@lesliechan721/aw 0.1.0-beta.10 → 0.1.0-beta.12

package/dist/src/commands/rebuild-command.js

@@ -5,6 +5,7 @@ import { previewCodexManager, resolveCodexOperationConsumer, } from '../utils/co
 import { createNoopDebugLogger } from '../output/debug-log.js';
 import { createNoopReporter } from '../output/reporter.js';
 import { getDefaultNativeCliRunner, } from '../utils/native-cli.js';
+import { createCodexNativeObservationSession } from '../utils/codex-native-observation.js';
 import { readPluginManifest } from '../utils/manifest.js';
 import { resolveAwHome, resolveCodexPaths } from '../utils/paths.js';
 import { resolveCliPackageRoot } from '../utils/paths.js';
@@ -13,8 +14,8 @@ import { analyzeCodexSurface } from '../utils/codex-surface-analysis.js';
 import { buildGeneratedName } from '../generators/shared.js';
 import { createCodexReconcilePlan, } from '../utils/codex-reconciler.js';
 import { readCodexConfigFile } from '../utils/codex-config.js';
-import { executeRebuildOperation, } from './rebuild-operations.js';
-import { assertNoClaudeUnboundNativeNameCollision, CodexActivationPostcheckError, createRebuildIntegration, executeCodexReconcileActivations, inspectCodexPluginRegistrationLive, inspectCodexSharedNativeLive, inspectNativeMarketplaceRegistrations, } from './rebuild-integration.js';
+import { executeRebuildComponentCleanup, executeRebuildOperation, prepareRebuildOperation, } from './rebuild-operations.js';
+import { assertNoClaudeUnboundNativeNameCollision, CodexActivationPostcheckError, createRebuildIntegration, executeCodexReconcileActivations, inspectCodexPluginRegistrationLive, inspectCodexSharedNativeLive, inspectNativeMarketplaceRegistrations, postcheckCodexReconcileActivations, } from './rebuild-integration.js';
 import { getNamespacedMarketplaceName } from '../utils/local-marketplace.js';
 import { formatPluginId, parsePluginId, planPluginSelectorSourceIds, preflightDesiredArtifactCollisions, withResolvedMultiSourceCatalog, } from '../utils/multi-source-catalog.js';
 import { calculateCodexNativeRenderPayloadDigest, calculateCodexSharedNativePayloadDigest, } from '../utils/catalog-digests.js';
@@ -32,8 +33,7 @@ import { readCatalogSourcesConfigSnapshot } from '../utils/catalog-sources.js';
 import { catalogGenerationErrorCode, isOfflineCleanupCatalogGenerationError, } from '../utils/catalog-generation-error.js';
 import { canonicalizePluginIntentState, calculatePluginIntentDigest, createEmptyPluginIntentState, mergePluginIntentRootPlatforms, readPluginIntentState, removePluginIntentRootPlatforms, writePluginIntentState, } from '../utils/plugin-intent-state.js';
 import { assertOperationPlanFingerprint, createOperationPlanConfigDigest, createOperationPlan, } from './operation-plan.js';
-import { validateCatalogSnapshotPluginEntriesComplete } from '../utils/catalog-snapshot.js';
-import { runPostApplyScript } from '../utils/plugin-scripts.js';
+import { validateCatalogSnapshotComplete, validateCatalogSnapshotPluginEntriesComplete, } from '../utils/catalog-snapshot.js';
 import { AwCapabilityUnsupportedError, IMPLEMENTED_AW_CAPABILITIES, } from './aw-capabilities.js';
 import { checkAwCapabilitySupport } from '../utils/manifest.js';
 import { createDependencyPlacementPlan, } from './dependency-operation-plan.js';
@@ -86,6 +86,7 @@ function assertRebuildCatalogSourceInventoryComplete(inventory, targetScope) {
     });
 }
 const MALFORMED_CONFIG_PRESERVED_WARNING = 'pluginConfigPreserved: 目标插件的无效配置文件已保留。可稍后运行 aw config reset 清理。';
+const OBSOLETE_CONTRACTS_CLEANUP_WARNING = 'obsoleteContractsCleanupFailed: Obsolete installation contracts could not be removed.';
 function omitSelectedPluginConfigErrors(inventory, targets) {
     let omitted = false;
     const errors = inventory.errors.filter((error) => {
@@ -326,9 +327,11 @@ function toTargetResult(result) {
         state: result.status === 'succeeded' ? 'completed' : 'failed',
         ...(result.status === 'failed' ? {
             message: result.error.message,
-            errorCode: errorPrefix && /^[A-Za-z][A-Za-z0-9]*$/u.test(errorPrefix)
-                ? errorPrefix
-                : 'writeFailed',
+            errorCode: result.error.phase === 'preApply'
+                ? 'preApplyFailed'
+                : errorPrefix && /^[A-Za-z][A-Za-z0-9]*$/u.test(errorPrefix)
+                    ? errorPrefix
+                    : 'writeFailed',
         } : {}),
     };
 }
@@ -365,6 +368,8 @@ async function runSingleSourceRebuildCommand(options) {
         ...(options.runtime?.codexManager ? { codexManager: options.runtime.codexManager } : {}),
         expectedCatalogConfigDigest: options.runtime?.expectedCatalogConfigDigest,
         codexUserActivationDesired: options.runtime?.codexUserActivationDesired,
+        codexObservationSession: options.runtime?.codexObservationSession,
+        preApplyExecutionCache: options.runtime?.preApplyExecutionCache,
     };
     const env = runtime.env;
     const selected = selectedPlatforms(options.commandOptions.platform);
@@ -392,6 +397,7 @@ async function runSingleSourceRebuildCommand(options) {
         for (const plugin of catalogPlugins) {
             plugin.sourceId = options.runtime.namespacedSource.sourceId;
             plugin.sourceIdentity = options.runtime.namespacedSource.sourceIdentity;
+            plugin.catalogLogicalIdentity = options.runtime.namespacedSource.logicalIdentity;
             plugin.pluginId = formatPluginId({
                 sourceId: options.runtime.namespacedSource.sourceId,
                 pluginName: plugin.manifest.name,
@@ -411,7 +417,7 @@ async function runSingleSourceRebuildCommand(options) {
         }
     }
     const platforms = selected.filter((platform) => (requestedByPlatform.get(platform)?.length ?? 0) > 0);
-    const integration = createRebuildIntegration({
+    const integration = options.execution?.integration ?? createRebuildIntegration({
         context: runtime,
         scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
         ...(options.execution?.prepared
@@ -421,11 +427,6 @@ async function runSingleSourceRebuildCommand(options) {
     const targets = [];
     const results = [];
     const warnings = [];
-    const recordWarning = (error) => {
-        const message = error instanceof Error ? error.message : String(error);
-        if (!warnings.includes(message))
-            warnings.push(message);
-    };
     for (const platform of platforms) {
         for (const pluginName of requestedByPlatform.get(platform) ?? []) {
             const currentPlugin = catalogByName.get(pluginName);
@@ -497,72 +498,34 @@ async function runSingleSourceRebuildCommand(options) {
                         ...options.runtime.resolvedReviewEvidenceByPlugin?.[pluginName],
                     });
                 }
-                const driver = options.execution?.deferredPostApplyTasks
-                    ? {
-                        ...integration.driver,
-                        runPostApply: async (invocation) => {
-                            options.execution.deferredPostApplyTasks.push({
-                                pluginId: identity.pluginId ?? identity.pluginName,
-                                run: async () => {
-                                    const startedAt = Date.now();
-                                    const emit = (data) => emitRebuildActionEvent(runtime, {
-                                        type: 'rebuild:action',
-                                        source: {
-                                            plugin: invocation.target.identity.pluginName,
-                                            platform: invocation.target.identity.platform,
-                                            scope: invocation.target.identity.scope,
-                                            action: options.command,
-                                        },
-                                        data,
-                                    });
-                                    await emit({ name: 'postApply', phase: 'start' });
-                                    try {
-                                        await integration.driver.runPostApply(invocation);
-                                    }
-                                    catch (error) {
-                                        await emit({
-                                            name: 'postApply',
-                                            phase: 'failure',
-                                            durationMs: Math.max(0, Date.now() - startedAt),
-                                            message: '运行 postApply 失败。',
-                                        });
-                                        throw error;
-                                    }
-                                    await emit({
-                                        name: 'postApply',
-                                        phase: 'success',
-                                        durationMs: Math.max(0, Date.now() - startedAt),
-                                    });
-                                },
-                                onFailure: (error) => {
-                                    recordWarning(error);
-                                    const action = result.actions.find((entry) => entry.name === 'postApply');
-                                    if (action)
-                                        action.status = 'failed';
-                                },
-                            });
-                        },
+                const driver = integration.driver;
+                let operationPreparation = options.execution?.operationPreparation;
+                if (options.execution?.skipPreApply
+                    && !operationPreparation
+                    && (options.command === 'install'
+                        || options.command === 'sync'
+                        || options.command === 'reinstall')) {
+                    const prepared = await prepareRebuildOperation({
+                        command: options.command,
+                        target,
+                        driver,
+                        skipPreApply: true,
+                        onActionEvent: (event) => emitRebuildActionEvent(runtime, event),
+                    });
+                    if (prepared.status === 'failed') {
+                        results.push(prepared.result);
+                        continue;
                     }
-                    : {
-                        ...integration.driver,
-                        runPostApply: async (invocation) => {
-                            try {
-                                await integration.driver.runPostApply(invocation);
-                            }
-                            catch (error) {
-                                recordWarning(error);
-                                throw error;
-                            }
-                        },
-                    };
+                    operationPreparation = prepared.preparation;
+                }
                 result = await executeRebuildOperation({
                     command: options.command,
                     target,
                     driver,
-                    onActionEvent: (event) => options.execution?.deferredPostApplyTasks
-                        && event.data.name === 'postApply'
-                        ? undefined
-                        : emitRebuildActionEvent(runtime, event),
+                    ...(operationPreparation
+                        ? { preparation: operationPreparation }
+                        : {}),
+                    onActionEvent: (event) => emitRebuildActionEvent(runtime, event),
                 });
             }
             catch (error) {
@@ -631,7 +594,7 @@ function mergeRebuildCommandResults(results) {
             : {}),
     };
 }
-function reconcileOverallState(targetResults, plan) {
+function reconcileOverallState(targetResults, plan, rebuildResults = []) {
     const failed = targetResults.some((result) => result.state === 'failed' || result.action === 'skipped');
     if (!failed)
         return 'succeeded';
@@ -642,7 +605,15 @@ function reconcileOverallState(targetResults, plan) {
         && result.action !== 'skipped'
         && result.target.pluginId !== undefined
         && requested.has(`${result.target.pluginId}\0${result.target.platform}`));
-    return completedRequested ? 'partial' : 'failed';
+    const completedMutation = targetResults.some((result) => result.state === 'completed'
+        && result.action !== 'keep'
+        && result.action !== 'skipped');
+    const observedMutation = rebuildResults.some((result) => result.actions.some((action) => action.status === 'succeeded'
+        && (action.name === 'stale.cleanup'
+            || action.name === 'native.write'
+            || action.name === 'artifacts.write'
+            || action.name === 'cleanup.owned')));
+    return completedRequested || completedMutation || observedMutation ? 'partial' : 'failed';
 }
 function createRebuildOperationPlan(options) {
     const selectedRoots = [...new Map(options.dependencyPlan.targets.flatMap((target) => target.relation === 'requested'
@@ -931,8 +902,8 @@ async function cleanupOfflineOwnedComponents(options) {
     try {
         await (options.removeObsoleteInstallationContracts ?? fs.remove)(obsoleteContracts);
     }
-    catch (error) {
-        warnings.push(`obsoleteContractsCleanupFailed: ${error instanceof Error ? error.message : String(error)}`);
+    catch {
+        warnings.push(OBSOLETE_CONTRACTS_CLEANUP_WARNING);
     }
     return leaseSafeRebuildResult({
         platforms: [...new Set(results.map((result) => result.target.platform))],
@@ -1034,6 +1005,7 @@ async function buildForceExclusiveCleanupPlan(options) {
         const pluginId = formatPluginId({ sourceId, pluginName: parsed.pluginName });
         plugin.sourceId = sourceId;
         plugin.sourceIdentity = active.sourceIdentity;
+        plugin.catalogLogicalIdentity = active.logicalIdentity;
         plugin.pluginId = pluginId;
         plugin.marketplaceName = sourceId === options.primarySourceId ? 'aw' : `aw-${sourceId}`;
         const context = {
@@ -1179,7 +1151,7 @@ async function buildLiveForceExclusiveCleanupPlan(options) {
             writeNativeRequired: false,
             artifacts: [],
             operationActions: [],
-            postApplySource: plugin,
+            preApplySource: plugin,
             forceExclusiveCleanup: true,
         });
         evidence.push(await forceOfflineCleanupEvidence({
@@ -1228,7 +1200,7 @@ async function mergeForceCleanupPlans(...plans) {
         }))),
     };
 }
-export async function runRebuildCommand(options) {
+async function runRebuildCommandInSession(options) {
     const runtimeEnv = options.runtime?.env ?? process.env;
     const readInventory = options.runtime?.inventoryCatalogSourceReferences
         ?? inventoryCatalogSourceReferences;
@@ -1338,7 +1310,7 @@ export async function runRebuildCommand(options) {
         }
         return mergeRebuildCommandResults([]);
     }
-    if (options.command === 'cleanup') {
+    if (options.command === 'cleanup' && !options.all) {
         if (cleanupForce) {
             const requestedPlatforms = selectedPlatforms(options.commandOptions.platform);
             const cleanupSourceSnapshot = await readCatalogSourcesConfigSnapshot(runtimeEnv).catch(() => undefined);
@@ -1512,8 +1484,8 @@ export async function runRebuildCommand(options) {
                 try {
                     await (options.runtime?.removeObsoleteInstallationContracts ?? fs.remove)(path.join(resolveAwHome(runtimeEnv), 'installation-contracts'));
                 }
-                catch (error) {
-                    result.warnings.push(`obsoleteContractsCleanupFailed: ${error instanceof Error ? error.message : String(error)}`);
+                catch {
+                    result.warnings.push(OBSOLETE_CONTRACTS_CLEANUP_WARNING);
                 }
             }
             return result;
@@ -1597,13 +1569,6 @@ export async function runRebuildCommand(options) {
                         pluginId: formatPluginId({ sourceId: source.sourceId, pluginName: entry.name }),
                     }));
                 });
-                const intentCatalogEntries = availableEntries.map((candidate) => ({
-                    pluginId: candidate.pluginId,
-                    dependencyPluginIds: candidate.entry.dependencies.map((dependency) => formatPluginId({
-                        sourceId: candidate.source.sourceId,
-                        pluginName: dependency,
-                    })),
-                }));
                 const selectedEntries = selectors.map((selector, index) => {
                     const matches = availableEntries.filter((candidate) => candidate.entry.name === selector.pluginName
                         && (selector.sourceId === undefined || candidate.source.sourceId === selector.sourceId));
@@ -1615,6 +1580,24 @@ export async function runRebuildCommand(options) {
                     }
                     return matches[0];
                 });
+                if (options.command === 'uninstall' || (options.command === 'cleanup' && options.all)) {
+                    await measureCommandPerformanceStage(options.runtime, 'catalog.validation', async () => {
+                        const selectedSources = new Map(selectedEntries.map((candidate) => [
+                            candidate.source.sourceId,
+                            candidate.source,
+                        ]));
+                        for (const source of selectedSources.values()) {
+                            await validateCatalogSnapshotComplete(source.rootDir);
+                        }
+                    });
+                }
+                const intentCatalogEntries = availableEntries.map((candidate) => ({
+                    pluginId: candidate.pluginId,
+                    dependencyPluginIds: candidate.entry.dependencies.map((dependency) => formatPluginId({
+                        sourceId: candidate.source.sourceId,
+                        pluginName: dependency,
+                    })),
+                }));
                 const dependencyEnabled = options.command === 'install'
                     || options.command === 'sync'
                     || options.command === 'reinstall';
@@ -1682,6 +1665,7 @@ export async function runRebuildCommand(options) {
                     const plugin = await readPluginManifest(path.join(candidate.source.rootDir, 'plugins', candidate.entry.name), { mode: 'bundle' });
                     plugin.sourceId = candidate.source.sourceId;
                     plugin.sourceIdentity = candidate.source.sourceIdentity;
+                    plugin.catalogLogicalIdentity = candidate.source.logicalIdentity;
                     plugin.pluginId = candidate.pluginId;
                     return { source: candidate.source, plugin, pluginId: candidate.pluginId };
                 }));
@@ -1905,12 +1889,41 @@ export async function runRebuildCommand(options) {
                     }
                     return marketplaceName;
                 };
+                const codexObservationScopeByMarketplace = new Map();
+                const projectIntentPluginIds = new Set();
+                for (const root of intentBeforeByScope.project.roots.filter((candidate) => candidate.platforms.includes('codex'))) {
+                    const rootEntry = availableEntries.find((candidate) => candidate.pluginId === root.pluginId);
+                    if (!rootEntry)
+                        continue;
+                    for (const candidate of entryClosure([rootEntry])) {
+                        projectIntentPluginIds.add(candidate.pluginId);
+                    }
+                }
+                const projectCodexConfig = await readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'project', runtimeEnv).configTomlPath);
+                for (const { entry, platform } of executionSelections) {
+                    if (platform !== 'codex')
+                        continue;
+                    const marketplaceName = marketplaceNameFor(entry, platform, options.commandOptions.scope);
+                    const codexPluginId = `${entry.plugin.manifest.name}@${marketplaceName}`;
+                    const requiredScope = options.commandOptions.scope === 'project'
+                        || projectIntentPluginIds.has(entry.pluginId)
+                        || Object.hasOwn(projectCodexConfig.snapshot.plugins, codexPluginId)
+                        ? 'both'
+                        : 'user';
+                    if (requiredScope === 'both'
+                        || !codexObservationScopeByMarketplace.has(marketplaceName)) {
+                        codexObservationScopeByMarketplace.set(marketplaceName, requiredScope);
+                    }
+                }
                 const executionContext = {
                     env: runtimeEnv,
                     nativeCliRunner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
                     reporter: options.runtime?.reporter ?? createNoopReporter(),
                     debugLogger: options.runtime?.debugLogger ?? createNoopDebugLogger(),
                     expectedCatalogConfigDigest: catalog.configDigest,
+                    codexObservationSession: options.runtime?.codexObservationSession,
+                    codexObservationScopeByMarketplace,
+                    preApplyExecutionCache: options.runtime?.preApplyExecutionCache,
                 };
                 const inspection = createRebuildIntegration({
                     context: executionContext,
@@ -1925,6 +1938,43 @@ export async function runRebuildCommand(options) {
                                         : []),
                                 }]]
                         : [])).values()];
+                const intentPlanForPreparedRoots = (plan, preparedKeys) => {
+                    const retainedRootKeys = new Set(plan.targets.flatMap((target) => target.relation === 'requested'
+                        && preparedKeys.has(`${target.pluginId}\0${target.platform}`)
+                        ? [`${target.pluginId}\0${target.platform}`]
+                        : []));
+                    const closureKeys = new Set(retainedRootKeys);
+                    const pending = [...closureKeys];
+                    while (pending.length > 0) {
+                        const consumerKey = pending.pop();
+                        for (const edge of plan.dependencyEdges) {
+                            if (`${edge.from}\0${edge.platform}` !== consumerKey)
+                                continue;
+                            const dependencyKey = `${edge.to}\0${edge.platform}`;
+                            if (closureKeys.has(dependencyKey))
+                                continue;
+                            closureKeys.add(dependencyKey);
+                            pending.push(dependencyKey);
+                        }
+                    }
+                    return {
+                        plan: {
+                            ...plan,
+                            requestedPluginIds: plan.requestedPluginIds.filter((pluginId) => plan.targets.some((target) => target.pluginId === pluginId
+                                && retainedRootKeys.has(`${target.pluginId}\0${target.platform}`))),
+                            resolvedPluginIds: plan.resolvedPluginIds.filter((pluginId) => plan.targets.some((target) => target.pluginId === pluginId
+                                && closureKeys.has(`${target.pluginId}\0${target.platform}`))),
+                            dependencyEdges: plan.dependencyEdges.filter((edge) => closureKeys.has(`${edge.from}\0${edge.platform}`)
+                                && closureKeys.has(`${edge.to}\0${edge.platform}`)),
+                            scopeOverrides: plan.scopeOverrides.filter((override) => closureKeys.has(`${override.pluginId}\0${override.platform}`)),
+                            targets: plan.targets.filter((target) => closureKeys.has(`${target.pluginId}\0${target.platform}`)),
+                        },
+                        selectedRoots: selectedRootsForPlan(plan).flatMap((root) => {
+                            const platforms = root.platforms.filter((platform) => retainedRootKeys.has(`${root.pluginId}\0${platform}`));
+                            return platforms.length > 0 ? [{ ...root, platforms }] : [];
+                        }),
+                    };
+                };
                 let plannedCodexRegistrations = new Map();
                 let plannedOwnedTextTargets = new Map();
                 let plannedSkillMarkerTargets = new Map();
@@ -1956,7 +2006,7 @@ export async function runRebuildCommand(options) {
                     }
                     return output;
                 };
-                const createPlan = async (inventory, codexManager) => {
+                const createPlan = async (inventory, codexManager, planOptions) => {
                     plannedCodexRegistrations = new Map();
                     plannedOwnedTextTargets = new Map();
                     plannedSkillMarkerTargets = new Map();
@@ -1965,6 +2015,15 @@ export async function runRebuildCommand(options) {
                     const placementNodes = [];
                     const blockingTargets = new Map();
                     const actualStates = new Map();
+                    const loadPlacementCodexConfigs = async () => {
+                        const [user, project] = await Promise.all(['user', 'project'].map((scope) => readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, scope, runtimeEnv).configTomlPath)));
+                        return { user, project };
+                    };
+                    let placementCodexConfigs;
+                    const readPlacementCodexConfigs = () => {
+                        placementCodexConfigs ??= loadPlacementCodexConfigs();
+                        return placementCodexConfigs;
+                    };
                     for (const [order, { entry, platform }] of executionSelections.entries()) {
                         const relation = selectedIds.has(entry.pluginId) ? 'requested' : 'dependency';
                         let resolvedScope = options.commandOptions.scope;
@@ -2050,12 +2109,17 @@ export async function runRebuildCommand(options) {
                                 cwd: options.commandOptions.cwd,
                                 env: runtimeEnv,
                                 nativeCliRunner: executionContext.nativeCliRunner,
+                                scope: codexObservationScopeByMarketplace.get(marketplaceNameFor(entry, platform, resolvedScope)) ?? 'both',
+                                observationSession: executionContext.codexObservationSession,
                                 ...(codexManager ? { manager: codexManager } : {}),
                             })
                             : undefined;
                         if (codexRegistration) {
                             plannedCodexRegistrations.set(codexPluginId, codexRegistration);
                         }
+                        const placementActivationConfigs = codexRegistration
+                            ? await readPlacementCodexConfigs()
+                            : undefined;
                         const placementState = (inspected, scope) => {
                             if (platform !== 'codex'
                                 || surface?.classification !== 'native'
@@ -2070,8 +2134,12 @@ export async function runRebuildCommand(options) {
                                 return 'partial';
                             if (codexRegistration.observation.value === 'absent')
                                 return 'absent';
-                            return codexRegistration.observations[scope]
-                                && codexRegistration.activations[scope] === true
+                            const configEnabled = placementActivationConfigs.user
+                                .snapshot.plugins[codexPluginId]?.enabled === true
+                                || (scope === 'project'
+                                    && placementActivationConfigs.project
+                                        .snapshot.plugins[codexPluginId]?.enabled === true);
+                            return configEnabled
                                 ? inspected.state
                                 : 'partial';
                         };
@@ -2205,12 +2273,14 @@ export async function runRebuildCommand(options) {
                             state = resolvedInspection.state;
                             errorCode ??= 'dependencyNotReady';
                         }
-                        if (entry.plugin.manifest.config?.fields
+                        if (!planOptions?.skipConfigValidation
+                            && entry.plugin.manifest.config?.fields
                             && (action === 'install' || action === 'reinstall')) {
                             const effective = resolvedScope === 'project'
                                 ? await resolveArtifactRenderConfig({
                                     sourceId: entry.source.sourceId,
                                     sourceIdentity: entry.source.sourceIdentity,
+                                    logicalIdentity: entry.source.logicalIdentity,
                                     pluginName: entry.plugin.manifest.name,
                                     manifest: entry.plugin.manifest,
                                     scope: 'project',
@@ -2220,6 +2290,7 @@ export async function runRebuildCommand(options) {
                                 : await resolveEffectivePluginConfig({
                                     sourceId: entry.source.sourceId,
                                     sourceIdentity: entry.source.sourceIdentity,
+                                    logicalIdentity: entry.source.logicalIdentity,
                                     pluginName: entry.plugin.manifest.name,
                                     manifest: entry.plugin.manifest,
                                     targetScope: 'user',
@@ -2418,15 +2489,29 @@ export async function runRebuildCommand(options) {
                         return [...scopes].sort();
                     };
                     const inspectBothScopes = options.command !== 'cleanup' && options.command !== 'uninstall';
-                    const readActivationConfig = async (scope) => {
-                        return readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, scope, runtimeEnv).configTomlPath);
-                    };
                     const [userConfig, projectConfig] = await Promise.all([
-                        readActivationConfig('user'),
-                        readActivationConfig('project'),
+                        readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'user', runtimeEnv).configTomlPath),
+                        readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'project', runtimeEnv).configTomlPath),
                     ]);
                     const catalogClosure = [];
                     const liveEvidence = [];
+                    const desiredScopesByPluginId = new Map();
+                    const intentScopesByPluginId = new Map();
+                    for (const planned of reconciledCodexTargets) {
+                        const entry = available.find((candidate) => candidate.pluginId === planned.pluginId);
+                        const marketplaceName = marketplaceNameFor(entry, 'codex', planned.resolvedScope);
+                        const codexPluginId = `${entry.plugin.manifest.name}@${marketplaceName}`;
+                        const desiredScopes = desiredScopesForEntry(entry);
+                        const intentScopes = intentScopesForEntry(entry);
+                        desiredScopesByPluginId.set(entry.pluginId, desiredScopes);
+                        intentScopesByPluginId.set(entry.pluginId, intentScopes);
+                        if (planned.resolvedScope === 'project'
+                            || desiredScopes.includes('project')
+                            || intentScopes.includes('project')
+                            || Object.hasOwn(projectConfig.snapshot.plugins, codexPluginId)) {
+                            codexObservationScopeByMarketplace.set(marketplaceName, 'both');
+                        }
+                    }
                     for (const planned of reconciledCodexTargets) {
                         const entry = available.find((candidate) => candidate.pluginId === planned.pluginId);
                         const surface = analyzeCodexSurface(entry.plugin.manifest);
@@ -2438,7 +2523,11 @@ export async function runRebuildCommand(options) {
                         const staticContentDigest = hasNativeRenderTargets
                             ? undefined
                             : await calculateCodexSharedNativePayloadDigest(entry.plugin.rootDir);
-                        const desiredScopes = desiredScopesForEntry(entry);
+                        const desiredScopes = desiredScopesByPluginId.get(entry.pluginId);
+                        const intentScopes = intentScopesByPluginId.get(entry.pluginId);
+                        const observationScope = codexObservationScopeByMarketplace.get(marketplaceName)
+                            ?? 'user';
+                        const plannedRegistration = plannedCodexRegistrations.get(codexPluginId);
                         const sharedInspection = surface.nativeKinds.length > 0
                             ? await inspectCodexSharedNativeLive({
                                 pluginName: entry.plugin.manifest.name,
@@ -2450,9 +2539,12 @@ export async function runRebuildCommand(options) {
                                 marketplaceName,
                                 marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
                                 nativeCliRunner: executionContext.nativeCliRunner,
+                                observationScope,
+                                observationSession: executionContext.codexObservationSession,
                                 ...(codexManager ? { manager: codexManager } : {}),
-                                ...(plannedCodexRegistrations.get(codexPluginId)
-                                    ? { pluginRegistration: plannedCodexRegistrations.get(codexPluginId) }
+                                ...(plannedRegistration
+                                    && (observationScope === 'user' || plannedRegistration.observations.project)
+                                    ? { pluginRegistration: plannedRegistration }
                                     : {}),
                                 ...(hasNativeRenderTargets ? { nativeRenderPlugin: entry.plugin } : {}),
                             })
@@ -2469,7 +2561,7 @@ export async function runRebuildCommand(options) {
                             relation: planned.relation,
                             resolvedScope: planned.resolvedScope,
                             desiredScopes,
-                            intentScopes: intentScopesForEntry(entry),
+                            intentScopes,
                             surface,
                         });
                         const sharedNative = sharedInspection?.sharedNative
@@ -2544,15 +2636,8 @@ export async function runRebuildCommand(options) {
                         liveEvidence.push({
                             codexPluginId,
                             sharedNative,
-                            ...(sharedInspection?.actualPayloadDigest
-                                ? { sharedNativePayloadDigest: sharedInspection.actualPayloadDigest }
-                                : {}),
-                            ...(sharedInspection?.payloadPath
-                                ? { sharedNativePayloadPath: sharedInspection.payloadPath }
-                                : {}),
                             activations: {
-                                user: sharedInspection?.activations.user
-                                    ?? userConfig?.snapshot.plugins[codexPluginId]?.enabled,
+                                user: userConfig.snapshot.plugins[codexPluginId]?.enabled,
                                 project: projectConfig?.snapshot.plugins[codexPluginId]?.enabled,
                             },
                             extensions,
@@ -2664,6 +2749,7 @@ export async function runRebuildCommand(options) {
                     const integration = createRebuildIntegration({
                         context: executionContext,
                         scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
+                        operationScopedNativePhases: true,
                     });
                     const preparedTargets = new Map();
                     const preparedTargetErrors = new Map();
@@ -2689,8 +2775,10 @@ export async function runRebuildCommand(options) {
                         const plannedNative = platform === 'codex'
                             ? codexPlans.flatMap((codexPlan) => codexPlan.sharedNativeActions).find((action) => action.pluginId === entry.pluginId)
                             : undefined;
+                        const codexNativeStillDesired = platform === 'codex'
+                            && codexPlans.some((codexPlan) => codexPlan.desiredTargets.some((target) => target.pluginId === entry.pluginId && target.scopes.length > 0));
                         const preserveSharedNative = plannedNative?.action === 'reuse'
-                            || plannedNative?.action === 'none';
+                            || (plannedNative?.action === 'none' && codexNativeStillDesired);
                         const marketplaceName = marketplaceNameFor(entry, platform, planned.resolvedScope);
                         try {
                             const target = await measureCommandPerformanceStage(options.runtime, 'target.build', () => integration.buildTarget({
@@ -2731,10 +2819,20 @@ export async function runRebuildCommand(options) {
                                     ...codexPlan.extensionRemovals,
                                 ].some((action) => action.pluginId === entry.pluginId
                                     && action.scope === planned.resolvedScope));
+                                const hasActivationMutation = codexPlans.some((codexPlan) => [
+                                    ...codexPlan.activationActions.user,
+                                    ...codexPlan.activationActions.project,
+                                ].some((action) => action.pluginId === entry.pluginId
+                                    && action.action !== 'none'));
                                 target.codexNativeObservationExpectation = preserveSharedNative && hasExtensionMutation
                                     ? (plannedNative.action === 'reuse' ? 'installed' : 'observed')
                                     : undefined;
-                                if (!writesSharedNative) {
+                                const removesSharedNative = !writesSharedNative
+                                    && !preserveSharedNative
+                                    && (buildCommand === 'cleanup' || buildCommand === 'uninstall');
+                                target.codexNativeSensitivePreflightRequired = preserveSharedNative
+                                    && hasActivationMutation;
+                                if (!writesSharedNative && !removesSharedNative) {
                                     const isSharedNativeComponent = (component) => component.kind === 'native-plugin'
                                         || (component.kind === 'shared-config'
                                             && component.identity.artifactKey.startsWith('marketplace-'));
@@ -2744,6 +2842,9 @@ export async function runRebuildCommand(options) {
                                     target.optionalOwnedComponents = target.optionalOwnedComponents?.filter((component) => !isSharedNativeComponent(component));
                                     target.operationActions = target.operationActions?.filter((action) => action.kind !== 'ensureNativeRegistration');
                                 }
+                                if (target.codexNativeSensitivePreflightRequired && !hasExtensionMutation) {
+                                    await integration.driver.preflightMutation?.(target);
+                                }
                             }
                             preparedTargets.set(`${entry.pluginId}\0${platform}`, {
                                 target,
@@ -2793,6 +2894,7 @@ export async function runRebuildCommand(options) {
                         const effective = await resolveEffectivePluginConfig({
                             sourceId: entry.source.sourceId,
                             sourceIdentity: entry.source.sourceIdentity,
+                            logicalIdentity: entry.source.logicalIdentity,
                             pluginName: entry.plugin.manifest.name,
                             manifest: entry.plugin.manifest,
                             targetScope: scope,
@@ -2806,12 +2908,40 @@ export async function runRebuildCommand(options) {
                         });
                     }));
                     return {
+                        integration,
                         preparedTargets,
                         preparedTargetErrors,
                         targetActions: [...preparedTargets.values()].flatMap((prepared) => prepared.target.operationActions ?? []),
                         configDigests,
                     };
                 };
+                if (options.runtime?.resolvePreApplyAuthorization) {
+                    const authorizationPlan = await measureCommandPerformanceStage(options.runtime, 'dependency.plan', () => createPlan(stateInventory, undefined, { skipConfigValidation: true }));
+                    assertWriteInventoryComplete(stateInventory, exactOwnedTextTargets(authorizationPlan), exactSkillMarkerTargets(authorizationPlan));
+                    const preview = mergeRebuildCommandResults([]);
+                    preview.dependencyPlan = authorizationPlan;
+                    preview.preApplyAuthorization = executionSelections.flatMap(({ entry, platform }) => {
+                        const planned = authorizationPlan.targets.find((target) => target.pluginId === entry.pluginId && target.platform === platform);
+                        if (!planned || planned.action === 'block' || !entry.plugin.manifest.scripts?.preApply) {
+                            return [];
+                        }
+                        const relation = planned.relation === 'requested'
+                            ? 'requested'
+                            : planned.requiredBy.some((pluginId) => selectedIds.has(pluginId))
+                                ? 'direct'
+                                : 'transitive';
+                        return [{
+                                pluginId: entry.pluginId,
+                                pluginName: entry.plugin.manifest.name,
+                                sourceId: entry.source.sourceId,
+                                sourceIdentity: entry.source.sourceIdentity,
+                                platform,
+                                scope: planned.resolvedScope,
+                                relation,
+                            }];
+                    });
+                    return preview;
+                }
                 if (options.runtime?.previewOperationPlan) {
                     await options.runtime.onPreviewStage?.('dependencyPlan');
                     const initialPlan = await measureCommandPerformanceStage(options.runtime, 'dependency.plan', () => createPlan(stateInventory));
@@ -2882,6 +3012,7 @@ export async function runRebuildCommand(options) {
                             : {}),
                         sourceId: entry.source.sourceId,
                         sourceIdentity: entry.source.sourceIdentity,
+                        logicalIdentity: entry.source.logicalIdentity,
                         resolvedCommit: entry.source.resolvedCommit,
                         manifestDigest: entry.source.manifestDigest,
                         snapshotDigest: entry.source.snapshotDigest,
@@ -2890,64 +3021,25 @@ export async function runRebuildCommand(options) {
                 }
                 let lockedPlan = await measureCommandPerformanceStage(options.runtime, 'dependency.plan', () => createPlan(stateInventory));
                 assertWriteInventoryComplete(stateInventory, exactOwnedTextTargets(lockedPlan), exactSkillMarkerTargets(lockedPlan));
+                const lifecycleCommand = options.command === 'install'
+                    || options.command === 'sync'
+                    || options.command === 'reinstall';
+                const preApplyRequired = lifecycleCommand && executionSelections.some(({ entry, platform }) => entry.plugin.manifest.scripts?.preApply !== undefined
+                    && lockedPlan.targets.some((target) => target.pluginId === entry.pluginId
+                        && target.platform === platform
+                        && target.action !== 'block'));
+                if (preApplyRequired
+                    && options.commandOptions.yes !== true
+                    && options.runtime?.preApplyConfirmed !== true) {
+                    throw namespacedPreflightError('preApplyAuthorizationRequired: Running plugin preApply requires --yes or an accepted Review.', preflightTargets);
+                }
                 const provisionalLockedCodexPlans = await createCodexPlans(lockedPlan);
                 const codexManagerRequired = provisionalLockedCodexPlans.some((plan) => plan.sharedNativeActions.some((action) => action.action === 'install'
                     || action.action === 'replace'
                     || action.action === 'repair'));
-                const activationOnlyOperation = !codexManagerRequired
-                    && provisionalLockedCodexPlans.some((plan) => plan.postcheck.support === 'observed'
-                        && plan.postcheck.plugins.length > 0);
-                const activationScope = provisionalLockedCodexPlans.some((plan) => plan.requirement.requiresProjectPluginContract) ? 'project' : 'user';
-                const activationConsumer = activationOnlyOperation
-                    ? await (options.runtime?.codexOperationConsumerResolver ?? resolveCodexOperationConsumer)({
-                        cwd: options.commandOptions.cwd,
-                        env: runtimeEnv,
-                        runner: executionContext.nativeCliRunner,
-                        operationRequirement: getCodexOperationRequirement(activationScope),
-                        requiresNativeMaterialization: false,
-                    })
-                    : undefined;
-                if (activationConsumer?.support === 'observed') {
-                    executionContext.codexManager = activationConsumer.manager;
-                }
-                if (codexManagerRequired) {
-                    const codexRequirementScope = provisionalLockedCodexPlans.some((plan) => plan.requirement.requiresProjectPluginContract)
-                        ? 'project'
-                        : 'user';
-                    if (options.runtime?.codexManagerResolver) {
-                        executionContext.codexManager = await options.runtime.codexManagerResolver({
-                            cwd: options.commandOptions.cwd,
-                            env: runtimeEnv,
-                            runner: executionContext.nativeCliRunner,
-                            authorizer: options.runtime?.managedCodexAuthorizer,
-                            operationRequirement: getCodexOperationRequirement(codexRequirementScope),
-                        });
-                    }
-                    else {
-                        const consumer = await (options.runtime?.codexOperationConsumerResolver ?? resolveCodexOperationConsumer)({
-                            cwd: options.commandOptions.cwd,
-                            env: runtimeEnv,
-                            runner: executionContext.nativeCliRunner,
-                            authorizer: options.runtime?.managedCodexAuthorizer,
-                            operationRequirement: getCodexOperationRequirement(codexRequirementScope),
-                            requiresNativeMaterialization: true,
-                        });
-                        if (consumer.support !== 'observed') {
-                            throw new Error('Codex native materialization requires an observed CLI consumer.');
-                        }
-                        executionContext.codexManager = consumer.manager;
-                    }
-                }
-                let lockedCodexPlans = activationConsumer?.support === 'assumed'
-                    ? await createCodexPlans(lockedPlan, 'assumed')
-                    : provisionalLockedCodexPlans;
-                if (executionContext.codexManager) {
-                    lockedPlan = await createPlan(stateInventory, executionContext.codexManager);
-                    assertWriteInventoryComplete(stateInventory, exactOwnedTextTargets(lockedPlan), exactSkillMarkerTargets(lockedPlan));
-                    lockedCodexPlans = await createCodexPlans(lockedPlan, 'observed', executionContext.codexManager);
-                }
-                const lockedPreparation = await prepareRenderedTargets(lockedPlan, lockedCodexPlans, true);
-                const lockedOperationPlan = createRebuildOperationPlan({
+                let lockedCodexPlans = provisionalLockedCodexPlans;
+                let lockedPreparation = await prepareRenderedTargets(lockedPlan, lockedCodexPlans, true);
+                let lockedOperationPlan = createRebuildOperationPlan({
                     command: options.command,
                     scope: options.commandOptions.scope,
                     dependencyPlan: lockedPlan,
@@ -2968,27 +3060,299 @@ export async function runRebuildCommand(options) {
                 }
                 if (options.runtime?.directCli
                     && options.commandOptions.yes !== true
-                    && (options.command === 'install'
-                        || options.command === 'sync'
-                        || options.command === 'reinstall')) {
+                    && lifecycleCommand) {
                     const sharedNativeImpact = lockedCodexPlans.some((plan) => plan.review.requiresConfirmation);
                     if (sharedNativeImpact) {
                         throw namespacedPreflightError('sharedNativeImpactAuthorizationRequired: Replacing or force-reinstalling shared Codex native state requires --yes.', preflightTargets);
                     }
                 }
-                if (options.runtime?.awHomeMutationToken) {
-                    const selectedRoots = selectedRootsForPlan(lockedPlan);
-                    await writeDesiredIntentSuperset({
-                        command: options.command,
-                        cwd: options.commandOptions.cwd,
-                        scope: options.commandOptions.scope,
-                        selectedRoots,
-                        plan: lockedPlan,
-                        codexPlan: lockedCodexPlans[0],
-                        preserveOtherCodexScopeRootIds,
-                        catalogEntries: intentCatalogEntries,
-                        env: runtimeEnv,
+                const operationPreparations = new Map();
+                const operationPreparationFailures = new Map();
+                const executionCommandFor = (entry, platform) => {
+                    const planned = lockedPlan.targets.find((target) => target.pluginId === entry.pluginId && target.platform === platform);
+                    const desiredInCurrentScope = platform === 'codex'
+                        && lockedCodexPlans.some((codexPlan) => codexPlan.desiredTargets.some((target) => target.pluginId === entry.pluginId && target.scopes.includes(planned.resolvedScope)));
+                    if (platform === 'codex' && options.command === 'sync' && !desiredInCurrentScope) {
+                        return 'cleanup';
+                    }
+                    if (platform === 'codex' && options.command === 'cleanup' && desiredInCurrentScope) {
+                        return 'install';
+                    }
+                    if (planned.action === 'move') {
+                        return planned.state === 'partial' ? 'reinstall' : 'install';
+                    }
+                    if (planned.relation === 'dependency'
+                        && (planned.action === 'install' || planned.action === 'reinstall')) {
+                        return planned.action;
+                    }
+                    return options.command;
+                };
+                const prepareLockedTargets = async (preparationOptions) => {
+                    const preparations = new Map();
+                    const failures = new Map();
+                    const states = new Map();
+                    const integration = createRebuildIntegration({
+                        context: executionContext,
+                        scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
+                        preparedTargets: [...lockedPreparation.preparedTargets.values()].map((entry) => entry.target),
                     });
+                    for (const { entry, platform } of executionSelections) {
+                        const key = `${entry.pluginId}\0${platform}`;
+                        if (preparationOptions.eligibleKeys
+                            && !preparationOptions.eligibleKeys.has(key)) {
+                            states.set(key, 'skipped');
+                            continue;
+                        }
+                        const directDependencyFailed = (entry.plugin.manifest.dependencies ?? []).some((pluginName) => {
+                            const dependencyPluginId = formatPluginId({
+                                sourceId: entry.source.sourceId,
+                                pluginName,
+                            });
+                            const state = states.get(`${dependencyPluginId}\0${platform}`);
+                            return state === 'failed' || state === 'skipped';
+                        });
+                        const planned = lockedPlan.targets.find((target) => target.pluginId === entry.pluginId && target.platform === platform);
+                        if (directDependencyFailed || planned.action === 'block') {
+                            states.set(key, 'skipped');
+                            continue;
+                        }
+                        const preparationError = lockedPreparation.preparedTargetErrors.get(key);
+                        const prepared = lockedPreparation.preparedTargets.get(key);
+                        if (preparationError || !prepared) {
+                            const message = preparationError instanceof Error
+                                ? preparationError.message
+                                : String(preparationError ?? 'Target preparation did not produce a target.');
+                            failures.set(key, failedResult(options.command, {
+                                sourceId: entry.source.sourceId,
+                                sourceIdentity: entry.source.sourceIdentity,
+                                pluginId: entry.pluginId,
+                                pluginName: entry.plugin.manifest.name,
+                                pluginVersion: entry.plugin.manifest.version,
+                                platform,
+                                scope: planned.resolvedScope,
+                                cwd: options.commandOptions.cwd,
+                            }, message));
+                            states.set(key, 'failed');
+                            continue;
+                        }
+                        const executionCommand = executionCommandFor(entry, platform);
+                        if (executionCommand === 'cleanup' || executionCommand === 'uninstall') {
+                            states.set(key, 'ready');
+                            continue;
+                        }
+                        const preparedOperation = await prepareRebuildOperation({
+                            command: executionCommand,
+                            target: prepared.target,
+                            driver: integration.driver,
+                            ...(preparationOptions.skipPreApply ? { skipPreApply: true } : {}),
+                            ...(preparationOptions.deferManagedNativeInspection
+                                && platform === 'codex'
+                                && executionContext.codexManager === undefined
+                                && (prepared.target.writeNativeRequired ?? prepared.target.requiresNative)
+                                ? { deferNativeInspection: true }
+                                : {}),
+                            onActionEvent: (event) => emitRebuildActionEvent(executionContext, event),
+                        });
+                        if (preparedOperation.status === 'failed') {
+                            failures.set(key, preparedOperation.result);
+                            states.set(key, 'failed');
+                            continue;
+                        }
+                        preparations.set(key, preparedOperation.preparation);
+                        states.set(key, 'ready');
+                    }
+                    return { preparations, failures };
+                };
+                if (lifecycleCommand) {
+                    const initialPreparation = await prepareLockedTargets({
+                        deferManagedNativeInspection: codexManagerRequired,
+                    });
+                    for (const [key, preparation] of initialPreparation.preparations) {
+                        operationPreparations.set(key, preparation);
+                    }
+                    for (const [key, failure] of initialPreparation.failures) {
+                        operationPreparationFailures.set(key, failure);
+                    }
+                    const nativePreparationKeys = new Set([...operationPreparations].flatMap(([key, preparation]) => preparation.target.identity.platform === 'codex'
+                        && (preparation.target.writeNativeRequired ?? preparation.target.requiresNative)
+                        ? [key]
+                        : []));
+                    const activationPluginIds = new Set(provisionalLockedCodexPlans.flatMap((plan) => plan.postcheck.plugins.map((plugin) => plugin.pluginId)));
+                    const activationPreparationKeys = new Set([...operationPreparations].flatMap(([key, preparation]) => preparation.target.identity.platform === 'codex'
+                        && preparation.target.identity.pluginId
+                        && activationPluginIds.has(preparation.target.identity.pluginId)
+                        ? [key]
+                        : []));
+                    const codexRequirementScopeFor = (keys) => {
+                        const pluginIds = new Set([...keys].flatMap((key) => {
+                            const pluginId = operationPreparations.get(key)?.target.identity.pluginId;
+                            return pluginId ? [pluginId] : [];
+                        }));
+                        return provisionalLockedCodexPlans.some((plan) => plan.desiredTargets.some((target) => pluginIds.has(target.pluginId) && target.scopes.includes('project')))
+                            ? 'project'
+                            : 'user';
+                    };
+                    let refreshManagedNativePlan = false;
+                    const failPreparedTargets = (keys, error) => {
+                        const message = error instanceof Error ? error.message : String(error);
+                        for (const key of keys) {
+                            const target = operationPreparations.get(key)?.target;
+                            if (!target)
+                                continue;
+                            operationPreparations.delete(key);
+                            operationPreparationFailures.set(key, failedResult(options.command, target.identity, message));
+                        }
+                    };
+                    if (executionContext.codexManager === undefined
+                        && nativePreparationKeys.size > 0) {
+                        try {
+                            if (options.runtime?.codexManagerResolver) {
+                                executionContext.codexManager = await options.runtime.codexManagerResolver({
+                                    cwd: options.commandOptions.cwd,
+                                    env: runtimeEnv,
+                                    runner: executionContext.nativeCliRunner,
+                                    authorizer: options.runtime?.managedCodexAuthorizer,
+                                    operationRequirement: getCodexOperationRequirement(codexRequirementScopeFor(nativePreparationKeys)),
+                                });
+                            }
+                            else {
+                                const consumer = await (options.runtime?.codexOperationConsumerResolver ?? resolveCodexOperationConsumer)({
+                                    cwd: options.commandOptions.cwd,
+                                    env: runtimeEnv,
+                                    runner: executionContext.nativeCliRunner,
+                                    authorizer: options.runtime?.managedCodexAuthorizer,
+                                    operationRequirement: getCodexOperationRequirement(codexRequirementScopeFor(nativePreparationKeys)),
+                                    requiresNativeMaterialization: true,
+                                });
+                                if (consumer.support !== 'observed') {
+                                    throw new Error('Codex native materialization requires an observed CLI consumer.');
+                                }
+                                executionContext.codexManager = consumer.manager;
+                            }
+                            refreshManagedNativePlan = true;
+                        }
+                        catch (error) {
+                            failPreparedTargets(nativePreparationKeys, error);
+                        }
+                    }
+                    else if (executionContext.codexManager === undefined
+                        && activationPreparationKeys.size > 0) {
+                        try {
+                            const consumer = await (options.runtime?.codexOperationConsumerResolver ?? resolveCodexOperationConsumer)({
+                                cwd: options.commandOptions.cwd,
+                                env: runtimeEnv,
+                                runner: executionContext.nativeCliRunner,
+                                operationRequirement: getCodexOperationRequirement(codexRequirementScopeFor(activationPreparationKeys)),
+                                requiresNativeMaterialization: false,
+                            });
+                            if (consumer.support === 'observed') {
+                                executionContext.codexManager = consumer.manager;
+                            }
+                            else {
+                                lockedCodexPlans = lockedCodexPlans.map((plan) => ({
+                                    ...plan,
+                                    warnings: [...new Set([
+                                            ...plan.warnings,
+                                            'codexProjectActivationAssumed',
+                                        ])],
+                                    postcheck: { ...plan.postcheck, support: 'assumed' },
+                                }));
+                            }
+                        }
+                        catch (error) {
+                            failPreparedTargets(activationPreparationKeys, error);
+                        }
+                    }
+                    if (executionContext.codexManager) {
+                        executionContext.codexObservationSession?.setManager(executionContext.codexManager);
+                    }
+                    if (refreshManagedNativePlan) {
+                        if (executionContext.codexManager) {
+                            lockedPlan = await createPlan(stateInventory, executionContext.codexManager);
+                            assertWriteInventoryComplete(stateInventory, exactOwnedTextTargets(lockedPlan), exactSkillMarkerTargets(lockedPlan));
+                        }
+                        lockedCodexPlans = await createCodexPlans(lockedPlan, 'observed', executionContext.codexManager);
+                        lockedPreparation = await prepareRenderedTargets(lockedPlan, lockedCodexPlans, false);
+                        const eligibleKeys = new Set(operationPreparations.keys());
+                        const initialOperationPreparations = new Map(operationPreparations);
+                        const finalPreparation = await prepareLockedTargets({
+                            eligibleKeys,
+                            skipPreApply: true,
+                        });
+                        operationPreparations.clear();
+                        for (const [key, preparation] of finalPreparation.preparations) {
+                            operationPreparations.set(key, {
+                                ...preparation,
+                                actions: [
+                                    ...(initialOperationPreparations.get(key)?.actions ?? []),
+                                    ...preparation.actions,
+                                ],
+                            });
+                        }
+                        for (const [key, failure] of finalPreparation.failures) {
+                            operationPreparationFailures.set(key, failure);
+                        }
+                    }
+                    const eligibleTargets = [...operationPreparations.keys()].flatMap((key) => {
+                        const prepared = lockedPreparation.preparedTargets.get(key);
+                        return prepared ? [prepared.target] : [];
+                    });
+                    lockedPreparation.integration.setNativeMarketplaceEligibleTargets(eligibleTargets);
+                }
+                lockedOperationPlan = createRebuildOperationPlan({
+                    command: options.command,
+                    scope: options.commandOptions.scope,
+                    dependencyPlan: lockedPlan,
+                    codexPlans: lockedCodexPlans,
+                    targetActions: lockedPreparation.targetActions,
+                    catalogSources: catalog.sources.flatMap((source) => source.resolution ? [source.resolution] : []),
+                    intentBeforeByScope,
+                    configDigests: lockedPreparation.configDigests,
+                    catalogEntries: intentCatalogEntries,
+                });
+                if (options.runtime?.expectedPlanFingerprint) {
+                    assertOperationPlanFingerprint(options.runtime.expectedPlanFingerprint, lockedOperationPlan);
+                }
+                if (options.runtime?.directCli
+                    && options.commandOptions.yes !== true
+                    && lifecycleCommand
+                    && lockedCodexPlans.some((plan) => plan.review.requiresConfirmation)) {
+                    throw namespacedPreflightError('sharedNativeImpactAuthorizationRequired: Replacing or force-reinstalling shared Codex native state requires --yes.', preflightTargets);
+                }
+                if (options.runtime?.awHomeMutationToken) {
+                    if (lifecycleCommand) {
+                        const preparedKeys = new Set(operationPreparations.keys());
+                        const intentSelection = intentPlanForPreparedRoots(lockedPlan, preparedKeys);
+                        const intentPlan = intentSelection.plan;
+                        const selectedRoots = intentSelection.selectedRoots;
+                        if (selectedRoots.length > 0) {
+                            await writeDesiredIntentSuperset({
+                                command: options.command,
+                                cwd: options.commandOptions.cwd,
+                                scope: options.commandOptions.scope,
+                                selectedRoots,
+                                plan: intentPlan,
+                                codexPlan: lockedCodexPlans[0],
+                                preserveOtherCodexScopeRootIds,
+                                catalogEntries: intentCatalogEntries,
+                                env: runtimeEnv,
+                            });
+                        }
+                    }
+                    else {
+                        const selectedRoots = selectedRootsForPlan(lockedPlan);
+                        await writeDesiredIntentSuperset({
+                            command: options.command,
+                            cwd: options.commandOptions.cwd,
+                            scope: options.commandOptions.scope,
+                            selectedRoots,
+                            plan: lockedPlan,
+                            codexPlan: lockedCodexPlans[0],
+                            preserveOtherCodexScopeRootIds,
+                            catalogEntries: intentCatalogEntries,
+                            env: runtimeEnv,
+                        });
+                    }
                 }
                 for (const pluginName of new Set(lockedPlan.targets.flatMap((target) => target.platform === 'claude'
                     && (target.action === 'install'
@@ -3142,7 +3506,6 @@ export async function runRebuildCommand(options) {
                     }
                 }
                 const results = [];
-                const deferredPostApplyTasks = [];
                 const dependencyStates = new Map();
                 for (const { entry, platform } of executionSelections) {
                     const planned = lockedPlan.targets.find((target) => target.pluginId === entry.pluginId && target.platform === platform);
@@ -3230,6 +3593,27 @@ export async function runRebuildCommand(options) {
                         dependencyStates.set(`${entry.pluginId}\0${platform}`, failedDependency || failedConsumer ? 'skipped' : 'failed');
                         continue;
                     }
+                    const operationPreparationFailure = operationPreparationFailures.get(`${entry.pluginId}\0${platform}`);
+                    if (operationPreparationFailure) {
+                        const targetResult = toTargetResult(operationPreparationFailure);
+                        results.push({
+                            platforms: [platform],
+                            plugins: [],
+                            warnings: [],
+                            rebuildResults: [operationPreparationFailure],
+                            targetResults: [{ ...targetResult, action: planned.action }],
+                            overallState: 'failed',
+                            receiptTargets: [{
+                                    pluginName: identity.pluginName,
+                                    pluginId: identity.pluginId,
+                                    sourceId: identity.sourceId,
+                                    platform,
+                                    scope: planned.resolvedScope,
+                                }],
+                        });
+                        dependencyStates.set(`${entry.pluginId}\0${platform}`, 'failed');
+                        continue;
+                    }
                     if (reconcileActivationOnly) {
                         const preparedError = preparedTargetErrors.get(`${entry.pluginId}\0${platform}`);
                         if (preparedError) {
@@ -3255,43 +3639,55 @@ export async function runRebuildCommand(options) {
                             dependencyStates.set(`${entry.pluginId}\0${platform}`, 'failed');
                             continue;
                         }
-                        const warnings = [];
-                        const result = {
+                        const actions = operationPreparations.get(`${entry.pluginId}\0${platform}`)?.actions
+                            ?? [];
+                        const preparedTarget = preparedTargets.get(`${entry.pluginId}\0${platform}`)?.target;
+                        let result;
+                        if (preparedTarget) {
+                            const nativeSkillKeys = new Set((entry.plugin.manifest.artifacts?.targets ?? [])
+                                .filter((target) => target.platform === 'codex'
+                                && target.target === 'codex.skill'
+                                && target.delivery?.mode === 'codex-native')
+                                .map((target) => target.skillKey));
+                            const marketplaceRoot = preparedTarget.identity.marketplaceRoot;
+                            const legacyNativeSkills = preparedTarget.ownedComponents.filter((component) => component.kind === 'skill-directory'
+                                && nativeSkillKeys.has(component.identity.artifactKey)
+                                && (!marketplaceRoot || path.relative(marketplaceRoot, component.path).startsWith('..')));
+                            if (legacyNativeSkills.length > 0) {
+                                result = await executeRebuildComponentCleanup({
+                                    command: options.command,
+                                    target: preparedTarget,
+                                    driver: lockedPreparation.integration.driver,
+                                    components: legacyNativeSkills,
+                                    actions,
+                                    onActionEvent: (event) => emitRebuildActionEvent(executionContext, event),
+                                    ...(rebuildCommandTestHooks?.beforeActivationLegacyCleanupMutation ? {
+                                        beforeMutation: rebuildCommandTestHooks.beforeActivationLegacyCleanupMutation,
+                                    } : {}),
+                                    ...(rebuildCommandTestHooks?.afterActivationLegacyCleanupQuarantine ? {
+                                        afterQuarantine: rebuildCommandTestHooks.afterActivationLegacyCleanupQuarantine,
+                                    } : {}),
+                                });
+                            }
+                        }
+                        result ??= {
                             status: 'succeeded', command: options.command, target: identity,
-                            actions: [{ name: 'postApply', status: 'succeeded' }],
+                            actions,
                             cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
                         };
-                        deferredPostApplyTasks.push({
-                            pluginId: entry.pluginId,
-                            run: () => runPostApplyScript({
-                                plugin: entry.plugin,
-                                platform,
-                                scope: planned.resolvedScope,
-                                cwd: options.commandOptions.cwd,
-                                context: executionContext,
-                                artifacts: [],
-                                components: [{
-                                        kind: 'target',
-                                        key: `${platform}:${planned.resolvedScope}`,
-                                        outcome: 'unchanged',
-                                    }],
-                                scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
-                            }),
-                            onFailure: (error) => {
-                                warnings.push(error instanceof Error ? error.message : String(error));
-                                result.actions[0].status = 'failed';
-                            },
-                        });
                         results.push({
-                            platforms: [platform], plugins: [identity.pluginName], warnings, rebuildResults: [result],
-                            targetResults: [{ target: identity, action: planned.action, state: 'completed' }],
-                            overallState: 'succeeded',
+                            platforms: [platform],
+                            plugins: result.status === 'succeeded' ? [identity.pluginName] : [],
+                            warnings: result.failures.map((failure) => failure.message),
+                            rebuildResults: [result],
+                            targetResults: [{ ...toTargetResult(result), action: planned.action }],
+                            overallState: result.status === 'succeeded' ? 'succeeded' : 'failed',
                             receiptTargets: [{
                                     pluginName: identity.pluginName, pluginId: identity.pluginId,
                                     sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
                                 }],
                         });
-                        dependencyStates.set(`${entry.pluginId}\0${platform}`, 'completed');
+                        dependencyStates.set(`${entry.pluginId}\0${platform}`, result.status === 'succeeded' ? 'completed' : 'failed');
                         continue;
                     }
                     if (platform === 'codex'
@@ -3318,33 +3714,39 @@ export async function runRebuildCommand(options) {
                         && !reconcileObsolete
                         && options.command !== 'cleanup'
                         && options.command !== 'uninstall') {
-                        const warnings = [];
-                        try {
-                            await runPostApplyScript({
-                                plugin: entry.plugin,
-                                platform,
-                                scope: planned.resolvedScope,
-                                cwd: options.commandOptions.cwd,
-                                context: executionContext,
-                                artifacts: [],
-                                components: [{
-                                        kind: 'target',
-                                        key: `${platform}:${planned.resolvedScope}`,
-                                        outcome: 'unchanged',
+                        const preparedError = preparedTargetErrors.get(`${entry.pluginId}\0${platform}`);
+                        if (preparedError) {
+                            const message = preparedError instanceof Error
+                                ? preparedError.message
+                                : String(preparedError);
+                            const result = failedResult(options.command, identity, message);
+                            results.push({
+                                platforms: [platform], plugins: [], warnings: [], rebuildResults: [result],
+                                targetResults: [{
+                                        target: identity,
+                                        action: planned.action,
+                                        state: 'failed',
+                                        errorCode: message.split(':', 1)[0] ?? 'targetPreparationFailed',
+                                        message,
+                                    }],
+                                overallState: 'failed',
+                                receiptTargets: [{
+                                        pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                        sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
                                     }],
-                                scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
                             });
+                            dependencyStates.set(`${entry.pluginId}\0${platform}`, 'failed');
+                            continue;
                         }
-                        catch (error) {
-                            warnings.push(error instanceof Error ? error.message : String(error));
-                        }
+                        const actions = operationPreparations.get(`${entry.pluginId}\0${platform}`)?.actions
+                            ?? [];
                         const result = {
                             status: 'succeeded', command: options.command, target: identity,
-                            actions: [{ name: 'postApply', status: warnings.length > 0 ? 'failed' : 'succeeded' }],
+                            actions,
                             cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
                         };
                         results.push({
-                            platforms: [platform], plugins: [identity.pluginName], warnings, rebuildResults: [result],
+                            platforms: [platform], plugins: [identity.pluginName], warnings: [], rebuildResults: [result],
                             targetResults: [{ target: identity, action: 'keep', state: 'completed' }],
                             overallState: 'succeeded',
                             receiptTargets: [{
@@ -3359,6 +3761,7 @@ export async function runRebuildCommand(options) {
                     const namespacedSource = {
                         sourceId: entry.source.sourceId,
                         sourceIdentity: entry.source.sourceIdentity,
+                        logicalIdentity: entry.source.logicalIdentity,
                         marketplaceName,
                         marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
                     };
@@ -3400,6 +3803,7 @@ export async function runRebuildCommand(options) {
                                         : {}),
                                     sourceId: entry.source.sourceId,
                                     sourceIdentity: entry.source.sourceIdentity,
+                                    logicalIdentity: entry.source.logicalIdentity,
                                     resolvedCommit: entry.source.resolvedCommit,
                                     manifestDigest: entry.source.manifestDigest,
                                     snapshotDigest: entry.source.snapshotDigest,
@@ -3411,10 +3815,10 @@ export async function runRebuildCommand(options) {
                             reviewCompleted: true,
                             targetHookCompleted: true,
                             prepared: preparedTargets.get(`${entry.pluginId}\0${platform}`),
+                            operationPreparation: operationPreparations.get(`${entry.pluginId}\0${platform}`),
+                            integration: lockedPreparation.integration,
                             preparationError: preparedTargetErrors.get(`${entry.pluginId}\0${platform}`),
-                            ...(platform === 'codex' && lockedCodexPlans.length > 0
-                                ? { deferredPostApplyTasks }
-                                : {}),
+                            skipPreApply: reconcileDesiredCleanup,
                         },
                     });
                     if (reconcileDesiredCleanup) {
@@ -3426,14 +3830,84 @@ export async function runRebuildCommand(options) {
                     results.push(executionResult);
                     dependencyStates.set(`${entry.pluginId}\0${platform}`, executionResult.overallState === 'succeeded' ? 'completed' : 'failed');
                 }
+                const failCompletedCodexTarget = (options_) => {
+                    const resultIndex = results.findIndex((candidate) => candidate.targetResults.some((target) => target.target.pluginId === options_.identity.pluginId
+                        && target.target.platform === 'codex'
+                        && target.target.scope === options_.identity.scope));
+                    if (resultIndex === -1)
+                        return false;
+                    const existing = results[resultIndex];
+                    const phase = options_.phase ?? 'postcheck.inspect';
+                    const rebuildResults = existing.rebuildResults.map((rebuild) => {
+                        if (rebuild.target.pluginId !== options_.identity.pluginId
+                            || rebuild.target.platform !== 'codex'
+                            || rebuild.target.scope !== options_.identity.scope)
+                            return rebuild;
+                        if (!rebuild.failures.some((failure) => failure.phase === phase && failure.message === options_.message)) {
+                            rebuild.failures.unshift({ phase, message: options_.message });
+                        }
+                        return {
+                            ...rebuild,
+                            status: 'failed',
+                            actions: rebuild.actions,
+                            error: { phase, message: options_.message },
+                        };
+                    });
+                    results[resultIndex] = {
+                        ...existing,
+                        plugins: existing.plugins.filter((pluginName) => pluginName !== options_.identity.pluginName),
+                        rebuildResults,
+                        targetResults: existing.targetResults.map((target) => target.target.pluginId === options_.identity.pluginId
+                            && target.target.platform === 'codex'
+                            && target.target.scope === options_.identity.scope
+                            ? {
+                                ...target,
+                                target: options_.identity,
+                                action: options_.action ?? target.action,
+                                state: 'failed',
+                                errorCode: options_.message.split(':', 1)[0] ?? 'codexActivationPostcheckFailed',
+                                message: options_.message,
+                                ...(options_.recoveryActions
+                                    ? { recoveryActions: options_.recoveryActions }
+                                    : {}),
+                            }
+                            : target),
+                        overallState: 'failed',
+                    };
+                    dependencyStates.set(`${options_.identity.pluginId}\0codex`, 'failed');
+                    return true;
+                };
+                const activationMutationPluginIds = new Set(lockedCodexPlans.flatMap((plan) => [
+                    ...plan.activationActions.user,
+                    ...plan.activationActions.project,
+                ].flatMap((action) => action.action === 'none' ? [] : [action.pluginId])));
+                for (const { entry, platform } of executionSelections) {
+                    if (platform !== 'codex'
+                        || !activationMutationPluginIds.has(entry.pluginId)
+                        || (dependencyStates.get(`${entry.pluginId}\0${platform}`) !== 'completed'
+                            && dependencyStates.get(`${entry.pluginId}\0${platform}`) !== 'kept'))
+                        continue;
+                    const prepared = preparedTargets.get(`${entry.pluginId}\0${platform}`)?.target;
+                    if (!prepared)
+                        continue;
+                    try {
+                        await lockedPreparation.integration.prepareNativeMarketplaceGroup(prepared);
+                    }
+                    catch (error) {
+                        const message = error instanceof Error ? error.message : String(error);
+                        failCompletedCodexTarget({ identity: prepared.identity, message, phase: 'native.write' });
+                    }
+                }
                 const successfulCodexPluginIds = new Set(executionSelections.flatMap(({ entry, platform }) => platform === 'codex'
                     && (dependencyStates.get(`${entry.pluginId}\0${platform}`) === 'completed'
                         || dependencyStates.get(`${entry.pluginId}\0${platform}`) === 'kept')
                     ? [entry.pluginId]
                     : []));
                 const activationPlans = selectCodexActivationPlans(lockedCodexPlans, successfulCodexPluginIds);
-                if (activationPlans.length > 0 || deferredPostApplyTasks.length > 0) {
-                    let failedActivationPluginIds = new Set();
+                if (activationPlans.length > 0
+                    || lockedPreparation.integration.driver.completePostchecks) {
+                    let activationError;
+                    const activationMutationMarketplaces = new Set();
                     try {
                         if (activationPlans.length > 0) {
                             await executeCodexReconcileActivations({
@@ -3442,23 +3916,67 @@ export async function runRebuildCommand(options) {
                                 env: runtimeEnv,
                                 manager: executionContext.codexManager,
                                 runner: executionContext.nativeCliRunner,
+                                observationSession: executionContext.codexObservationSession,
+                                preflightCompleted: true,
+                                mutationMarketplaces: activationMutationMarketplaces,
+                                observationScopeByMarketplace: codexObservationScopeByMarketplace,
                             });
                         }
                     }
                     catch (error) {
-                        failedActivationPluginIds = failedCodexActivationPluginIds({
-                            error,
+                        activationError = error;
+                    }
+                    try {
+                        await lockedPreparation.integration.captureCodexPostMutationSnapshots([...activationMutationMarketplaces]);
+                    }
+                    catch (error) {
+                        activationError ??= error;
+                    }
+                    const failedCodexPluginIds = new Set(executionSelections.flatMap(({ entry, platform }) => platform === 'codex'
+                        && (dependencyStates.get(`${entry.pluginId}\0${platform}`) === 'failed'
+                            || dependencyStates.get(`${entry.pluginId}\0${platform}`) === 'skipped')
+                        ? [entry.pluginId]
+                        : []));
+                    for (const failure of await lockedPreparation.integration.driver.completePostchecks?.() ?? []) {
+                        const message = failure.error instanceof Error
+                            ? failure.error.message
+                            : String(failure.error);
+                        if (failCompletedCodexTarget({ identity: failure.target.identity, message })) {
+                            failedCodexPluginIds.add(failure.target.identity.pluginId ?? failure.target.identity.pluginName);
+                        }
+                    }
+                    if (!activationError && activationPlans.length > 0) {
+                        const postcheckPluginIds = new Set([...successfulCodexPluginIds]
+                            .filter((pluginId) => !failedCodexPluginIds.has(pluginId)));
+                        const postcheckPlans = selectCodexActivationPlans(activationPlans, postcheckPluginIds);
+                        try {
+                            await postcheckCodexReconcileActivations({
+                                plans: postcheckPlans,
+                                cwd: options.commandOptions.cwd,
+                                env: runtimeEnv,
+                                manager: executionContext.codexManager,
+                                runner: executionContext.nativeCliRunner,
+                                observationScopeByMarketplace: codexObservationScopeByMarketplace,
+                                observationSession: executionContext.codexObservationSession,
+                            });
+                        }
+                        catch (error) {
+                            activationError = error;
+                        }
+                    }
+                    if (activationError) {
+                        const failedActivationPluginIds = failedCodexActivationPluginIds({
+                            error: activationError,
                             plans: activationPlans,
                             successfulPluginIds: successfulCodexPluginIds,
                         });
-                        for (const pluginId of failedActivationPluginIds) {
-                            dependencyStates.set(`${pluginId}\0codex`, 'failed');
-                        }
-                        const message = error instanceof Error ? error.message : String(error);
+                        const message = activationError instanceof Error
+                            ? activationError.message
+                            : String(activationError);
                         const failedSelections = executionSelections.filter((candidate) => candidate.platform === 'codex'
                             && failedActivationPluginIds.has(candidate.entry.pluginId));
                         if (failedSelections.length === 0)
-                            throw error;
+                            throw activationError;
                         for (const selection of failedSelections) {
                             const planned = lockedPlan.targets.find((target) => target.pluginId === selection.entry.pluginId && target.platform === 'codex');
                             const identity = {
@@ -3471,44 +3989,48 @@ export async function runRebuildCommand(options) {
                                 scope: planned.resolvedScope,
                                 cwd: options.commandOptions.cwd,
                             };
-                            const resultIndex = results.findIndex((candidate) => candidate.targetResults.some((target) => target.target.pluginId === identity.pluginId
-                                && target.target.platform === 'codex'
-                                && target.target.scope === identity.scope));
-                            if (resultIndex === -1)
-                                throw error;
-                            const existing = results[resultIndex];
-                            const failed = failedResult(options.command, identity, message, 'postcheck.inspect');
-                            results[resultIndex] = {
-                                ...existing,
-                                plugins: existing.plugins.filter((pluginName) => pluginName !== identity.pluginName),
-                                rebuildResults: existing.rebuildResults.map((rebuild) => rebuild.target.pluginId === identity.pluginId
-                                    && rebuild.target.platform === 'codex'
-                                    && rebuild.target.scope === identity.scope
-                                    ? failed
-                                    : rebuild),
-                                targetResults: existing.targetResults.map((target) => target.target.pluginId === identity.pluginId
-                                    && target.target.platform === 'codex'
-                                    && target.target.scope === identity.scope
-                                    ? {
-                                        target: identity,
-                                        action: target.action,
-                                        state: 'failed',
-                                        errorCode: message.split(':', 1)[0] ?? 'codexActivationPostcheckFailed',
-                                        message,
-                                    }
-                                    : target),
-                                overallState: 'failed',
-                            };
+                            if (!failCompletedCodexTarget({ identity, message }))
+                                throw activationError;
+                            failedCodexPluginIds.add(selection.entry.pluginId);
                         }
                     }
-                    for (const task of deferredPostApplyTasks) {
-                        if (failedActivationPluginIds.has(task.pluginId))
-                            continue;
-                        try {
-                            await task.run();
-                        }
-                        catch (error) {
-                            task.onFailure(error);
+                    let propagated = true;
+                    while (propagated) {
+                        propagated = false;
+                        for (const selection of executionSelections.filter((candidate) => candidate.platform === 'codex')) {
+                            if (failedCodexPluginIds.has(selection.entry.pluginId))
+                                continue;
+                            const failedDependency = (selection.entry.plugin.manifest.dependencies ?? [])
+                                .map((pluginName) => formatPluginId({
+                                sourceId: selection.entry.source.sourceId,
+                                pluginName,
+                            }))
+                                .find((pluginId) => failedCodexPluginIds.has(pluginId));
+                            if (!failedDependency)
+                                continue;
+                            const planned = lockedPlan.targets.find((target) => target.pluginId === selection.entry.pluginId && target.platform === 'codex');
+                            const identity = {
+                                sourceId: selection.entry.source.sourceId,
+                                sourceIdentity: selection.entry.source.sourceIdentity,
+                                pluginId: selection.entry.pluginId,
+                                pluginName: selection.entry.plugin.manifest.name,
+                                pluginVersion: selection.entry.plugin.manifest.version,
+                                platform: 'codex',
+                                scope: planned.resolvedScope,
+                                cwd: options.commandOptions.cwd,
+                            };
+                            const message = `dependencyInstallFailed: ${selection.entry.pluginId} requires failed dependency ${failedDependency}.`;
+                            if (failCompletedCodexTarget({
+                                identity,
+                                message,
+                                recoveryActions: [
+                                    `run aw sync --all --platform codex --scope ${planned.resolvedScope}`,
+                                ],
+                            })) {
+                                failedCodexPluginIds.add(selection.entry.pluginId);
+                                dependencyStates.set(`${selection.entry.pluginId}\0codex`, 'failed');
+                                propagated = true;
+                            }
                         }
                     }
                 }
@@ -3524,8 +4046,9 @@ export async function runRebuildCommand(options) {
                         return {
                             ...target,
                             recoveryActions: [
-                                `run aw cleanup ${planned.pluginId} --platform ${planned.platform} --scope ${planned.preservedScope}`,
-                                `then run aw sync --all --platform ${planned.platform} --scope ${planned.resolvedScope}`,
+                                `remove every direct and indirect dependent of ${planned.pluginId} in consumer-first order; if dependencyStillRequired is reported, handle the other reported dependents first`,
+                                `then run aw cleanup ${planned.pluginId} --platform ${planned.platform} --scope ${planned.preservedScope}`,
+                                `then reinstall every removed root at its original platform and scope, selecting --dependency-scope ${planned.pluginId}#${planned.platform}=${planned.resolvedScope} during each install`,
                             ],
                         };
                     });
@@ -3561,6 +4084,7 @@ export async function runRebuildCommand(options) {
                                 namespacedSource: {
                                     sourceId: entry.source.sourceId,
                                     sourceIdentity: entry.source.sourceIdentity,
+                                    logicalIdentity: entry.source.logicalIdentity,
                                     marketplaceName,
                                     marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
                                 },
@@ -3585,7 +4109,7 @@ export async function runRebuildCommand(options) {
                     merged.warnings.push(MALFORMED_CONFIG_PRESERVED_WARNING);
                 }
                 merged.dependencyPlan = lockedPlan;
-                merged.overallState = reconcileOverallState(merged.targetResults, lockedPlan);
+                merged.overallState = reconcileOverallState(merged.targetResults, lockedPlan, merged.rebuildResults);
                 if (lockedCodexPlans.length > 0)
                     merged.codexReconcilePlans = lockedCodexPlans;
                 merged.operationPlan = lockedOperationPlan;
@@ -3596,8 +4120,8 @@ export async function runRebuildCommand(options) {
             try {
                 await (options.runtime?.removeObsoleteInstallationContracts ?? fs.remove)(path.join(resolveAwHome(runtimeEnv), 'installation-contracts'));
             }
-            catch (error) {
-                resolvedResult.warnings.push(`obsoleteContractsCleanupFailed: ${error instanceof Error ? error.message : String(error)}`);
+            catch {
+                resolvedResult.warnings.push(OBSOLETE_CONTRACTS_CLEANUP_WARNING);
             }
         }
         return resolvedResult;
@@ -3623,4 +4147,25 @@ export async function runRebuildCommand(options) {
         throw error;
     }
 }
+export async function runRebuildCommand(options) {
+    if (options.runtime?.codexObservationSession) {
+        return runRebuildCommandInSession(options);
+    }
+    const env = options.runtime?.env ?? process.env;
+    const session = await createCodexNativeObservationSession({
+        exactCwd: options.commandOptions.cwd,
+        env,
+        runner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
+        manager: options.runtime?.codexManager,
+    });
+    try {
+        return await runRebuildCommandInSession({
+            ...options,
+            runtime: { ...options.runtime, codexObservationSession: session },
+        });
+    }
+    finally {
+        await session.dispose();
+    }
+}
 //# sourceMappingURL=rebuild-command.js.map