dingtalk-profile

DingTalk multi-organization / profile Skill

🧪 EXPERIMENTAL · Experimental version / Preview — multi mode currently does not meet the stable standard; the interface, naming, and cross-skill references may be adjusted later. For production / shared environments, please prefer mono mode (dws skill setup --mode mono）。

PREREQUISITE: Read the dws-shared skill first for auth, global flags, product routing, URL preflight, error codes, and safety rules. The dws binary must be on PATH.

dws can log in to multiple DingTalk accounts at the same time, and the same organization can also retain multiple accounts. One profile = one corpId + userId identity; the current profile determines which identity is injected for this command.

Trigger conditions (use this skill if any one is hit)

• Explicit: the user mentions switching / changing / cross-organization, another DingTalk, another company, see which organizations are logged in, which organization is current, a certain person / group / data is in another organization
• Implicit (most common, easily missed): reading / searching in the current organization did not find the target (group / person / data), and dws profile list after deduplication shows ≥2 organizations logged in — do not rush to conclude "does not exist"; follow the cross-organization iron rules below to search in other organizations
• Need to aggregate / compare data across multiple organizations
• The user asks about authentication status / which organizations or accounts are logged in / which account is current

Does not trigger: when only 1 organization is logged in, handle it normally according to the current organization, without --profile。

Command

• dws profile list --format json — lists all accounts by default;profile is a stable selector corpId:userId, Token status is read live and not refreshed
• dws profile switch <selector|-> — persistently switches accounts;- switches back to the previous one
• Global --profile <selector> — specifies the identity for a single time, without changing the current profile
• dws auth login — a new account adds a new profile; re-login of the same corpId + userId only refreshes that account
• dws auth status [--profile <selector>] — views and refreshes the specified identity as needed; if refresh fails, returns unauthenticated and the real reason

selector supports corpId:userId、corpId:userName、corpName:userId、corpName:userName, and is also compatible with a standalone corpId, a unique corpName, and a local profile name. The name is only used for input; when there are duplicate names, you must switch to the stable profile list returned in the error candidates corpId:userId。

When only an organization is passed, there must be a unique isOrgCurrent=true account. If a multi-account organization has no default account, first ask the user to specify an account; it is forbidden to choose the first item, the most recently logged-in, or the most recently used account.primaryProfile/isPrimary is only for compatible output and does not participate in selection.

Cross-organization iron rules (must be executed, must not be skipped)

"Find group / find person / find data" (chat search, aisearch / contact, doc / wiki search and other read / search scenarios) did not hit in the current organization, and dws profile list according to corpId after deduplication shows ≥2 organizations, then search once in each organization using the isOrgCurrent=true of the unique profile item; use it if hit, and only ask the user after all organizations do not have it. If a multi-account organization has no default account, first ask the user. It is forbidden to repeatedly treat multiple accounts of the same organization as multiple organizations.

Cross-organization aggregation (agent orchestration, no built-in --all-orgs)

① dws profile list --format json group by corpId → ② for each group, take the stable isOrgCurrent=true of the unique profile; if none, ask the user → ③ retrieve data once for each stable profile → ④ merge and annotate the source organization and account.

Security guardrails (must be followed)

• Only when dws profile list deduplicated by corpId shows ≥2 organizations is cross-organization logic enabled; multiple accounts in the same organization do not count as multiple organizations.
• Automatic cross-organization applies only to "read / search". Operations such as write / send / delete / recall are by default performed only in the current organization; if --profile really needs to be carried for cross-organization writes, the target organization must first be confirmed with the user.
• Persistently switching dws profile switch(changing the default organization) is treated as a write operation: it must not be executed without the user's explicit request. For cross-organization data lookup, always use one-time --profile, without changing the current organization.
• dws auth logout logs out all accounts by default; the organization selector logs out all accounts in that organization; the precise selector or local profile name logs out only one account. The target scope must be confirmed before execution.