@lesliechan721/aw 0.1.0-beta.10 → 0.1.0-beta.12

package/dist/src/utils/plugin-config-write.js

@@ -1,12 +1,13 @@
-import { stablePluginConfigStringify } from '@lesliechan721/aw-plugin-core/manifest';
 import { statusCommandV7, statusTargetIntent, } from '../commands/status-v6.js';
 import { syncWriteCommand } from '../commands/write-commands.js';
 import { CONFIG_MUTATION_RECEIPT_SCHEMA_VERSION, } from '../types.js';
 import { getDefaultNativeCliRunner } from './native-cli.js';
 import { assertReadyPluginConfigStore, assertSafePluginConfigSegment, codexNativeRefreshKeys, coercePluginConfigUpdates, patchPluginConfigStore, readPluginConfigStore, readNamespacedPluginConfigStoreIdentity, resetPluginConfigStore, resolveConfigRead, resolveEffectivePluginConfig, resolvePluginConfigStorePath, resolvePluginConfigSchemaAccess, summarizeEffectivePluginConfig, } from './plugin-config.js';
+import { analyzePluginConfigMutationImpact } from './plugin-config-impact.js';
 import { collectSensitivePluginConfigValues, redactPluginScriptOutput, } from './plugin-scripts.js';
 import { resolveClaudeProjectKey, resolveCodexProjectKey } from './paths.js';
 import { withAwHomeMutationLock, } from './aw-home-mutation-lock.js';
+import { assertProjectSharedConfigPathVisible, } from './project-boundary.js';
 export function buildConfigMutationReceipt(command, receipt) {
     return {
         ...receipt,
@@ -14,6 +15,60 @@ export function buildConfigMutationReceipt(command, receipt) {
         command,
     };
 }
+function publicConfigApplyTargetResult(result) {
+    return {
+        target: {
+            pluginName: result.target.pluginName,
+            ...(result.target.pluginId ? { pluginId: result.target.pluginId } : {}),
+            platform: result.target.platform,
+            scope: result.target.scope,
+        },
+        action: result.action,
+        state: result.state,
+        ...(result.message ? { message: result.message } : {}),
+        ...(result.errorCode ? { errorCode: result.errorCode } : {}),
+        ...(result.relation ? { relation: result.relation } : {}),
+        ...(result.requiredBy ? { requiredBy: result.requiredBy } : {}),
+    };
+}
+function publicConfigApplyResult(apply) {
+    if (apply.state === 'skipped')
+        return apply;
+    return {
+        ...apply,
+        targetResults: apply.targetResults.map(publicConfigApplyTargetResult),
+    };
+}
+export function configWriteStateForError(error) {
+    return error?.configWrite === 'failed'
+        ? 'failed'
+        : 'notStarted';
+}
+function markConfigWriteFailed(error) {
+    const failure = error instanceof Error ? error : new Error(String(error));
+    return Object.assign(failure, { configWrite: 'failed' });
+}
+function skippedApply(reason) {
+    return { state: 'skipped', reason, targetResults: [] };
+}
+function unavailableApply(reason, stage, targetResults = []) {
+    const messages = {
+        invalidConfig: 'The effective config is invalid for every visible target.',
+        schemaUnavailable: 'The config schema is unavailable after the config commit.',
+        sourceUnavailable: 'The plugin source is unavailable after the config commit.',
+        effectiveConfigUnavailable: 'The effective config cannot be read after the config commit.',
+        targetDiscoveryFailed: 'Visible config apply targets cannot be discovered after the config commit.',
+    };
+    return {
+        state: 'unavailable',
+        reason,
+        targetResults,
+        error: { stage, code: reason, message: messages[reason] },
+    };
+}
+function overallStateForApply(apply) {
+    return apply.state === 'succeeded' || apply.state === 'skipped' ? 'succeeded' : 'partial';
+}
 function uniqueInOrder(values) {
     return [...new Set(values)];
 }
@@ -91,6 +146,9 @@ async function reinstallVisibleTargets(options) {
         : { targets: dedupeTargets(options.applyTargets), failures: [] });
     const targetResults = [...discovered.failures];
     let runtimeFailed = discovered.failures.length > 0;
+    let invalidTargets = 0;
+    let unavailableTargets = 0;
+    const errors = [];
     const reinstall = options.reinstallCommandImpl ?? syncWriteCommand;
     if (options.plugin.sourceId && !options.plugin.pluginId) {
         throw new Error(`Plugin "${options.plugin.manifest.name}" is missing its namespaced plugin ID.`);
@@ -105,6 +163,7 @@ async function reinstallVisibleTargets(options) {
                 ...(options.plugin.sourceId ? {
                     sourceId: options.plugin.sourceId,
                     sourceIdentity: options.plugin.sourceIdentity,
+                    logicalIdentity: options.plugin.catalogLogicalIdentity,
                 } : {}),
                 pluginName: options.plugin.manifest.name,
                 manifest: options.plugin.manifest,
@@ -118,6 +177,10 @@ async function reinstallVisibleTargets(options) {
             // Generic credential redaction and known config paths still apply.
         }
         let sanitized = redactPluginScriptOutput(message, sensitiveValues);
+        for (const privatePath of [target.projectKey, options.cwd]) {
+            if (privatePath)
+                sanitized = sanitized.split(privatePath).join('<project>');
+        }
         for (const scope of ['user', 'project']) {
             const configPath = resolvePluginConfigStorePath({
                 sourceId: options.plugin.sourceId,
@@ -150,7 +213,50 @@ async function reinstallVisibleTargets(options) {
                 : Array.isArray(entry) && /^(?:messages|warnings)$/u.test(key)),
         ])));
     };
+    const preApplyExecutionCache = new Map();
     for (const target of discovered.targets) {
+        try {
+            const effective = await resolveEffectivePluginConfig({
+                ...(options.plugin.sourceId ? {
+                    sourceId: options.plugin.sourceId,
+                    sourceIdentity: options.plugin.sourceIdentity,
+                    logicalIdentity: options.plugin.catalogLogicalIdentity,
+                } : {}),
+                pluginName: options.plugin.manifest.name,
+                manifest: options.plugin.manifest,
+                targetScope: target.scope,
+                cwd: options.cwd,
+                env: options.env,
+            });
+            if (effective.issues.length > 0) {
+                invalidTargets += 1;
+                targetResults.push({
+                    target,
+                    action: 'reinstall',
+                    state: 'skipped',
+                    errorCode: 'invalidConfig',
+                    message: 'The effective config is invalid for this target.',
+                });
+                continue;
+            }
+        }
+        catch {
+            runtimeFailed = true;
+            unavailableTargets += 1;
+            targetResults.push({
+                target,
+                action: 'reinstall',
+                state: 'failed',
+                errorCode: 'effectiveConfigUnavailable',
+                message: 'The effective config cannot be read for this target.',
+            });
+            errors.push({
+                stage: 'targetValidation',
+                code: 'effectiveConfigUnavailable',
+                message: 'The effective config cannot be read for a visible target.',
+            });
+            continue;
+        }
         try {
             const debugLogger = options.rebuildRuntime?.debugLogger;
             const reporter = options.rebuildRuntime?.reporter;
@@ -158,10 +264,15 @@ async function reinstallVisibleTargets(options) {
                 cwd: options.cwd,
                 platform: target.platform,
                 scope: target.scope,
+                ...(options.rebuildRuntime?.scriptTimeoutMs === undefined
+                    ? {}
+                    : { scriptTimeoutMs: options.rebuildRuntime.scriptTimeoutMs }),
             }, {
                 ...options.rebuildRuntime,
                 env: options.env,
                 nativeCliRunner,
+                preApplyConfirmed: options.preApplyConfirmed === true,
+                preApplyExecutionCache,
                 ...(debugLogger ? {
                     debugLogger: {
                         ...debugLogger,
@@ -175,10 +286,12 @@ async function reinstallVisibleTargets(options) {
                     },
                 } : {}),
             });
-            if (result.overallState === 'failed')
+            options.rebuildRuntime?.operationDiagnosticSink?.(result.rebuildResults);
+            if (result.overallState !== 'succeeded')
                 runtimeFailed = true;
             targetResults.push(...await Promise.all(result.targetResults.map(async (entry) => ({
                 ...entry,
+                state: entry.action === 'skipped' ? 'skipped' : entry.state,
                 ...(entry.message ? { message: await sanitizeFailure(entry.message, entry.target) } : {}),
             }))));
         }
@@ -191,17 +304,33 @@ async function reinstallVisibleTargets(options) {
                 state: 'failed',
                 message,
             });
+            errors.push({
+                stage: 'apply',
+                code: 'targetApplyFailed',
+                message: 'A visible config apply target failed.',
+            });
         }
     }
-    const overallState = runtimeFailed || targetResults.some((entry) => entry.state === 'failed')
-        ? 'partial' : 'succeeded';
-    return {
-        overallState,
-        targetResults,
-        ...(discovered.targets.length === 0 && discovered.failures.length === 0
-            ? { applySkippedReason: 'noVisibleTarget' }
-            : {}),
-    };
+    if (discovered.targets.length === 0 && discovered.failures.length === 0) {
+        return skippedApply('noVisibleTarget');
+    }
+    if (discovered.targets.length > 0 && invalidTargets === discovered.targets.length) {
+        return unavailableApply('invalidConfig', 'targetValidation', targetResults);
+    }
+    if (discovered.targets.length > 0 && unavailableTargets === discovered.targets.length) {
+        return unavailableApply('effectiveConfigUnavailable', 'targetValidation', targetResults);
+    }
+    if (runtimeFailed
+        || invalidTargets > 0
+        || unavailableTargets > 0
+        || targetResults.some((entry) => entry.state === 'failed' || entry.state === 'skipped')) {
+        return {
+            state: 'partial',
+            targetResults,
+            ...(errors.length > 0 ? { errors } : {}),
+        };
+    }
+    return { state: 'succeeded', targetResults };
 }
 async function resolveConfigApplyTargets(options) {
     if (options.applyTargets !== undefined) {
@@ -217,15 +346,16 @@ async function resolveConfigApplyTargets(options) {
         rebuildRuntime: options.rebuildRuntime,
     });
 }
-async function configApplyHasIssues(options) {
-    const scopes = [...new Set(options.targets.map((target) => target.scope))];
-    for (const scope of scopes) {
-        if (options.knownValidScopes?.includes(scope))
-            continue;
+async function configApplyHasValidCodexTarget(options) {
+    const codexScopes = new Set(options.targets
+        .filter((target) => target.platform === 'codex')
+        .map((target) => target.scope));
+    for (const scope of codexScopes) {
         const effective = await resolveEffectivePluginConfig({
             ...(options.plugin.sourceId ? {
                 sourceId: options.plugin.sourceId,
                 sourceIdentity: options.plugin.sourceIdentity,
+                logicalIdentity: options.plugin.catalogLogicalIdentity,
             } : {}),
             pluginName: options.plugin.manifest.name,
             manifest: options.plugin.manifest,
@@ -233,14 +363,141 @@ async function configApplyHasIssues(options) {
             cwd: options.cwd,
             env: options.env,
         });
-        if (effective.issues.length > 0)
+        if (effective.issues.length === 0)
             return true;
     }
     return false;
 }
+async function applyConfigToVisibleTargets(options) {
+    let discovered;
+    if (options.discovered) {
+        discovered = options.discovered;
+    }
+    else {
+        try {
+            discovered = await resolveConfigApplyTargets(options);
+        }
+        catch {
+            return unavailableApply('targetDiscoveryFailed', 'targetDiscovery');
+        }
+    }
+    if (discovered.targets.length === 0
+        && discovered.failures.length === 0
+        && options.noVisibleTargetHasInvalidConfig) {
+        return unavailableApply('invalidConfig', 'targetValidation');
+    }
+    return reinstallVisibleTargets({ ...options, discovered });
+}
+export async function resolveConfigPreApplyAuthorization(options) {
+    const applyTargets = dedupeTargets(options.applyTargets);
+    if (applyTargets.length === 0 || !pluginMayRunPreApply(options.plugin)) {
+        return { targets: [], availableApplyTargets: applyTargets, unavailableTargetResults: [] };
+    }
+    if (options.plugin.sourceId && !options.plugin.pluginId) {
+        return {
+            targets: [],
+            availableApplyTargets: [],
+            unavailableTargetResults: applyTargets.map((target) => ({
+                target,
+                action: 'reinstall',
+                state: 'failed',
+                errorCode: 'sourceUnavailable',
+                message: 'The preApply authorization scope cannot be resolved for this target.',
+            })),
+        };
+    }
+    const selector = options.plugin.sourceId
+        ? options.plugin.pluginId
+        : options.plugin.manifest.name;
+    const groups = new Map();
+    for (const target of applyTargets) {
+        const targets = groups.get(target.scope) ?? [];
+        targets.push(target);
+        groups.set(target.scope, targets);
+    }
+    const authorization = [];
+    const availableApplyTargets = [];
+    const unavailableTargetResults = [];
+    const resolveGroup = async (targets) => {
+        const platforms = new Set(targets.map((target) => target.platform));
+        const platform = platforms.size === 2 ? 'both' : [...platforms][0];
+        try {
+            const preview = await (options.reinstallCommandImpl ?? syncWriteCommand)([selector], {
+                cwd: options.cwd,
+                platform,
+                scope: targets[0].scope,
+            }, {
+                ...options.rebuildRuntime,
+                env: options.env ?? process.env,
+                nativeCliRunner: options.nativeCliRunner,
+                resolvePreApplyAuthorization: true,
+            });
+            if (preview.overallState !== 'succeeded' || !preview.preApplyAuthorization)
+                return false;
+            authorization.push(...preview.preApplyAuthorization);
+            availableApplyTargets.push(...targets);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    for (const targets of groups.values()) {
+        if (await resolveGroup(targets))
+            continue;
+        for (const target of targets) {
+            if (targets.length > 1 && await resolveGroup([target]))
+                continue;
+            unavailableTargetResults.push({
+                target,
+                action: 'reinstall',
+                state: 'failed',
+                errorCode: 'sourceUnavailable',
+                message: 'The preApply authorization scope cannot be resolved for this target.',
+            });
+        }
+    }
+    return {
+        targets: [...new Map(authorization.map((target) => [[
+                    target.pluginId,
+                    target.platform,
+                    target.scope,
+                ].join('\0'), target])).values()],
+        availableApplyTargets: dedupeTargets(availableApplyTargets),
+        unavailableTargetResults,
+    };
+}
+function pluginMayRunPreApply(plugin) {
+    return plugin.manifest.scripts?.preApply !== undefined
+        || (plugin.manifest.dependencies?.length ?? 0) > 0;
+}
+function throwPreApplyAuthorizationRequired(targets) {
+    const plugins = [...new Set(targets.map((target) => target.pluginId))].join(', ');
+    const error = new Error(`preApplyAuthorizationRequired: Applying this config runs plugin preApply for ${plugins}. Re-run with --yes.`);
+    error.code = 'preApplyAuthorizationRequired';
+    throw error;
+}
+function preApplyAuthorizationIsConfirmed(options) {
+    if (options.confirmed !== true)
+        return false;
+    if (options.authorizedTargets === undefined)
+        return true;
+    const authorized = new Set(options.authorizedTargets.map((target) => [
+        target.pluginId,
+        target.sourceIdentity,
+        target.platform,
+        target.scope,
+    ].join('\0')));
+    return options.required.every((target) => authorized.has([
+        target.pluginId,
+        target.sourceIdentity,
+        target.platform,
+        target.scope,
+    ].join('\0')));
+}
 function otherProjectsWarning(scope) {
     return scope === 'user'
-        ? ['其它项目不会由本次命令扫描或更新。请在每个项目目录中运行对应的 aw reinstall 命令。']
+        ? ['其它项目不会由本次命令扫描或更新，可能需要在对应项目目录中运行 aw sync。']
         : [];
 }
 function buildReceiptFieldEntry(options) {
@@ -261,25 +518,90 @@ export async function replayConfigRuntimeWrites(options) {
         action: async (awHomeMutationToken) => {
             const env = options.env ?? process.env;
             const rebuildRuntime = { ...options.rebuildRuntime, awHomeMutationToken };
-            const discovered = await resolveConfigApplyTargets({
+            let discovered;
+            try {
+                discovered = await resolveConfigApplyTargets({
+                    plugin: options.plugin,
+                    scope: options.scope,
+                    cwd: options.cwd,
+                    env,
+                    applyTargets: options.applyTargets,
+                    nativeCliRunner: options.nativeCliRunner,
+                    rebuildRuntime,
+                });
+            }
+            catch {
+                const apply = unavailableApply('targetDiscoveryFailed', 'targetDiscovery');
+                return {
+                    configWrite: 'succeeded',
+                    overallState: 'partial',
+                    apply: publicConfigApplyResult(apply),
+                    otherProjectsMayRequireSync: false,
+                };
+            }
+            const preApplyAuthorization = await resolveConfigPreApplyAuthorization({
                 plugin: options.plugin,
                 scope: options.scope,
                 cwd: options.cwd,
                 env,
-                applyTargets: options.applyTargets,
+                applyTargets: discovered.targets,
                 nativeCliRunner: options.nativeCliRunner,
                 rebuildRuntime,
+                reinstallCommandImpl: options.reinstallCommandImpl,
             });
-            const applied = await configApplyHasIssues({
-                plugin: options.plugin,
-                targets: discovered.targets,
-                cwd: options.cwd,
-                env,
-            }) ? {
-                overallState: 'partial',
-                targetResults: [],
-                applySkippedReason: 'invalidConfig',
-            } : await reinstallVisibleTargets({
+            if (preApplyAuthorization.targets.length > 0 && !preApplyAuthorizationIsConfirmed({
+                required: preApplyAuthorization.targets,
+                confirmed: options.preApplyConfirmed,
+                authorizedTargets: options.preApplyAuthorizedTargets,
+            })) {
+                const apply = {
+                    state: 'partial',
+                    targetResults: preApplyAuthorization.targets.map((target) => ({
+                        target: {
+                            pluginName: target.pluginName,
+                            pluginId: target.pluginId,
+                            platform: target.platform,
+                            scope: target.scope,
+                        },
+                        action: 'reinstall',
+                        state: 'failed',
+                        errorCode: 'preApplyAuthorizationRequired',
+                        message: 'Running plugin preApply requires explicit authorization.',
+                    })),
+                };
+                return {
+                    configWrite: 'succeeded',
+                    overallState: 'partial',
+                    apply: publicConfigApplyResult(apply),
+                    otherProjectsMayRequireSync: false,
+                };
+            }
+            discovered = {
+                targets: preApplyAuthorization.availableApplyTargets,
+                failures: [...discovered.failures, ...preApplyAuthorization.unavailableTargetResults],
+            };
+            if (discovered.targets.length === 0
+                && preApplyAuthorization.unavailableTargetResults.length > 0) {
+                const apply = unavailableApply('sourceUnavailable', 'source', preApplyAuthorization.unavailableTargetResults);
+                return {
+                    configWrite: 'succeeded',
+                    overallState: 'partial',
+                    apply: publicConfigApplyResult(apply),
+                    otherProjectsMayRequireSync: false,
+                };
+            }
+            if (options.scope === 'user'
+                && options.sharedNativeApplyConfirmed !== true
+                && pluginHasSharedNativeRefreshKeys(options.plugin)
+                && await configApplyHasValidCodexTarget({
+                    plugin: options.plugin,
+                    targets: discovered.targets,
+                    cwd: options.cwd,
+                    env,
+                })) {
+                throwSharedNativeApplyConfirmationRequired();
+            }
+            const apply = await reinstallVisibleTargets({
                 plugin: options.plugin,
                 scope: options.scope,
                 cwd: options.cwd,
@@ -289,23 +611,27 @@ export async function replayConfigRuntimeWrites(options) {
                 reinstallCommandImpl: options.reinstallCommandImpl,
                 rebuildRuntime,
                 discovered,
+                preApplyConfirmed: options.preApplyConfirmed,
             });
             return {
                 configWrite: 'succeeded',
-                overallState: applied.overallState,
-                targetResults: applied.targetResults,
-                ...(applied.applySkippedReason ? { applySkippedReason: applied.applySkippedReason } : {}),
-                otherProjectsRequireReinstall: options.scope === 'user',
+                overallState: overallStateForApply(apply),
+                apply: publicConfigApplyResult(apply),
+                otherProjectsMayRequireSync: false,
             };
         },
     });
 }
-function changedKeysAffectSharedNativeTarget(options) {
-    const changedKeys = new Set(options.changedKeys);
-    return (options.plugin.manifest.artifacts?.targets ?? []).some((target) => target.platform === 'codex'
+function pluginHasSharedNativeRefreshKeys(plugin) {
+    return (plugin.manifest.artifacts?.targets ?? []).some((target) => target.platform === 'codex'
         && target.target === 'codex.skill'
         && target.delivery?.mode === 'codex-native'
-        && target.refreshKeys.some((key) => changedKeys.has(key)));
+        && target.refreshKeys.length > 0);
+}
+function throwSharedNativeApplyConfirmationRequired() {
+    const error = new Error('sharedNativeConfigApplyConfirmationRequired: Applying this user config changes a shared Codex native artifact. Re-run with --yes.');
+    error.code = 'sharedNativeConfigApplyConfirmationRequired';
+    throw error;
 }
 async function applyPluginConfigWriteUnlocked(options) {
     const requestedPluginName = options.pluginName ?? options.plugin?.manifest.name;
@@ -315,6 +641,7 @@ async function applyPluginConfigWriteUnlocked(options) {
     const configIdentity = options.plugin?.sourceId ? {
         sourceId: options.plugin.sourceId,
         sourceIdentity: options.plugin.sourceIdentity,
+        logicalIdentity: options.plugin.catalogLogicalIdentity,
     } : {};
     const requestedUpdates = options.request.updates ?? {};
     const requestedRemoveKeys = uniqueInOrder(options.request.removeKeys ?? []);
@@ -346,11 +673,14 @@ async function applyPluginConfigWriteUnlocked(options) {
         });
         assertReadyPluginConfigStore(userStore);
     }
-    for (const key of requestedRemoveKeys) {
-        if (!schema[key])
-            throw new Error(`Unknown config key "${key}".`);
-    }
     if (options.scope === 'project') {
+        const rejectedSensitiveKeys = Object.keys(requestedUpdates)
+            .filter((key) => schema[key]?.sensitive === true);
+        if (rejectedSensitiveKeys.length > 0) {
+            const error = new Error('sensitiveProjectConfigUnsupported: Sensitive config can only be set in user scope.');
+            error.code = 'sensitiveProjectConfigUnsupported';
+            throw error;
+        }
         const userOnlyKeys = codexNativeRefreshKeys(schemaPlugin.manifest);
         const rejectedKeys = Object.keys(requestedUpdates).filter((key) => userOnlyKeys.has(key));
         if (rejectedKeys.length > 0) {
@@ -359,126 +689,164 @@ async function applyPluginConfigWriteUnlocked(options) {
             throw error;
         }
     }
-    const updates = await coercePluginConfigUpdates({ schema, updates: requestedUpdates, cwd: options.cwd });
-    const store = await readPluginConfigStore({
-        ...configIdentity,
-        pluginName,
+    let discovered;
+    let targetDiscoveryFailed = false;
+    if (options.apply !== false) {
+        try {
+            discovered = await resolveConfigApplyTargets({
+                plugin: schemaPlugin,
+                scope: options.scope,
+                cwd: options.cwd,
+                env: options.env ?? process.env,
+                applyTargets: options.applyTargets,
+                nativeCliRunner: options.nativeCliRunner,
+                rebuildRuntime: options.rebuildRuntime,
+            });
+        }
+        catch {
+            targetDiscoveryFailed = true;
+        }
+    }
+    const impact = await analyzePluginConfigMutationImpact({
+        plugin: schemaPlugin,
         scope: options.scope,
         cwd: options.cwd,
         env: options.env,
-        schema,
+        visibleTargets: discovered?.targets ?? [],
+        mutation: {
+            kind: 'patch',
+            updates: requestedUpdates,
+            removeKeys: requestedRemoveKeys,
+        },
     });
-    assertReadyPluginConfigStore(store);
+    const updates = await coercePluginConfigUpdates({ schema, updates: requestedUpdates, cwd: options.cwd });
     const warnings = [];
-    const removedKeys = requestedRemoveKeys.filter((key) => Object.hasOwn(store.values, key));
-    const updatedKeys = Object.entries(updates)
-        .filter(([key, value]) => !Object.hasOwn(store.values, key)
-        || stablePluginConfigStringify(store.values[key]) !== stablePluginConfigStringify(value))
-        .map(([key]) => key);
-    const changedKeys = [...updatedKeys, ...removedKeys];
-    let applyTargets = options.applyTargets;
-    const sharedNativeAffected = changedKeysAffectSharedNativeTarget({
-        plugin: schemaPlugin,
-        changedKeys,
-    });
+    const { updatedKeys, removedKeys, staleRemovedKeys } = impact;
+    let preApplyUnavailableReason;
+    let preApplyUnavailableTargetResults = [];
+    let applyDiscovery = discovered
+        ? { targets: impact.affectedTargets, failures: discovered.failures }
+        : undefined;
+    const shouldApply = options.apply !== false && impact.storeChanged && !impact.noEffectiveChange;
+    if (shouldApply && pluginMayRunPreApply(schemaPlugin)) {
+        if (applyDiscovery) {
+            const preApplyAuthorization = await resolveConfigPreApplyAuthorization({
+                plugin: schemaPlugin,
+                scope: options.scope,
+                cwd: options.cwd,
+                env: options.env,
+                applyTargets: applyDiscovery.targets,
+                nativeCliRunner: options.nativeCliRunner,
+                rebuildRuntime: options.rebuildRuntime,
+                reinstallCommandImpl: options.reinstallCommandImpl,
+            });
+            if (preApplyAuthorization.targets.length > 0 && !preApplyAuthorizationIsConfirmed({
+                required: preApplyAuthorization.targets,
+                confirmed: options.preApplyConfirmed,
+                authorizedTargets: options.preApplyAuthorizedTargets,
+            })) {
+                throwPreApplyAuthorizationRequired(preApplyAuthorization.targets);
+            }
+            preApplyUnavailableTargetResults = preApplyAuthorization.unavailableTargetResults;
+            applyDiscovery = {
+                targets: preApplyAuthorization.availableApplyTargets,
+                failures: [...applyDiscovery.failures, ...preApplyUnavailableTargetResults],
+            };
+            if (applyDiscovery.targets.length === 0 && preApplyUnavailableTargetResults.length > 0) {
+                preApplyUnavailableReason = 'sourceUnavailable';
+            }
+        }
+    }
     if (options.apply !== false
         && options.scope === 'user'
-        && options.sharedNativeApplyConfirmed === false
-        && sharedNativeAffected) {
-        applyTargets ??= (await discoverVisibleTargets({
-            plugin: schemaPlugin,
-            pluginName,
-            scope: options.scope,
-            cwd: options.cwd,
-            env: options.env ?? process.env,
-            nativeCliRunner: options.nativeCliRunner ?? getDefaultNativeCliRunner(),
-            rebuildRuntime: options.rebuildRuntime,
-        })).targets;
-        if (applyTargets.some((target) => target.platform === 'codex')) {
-            const error = new Error('sharedNativeConfigApplyConfirmationRequired: Applying this user config changes a shared Codex native artifact. Re-run with --yes.');
-            error.code = 'sharedNativeConfigApplyConfirmationRequired';
-            throw error;
+        && options.sharedNativeApplyConfirmed !== true
+        && impact.sharedNativeRenderTargets.length > 0
+        && impact.affectedTargets.some((target) => target.platform === 'codex')) {
+        throwSharedNativeApplyConfirmationRequired();
+    }
+    if (impact.storeChanged) {
+        try {
+            const write = await patchPluginConfigStore({
+                ...configIdentity,
+                pluginName,
+                scope: options.scope,
+                cwd: options.cwd,
+                env: options.env,
+                updates: Object.fromEntries(updatedKeys.map((key) => [key, updates[key]])),
+                removeKeys: requestedRemoveKeys,
+                schema,
+            });
+            warnings.push(...write.warnings);
+        }
+        catch (error) {
+            throw markConfigWriteFailed(error);
         }
     }
-    if (changedKeys.length > 0) {
-        await patchPluginConfigStore({
+    let effective;
+    try {
+        effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({
             ...configIdentity,
             pluginName,
-            scope: options.scope,
+            manifest: schemaPlugin.manifest,
+            targetScope: options.scope,
             cwd: options.cwd,
             env: options.env,
-            updates: Object.fromEntries(updatedKeys.map((key) => [key, updates[key]])),
-            removeKeys: requestedRemoveKeys,
-            schema,
-        });
-    }
-    const effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({
-        ...configIdentity,
-        pluginName,
-        manifest: schemaPlugin.manifest,
-        targetScope: options.scope,
-        cwd: options.cwd,
-        env: options.env,
-    }));
-    let applied;
-    if (changedKeys.length === 0) {
-        applied = {
-            overallState: 'succeeded',
-            targetResults: [],
-            applySkippedReason: 'noConfigChange',
-        };
+        }));
     }
-    else if (effective.issues.length > 0) {
-        applied = {
+    catch {
+        const apply = unavailableApply('effectiveConfigUnavailable', 'effectiveConfig');
+        const otherProjectsMayRequireSync = options.scope === 'user' && impact.storeChanged;
+        if (otherProjectsMayRequireSync)
+            warnings.push(...otherProjectsWarning(options.scope));
+        return {
+            plugin: pluginName,
+            scope: options.scope,
+            ...(schemaAccess.schema ? { schema: schemaAccess.schema } : {}),
+            updatedKeys,
+            removedKeys,
+            staleRemovedKeys,
+            configWrite: 'succeeded',
             overallState: 'partial',
-            targetResults: [],
-            applySkippedReason: 'invalidConfig',
+            apply: publicConfigApplyResult(apply),
+            otherProjectsMayRequireSync,
+            warnings,
         };
     }
-    else if (options.apply === false) {
-        applied = {
-            overallState: 'succeeded',
-            targetResults: [],
-            applySkippedReason: 'notRequested',
-        };
+    let apply;
+    try {
+        apply = !impact.storeChanged
+            ? skippedApply('noConfigChange')
+            : options.apply === false
+                ? skippedApply('notRequested')
+                : targetDiscoveryFailed
+                    ? unavailableApply('targetDiscoveryFailed', 'targetDiscovery')
+                    : impact.noEffectiveChange
+                        && ((discovered?.targets.length ?? 0) > 0
+                            || staleRemovedKeys.length === impact.changedKeys.length)
+                        ? skippedApply('noEffectiveConfigChange')
+                        : preApplyUnavailableReason
+                            ? unavailableApply(preApplyUnavailableReason, preApplyUnavailableReason === 'sourceUnavailable' ? 'source' : 'targetDiscovery', preApplyUnavailableTargetResults)
+                            : await applyConfigToVisibleTargets({
+                                plugin: schemaPlugin,
+                                scope: options.scope,
+                                cwd: options.cwd,
+                                env: options.env ?? process.env,
+                                applyTargets: applyDiscovery?.targets ?? impact.affectedTargets,
+                                nativeCliRunner: options.nativeCliRunner,
+                                reinstallCommandImpl: options.reinstallCommandImpl,
+                                rebuildRuntime: options.rebuildRuntime,
+                                noVisibleTargetHasInvalidConfig: (discovered?.targets.length ?? 0) > 0
+                                    && effective.issues.length > 0,
+                                preApplyConfirmed: options.preApplyConfirmed,
+                                discovered: applyDiscovery,
+                            });
     }
-    else {
-        const discovered = await resolveConfigApplyTargets({
-            plugin: schemaPlugin,
-            scope: options.scope,
-            cwd: options.cwd,
-            env: options.env ?? process.env,
-            applyTargets: options.applyTargets,
-            nativeCliRunner: options.nativeCliRunner,
-            rebuildRuntime: options.rebuildRuntime,
-        });
-        applied = await configApplyHasIssues({
-            plugin: schemaPlugin,
-            targets: discovered.targets,
-            cwd: options.cwd,
-            env: options.env,
-            knownValidScopes: [options.scope],
-        }) ? {
-            overallState: 'partial',
-            targetResults: [],
-            applySkippedReason: 'invalidConfig',
-        } : await reinstallVisibleTargets({
-            plugin: schemaPlugin,
-            scope: options.scope,
-            cwd: options.cwd,
-            env: options.env ?? process.env,
-            applyTargets,
-            nativeCliRunner: options.nativeCliRunner,
-            reinstallCommandImpl: options.reinstallCommandImpl,
-            rebuildRuntime: options.rebuildRuntime,
-            discovered,
-        });
+    catch (error) {
+        const failure = error instanceof Error ? error : new Error(String(error));
+        throw Object.assign(failure, { configWrite: 'succeeded' });
     }
-    const otherProjectsRequireReinstall = options.scope === 'user'
-        && changedKeys.length > 0
-        && effective.issues.length === 0
-        && applied.applySkippedReason !== 'invalidConfig';
-    if (otherProjectsRequireReinstall)
+    const otherProjectsMayRequireSync = options.scope === 'user' && impact.storeChanged;
+    if (otherProjectsMayRequireSync)
         warnings.push(...otherProjectsWarning(options.scope));
     return {
         plugin: pluginName,
@@ -486,12 +854,12 @@ async function applyPluginConfigWriteUnlocked(options) {
         ...(schemaAccess.schema ? { schema: schemaAccess.schema } : {}),
         updatedKeys,
         removedKeys,
+        staleRemovedKeys,
         effective,
         configWrite: 'succeeded',
-        overallState: applied.overallState,
-        targetResults: applied.targetResults,
-        ...(applied.applySkippedReason ? { applySkippedReason: applied.applySkippedReason } : {}),
-        otherProjectsRequireReinstall,
+        overallState: overallStateForApply(apply),
+        apply: publicConfigApplyResult(apply),
+        otherProjectsMayRequireSync,
         warnings,
     };
 }
@@ -500,6 +868,20 @@ export async function applyPluginConfigWrite(options) {
     if (!requestedPluginName)
         throw new Error('Plugin name is required for config write.');
     assertSafePluginConfigSegment(requestedPluginName);
+    if (options.scope === 'project') {
+        const targetPath = resolvePluginConfigStorePath({
+            sourceId: options.plugin?.sourceId,
+            pluginName: requestedPluginName,
+            scope: 'project',
+            cwd: options.cwd,
+            env: options.env,
+        });
+        await assertProjectSharedConfigPathVisible({
+            cwd: options.cwd,
+            targetPath,
+            env: options.env,
+        });
+    }
     return withAwHomeMutationLock({
         env: options.env,
         token: options.awHomeMutationToken,
@@ -522,6 +904,7 @@ export async function applyPluginConfigWrite(options) {
                             ...(options.plugin.sourceId ? {
                                 sourceId: options.plugin.sourceId,
                                 sourceIdentity: options.plugin.sourceIdentity,
+                                logicalIdentity: options.plugin.catalogLogicalIdentity,
                             } : {}),
                             pluginName: options.plugin.manifest.name,
                             manifest: options.plugin.manifest,
@@ -539,6 +922,7 @@ export async function applyPluginConfigWrite(options) {
                     }
                 }
                 let message = redactPluginScriptOutput(error instanceof Error ? error.message : String(error), sensitiveValues);
+                message = message.split(options.cwd).join('<project>');
                 for (const scope of ['user', 'project']) {
                     const configPath = resolvePluginConfigStorePath({
                         sourceId: options.plugin?.sourceId,
@@ -556,6 +940,13 @@ export async function applyPluginConfigWrite(options) {
                 const safeError = new Error(message);
                 const code = error.code;
                 safeError.code = typeof code === 'string' ? code : 'configApplyFailed';
+                const configWrite = error.configWrite;
+                if (configWrite === 'succeeded' || configWriteStateForError(error) === 'failed') {
+                    safeError.configWrite = configWrite === 'succeeded' ? 'succeeded' : 'failed';
+                }
+                if (error && typeof error === 'object' && 'operationDiagnostic' in error) {
+                    safeError.operationDiagnostic = error.operationDiagnostic;
+                }
                 throw safeError;
             }
         },
@@ -563,19 +954,14 @@ export async function applyPluginConfigWrite(options) {
 }
 async function resetPluginConfigWithHelperUnlocked(options) {
     const pluginName = assertSafePluginConfigSegment(options.pluginName);
-    const schemaAccess = options.plugin ? await resolvePluginConfigSchemaAccess({
-        pluginName,
-        currentPlugin: options.plugin,
-        scope: options.scope,
-        cwd: options.cwd,
-        env: options.env,
-    }) : undefined;
     let configIdentity = options.plugin?.sourceId ? {
         sourceId: options.plugin.sourceId,
         sourceIdentity: options.plugin.sourceIdentity,
+        logicalIdentity: options.plugin.catalogLogicalIdentity,
     } : options.sourceId ? {
         sourceId: options.sourceId,
         sourceIdentity: options.sourceIdentity,
+        logicalIdentity: options.logicalIdentity,
     } : {};
     if (options.sourceId && !options.sourceIdentity) {
         try {
@@ -586,10 +972,15 @@ async function resetPluginConfigWithHelperUnlocked(options) {
                 cwd: options.cwd,
                 env: options.env,
             });
-            if (identity)
+            if (identity?.binding.kind === 'source')
+                configIdentity = {
+                    sourceId: options.sourceId,
+                    sourceIdentity: identity.binding.sourceIdentity,
+                };
+            if (identity?.binding.kind === 'catalog')
                 configIdentity = {
                     sourceId: options.sourceId,
-                    sourceIdentity: identity.sourceIdentity,
+                    logicalIdentity: identity.binding.logicalIdentity,
                 };
         }
         catch {
@@ -611,87 +1002,179 @@ async function resetPluginConfigWithHelperUnlocked(options) {
         // Reset is the final recovery boundary and does not require a readable store.
     }
     const warnings = [];
-    const reset = await resetPluginConfigStore({
-        ...configIdentity,
-        pluginName,
-        scope: options.scope,
-        cwd: options.cwd,
-        env: options.env,
-    });
-    let applied = {
-        overallState: 'succeeded',
-        targetResults: [],
-        applySkippedReason: reset.deleted ? 'notRequested' : 'noConfigChange',
-    };
+    let impact;
+    let targetDiscoveryFailed = false;
+    let visibleTargets = [];
+    if (options.plugin) {
+        if (options.apply !== false) {
+            try {
+                visibleTargets = (await resolveConfigApplyTargets({
+                    plugin: options.plugin,
+                    scope: options.scope,
+                    cwd: options.cwd,
+                    env: options.env ?? process.env,
+                    applyTargets: options.applyTargets,
+                    nativeCliRunner: options.nativeCliRunner,
+                    rebuildRuntime: options.rebuildRuntime,
+                })).targets;
+            }
+            catch {
+                targetDiscoveryFailed = true;
+            }
+        }
+        try {
+            impact = await analyzePluginConfigMutationImpact({
+                plugin: options.plugin,
+                scope: options.scope,
+                cwd: options.cwd,
+                env: options.env,
+                visibleTargets,
+                mutation: { kind: 'reset' },
+            });
+            removedKeys = impact.removedKeys;
+        }
+        catch {
+            // Reset remains available when its before state cannot be read.
+        }
+    }
+    let preApplyUnavailableReason;
+    let preApplyUnavailableTargetResults = [];
+    let applyDiscovery = options.plugin && !targetDiscoveryFailed
+        ? { targets: impact?.affectedTargets ?? visibleTargets, failures: [] }
+        : undefined;
+    if (options.plugin
+        && options.apply !== false
+        && impact?.storeChanged
+        && !impact.noEffectiveChange
+        && applyDiscovery
+        && pluginMayRunPreApply(options.plugin)) {
+        const preApplyAuthorization = await resolveConfigPreApplyAuthorization({
+            plugin: options.plugin,
+            scope: options.scope,
+            cwd: options.cwd,
+            env: options.env,
+            applyTargets: applyDiscovery.targets,
+            nativeCliRunner: options.nativeCliRunner,
+            rebuildRuntime: options.rebuildRuntime,
+            reinstallCommandImpl: options.reinstallCommandImpl,
+        });
+        if (preApplyAuthorization.targets.length > 0 && !preApplyAuthorizationIsConfirmed({
+            required: preApplyAuthorization.targets,
+            confirmed: options.preApplyConfirmed,
+            authorizedTargets: options.preApplyAuthorizedTargets,
+        })) {
+            throwPreApplyAuthorizationRequired(preApplyAuthorization.targets);
+        }
+        preApplyUnavailableTargetResults = preApplyAuthorization.unavailableTargetResults;
+        applyDiscovery = {
+            targets: preApplyAuthorization.availableApplyTargets,
+            failures: preApplyUnavailableTargetResults,
+        };
+        if (applyDiscovery.targets.length === 0 && preApplyUnavailableTargetResults.length > 0) {
+            preApplyUnavailableReason = 'sourceUnavailable';
+        }
+    }
+    if (options.plugin
+        && options.apply !== false
+        && options.scope === 'user'
+        && options.sharedNativeApplyConfirmed !== true
+        && (impact
+            ? impact.sharedNativeRenderTargets.length > 0
+                && impact.affectedTargets.some((target) => target.platform === 'codex')
+            : pluginHasSharedNativeRefreshKeys(options.plugin))
+        && visibleTargets.some((target) => target.platform === 'codex')) {
+        throwSharedNativeApplyConfirmationRequired();
+    }
+    let reset;
+    try {
+        reset = await resetPluginConfigStore({
+            ...configIdentity,
+            pluginName,
+            scope: options.scope,
+            cwd: options.cwd,
+            env: options.env,
+        });
+    }
+    catch (error) {
+        throw markConfigWriteFailed(error);
+    }
+    let schemaAccess;
+    let apply = reset.deleted ? skippedApply('notRequested') : skippedApply('noConfigChange');
     let effective;
-    if (schemaAccess?.plugin) {
-        if (schemaAccess.plugin.manifest.config?.fields) {
+    if (options.plugin) {
+        try {
+            schemaAccess = await resolvePluginConfigSchemaAccess({
+                pluginName,
+                currentPlugin: options.plugin,
+                scope: options.scope,
+                cwd: options.cwd,
+                env: options.env,
+            });
+        }
+        catch {
+            if (reset.deleted && options.apply !== false) {
+                apply = unavailableApply('sourceUnavailable', 'source');
+            }
+        }
+        const schemaPlugin = schemaAccess?.plugin;
+        if (schemaPlugin?.manifest.config?.fields) {
             try {
                 effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({
                     ...configIdentity,
                     pluginName,
-                    manifest: schemaAccess.plugin.manifest,
+                    manifest: schemaPlugin.manifest,
                     targetScope: options.scope,
                     cwd: options.cwd,
                     env: options.env,
                 }));
             }
             catch {
-                if (options.apply !== false) {
-                    applied = {
-                        overallState: 'partial',
-                        targetResults: [],
-                        applySkippedReason: 'invalidConfig',
-                    };
+                if (reset.deleted && options.apply !== false) {
+                    apply = unavailableApply('effectiveConfigUnavailable', 'effectiveConfig');
                 }
             }
+            if (reset.deleted
+                && options.apply !== false
+                && apply.state === 'skipped'
+                && impact?.noEffectiveChange
+                && visibleTargets.length > 0) {
+                apply = skippedApply('noEffectiveConfigChange');
+            }
+            else if (reset.deleted
+                && options.apply !== false
+                && apply.state === 'skipped'
+                && targetDiscoveryFailed) {
+                apply = unavailableApply('targetDiscoveryFailed', 'targetDiscovery');
+            }
+            else if (reset.deleted && options.apply !== false && apply.state === 'skipped') {
+                apply = preApplyUnavailableReason
+                    ? unavailableApply(preApplyUnavailableReason, 'source', preApplyUnavailableTargetResults)
+                    : await applyConfigToVisibleTargets({
+                        plugin: schemaPlugin,
+                        scope: options.scope,
+                        cwd: options.cwd,
+                        env: options.env ?? process.env,
+                        applyTargets: applyDiscovery?.targets ?? impact?.affectedTargets ?? options.applyTargets,
+                        nativeCliRunner: options.nativeCliRunner,
+                        reinstallCommandImpl: options.reinstallCommandImpl,
+                        rebuildRuntime: options.rebuildRuntime,
+                        noVisibleTargetHasInvalidConfig: (effective?.issues.length ?? 0) > 0,
+                        preApplyConfirmed: options.preApplyConfirmed,
+                        discovered: applyDiscovery,
+                    });
+            }
         }
-        if (reset.deleted && effective && effective.issues.length > 0) {
-            applied = {
-                overallState: 'partial',
-                targetResults: [],
-                applySkippedReason: 'invalidConfig',
-            };
-        }
-        else if (reset.deleted && options.apply !== false && applied.applySkippedReason !== 'invalidConfig') {
-            const discovered = await resolveConfigApplyTargets({
-                plugin: schemaAccess.plugin,
-                scope: options.scope,
-                cwd: options.cwd,
-                env: options.env ?? process.env,
-                applyTargets: options.applyTargets,
-                nativeCliRunner: options.nativeCliRunner,
-                rebuildRuntime: options.rebuildRuntime,
-            });
-            applied = await configApplyHasIssues({
-                plugin: schemaAccess.plugin,
-                targets: discovered.targets,
-                cwd: options.cwd,
-                env: options.env,
-                knownValidScopes: effective ? [options.scope] : undefined,
-            }) ? {
-                overallState: 'partial',
-                targetResults: [],
-                applySkippedReason: 'invalidConfig',
-            } : await reinstallVisibleTargets({
-                plugin: schemaAccess.plugin,
-                scope: options.scope,
-                cwd: options.cwd,
-                env: options.env ?? process.env,
-                applyTargets: options.applyTargets,
-                nativeCliRunner: options.nativeCliRunner,
-                reinstallCommandImpl: options.reinstallCommandImpl,
-                rebuildRuntime: options.rebuildRuntime,
-                discovered,
-            });
+        else if (reset.deleted && options.apply !== false && apply.state === 'skipped') {
+            apply = unavailableApply('schemaUnavailable', 'schema');
         }
     }
-    const otherProjectsRequireReinstall = Boolean(schemaAccess?.plugin)
-        && options.scope === 'user'
-        && reset.deleted
-        && (effective?.issues.length ?? 0) === 0
-        && applied.applySkippedReason !== 'invalidConfig';
-    if (otherProjectsRequireReinstall)
+    else if (reset.deleted && options.apply !== false) {
+        apply = options.pluginError
+            ? unavailableApply('sourceUnavailable', 'source')
+            : unavailableApply('schemaUnavailable', 'schema');
+    }
+    const otherProjectsMayRequireSync = options.scope === 'user' && reset.deleted;
+    if (otherProjectsMayRequireSync)
         warnings.push(...otherProjectsWarning(options.scope));
     return {
         plugin: pluginName,
@@ -704,10 +1187,9 @@ async function resetPluginConfigWithHelperUnlocked(options) {
         removedKeys,
         ...(effective ? { effective } : {}),
         configWrite: 'succeeded',
-        overallState: applied.overallState,
-        targetResults: applied.targetResults,
-        ...(applied.applySkippedReason ? { applySkippedReason: applied.applySkippedReason } : {}),
-        otherProjectsRequireReinstall,
+        overallState: overallStateForApply(apply),
+        apply: publicConfigApplyResult(apply),
+        otherProjectsMayRequireSync,
         warnings,
     };
 }
@@ -751,9 +1233,11 @@ export async function describeResetAffectedFields(options) {
             ...(options.plugin?.sourceId ? {
                 sourceId: options.plugin.sourceId,
                 sourceIdentity: options.plugin.sourceIdentity,
+                logicalIdentity: options.plugin.catalogLogicalIdentity,
             } : options.sourceId ? {
                 sourceId: options.sourceId,
                 sourceIdentity: options.sourceIdentity,
+                logicalIdentity: options.logicalIdentity,
             } : {}),
             pluginName: options.pluginName,
             scope: options.scope,