *testing.T) {
+	for _, args := range [][]string{
+		{"chat", "--help"},
+		{"chat", "media", "--help"},
+	} {
+		root := NewRootCommand()
+		var output bytes.Buffer
+		root.SetOut(&output)
+		root.SetErr(&output)
+		root.SetArgs(args)
+		if err := root.Execute(); err != nil {
+			t.Fatalf("dws %s: %v\n%s", strings.Join(args, " "), err, output.String())
+		}
+		for _, line := range strings.Split(output.String(), "\n") {
+			fields := strings.Fields(line)
+			if len(fields) > 0 && (fields[0] == "media" || fields[0] == "upload") {
+				t.Fatalf("dws %s exposes retired command in Help line %q:\n%s", strings.Join(args, " "), line, output.String())
+			}
+		}
+	}
+
+	root := NewRootCommand()
+	var output bytes.Buffer
+	root.SetOut(&output)
+	root.SetErr(&output)
+	root.SetArgs([]string{"schema", "--cli-path", "chat media upload", "--format", "json"})
+	err := root.Execute()
+	if err == nil {
+		t.Fatalf("retired chat media upload remains queryable from Schema:\n%s", output.String())
+	}
+	if !strings.Contains(err.Error(), "unknown runtime schema path") {
+		t.Fatalf("retired chat media upload Schema error = %v, want unknown path", err)
+	}
+}
+
+func TestRootChatMediaUploadWithoutAppCredentialsReturnsMigrationValidation(t *testing.T) {
+	for _, key := range []string{"DWS_CLIENT_ID", "DWS_CLIENT_SECRET"} {
+		value, existed := os.LookupEnv(key)
+		if err := os.Unsetenv(key); err != nil {
+			t.Fatalf("unset %s: %v", key, err)
+		}
+		t.Cleanup(func() {
+			if existed {
+				_ = os.Setenv(key, value)
+				return
+			}
+			_ = os.Unsetenv(key)
+		})
+		if _, exists := os.LookupEnv(key); exists {
+			t.Fatalf("%s is still set", key)
+		}
+	}
+	t.Setenv("DWS_CONFIG_DIR", filepath.Join(t.TempDir(), "config"))
+
+	filePath := filepath.Join(t.TempDir(), "image.png")
+	if err := os.WriteFile(filePath, []byte("image"), 0o600); err != nil {
+		t.Fatalf("write image fixture: %v", err)
+	}
+	commandArgs := []string{
+		"chat", "media", "upload",
+		"--file", filePath,
+		"--type", "image",
+	}
+	previousArgs := os.Args
+	os.Args = append([]string{"dws"}, commandArgs...)
+	t.Cleanup(func() { os.Args = previousArgs })
+
+	root := NewRootCommand()
+	var output bytes.Buffer
+	root.SetOut(&output)
+	root.SetErr(&output)
+	root.SetArgs(commandArgs)
+	err := root.Execute()
+	if err == nil {
+		t.Fatalf("chat media upload succeeded without app credentials:\n%s", output.String())
+	}
+
+	var typed *apperrors.Error
+	if !stderrors.As(err, &typed) {
+		t.Fatalf("chat media upload error type = %T, want *errors.Error: %v", err, err)
+	}
+	if typed.Category != apperrors.CategoryValidation {
+		t.Fatalf("chat media upload category = %q, want %q", typed.Category, apperrors.CategoryValidation)
+	}
+	if exitCode := apperrors.ExitCode(err); exitCode != 3 {
+		t.Fatalf("chat media upload exit code = %d, want 3", exitCode)
+	}
+
+	got := output.String() + "\n" + err.Error()
+	for _, want := range []string{"已下线", "chat message send --msg-type file --file-path"} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("chat media upload migration output missing %q:\n%s", want, got)
+		}
+	}
+	for _, forbidden := range []string{
+		"DWS_CLIENT_ID",
+		"DWS_CLIENT_SECRET",
+		"缺少应用凭证",
+		"AppSecret",
+		"clientSecret",
+	} {
+		if strings.Contains(got, forbidden) {
+			t.Fatalf("chat media upload returned credential error %q:\n%s", forbidden, got)
+		}
+	}
+}
+
 func TestRootKeepsContactWukongCompatibilityCommands(t *testing.T) {
 	root := NewRootCommand()
 	label := mustFindCommand(t, root, "contact", "label")

internal/app/runner.go

@@ -168,6 +168,7 @@ var (
 	runnerPreflightDocDownload          = (*runtimeRunner).preflightDocDownload
 	runnerCallTool                      = (*transport.Client).CallTool
 	runnerStdioEnsureInitialized        = (*transport.StdioClient).EnsureInitialized
+	runnerStdioListTools                = (*transport.StdioClient).ListTools
 	runnerStdioCallTool                 = (*transport.StdioClient).CallTool
 	runnerHandlePatAuthCheck            func(context.Context, *runtimeRunner, executor.Invocation, *apperrors.PATError, string, io.Writer) (executor.Result, error)
 	runnerRetryWithPatAuthRetry         func(context.Context, executor.Runner, executor.Invocation, *PatScopeError, string, io.Writer) (executor.Result, error)
@@ -193,13 +194,32 @@ func (r *runtimeRunner) Run(ctx context.Context, invocation executor.Invocation)
 	// invocations within the same process free.
 	logHostOwnedPATDecisionOnce()
 
-	selections, multi, err := runnerResolveMultiProfileSelections(defaultConfigDir(), authpkg.RuntimeProfile())
+	rawProfile := authpkg.RuntimeProfile()
+	selections, multi, err := runnerResolveMultiProfileSelections(defaultConfigDir(), rawProfile)
 	if err != nil {
 		return executor.Result{}, apperrors.NewValidation(err.Error())
 	}
 	if multi {
 		return r.runMultiProfile(ctx, invocation, selections)
 	}
+	if strings.TrimSpace(rawProfile) != "" {
+		profile, err := authpkg.ResolveProfile(defaultConfigDir(), rawProfile)
+		if err != nil {
+			return executor.Result{}, apperrors.NewValidation(err.Error())
+		}
+		if profile == nil {
+			return executor.Result{}, apperrors.NewValidation(fmt.Sprintf("profile %q not found", rawProfile))
+		}
+		resolvedSelector := authpkg.ProfileSelector(*profile)
+		if strings.TrimSpace(profile.UserID) == "" {
+			// Preserve a unique local-name selector for an unresolved account.
+			// Reducing it to corpId can select a different exact account through
+			// the organization's current-account pointer.
+			resolvedSelector = rawProfile
+		}
+		authpkg.SetRuntimeProfile(resolvedSelector)
+		defer authpkg.SetRuntimeProfile(rawProfile)
+	}
 
 	return r.runSingle(ctx, invocation, true)
 }
@@ -223,7 +243,9 @@ func (r *runtimeRunner) runSingle(ctx context.Context, invocation executor.Invoc
 	// ~70ms on macOS; starting it here lets the load overlap with endpoint
 	// resolution and catalog loading below.
 	if prefetchToken {
-		go runnerGetCachedRuntimeToken(ctx)
+		go func() {
+			_, _ = runnerGetCachedRuntimeToken(ctx)
+		}()
 	}
 
 	if shouldUseDirectRuntime(invocation) {
@@ -313,10 +335,11 @@ func resolveMultiProfileSelections(configDir, rawSelector string) ([]multiProfil
 		if profile == nil {
 			return nil, false, fmt.Errorf("profile %q not found", selector)
 		}
-		if seen[profile.CorpID] {
+		identitySelector := authpkg.ProfileSelector(*profile)
+		if seen[identitySelector] {
 			continue
 		}
-		seen[profile.CorpID] = true
+		seen[identitySelector] = true
 		selections = append(selections, multiProfileSelection{
 			Selector: selector,
 			Profile:  *profile,
@@ -334,13 +357,20 @@ func (r *runtimeRunner) runMultiProfile(ctx context.Context, invocation executor
 	failed := 0
 
 	for _, selection := range selections {
-		authpkg.SetRuntimeProfile(selection.Profile.CorpID)
+		resolvedSelector := authpkg.ProfileSelector(selection.Profile)
+		if strings.TrimSpace(selection.Profile.UserID) == "" {
+			resolvedSelector = selection.Selector
+		}
+		authpkg.SetRuntimeProfile(resolvedSelector)
 		result, err := r.runSingle(ctx, cloneInvocation(invocation), false)
 
 		entry := map[string]any{
 			"selector": selection.Selector,
+			"profile":  resolvedSelector,
 			"corpId":   selection.Profile.CorpID,
 			"corpName": selection.Profile.CorpName,
+			"userId":   selection.Profile.UserID,
+			"userName": selection.Profile.UserName,
 			"ok":       err == nil,
 		}
 		if err != nil {
@@ -466,7 +496,7 @@ func (r *runtimeRunner) handleCatalogMiss(ctx context.Context, invocation execut
 func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string, invocation executor.Invocation) (result executor.Result, retErr error) {
 	// Route stdio:// endpoints to the local StdioClient — no HTTP, no auth.
 	if IsStdioEndpoint(endpoint) {
-		return r.executeStdioInvocation(ctx, invocation)
+		return r.executeStdioInvocationAtEndpoint(ctx, endpoint, invocation)
 	}
 
 	// Constructing the Cobra tree is also used for help, schema, and command
@@ -517,8 +547,12 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 	authToken := ""
 	if hasPluginAuth {
 		authToken = pluginAuth.Token
-	} else {
-		authToken = r.resolveAuthToken(ctx)
+	} else if !invocation.DryRun && (r.globalFlags == nil || !r.globalFlags.Mock) {
+		var tokenErr error
+		authToken, tokenErr = r.resolveAuthToken(ctx)
+		if tokenErr != nil {
+			return executor.Result{}, tokenResolutionError(tokenErr)
+		}
 	}
 
 	var timeoutSec int
@@ -600,6 +634,12 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 			}
 			return runnerHandlePatAuthCheck(ctx, r, invocation, patCheck, defaultConfigDir(), os.Stderr)
 		}
+		if result, retryErr, handled := r.retryAuthRefreshRequired(ctx, endpoint, invocation, authToken, err, hasPluginAuth); handled {
+			if retryErr != nil {
+				runnerCaptureRuntimeFailure(invocation, err, retryErr)
+			}
+			return result, retryErr
+		}
 		runnerCaptureRuntimeFailure(invocation, err, err)
 		return executor.Result{}, err
 	}
@@ -608,9 +648,15 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 	callResult, err := runnerCallTool(tc, callCtx, endpoint, invocation.Tool, invocation.Params)
 	RecordTiming(ctx, "mcp_call", time.Since(callStart))
 	if err != nil {
-		if isAuthError(err) {
+		if isRefreshableTransportAuthError(err) {
 			if fn := edition.Get().OnAuthError; fn != nil {
 				if overrideErr := fn(defaultConfigDir(), err); overrideErr != nil {
+					if result, retryErr, handled := r.retryAuthRefreshRequired(ctx, endpoint, invocation, authToken, overrideErr, hasPluginAuth); handled {
+						if retryErr != nil {
+							runnerCaptureRuntimeFailure(invocation, err, retryErr)
+						}
+						return result, retryErr
+					}
 					runnerCaptureRuntimeFailure(invocation, err, overrideErr)
 					return executor.Result{}, overrideErr
 				}
@@ -635,6 +681,12 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 				}
 				return runnerHandlePatAuthCheck(ctx, r, invocation, patCheck, defaultConfigDir(), os.Stderr)
 			}
+			if result, retryErr, handled := r.retryAuthRefreshRequired(ctx, endpoint, invocation, authToken, editionErr, hasPluginAuth); handled {
+				if retryErr != nil {
+					runnerCaptureRuntimeFailure(invocation, editionErr, retryErr)
+				}
+				return result, retryErr
+			}
 			return executor.Result{}, editionErr
 		}
 	}
@@ -655,6 +707,12 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 		// patterns (PAT permission, gateway-auth) before generic handling.
 		if classify := edition.Get().ClassifyToolResult; classify != nil {
 			if hookErr := classify(callResult.Content); hookErr != nil {
+				if result, retryErr, handled := r.retryAuthRefreshRequired(ctx, endpoint, invocation, authToken, hookErr, hasPluginAuth); handled {
+					if retryErr != nil {
+						runnerCaptureRuntimeFailure(invocation, hookErr, retryErr)
+					}
+					return result, retryErr
+				}
 				runnerCaptureRuntimeFailure(invocation, hookErr, hookErr)
 				return executor.Result{}, hookErr
 			}
@@ -719,6 +777,14 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 // subprocess instead of the HTTP transport. This is used for plugin stdio
 // servers whose endpoints use the stdio:// scheme.
 func (r *runtimeRunner) executeStdioInvocation(ctx context.Context, invocation executor.Invocation) (executor.Result, error) {
+	return r.executeStdioInvocationAtEndpoint(ctx, "", invocation)
+}
+
+func (r *runtimeRunner) executeStdioInvocationAtEndpoint(
+	ctx context.Context,
+	endpoint string,
+	invocation executor.Invocation,
+) (executor.Result, error) {
 	if invocation.DryRun {
 		return executor.Result{
 			Invocation: invocation,
@@ -731,10 +797,14 @@ func (r *runtimeRunner) executeStdioInvocation(ctx context.Context, invocation e
 		}, nil
 	}
 
-	client, ok := LookupStdioClient(invocation.CanonicalProduct)
+	lookupKey := strings.Trim(strings.TrimPrefix(strings.TrimSpace(endpoint), stdioEndpointScheme), "/")
+	if lookupKey == "" {
+		lookupKey = invocation.CanonicalProduct
+	}
+	client, ok := LookupStdioClient(lookupKey)
 	if !ok {
 		return executor.Result{}, apperrors.NewInternal(
-			fmt.Sprintf("stdio client not found for %q", invocation.CanonicalProduct))
+			fmt.Sprintf("stdio client not found for %q", lookupKey))
 	}
 
 	callCtx := ctx
@@ -751,6 +821,27 @@ func (r *runtimeRunner) executeStdioInvocation(ctx context.Context, invocation e
 		)
 	}
 
+	tools, err := runnerStdioListTools(client, callCtx)
+	if err != nil {
+		return executor.Result{}, apperrors.NewAPI(
+			fmt.Sprintf("stdio tools/list failed: %v", err),
+			apperrors.WithOperation("tools/list"),
+			apperrors.WithReason("stdio_tools_list_error"),
+		)
+	}
+	schema, ok := pluginToolInputSchema(tools, invocation.Tool)
+	if !ok {
+		return executor.Result{}, apperrors.NewValidation(
+			fmt.Sprintf("plugin tool %q is not declared by tools/list", invocation.Tool),
+			apperrors.WithReason("plugin_tool_not_found"),
+		)
+	}
+	normalizedParams, err := normalizePluginInputParams(invocation.Params, schema)
+	if err != nil {
+		return executor.Result{}, err
+	}
+	invocation.Params = normalizedParams
+
 	callResult, err := runnerStdioCallTool(client, callCtx, invocation.Tool, invocation.Params)
 	if err != nil {
 		return executor.Result{}, apperrors.NewAPI(
@@ -779,67 +870,49 @@ func (r *runtimeRunner) executeStdioInvocation(ctx context.Context, invocation e
 	}, nil
 }
 
-func (r *runtimeRunner) resolveAuthToken(ctx context.Context) string {
+func (r *runtimeRunner) resolveAuthToken(ctx context.Context) (string, error) {
 	explicitToken := ""
 	if r != nil && r.globalFlags != nil {
 		explicitToken = r.globalFlags.Token
 	}
-	if token := strings.TrimSpace(explicitToken); token != "" {
-		return token
-	}
-	if tp := edition.Get().TokenProvider; tp != nil {
-		token, _ := tp(ctx, func() (string, error) {
-			return resolveAccessTokenFromDir(ctx, defaultConfigDir())
-		})
-		return token
-	}
-	return getCachedRuntimeToken(ctx)
+	return resolveRuntimeAuthToken(ctx, explicitToken)
 }
 
-func resolveRuntimeAuthToken(ctx context.Context, explicitToken string) string {
-	if token := strings.TrimSpace(explicitToken); token != "" {
-		return token
+func resolveRuntimeAuthToken(ctx context.Context, explicitToken string) (string, error) {
+	snapshot, err := runtimeTokenManager.Get(ctx, defaultConfigDir(), explicitToken)
+	if err != nil {
+		return "", err
 	}
-	// Use cached token to avoid repeated Keychain access (~70ms per call)
-	return getCachedRuntimeToken(ctx)
+	return snapshot.AccessToken, nil
 }
 
-// Cached token state for process lifetime
-var (
-	cachedRuntimeTokenMu sync.Mutex
-	cachedRuntimeTokens  = map[string]string{}
-)
-
-// getCachedRuntimeToken returns a cached access token, loading it only once per process.
-// This avoids repeated Keychain access which takes ~70ms each time.
-func getCachedRuntimeToken(ctx context.Context) string {
-	cacheKey := strings.TrimSpace(authpkg.RuntimeProfile())
-	if cacheKey == "" {
-		cacheKey = "__default__"
-	}
-	cachedRuntimeTokenMu.Lock()
-	if token := cachedRuntimeTokens[cacheKey]; token != "" {
-		cachedRuntimeTokenMu.Unlock()
-		return token
-	}
-	cachedRuntimeTokenMu.Unlock()
-
+// getCachedRuntimeToken is kept as the prefetch seam used by runner tests. The
+// cache itself lives exclusively in TokenManager.
+func getCachedRuntimeToken(ctx context.Context) (string, error) {
 	loadStart := time.Now()
 	defer func() { RecordTiming(ctx, "auth_keychain", time.Since(loadStart)) }()
+	return resolveRuntimeAuthToken(ctx, "")
+}
 
-	configDir := defaultConfigDir()
-	token, tokenErr := resolveAccessTokenFromDir(ctx, configDir)
-	if tokenErr != nil && errors.Is(tokenErr, authpkg.ErrTokenDecryption) {
-		slog.Error(tokenErr.Error())
-		return ""
+func tokenResolutionError(err error) error {
+	if err == nil {
+		return nil
 	}
-	if token == "" {
-		return ""
+	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+		return err
 	}
-	cachedRuntimeTokenMu.Lock()
-	cachedRuntimeTokens[cacheKey] = token
-	cachedRuntimeTokenMu.Unlock()
-	return token
+	if errors.Is(err, authpkg.ErrTokenDataNotFound) {
+		return apperrors.NewAuth(
+			"未登录，请先执行 dws auth login",
+			apperrors.WithReason("not_authenticated"),
+			apperrors.WithHint("运行 'dws auth login' 完成登录后重试"),
+			apperrors.WithActions("dws auth login"),
+			apperrors.WithCause(err),
+		)
+	}
+	// Keychain, parse, permission, lock, and refresh failures are real local or
+	// network errors. Preserve their cause instead of disguising them as logout.
+	return fmt.Errorf("resolve access token: %w", err)
 }
 
 // generateExecutionID returns a random 16-char hex string used to correlate
@@ -854,9 +927,7 @@ func generateExecutionID() string {
 // ResetRuntimeTokenCache clears the cached token, forcing a reload on next access.
 // This should be called after login/logout operations.
 func ResetRuntimeTokenCache() {
-	cachedRuntimeTokenMu.Lock()
-	defer cachedRuntimeTokenMu.Unlock()
-	cachedRuntimeTokens = map[string]string{}
+	runtimeTokenManager.Invalidate()
 }
 
 func newRuntimeContentScanner() safety.Scanner {

internal/app/runner_full_coverage_test.go

@@ -50,9 +50,9 @@ func TestCrossPlatformCoverageRunnerRemainingRoutingCoverage(t *testing.T) {
 
 	inv := executor.Invocation{CanonicalProduct: "product", Tool: "tool"}
 	prefetched := make(chan struct{}, 1)
-	runnerGetCachedRuntimeToken = func(context.Context) string {
+	runnerGetCachedRuntimeToken = func(context.Context) (string, error) {
 		prefetched <- struct{}{}
-		return ""
+		return "", nil
 	}
 	r := &runtimeRunner{
 		loader:    cli.CatalogLoaderFrom(cli.Catalog{}, wantErr),
@@ -197,7 +197,7 @@ func TestCrossPlatformCoverageRunnerRemainingExecutionCoverage(t *testing.T) {
 		return nil
 	}
 
-	authErr := apperrors.NewAuth("expired")
+	authErr := apperrors.NewAuth("expired", apperrors.WithReason("http_401"))
 	runnerCallTool = func(*transport.Client, context.Context, string, string, map[string]any) (transport.ToolCallResult, error) {
 		return transport.ToolCallResult{}, authErr
 	}
@@ -290,10 +290,12 @@ func TestCrossPlatformCoverageRunnerRemainingExecutionCoverage(t *testing.T) {
 
 func TestCrossPlatformCoverageRunnerRemainingStdioAuthAndHeadersCoverage(t *testing.T) {
 	oldStdioInit := runnerStdioEnsureInitialized
+	oldStdioList := runnerStdioListTools
 	oldStdioCall := runnerStdioCallTool
 	oldEdition := edition.Get()
 	t.Cleanup(func() {
 		runnerStdioEnsureInitialized = oldStdioInit
+		runnerStdioListTools = oldStdioList
 		runnerStdioCallTool = oldStdioCall
 		edition.Override(oldEdition)
 		StopAllStdioClients()
@@ -309,6 +311,14 @@ func TestCrossPlatformCoverageRunnerRemainingStdioAuthAndHeadersCoverage(t *test
 		t.Fatalf("stdio initialize error = %v", err)
 	}
 	runnerStdioEnsureInitialized = func(*transport.StdioClient, context.Context) error { return nil }
+	runnerStdioListTools = func(*transport.StdioClient, context.Context) (transport.ToolsListResult, error) {
+		return transport.ToolsListResult{
+			Tools: []transport.ToolDescriptor{{
+				Name:        "tool",
+				InputSchema: map[string]any{"type": "object"},
+			}},
+		}, nil
+	}
 	runnerStdioCallTool = func(*transport.StdioClient, context.Context, string, map[string]any) (transport.ToolCallResult, error) {
 		return transport.ToolCallResult{}, wantErr
 	}
@@ -327,21 +337,31 @@ func TestCrossPlatformCoverageRunnerRemainingStdioAuthAndHeadersCoverage(t *test
 	if got, err := r.executeStdioInvocation(context.Background(), inv); err != nil || !got.Invocation.Implemented {
 		t.Fatalf("stdio success = %#v, %v", got, err)
 	}
+	RegisterStdioClient("plugin/server-key", client)
+	overlayIDInvocation := inv
+	overlayIDInvocation.CanonicalProduct = "overlay-id"
+	if got, err := r.executeInvocation(
+		context.Background(),
+		"stdio://plugin/server-key",
+		overlayIDInvocation,
+	); err != nil || !got.Invocation.Implemented {
+		t.Fatalf("stdio endpoint-key lookup = %#v, %v", got, err)
+	}
 
 	r.globalFlags.Token = " explicit "
-	if got := r.resolveAuthToken(context.Background()); got != "explicit" {
-		t.Fatalf("explicit auth token = %q", got)
+	if got, err := r.resolveAuthToken(context.Background()); err != nil || got != "explicit" {
+		t.Fatalf("explicit auth token = %q, %v", got, err)
 	}
 	edition.Override(&edition.Hooks{TokenProvider: func(_ context.Context, fallback func() (string, error)) (string, error) {
 		_, _ = fallback()
 		return "provided", nil
 	}})
 	r.globalFlags.Token = ""
-	if got := r.resolveAuthToken(context.Background()); got != "provided" {
-		t.Fatalf("provided auth token = %q", got)
+	if got, err := r.resolveAuthToken(context.Background()); err != nil || got != "provided" {
+		t.Fatalf("provided auth token = %q, %v", got, err)
 	}
-	if got := resolveRuntimeAuthToken(context.Background(), " runtime "); got != "runtime" {
-		t.Fatalf("runtime explicit token = %q", got)
+	if got, err := resolveRuntimeAuthToken(context.Background(), " runtime "); err != nil || got != "runtime" {
+		t.Fatalf("runtime explicit token = %q, %v", got, err)
 	}
 
 	t.Setenv(envDWSChannel, "channel")

internal/app/schema_agent_examples_dry_run_test.go

@@ -35,6 +35,7 @@ import (
 var (
 	manualAgentExamplePlaceholderPattern = regexp.MustCompile(`<([^>]+)>`)
 	manualAgentExampleDryRunJSONPattern  = regexp.MustCompile(`(?i)"dry_run"\s*:\s*true`)
+	manualAgentExampleDryRunPlanPattern  = regexp.MustCompile(`(?i)"preview_kind"\s*:\s*"plan"`)
 )
 
 // TestManualAgentExamplesContract is the always-on gate. It validates every
@@ -67,7 +68,7 @@ func TestManualAgentExamplesDryRun(t *testing.T) {
 			t.Fatalf("create isolated test directory %s: %v", dir, err)
 		}
 	}
-	t.Setenv("HOME", homeDir)
+	setTestHome(t, homeDir)
 	t.Setenv("DWS_CONFIG_DIR", configDir)
 	t.Setenv("HTTP_PROXY", "http://127.0.0.1:1")
 	t.Setenv("HTTPS_PROXY", "http://127.0.0.1:1")
@@ -391,6 +392,9 @@ func manualAgentExampleDryRunObserved(capture manualAgentExampleCapture) bool {
 
 func manualAgentExampleDryRunEvidence(capture manualAgentExampleCapture) (string, bool) {
 	normalized := strings.ToLower(capture.Output)
+	if manualAgentExampleDryRunJSONPattern.MatchString(capture.Output) && manualAgentExampleDryRunPlanPattern.MatchString(capture.Output) {
+		return cli.DryRunPreviewPlan, true
+	}
 	if manualAgentExampleDryRunJSONPattern.MatchString(capture.Output) {
 		return cli.DryRunPreviewRequest, true
 	}
@@ -428,6 +432,22 @@ func TestManualAgentExampleDryRunEvidenceAcceptsSharedAndCommandPlans(t *testing
 	}
 }
 
+func TestCrossPlatformCoverageManualAgentExampleDryRunEvidenceClassifiesStructuredPlan(t *testing.T) {
+	kind, observed := manualAgentExampleDryRunEvidence(manualAgentExampleCapture{
+		Output:       `{"dry_run":true,"executed":false,"preview_kind":"plan"}`,
+		DryRunChecks: 1,
+	})
+	if !observed || kind != cli.DryRunPreviewPlan {
+		t.Fatalf("structured plan classified as kind=%q observed=%v", kind, observed)
+	}
+	if manualAgentExampleDryRunObserved(manualAgentExampleCapture{
+		Output:       `{"dry_run":false,"executed":false,"preview_kind":"plan"}`,
+		DryRunChecks: 1,
+	}) {
+		t.Fatal("non-dry-run structured plan was accepted as evidence")
+	}
+}
+
 func manualAgentExamplePromptObserved(output string) bool {
 	normalized := strings.ToLower(output)
 	for _, marker := range []string{
@@ -470,7 +490,7 @@ func TestManualAgentExamplePromptObservedRejectsInteractiveConfirmation(t *testi
 }
 
 func TestAitableAdvpermDisableDryRunSkipsConfirmationAndToolCall(t *testing.T) {
-	t.Setenv("HOME", t.TempDir())
+	setTestHome(t, t.TempDir())
 	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
 
 	args := []string{
@@ -518,7 +538,7 @@ func TestManualAgentExampleChatGroupMuteMemberUsesCommandDryRunPreview(t *testin
 	if err := os.MkdirAll(configDir, 0o700); err != nil {
 		t.Fatalf("create isolated config directory: %v", err)
 	}
-	t.Setenv("HOME", sandboxRoot)
+	setTestHome(t, sandboxRoot)
 	t.Setenv("DWS_CONFIG_DIR", configDir)
 
 	capture, err := executeManualAgentExampleCapture(t, []string{

internal/app/schema_completeness_test.go

@@ -14,7 +14,7 @@ func TestRuntimeSchemaCompletenessCoversPublicCommandTree(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	root := NewRootCommand()
+	root := NewSchemaSourceRootCommand()
 	if err := cli.ValidateEmbeddedRuntimeSchemaCompleteness(root); err != nil {
 		t.Fatal(err)
 	}

internal/app/schema_local_registry_contract_test.go

@@ -61,15 +61,24 @@ func TestEventRegistryDeliversOneTypedSchemaPath(t *testing.T) {
 		}
 	}
 	for flag, wantType := range map[string]string{
-		"dry-run":     "boolean",
-		"duration":    "string",
-		"event-types": "array",
-		"max-events":  "integer",
+		"dry-run":          "boolean",
+		"duration":         "string",
+		"event-types":      "array",
+		"max-events":       "integer",
+		"open-dingtalk-id": "string",
 	} {
 		if got := schemaContractString(consumeParams[flag]["type"]); got != wantType {
 			t.Errorf("event.consume --%s type = %q, want %q", flag, got, wantType)
 		}
 	}
+	if _, exists := consumeParams["odid"]; exists {
+		t.Error("event.consume exposes unsupported --odid alias")
+	}
+	for _, name := range []string{"user", "open-dingtalk-id", "group"} {
+		if _, exists := consumeParams[name]["required_when"]; exists {
+			t.Errorf("event.consume --%s unexpectedly declares required_when", name)
+		}
+	}
 	if _, exists := consumeParams["duration"]["default"]; exists {
 		t.Error("event.consume --duration leaked zero default 0s")
 	}

internal/app/schema_shortcut_contract_test.go

@@ -0,0 +1,358 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+
+package app
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/shortcut"
+)
+
+const publicShortcutSchemaCount = 210
+
+func TestEmbeddedSchemaPublishesEveryPublicShortcutContract(t *testing.T) {
+	tools := embeddedSchemaAllToolsForHelpFlagTest(t, NewRootCommand())
+	public := make([]shortcut.Shortcut, 0, publicShortcutSchemaCount)
+	for _, candidate := range shortcut.All() {
+		if candidate.UserDefined || !shortcut.InPublicCatalog(candidate.Service, candidate.Command) {
+			continue
+		}
+		public = append(public, candidate)
+	}
+	if got := len(public); got != publicShortcutSchemaCount {
+		t.Fatalf("public built-in shortcuts = %d, want %d", got, publicShortcutSchemaCount)
+	}
+
+	deliveredShortcuts := 0
+	for canonical := range tools {
+		if strings.Contains(canonical, ".shortcut_") {
+			deliveredShortcuts++
+		}
+	}
+	if deliveredShortcuts != publicShortcutSchemaCount {
+		t.Fatalf("embedded schema --all shortcut tools = %d, want %d", deliveredShortcuts, publicShortcutSchemaCount)
+	}
+
+	for _, declared := range public {
+		declared := declared
+		t.Run(declared.Service+"/"+strings.TrimPrefix(declared.Command, "+"), func(t *testing.T) {
+			canonical := shortcutSchemaCanonical(declared)
+			tool := tools[canonical]
+			if tool == nil {
+				t.Fatalf("embedded schema --all is missing %s (%s %s)", canonical, declared.Service, declared.Command)
+			}
+			assertEmbeddedShortcutIdentityAndSelection(t, tool, declared, canonical)
+			assertEmbeddedShortcutSafetyAndInterface(t, tool, declared, canonical)
+			assertEmbeddedShortcutParameters(t, tool, declared, canonical)
+			assertEmbeddedShortcutConstraints(t, tool, declared, canonical)
+		})
+	}
+}
+
+func TestEmbeddedShortcutProgressiveQueriesReturnCompleteContracts(t *testing.T) {
+	leaf := executeShortcutSchemaQuery(t, "--cli-path", "chat +messages-read-status")
+	if got, want := schemaContractString(leaf["canonical_path"]), "chat.shortcut_messages_read_status"; got != want {
+		t.Fatalf("shortcut leaf canonical_path = %q, want %q", got, want)
+	}
+	if got, want := schemaContractString(leaf["confirmation"]), "not_required"; got != want {
+		t.Fatalf("shortcut leaf confirmation = %q, want %q", got, want)
+	}
+	conversationID := schemaContractMap(leaf["parameters"])["conversation-id"]
+	if required, _ := conversationID["required"].(bool); !required {
+		t.Fatal("public --conversation-id must become required after hidden compatibility aliases are removed from Schema")
+	}
+	if got := leaf["constraints"]; got != nil {
+		t.Fatalf("shortcut leaf constraints = %#v, want omitted after hidden compatibility aliases collapse", got)
+	}
+
+	constrainedLeaf := executeShortcutSchemaQuery(t, "--cli-path", "calendar +freebusy")
+	wantConstraints := map[string]any{
+		"require_one_of": [][]string{{"users", "rooms"}},
+	}
+	if got := constrainedLeaf["constraints"]; !schemaContractJSONEqual(got, wantConstraints) {
+		t.Fatalf("shortcut leaf constraints = %#v, want %#v", got, wantConstraints)
+	}
+
+	product := executeShortcutSchemaQuery(t, "chat")
+	productPayload, _ := product["product"].(map[string]any)
+	if got, want := int(product["count"].(float64)), 120; got != want {
+		t.Fatalf("schema chat count = %d, want %d", got, want)
+	}
+	summaries := schemaContractObjectSlice(productPayload["tools"])
+	shortcutCount := 0
+	for _, summary := range summaries {
+		if strings.HasPrefix(schemaContractString(summary["canonical_path"]), "chat.shortcut_") {
+			shortcutCount++
+		}
+	}
+	if shortcutCount != 42 {
+		t.Fatalf("schema chat shortcut summaries = %d, want 42", shortcutCount)
+	}
+}
+
+func executeShortcutSchemaQuery(t testing.TB, args ...string) map[string]any {
+	t.Helper()
+	root := NewRootCommand()
+	var stdout, stderr bytes.Buffer
+	root.SetOut(&stdout)
+	root.SetErr(&stderr)
+	root.SetArgs(append([]string{"schema"}, append(args, "--format", "json")...))
+	if err := root.Execute(); err != nil {
+		t.Fatalf("execute dws schema %q: %v; stderr=%s", strings.Join(args, " "), err, stderr.String())
+	}
+	var payload map[string]any
+	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
+		t.Fatalf("decode dws schema %q: %v", strings.Join(args, " "), err)
+	}
+	return payload
+}
+
+func shortcutSchemaCanonical(declared shortcut.Shortcut) string {
+	name := strings.ReplaceAll(strings.TrimPrefix(declared.Command, "+"), "-", "_")
+	return declared.Service + ".shortcut_" + name
+}
+
+func assertEmbeddedShortcutIdentityAndSelection(
+	t testing.TB,
+	tool map[string]any,
+	declared shortcut.Shortcut,
+	canonical string,
+) {
+	t.Helper()
+	if got, want := schemaContractString(tool["canonical_path"]), canonical; got != want {
+		t.Errorf("canonical_path = %q, want %q", got, want)
+	}
+	if got, want := schemaContractString(tool["primary_cli_path"]), declared.Service+" "+declared.Command; got != want {
+		t.Errorf("%s primary_cli_path = %q, want %q", canonical, got, want)
+	}
+	if got, want := schemaContractString(tool["agent_summary"]), declared.Description; got != want {
+		t.Errorf("%s agent_summary = %q, want %q", canonical, got, want)
+	}
+	if got, want := schemaContractStringSlice(tool["use_when"]), []string{declared.Intent}; !schemaContractJSONEqual(got, want) {
+		t.Errorf("%s use_when = %#v, want %#v", canonical, got, want)
+	}
+	if len(schemaContractStringSlice(tool["avoid_when"])) == 0 {
+		t.Errorf("%s has no reviewed avoid_when", canonical)
+	}
+	examples := schemaContractStringSlice(tool["examples"])
+	if len(examples) == 0 || len(examples) > 2 {
+		t.Errorf("%s examples = %d, want 1..2", canonical, len(examples))
+	}
+	for _, example := range examples {
+		if strings.Contains(example, "--yes") {
+			t.Errorf("%s stores unsafe example %q", canonical, example)
+		}
+		if !strings.HasPrefix(example, "dws "+declared.Service+" "+declared.Command) {
+			t.Errorf("%s example does not use its primary path: %q", canonical, example)
+		}
+	}
+}
+
+func assertEmbeddedShortcutSafetyAndInterface(
+	t testing.TB,
+	tool map[string]any,
+	declared shortcut.Shortcut,
+	canonical string,
+) {
+	t.Helper()
+	risk := declared.Risk
+	if risk == "" {
+		risk = shortcut.RiskRead
+	}
+	wantEffect, wantRisk, wantConfirmation, wantIdempotency := "read", "low", "not_required", "idempotent"
+	switch risk {
+	case shortcut.RiskWrite:
+		wantEffect, wantRisk, wantConfirmation, wantIdempotency = "write", "medium", "user_required", "unknown"
+	case shortcut.RiskHighWrite:
+		wantEffect, wantRisk, wantConfirmation, wantIdempotency = "destructive", "high", "user_required", "unknown"
+	}
+	for field, want := range map[string]string{
+		"effect":         wantEffect,
+		"risk":           wantRisk,
+		"confirmation":   wantConfirmation,
+		"idempotency":    wantIdempotency,
+		"interface_mode": "composite",
+		"availability":   "available",
+	} {
+		if got := schemaContractString(tool[field]); got != want {
+			t.Errorf("%s %s = %q, want %q", canonical, field, got, want)
+		}
+	}
+	if strings.TrimSpace(schemaContractString(tool["interface_reason"])) == "" {
+		t.Errorf("%s has no reviewed composite interface reason", canonical)
+	}
+}
+
+func assertEmbeddedShortcutParameters(
+	t testing.TB,
+	tool map[string]any,
+	declared shortcut.Shortcut,
+	canonical string,
+) {
+	t.Helper()
+	parameters := schemaContractMap(tool["parameters"])
+	publicFlags := make([]shortcut.Flag, 0, len(declared.Flags))
+	for _, flag := range declared.Flags {
+		if !flag.Hidden {
+			publicFlags = append(publicFlags, flag)
+		}
+	}
+	if got, want := len(parameters), len(publicFlags); got != want {
+		t.Errorf("%s parameters = %d, want %d", canonical, got, want)
+	}
+	for _, flag := range publicFlags {
+		parameter := parameters[flag.Name]
+		if parameter == nil {
+			t.Errorf("%s is missing parameter --%s", canonical, flag.Name)
+			continue
+		}
+		flagType := flag.Type
+		if flagType == "" {
+			flagType = shortcut.FlagString
+		}
+		wantType := map[shortcut.FlagType]string{
+			shortcut.FlagString:      "string",
+			shortcut.FlagBool:        "boolean",
+			shortcut.FlagInt:         "integer",
+			shortcut.FlagStringSlice: "array",
+		}[flagType]
+		if got := schemaContractString(parameter["type"]); got != wantType {
+			t.Errorf("%s --%s type = %q, want %q", canonical, flag.Name, got, wantType)
+		}
+		if got, _ := parameter["required"].(bool); got != shortcutSchemaRequired(declared, flag.Name) {
+			t.Errorf("%s --%s required = %t, want %t", canonical, flag.Name, got, shortcutSchemaRequired(declared, flag.Name))
+		}
+		if got, want := schemaContractString(parameter["default"]), shortcutSchemaDefault(flag); got != want {
+			t.Errorf("%s --%s default = %q, want %q", canonical, flag.Name, got, want)
+		}
+		gotEnum := schemaContractStringSlice(parameter["enum"])
+		if len(flag.Enum) == 0 {
+			if len(gotEnum) != 0 {
+				t.Errorf("%s --%s enum = %#v, want empty", canonical, flag.Name, gotEnum)
+			}
+		} else if !schemaContractJSONEqual(gotEnum, flag.Enum) {
+			t.Errorf("%s --%s enum = %#v, want %#v", canonical, flag.Name, gotEnum, flag.Enum)
+		}
+	}
+}
+
+func shortcutSchemaDefault(flag shortcut.Flag) string {
+	value := strings.TrimSpace(flag.Default)
+	switch flag.Type {
+	case shortcut.FlagBool:
+		if value != "true" {
+			return ""
+		}
+	case shortcut.FlagInt:
+		if value == "0" {
+			return ""
+		}
+	case shortcut.FlagStringSlice:
+		if value != "" {
+			return "[" + value + "]"
+		}
+	}
+	return value
+}
+
+func shortcutSchemaRequired(declared shortcut.Shortcut, flagName string) bool {
+	for _, flag := range declared.Flags {
+		if flag.Name == flagName && flag.Required {
+			return true
+		}
+	}
+	public := make(map[string]bool, len(declared.Flags))
+	for _, flag := range declared.Flags {
+		if !flag.Hidden {
+			public[flag.Name] = true
+		}
+	}
+	for _, constraint := range declared.Constraints {
+		if constraint.Kind != shortcut.ConstraintAtLeastOne && constraint.Kind != shortcut.ConstraintExactlyOne {
+			continue
+		}
+		visible := make([]string, 0, len(constraint.Flags))
+		for _, constrained := range constraint.Flags {
+			if public[constrained] {
+				visible = append(visible, constrained)
+			}
+		}
+		if len(visible) == 1 && visible[0] == flagName {
+			return true
+		}
+	}
+	return false
+}
+
+func assertEmbeddedShortcutConstraints(
+	t testing.TB,
+	tool map[string]any,
+	declared shortcut.Shortcut,
+	canonical string,
+) {
+	t.Helper()
+	public := make(map[string]bool, len(declared.Flags))
+	for _, flag := range declared.Flags {
+		if !flag.Hidden {
+			public[flag.Name] = true
+		}
+	}
+	want := map[string][][]string{}
+	for _, constraint := range declared.Constraints {
+		flags := make([]string, 0, len(constraint.Flags))
+		for _, flagName := range constraint.Flags {
+			if public[flagName] {
+				flags = append(flags, flagName)
+			}
+		}
+		switch constraint.Kind {
+		case shortcut.ConstraintAtLeastOne:
+			if len(flags) > 1 {
+				want["require_one_of"] = append(want["require_one_of"], flags)
+			}
+		case shortcut.ConstraintExactlyOne:
+			if len(flags) > 1 {
+				want["require_one_of"] = append(want["require_one_of"], flags)
+				want["mutually_exclusive"] = append(want["mutually_exclusive"], flags)
+			}
+		case shortcut.ConstraintMutuallyExclusive:
+			if len(flags) > 1 {
+				want["mutually_exclusive"] = append(want["mutually_exclusive"], flags)
+			}
+		case shortcut.ConstraintCustom:
+			for _, flagName := range flags {
+				description := schemaContractString(schemaContractMap(tool["parameters"])[flagName]["description"])
+				for _, requiredText := range []string{"原文不能为空", "不能重复"} {
+					if !strings.Contains(description, requiredText) {
+						t.Errorf("%s --%s description does not publish custom constraint %q: %q", canonical, flagName, requiredText, description)
+					}
+				}
+			}
+		default:
+			t.Errorf("%s has unsupported declared shortcut constraint %q", canonical, constraint.Kind)
+		}
+	}
+	if len(want) == 0 {
+		if got := tool["constraints"]; got != nil {
+			t.Errorf("%s constraints = %#v, want omitted", canonical, got)
+		}
+		return
+	}
+	if got := tool["constraints"]; !schemaContractJSONEqual(got, want) {
+		t.Errorf("%s constraints = %s, want %s", canonical, mustShortcutJSON(got), mustShortcutJSON(want))
+	}
+}
+
+func mustShortcutJSON(value any) string {
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		return fmt.Sprintf("%#v", value)
+	}
+	return string(encoded)
+}

internal/app/skill_command.go

@@ -17,6 +17,7 @@ import (
 	"archive/zip"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"mime"
@@ -36,25 +37,25 @@ import (
 )
 
 var (
-	skillLoadAccessToken   = loadSkillAccessToken
-	skillDownloadToTmp     = downloadSkillToTmpDir
-	skillHTTPDo            = func(client *http.Client, req *http.Request) (*http.Response, error) { return client.Do(req) }
-	skillNewRequest        = http.NewRequestWithContext
-	skillLoadTokenData     = authpkg.LoadTokenData
-	skillResolveTargetPath = resolveSkillTargetPath
-	skillFetchDownloadInfo = fetchSkillDownloadInfo
-	skillDownloadFile      = downloadSkillFile
-	skillExtractZip        = extractSkillZip
-	skillUserHomeDir       = os.UserHomeDir
-	skillMkdirTemp         = os.MkdirTemp
-	skillCreate            = os.Create
-	skillCreateTemp        = os.CreateTemp
-	skillRemoveAll         = os.RemoveAll
-	skillRemove            = os.Remove
-	skillMkdirAll          = os.MkdirAll
-	skillOpenFile          = os.OpenFile
-	skillCopy              = io.Copy
-	skillOpenZipFile       = func(file *zip.File) (io.ReadCloser, error) { return file.Open() }
+	skillLoadAccessToken    = loadSkillAccessToken
+	skillDownloadToTmp      = downloadSkillToTmpDir
+	skillHTTPDo             = func(client *http.Client, req *http.Request) (*http.Response, error) { return client.Do(req) }
+	skillNewRequest         = http.NewRequestWithContext
+	skillResolveAccessToken = ResolveAuxiliaryAccessToken
+	skillResolveTargetPath  = resolveSkillTargetPath
+	skillFetchDownloadInfo  = fetchSkillDownloadInfo
+	skillDownloadFile       = downloadSkillFile
+	skillExtractZip         = extractSkillZip
+	skillUserHomeDir        = os.UserHomeDir
+	skillMkdirTemp          = os.MkdirTemp
+	skillCreate             = os.Create
+	skillCreateTemp         = os.CreateTemp
+	skillRemoveAll          = os.RemoveAll
+	skillRemove             = os.Remove
+	skillMkdirAll           = os.MkdirAll
+	skillOpenFile           = os.OpenFile
+	skillCopy               = io.Copy
+	skillOpenZipFile        = func(file *zip.File) (io.ReadCloser, error) { return file.Open() }
 )
 
 func init() {
@@ -296,7 +297,7 @@ func newSkillAddHintCommand() *cobra.Command {
 
 func runSkillGet(cmd *cobra.Command, args []string) error {
 	skillID, _ := cmd.Flags().GetString("skill-id")
-	accessToken, err := skillLoadAccessToken()
+	accessToken, err := skillLoadAccessToken(cmd.Context())
 	if err != nil {
 		return err
 	}
@@ -319,7 +320,7 @@ func runSkillFind(cmd *cobra.Command, args []string) error {
 	if source == "" {
 		source, _ = cmd.Flags().GetString("scopes")
 	}
-	accessToken, err := skillLoadAccessToken()
+	accessToken, err := skillLoadAccessToken(cmd.Context())
 	if err != nil {
 		return err
 	}
@@ -388,7 +389,7 @@ func runSkillAdd(cmd *cobra.Command, args []string) error {
 		return apperrors.NewValidation(fmt.Sprintf("invalid target '%s': %v. Supported targets: %s", target, err, supportedTargets()))
 	}
 
-	accessToken, err := skillLoadAccessToken()
+	accessToken, err := skillLoadAccessToken(cmd.Context())
 	if err != nil {
 		return err
 	}
@@ -441,13 +442,16 @@ func runSkillAdd(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
-func loadSkillAccessToken() (string, error) {
+func loadSkillAccessToken(ctx context.Context) (string, error) {
 	configDir := defaultConfigDir()
-	tokenData, err := skillLoadTokenData(configDir)
-	if err != nil || tokenData == nil || !tokenData.IsAccessTokenValid() {
+	token, err := skillResolveAccessToken(ctx, configDir, "")
+	if errors.Is(err, authpkg.ErrTokenDataNotFound) {
 		return "", skillAuthError()
 	}
-	return tokenData.AccessToken, nil
+	if err != nil {
+		return "", fmt.Errorf("resolve skill access token: %w", err)
+	}
+	return token, nil
 }
 
 func skillAuthError() error {

internal/app/skill_command_full_coverage_test.go

@@ -57,11 +57,11 @@ func TestCrossPlatformCoverageSkillCommandHighLevelRemainingCoverage(t *testing.
 	})
 	fail := errors.New("failure")
 	cmd := skillCoverageCommand()
-	skillLoadAccessToken = func() (string, error) { return "", fail }
+	skillLoadAccessToken = func(context.Context) (string, error) { return "", fail }
 	if err := runSkillGet(cmd, nil); !errors.Is(err, fail) {
 		t.Fatalf("skill get auth error = %v", err)
 	}
-	skillLoadAccessToken = func() (string, error) { return "token", nil }
+	skillLoadAccessToken = func(context.Context) (string, error) { return "token", nil }
 	skillNewRequest = func(context.Context, string, string, io.Reader) (*http.Request, error) { return nil, fail }
 	if err := runSkillFind(cmd, nil); err == nil {
 		t.Fatal("skill find request failure should propagate")
@@ -72,11 +72,11 @@ func TestCrossPlatformCoverageSkillCommandHighLevelRemainingCoverage(t *testing.
 		t.Fatalf("skill get download error = %v", err)
 	}
 
-	skillLoadAccessToken = func() (string, error) { return "", fail }
+	skillLoadAccessToken = func(context.Context) (string, error) { return "", fail }
 	if err := runSkillFind(cmd, nil); !errors.Is(err, fail) {
 		t.Fatalf("skill find auth error = %v", err)
 	}
-	skillLoadAccessToken = func() (string, error) { return "token", nil }
+	skillLoadAccessToken = func(context.Context) (string, error) { return "token", nil }
 	skillHTTPDo = func(*http.Client, *http.Request) (*http.Response, error) { return nil, fail }
 	if err := runSkillFind(cmd, nil); err == nil {
 		t.Fatal("skill find network failure should propagate")
@@ -111,11 +111,11 @@ func TestCrossPlatformCoverageSkillCommandHighLevelRemainingCoverage(t *testing.
 		t.Fatal("invalid skill target should fail")
 	}
 	skillResolveTargetPath = func(string) (string, error) { return "dest", nil }
-	skillLoadAccessToken = func() (string, error) { return "", fail }
+	skillLoadAccessToken = func(context.Context) (string, error) { return "", fail }
 	if err := runSkillAdd(cmd, []string{"id", "target"}); !errors.Is(err, fail) {
 		t.Fatalf("skill add auth error = %v", err)
 	}
-	skillLoadAccessToken = func() (string, error) { return "token", nil }
+	skillLoadAccessToken = func(context.Context) (string, error) { return "token", nil }
 	skillFetchDownloadInfo = func(context.Context, string, string) (*downloadSkillResponse, error) { return nil, fail }
 	if err := runSkillAdd(cmd, []string{"id", "target"}); !errors.Is(err, fail) {
 		t.Fatalf("skill info error = %v", err)
@@ -152,25 +152,35 @@ func TestCrossPlatformCoverageSkillCommandHighLevelRemainingCoverage(t *testing.
 
 func TestCrossPlatformCoverageSkillCommandLowLevelRemainingCoverage(t *testing.T) {
 	oldHTTP := skillHTTPDo
-	oldNewRequest, oldLoadToken := skillNewRequest, skillLoadTokenData
+	oldNewRequest, oldResolveToken := skillNewRequest, skillResolveAccessToken
 	oldHome := skillUserHomeDir
 	oldMkdirTemp, oldCreate, oldCreateTemp := skillMkdirTemp, skillCreate, skillCreateTemp
 	oldRemoveAll, oldRemove, oldMkdir := skillRemoveAll, skillRemove, skillMkdirAll
 	oldOpen, oldCopy, oldZipOpen := skillOpenFile, skillCopy, skillOpenZipFile
 	t.Cleanup(func() {
 		skillHTTPDo = oldHTTP
-		skillNewRequest, skillLoadTokenData = oldNewRequest, oldLoadToken
+		skillNewRequest, skillResolveAccessToken = oldNewRequest, oldResolveToken
 		skillUserHomeDir = oldHome
 		skillMkdirTemp, skillCreate, skillCreateTemp = oldMkdirTemp, oldCreate, oldCreateTemp
 		skillRemoveAll, skillRemove, skillMkdirAll = oldRemoveAll, oldRemove, oldMkdir
 		skillOpenFile, skillCopy, skillOpenZipFile = oldOpen, oldCopy, oldZipOpen
 	})
 	fail := errors.New("failure")
-	skillLoadTokenData = func(string) (*authpkg.TokenData, error) { return nil, nil }
-	if _, err := loadSkillAccessToken(); err == nil {
+	skillResolveAccessToken = func(context.Context, string, string) (string, error) {
+		return "", authpkg.ErrTokenDataNotFound
+	}
+	if _, err := loadSkillAccessToken(context.Background()); err == nil {
 		t.Fatal("invalid skill access token succeeded")
 	}
-	skillLoadTokenData = oldLoadToken
+	canceled, cancel := context.WithCancel(context.Background())
+	cancel()
+	skillResolveAccessToken = func(ctx context.Context, _, _ string) (string, error) {
+		return "", ctx.Err()
+	}
+	if _, err := loadSkillAccessToken(canceled); !errors.Is(err, context.Canceled) {
+		t.Fatalf("skill token cancellation = %v", err)
+	}
+	skillResolveAccessToken = oldResolveToken
 	skillNewRequest = func(context.Context, string, string, io.Reader) (*http.Request, error) { return nil, fail }
 	if _, err := fetchSkillDownloadInfo(context.Background(), "token", "id"); err == nil {
 		t.Fatal("download-info request failure should propagate")

internal/app/skill_command_test.go

@@ -18,7 +18,6 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"errors"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -369,6 +368,7 @@ func TestSkillInstallCommandValidation(t *testing.T) {
 
 func TestSkillInstallInvalidTarget(t *testing.T) {
 	tempDir := t.TempDir()
+	t.Cleanup(CloseFileLogger)
 	configDir := filepath.Join(tempDir, "config")
 	t.Setenv("DWS_CONFIG_DIR", configDir)
 	t.Cleanup(CloseFileLogger)
@@ -392,12 +392,15 @@ func TestSkillInstallInvalidTarget(t *testing.T) {
 func TestSkillInstallRequiresAuth(t *testing.T) {
 	// Setup: Create config directory without token
 	tempDir := t.TempDir()
+	t.Cleanup(CloseFileLogger)
 	configDir := filepath.Join(tempDir, "config")
 	t.Setenv("DWS_CONFIG_DIR", configDir)
 	t.Cleanup(CloseFileLogger)
-	originalLoadToken := skillLoadTokenData
-	skillLoadTokenData = func(string) (*authpkg.TokenData, error) { return nil, errors.New("missing") }
-	t.Cleanup(func() { skillLoadTokenData = originalLoadToken })
+	originalResolveToken := skillResolveAccessToken
+	skillResolveAccessToken = func(context.Context, string, string) (string, error) {
+		return "", authpkg.ErrTokenDataNotFound
+	}
+	t.Cleanup(func() { skillResolveAccessToken = originalResolveToken })
 
 	// Ensure the config directory exists but has no token
 	if err := os.MkdirAll(configDir, 0755); err != nil {
@@ -677,16 +680,11 @@ func TestSkillSearchUsesSourceQueryAndKeepsScopesCompat(t *testing.T) {
 	configDir := filepath.Join(t.TempDir(), "config")
 	t.Setenv("DWS_CONFIG_DIR", configDir)
 	t.Cleanup(CloseFileLogger)
-	originalLoadToken := skillLoadTokenData
-	skillLoadTokenData = func(string) (*authpkg.TokenData, error) {
-		return &authpkg.TokenData{
-			AccessToken:  "test-token",
-			RefreshToken: "refresh-token",
-			ExpiresAt:    time.Now().Add(time.Hour),
-			RefreshExpAt: time.Now().Add(24 * time.Hour),
-		}, nil
+	originalResolveToken := skillResolveAccessToken
+	skillResolveAccessToken = func(context.Context, string, string) (string, error) {
+		return "test-token", nil
 	}
-	t.Cleanup(func() { skillLoadTokenData = originalLoadToken })
+	t.Cleanup(func() { skillResolveAccessToken = originalResolveToken })
 
 	var gotSources []string
 	var gotScopes []string

internal/app/skill_setup_test.go

@@ -88,7 +88,7 @@ func TestResolveSkillSetupSourceErrorWhenMissing(t *testing.T) {
 	// Isolate HOME so the ~/.dws/skills/<mode>/ fallback (added by the release
 	// pipeline cache work) does not pick up real cached content on the
 	// developer machine.
-	t.Setenv("HOME", t.TempDir())
+	setTestHome(t, t.TempDir())
 	_, err := resolveSkillSetupSource(tmp, skillSetupModeMono)
 	if err == nil {
 		t.Fatalf("expected error when source missing")
@@ -110,8 +110,9 @@ func TestResolveSkillSetupTargetsSingleAgent(t *testing.T) {
 	if len(got) != 1 {
 		t.Fatalf("expected 1 dest, got %d", len(got))
 	}
-	if !strings.Contains(got[0], filepath.Join(".claude", "skills", "dws")) {
-		t.Fatalf("expected .claude/skills/dws path, got %s", got[0])
+	want := filepath.Join(home, ".claude", "skills", "dws")
+	if filepath.Clean(got[0]) != filepath.Clean(want) {
+		t.Fatalf("expected %s, got %s", want, got[0])
 	}
 }
 
@@ -133,11 +134,9 @@ func TestResolveSkillSetupTargetsMultiOmitsDwsTail(t *testing.T) {
 	if len(got) != 1 {
 		t.Fatalf("expected 1 dest, got %d", len(got))
 	}
-	if filepath.Base(got[0]) == "dws" {
-		t.Fatalf("multi target must not end with /dws, got %s", got[0])
-	}
-	if !strings.HasSuffix(got[0], filepath.Join(".claude", "skills")) {
-		t.Fatalf("expected suffix .claude/skills, got %s", got[0])
+	want := filepath.Join(home, ".claude", "skills")
+	if filepath.Clean(got[0]) != filepath.Clean(want) {
+		t.Fatalf("expected %s, got %s", want, got[0])
 	}
 }
 

internal/app/test_home_test.go

@@ -0,0 +1,65 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+)
+
+func setTestHome(t *testing.T, home string) {
+	t.Helper()
+	t.Setenv("HOME", home)
+	if runtime.GOOS == "windows" {
+		// os.UserHomeDir uses USERPROFILE on Windows rather than HOME.
+		t.Setenv("USERPROFILE", home)
+	}
+}
+
+func TestCrossPlatformCoverageConfigureLogLevelTerminatesReplacedFileLoggers(t *testing.T) {
+	firstConfig := t.TempDir()
+	secondConfig := t.TempDir()
+	t.Cleanup(CloseFileLogger)
+
+	t.Setenv("DWS_CONFIG_DIR", firstConfig)
+	configureLogLevel(&GlobalFlags{})
+	firstLogger := FileLoggerInstance()
+	t.Setenv("DWS_CONFIG_DIR", secondConfig)
+	configureLogLevel(&GlobalFlags{})
+
+	firstLogPath := filepath.Join(firstConfig, "logs", "dws.log")
+	if err := os.Remove(firstLogPath); err != nil {
+		t.Fatalf("remove previous logger file: %v", err)
+	}
+	firstLogger.Info("late write to replaced logger")
+	if _, err := os.Stat(firstLogPath); !os.IsNotExist(err) {
+		t.Fatalf("replaced logger recreated its log file: %v", err)
+	}
+
+	previousSameDirLogger := FileLoggerInstance()
+	configureLogLevel(&GlobalFlags{})
+	currentLogger := FileLoggerInstance()
+	CloseFileLogger()
+	secondLogPath := filepath.Join(secondConfig, "logs", "dws.log")
+	if err := os.Remove(secondLogPath); err != nil {
+		t.Fatalf("remove current logger file: %v", err)
+	}
+	previousSameDirLogger.Info("late write to same-directory replaced logger")
+	currentLogger.Info("late write to closed current logger")
+	if _, err := os.Stat(secondLogPath); !os.IsNotExist(err) {
+		t.Fatalf("closed logger recreated same-directory log file: %v", err)
+	}
+}

internal/app/testmain_test.go

@@ -14,9 +14,12 @@
 package app
 
 import (
+	"fmt"
 	"os"
+	"path/filepath"
 	"testing"
 
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/audit"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/keychain"
 )
 
@@ -49,8 +52,48 @@ func TestMain(m *testing.M) {
 		_ = os.RemoveAll(tmpDir)
 		panic("set " + keychain.StorageDirEnv + ": " + err.Error())
 	}
+	if err := os.Setenv(keychain.TestNamespaceEnv, tmpDir); err != nil {
+		_ = os.RemoveAll(tmpDir)
+		panic("set " + keychain.TestNamespaceEnv + ": " + err.Error())
+	}
+	if err := os.Setenv("DWS_CONFIG_DIR", filepath.Join(tmpDir, "config")); err != nil {
+		_ = os.RemoveAll(tmpDir)
+		panic("set DWS_CONFIG_DIR: " + err.Error())
+	}
+	for key, value := range map[string]string{
+		audit.EnvAudit:         "1",
+		audit.EnvAuditDir:      filepath.Join(tmpDir, "audit"),
+		audit.EnvRetentionDays: "1",
+		audit.EnvForwardURL:    "",
+		audit.EnvForwardToken:  "",
+		audit.EnvForwardRedact: "none",
+		audit.EnvAuditDebug:    "",
+	} {
+		if err := os.Setenv(key, value); err != nil {
+			_ = os.RemoveAll(tmpDir)
+			panic("set " + key + ": " + err.Error())
+		}
+	}
+	// Keep the process-wide audit sink outside per-test TempDir trees. Cobra
+	// skips PersistentPostRunE on expected command errors, and Windows cannot
+	// remove a TempDir while the audit lock is still open.
+	setupAuditSink()
 	openBrowserFunc = func(string) error { return nil }
 	code := m.Run()
-	_ = os.RemoveAll(tmpDir)
+	StopAllStdioClients()
+	CloseAuditSink()
+	CloseFileLogger()
+	if err := keychain.RemoveAuthTokenEntries(keychain.Service); err != nil {
+		fmt.Fprintf(os.Stderr, "internal/app keychain cleanup: %v\n", err)
+		if code == 0 {
+			code = 1
+		}
+	}
+	if err := os.RemoveAll(tmpDir); err != nil {
+		fmt.Fprintf(os.Stderr, "internal/app test cleanup %s: %v\n", tmpDir, err)
+		if code == 0 {
+			code = 1
+		}
+	}
 	os.Exit(code)
 }

internal/app/tool_caller_adapter.go

@@ -17,7 +17,9 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"sync"
 
+	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/jsonutil"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
@@ -27,8 +29,9 @@ import (
 // interface so that private overlays can invoke MCP tools without importing
 // internal packages.
 type toolCallerAdapter struct {
-	runner executor.Runner
-	flags  *GlobalFlags
+	runner  executor.Runner
+	flags   *GlobalFlags
+	tokenMu sync.Mutex
 }
 
 var toolCallerDryRun = func(ctx context.Context, invocation executor.Invocation) (executor.Result, error) {
@@ -63,6 +66,26 @@ func (a *toolCallerAdapter) CallTool(ctx context.Context, productID, toolName st
 	return convertResult(result), nil
 }
 
+// CallToolWithToken invokes a helper with an in-memory token override. It is
+// used during login before the new token has been persisted to any profile
+// slot.
+func (a *toolCallerAdapter) CallToolWithToken(ctx context.Context, token, productID, toolName string, args map[string]any) (*edition.ToolResult, error) {
+	if a == nil || a.flags == nil {
+		return nil, fmt.Errorf("ToolCaller token override is not configured")
+	}
+	a.tokenMu.Lock()
+	defer a.tokenMu.Unlock()
+	previousToken := a.flags.Token
+	previousProfile := authpkg.RuntimeProfile()
+	a.flags.Token = token
+	authpkg.SetRuntimeProfile("")
+	defer func() {
+		a.flags.Token = previousToken
+		authpkg.SetRuntimeProfile(previousProfile)
+	}()
+	return a.CallTool(ctx, productID, toolName, args)
+}
+
 func (a *toolCallerAdapter) Format() string {
 	if a != nil && a.flags != nil {
 		return a.flags.Format

internal/app/tool_caller_adapter_test.go

@@ -0,0 +1,66 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"context"
+	"testing"
+
+	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
+)
+
+func TestToolCallerTokenOverrideClearsUnpersistedRuntimeProfile(t *testing.T) {
+	authpkg.SetRuntimeProfile("corp_not_persisted")
+	t.Cleanup(func() { authpkg.SetRuntimeProfile("") })
+
+	flags := &GlobalFlags{}
+	runner := runtimeProfileCaptureRunner{flags: flags}
+	caller := &toolCallerAdapter{runner: runner, flags: flags}
+	result, err := caller.CallToolWithToken(
+		context.Background(),
+		"temporary-access-token",
+		"contact",
+		"get_current_user_profile",
+		nil,
+	)
+	if err != nil {
+		t.Fatalf("CallToolWithToken() error = %v", err)
+	}
+	if got := result.Content[0].Text; got != `{"profile":"","token":"temporary-access-token"}` {
+		t.Fatalf("CallToolWithToken() result = %s", got)
+	}
+	if authpkg.RuntimeProfile() != "corp_not_persisted" {
+		t.Fatalf("runtime profile = %q, want restored selector", authpkg.RuntimeProfile())
+	}
+	if flags.Token != "" {
+		t.Fatalf("token override leaked after call: %q", flags.Token)
+	}
+}
+
+type runtimeProfileCaptureRunner struct {
+	flags *GlobalFlags
+}
+
+func (r runtimeProfileCaptureRunner) Run(_ context.Context, invocation executor.Invocation) (executor.Result, error) {
+	return executor.Result{
+		Invocation: invocation,
+		Response: map[string]any{
+			"content": []any{map[string]any{
+				"type": "text",
+				"text": `{"profile":"` + authpkg.RuntimeProfile() + `","token":"` + r.flags.Token + `"}`,
+			}},
+		},
+	}, nil
+}

internal/app/usage_recording.go

@@ -15,6 +15,7 @@ package app
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/shortcut/usage"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
@@ -38,6 +39,21 @@ func (r recordingToolCaller) CallTool(ctx context.Context, product, tool string,
 	return res, err
 }
 
+func (r recordingToolCaller) CallToolWithToken(
+	ctx context.Context,
+	token, product, tool string,
+	args map[string]any,
+) (*edition.ToolResult, error) {
+	inner, ok := r.inner.(tokenOverrideToolCaller)
+	if !ok {
+		return nil, fmt.Errorf("ToolCaller token override is not configured")
+	}
+	recordedArgs := cloneToolArgs(args)
+	res, err := inner.CallToolWithToken(ctx, token, product, tool, args)
+	usage.Append(product, tool, recordedArgs, err == nil, r.inner.DryRun())
+	return res, err
+}
+
 func (r recordingToolCaller) Format() string { return r.inner.Format() }
 func (r recordingToolCaller) DryRun() bool   { return r.inner.DryRun() }
 func (r recordingToolCaller) Fields() string { return r.inner.Fields() }

internal/app/usage_recording_test.go

@@ -25,6 +25,7 @@ import (
 
 type crossPlatformCoverageCaller struct {
 	args   map[string]any
+	token  string
 	dryRun bool
 }
 
@@ -33,6 +34,16 @@ func (c *crossPlatformCoverageCaller) CallTool(_ context.Context, _, _ string, a
 	return &edition.ToolResult{}, nil
 }
 
+func (c *crossPlatformCoverageCaller) CallToolWithToken(
+	_ context.Context,
+	token, _, _ string,
+	args map[string]any,
+) (*edition.ToolResult, error) {
+	c.token = token
+	c.args = args
+	return &edition.ToolResult{}, nil
+}
+
 func (*crossPlatformCoverageCaller) Format() string { return "json" }
 func (c *crossPlatformCoverageCaller) DryRun() bool { return c.dryRun }
 func (*crossPlatformCoverageCaller) Fields() string { return "id,name" }
@@ -88,6 +99,23 @@ func TestCrossPlatformCoverageRecordingToolCaller(t *testing.T) {
 		t.Fatal("sensitive text must not be recorded")
 	}
 
+	tokenCaller, ok := caller.(tokenOverrideToolCaller)
+	if !ok {
+		t.Fatal("recording caller dropped token override support")
+	}
+	if _, err := tokenCaller.CallToolWithToken(
+		context.Background(),
+		"temporary-token",
+		"contact",
+		"get_current_user_profile",
+		nil,
+	); err != nil {
+		t.Fatal(err)
+	}
+	if inner.token != "temporary-token" || len(inner.args) != 0 {
+		t.Fatalf("token override forwarding = token %q args %#v", inner.token, inner.args)
+	}
+
 	inner.dryRun = true
 	if _, err := caller.CallTool(context.Background(), "chat", "send_message", args); err != nil {
 		t.Fatal(err)
@@ -96,7 +124,7 @@ func TestCrossPlatformCoverageRecordingToolCaller(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(records) != 1 {
+	if len(records) != 2 {
 		t.Fatalf("dry-run call must not be recorded: %#v", records)
 	}
 }

internal/auth/access_token_snapshot_test.go

@@ -0,0 +1,151 @@
+package auth
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+)
+
+func TestCrossPlatformCoverageOAuthProviderTokenSnapshotPreservesLoadFailure(t *testing.T) {
+	oldLoad := oauthLoadToken
+	want := errors.New("keychain permission denied")
+	oauthLoadToken = func(string) (*TokenData, error) { return nil, want }
+	t.Cleanup(func() { oauthLoadToken = oldLoad })
+
+	_, err := NewOAuthProvider(t.TempDir(), nil).GetTokenSnapshot(context.Background())
+	if !errors.Is(err, want) {
+		t.Fatalf("error = %v, want cause %v", err, want)
+	}
+	if errors.Is(err, ErrTokenDataNotFound) {
+		t.Fatalf("load failure was misclassified as missing credentials: %v", err)
+	}
+}
+
+func TestCrossPlatformCoverageOAuthProviderLoginReauthorizesAfterLoadFailureAndRejectsUnreadableTarget(t *testing.T) {
+	cleanupKeychain(t)
+	setLoginPreflightCredentials(t)
+
+	oldLoad := oauthLoadToken
+	oldOpenBrowser := oauthOpenBrowser
+	oldExchange := oauthExchange
+	oldCheckStatus := oauthCheckStatus
+	oldSave := oauthSaveToken
+	oldKeychainGet := authKeychainGet
+	oldLoginTimeout := oauthLoginTimeout
+	t.Cleanup(func() {
+		oauthLoadToken = oldLoad
+		oauthOpenBrowser = oldOpenBrowser
+		oauthExchange = oldExchange
+		oauthCheckStatus = oldCheckStatus
+		oauthSaveToken = oldSave
+		authKeychainGet = oldKeychainGet
+		oauthLoginTimeout = oldLoginTimeout
+	})
+	oauthLoginTimeout = 2 * time.Second
+
+	loadErr := errors.New("keychain permission denied")
+	targetErr := errors.New("target token ciphertext is unreadable")
+	oauthLoadToken = func(string) (*TokenData, error) { return nil, loadErr }
+
+	browserCalls := 0
+	oauthOpenBrowser = func(authURL string) error {
+		browserCalls++
+		parsed, err := url.Parse(authURL)
+		if err != nil {
+			return err
+		}
+		callbackURL := parsed.Query().Get("redirect_uri") + "?code=reauthorize"
+		response, err := (&http.Client{Timeout: 5 * time.Second}).Get(callbackURL)
+		if err != nil {
+			return err
+		}
+		_, _ = io.Copy(io.Discard, response.Body)
+		return response.Body.Close()
+	}
+
+	exchangeCalls := 0
+	oauthExchange = func(*OAuthProvider, context.Context, string) (*TokenData, error) {
+		exchangeCalls++
+		return &TokenData{
+			AccessToken: "new-access",
+			CorpID:      "corp-target",
+			UserID:      "user-target",
+		}, nil
+	}
+	oauthCheckStatus = func(*OAuthProvider, context.Context, string) (*CLIAuthStatus, error) {
+		return &CLIAuthStatus{Success: true, Result: &CLIAuthResult{CLIAuthEnabled: true}}, nil
+	}
+
+	targetReads := 0
+	authKeychainGet = func(_ string, account string) (string, error) {
+		if account == TokenAccountForIdentity("corp-target", "user-target") {
+			targetReads++
+			return "", targetErr
+		}
+		return "", nil
+	}
+	saveCalls := 0
+	oauthSaveToken = func(string, *TokenData) error {
+		saveCalls++
+		return nil
+	}
+
+	provider := NewOAuthProvider(t.TempDir(), slog.New(slog.NewTextHandler(io.Discard, nil)))
+	provider.Output = io.Discard
+	_, err := provider.Login(context.Background(), false)
+	if !errors.Is(err, targetErr) {
+		t.Fatalf("Login() error = %v, want target cause %v", err, targetErr)
+	}
+	if errors.Is(err, loadErr) {
+		t.Fatalf("Login() returned stale load failure instead of reauthorizing: %v", err)
+	}
+	if browserCalls != 1 || exchangeCalls != 1 {
+		t.Fatalf("authorization calls = browser:%d exchange:%d, want 1 each", browserCalls, exchangeCalls)
+	}
+	if targetReads != 1 {
+		t.Fatalf("target slot reads = %d, want 1", targetReads)
+	}
+	if saveCalls != 0 {
+		t.Fatalf("SaveTokenData calls = %d, want 0", saveCalls)
+	}
+}
+
+func TestCrossPlatformCoverageOAuthProviderTokenSnapshotReturnsExpiryMetadata(t *testing.T) {
+	oldLoad := oauthLoadToken
+	expiresAt := time.Now().Add(time.Hour)
+	oauthLoadToken = func(string) (*TokenData, error) {
+		return &TokenData{AccessToken: "token", ExpiresAt: expiresAt}, nil
+	}
+	t.Cleanup(func() { oauthLoadToken = oldLoad })
+
+	snapshot, err := NewOAuthProvider(t.TempDir(), nil).GetTokenSnapshot(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if snapshot.AccessToken != "token" || !snapshot.ExpiresAt.Equal(expiresAt) {
+		t.Fatalf("snapshot = %#v", snapshot)
+	}
+}
+
+func TestCrossPlatformCoverageTokenMarkerRevisionChangesOnEveryPublication(t *testing.T) {
+	configDir := t.TempDir()
+	if err := WriteTokenMarker(configDir); err != nil {
+		t.Fatal(err)
+	}
+	first, present, err := ReadTokenMarkerRevision(configDir)
+	if err != nil || !present || first == "" {
+		t.Fatalf("first marker = %q, %v, %v", first, present, err)
+	}
+	if err := WriteTokenMarker(configDir); err != nil {
+		t.Fatal(err)
+	}
+	second, present, err := ReadTokenMarkerRevision(configDir)
+	if err != nil || !present || second == "" || second == first {
+		t.Fatalf("second marker = %q, %v, %v; first=%q", second, present, err, first)
+	}
+}

internal/auth/auth_extra_test.go

@@ -306,6 +306,43 @@ func TestRevokeTokenRemote(t *testing.T) {
 	// Can't easily test since LogoutURL is a const. Just test that it doesn't panic with real URL.
 }
 
+func TestRevokeTokenRemoteForDataUsesExactTokenMetadata(t *testing.T) {
+	configDir := t.TempDir()
+	var got struct {
+		ClientID    string `json:"clientId"`
+		AccessToken string `json:"accessToken"`
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != MCPRevokeTokenPath {
+			t.Errorf("revoke path = %q, want %q", r.URL.Path, MCPRevokeTokenPath)
+		}
+		if err := json.NewDecoder(r.Body).Decode(&got); err != nil {
+			t.Errorf("decode revoke body: %v", err)
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	t.Setenv("DWS_CONFIG_DIR", configDir)
+	if err := os.WriteFile(filepath.Join(configDir, "mcp_url"), []byte(srv.URL), 0o600); err != nil {
+		t.Fatalf("write mcp_url: %v", err)
+	}
+	SetClientID("wrong-global-client")
+	t.Cleanup(func() { SetClientID("") })
+
+	data := &TokenData{
+		AccessToken: "exact-account-token",
+		ClientID:    "exact-account-client",
+		Source:      "mcp",
+	}
+	if err := RevokeTokenRemoteForData(t.Context(), data); err != nil {
+		t.Fatalf("RevokeTokenRemoteForData() error = %v", err)
+	}
+	if got.ClientID != data.ClientID || got.AccessToken != data.AccessToken {
+		t.Fatalf("revoke body = %#v, want exact token metadata", got)
+	}
+}
+
 // ─── oauth_helpers.go ──────────────────────────────────────────────────
 
 type tokenResponse struct {

internal/auth/auth_legacy_platform_coverage_test.go

@@ -0,0 +1,297 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package auth
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/keychain"
+)
+
+// The native coverage jobs intentionally execute only TestCrossPlatformCoverage
+// entry points. Keep the compatibility assertions below as independently named
+// regression tests for the stable make target, and exercise the same functions
+// here as isolated subtests so their cleanup hooks run between cases.
+func TestCrossPlatformCoverageAuthLegacyCompatibilityRegressions(t *testing.T) {
+	t.Setenv(keychain.DisableKeychainEnv, "1")
+	t.Setenv(keychain.StorageDirEnv, t.TempDir())
+	tests := []struct {
+		name string
+		run  func(*testing.T)
+	}{
+		{"prepare unique global owner", TestPrepareLoginPersistenceRepairsOnlySafeGlobalOwner},
+		{"token load isolation matrix", TestTokenLoadIsolationMatrix},
+		{"reject future profiles before remote work", TestPersistingLoginFlowsRejectFutureProfilesBeforeRemoteWork},
+		{"fresh UID-less isolation", TestFreshUIDLessExactLoginCannotOverwriteExistingUnresolvedProfile},
+		{"reject mismatched exact switch", TestSetCurrentProfileRejectsMismatchedExactIdentitySlotBesideBlankProfile},
+		{"reject unreadable previous identity", TestUsePreviousProfileRejectsUnreadableExactIdentityBesideBlankProfile},
+		{"reauthorization guidance without profile", TestLegacyRefreshReauthorizationGuidanceWithoutProfileStillExplainsLogin},
+		{"repair v3 unresolved profile", TestPrepareLoginPersistenceV3UnresolvedProfileRepair},
+		{"device ignores unrelated unreadable profile", TestDeviceLoginIgnoresUnreadableUnrelatedProfile},
+		{"reject unreadable global before login", TestPrepareLoginPersistenceUnreadableGlobalFailsClosedBeforeRemote},
+		{"device validates resolved target", TestDeviceFlowChecksResolvedTargetBeforeSave},
+		{"accept recoverable credential material", TestPrepareLoginPersistenceRequiresCredentialMaterialButNotValidity},
+		{"auth code validates resolved target", TestExchangeAuthCodeChecksResolvedTargetBeforeSave},
+		{"standalone exchange prepares and marks fresh", TestExchangeCodeForTokenPreparesBeforeRemoteAndMarksFresh},
+	}
+	for _, test := range tests {
+		t.Run(test.name, test.run)
+	}
+}
+
+func TestCrossPlatformCoverageHalfMigratedGlobalRepairRemainingEdges(t *testing.T) {
+	t.Setenv(keychain.DisableKeychainEnv, "1")
+	t.Setenv(keychain.StorageDirEnv, t.TempDir())
+
+	t.Run("nil global token", func(t *testing.T) {
+		isolateHalfMigratedRepairHooks(t)
+		profilesLoadLegacy = func() (*TokenData, error) { return nil, nil }
+		cfg := &ProfilesConfig{Version: profilesVersion, Profiles: []Profile{{CorpID: "corp_nil_global"}}}
+		if err := repairHalfMigratedGlobalTokenLocked(cfg); err != nil {
+			t.Fatalf("repairHalfMigratedGlobalTokenLocked() error = %v", err)
+		}
+	})
+
+	t.Run("global token without organization", func(t *testing.T) {
+		isolateHalfMigratedRepairHooks(t)
+		profilesLoadLegacy = func() (*TokenData, error) {
+			return &TokenData{AccessToken: "legacy"}, nil
+		}
+		cfg := &ProfilesConfig{Version: profilesVersion, Profiles: []Profile{{CorpID: "corp_other"}}}
+		if err := repairHalfMigratedGlobalTokenLocked(cfg); err != nil {
+			t.Fatalf("repairHalfMigratedGlobalTokenLocked() error = %v", err)
+		}
+	})
+
+	t.Run("orphan global organization", func(t *testing.T) {
+		isolateHalfMigratedRepairHooks(t)
+		profilesLoadLegacy = func() (*TokenData, error) {
+			return &TokenData{AccessToken: "legacy", CorpID: "corp_orphan"}, nil
+		}
+		cfg := &ProfilesConfig{Version: profilesVersion, Profiles: []Profile{{CorpID: "corp_other"}}}
+		if err := repairHalfMigratedGlobalTokenLocked(cfg); err != nil {
+			t.Fatalf("repairHalfMigratedGlobalTokenLocked() error = %v", err)
+		}
+	})
+
+	t.Run("identity repair write failure", func(t *testing.T) {
+		isolateHalfMigratedRepairHooks(t)
+		failure := errors.New("identity repair write failure")
+		const corpID, userID = "corp_identity_repair", "user_identity_repair"
+		profilesLoadLegacy = func() (*TokenData, error) {
+			return &TokenData{AccessToken: "legacy", CorpID: corpID}, nil
+		}
+		profilesLoadCorp = func(string) (*TokenData, error) {
+			return &TokenData{AccessToken: "organization", CorpID: corpID}, nil
+		}
+		profilesSaveIdentity = func(string, string, *TokenData) error { return failure }
+		cfg := &ProfilesConfig{Version: profilesVersion, Profiles: []Profile{{CorpID: corpID, UserID: userID}}}
+		if err := repairHalfMigratedGlobalTokenLocked(cfg); !errors.Is(err, failure) {
+			t.Fatalf("repairHalfMigratedGlobalTokenLocked() error = %v, want %v", err, failure)
+		}
+	})
+
+	t.Run("organization repair write failure", func(t *testing.T) {
+		isolateHalfMigratedRepairHooks(t)
+		failure := errors.New("organization repair write failure")
+		const corpID = "corp_organization_repair"
+		profilesLoadLegacy = func() (*TokenData, error) {
+			return &TokenData{AccessToken: "legacy", CorpID: corpID}, nil
+		}
+		profilesSaveCorp = func(string, *TokenData) error { return failure }
+		cfg := &ProfilesConfig{Version: profilesVersion, Profiles: []Profile{{CorpID: corpID}}}
+		if err := repairHalfMigratedGlobalTokenLocked(cfg); !errors.Is(err, failure) {
+			t.Fatalf("repairHalfMigratedGlobalTokenLocked() error = %v, want %v", err, failure)
+		}
+	})
+
+	t.Run("nil profile is not canonical", func(t *testing.T) {
+		if loginProfileHasUsableCanonicalToken(nil, nil, nil) {
+			t.Fatal("nil profile was treated as a usable canonical token")
+		}
+	})
+
+	t.Run("global write preflight reports unreadable slot", func(t *testing.T) {
+		oldGet := authKeychainGet
+		failure := errors.New("global ciphertext is unreadable")
+		authKeychainGet = func(_, account string) (string, error) {
+			if account == keychain.AccountToken {
+				return "", failure
+			}
+			return "", nil
+		}
+		t.Cleanup(func() { authKeychainGet = oldGet })
+
+		err := preflightTokenWritePersistence(t.TempDir(), &TokenData{AccessToken: "fresh"})
+		if !errors.Is(err, failure) {
+			t.Fatalf("preflightTokenWritePersistence() error = %v, want %v", err, failure)
+		}
+	})
+}
+
+func TestCrossPlatformCoverageLegacyProfileGuardRemainingEdges(t *testing.T) {
+	t.Run("empty v3 registry normalizes and persists", func(t *testing.T) {
+		oldLoad := profilesLoad
+		oldSave := profilesSave
+		cfg := &ProfilesConfig{Version: profilesUnresolvedSelectorVersion}
+		profilesLoad = func(string) (*ProfilesConfig, error) { return cfg, nil }
+		saves := 0
+		profilesSave = func(string, *ProfilesConfig) error {
+			saves++
+			return nil
+		}
+		t.Cleanup(func() {
+			profilesLoad = oldLoad
+			profilesSave = oldSave
+		})
+
+		if err := ensureProfilesMigrationLocked(t.TempDir()); err != nil {
+			t.Fatalf("ensureProfilesMigrationLocked() error = %v", err)
+		}
+		if cfg.Version != profilesVersion || saves != 1 {
+			t.Fatalf("normalized registry = version %d saves %d", cfg.Version, saves)
+		}
+	})
+
+	if normalizeProfilesVersionForSelectors(nil) {
+		t.Fatal("nil profile registry reported a version change")
+	}
+	future := &ProfilesConfig{Version: profilesMaxVersion + 1}
+	if normalizeProfilesVersionForSelectors(future) {
+		t.Fatal("future profile registry reported a version change")
+	}
+	if profilesConfigContainsUnresolvedSelector(nil) {
+		t.Fatal("nil profile registry contained an unresolved selector")
+	}
+	reserved := unresolvedProfileSelector("corp_org_current_guard")
+	if !profilesConfigContainsUnresolvedSelector(&ProfilesConfig{
+		OrgCurrentProfiles: map[string]string{"corp_org_current_guard": reserved},
+	}) {
+		t.Fatal("reserved organization-current selector was not detected")
+	}
+	if selectorConflictsWithOrganizationGrammar(nil, "corp") {
+		t.Fatal("nil profile registry reported an organization-selector conflict")
+	}
+	if err := validateIdentityOnlyProfileToken(Profile{}); !errors.Is(err, ErrTokenDataNotFound) {
+		t.Fatalf("validateIdentityOnlyProfileToken(blank) error = %v", err)
+	}
+
+	oldLoadIdentity := profilesLoadIdentity
+	profilesLoadIdentity = func(string, string) (*TokenData, error) { return nil, nil }
+	t.Cleanup(func() { profilesLoadIdentity = oldLoadIdentity })
+	if err := validateIdentityOnlyProfileToken(Profile{CorpID: "corp_nil_identity", UserID: "user_nil_identity"}); !errors.Is(err, ErrTokenDataNotFound) {
+		t.Fatalf("validateIdentityOnlyProfileToken(nil token) error = %v", err)
+	}
+}
+
+func TestCrossPlatformCoverageTokenPersistenceRemainingEdges(t *testing.T) {
+	t.Setenv(keychain.DisableKeychainEnv, "1")
+	t.Setenv(keychain.StorageDirEnv, t.TempDir())
+
+	plan := planTokenPersistenceWrites(&ProfilesConfig{}, nil, "")
+	if !plan.WriteGlobal || plan.CorpID != "" {
+		t.Fatalf("nil-token write plan = %#v", plan)
+	}
+	if err := SaveLoginTokenData(t.TempDir(), nil); err == nil {
+		t.Fatal("SaveLoginTokenData(nil) succeeded")
+	}
+
+	futureDir := t.TempDir()
+	writeFutureProfilesForLoginPreflight(t, futureDir)
+	err := SaveLoginTokenData(futureDir, &TokenData{AccessToken: "fresh"})
+	if err == nil || !strings.Contains(err.Error(), "newer than supported") {
+		t.Fatalf("SaveLoginTokenData(future schema) error = %v", err)
+	}
+
+	t.Run("nil identity token", func(t *testing.T) {
+		isolateTokenProfileLoadHooks(t)
+		tokenLoadKeychainIdentity = func(string, string) (*TokenData, error) { return nil, nil }
+		_, err := tokenLoadProfileIdentity(Profile{CorpID: "corp_nil_identity", UserID: "user_nil_identity"})
+		if !errors.Is(err, ErrTokenDataNotFound) {
+			t.Fatalf("tokenLoadProfileIdentity() error = %v", err)
+		}
+	})
+
+	t.Run("nil organization fallback", func(t *testing.T) {
+		isolateTokenProfileLoadHooks(t)
+		tokenLoadKeychainForCorpID = func(string) (*TokenData, error) { return nil, nil }
+		_, err := tokenLoadProfileIdentity(Profile{CorpID: "corp_nil_org", UserID: "user_nil_org"})
+		if !errors.Is(err, ErrTokenDataNotFound) {
+			t.Fatalf("tokenLoadProfileIdentity() error = %v", err)
+		}
+	})
+
+	t.Run("organization fallback belongs to another organization", func(t *testing.T) {
+		isolateTokenProfileLoadHooks(t)
+		tokenLoadKeychainForCorpID = func(string) (*TokenData, error) {
+			return &TokenData{AccessToken: "wrong", CorpID: "corp_other", UserID: "user_wrong_org"}, nil
+		}
+		_, err := tokenLoadProfileIdentity(Profile{CorpID: "corp_expected", UserID: "user_wrong_org"})
+		if err == nil || !strings.Contains(err.Error(), "contains token for corpId") {
+			t.Fatalf("tokenLoadProfileIdentity() error = %v", err)
+		}
+	})
+
+	t.Run("identity repair write failure", func(t *testing.T) {
+		isolateTokenProfileLoadHooks(t)
+		failure := errors.New("identity repair write failure")
+		const corpID, userID = "corp_identity_save", "user_identity_save"
+		tokenLoadKeychainForCorpID = func(string) (*TokenData, error) {
+			return &TokenData{AccessToken: "organization", CorpID: corpID, UserID: userID}, nil
+		}
+		tokenSaveKeychainForIdentity = func(string, string, *TokenData) error { return failure }
+		_, err := tokenLoadProfileIdentity(Profile{CorpID: corpID, UserID: userID})
+		if !errors.Is(err, failure) {
+			t.Fatalf("tokenLoadProfileIdentity() error = %v, want %v", err, failure)
+		}
+	})
+}
+
+func isolateHalfMigratedRepairHooks(t *testing.T) {
+	t.Helper()
+	oldLoadLegacy := profilesLoadLegacy
+	oldLoadCorp := profilesLoadCorp
+	oldLoadIdentity := profilesLoadIdentity
+	oldSaveCorp := profilesSaveCorp
+	oldSaveIdentity := profilesSaveIdentity
+	t.Cleanup(func() {
+		profilesLoadLegacy = oldLoadLegacy
+		profilesLoadCorp = oldLoadCorp
+		profilesLoadIdentity = oldLoadIdentity
+		profilesSaveCorp = oldSaveCorp
+		profilesSaveIdentity = oldSaveIdentity
+	})
+	profilesLoadLegacy = func() (*TokenData, error) { return nil, ErrTokenDataNotFound }
+	profilesLoadCorp = func(string) (*TokenData, error) { return nil, ErrTokenDataNotFound }
+	profilesLoadIdentity = func(string, string) (*TokenData, error) { return nil, ErrTokenDataNotFound }
+	profilesSaveCorp = func(string, *TokenData) error { return nil }
+	profilesSaveIdentity = func(string, string, *TokenData) error { return nil }
+}
+
+func isolateTokenProfileLoadHooks(t *testing.T) {
+	t.Helper()
+	oldLoadIdentity := tokenLoadKeychainIdentity
+	oldLoadCorp := tokenLoadKeychainForCorpID
+	oldSaveIdentity := tokenSaveKeychainForIdentity
+	t.Cleanup(func() {
+		tokenLoadKeychainIdentity = oldLoadIdentity
+		tokenLoadKeychainForCorpID = oldLoadCorp
+		tokenSaveKeychainForIdentity = oldSaveIdentity
+	})
+	tokenLoadKeychainIdentity = func(string, string) (*TokenData, error) { return nil, ErrTokenDataNotFound }
+	tokenLoadKeychainForCorpID = func(string) (*TokenData, error) { return nil, ErrTokenDataNotFound }
+	tokenSaveKeychainForIdentity = func(string, string, *TokenData) error { return nil }
+}

internal/auth/blank_profile_selector_regression_test.go

@@ -0,0 +1,357 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package auth
+
+import (
+	"encoding/json"
+	"os"
+	"strings"
+	"testing"
+)
+
+type blankProfileSelectorFixture struct {
+	configDir     string
+	corpID        string
+	blankName     string
+	blankSelector string
+	exactUserID   string
+	exactSelector string
+	blankToken    *TokenData
+	exactToken    *TokenData
+}
+
+func seedBlankProfileSelectorFixture(
+	t *testing.T,
+	blankName string,
+	corpName string,
+	blankCurrent bool,
+) blankProfileSelectorFixture {
+	t.Helper()
+	cleanupKeychain(t)
+
+	configDir := t.TempDir()
+	corpID := "corp_selector_fixture"
+	exactUserID := "identity_exact_fixture"
+	exactSelector := profileSelector(corpID, exactUserID)
+
+	blankToken := testToken("at_unresolved_fixture", corpID, corpName)
+	blankToken.UserID = ""
+	blankToken.UserName = ""
+	exactToken := testToken("at_exact_fixture", corpID, corpName)
+	exactToken.UserID = exactUserID
+	exactToken.UserName = "Exact Fixture Account"
+
+	if err := SaveTokenDataKeychainForCorpID(corpID, blankToken); err != nil {
+		t.Fatalf("SaveTokenDataKeychainForCorpID(blank) error = %v", err)
+	}
+	if err := SaveTokenDataKeychainForIdentity(corpID, exactUserID, exactToken); err != nil {
+		t.Fatalf("SaveTokenDataKeychainForIdentity(exact) error = %v", err)
+	}
+	if err := SaveTokenDataKeychain(exactToken); err != nil {
+		t.Fatalf("SaveTokenDataKeychain(exact mirror) error = %v", err)
+	}
+	if err := WriteTokenMarker(configDir); err != nil {
+		t.Fatalf("WriteTokenMarker() error = %v", err)
+	}
+
+	cfg := &ProfilesConfig{
+		Version:        profilesVersion,
+		PrimaryProfile: exactSelector,
+		OrgCurrentProfiles: map[string]string{
+			corpID: exactSelector,
+		},
+		Profiles: []Profile{
+			{
+				Name:     blankName,
+				CorpID:   corpID,
+				CorpName: corpName,
+				Status:   ProfileStatusActive,
+			},
+			{
+				Name:     "Exact Fixture Account",
+				CorpID:   corpID,
+				CorpName: corpName,
+				UserID:   exactUserID,
+				UserName: "Exact Fixture Account",
+				Status:   ProfileStatusActive,
+			},
+		},
+	}
+	blankSelector := ProfileSelectionSelector(cfg.Profiles[0], cfg)
+	persistedBlankPointer := strings.TrimSpace(blankName)
+	if selectorConflictsWithOrganizationGrammar(cfg, persistedBlankPointer) {
+		// An ambiguous local name has always been captured by CorpId/CorpName
+		// grammar in the public resolver. New writers must use the reserved
+		// selector to preserve exact blank-profile intent without changing that
+		// precedence.
+		persistedBlankPointer = blankSelector
+		if _, reserved := parseUnresolvedProfileSelector(persistedBlankPointer); reserved {
+			cfg.Version = profilesUnresolvedSelectorVersion
+		}
+	}
+	cfg.CurrentProfile = exactSelector
+	cfg.PreviousProfile = persistedBlankPointer
+	if blankCurrent {
+		cfg.CurrentProfile = persistedBlankPointer
+		cfg.PreviousProfile = exactSelector
+	}
+	data, err := json.MarshalIndent(cfg, "", "  ")
+	if err != nil {
+		t.Fatalf("json.MarshalIndent(profiles) error = %v", err)
+	}
+	data = append(data, '\n')
+	if err := os.WriteFile(ProfilesPath(configDir), data, 0o600); err != nil {
+		t.Fatalf("os.WriteFile(profiles.json) error = %v", err)
+	}
+
+	return blankProfileSelectorFixture{
+		configDir:     configDir,
+		corpID:        corpID,
+		blankName:     blankName,
+		blankSelector: blankSelector,
+		exactUserID:   exactUserID,
+		exactSelector: exactSelector,
+		blankToken:    blankToken,
+		exactToken:    exactToken,
+	}
+}
+
+func TestCrossPlatformCoverageBlankProfileNameMatchingCorpNameResolvesCurrentProfileExactly(t *testing.T) {
+	fixture := seedBlankProfileSelectorFixture(t, "Fixture Organization", "Fixture Organization", true)
+
+	selected, exact, err := ResolveProfileWithScope(fixture.configDir, "")
+	if err != nil {
+		t.Fatalf("ResolveProfileWithScope(current) error = %v", err)
+	}
+	if selected == nil || selected.CorpID != fixture.corpID || selected.UserID != "" {
+		t.Fatalf("resolved current profile = %#v, want unresolved profile", selected)
+	}
+	if !exact {
+		t.Fatal("current local-name selector should resolve one exact unresolved profile")
+	}
+	cfg, err := LoadProfiles(fixture.configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() error = %v", err)
+	}
+	if cfg.CurrentProfile != fixture.blankSelector {
+		t.Fatalf("current profile = %q, want stable unresolved selector %q", cfg.CurrentProfile, fixture.blankSelector)
+	}
+}
+
+func TestCrossPlatformCoverageBlankProfileNameMatchingCorpNameLoadsOrganizationToken(t *testing.T) {
+	fixture := seedBlankProfileSelectorFixture(t, "Fixture Organization", "Fixture Organization", false)
+
+	if fixture.blankSelector == fixture.blankName || fixture.blankSelector == fixture.corpID {
+		t.Fatalf("unsafe blank selector = %q, want reserved exact selector", fixture.blankSelector)
+	}
+	loaded, err := LoadTokenDataForProfile(fixture.configDir, fixture.blankSelector)
+	if err != nil {
+		t.Fatalf("LoadTokenDataForProfile(blank local name) error = %v", err)
+	}
+	if loaded.UserID != "" || loaded.AccessToken != fixture.blankToken.AccessToken {
+		t.Fatalf("loaded token = %#v, want unresolved organization token", loaded)
+	}
+}
+
+func TestCrossPlatformCoverageBlankProfileNameMatchingCorpNameRoundTripsPreviousProfile(t *testing.T) {
+	fixture := seedBlankProfileSelectorFixture(t, "Fixture Organization", "Fixture Organization", false)
+
+	selected, err := UsePreviousProfile(fixture.configDir)
+	if err != nil {
+		t.Fatalf("UsePreviousProfile() error = %v", err)
+	}
+	if selected == nil || selected.CorpID != fixture.corpID || selected.UserID != "" {
+		t.Fatalf("selected previous profile = %#v, want unresolved profile", selected)
+	}
+
+	cfg, err := LoadProfiles(fixture.configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() error = %v", err)
+	}
+	if cfg.CurrentProfile != fixture.blankSelector || cfg.PreviousProfile != fixture.exactSelector {
+		t.Fatalf(
+			"profile pointers = current %q previous %q, want %q and %q",
+			cfg.CurrentProfile,
+			cfg.PreviousProfile,
+			fixture.blankSelector,
+			fixture.exactSelector,
+		)
+	}
+}
+
+func TestCrossPlatformCoverageBlankProfileNameMatchingCorpNameDeletesOnlyUnresolvedProfile(t *testing.T) {
+	fixture := seedBlankProfileSelectorFixture(t, "Fixture Organization", "Fixture Organization", false)
+
+	if err := DeleteTokenDataForProfile(fixture.configDir, fixture.blankSelector); err != nil {
+		t.Fatalf("DeleteTokenDataForProfile(blank local name) error = %v", err)
+	}
+
+	cfg, err := LoadProfiles(fixture.configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() error = %v", err)
+	}
+	if len(cfg.Profiles) != 1 || cfg.Profiles[0].CorpID != fixture.corpID || cfg.Profiles[0].UserID != fixture.exactUserID {
+		t.Fatalf("profiles after blank deletion = %#v, want only exact account", cfg.Profiles)
+	}
+	loaded, err := LoadTokenDataForProfile(fixture.configDir, fixture.exactSelector)
+	if err != nil {
+		t.Fatalf("LoadTokenDataForProfile(exact after blank deletion) error = %v", err)
+	}
+	if loaded.UserID != fixture.exactUserID || loaded.AccessToken != fixture.exactToken.AccessToken {
+		t.Fatalf("exact token after blank deletion = %#v, want exact account preserved", loaded)
+	}
+}
+
+func TestCrossPlatformCoverageBlankProfileNameContainingColonWinsOverIdentitySyntax(t *testing.T) {
+	fixture := seedBlankProfileSelectorFixture(t, "legacy:outsourced", "Fixture Organization", true)
+
+	if fixture.blankSelector == fixture.blankName {
+		t.Fatalf("colon-containing name leaked as selector %q", fixture.blankSelector)
+	}
+	if _, _, parsedAsIdentity := ParseIdentitySelector(fixture.blankSelector); parsedAsIdentity {
+		t.Fatalf("stable blank selector %q was parsed as an identity", fixture.blankSelector)
+	}
+	selected, exact, err := ResolveProfileWithScope(fixture.configDir, "")
+	if err != nil {
+		t.Fatalf("ResolveProfileWithScope(colon local name) error = %v", err)
+	}
+	if selected == nil || selected.CorpID != fixture.corpID || selected.UserID != "" {
+		t.Fatalf("resolved colon-name profile = %#v, want unresolved profile", selected)
+	}
+	if !exact {
+		t.Fatal("colon-containing local name should resolve one exact unresolved profile")
+	}
+
+	cfg, err := LoadProfiles(fixture.configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() error = %v", err)
+	}
+	if cfg.CurrentProfile != fixture.blankSelector {
+		t.Fatalf("current profile = %q, want migrated colon-name selector %q", cfg.CurrentProfile, fixture.blankSelector)
+	}
+
+	loaded, err := LoadTokenDataForProfile(fixture.configDir, fixture.blankSelector)
+	if err != nil {
+		t.Fatalf("LoadTokenDataForProfile(colon local name) error = %v", err)
+	}
+	if loaded.UserID != "" || loaded.AccessToken != fixture.blankToken.AccessToken {
+		t.Fatalf("loaded colon-name token = %#v, want unresolved organization token", loaded)
+	}
+}
+
+func TestCrossPlatformCoverageRealExactSelectorWinsOverMatchingBlankLegacyName(t *testing.T) {
+	const exactSelector = "corp_selector_fixture:identity_exact_fixture"
+	fixture := seedBlankProfileSelectorFixture(t, exactSelector, "Fixture Organization", true)
+
+	selected, exact, err := ResolveProfileWithScope(fixture.configDir, "")
+	if err != nil {
+		t.Fatalf("ResolveProfileWithScope(current exact collision) error = %v", err)
+	}
+	if selected == nil || selected.UserID != fixture.exactUserID || !exact {
+		t.Fatalf("resolved current collision = %#v exact=%v, want real exact identity", selected, exact)
+	}
+	cfg, err := LoadProfiles(fixture.configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() error = %v", err)
+	}
+	if cfg.CurrentProfile != exactSelector {
+		t.Fatalf("current collision selector = %q, want real exact %q", cfg.CurrentProfile, exactSelector)
+	}
+
+	blank, err := LoadTokenDataForProfile(fixture.configDir, fixture.blankSelector)
+	if err != nil {
+		t.Fatalf("LoadTokenDataForProfile(reserved blank collision) error = %v", err)
+	}
+	if blank.UserID != "" || blank.AccessToken != fixture.blankToken.AccessToken {
+		t.Fatalf("reserved blank collision token = %#v", blank)
+	}
+	if err := DeleteTokenDataForProfile(fixture.configDir, fixture.blankSelector); err != nil {
+		t.Fatalf("DeleteTokenDataForProfile(reserved blank collision) error = %v", err)
+	}
+	exactToken, err := LoadTokenDataForProfile(fixture.configDir, exactSelector)
+	if err != nil || exactToken.UserID != fixture.exactUserID {
+		t.Fatalf("exact identity after blank collision delete = %#v, %v", exactToken, err)
+	}
+}
+
+func TestCrossPlatformCoverageUnrelatedProfileDeletionPreservesBlankOrganizationCurrentMapping(t *testing.T) {
+	fixture := seedBlankProfileSelectorFixture(t, "Fixture Organization", "Fixture Organization", true)
+	cfg, err := LoadProfiles(fixture.configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() error = %v", err)
+	}
+	cfg.Profiles = append(cfg.Profiles, Profile{
+		Name:   "Unrelated Account",
+		CorpID: "corp_unrelated_fixture",
+		UserID: "identity_unrelated_fixture",
+		Status: ProfileStatusActive,
+	})
+	if err := SaveProfiles(fixture.configDir, cfg); err != nil {
+		t.Fatalf("SaveProfiles(unrelated) error = %v", err)
+	}
+	if _, err := RemoveProfile(fixture.configDir, "corp_unrelated_fixture:identity_unrelated_fixture"); err != nil {
+		t.Fatalf("RemoveProfile(unrelated) error = %v", err)
+	}
+
+	cfg, err = LoadProfiles(fixture.configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles(after unrelated delete) error = %v", err)
+	}
+	if cfg.CurrentProfile != fixture.blankSelector {
+		t.Fatalf("blank current after unrelated delete = %q, want %q", cfg.CurrentProfile, fixture.blankSelector)
+	}
+	if got := cfg.OrgCurrentProfiles[fixture.corpID]; got != fixture.exactSelector {
+		t.Fatalf("organization current after unrelated delete = %q, want %q", got, fixture.exactSelector)
+	}
+	selected, err := ResolveProfile(fixture.configDir, fixture.corpID)
+	if err != nil || selected.UserID != fixture.exactUserID {
+		t.Fatalf("organization selector after unrelated delete = %#v, %v", selected, err)
+	}
+}
+
+func TestCrossPlatformCoverageSameCorpNonCurrentDeletionPreservesExactOrganizationCurrent(t *testing.T) {
+	fixture := seedBlankProfileSelectorFixture(t, "Fixture Organization", "Fixture Organization", true)
+	cfg, err := LoadProfiles(fixture.configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles() error = %v", err)
+	}
+	cfg.Profiles = append(cfg.Profiles, Profile{
+		Name:     "Another Exact Account",
+		CorpID:   fixture.corpID,
+		CorpName: "Fixture Organization",
+		UserID:   "identity_noncurrent_fixture",
+		Status:   ProfileStatusActive,
+	})
+	if err := SaveProfiles(fixture.configDir, cfg); err != nil {
+		t.Fatalf("SaveProfiles(non-current exact) error = %v", err)
+	}
+	if _, err := RemoveProfile(fixture.configDir, fixture.corpID+":identity_noncurrent_fixture"); err != nil {
+		t.Fatalf("RemoveProfile(non-current exact) error = %v", err)
+	}
+
+	cfg, err = LoadProfiles(fixture.configDir)
+	if err != nil {
+		t.Fatalf("LoadProfiles(after same-corp delete) error = %v", err)
+	}
+	if cfg.CurrentProfile != fixture.blankSelector {
+		t.Fatalf("blank current after same-corp delete = %q, want %q", cfg.CurrentProfile, fixture.blankSelector)
+	}
+	if got := cfg.OrgCurrentProfiles[fixture.corpID]; got != fixture.exactSelector {
+		t.Fatalf("organization current after same-corp delete = %q, want %q", got, fixture.exactSelector)
+	}
+	selected, err := ResolveProfile(fixture.configDir, fixture.corpID)
+	if err != nil || selected.UserID != fixture.exactUserID {
+		t.Fatalf("organization selector after same-corp delete = %#v, %v", selected, err)
+	}
+}

internal/auth/cli_auth_check_test.go

@@ -495,6 +495,10 @@ func TestDeviceFlow_LoginOnce_CLIAuthEnabled_Success(t *testing.T) {
 		logger:          newDeviceFlowTestLogger(),
 		Output:          io.Discard,
 		httpClient:      srv.Client(),
+		IdentityEnricher: func(_ context.Context, data *TokenData) error {
+			data.UserID = "user123"
+			return nil
+		},
 	}
 
 	token, err := provider.loginOnce(context.Background(), 1)

internal/auth/coverage_edges_test.go

@@ -396,7 +396,8 @@ func TestCrossPlatformCoverageDeviceFlowLoginRetry(t *testing.T) {
 				return
 			}
 			_ = json.NewEncoder(w).Encode(map[string]any{
-				"accessToken": "device-access", "refreshToken": "refresh", "expiresIn": 7200, "corpId": "corp-device",
+				"accessToken": "device-access", "refreshToken": "refresh", "expiresIn": 7200,
+				"corpId": "corp-device", "userId": "user-device",
 			})
 		case strings.HasSuffix(r.URL.Path, CLIAuthEnabledPath):
 			_ = json.NewEncoder(w).Encode(CLIAuthStatus{Success: true, Result: &CLIAuthResult{CLIAuthEnabled: true}})
@@ -493,7 +494,7 @@ func TestCrossPlatformCoverageProfilesLifecycleEdges(t *testing.T) {
 	}
 	normalizeProfilesConfig(cfg)
 	if len(cfg.Profiles) != 1 || cfg.Profiles[0].Name != "Acme" ||
-		cfg.PrimaryProfile != "corp-a" || cfg.CurrentProfile != "corp-a" || cfg.PreviousProfile != "" {
+		cfg.PrimaryProfile != "" || cfg.CurrentProfile != "" || cfg.PreviousProfile != "" {
 		t.Fatalf("normalized profiles = %#v", cfg)
 	}
 
@@ -515,6 +516,16 @@ func TestCrossPlatformCoverageProfilesLifecycleEdges(t *testing.T) {
 	if err := UpsertProfileFromTokenWithCurrent(dir, second, true); err != nil {
 		t.Fatal(err)
 	}
+	if err := SaveTokenDataKeychainForIdentity(first.CorpID, first.UserID, first); err != nil {
+		t.Fatal(err)
+	}
+	if err := SaveTokenDataKeychainForCorpID(second.CorpID, second); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_ = DeleteTokenDataKeychainForIdentity(first.CorpID, first.UserID)
+		_ = DeleteTokenDataKeychainForCorpID(second.CorpID)
+	})
 	profilesForAmbiguity, err := LoadProfiles(dir)
 	if err != nil {
 		t.Fatal(err)
@@ -575,7 +586,7 @@ func TestCrossPlatformCoverageProfilesLifecycleEdges(t *testing.T) {
 		{CorpID: "two", Name: "Acme-12345678"},
 		{CorpID: "three", Name: "Acme-12345678-2"},
 	}}
-	if got := chooseProfileName(nameCfg, &TokenData{CorpID: "corp-12345678", CorpName: "Acme"}); got != "Acme-12345678-3" {
+	if got := chooseProfileName(nameCfg, &TokenData{CorpID: "corp-12345678", CorpName: "Acme"}); got != "Acme-2" {
 		t.Fatalf("collision profile name = %q", got)
 	}
 	if chooseProfileName(&ProfilesConfig{}, &TokenData{}) != "profile" {
@@ -585,12 +596,7 @@ func TestCrossPlatformCoverageProfilesLifecycleEdges(t *testing.T) {
 		!shouldRefreshProfileName(&Profile{}, first) {
 		t.Fatal("profile refresh-name decisions failed")
 	}
-	if findProfile(nil, "x") != nil || findProfile(cfg, "") != nil ||
-		profileIndexByCorpID(nil, "x") != -1 || firstProfileCorpID(nil) != "" {
-		t.Fatal("nil profile helper failed")
-	}
-	if shortCorpID("short") != "short" || shortCorpID("corp-12345678") != "12345678" ||
-		timeOrRFC3339(time.Time{}) != "" {
+	if shortCorpID("short") != "short" || shortCorpID("corp-12345678") != "12345678" {
 		t.Fatal("profile formatting helpers failed")
 	}
 }
@@ -1234,6 +1240,12 @@ func TestCrossPlatformCoveragePortableAuthBundleCoverageEdges(t *testing.T) {
 	})
 
 	t.Run("import validation", func(t *testing.T) {
+		oldGOOS := portableRuntimeGOOS
+		t.Cleanup(func() {
+			portableRuntimeGOOS = oldGOOS
+		})
+		portableRuntimeGOOS = func() string { return "linux" }
+
 		t.Setenv(keychain.StorageDirEnv, t.TempDir())
 		if _, err := ImportPortableAuthBundle(t.TempDir(), nil); err == nil {
 			t.Fatal("nil portable reader succeeded")
@@ -1443,31 +1455,43 @@ func TestCrossPlatformCoverageTokenStorageAndRevocationCoverageEdges(t *testing.
 	oldMarshalIndent := tokenJSONMarshalIndent
 	oldMarshal := tokenJSONMarshal
 	oldMkdir := tokenMkdirAll
+	oldRead := tokenReadFile
 	oldWrite := tokenWriteFile
 	oldRename := tokenRename
 	oldRemove := tokenRemove
 	oldGlob := tokenGlob
 	oldSaveCorp := tokenSaveKeychainForCorpID
+	oldSaveIdentity := tokenSaveKeychainForIdentity
 	oldSaveLegacy := tokenSaveKeychain
 	oldLoadCorp := tokenLoadKeychainForCorpID
+	oldLoadIdentity := tokenLoadKeychainIdentity
 	oldLoadLegacy := tokenLoadKeychain
 	oldExists := tokenKeychainExists
 	oldDeleteCorp := tokenDeleteKeychainForCorpID
+	oldDeleteIdentity := tokenDeleteKeychainIdentity
 	oldDeleteLegacy := tokenDeleteKeychain
+	oldRemoveAuthEntries := tokenRemoveAuthTokenEntries
 	oldLoadSecure := tokenLoadSecure
 	oldDeleteSecure := tokenDeleteSecure
+	oldEnsureProfiles := profilesEnsureMigration
 	oldResolve := tokenResolveProfile
+	oldResolveDeletion := tokenResolveDeletion
+	oldResolveSelection := tokenResolveSelection
 	oldUpsert := tokenUpsertProfile
 	oldRemoveProfile := tokenRemoveProfile
 	oldSync := tokenSyncLegacyMirror
+	oldSyncOrganization := tokenSyncOrganizationMirror
 	oldLoadProfiles := tokenLoadProfiles
+	oldSaveProfiles := tokenSaveProfiles
 	oldWriteMarker := tokenWriteMarker
+	oldWriteManualMarker := tokenWriteManualMarker
 	oldDeleteMarker := tokenDeleteMarker
 	oldParseURL := tokenParseURL
 	oldNewRequest := tokenNewRequest
 	oldDefaultDir := tokenDefaultConfigDir
 	oldLoadData := tokenLoadData
 	oldRevokeURL := tokenRevokeURL
+	oldMCPBaseURL := tokenMCPBaseURL
 	oldLogoutURL := tokenLogoutURL
 	oldLogoutContinue := tokenLogoutContinueURL
 	oldLogoutClient := tokenLogoutHTTPClient
@@ -1477,31 +1501,43 @@ func TestCrossPlatformCoverageTokenStorageAndRevocationCoverageEdges(t *testing.
 		tokenJSONMarshalIndent = oldMarshalIndent
 		tokenJSONMarshal = oldMarshal
 		tokenMkdirAll = oldMkdir
+		tokenReadFile = oldRead
 		tokenWriteFile = oldWrite
 		tokenRename = oldRename
 		tokenRemove = oldRemove
 		tokenGlob = oldGlob
 		tokenSaveKeychainForCorpID = oldSaveCorp
+		tokenSaveKeychainForIdentity = oldSaveIdentity
 		tokenSaveKeychain = oldSaveLegacy
 		tokenLoadKeychainForCorpID = oldLoadCorp
+		tokenLoadKeychainIdentity = oldLoadIdentity
 		tokenLoadKeychain = oldLoadLegacy
 		tokenKeychainExists = oldExists
 		tokenDeleteKeychainForCorpID = oldDeleteCorp
+		tokenDeleteKeychainIdentity = oldDeleteIdentity
 		tokenDeleteKeychain = oldDeleteLegacy
+		tokenRemoveAuthTokenEntries = oldRemoveAuthEntries
 		tokenLoadSecure = oldLoadSecure
 		tokenDeleteSecure = oldDeleteSecure
+		profilesEnsureMigration = oldEnsureProfiles
 		tokenResolveProfile = oldResolve
+		tokenResolveDeletion = oldResolveDeletion
+		tokenResolveSelection = oldResolveSelection
 		tokenUpsertProfile = oldUpsert
 		tokenRemoveProfile = oldRemoveProfile
 		tokenSyncLegacyMirror = oldSync
+		tokenSyncOrganizationMirror = oldSyncOrganization
 		tokenLoadProfiles = oldLoadProfiles
+		tokenSaveProfiles = oldSaveProfiles
 		tokenWriteMarker = oldWriteMarker
+		tokenWriteManualMarker = oldWriteManualMarker
 		tokenDeleteMarker = oldDeleteMarker
 		tokenParseURL = oldParseURL
 		tokenNewRequest = oldNewRequest
 		tokenDefaultConfigDir = oldDefaultDir
 		tokenLoadData = oldLoadData
 		tokenRevokeURL = oldRevokeURL
+		tokenMCPBaseURL = oldMCPBaseURL
 		tokenLogoutURL = oldLogoutURL
 		tokenLogoutContinueURL = oldLogoutContinue
 		tokenLogoutHTTPClient = oldLogoutClient
@@ -1566,10 +1602,12 @@ func TestCrossPlatformCoverageTokenStorageAndRevocationCoverageEdges(t *testing.
 			t.Fatalf("corp marker error = %v", err)
 		}
 		SetRuntimeProfile("")
+		tokenWriteManualMarker = func(string) error { return fail }
 		if err := saveTokenDataLocked(dir, &TokenData{}); !errors.Is(err, fail) {
 			t.Fatalf("legacy marker error = %v", err)
 		}
 		tokenWriteMarker = oldWriteMarker
+		tokenWriteManualMarker = oldWriteManualMarker
 
 		edition.Override(&edition.Hooks{Name: "coverage", SaveToken: func(string, []byte) error { return nil }})
 		if err := saveTokenDataLocked(dir, data); err != nil {
@@ -1624,6 +1662,9 @@ func TestCrossPlatformCoverageTokenStorageAndRevocationCoverageEdges(t *testing.
 			t.Fatalf("failed migration load = %#v %v", got, err)
 		}
 		tokenSaveKeychain = func(*TokenData) error { return nil }
+		tokenLoadKeychain = func() (*TokenData, error) { return nil, ErrTokenDataNotFound }
+		tokenReadFile = func(string) ([]byte, error) { return nil, os.ErrNotExist }
+		tokenWriteManualMarker = func(string) error { return nil }
 		deleted := false
 		tokenDeleteSecure = func(string) error { deleted = true; return nil }
 		if _, err := LoadTokenDataForProfile(dir, ""); err != nil || !deleted {
@@ -1647,25 +1688,70 @@ func TestCrossPlatformCoverageTokenStorageAndRevocationCoverageEdges(t *testing.
 	t.Run("delete branches", func(t *testing.T) {
 		dir := t.TempDir()
 		fail := errors.New("fail")
-		selected := &Profile{CorpID: "corp"}
-		tokenResolveProfile = func(string, string) (*Profile, error) { return nil, fail }
+		selected := &Profile{CorpID: "corp", UserID: "user"}
+		profilesEnsureMigration = func(string) error { return fail }
+		if err := deleteTokenDataForProfileLocked(dir, ""); !errors.Is(err, fail) {
+			t.Fatalf("delete migration error = %v", err)
+		}
+		profilesEnsureMigration = func(string) error { return nil }
+		tokenLoadProfiles = func(string) (*ProfilesConfig, error) { return nil, fail }
+		if err := deleteTokenDataForProfileLocked(dir, ""); !errors.Is(err, fail) {
+			t.Fatalf("delete profiles load error = %v", err)
+		}
+		cfg := &ProfilesConfig{
+			CurrentProfile:     ProfileSelector(*selected),
+			OrgCurrentProfiles: map[string]string{"corp": ProfileSelector(*selected)},
+			Profiles:           []Profile{*selected},
+		}
+		tokenLoadProfiles = func(string) (*ProfilesConfig, error) { return cfg, nil }
+		tokenResolveDeletion = func(*ProfilesConfig, string) (*Profile, bool, error) { return nil, false, fail }
 		if err := deleteTokenDataForProfileLocked(dir, ""); !errors.Is(err, fail) {
 			t.Fatalf("delete resolution error = %v", err)
 		}
-		tokenResolveProfile = func(string, string) (*Profile, error) { return selected, nil }
-		tokenDeleteKeychainForCorpID = func(string) error { return fail }
+		tokenResolveDeletion = func(*ProfilesConfig, string) (*Profile, bool, error) { return selected, true, nil }
+		tokenLoadKeychainIdentity = func(string, string) (*TokenData, error) {
+			return &TokenData{CorpID: "corp", UserID: "user"}, nil
+		}
+		tokenLoadKeychainForCorpID = func(string) (*TokenData, error) {
+			return &TokenData{CorpID: "corp", UserID: "user"}, nil
+		}
+		tokenLoadKeychain = func() (*TokenData, error) {
+			return &TokenData{CorpID: "corp", UserID: "user"}, nil
+		}
+		tokenReadFile = func(string) ([]byte, error) { return nil, os.ErrNotExist }
+		tokenSaveProfiles = func(string, *ProfilesConfig) error { return nil }
+		tokenSaveKeychainForIdentity = func(string, string, *TokenData) error { return nil }
+		tokenSaveKeychainForCorpID = func(string, *TokenData) error { return nil }
+		tokenSaveKeychain = func(*TokenData) error { return nil }
+		tokenWriteMarker = func(string) error { return nil }
+		tokenDeleteMarker = func(string) error { return nil }
 		tokenRemoveProfile = func(string, string) (*Profile, error) { return selected, nil }
 		tokenSyncLegacyMirror = func(string) error { return nil }
+		tokenSyncOrganizationMirror = func(Profile) error { return nil }
 		tokenDeleteSecure = func(string) error { return nil }
+		tokenDeleteKeychainForCorpID = func(string) error { return nil }
+		tokenDeleteKeychainIdentity = func(string, string) error { return fail }
+		if err := deleteTokenDataForProfileLocked(dir, ""); !errors.Is(err, fail) {
+			t.Fatalf("delete identity keychain error = %v", err)
+		}
+		tokenDeleteKeychainIdentity = func(string, string) error { return nil }
+		cfg.OrgCurrentProfiles = map[string]string{"corp": ProfileSelector(*selected)}
+		tokenRemoveProfile = func(string, string) (*Profile, error) {
+			cfg.OrgCurrentProfiles = nil
+			return selected, nil
+		}
+		tokenDeleteKeychainForCorpID = func(string) error { return fail }
 		if err := deleteTokenDataForProfileLocked(dir, ""); !errors.Is(err, fail) {
 			t.Fatalf("delete corp keychain error = %v", err)
 		}
 		tokenDeleteKeychainForCorpID = func(string) error { return nil }
+		cfg.OrgCurrentProfiles = map[string]string{"corp": ProfileSelector(*selected)}
 		tokenRemoveProfile = func(string, string) (*Profile, error) { return nil, fail }
 		if err := deleteTokenDataForProfileLocked(dir, ""); !errors.Is(err, fail) {
 			t.Fatalf("remove profile error = %v", err)
 		}
 		tokenRemoveProfile = func(string, string) (*Profile, error) { return selected, nil }
+		cfg.OrgCurrentProfiles = nil
 		tokenSyncLegacyMirror = func(string) error { return fail }
 		if err := deleteTokenDataForProfileLocked(dir, ""); !errors.Is(err, fail) {
 			t.Fatalf("sync mirror error = %v", err)
@@ -1676,7 +1762,8 @@ func TestCrossPlatformCoverageTokenStorageAndRevocationCoverageEdges(t *testing.
 			t.Fatalf("secure cleanup error = %v", err)
 		}
 
-		tokenResolveProfile = func(string, string) (*Profile, error) { return nil, nil }
+		cfg.CurrentProfile = ""
+		cfg.Profiles = nil
 		tokenDeleteKeychain = func() error { return fail }
 		tokenDeleteMarker = func(string) error { return nil }
 		if err := deleteTokenDataForProfileLocked(dir, ""); !errors.Is(err, fail) {
@@ -1704,22 +1791,17 @@ func TestCrossPlatformCoverageTokenStorageAndRevocationCoverageEdges(t *testing.
 	t.Run("delete all", func(t *testing.T) {
 		fail := errors.New("fail")
 		base := func() string {
-			tokenLoadProfiles = func(string) (*ProfilesConfig, error) { return &ProfilesConfig{}, nil }
-			tokenDeleteKeychainForCorpID = func(string) error { return nil }
+			tokenRemoveAuthTokenEntries = func(string) error { return nil }
 			tokenRemove = func(string) error { return os.ErrNotExist }
 			tokenGlob = func(string) ([]string, error) { return nil, nil }
-			tokenDeleteKeychain = func() error { return nil }
 			tokenDeleteSecure = func(string) error { return nil }
 			tokenDeleteMarker = func(string) error { return nil }
 			return t.TempDir()
 		}
 		dir := base()
-		tokenLoadProfiles = func(string) (*ProfilesConfig, error) {
-			return &ProfilesConfig{Profiles: []Profile{{CorpID: "corp"}}}, nil
-		}
-		tokenDeleteKeychainForCorpID = func(string) error { return fail }
+		tokenRemoveAuthTokenEntries = func(string) error { return fail }
 		if err := DeleteAllTokenData(dir); !errors.Is(err, fail) {
-			t.Fatalf("delete-all corp error = %v", err)
+			t.Fatalf("delete-all auth namespace error = %v", err)
 		}
 		dir = base()
 		tokenRemove = func(string) error { return fail }
@@ -1739,11 +1821,6 @@ func TestCrossPlatformCoverageTokenStorageAndRevocationCoverageEdges(t *testing.
 			t.Fatalf("delete-all quarantine error = %v", err)
 		}
 		dir = base()
-		tokenDeleteKeychain = func() error { return fail }
-		if err := DeleteAllTokenData(dir); !errors.Is(err, fail) {
-			t.Fatalf("delete-all legacy keychain error = %v", err)
-		}
-		dir = base()
 		tokenDeleteSecure = func(string) error { return fail }
 		if err := DeleteAllTokenData(dir); !errors.Is(err, fail) {
 			t.Fatalf("delete-all secure error = %v", err)
@@ -1759,6 +1836,9 @@ func TestCrossPlatformCoverageTokenStorageAndRevocationCoverageEdges(t *testing.
 		resetClientIDFromMCP()
 		SetClientID("client")
 		fail := errors.New("fail")
+		tokenLoadData = func(string) (*TokenData, error) {
+			return &TokenData{AccessToken: "access", ClientID: "client", Source: "direct"}, nil
+		}
 		tokenParseURL = func(string) (*url.URL, error) { return nil, fail }
 		if err := RevokeTokenRemote(context.Background()); !errors.Is(err, fail) {
 			t.Fatalf("logout parse error = %v", err)
@@ -1791,16 +1871,14 @@ func TestCrossPlatformCoverageTokenStorageAndRevocationCoverageEdges(t *testing.
 		}
 
 		SetClientIDFromMCP("mcp-client")
-		tokenRevokeURL = func() string { return "" }
-		if err := RevokeTokenRemote(context.Background()); err != nil {
-			t.Fatal(err)
-		}
-		tokenRevokeURL = func() string { return "https://revoke.test" }
 		tokenLoadData = func(string) (*TokenData, error) { return nil, fail }
 		if err := RevokeTokenRemote(context.Background()); err != nil {
 			t.Fatal("missing token revoke should be a no-op")
 		}
-		tokenLoadData = func(string) (*TokenData, error) { return &TokenData{AccessToken: "access"}, nil }
+		tokenMCPBaseURL = func() string { return "https://revoke.test" }
+		tokenLoadData = func(string) (*TokenData, error) {
+			return &TokenData{AccessToken: "access", ClientID: "mcp-client", Source: "mcp"}, nil
+		}
 		tokenJSONMarshal = func(any) ([]byte, error) { return nil, fail }
 		if err := RevokeTokenRemote(context.Background()); !errors.Is(err, fail) {
 			t.Fatalf("revoke marshal error = %v", err)
@@ -2201,8 +2279,8 @@ func TestCrossPlatformCoverageProfilesCoverageEdges(t *testing.T) {
 	}
 	primaryOnly := &ProfilesConfig{PrimaryProfile: "primary", Profiles: []Profile{{Name: "primary", CorpID: "primary"}}}
 	profilesLoad = func(string) (*ProfilesConfig, error) { return primaryOnly, nil }
-	if got, err := ResolveProfile(dir, ""); err != nil || got == nil || got.CorpID != "primary" {
-		t.Fatalf("primary profile resolution = %#v %v", got, err)
+	if got, err := ResolveProfile(dir, ""); err != nil || got != nil {
+		t.Fatalf("primary-only profile resolution = %#v %v", got, err)
 	}
 	profilesLoad = func(string) (*ProfilesConfig, error) { return &ProfilesConfig{}, nil }
 	if got, err := ResolveProfile(dir, ""); err != nil || got != nil {
@@ -2216,8 +2294,8 @@ func TestCrossPlatformCoverageProfilesCoverageEdges(t *testing.T) {
 	}
 	cfgNoCurrent := &ProfilesConfig{PrimaryProfile: "primary", Profiles: []Profile{{CorpID: "primary"}}}
 	profilesLoad = func(string) (*ProfilesConfig, error) { return cfgNoCurrent, nil }
-	if got, err := resolveProfileForLoad(dir, ""); err != nil || got == nil || got.CorpID != "primary" {
-		t.Fatalf("profile-for-load primary fallback = %#v %v", got, err)
+	if got, err := resolveProfileForLoad(dir, ""); err != nil || got != nil {
+		t.Fatalf("profile-for-load primary-only result = %#v %v", got, err)
 	}
 
 	profilesLoad = func(string) (*ProfilesConfig, error) { return cfg, nil }
@@ -2236,6 +2314,10 @@ func TestCrossPlatformCoverageProfilesCoverageEdges(t *testing.T) {
 		Profiles: []Profile{{Name: "primary", CorpID: "primary"}, {Name: "current", CorpID: "current"}, {Name: "previous", CorpID: "previous"}},
 	}
 	profilesSave = func(string, *ProfilesConfig) error { return nil }
+	profilesLoadCorp = func(corpID string) (*TokenData, error) {
+		return &TokenData{CorpID: corpID, AccessToken: "x"}, nil
+	}
+	profilesSaveCorp = func(string, *TokenData) error { return nil }
 	profilesSyncLegacyMirror = func(string) error { return fail }
 	if _, err := setCurrentProfileLocked(dir, "current"); !errors.Is(err, fail) {
 		t.Fatalf("set-current mirror error = %v", err)
@@ -2263,9 +2345,13 @@ func TestCrossPlatformCoverageProfilesCoverageEdges(t *testing.T) {
 	deletedLegacy, deletedMarker := false, false
 	profilesDeleteLegacy = func() error { deletedLegacy = true; return fail }
 	profilesDeleteMarker = func(string) error { deletedMarker = true; return fail }
-	if err := syncLegacyTokenMirrorLocked(dir); err != nil || !deletedLegacy || !deletedMarker {
+	if err := syncLegacyTokenMirrorLocked(dir); !errors.Is(err, fail) || !deletedLegacy || deletedMarker {
 		t.Fatalf("empty mirror cleanup = %v %v %v", err, deletedLegacy, deletedMarker)
 	}
+	profilesDeleteLegacy = func() error { return nil }
+	if err := syncLegacyTokenMirrorLocked(dir); !errors.Is(err, fail) || !deletedMarker {
+		t.Fatalf("empty mirror marker cleanup = %v %v", err, deletedMarker)
+	}
 
 	normalizeProfilesConfig(nil)
 }
@@ -2905,3 +2991,181 @@ func TestCrossPlatformCoverageDeviceFlowHighLevelCoverageEdges(t *testing.T) {
 	}
 	dfPrintBox(io.Discard, []string{"short"})
 }
+
+func TestCrossPlatformCoverageMultiAccountSelectorAndIdentityLoadEdges(t *testing.T) {
+	cfg := &ProfilesConfig{
+		Profiles: []Profile{
+			{Name: "local-a", CorpID: "corp-a", CorpName: "Shared", UserID: "u1", UserName: "Alice"},
+			{Name: "duplicate", CorpID: "corp-a", CorpName: "Shared", UserID: "u2", UserName: "Alice"},
+			{Name: "duplicate", CorpID: "corp-b", CorpName: "Shared", UserID: "u3", UserName: "Bob"},
+			{Name: "solo", CorpID: "corp-c", CorpName: "Solo", UserID: "u4", UserName: "Carol"},
+		},
+	}
+
+	for _, tc := range []struct {
+		selector string
+		wantErr  bool
+	}{
+		{"", true},
+		{"missing:u1", true},
+		{"Shared:u1", true},
+		{"corp-a:u1", false},
+		{"corp-a:Alice", true},
+		{"corp-a:missing", true},
+		{"corp-a", true},
+		{"corp-c", false},
+		{"Solo", false},
+		{"local-a", false},
+		{"duplicate", true},
+		{"missing", true},
+	} {
+		_, _, err := resolveProfileSelection("", cfg, tc.selector)
+		if (err != nil) != tc.wantErr {
+			t.Fatalf("resolveProfileSelection(%q) error = %v", tc.selector, err)
+		}
+	}
+	if _, _, err := resolveProfileSelection("", nil, "x"); err == nil {
+		t.Fatal("nil profile config selection succeeded")
+	}
+	cfg.OrgCurrentProfiles = map[string]string{"corp-a": "corp-a:u2"}
+	if got, _, err := resolveProfileSelection("", cfg, "corp-a"); err != nil || got.UserID != "u2" {
+		t.Fatalf("organization current selection = %#v %v", got, err)
+	}
+
+	for _, tc := range []struct {
+		selector string
+		wantErr  bool
+		exact    bool
+	}{
+		{"", true, false},
+		{"corp-a:u1", false, true},
+		{"corp-a", false, false},
+		{"Solo", false, false},
+		{"local-a", false, true},
+		{"duplicate", true, true},
+		{"missing", true, false},
+	} {
+		_, exact, err := resolveProfileDeletionSelection(cfg, tc.selector)
+		if (err != nil) != tc.wantErr || (!tc.wantErr && exact != tc.exact) {
+			t.Fatalf("resolveProfileDeletionSelection(%q) = exact %v, %v", tc.selector, exact, err)
+		}
+	}
+	if _, _, err := resolveProfileDeletionSelection(nil, "x"); err == nil {
+		t.Fatal("nil deletion config succeeded")
+	}
+
+	for _, selector := range []string{"", "corp-a", "missing", "Solo", "Shared"} {
+		_, _ = resolveOrganizationCorpID(cfg, selector)
+	}
+	if got, err := resolveOrganizationCorpID(nil, "x"); err != nil || got != "" {
+		t.Fatalf("nil organization resolution = %q %v", got, err)
+	}
+	if _, _, err := resolveOrganizationDefault(cfg, "missing", "missing", nil); err == nil {
+		t.Fatal("empty organization default succeeded")
+	}
+	if got, _, err := resolveOrganizationDefault(cfg, "corp-c", "Solo", profilesForCorpID(cfg, "corp-c")); err != nil || got.UserID != "u4" {
+		t.Fatalf("single account organization default = %#v %v", got, err)
+	}
+	if _, _, err := resolveOrganizationDefault(&ProfilesConfig{}, "corp-a", "corp-a", profilesForCorpID(cfg, "corp-a")); err == nil {
+		t.Fatal("ambiguous organization default succeeded")
+	}
+	if got := profileSelectorCandidates([]*Profile{nil, &cfg.Profiles[1], &cfg.Profiles[0]}); len(got) != 2 || got[0] != "corp-a:u1" {
+		t.Fatalf("selector candidates = %#v", got)
+	}
+	for selector, want := range map[string]bool{
+		"":                   false,
+		"corp-a:u1":          true,
+		"Shared:Bob":         true,
+		"corp-c":             true,
+		"local-a":            true,
+		"definitely-missing": false,
+	} {
+		if got := profileSelectorReferenceExists(cfg, selector); got != want {
+			t.Fatalf("profileSelectorReferenceExists(%q) = %v", selector, got)
+		}
+	}
+	if profileSelectorReferenceExists(nil, "corp-a") {
+		t.Fatal("nil profile selector reference exists")
+	}
+
+	oldAcquire := profilesAcquireDualLock
+	oldEnsure := profilesEnsureMigration
+	oldLoad := profilesLoad
+	t.Cleanup(func() {
+		profilesAcquireDualLock = oldAcquire
+		profilesEnsureMigration = oldEnsure
+		profilesLoad = oldLoad
+	})
+	profilesAcquireDualLock = func(context.Context, string) (*DualLock, error) { return &DualLock{}, nil }
+	profilesEnsureMigration = func(string) error { return nil }
+	profilesLoad = func(string) (*ProfilesConfig, error) { return cfg, nil }
+	if got, exact, err := ResolveProfileDeletionScope("cfg", "corp-a:u1"); err != nil || !exact || got.UserID != "u1" {
+		t.Fatalf("deletion scope = %#v %v %v", got, exact, err)
+	}
+	profilesEnsureMigration = func(string) error { return errors.New("migration") }
+	if _, _, err := ResolveProfileDeletionScope("cfg", "corp-a"); err == nil {
+		t.Fatal("deletion scope migration failure succeeded")
+	}
+	profilesEnsureMigration = func(string) error { return nil }
+	profilesLoad = func(string) (*ProfilesConfig, error) { return nil, errors.New("load") }
+	if _, _, err := ResolveProfileDeletionScope("cfg", "corp-a"); err == nil {
+		t.Fatal("deletion scope load failure succeeded")
+	}
+
+	oldLoadIdentity := profilesLoadIdentity
+	oldLoadCorp := profilesLoadCorp
+	oldSaveIdentity := profilesSaveIdentity
+	t.Cleanup(func() {
+		profilesLoadIdentity = oldLoadIdentity
+		profilesLoadCorp = oldLoadCorp
+		profilesSaveIdentity = oldSaveIdentity
+	})
+	profile := Profile{CorpID: "corp-a", UserID: "u1"}
+	profilesLoadIdentity = func(string, string) (*TokenData, error) { return &TokenData{AccessToken: "identity"}, nil }
+	if got, err := loadTokenForProfileIdentity(profile); err != nil || got.AccessToken != "identity" {
+		t.Fatalf("identity token load = %#v %v", got, err)
+	}
+	fail := errors.New("fail")
+	profilesLoadIdentity = func(string, string) (*TokenData, error) { return nil, fail }
+	if _, err := loadTokenForProfileIdentity(profile); !errors.Is(err, fail) {
+		t.Fatalf("identity load failure = %v", err)
+	}
+	profilesLoadIdentity = func(string, string) (*TokenData, error) { return nil, ErrTokenDataNotFound }
+	profilesLoadCorp = func(string) (*TokenData, error) { return nil, ErrTokenDataNotFound }
+	if _, err := loadTokenForProfileIdentity(profile); !errors.Is(err, ErrTokenDataNotFound) {
+		t.Fatalf("missing organization mirror = %v", err)
+	}
+	profilesLoadCorp = func(string) (*TokenData, error) { return nil, fail }
+	if _, err := loadTokenForProfileIdentity(profile); !errors.Is(err, fail) {
+		t.Fatalf("organization mirror failure = %v", err)
+	}
+	for _, data := range []*TokenData{
+		{CorpID: "corp-a"},
+		{CorpID: "corp-a", UserID: "other"},
+	} {
+		profilesLoadCorp = func(string) (*TokenData, error) { return data, nil }
+		if _, err := loadTokenForProfileIdentity(profile); err == nil {
+			t.Fatalf("invalid organization mirror %#v succeeded", data)
+		}
+	}
+	profilesLoadCorp = func(string) (*TokenData, error) {
+		return &TokenData{CorpID: "corp-a", UserID: "u1", AccessToken: "mirror"}, nil
+	}
+	profilesSaveIdentity = func(string, string, *TokenData) error { return fail }
+	if _, err := loadTokenForProfileIdentity(profile); !errors.Is(err, fail) {
+		t.Fatalf("identity repair save failure = %v", err)
+	}
+	profilesSaveIdentity = func(string, string, *TokenData) error { return nil }
+	if got, err := loadTokenForProfileIdentity(profile); err != nil || got.AccessToken != "mirror" {
+		t.Fatalf("identity repair = %#v %v", got, err)
+	}
+	if _, err := loadTokenForProfileIdentity(Profile{CorpID: "corp-a"}); err == nil {
+		t.Fatal("unresolved profile loaded organization token owned by an exact identity")
+	}
+	profilesLoadCorp = func(string) (*TokenData, error) {
+		return &TokenData{CorpID: "corp-a", AccessToken: "organization"}, nil
+	}
+	if got, err := loadTokenForProfileIdentity(Profile{CorpID: "corp-a"}); err != nil || got.AccessToken != "organization" {
+		t.Fatalf("organization-only token load = %#v %v", got, err)
+	}
+}