@lesliechan721/aw 0.1.0-beta.10 → 0.1.0-beta.11

package/dist/src/utils/plugin-config-write.js

@@ -7,6 +7,7 @@ import { assertReadyPluginConfigStore, assertSafePluginConfigSegment, codexNativ
 import { collectSensitivePluginConfigValues, redactPluginScriptOutput, } from './plugin-scripts.js';
 import { resolveClaudeProjectKey, resolveCodexProjectKey } from './paths.js';
 import { withAwHomeMutationLock, } from './aw-home-mutation-lock.js';
+import { assertProjectSharedConfigPathVisible, } from './project-boundary.js';
 export function buildConfigMutationReceipt(command, receipt) {
     return {
         ...receipt,
@@ -14,6 +15,60 @@ export function buildConfigMutationReceipt(command, receipt) {
         command,
     };
 }
+function publicConfigApplyTargetResult(result) {
+    return {
+        target: {
+            pluginName: result.target.pluginName,
+            ...(result.target.pluginId ? { pluginId: result.target.pluginId } : {}),
+            platform: result.target.platform,
+            scope: result.target.scope,
+        },
+        action: result.action,
+        state: result.state,
+        ...(result.message ? { message: result.message } : {}),
+        ...(result.errorCode ? { errorCode: result.errorCode } : {}),
+        ...(result.relation ? { relation: result.relation } : {}),
+        ...(result.requiredBy ? { requiredBy: result.requiredBy } : {}),
+    };
+}
+function publicConfigApplyResult(apply) {
+    if (apply.state === 'skipped')
+        return apply;
+    return {
+        ...apply,
+        targetResults: apply.targetResults.map(publicConfigApplyTargetResult),
+    };
+}
+export function configWriteStateForError(error) {
+    return error?.configWrite === 'failed'
+        ? 'failed'
+        : 'notStarted';
+}
+function markConfigWriteFailed(error) {
+    const failure = error instanceof Error ? error : new Error(String(error));
+    return Object.assign(failure, { configWrite: 'failed' });
+}
+function skippedApply(reason) {
+    return { state: 'skipped', reason, targetResults: [] };
+}
+function unavailableApply(reason, stage, targetResults = []) {
+    const messages = {
+        invalidConfig: 'The effective config is invalid for every visible target.',
+        schemaUnavailable: 'The config schema is unavailable after the config commit.',
+        sourceUnavailable: 'The plugin source is unavailable after the config commit.',
+        effectiveConfigUnavailable: 'The effective config cannot be read after the config commit.',
+        targetDiscoveryFailed: 'Visible config apply targets cannot be discovered after the config commit.',
+    };
+    return {
+        state: 'unavailable',
+        reason,
+        targetResults,
+        error: { stage, code: reason, message: messages[reason] },
+    };
+}
+function overallStateForApply(apply) {
+    return apply.state === 'succeeded' || apply.state === 'skipped' ? 'succeeded' : 'partial';
+}
 function uniqueInOrder(values) {
     return [...new Set(values)];
 }
@@ -91,6 +146,9 @@ async function reinstallVisibleTargets(options) {
         : { targets: dedupeTargets(options.applyTargets), failures: [] });
     const targetResults = [...discovered.failures];
     let runtimeFailed = discovered.failures.length > 0;
+    let invalidTargets = 0;
+    let unavailableTargets = 0;
+    const errors = [];
     const reinstall = options.reinstallCommandImpl ?? syncWriteCommand;
     if (options.plugin.sourceId && !options.plugin.pluginId) {
         throw new Error(`Plugin "${options.plugin.manifest.name}" is missing its namespaced plugin ID.`);
@@ -105,6 +163,7 @@ async function reinstallVisibleTargets(options) {
                 ...(options.plugin.sourceId ? {
                     sourceId: options.plugin.sourceId,
                     sourceIdentity: options.plugin.sourceIdentity,
+                    logicalIdentity: options.plugin.catalogLogicalIdentity,
                 } : {}),
                 pluginName: options.plugin.manifest.name,
                 manifest: options.plugin.manifest,
@@ -118,6 +177,10 @@ async function reinstallVisibleTargets(options) {
             // Generic credential redaction and known config paths still apply.
         }
         let sanitized = redactPluginScriptOutput(message, sensitiveValues);
+        for (const privatePath of [target.projectKey, options.cwd]) {
+            if (privatePath)
+                sanitized = sanitized.split(privatePath).join('<project>');
+        }
         for (const scope of ['user', 'project']) {
             const configPath = resolvePluginConfigStorePath({
                 sourceId: options.plugin.sourceId,
@@ -151,6 +214,48 @@ async function reinstallVisibleTargets(options) {
         ])));
     };
     for (const target of discovered.targets) {
+        try {
+            const effective = await resolveEffectivePluginConfig({
+                ...(options.plugin.sourceId ? {
+                    sourceId: options.plugin.sourceId,
+                    sourceIdentity: options.plugin.sourceIdentity,
+                    logicalIdentity: options.plugin.catalogLogicalIdentity,
+                } : {}),
+                pluginName: options.plugin.manifest.name,
+                manifest: options.plugin.manifest,
+                targetScope: target.scope,
+                cwd: options.cwd,
+                env: options.env,
+            });
+            if (effective.issues.length > 0) {
+                invalidTargets += 1;
+                targetResults.push({
+                    target,
+                    action: 'reinstall',
+                    state: 'skipped',
+                    errorCode: 'invalidConfig',
+                    message: 'The effective config is invalid for this target.',
+                });
+                continue;
+            }
+        }
+        catch {
+            runtimeFailed = true;
+            unavailableTargets += 1;
+            targetResults.push({
+                target,
+                action: 'reinstall',
+                state: 'failed',
+                errorCode: 'effectiveConfigUnavailable',
+                message: 'The effective config cannot be read for this target.',
+            });
+            errors.push({
+                stage: 'targetValidation',
+                code: 'effectiveConfigUnavailable',
+                message: 'The effective config cannot be read for a visible target.',
+            });
+            continue;
+        }
         try {
             const debugLogger = options.rebuildRuntime?.debugLogger;
             const reporter = options.rebuildRuntime?.reporter;
@@ -158,6 +263,10 @@ async function reinstallVisibleTargets(options) {
                 cwd: options.cwd,
                 platform: target.platform,
                 scope: target.scope,
+                yes: true,
+                ...(options.rebuildRuntime?.scriptTimeoutMs === undefined
+                    ? {}
+                    : { scriptTimeoutMs: options.rebuildRuntime.scriptTimeoutMs }),
             }, {
                 ...options.rebuildRuntime,
                 env: options.env,
@@ -175,10 +284,12 @@ async function reinstallVisibleTargets(options) {
                     },
                 } : {}),
             });
-            if (result.overallState === 'failed')
+            options.rebuildRuntime?.operationDiagnosticSink?.(result.rebuildResults);
+            if (result.overallState !== 'succeeded')
                 runtimeFailed = true;
             targetResults.push(...await Promise.all(result.targetResults.map(async (entry) => ({
                 ...entry,
+                state: entry.action === 'skipped' ? 'skipped' : entry.state,
                 ...(entry.message ? { message: await sanitizeFailure(entry.message, entry.target) } : {}),
             }))));
         }
@@ -191,17 +302,33 @@ async function reinstallVisibleTargets(options) {
                 state: 'failed',
                 message,
             });
+            errors.push({
+                stage: 'apply',
+                code: 'targetApplyFailed',
+                message: 'A visible config apply target failed.',
+            });
         }
     }
-    const overallState = runtimeFailed || targetResults.some((entry) => entry.state === 'failed')
-        ? 'partial' : 'succeeded';
-    return {
-        overallState,
-        targetResults,
-        ...(discovered.targets.length === 0 && discovered.failures.length === 0
-            ? { applySkippedReason: 'noVisibleTarget' }
-            : {}),
-    };
+    if (discovered.targets.length === 0 && discovered.failures.length === 0) {
+        return skippedApply('noVisibleTarget');
+    }
+    if (discovered.targets.length > 0 && invalidTargets === discovered.targets.length) {
+        return unavailableApply('invalidConfig', 'targetValidation', targetResults);
+    }
+    if (discovered.targets.length > 0 && unavailableTargets === discovered.targets.length) {
+        return unavailableApply('effectiveConfigUnavailable', 'targetValidation', targetResults);
+    }
+    if (runtimeFailed
+        || invalidTargets > 0
+        || unavailableTargets > 0
+        || targetResults.some((entry) => entry.state === 'failed' || entry.state === 'skipped')) {
+        return {
+            state: 'partial',
+            targetResults,
+            ...(errors.length > 0 ? { errors } : {}),
+        };
+    }
+    return { state: 'succeeded', targetResults };
 }
 async function resolveConfigApplyTargets(options) {
     if (options.applyTargets !== undefined) {
@@ -217,15 +344,16 @@ async function resolveConfigApplyTargets(options) {
         rebuildRuntime: options.rebuildRuntime,
     });
 }
-async function configApplyHasIssues(options) {
-    const scopes = [...new Set(options.targets.map((target) => target.scope))];
-    for (const scope of scopes) {
-        if (options.knownValidScopes?.includes(scope))
-            continue;
+async function configApplyHasValidCodexTarget(options) {
+    const codexScopes = new Set(options.targets
+        .filter((target) => target.platform === 'codex')
+        .map((target) => target.scope));
+    for (const scope of codexScopes) {
         const effective = await resolveEffectivePluginConfig({
             ...(options.plugin.sourceId ? {
                 sourceId: options.plugin.sourceId,
                 sourceIdentity: options.plugin.sourceIdentity,
+                logicalIdentity: options.plugin.catalogLogicalIdentity,
             } : {}),
             pluginName: options.plugin.manifest.name,
             manifest: options.plugin.manifest,
@@ -233,14 +361,29 @@ async function configApplyHasIssues(options) {
             cwd: options.cwd,
             env: options.env,
         });
-        if (effective.issues.length > 0)
+        if (effective.issues.length === 0)
             return true;
     }
     return false;
 }
+async function applyConfigToVisibleTargets(options) {
+    let discovered;
+    try {
+        discovered = await resolveConfigApplyTargets(options);
+    }
+    catch {
+        return unavailableApply('targetDiscoveryFailed', 'targetDiscovery');
+    }
+    if (discovered.targets.length === 0
+        && discovered.failures.length === 0
+        && options.noVisibleTargetHasInvalidConfig) {
+        return unavailableApply('invalidConfig', 'targetValidation');
+    }
+    return reinstallVisibleTargets({ ...options, discovered });
+}
 function otherProjectsWarning(scope) {
     return scope === 'user'
-        ? ['其它项目不会由本次命令扫描或更新。请在每个项目目录中运行对应的 aw reinstall 命令。']
+        ? ['其它项目不会由本次命令扫描或更新，可能需要在对应项目目录中运行 aw sync。']
         : [];
 }
 function buildReceiptFieldEntry(options) {
@@ -261,25 +404,38 @@ export async function replayConfigRuntimeWrites(options) {
         action: async (awHomeMutationToken) => {
             const env = options.env ?? process.env;
             const rebuildRuntime = { ...options.rebuildRuntime, awHomeMutationToken };
-            const discovered = await resolveConfigApplyTargets({
-                plugin: options.plugin,
-                scope: options.scope,
-                cwd: options.cwd,
-                env,
-                applyTargets: options.applyTargets,
-                nativeCliRunner: options.nativeCliRunner,
-                rebuildRuntime,
-            });
-            const applied = await configApplyHasIssues({
-                plugin: options.plugin,
-                targets: discovered.targets,
-                cwd: options.cwd,
-                env,
-            }) ? {
-                overallState: 'partial',
-                targetResults: [],
-                applySkippedReason: 'invalidConfig',
-            } : await reinstallVisibleTargets({
+            let discovered;
+            try {
+                discovered = await resolveConfigApplyTargets({
+                    plugin: options.plugin,
+                    scope: options.scope,
+                    cwd: options.cwd,
+                    env,
+                    applyTargets: options.applyTargets,
+                    nativeCliRunner: options.nativeCliRunner,
+                    rebuildRuntime,
+                });
+            }
+            catch {
+                return {
+                    configWrite: 'succeeded',
+                    overallState: 'partial',
+                    apply: publicConfigApplyResult(unavailableApply('targetDiscoveryFailed', 'targetDiscovery')),
+                    otherProjectsMayRequireSync: false,
+                };
+            }
+            if (options.scope === 'user'
+                && options.sharedNativeApplyConfirmed !== true
+                && pluginHasSharedNativeRefreshKeys(options.plugin)
+                && await configApplyHasValidCodexTarget({
+                    plugin: options.plugin,
+                    targets: discovered.targets,
+                    cwd: options.cwd,
+                    env,
+                })) {
+                throwSharedNativeApplyConfirmationRequired();
+            }
+            const apply = await reinstallVisibleTargets({
                 plugin: options.plugin,
                 scope: options.scope,
                 cwd: options.cwd,
@@ -292,10 +448,9 @@ export async function replayConfigRuntimeWrites(options) {
             });
             return {
                 configWrite: 'succeeded',
-                overallState: applied.overallState,
-                targetResults: applied.targetResults,
-                ...(applied.applySkippedReason ? { applySkippedReason: applied.applySkippedReason } : {}),
-                otherProjectsRequireReinstall: options.scope === 'user',
+                overallState: overallStateForApply(apply),
+                apply: publicConfigApplyResult(apply),
+                otherProjectsMayRequireSync: false,
             };
         },
     });
@@ -307,6 +462,17 @@ function changedKeysAffectSharedNativeTarget(options) {
         && target.delivery?.mode === 'codex-native'
         && target.refreshKeys.some((key) => changedKeys.has(key)));
 }
+function pluginHasSharedNativeRefreshKeys(plugin) {
+    return (plugin.manifest.artifacts?.targets ?? []).some((target) => target.platform === 'codex'
+        && target.target === 'codex.skill'
+        && target.delivery?.mode === 'codex-native'
+        && target.refreshKeys.length > 0);
+}
+function throwSharedNativeApplyConfirmationRequired() {
+    const error = new Error('sharedNativeConfigApplyConfirmationRequired: Applying this user config changes a shared Codex native artifact. Re-run with --yes.');
+    error.code = 'sharedNativeConfigApplyConfirmationRequired';
+    throw error;
+}
 async function applyPluginConfigWriteUnlocked(options) {
     const requestedPluginName = options.pluginName ?? options.plugin?.manifest.name;
     if (!requestedPluginName)
@@ -315,6 +481,7 @@ async function applyPluginConfigWriteUnlocked(options) {
     const configIdentity = options.plugin?.sourceId ? {
         sourceId: options.plugin.sourceId,
         sourceIdentity: options.plugin.sourceIdentity,
+        logicalIdentity: options.plugin.catalogLogicalIdentity,
     } : {};
     const requestedUpdates = options.request.updates ?? {};
     const requestedRemoveKeys = uniqueInOrder(options.request.removeKeys ?? []);
@@ -346,11 +513,14 @@ async function applyPluginConfigWriteUnlocked(options) {
         });
         assertReadyPluginConfigStore(userStore);
     }
-    for (const key of requestedRemoveKeys) {
-        if (!schema[key])
-            throw new Error(`Unknown config key "${key}".`);
-    }
     if (options.scope === 'project') {
+        const rejectedSensitiveKeys = Object.keys(requestedUpdates)
+            .filter((key) => schema[key]?.sensitive === true);
+        if (rejectedSensitiveKeys.length > 0) {
+            const error = new Error('sensitiveProjectConfigUnsupported: Sensitive config can only be set in user scope.');
+            error.code = 'sensitiveProjectConfigUnsupported';
+            throw error;
+        }
         const userOnlyKeys = codexNativeRefreshKeys(schemaPlugin.manifest);
         const rejectedKeys = Object.keys(requestedUpdates).filter((key) => userOnlyKeys.has(key));
         if (rejectedKeys.length > 0) {
@@ -369,8 +539,14 @@ async function applyPluginConfigWriteUnlocked(options) {
         schema,
     });
     assertReadyPluginConfigStore(store);
+    for (const key of requestedRemoveKeys) {
+        if (!schema[key] && !Object.hasOwn(store.values, key)) {
+            throw new Error(`Unknown config key "${key}".`);
+        }
+    }
     const warnings = [];
     const removedKeys = requestedRemoveKeys.filter((key) => Object.hasOwn(store.values, key));
+    const staleRemovedKeys = removedKeys.filter((key) => !schema[key]);
     const updatedKeys = Object.entries(updates)
         .filter(([key, value]) => !Object.hasOwn(store.values, key)
         || stablePluginConfigStringify(store.values[key]) !== stablePluginConfigStringify(value))
@@ -383,7 +559,7 @@ async function applyPluginConfigWriteUnlocked(options) {
     });
     if (options.apply !== false
         && options.scope === 'user'
-        && options.sharedNativeApplyConfirmed === false
+        && options.sharedNativeApplyConfirmed !== true
         && sharedNativeAffected) {
         applyTargets ??= (await discoverVisibleTargets({
             plugin: schemaPlugin,
@@ -395,90 +571,91 @@ async function applyPluginConfigWriteUnlocked(options) {
             rebuildRuntime: options.rebuildRuntime,
         })).targets;
         if (applyTargets.some((target) => target.platform === 'codex')) {
-            const error = new Error('sharedNativeConfigApplyConfirmationRequired: Applying this user config changes a shared Codex native artifact. Re-run with --yes.');
-            error.code = 'sharedNativeConfigApplyConfirmationRequired';
-            throw error;
+            throwSharedNativeApplyConfirmationRequired();
         }
     }
+    if (options.apply !== false
+        && options.sharedNativeApplyConfirmed !== true
+        && changedKeys.length > 0
+        && schemaPlugin.manifest.scripts?.preApply) {
+        const error = new Error('preApplyAuthorizationRequired: Applying this config runs plugin preApply. Re-run with --yes.');
+        error.code = 'preApplyAuthorizationRequired';
+        throw error;
+    }
     if (changedKeys.length > 0) {
-        await patchPluginConfigStore({
+        try {
+            const write = await patchPluginConfigStore({
+                ...configIdentity,
+                pluginName,
+                scope: options.scope,
+                cwd: options.cwd,
+                env: options.env,
+                updates: Object.fromEntries(updatedKeys.map((key) => [key, updates[key]])),
+                removeKeys: requestedRemoveKeys,
+                schema,
+            });
+            warnings.push(...write.warnings);
+        }
+        catch (error) {
+            throw markConfigWriteFailed(error);
+        }
+    }
+    let effective;
+    try {
+        effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({
             ...configIdentity,
             pluginName,
-            scope: options.scope,
+            manifest: schemaPlugin.manifest,
+            targetScope: options.scope,
             cwd: options.cwd,
             env: options.env,
-            updates: Object.fromEntries(updatedKeys.map((key) => [key, updates[key]])),
-            removeKeys: requestedRemoveKeys,
-            schema,
-        });
-    }
-    const effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({
-        ...configIdentity,
-        pluginName,
-        manifest: schemaPlugin.manifest,
-        targetScope: options.scope,
-        cwd: options.cwd,
-        env: options.env,
-    }));
-    let applied;
-    if (changedKeys.length === 0) {
-        applied = {
-            overallState: 'succeeded',
-            targetResults: [],
-            applySkippedReason: 'noConfigChange',
-        };
+        }));
     }
-    else if (effective.issues.length > 0) {
-        applied = {
+    catch {
+        const apply = unavailableApply('effectiveConfigUnavailable', 'effectiveConfig');
+        const otherProjectsMayRequireSync = options.scope === 'user' && changedKeys.length > 0;
+        if (otherProjectsMayRequireSync)
+            warnings.push(...otherProjectsWarning(options.scope));
+        return {
+            plugin: pluginName,
+            scope: options.scope,
+            ...(schemaAccess.schema ? { schema: schemaAccess.schema } : {}),
+            updatedKeys,
+            removedKeys,
+            staleRemovedKeys,
+            configWrite: 'succeeded',
             overallState: 'partial',
-            targetResults: [],
-            applySkippedReason: 'invalidConfig',
+            apply: publicConfigApplyResult(apply),
+            otherProjectsMayRequireSync,
+            warnings,
         };
     }
-    else if (options.apply === false) {
-        applied = {
-            overallState: 'succeeded',
-            targetResults: [],
-            applySkippedReason: 'notRequested',
-        };
+    let apply;
+    try {
+        apply = changedKeys.length === 0
+            ? skippedApply('noConfigChange')
+            : staleRemovedKeys.length === changedKeys.length
+                ? skippedApply('noEffectiveConfigChange')
+                : options.apply === false
+                    ? skippedApply('notRequested')
+                    : await applyConfigToVisibleTargets({
+                        plugin: schemaPlugin,
+                        scope: options.scope,
+                        cwd: options.cwd,
+                        env: options.env ?? process.env,
+                        applyTargets,
+                        nativeCliRunner: options.nativeCliRunner,
+                        reinstallCommandImpl: options.reinstallCommandImpl,
+                        rebuildRuntime: options.rebuildRuntime,
+                        noVisibleTargetHasInvalidConfig: effective.issues.length > 0,
+                    });
     }
-    else {
-        const discovered = await resolveConfigApplyTargets({
-            plugin: schemaPlugin,
-            scope: options.scope,
-            cwd: options.cwd,
-            env: options.env ?? process.env,
-            applyTargets: options.applyTargets,
-            nativeCliRunner: options.nativeCliRunner,
-            rebuildRuntime: options.rebuildRuntime,
-        });
-        applied = await configApplyHasIssues({
-            plugin: schemaPlugin,
-            targets: discovered.targets,
-            cwd: options.cwd,
-            env: options.env,
-            knownValidScopes: [options.scope],
-        }) ? {
-            overallState: 'partial',
-            targetResults: [],
-            applySkippedReason: 'invalidConfig',
-        } : await reinstallVisibleTargets({
-            plugin: schemaPlugin,
-            scope: options.scope,
-            cwd: options.cwd,
-            env: options.env ?? process.env,
-            applyTargets,
-            nativeCliRunner: options.nativeCliRunner,
-            reinstallCommandImpl: options.reinstallCommandImpl,
-            rebuildRuntime: options.rebuildRuntime,
-            discovered,
-        });
+    catch (error) {
+        const failure = error instanceof Error ? error : new Error(String(error));
+        throw Object.assign(failure, { configWrite: 'succeeded' });
     }
-    const otherProjectsRequireReinstall = options.scope === 'user'
-        && changedKeys.length > 0
-        && effective.issues.length === 0
-        && applied.applySkippedReason !== 'invalidConfig';
-    if (otherProjectsRequireReinstall)
+    const otherProjectsMayRequireSync = options.scope === 'user' && changedKeys.length > 0;
+    if (otherProjectsMayRequireSync)
         warnings.push(...otherProjectsWarning(options.scope));
     return {
         plugin: pluginName,
@@ -486,12 +663,12 @@ async function applyPluginConfigWriteUnlocked(options) {
         ...(schemaAccess.schema ? { schema: schemaAccess.schema } : {}),
         updatedKeys,
         removedKeys,
+        staleRemovedKeys,
         effective,
         configWrite: 'succeeded',
-        overallState: applied.overallState,
-        targetResults: applied.targetResults,
-        ...(applied.applySkippedReason ? { applySkippedReason: applied.applySkippedReason } : {}),
-        otherProjectsRequireReinstall,
+        overallState: overallStateForApply(apply),
+        apply: publicConfigApplyResult(apply),
+        otherProjectsMayRequireSync,
         warnings,
     };
 }
@@ -500,6 +677,20 @@ export async function applyPluginConfigWrite(options) {
     if (!requestedPluginName)
         throw new Error('Plugin name is required for config write.');
     assertSafePluginConfigSegment(requestedPluginName);
+    if (options.scope === 'project') {
+        const targetPath = resolvePluginConfigStorePath({
+            sourceId: options.plugin?.sourceId,
+            pluginName: requestedPluginName,
+            scope: 'project',
+            cwd: options.cwd,
+            env: options.env,
+        });
+        await assertProjectSharedConfigPathVisible({
+            cwd: options.cwd,
+            targetPath,
+            env: options.env,
+        });
+    }
     return withAwHomeMutationLock({
         env: options.env,
         token: options.awHomeMutationToken,
@@ -522,6 +713,7 @@ export async function applyPluginConfigWrite(options) {
                             ...(options.plugin.sourceId ? {
                                 sourceId: options.plugin.sourceId,
                                 sourceIdentity: options.plugin.sourceIdentity,
+                                logicalIdentity: options.plugin.catalogLogicalIdentity,
                             } : {}),
                             pluginName: options.plugin.manifest.name,
                             manifest: options.plugin.manifest,
@@ -539,6 +731,7 @@ export async function applyPluginConfigWrite(options) {
                     }
                 }
                 let message = redactPluginScriptOutput(error instanceof Error ? error.message : String(error), sensitiveValues);
+                message = message.split(options.cwd).join('<project>');
                 for (const scope of ['user', 'project']) {
                     const configPath = resolvePluginConfigStorePath({
                         sourceId: options.plugin?.sourceId,
@@ -556,6 +749,13 @@ export async function applyPluginConfigWrite(options) {
                 const safeError = new Error(message);
                 const code = error.code;
                 safeError.code = typeof code === 'string' ? code : 'configApplyFailed';
+                const configWrite = error.configWrite;
+                if (configWrite === 'succeeded' || configWriteStateForError(error) === 'failed') {
+                    safeError.configWrite = configWrite === 'succeeded' ? 'succeeded' : 'failed';
+                }
+                if (error && typeof error === 'object' && 'operationDiagnostic' in error) {
+                    safeError.operationDiagnostic = error.operationDiagnostic;
+                }
                 throw safeError;
             }
         },
@@ -563,19 +763,14 @@ export async function applyPluginConfigWrite(options) {
 }
 async function resetPluginConfigWithHelperUnlocked(options) {
     const pluginName = assertSafePluginConfigSegment(options.pluginName);
-    const schemaAccess = options.plugin ? await resolvePluginConfigSchemaAccess({
-        pluginName,
-        currentPlugin: options.plugin,
-        scope: options.scope,
-        cwd: options.cwd,
-        env: options.env,
-    }) : undefined;
     let configIdentity = options.plugin?.sourceId ? {
         sourceId: options.plugin.sourceId,
         sourceIdentity: options.plugin.sourceIdentity,
+        logicalIdentity: options.plugin.catalogLogicalIdentity,
     } : options.sourceId ? {
         sourceId: options.sourceId,
         sourceIdentity: options.sourceIdentity,
+        logicalIdentity: options.logicalIdentity,
     } : {};
     if (options.sourceId && !options.sourceIdentity) {
         try {
@@ -586,10 +781,15 @@ async function resetPluginConfigWithHelperUnlocked(options) {
                 cwd: options.cwd,
                 env: options.env,
             });
-            if (identity)
+            if (identity?.binding.kind === 'source')
+                configIdentity = {
+                    sourceId: options.sourceId,
+                    sourceIdentity: identity.binding.sourceIdentity,
+                };
+            if (identity?.binding.kind === 'catalog')
                 configIdentity = {
                     sourceId: options.sourceId,
-                    sourceIdentity: identity.sourceIdentity,
+                    logicalIdentity: identity.binding.logicalIdentity,
                 };
         }
         catch {
@@ -597,6 +797,7 @@ async function resetPluginConfigWithHelperUnlocked(options) {
         }
     }
     let removedKeys = [];
+    let removedKeysKnown = false;
     try {
         const store = await readPluginConfigStore({
             ...configIdentity,
@@ -606,92 +807,110 @@ async function resetPluginConfigWithHelperUnlocked(options) {
             env: options.env,
         });
         removedKeys = collectRemovedConfigKeys(store.values);
+        removedKeysKnown = store.state !== 'invalid';
     }
     catch {
         // Reset is the final recovery boundary and does not require a readable store.
     }
     const warnings = [];
-    const reset = await resetPluginConfigStore({
-        ...configIdentity,
-        pluginName,
-        scope: options.scope,
-        cwd: options.cwd,
-        env: options.env,
-    });
-    let applied = {
-        overallState: 'succeeded',
-        targetResults: [],
-        applySkippedReason: reset.deleted ? 'notRequested' : 'noConfigChange',
-    };
+    const sharedNativeAffected = options.plugin
+        && (removedKeysKnown
+            ? changedKeysAffectSharedNativeTarget({
+                plugin: options.plugin,
+                changedKeys: removedKeys,
+            })
+            : pluginHasSharedNativeRefreshKeys(options.plugin));
+    if (options.plugin
+        && options.apply !== false
+        && options.scope === 'user'
+        && options.sharedNativeApplyConfirmed !== true
+        && sharedNativeAffected) {
+        const discovered = await resolveConfigApplyTargets({
+            plugin: options.plugin,
+            scope: options.scope,
+            cwd: options.cwd,
+            env: options.env ?? process.env,
+            applyTargets: options.applyTargets,
+            nativeCliRunner: options.nativeCliRunner,
+            rebuildRuntime: options.rebuildRuntime,
+        });
+        if (discovered.targets.some((target) => target.platform === 'codex')) {
+            throwSharedNativeApplyConfirmationRequired();
+        }
+    }
+    let reset;
+    try {
+        reset = await resetPluginConfigStore({
+            ...configIdentity,
+            pluginName,
+            scope: options.scope,
+            cwd: options.cwd,
+            env: options.env,
+        });
+    }
+    catch (error) {
+        throw markConfigWriteFailed(error);
+    }
+    let schemaAccess;
+    let apply = reset.deleted ? skippedApply('notRequested') : skippedApply('noConfigChange');
     let effective;
-    if (schemaAccess?.plugin) {
-        if (schemaAccess.plugin.manifest.config?.fields) {
+    if (options.plugin) {
+        try {
+            schemaAccess = await resolvePluginConfigSchemaAccess({
+                pluginName,
+                currentPlugin: options.plugin,
+                scope: options.scope,
+                cwd: options.cwd,
+                env: options.env,
+            });
+        }
+        catch {
+            if (reset.deleted && options.apply !== false) {
+                apply = unavailableApply('sourceUnavailable', 'source');
+            }
+        }
+        const schemaPlugin = schemaAccess?.plugin;
+        if (schemaPlugin?.manifest.config?.fields) {
             try {
                 effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({
                     ...configIdentity,
                     pluginName,
-                    manifest: schemaAccess.plugin.manifest,
+                    manifest: schemaPlugin.manifest,
                     targetScope: options.scope,
                     cwd: options.cwd,
                     env: options.env,
                 }));
             }
             catch {
-                if (options.apply !== false) {
-                    applied = {
-                        overallState: 'partial',
-                        targetResults: [],
-                        applySkippedReason: 'invalidConfig',
-                    };
+                if (reset.deleted && options.apply !== false) {
+                    apply = unavailableApply('effectiveConfigUnavailable', 'effectiveConfig');
                 }
             }
+            if (reset.deleted && options.apply !== false && apply.state === 'skipped') {
+                apply = await applyConfigToVisibleTargets({
+                    plugin: schemaPlugin,
+                    scope: options.scope,
+                    cwd: options.cwd,
+                    env: options.env ?? process.env,
+                    applyTargets: options.applyTargets,
+                    nativeCliRunner: options.nativeCliRunner,
+                    reinstallCommandImpl: options.reinstallCommandImpl,
+                    rebuildRuntime: options.rebuildRuntime,
+                    noVisibleTargetHasInvalidConfig: (effective?.issues.length ?? 0) > 0,
+                });
+            }
         }
-        if (reset.deleted && effective && effective.issues.length > 0) {
-            applied = {
-                overallState: 'partial',
-                targetResults: [],
-                applySkippedReason: 'invalidConfig',
-            };
-        }
-        else if (reset.deleted && options.apply !== false && applied.applySkippedReason !== 'invalidConfig') {
-            const discovered = await resolveConfigApplyTargets({
-                plugin: schemaAccess.plugin,
-                scope: options.scope,
-                cwd: options.cwd,
-                env: options.env ?? process.env,
-                applyTargets: options.applyTargets,
-                nativeCliRunner: options.nativeCliRunner,
-                rebuildRuntime: options.rebuildRuntime,
-            });
-            applied = await configApplyHasIssues({
-                plugin: schemaAccess.plugin,
-                targets: discovered.targets,
-                cwd: options.cwd,
-                env: options.env,
-                knownValidScopes: effective ? [options.scope] : undefined,
-            }) ? {
-                overallState: 'partial',
-                targetResults: [],
-                applySkippedReason: 'invalidConfig',
-            } : await reinstallVisibleTargets({
-                plugin: schemaAccess.plugin,
-                scope: options.scope,
-                cwd: options.cwd,
-                env: options.env ?? process.env,
-                applyTargets: options.applyTargets,
-                nativeCliRunner: options.nativeCliRunner,
-                reinstallCommandImpl: options.reinstallCommandImpl,
-                rebuildRuntime: options.rebuildRuntime,
-                discovered,
-            });
+        else if (reset.deleted && options.apply !== false && apply.state === 'skipped') {
+            apply = unavailableApply('schemaUnavailable', 'schema');
         }
     }
-    const otherProjectsRequireReinstall = Boolean(schemaAccess?.plugin)
-        && options.scope === 'user'
-        && reset.deleted
-        && (effective?.issues.length ?? 0) === 0
-        && applied.applySkippedReason !== 'invalidConfig';
-    if (otherProjectsRequireReinstall)
+    else if (reset.deleted && options.apply !== false) {
+        apply = options.pluginError
+            ? unavailableApply('sourceUnavailable', 'source')
+            : unavailableApply('schemaUnavailable', 'schema');
+    }
+    const otherProjectsMayRequireSync = options.scope === 'user' && reset.deleted;
+    if (otherProjectsMayRequireSync)
         warnings.push(...otherProjectsWarning(options.scope));
     return {
         plugin: pluginName,
@@ -704,10 +923,9 @@ async function resetPluginConfigWithHelperUnlocked(options) {
         removedKeys,
         ...(effective ? { effective } : {}),
         configWrite: 'succeeded',
-        overallState: applied.overallState,
-        targetResults: applied.targetResults,
-        ...(applied.applySkippedReason ? { applySkippedReason: applied.applySkippedReason } : {}),
-        otherProjectsRequireReinstall,
+        overallState: overallStateForApply(apply),
+        apply: publicConfigApplyResult(apply),
+        otherProjectsMayRequireSync,
         warnings,
     };
 }
@@ -751,9 +969,11 @@ export async function describeResetAffectedFields(options) {
             ...(options.plugin?.sourceId ? {
                 sourceId: options.plugin.sourceId,
                 sourceIdentity: options.plugin.sourceIdentity,
+                logicalIdentity: options.plugin.catalogLogicalIdentity,
             } : options.sourceId ? {
                 sourceId: options.sourceId,
                 sourceIdentity: options.sourceIdentity,
+                logicalIdentity: options.logicalIdentity,
             } : {}),
             pluginName: options.pluginName,
             scope: options.scope,