@lesliechan721/aw 0.1.0-beta.10

package/dist/src/commands/rebuild-command.js

@@ -0,0 +1,3626 @@
+import path from 'node:path';
+import fs from 'fs-extra';
+import { getCodexOperationRequirement, probeAgentVersion } from '../utils/agent-version.js';
+import { previewCodexManager, resolveCodexOperationConsumer, } from '../utils/codex-manager.js';
+import { createNoopDebugLogger } from '../output/debug-log.js';
+import { createNoopReporter } from '../output/reporter.js';
+import { getDefaultNativeCliRunner, } from '../utils/native-cli.js';
+import { readPluginManifest } from '../utils/manifest.js';
+import { resolveAwHome, resolveCodexPaths } from '../utils/paths.js';
+import { resolveCliPackageRoot } from '../utils/paths.js';
+import { supportsPlatform } from '../utils/platform-support.js';
+import { analyzeCodexSurface } from '../utils/codex-surface-analysis.js';
+import { buildGeneratedName } from '../generators/shared.js';
+import { createCodexReconcilePlan, } from '../utils/codex-reconciler.js';
+import { readCodexConfigFile } from '../utils/codex-config.js';
+import { executeRebuildOperation, } from './rebuild-operations.js';
+import { assertNoClaudeUnboundNativeNameCollision, CodexActivationPostcheckError, createRebuildIntegration, executeCodexReconcileActivations, inspectCodexPluginRegistrationLive, inspectCodexSharedNativeLive, inspectNativeMarketplaceRegistrations, } from './rebuild-integration.js';
+import { getNamespacedMarketplaceName } from '../utils/local-marketplace.js';
+import { formatPluginId, parsePluginId, planPluginSelectorSourceIds, preflightDesiredArtifactCollisions, withResolvedMultiSourceCatalog, } from '../utils/multi-source-catalog.js';
+import { calculateCodexNativeRenderPayloadDigest, calculateCodexSharedNativePayloadDigest, } from '../utils/catalog-digests.js';
+import { resolveCatalogOperationContext, } from '../utils/catalog-operation-context.js';
+import { assertStrictSemVer } from '../utils/manifest.js';
+import { assertCatalogSourceInventoryComplete, canonicalMarketplaceRegistrationNames, inventoryCatalogSourceReferences, } from '../utils/catalog-source-references.js';
+import { sanitizeCatalogSourceErrorMessage } from '../utils/catalog-public-error.js';
+import { resolveEffectivePluginConfig } from '../utils/plugin-config.js';
+import { resolveArtifactRenderConfig } from '../utils/artifact-renderer.js';
+import { inspectOwnedComponents, parseOwnedTextHeader, readSkillOwnerMarker, SKILL_OWNER_MARKER, } from '../utils/ownership.js';
+import { resolveActiveCatalogPluginShallow } from '../utils/catalog-generation-resolver.js';
+import { canonicalizePathThroughExistingAncestorSync, codexProjectConfigAliasesUserHome, getClaudeHome, getCodexHome, resolveCanonicalRepoProjectKey, resolveRepoRootSync, } from '../utils/state-paths.js';
+import { resolvePluginMetaDependencyClosure } from '../utils/plugin-dependencies.js';
+import { readCatalogSourcesConfigSnapshot } from '../utils/catalog-sources.js';
+import { catalogGenerationErrorCode, isOfflineCleanupCatalogGenerationError, } from '../utils/catalog-generation-error.js';
+import { canonicalizePluginIntentState, calculatePluginIntentDigest, createEmptyPluginIntentState, mergePluginIntentRootPlatforms, readPluginIntentState, removePluginIntentRootPlatforms, writePluginIntentState, } from '../utils/plugin-intent-state.js';
+import { assertOperationPlanFingerprint, createOperationPlanConfigDigest, createOperationPlan, } from './operation-plan.js';
+import { validateCatalogSnapshotPluginEntriesComplete } from '../utils/catalog-snapshot.js';
+import { runPostApplyScript } from '../utils/plugin-scripts.js';
+import { AwCapabilityUnsupportedError, IMPLEMENTED_AW_CAPABILITIES, } from './aw-capabilities.js';
+import { checkAwCapabilitySupport } from '../utils/manifest.js';
+import { createDependencyPlacementPlan, } from './dependency-operation-plan.js';
+import { createReconcileOperationPlan, } from './reconcile-operation-plan.js';
+import { forceOfflineCleanupEvidence, offlineCleanupEvidenceFromInventory, offlineCleanupEvidenceMatches, } from './offline-cleanup-evidence.js';
+async function measureCommandPerformanceStage(runtime, name, operation) {
+    const startedAt = Date.now();
+    let phase = 'success';
+    try {
+        return await operation();
+    }
+    catch (error) {
+        phase = 'failure';
+        throw error;
+    }
+    finally {
+        await Promise.resolve().then(() => runtime?.debugLogger?.log({
+            type: 'performance:stage',
+            level: 'debug',
+            target: 'debugLog',
+            message: 'Command performance stage completed.',
+            data: {
+                name,
+                phase,
+                durationMs: Math.max(0, Date.now() - startedAt),
+            },
+        })).catch(() => undefined);
+    }
+}
+let rebuildCommandTestHooks;
+async function emitRebuildActionEvent(runtime, event) {
+    await Promise.allSettled([
+        Promise.resolve().then(() => runtime.reporter.event(event)),
+        Promise.resolve().then(() => runtime.debugLogger.log(event)),
+    ]);
+}
+export function setRebuildCommandTestHooksForTests(hooks) {
+    rebuildCommandTestHooks = hooks;
+}
+function assertRebuildCatalogSourceInventoryComplete(inventory, targetScope) {
+    if (targetScope !== 'user') {
+        assertCatalogSourceInventoryComplete(inventory);
+        return;
+    }
+    assertCatalogSourceInventoryComplete({
+        ...inventory,
+        errors: inventory.errors.filter((error) => error.relevance.global
+            || error.relevance.scope !== 'project'
+            || !error.kind.startsWith('config')),
+    });
+}
+const MALFORMED_CONFIG_PRESERVED_WARNING = 'pluginConfigPreserved: 目标插件的无效配置文件已保留。可稍后运行 aw config reset 清理。';
+function omitSelectedPluginConfigErrors(inventory, targets) {
+    let omitted = false;
+    const errors = inventory.errors.filter((error) => {
+        const relevance = error.relevance;
+        const selected = error.kind.startsWith('config') && targets.some((target) => {
+            if (!relevance.global
+                && relevance.sourceId === target.sourceId
+                && relevance.pluginName === target.pluginName)
+                return true;
+            const location = error.location.replaceAll('\\', '/');
+            return location.endsWith(`/plugin-config/${target.sourceId}/${target.pluginName}/config.json`);
+        });
+        if (selected)
+            omitted = true;
+        return !selected;
+    });
+    return { inventory: { ...inventory, errors }, omitted };
+}
+function selectedPlatforms(selection) {
+    return selection === 'both' ? ['codex', 'claude'] : [selection];
+}
+function selectCodexActivationPlans(plans, pluginIds) {
+    return plans.flatMap((plan) => {
+        if (!plan.desiredTargets.some((target) => pluginIds.has(target.pluginId)))
+            return [];
+        const sharedNativeActions = plan.sharedNativeActions.filter((action) => pluginIds.has(action.pluginId));
+        const userActions = plan.activationActions.user.filter((action) => pluginIds.has(action.pluginId));
+        const projectActions = plan.activationActions.project.filter((action) => pluginIds.has(action.pluginId));
+        const postcheckPlugins = plan.postcheck.plugins.filter((plugin) => pluginIds.has(plugin.pluginId));
+        const codexPluginIds = new Set([
+            ...sharedNativeActions.map((action) => action.codexPluginId),
+            ...userActions.map((action) => action.codexPluginId),
+            ...projectActions.map((action) => action.codexPluginId),
+            ...postcheckPlugins.map((plugin) => plugin.codexPluginId),
+        ]);
+        return [{
+                ...plan,
+                activationActions: { user: userActions, project: projectActions },
+                staleActivationRemovals: plan.staleActivationRemovals.filter((action) => codexPluginIds.has(action.codexPluginId)),
+                postcheck: { ...plan.postcheck, plugins: postcheckPlugins },
+            }];
+    });
+}
+function failedCodexActivationPluginIds(options) {
+    const error = options.error;
+    if (!(error instanceof CodexActivationPostcheckError)) {
+        return new Set(options.successfulPluginIds);
+    }
+    const ownersByCodexPluginId = new Map();
+    for (const entry of options.plans.flatMap((plan) => [
+        ...plan.activationActions.user,
+        ...plan.activationActions.project,
+        ...plan.postcheck.plugins,
+    ])) {
+        const owners = ownersByCodexPluginId.get(entry.codexPluginId) ?? new Set();
+        owners.add(entry.pluginId);
+        ownersByCodexPluginId.set(entry.codexPluginId, owners);
+    }
+    const failed = new Set();
+    for (const codexPluginId of error.codexPluginIds) {
+        const owners = ownersByCodexPluginId.get(codexPluginId);
+        if (!owners || owners.size === 0)
+            return new Set(options.successfulPluginIds);
+        for (const pluginId of owners) {
+            if (options.successfulPluginIds.has(pluginId))
+                failed.add(pluginId);
+        }
+    }
+    return failed.size > 0 ? failed : new Set(options.successfulPluginIds);
+}
+function updateIntentOverrides(options) {
+    const plannedKeys = new Set(options.plan.targets.map((target) => `${target.pluginId}\0${target.platform}`));
+    return canonicalizePluginIntentState({
+        ...options.state,
+        dependencyScopeOverrides: [
+            ...options.state.dependencyScopeOverrides.filter((override) => !plannedKeys.has(`${override.pluginId}\0${override.platform}`)),
+            ...options.plan.scopeOverrides,
+        ],
+    });
+}
+function effectiveDependencyScopeOverrides(options) {
+    const nodeKeys = new Set(options.nodes.map((node) => `${node.pluginId}\0${node.platform}`));
+    const explicitMatches = (pluginId, platform) => options.explicit.some((override) => override.pluginId === pluginId
+        && (override.platform === undefined || override.platform === platform));
+    return [
+        ...options.state.dependencyScopeOverrides.filter((override) => nodeKeys.has(`${override.pluginId}\0${override.platform}`)
+            && !options.ignoredPersistedRootIds?.has(override.pluginId)
+            && !explicitMatches(override.pluginId, override.platform)),
+        ...options.explicit.filter((override) => options.nodes.some((node) => node.pluginId === override.pluginId
+            && (override.platform === undefined || node.platform === override.platform))),
+    ];
+}
+function pruneUnreachableDependencyScopeOverrides(state, catalogEntries) {
+    if (!catalogEntries || state.dependencyScopeOverrides.length === 0)
+        return state;
+    const byId = new Map(catalogEntries.map((entry) => [entry.pluginId, entry]));
+    const reachable = new Set();
+    const visiting = new Set();
+    const visited = new Set();
+    const visit = (pluginId, platform, root) => {
+        const entry = byId.get(pluginId);
+        if (!entry || visiting.has(pluginId))
+            return false;
+        const visitKey = `${pluginId}\0${platform}`;
+        if (visited.has(visitKey)) {
+            if (!root)
+                reachable.add(visitKey);
+            return true;
+        }
+        visiting.add(pluginId);
+        for (const dependencyPluginId of entry.dependencyPluginIds) {
+            if (!visit(dependencyPluginId, platform, false))
+                return false;
+        }
+        visiting.delete(pluginId);
+        visited.add(visitKey);
+        if (!root)
+            reachable.add(visitKey);
+        return true;
+    };
+    for (const root of state.roots) {
+        for (const platform of root.platforms) {
+            visiting.clear();
+            if (!visit(root.pluginId, platform, true))
+                return state;
+        }
+    }
+    return canonicalizePluginIntentState({
+        ...state,
+        dependencyScopeOverrides: state.dependencyScopeOverrides.filter((override) => reachable.has(`${override.pluginId}\0${override.platform}`)),
+    });
+}
+function deriveDesiredIntentState(options) {
+    let next = options.state;
+    if (options.command === 'install') {
+        for (const root of options.selectedRoots)
+            next = mergePluginIntentRootPlatforms(next, root);
+        next = updateIntentOverrides({ state: next, plan: options.plan });
+    }
+    else if (options.command === 'uninstall') {
+        for (const root of options.selectedRoots)
+            next = removePluginIntentRootPlatforms(next, root);
+        next = pruneUnreachableDependencyScopeOverrides(next, options.catalogEntries);
+    }
+    return next;
+}
+function removeSelectedRootPlatformsFromOtherScope(options) {
+    let next = options.state;
+    for (const root of options.selectedRoots) {
+        const platforms = root.platforms.filter((platform) => platform !== 'codex' || !options.preserveCodexRootIds.has(root.pluginId));
+        if (platforms.length > 0) {
+            next = removePluginIntentRootPlatforms(next, { ...root, platforms });
+        }
+    }
+    return next;
+}
+async function writeDesiredIntentSuperset(options) {
+    const location = { scope: options.scope, cwd: options.cwd, env: options.env };
+    let next = deriveDesiredIntentState({
+        command: options.command,
+        state: await readPluginIntentState(location),
+        selectedRoots: options.selectedRoots,
+        plan: options.plan,
+        catalogEntries: options.catalogEntries,
+    });
+    const superset = next;
+    await writePluginIntentState(location, superset);
+    const writes = [{ location, superset }];
+    if (options.command === 'install' || options.codexPlan) {
+        const otherScope = options.scope === 'user' ? 'project' : 'user';
+        const otherLocation = { scope: otherScope, cwd: options.cwd, env: options.env };
+        let other = await readPluginIntentState(otherLocation);
+        if (options.command === 'install') {
+            other = removeSelectedRootPlatformsFromOtherScope({
+                state: other,
+                selectedRoots: options.selectedRoots,
+                preserveCodexRootIds: options.preserveOtherCodexScopeRootIds,
+            });
+        }
+        const otherSuperset = other;
+        await writePluginIntentState(otherLocation, otherSuperset);
+        writes.push({
+            location: otherLocation,
+            superset: otherSuperset,
+        });
+    }
+    return writes;
+}
+function createSyntheticPlugin(pluginName, env) {
+    const rootDir = path.join(resolveAwHome(env), 'plugins', pluginName);
+    return {
+        rootDir,
+        manifestPath: path.join(rootDir, '.agents-plugin', 'plugin.json'),
+        manifest: {
+            schemaVersion: 3,
+            name: pluginName,
+            version: '0.0.0',
+            description: 'Cleanup-only target for a plugin missing from the current catalog.',
+            marketplace: {
+                category: 'cleanup',
+                strict: true,
+                policy: { installation: 'AVAILABLE', authentication: 'ON_INSTALL' },
+            },
+        },
+    };
+}
+function failedResult(command, identity, message, phase = 'preflight') {
+    return {
+        status: 'failed',
+        command,
+        target: identity,
+        actions: phase === 'preflight' ? [] : [{ name: phase, status: 'failed' }],
+        cleanupAttempted: false,
+        removed: [],
+        absent: [],
+        residual: [],
+        quarantined: [],
+        failures: [{ phase, message }],
+        error: { phase, message },
+    };
+}
+function toTargetResult(result) {
+    const errorPrefix = result.status === 'failed'
+        ? result.error.message.split(':', 1)[0]
+        : undefined;
+    return {
+        target: {
+            pluginName: result.target.pluginName,
+            ...(result.target.sourceId ? {
+                sourceId: result.target.sourceId,
+                sourceIdentity: result.target.sourceIdentity,
+                pluginId: result.target.pluginId,
+            } : {}),
+            platform: result.target.platform,
+            scope: result.target.scope,
+        },
+        action: result.command,
+        state: result.status === 'succeeded' ? 'completed' : 'failed',
+        ...(result.status === 'failed' ? {
+            message: result.error.message,
+            errorCode: errorPrefix && /^[A-Za-z][A-Za-z0-9]*$/u.test(errorPrefix)
+                ? errorPrefix
+                : 'writeFailed',
+        } : {}),
+    };
+}
+async function assertClaudeVersion(options) {
+    if (!options.platforms.includes('claude'))
+        return;
+    const failures = [];
+    const result = await probeAgentVersion('claude', {
+        cwd: options.cwd,
+        env: options.env,
+        runner: options.runtime.nativeCliRunner,
+    });
+    if (result.status !== 'supported')
+        failures.push(result);
+    if (failures.length > 0) {
+        throw new Error(failures.map((failure) => `${failure.command} 版本检查失败：${failure.details ?? failure.status}；最低版本 ${failure.requiredMinVersion}。`)
+            .join('；'));
+    }
+}
+async function resolveRequestedNames(options) {
+    const result = new Map();
+    for (const platform of options.platforms) {
+        const names = options.pluginNames;
+        result.set(platform, [...new Set(names)]);
+    }
+    return result;
+}
+async function runSingleSourceRebuildCommand(options) {
+    const runtime = {
+        env: options.runtime?.env ?? process.env,
+        nativeCliRunner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
+        reporter: options.runtime?.reporter ?? createNoopReporter(),
+        debugLogger: options.runtime?.debugLogger ?? createNoopDebugLogger(),
+        ...(options.runtime?.codexManager ? { codexManager: options.runtime.codexManager } : {}),
+        expectedCatalogConfigDigest: options.runtime?.expectedCatalogConfigDigest,
+        codexUserActivationDesired: options.runtime?.codexUserActivationDesired,
+    };
+    const env = runtime.env;
+    const selected = selectedPlatforms(options.commandOptions.platform);
+    const catalog = options.runtime?.catalogResolution;
+    if (!catalog)
+        throw new Error('Internal error: a resolved catalog source is required.');
+    const requestedByPlatform = await resolveRequestedNames({
+        command: options.command,
+        pluginNames: options.pluginNames,
+        all: options.all,
+        platforms: selected,
+        scope: options.commandOptions.scope,
+        cwd: options.commandOptions.cwd,
+        env,
+        nativeCliRunner: runtime.nativeCliRunner,
+    });
+    const exactPluginNames = [...new Set([...requestedByPlatform.values()].flat())];
+    const catalogPlugins = options.runtime?.resolvedCatalogPlugins ?? (await Promise.all(exactPluginNames.map(async (pluginName) => {
+        const pluginRoot = path.join(catalog.rootDir, 'plugins', pluginName);
+        return await fs.pathExists(pluginRoot)
+            ? readPluginManifest(pluginRoot, { mode: 'bundle' })
+            : null;
+    }))).filter((plugin) => plugin !== null);
+    if (options.runtime?.namespacedSource) {
+        for (const plugin of catalogPlugins) {
+            plugin.sourceId = options.runtime.namespacedSource.sourceId;
+            plugin.sourceIdentity = options.runtime.namespacedSource.sourceIdentity;
+            plugin.pluginId = formatPluginId({
+                sourceId: options.runtime.namespacedSource.sourceId,
+                pluginName: plugin.manifest.name,
+            });
+            plugin.marketplaceName = options.runtime.namespacedSource.marketplaceName;
+        }
+    }
+    const catalogByName = new Map(catalogPlugins.map((plugin) => [plugin.manifest.name, plugin]));
+    if (options.commandOptions.platform === 'both'
+        && options.command !== 'cleanup'
+        && options.command !== 'uninstall') {
+        for (const platform of selected) {
+            requestedByPlatform.set(platform, (requestedByPlatform.get(platform) ?? []).filter((pluginName) => {
+                const plugin = catalogByName.get(pluginName);
+                return !plugin || supportsPlatform(plugin.manifest, platform);
+            }));
+        }
+    }
+    const platforms = selected.filter((platform) => (requestedByPlatform.get(platform)?.length ?? 0) > 0);
+    const integration = createRebuildIntegration({
+        context: runtime,
+        scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
+        ...(options.execution?.prepared
+            ? { preparedTargets: [options.execution.prepared.target] }
+            : {}),
+    });
+    const targets = [];
+    const results = [];
+    const warnings = [];
+    const recordWarning = (error) => {
+        const message = error instanceof Error ? error.message : String(error);
+        if (!warnings.includes(message))
+            warnings.push(message);
+    };
+    for (const platform of platforms) {
+        for (const pluginName of requestedByPlatform.get(platform) ?? []) {
+            const currentPlugin = catalogByName.get(pluginName);
+            const identity = {
+                ...(options.runtime?.namespacedSource ?? {}),
+                ...(options.runtime?.namespacedSource ? {
+                    pluginId: formatPluginId({
+                        sourceId: options.runtime.namespacedSource.sourceId,
+                        pluginName,
+                    }),
+                } : currentPlugin?.pluginId ? { pluginId: currentPlugin.pluginId } : {}),
+                pluginName,
+                pluginVersion: currentPlugin?.manifest.version ?? '0.0.0',
+                platform,
+                scope: options.commandOptions.scope,
+                cwd: options.commandOptions.cwd,
+            };
+            if (!currentPlugin && options.command !== 'cleanup' && options.command !== 'uninstall') {
+                results.push(failedResult(options.command, identity, `${pluginName} 当前不在 current catalog 中。`));
+                continue;
+            }
+            const plugin = currentPlugin ?? createSyntheticPlugin(pluginName, env);
+            if (currentPlugin
+                && options.command !== 'cleanup'
+                && options.command !== 'uninstall'
+                && !supportsPlatform(currentPlugin.manifest, platform)) {
+                results.push(failedResult(options.command, identity, `${pluginName} 当前 catalog 不支持 ${platform}。`));
+                continue;
+            }
+            if (currentPlugin
+                && platform === 'codex'
+                && options.commandOptions.scope === 'project'
+                && options.command !== 'cleanup'
+                && options.command !== 'uninstall'
+                && codexProjectConfigAliasesUserHome(options.commandOptions.cwd, env)) {
+                results.push(failedResult(options.command, identity, 'codexScopePathAlias: Codex project config 与用户配置目录相同。请进入实际项目目录后重试。'));
+                continue;
+            }
+            let result;
+            try {
+                if (options.execution?.preparationError)
+                    throw options.execution.preparationError;
+                const target = options.execution?.prepared?.target ?? await integration.buildTarget({
+                    ...(options.runtime?.namespacedSource ?? {}),
+                    ...(options.runtime?.namespacedSource ? {
+                        pluginId: formatPluginId({
+                            sourceId: options.runtime.namespacedSource.sourceId,
+                            pluginName,
+                        }),
+                    } : plugin.pluginId ? { pluginId: plugin.pluginId } : {}),
+                    plugin,
+                    platform,
+                    scope: options.commandOptions.scope,
+                    cwd: options.commandOptions.cwd,
+                    command: options.command,
+                    catalog,
+                });
+                targets.push(target);
+                if (!options.execution?.targetHookCompleted) {
+                    await rebuildCommandTestHooks?.afterTargetBuilt?.({
+                        command: options.command,
+                        identity,
+                    });
+                }
+                if (!options.execution?.reviewCompleted) {
+                    await options.runtime?.reviewPreflight?.({
+                        command: options.command,
+                        identity,
+                        ...options.runtime.resolvedReviewEvidenceByPlugin?.[pluginName],
+                    });
+                }
+                const driver = options.execution?.deferredPostApplyTasks
+                    ? {
+                        ...integration.driver,
+                        runPostApply: async (invocation) => {
+                            options.execution.deferredPostApplyTasks.push({
+                                pluginId: identity.pluginId ?? identity.pluginName,
+                                run: async () => {
+                                    const startedAt = Date.now();
+                                    const emit = (data) => emitRebuildActionEvent(runtime, {
+                                        type: 'rebuild:action',
+                                        source: {
+                                            plugin: invocation.target.identity.pluginName,
+                                            platform: invocation.target.identity.platform,
+                                            scope: invocation.target.identity.scope,
+                                            action: options.command,
+                                        },
+                                        data,
+                                    });
+                                    await emit({ name: 'postApply', phase: 'start' });
+                                    try {
+                                        await integration.driver.runPostApply(invocation);
+                                    }
+                                    catch (error) {
+                                        await emit({
+                                            name: 'postApply',
+                                            phase: 'failure',
+                                            durationMs: Math.max(0, Date.now() - startedAt),
+                                            message: '运行 postApply 失败。',
+                                        });
+                                        throw error;
+                                    }
+                                    await emit({
+                                        name: 'postApply',
+                                        phase: 'success',
+                                        durationMs: Math.max(0, Date.now() - startedAt),
+                                    });
+                                },
+                                onFailure: (error) => {
+                                    recordWarning(error);
+                                    const action = result.actions.find((entry) => entry.name === 'postApply');
+                                    if (action)
+                                        action.status = 'failed';
+                                },
+                            });
+                        },
+                    }
+                    : {
+                        ...integration.driver,
+                        runPostApply: async (invocation) => {
+                            try {
+                                await integration.driver.runPostApply(invocation);
+                            }
+                            catch (error) {
+                                recordWarning(error);
+                                throw error;
+                            }
+                        },
+                    };
+                result = await executeRebuildOperation({
+                    command: options.command,
+                    target,
+                    driver,
+                    onActionEvent: (event) => options.execution?.deferredPostApplyTasks
+                        && event.data.name === 'postApply'
+                        ? undefined
+                        : emitRebuildActionEvent(runtime, event),
+                });
+            }
+            catch (error) {
+                result = error.result ?? failedResult(options.command, identity, error instanceof Error ? error.message : String(error), 'preflight');
+            }
+            results.push(result);
+        }
+    }
+    const successful = results.filter((result) => result.status === 'succeeded');
+    return {
+        platforms,
+        plugins: [...new Set(successful.map((result) => result.target.pluginName))],
+        warnings: [...new Set(warnings)],
+        rebuildResults: results,
+        targetResults: results.map(toTargetResult),
+        overallState: successful.length === results.length
+            ? 'succeeded'
+            : successful.length > 0 ? 'partial' : 'failed',
+        receiptTargets: results.map((result) => ({
+            pluginName: result.target.pluginName,
+            ...(result.target.sourceId ? {
+                sourceId: result.target.sourceId,
+                pluginId: result.target.pluginId,
+            } : {}),
+            platform: result.target.platform,
+            scope: result.target.scope,
+        })),
+    };
+}
+function resolveRuntimeCliVersion() {
+    const value = fs.readJsonSync(path.join(resolveCliPackageRoot(), 'package.json'));
+    return assertStrictSemVer(value.version, 'packages/cli/package.json version');
+}
+function toCatalogResolution(source) {
+    return {
+        rootDir: source.rootDir,
+        source: 'local',
+        catalogVersion: source.manifest.catalogVersion,
+        channel: source.manifest.channel,
+    };
+}
+function mergeRebuildCommandResults(results) {
+    const rebuildResults = results.flatMap((result) => result.rebuildResults);
+    const platforms = [...new Set(results.flatMap((result) => result.platforms))];
+    return {
+        platforms,
+        plugins: [...new Set(results.flatMap((result) => result.plugins))],
+        warnings: [...new Set(results.flatMap((result) => result.warnings))],
+        rebuildResults,
+        targetResults: results.flatMap((result) => result.targetResults),
+        overallState: rebuildResults.every((result) => result.status === 'succeeded')
+            ? 'succeeded'
+            : rebuildResults.some((result) => result.status === 'succeeded') ? 'partial' : 'failed',
+        receiptTargets: results.flatMap((result) => result.receiptTargets),
+        ...(results.find((result) => result.dependencyPlan)?.dependencyPlan
+            ? { dependencyPlan: results.find((result) => result.dependencyPlan).dependencyPlan }
+            : {}),
+        ...(results.find((result) => result.codexManagerPreview)?.codexManagerPreview
+            ? { codexManagerPreview: results.find((result) => result.codexManagerPreview).codexManagerPreview }
+            : {}),
+        ...(results.find((result) => result.operationPlan)?.operationPlan
+            ? { operationPlan: results.find((result) => result.operationPlan).operationPlan }
+            : {}),
+        ...(results.some((result) => result.offlineCleanupPlans !== undefined)
+            ? { offlineCleanupPlans: results.flatMap((result) => result.offlineCleanupPlans ?? []) }
+            : {}),
+    };
+}
+function reconcileOverallState(targetResults, plan) {
+    const failed = targetResults.some((result) => result.state === 'failed' || result.action === 'skipped');
+    if (!failed)
+        return 'succeeded';
+    const requested = new Set(plan.targets
+        .filter((target) => target.relation === 'requested')
+        .map((target) => `${target.pluginId}\0${target.platform}`));
+    const completedRequested = targetResults.some((result) => result.state === 'completed'
+        && result.action !== 'skipped'
+        && result.target.pluginId !== undefined
+        && requested.has(`${result.target.pluginId}\0${result.target.platform}`));
+    return completedRequested ? 'partial' : 'failed';
+}
+function createRebuildOperationPlan(options) {
+    const selectedRoots = [...new Map(options.dependencyPlan.targets.flatMap((target) => target.relation === 'requested'
+            ? [[target.pluginId, {
+                        pluginId: target.pluginId,
+                        platforms: options.dependencyPlan.targets.flatMap((candidate) => candidate.relation === 'requested' && candidate.pluginId === target.pluginId
+                            ? [candidate.platform]
+                            : []),
+                    }]]
+            : [])).values()];
+    const intentBefore = options.intentBeforeByScope[options.scope];
+    const intentAfter = deriveDesiredIntentState({
+        command: options.command,
+        state: intentBefore,
+        selectedRoots,
+        plan: options.dependencyPlan,
+        catalogEntries: options.catalogEntries,
+    });
+    const beforeDigest = calculatePluginIntentDigest(intentBefore);
+    const afterDigest = calculatePluginIntentDigest(intentAfter);
+    const actions = [
+        ...(options.targetActions ?? []),
+        ...options.codexPlans.flatMap((plan) => [
+            ...plan.sharedNativeActions.flatMap((action) => action.action === 'install' || action.action === 'replace' || action.action === 'repair'
+                ? [{
+                        kind: 'ensureNativeRegistration',
+                        pluginId: action.pluginId,
+                        platform: 'codex',
+                        scope: options.dependencyPlan.targets.find((target) => target.pluginId === action.pluginId && target.platform === 'codex')?.resolvedScope ?? 'user',
+                        registration: action.codexPluginId,
+                    }]
+                : []),
+            ...['user', 'project'].flatMap((scope) => plan.activationActions[scope].flatMap((action) => action.action === 'none'
+                ? []
+                : [{
+                        kind: 'setActivation',
+                        pluginId: action.pluginId,
+                        platform: 'codex',
+                        scope,
+                        enabled: action.desired,
+                    }])),
+            ...plan.staleActivationRemovals.map((action) => ({
+                kind: 'setActivation',
+                pluginId: action.codexPluginId,
+                platform: 'codex',
+                scope: action.scope,
+                enabled: false,
+            })),
+        ]),
+    ];
+    return createOperationPlan({
+        intentChanges: beforeDigest === afterDigest
+            ? []
+            : [{ scope: options.scope, beforeDigest, afterDigest }],
+        actions,
+        changes: options.dependencyPlan.targets.map((target) => [
+            target.pluginId,
+            target.platform,
+            target.resolvedScope,
+            target.action,
+        ].join(':')),
+        warnings: options.codexPlans.flatMap((plan) => plan.warnings),
+        evidence: {
+            catalogDigests: options.catalogSources.map((source) => ({
+                sourceId: source.sourceId,
+                digest: source.manifestDigest,
+            })),
+            intentDigests: ['user', 'project'].map((scope) => ({
+                scope,
+                digest: calculatePluginIntentDigest(options.intentBeforeByScope[scope]),
+            })),
+            configDigests: options.configDigests,
+            targetOwnerFingerprints: options.dependencyPlan.targets.map((target) => ({
+                pluginId: target.pluginId,
+                platform: target.platform,
+                scope: target.resolvedScope,
+                fingerprint: JSON.stringify({ state: target.state, errorCode: target.errorCode ?? null }),
+            })),
+        },
+    });
+}
+function leaseSafeRebuildResult(result) {
+    const projectPath = (value) => path.basename(value);
+    return {
+        ...result,
+        rebuildResults: result.rebuildResults.map((entry) => ({
+            ...entry,
+            target: { ...entry.target, cwd: '.' },
+            removed: entry.removed.map(projectPath),
+            absent: entry.absent.map(projectPath),
+            residual: entry.residual.map(projectPath),
+            quarantined: entry.quarantined.map(projectPath),
+        })),
+    };
+}
+function namespacedPreflightError(message, targets, legacyTargets = []) {
+    return Object.assign(new Error(message), { namespacedTargets: targets, legacyTargets });
+}
+function selectedLegacyLiveReferences(references, platforms, scope) {
+    return references.filter((reference) => (reference.kind === 'legacyOwner' || reference.kind === 'legacyMarketplace')
+        && reference.pluginName
+        && reference.scope === scope
+        && reference.platform
+        && platforms.has(reference.platform));
+}
+function projectLegacyTargets(references) {
+    return [...new Map(references.map((reference) => {
+            const target = {
+                pluginName: reference.pluginName,
+                platform: reference.platform,
+                scope: reference.scope,
+            };
+            return [`${target.pluginName}\0${target.platform}\0${target.scope}`, target];
+        })).values()];
+}
+function resolveLiveCleanupTargets(options) {
+    const visible = options.references.filter((reference) => (reference.kind === 'namespacedOwner'
+        || reference.kind === 'namespacedMarketplace')
+        && reference.sourceId
+        && reference.pluginName
+        && reference.platform
+        && options.platforms.includes(reference.platform)
+        && reference.scope === options.scope);
+    const targets = [];
+    const selectors = options.selectors.map((value) => {
+        const parsed = parsePluginId(value);
+        const matchesByTarget = new Map();
+        for (const reference of visible.filter((entry) => entry.pluginName === parsed.pluginName
+            && (parsed.sourceId === undefined || entry.sourceId === parsed.sourceId))) {
+            const stableSourceIdentity = reference.sourceIdentity
+                ?? options.references.find((entry) => entry.kind === 'namespacedMarketplace'
+                    && entry.sourceId === reference.sourceId
+                    && entry.sourceIdentity)?.sourceIdentity
+                ?? 'unavailable';
+            const liveNames = new Set(options.references.flatMap((candidate) => candidate.sourceId === reference.sourceId
+                && candidate.pluginName === reference.pluginName
+                && candidate.platform === reference.platform
+                && candidate.scope === reference.scope
+                && candidate.marketplaceName
+                ? [candidate.marketplaceName]
+                : []));
+            const registeredNames = canonicalMarketplaceRegistrationNames(options.references, reference.sourceId);
+            const unboundNativeNames = new Set(options.references.flatMap((candidate) => candidate.kind === 'namespacedMarketplace'
+                && candidate.sourceId === undefined
+                && candidate.pluginName === reference.pluginName
+                && candidate.platform === reference.platform
+                && candidate.scope === reference.scope
+                && candidate.marketplaceName
+                ? [candidate.marketplaceName]
+                : []));
+            const marketplaceName = liveNames.size === 1
+                ? [...liveNames][0]
+                : liveNames.size === 0 && registeredNames.length === 1
+                    ? registeredNames[0]
+                    : undefined;
+            const marketplaceIdentityUnresolved = liveNames.size > 1
+                || (liveNames.size === 0 && registeredNames.length > 1)
+                || (liveNames.size === 0 && registeredNames.length === 0 && unboundNativeNames.size > 0);
+            const target = {
+                pluginId: formatPluginId({ sourceId: reference.sourceId, pluginName: reference.pluginName }),
+                pluginName: reference.pluginName,
+                sourceId: reference.sourceId,
+                sourceIdentity: stableSourceIdentity,
+                platform: reference.platform,
+                scope: reference.scope,
+                ...(marketplaceName ? { marketplaceName } : {}),
+                ...((liveNames.size === 1
+                    || (marketplaceName !== undefined && unboundNativeNames.has(marketplaceName)))
+                    ? { nativeRegistration: true }
+                    : {}),
+                ...(marketplaceIdentityUnresolved ? { marketplaceIdentityUnresolved: true } : {}),
+            };
+            const key = [target.pluginId, target.sourceIdentity, target.platform, target.scope].join('\0');
+            const previous = matchesByTarget.get(key);
+            matchesByTarget.set(key, previous?.marketplaceName ? previous : target);
+        }
+        const matches = [...matchesByTarget.values()];
+        const identities = [...new Set(matches.map((target) => target.pluginId))];
+        if (parsed.sourceId === undefined && identities.length > 1) {
+            throw new Error(`pluginSelectorAmbiguous: Plugin "${parsed.pluginName}" has multiple live matches: ${identities.sort().join(', ')}.`);
+        }
+        targets.push(...matches);
+        return identities.length === 1 ? identities[0] : value;
+    });
+    return {
+        selectors,
+        targets: [...new Map(targets.map((target) => [[
+                    target.pluginId, target.sourceIdentity, target.platform, target.scope,
+                ].join('\0'), target])).values()],
+    };
+}
+async function cleanupOfflineOwnedComponents(options) {
+    const results = [];
+    const warnings = [];
+    const nativeCliRunner = options.nativeCliRunner ?? getDefaultNativeCliRunner();
+    const codexManager = options.codexManager;
+    const context = {
+        env: options.env,
+        nativeCliRunner,
+        ...(codexManager ? { codexManager } : {}),
+        reporter: createNoopReporter(),
+        debugLogger: createNoopDebugLogger(),
+    };
+    const integration = createRebuildIntegration({ context });
+    for (const target of options.targets) {
+        const inventoryErrors = (options.inventoryErrors ?? []).filter((error) => error.relevance.global || ((error.relevance.sourceId === undefined || error.relevance.sourceId === target.sourceId)
+            && (error.relevance.pluginName === undefined || error.relevance.pluginName === target.pluginName)
+            && (error.relevance.platform === undefined || error.relevance.platform === target.platform)
+            && (error.relevance.scope === undefined || error.relevance.scope === target.scope)));
+        const evidence = options.evidence?.find((candidate) => candidate.pluginId === target.pluginId
+            && candidate.sourceIdentity === target.sourceIdentity
+            && candidate.platform === target.platform
+            && candidate.scope === target.scope);
+        const activationAction = target.platform === 'codex'
+            ? evidence?.plan.actions.find((action) => action.action === 'removeNativeRegistration'
+                && action.activationScope === target.scope)
+            : undefined;
+        let activationDisposition = 'remove';
+        if (activationAction && target.scope === 'user') {
+            activationDisposition = 'disable';
+        }
+        const plugin = createSyntheticPlugin(target.pluginName, options.env);
+        plugin.sourceId = target.sourceId;
+        plugin.sourceIdentity = target.sourceIdentity;
+        plugin.pluginId = target.pluginId;
+        const marketplaceName = target.marketplaceName ?? 'aw';
+        plugin.marketplaceName = marketplaceName;
+        const desired = await integration.buildTarget({
+            sourceId: target.sourceId,
+            sourceIdentity: target.sourceIdentity,
+            pluginId: target.pluginId,
+            marketplaceName,
+            marketplaceRoot: path.join(resolveAwHome(options.env), 'marketplaces', target.sourceId),
+            plugin,
+            platform: target.platform,
+            scope: target.scope,
+            cwd: options.cwd,
+            command: 'cleanup',
+            catalog: {
+                rootDir: resolveAwHome(options.env),
+                source: 'local',
+                catalogVersion: '0.0.0',
+                channel: 'beta',
+            },
+            includeNativeCleanupCandidate: target.nativeRegistration === true,
+            preserveCodexSharedNativePayload: target.platform === 'codex',
+            ...(activationAction
+                ? {
+                    codexActivationCleanup: [{
+                            codexPluginId: activationAction.target,
+                            scope: activationAction.activationScope,
+                            disposition: activationDisposition,
+                        }],
+                }
+                : {}),
+        });
+        const result = await executeRebuildOperation({
+            command: 'cleanup',
+            target: desired,
+            driver: integration.driver,
+        });
+        if (target.marketplaceIdentityUnresolved) {
+            result.residual.push('nativeMarketplaceIdentityUnresolved');
+            warnings.push(`nativeMarketplaceIdentityUnresolved: Preserved ambiguous native registration for ${target.pluginId} on ${target.platform}/${target.scope}.`);
+        }
+        let finalResult = result;
+        if (inventoryErrors.length > 0) {
+            const message = 'stateInventoryResidual: Some weak state could not be verified. Retry cleanup, use cleanup --force only for exclusively owned damaged output, or run reinstall/sync to restore the target.';
+            result.residual = [...new Set([
+                    ...result.residual,
+                    ...inventoryErrors.map((error) => error.location),
+                ])];
+            warnings.push(...inventoryErrors.map((error) => `stateInventoryResidual: ${error.kind}: ${error.message}`));
+            if (result.status === 'succeeded') {
+                finalResult = {
+                    ...result,
+                    status: 'failed',
+                    failures: [...result.failures, { phase: 'cleanup.owned', message }],
+                    error: { phase: 'cleanup.owned', message },
+                };
+            }
+        }
+        results.push(finalResult);
+    }
+    const obsoleteContracts = path.join(resolveAwHome(options.env), 'installation-contracts');
+    try {
+        await (options.removeObsoleteInstallationContracts ?? fs.remove)(obsoleteContracts);
+    }
+    catch (error) {
+        warnings.push(`obsoleteContractsCleanupFailed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return leaseSafeRebuildResult({
+        platforms: [...new Set(results.map((result) => result.target.platform))],
+        plugins: results.filter((result) => result.status === 'succeeded').map((result) => result.target.pluginName),
+        warnings: [...new Set(warnings)],
+        rebuildResults: results,
+        targetResults: results.map(toTargetResult),
+        overallState: results.every((result) => result.status === 'succeeded') ? 'succeeded' : 'failed',
+        receiptTargets: results.map((result) => ({
+            pluginName: result.target.pluginName,
+            pluginId: result.target.pluginId,
+            sourceId: result.target.sourceId,
+            platform: result.target.platform,
+            scope: result.target.scope,
+        })),
+        ...(options.evidence ? { offlineCleanupPlans: options.evidence } : {}),
+    });
+}
+async function previewOfflineOwnedComponents(options) {
+    await options.onPreviewStage?.('inventory');
+    const preview = mergeRebuildCommandResults([]);
+    preview.warnings.push(...options.targets.flatMap((target) => target.marketplaceIdentityUnresolved
+        ? [`nativeMarketplaceIdentityUnresolved: Preserved ambiguous native registration for ${target.pluginId} on ${target.platform}/${target.scope}.`]
+        : []));
+    if (options.evidence) {
+        preview.offlineCleanupPlans = options.evidence;
+        preview.operationPlan = createOfflineCleanupOperationPlan(options.evidence);
+    }
+    await options.onPreviewStage?.('dependencyPlan');
+    return preview;
+}
+function createOfflineCleanupOperationPlan(evidence) {
+    return createOperationPlan({
+        intentChanges: [],
+        actions: evidence.flatMap((target) => target.plan.actions.map((action) => action.action === 'removeNativeRegistration'
+            ? {
+                kind: 'removeNativeRegistration',
+                pluginId: target.pluginId,
+                platform: target.platform,
+                scope: target.scope,
+                registration: action.target,
+            }
+            : {
+                kind: 'removeOwnedArtifact',
+                pluginId: target.pluginId,
+                platform: target.platform,
+                scope: target.scope,
+                path: action.target,
+                ownerFingerprint: target.targetFingerprint,
+            })),
+        changes: evidence.flatMap((target) => target.plan.actions.map((action) => `${target.pluginId}:${action.action}:${action.target}`)),
+        warnings: [],
+        evidence: {
+            catalogDigests: evidence.map((target) => ({
+                sourceId: target.sourceId,
+                digest: target.sourceIdentity,
+            })),
+            intentDigests: [],
+            configDigests: [],
+            targetOwnerFingerprints: evidence.map((target) => ({
+                pluginId: target.pluginId,
+                platform: target.platform,
+                scope: target.scope,
+                fingerprint: target.targetFingerprint,
+            })),
+        },
+    });
+}
+async function buildForceExclusiveCleanupPlan(options) {
+    const targets = [];
+    const evidence = [];
+    for (const selector of options.selectors) {
+        const parsed = parsePluginId(selector);
+        const sourceId = parsed.sourceId ?? options.primarySourceId;
+        if (!sourceId) {
+            throw namespacedPreflightError('forceCleanupPathUnavailable: The selected plugin has no local Active source identity. Restore the local Active bundle, then retry cleanup --force, or inspect and remove the exact output manually.', []);
+        }
+        let active;
+        let plugin;
+        try {
+            active = await resolveActiveCatalogPluginShallow({
+                sourceId,
+                pluginName: parsed.pluginName,
+                env: options.env,
+            });
+            plugin = active.plugin;
+        }
+        catch {
+            const unavailableTarget = options.platforms.map((platform) => ({
+                pluginId: formatPluginId({ sourceId, pluginName: parsed.pluginName }),
+                pluginName: parsed.pluginName,
+                sourceId,
+                sourceIdentity: 'unavailable',
+                platform,
+                scope: options.scope,
+            }));
+            throw namespacedPreflightError('forceCleanupPathUnavailable: The exact exclusive output path is unavailable from live evidence and the local Active bundle. Restore the local Active bundle, then retry cleanup --force, or inspect and remove the exact output manually.', unavailableTarget);
+        }
+        const pluginId = formatPluginId({ sourceId, pluginName: parsed.pluginName });
+        plugin.sourceId = sourceId;
+        plugin.sourceIdentity = active.sourceIdentity;
+        plugin.pluginId = pluginId;
+        plugin.marketplaceName = sourceId === options.primarySourceId ? 'aw' : `aw-${sourceId}`;
+        const context = {
+            env: options.env,
+            nativeCliRunner: getDefaultNativeCliRunner(),
+            reporter: createNoopReporter(),
+            debugLogger: createNoopDebugLogger(),
+        };
+        const integration = createRebuildIntegration({ context });
+        for (const platform of options.platforms) {
+            const inspectedTarget = await integration.buildTarget({
+                sourceId,
+                sourceIdentity: active.sourceIdentity,
+                pluginId,
+                marketplaceName: plugin.marketplaceName,
+                marketplaceRoot: path.join(resolveAwHome(options.env), 'marketplaces', sourceId),
+                plugin,
+                platform,
+                scope: options.scope,
+                cwd: options.cwd,
+                command: 'install',
+                catalog: {
+                    rootDir: active.snapshotPath,
+                    source: 'local',
+                    catalogVersion: active.catalogVersion,
+                },
+                readOnlyInspectionPlan: true,
+                readOnlyShallowInspectionPlan: true,
+            });
+            const expected = [...new Set([
+                    ...(inspectedTarget.desiredOwnedComponents ?? []),
+                    ...(inspectedTarget.optionalOwnedComponents ?? []),
+                ])].filter((component) => component.kind === 'skill-directory' || component.kind === 'owned-text-file');
+            const inspection = await inspectOwnedComponents({
+                components: expected,
+                executor: integration.driver.ownership,
+                forceExclusive: true,
+            });
+            const ordinaryInspection = await inspectOwnedComponents({
+                components: expected,
+                executor: integration.driver.ownership,
+            });
+            const removable = inspection.components.flatMap((entry) => entry.state === 'present'
+                && (options.damagedOnly !== true
+                    || ordinaryInspection.components.find((candidate) => candidate.component === entry.component)?.state !== 'present')
+                && 'path' in entry.component
+                ? [entry.component]
+                : []);
+            if (removable.length === 0)
+                continue;
+            const target = {
+                ...inspectedTarget,
+                ownedComponents: removable,
+                desiredOwnedComponents: removable,
+                optionalOwnedComponents: [],
+                requiresNative: false,
+                writeNativeRequired: false,
+                artifacts: inspectedTarget.artifacts.filter((artifact) => removable.some((component) => path.resolve(component.path) === path.resolve(artifact.path))),
+                operationActions: [],
+                forceExclusiveCleanup: true,
+            };
+            targets.push(target);
+            evidence.push(await forceOfflineCleanupEvidence({
+                reason: 'bundleUnavailable',
+                pluginId,
+                pluginName: parsed.pluginName,
+                sourceId,
+                sourceIdentity: active.sourceIdentity,
+                platform,
+                scope: options.scope,
+                components: removable,
+            }));
+        }
+    }
+    if (targets.length === 0) {
+        return { targets, evidence };
+    }
+    return { targets, evidence };
+}
+async function buildLiveForceExclusiveCleanupPlan(options) {
+    const targets = [];
+    const evidence = [];
+    for (const target of options.targets) {
+        const components = [];
+        const references = options.inventory.references.filter((reference) => reference.kind === 'namespacedOwner'
+            && reference.sourceId === target.sourceId
+            && reference.pluginName === target.pluginName
+            && reference.platform === target.platform
+            && reference.scope === target.scope);
+        for (const reference of references) {
+            if (path.basename(reference.location) === SKILL_OWNER_MARKER) {
+                const skillRoot = path.dirname(reference.location);
+                const allowedRoot = path.dirname(skillRoot);
+                const marker = await readSkillOwnerMarker({ skillRoot, allowedRoot }).catch(() => null);
+                if (marker
+                    && marker.sourceId === target.sourceId
+                    && marker.pluginId === target.pluginId
+                    && marker.platform === target.platform
+                    && marker.scope === target.scope) {
+                    components.push({ kind: 'skill-directory', path: skillRoot, allowedRoot, identity: marker });
+                }
+                continue;
+            }
+            const parsed = await fs.readFile(reference.location, 'utf8')
+                .then((content) => parseOwnedTextHeader(content))
+                .catch(() => null);
+            if (parsed
+                && parsed.identity.sourceId === target.sourceId
+                && parsed.identity.pluginId === target.pluginId
+                && parsed.identity.platform === target.platform
+                && parsed.identity.scope === target.scope) {
+                components.push({
+                    kind: 'owned-text-file',
+                    path: reference.location,
+                    allowedRoot: path.dirname(reference.location),
+                    identity: parsed.identity,
+                });
+            }
+        }
+        if (components.length === 0)
+            continue;
+        const plugin = createSyntheticPlugin(target.pluginName, options.env);
+        plugin.sourceId = target.sourceId;
+        plugin.sourceIdentity = target.sourceIdentity;
+        plugin.pluginId = target.pluginId;
+        plugin.marketplaceName = target.marketplaceName;
+        targets.push({
+            plugin,
+            identity: {
+                sourceId: target.sourceId,
+                sourceIdentity: target.sourceIdentity,
+                pluginId: target.pluginId,
+                pluginName: target.pluginName,
+                pluginVersion: plugin.manifest.version,
+                platform: target.platform,
+                scope: target.scope,
+                cwd: options.cwd,
+            },
+            ownedComponents: components,
+            desiredOwnedComponents: components,
+            optionalOwnedComponents: [],
+            requiresNative: false,
+            writeNativeRequired: false,
+            artifacts: [],
+            operationActions: [],
+            postApplySource: plugin,
+            forceExclusiveCleanup: true,
+        });
+        evidence.push(await forceOfflineCleanupEvidence({
+            reason: 'bundleUnavailable',
+            pluginId: target.pluginId,
+            pluginName: target.pluginName,
+            sourceId: target.sourceId,
+            sourceIdentity: target.sourceIdentity,
+            platform: target.platform,
+            scope: target.scope,
+            components,
+        }));
+    }
+    return { targets, evidence };
+}
+async function mergeForceCleanupPlans(...plans) {
+    const targets = new Map();
+    for (const target of plans.flatMap((plan) => plan.targets)) {
+        const key = `${target.identity.pluginId}\0${target.identity.platform}\0${target.identity.scope}`;
+        const previous = targets.get(key);
+        if (!previous) {
+            targets.set(key, target);
+            continue;
+        }
+        const components = [...previous.ownedComponents];
+        for (const component of target.ownedComponents) {
+            if ('path' in component && !components.some((candidate) => 'path' in candidate && path.resolve(candidate.path) === path.resolve(component.path))) {
+                components.push(component);
+            }
+        }
+        previous.ownedComponents = components;
+        previous.desiredOwnedComponents = components;
+    }
+    const mergedTargets = [...targets.values()];
+    return {
+        targets: mergedTargets,
+        evidence: await Promise.all(mergedTargets.map((target) => forceOfflineCleanupEvidence({
+            reason: 'bundleUnavailable',
+            pluginId: target.identity.pluginId,
+            pluginName: target.identity.pluginName,
+            sourceId: target.identity.sourceId,
+            sourceIdentity: target.identity.sourceIdentity,
+            platform: target.identity.platform,
+            scope: target.identity.scope,
+            components: target.ownedComponents,
+        }))),
+    };
+}
+export async function runRebuildCommand(options) {
+    const runtimeEnv = options.runtime?.env ?? process.env;
+    const readInventory = options.runtime?.inventoryCatalogSourceReferences
+        ?? inventoryCatalogSourceReferences;
+    let ordinaryInventory;
+    const readOrdinaryInventory = async () => {
+        ordinaryInventory ??= await measureCommandPerformanceStage(options.runtime, 'inventory', () => readInventory({
+            cwd: options.commandOptions.cwd,
+            env: runtimeEnv,
+        }));
+        return ordinaryInventory;
+    };
+    let requestedPluginNames = options.pluginNames;
+    const cleanupForce = options.command === 'cleanup'
+        && options.commandOptions.force === true;
+    const expectedOfflineCleanup = options.runtime?.expectedOfflineCleanupEvidence;
+    let cleanupInventory;
+    let cleanupLiveTargets = [];
+    let liveTargets = [];
+    let legacyLiveTargets = [];
+    let malformedSelectedConfigPreserved = false;
+    if (options.command === 'cleanup' && !options.all) {
+        cleanupInventory = await readOrdinaryInventory();
+        const live = resolveLiveCleanupTargets({
+            selectors: requestedPluginNames,
+            platforms: selectedPlatforms(options.commandOptions.platform),
+            scope: options.commandOptions.scope,
+            references: cleanupInventory.references,
+        });
+        requestedPluginNames = live.selectors;
+        cleanupLiveTargets = live.targets;
+        if (expectedOfflineCleanup && expectedOfflineCleanup.forceExclusive !== true) {
+            const liveTarget = cleanupLiveTargets.find((target) => target.pluginId === expectedOfflineCleanup.pluginId
+                && target.pluginName === expectedOfflineCleanup.pluginName
+                && target.sourceId === expectedOfflineCleanup.sourceId
+                && target.sourceIdentity === expectedOfflineCleanup.sourceIdentity
+                && target.platform === expectedOfflineCleanup.platform
+                && target.scope === expectedOfflineCleanup.scope);
+            const actualOfflineCleanup = liveTarget
+                ? offlineCleanupEvidenceFromInventory({
+                    ...expectedOfflineCleanup,
+                    inventory: cleanupInventory,
+                })
+                : null;
+            if (!liveTarget
+                || !actualOfflineCleanup
+                || !offlineCleanupEvidenceMatches(expectedOfflineCleanup, actualOfflineCleanup)) {
+                throw namespacedPreflightError('operationReviewStale: offline cleanup ownership evidence changed before mutation.', cleanupLiveTargets);
+            }
+            cleanupLiveTargets = [liveTarget];
+        }
+        liveTargets = cleanupLiveTargets;
+        if (cleanupLiveTargets.length > 0) {
+            const filtered = omitSelectedPluginConfigErrors(cleanupInventory, cleanupLiveTargets);
+            cleanupInventory = filtered.inventory;
+            malformedSelectedConfigPreserved ||= filtered.omitted;
+        }
+    }
+    if (options.all) {
+        const inventory = await readOrdinaryInventory();
+        if (options.command !== 'cleanup') {
+            assertRebuildCatalogSourceInventoryComplete(inventory, options.commandOptions.scope);
+        }
+        const requestedPlatforms = new Set(selectedPlatforms(options.commandOptions.platform));
+        legacyLiveTargets = projectLegacyTargets(selectedLegacyLiveReferences(inventory.references, requestedPlatforms, options.commandOptions.scope));
+        const live = inventory.references.filter((reference) => (reference.kind === 'namespacedOwner' || reference.kind === 'namespacedMarketplace')
+            && reference.sourceId
+            && reference.pluginName
+            && reference.scope === options.commandOptions.scope
+            && reference.platform
+            && requestedPlatforms.has(reference.platform));
+        const projectedTargets = [...new Map(live.map((reference) => {
+                const target = {
+                    pluginId: formatPluginId({
+                        sourceId: reference.sourceId,
+                        pluginName: reference.pluginName,
+                    }),
+                    pluginName: reference.pluginName,
+                    sourceId: reference.sourceId,
+                    sourceIdentity: reference.sourceIdentity ?? 'unavailable',
+                    platform: reference.platform,
+                    scope: reference.scope,
+                };
+                return [[
+                        target.pluginId,
+                        target.sourceIdentity,
+                        target.platform,
+                        target.scope,
+                    ].join('\0'), target];
+            })).values()];
+        liveTargets = projectedTargets;
+        if (options.command === 'cleanup') {
+            cleanupInventory = inventory;
+            cleanupLiveTargets = projectedTargets;
+        }
+        const identities = new Set();
+        for (const reference of live) {
+            const pluginId = formatPluginId({ sourceId: reference.sourceId, pluginName: reference.pluginName });
+            identities.add(pluginId);
+        }
+        requestedPluginNames = [...identities];
+    }
+    const selectors = requestedPluginNames.map(parsePluginId);
+    const sourceIds = planPluginSelectorSourceIds(selectors);
+    if (options.all && selectors.length === 0) {
+        if (legacyLiveTargets.length > 0) {
+            throw namespacedPreflightError(`legacyStateUnsupported: legacy live runtime state exists for ${legacyLiveTargets.map((target) => `${target.pluginName}:${target.platform}/${target.scope}`).join(', ')}.`, [], legacyLiveTargets);
+        }
+        return mergeRebuildCommandResults([]);
+    }
+    if (options.command === 'cleanup') {
+        if (cleanupForce) {
+            const requestedPlatforms = selectedPlatforms(options.commandOptions.platform);
+            const cleanupSourceSnapshot = await readCatalogSourcesConfigSnapshot(runtimeEnv).catch(() => undefined);
+            const primarySource = cleanupSourceSnapshot?.config.sources.find((source) => source.primary)?.id;
+            const livePlan = await buildLiveForceExclusiveCleanupPlan({
+                targets: cleanupLiveTargets,
+                inventory: cleanupInventory,
+                env: runtimeEnv,
+                cwd: options.commandOptions.cwd,
+            });
+            const selectorsNeedingSupplement = requestedPluginNames.filter((selector) => {
+                const parsed = parsePluginId(selector);
+                const sourceId = parsed.sourceId ?? primarySource;
+                if (!sourceId)
+                    return true;
+                const missingLiveTarget = requestedPlatforms.some((platform) => !livePlan.targets.some((target) => target.identity.pluginId === formatPluginId({ sourceId, pluginName: parsed.pluginName })
+                    && target.identity.platform === platform
+                    && target.identity.scope === options.commandOptions.scope));
+                const damagedExclusiveEvidence = cleanupInventory.errors.some((error) => (error.kind === 'ownerMarkerRead'
+                    || error.kind === 'ownerMarkerValidation'
+                    || error.kind === 'ownerHeaderRead'
+                    || error.kind === 'ownerHeaderParse'
+                    || error.kind === 'ownerHeaderPathValidation')
+                    && !error.relevance.global
+                    && (error.relevance.sourceId === undefined || error.relevance.sourceId === sourceId)
+                    && (error.relevance.pluginName === undefined || error.relevance.pluginName === parsed.pluginName)
+                    && (error.relevance.platform === undefined || requestedPlatforms.includes(error.relevance.platform))
+                    && (error.relevance.scope === undefined || error.relevance.scope === options.commandOptions.scope));
+                return missingLiveTarget || damagedExclusiveEvidence;
+            });
+            const supplement = selectorsNeedingSupplement.length > 0
+                ? await buildForceExclusiveCleanupPlan({
+                    selectors: selectorsNeedingSupplement,
+                    platforms: requestedPlatforms,
+                    scope: options.commandOptions.scope,
+                    cwd: options.commandOptions.cwd,
+                    env: runtimeEnv,
+                    primarySourceId: primarySource,
+                    damagedOnly: cleanupLiveTargets.length > 0,
+                })
+                : { targets: [], evidence: [] };
+            const forcePlan = await mergeForceCleanupPlans(livePlan, supplement);
+            const requestedTargets = requestedPluginNames.flatMap((selector) => {
+                const parsed = parsePluginId(selector);
+                const sourceId = parsed.sourceId ?? primarySource;
+                return sourceId ? requestedPlatforms.map((platform) => ({
+                    pluginId: formatPluginId({ sourceId, pluginName: parsed.pluginName }),
+                    pluginName: parsed.pluginName,
+                    sourceId,
+                    sourceIdentity: 'unavailable',
+                    platform,
+                    scope: options.commandOptions.scope,
+                })) : [];
+            });
+            const unresolvedTargets = requestedTargets.filter((requested) => !forcePlan.targets.some((target) => target.identity.pluginId === requested.pluginId
+                && target.identity.platform === requested.platform
+                && target.identity.scope === requested.scope));
+            if (expectedOfflineCleanup?.forceExclusive === true) {
+                const actual = forcePlan.evidence.find((candidate) => candidate.pluginId === expectedOfflineCleanup.pluginId
+                    && candidate.platform === expectedOfflineCleanup.platform
+                    && candidate.scope === expectedOfflineCleanup.scope);
+                if (!actual || !offlineCleanupEvidenceMatches(expectedOfflineCleanup, actual)) {
+                    throw namespacedPreflightError('operationReviewStale: force cleanup path or ownership evidence changed before mutation.', cleanupLiveTargets);
+                }
+            }
+            if (unresolvedTargets.length > 0) {
+                throw namespacedPreflightError('forceCleanupPathUnavailable: No exact exclusive output is available from live evidence or the local Active shallow plan. Restore the local Active bundle, then retry cleanup --force, or inspect and remove the exact output manually.', unresolvedTargets);
+            }
+            if (forcePlan.targets.length === 0) {
+                throw namespacedPreflightError('forceCleanupPathUnavailable: No exact exclusive output is available from live evidence or the local Active shallow plan. Restore the local Active bundle, then retry cleanup --force, or inspect and remove the exact output manually.', requestedTargets);
+            }
+            const operationPlan = createOfflineCleanupOperationPlan(forcePlan.evidence);
+            if (options.runtime?.expectedPlanFingerprint) {
+                assertOperationPlanFingerprint(options.runtime.expectedPlanFingerprint, operationPlan);
+            }
+            if (options.runtime?.previewOperationPlan) {
+                return {
+                    ...await previewOfflineOwnedComponents({
+                        targets: cleanupLiveTargets,
+                        evidence: forcePlan.evidence,
+                        cwd: options.commandOptions.cwd,
+                        env: runtimeEnv,
+                        onPreviewStage: options.runtime.onPreviewStage,
+                    }),
+                    operationPlan,
+                };
+            }
+            const forceResults = await Promise.all(forcePlan.targets.map(async (target) => {
+                const integration = createRebuildIntegration({
+                    context: {
+                        env: runtimeEnv,
+                        nativeCliRunner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
+                        reporter: options.runtime?.reporter ?? createNoopReporter(),
+                        debugLogger: options.runtime?.debugLogger ?? createNoopDebugLogger(),
+                    },
+                });
+                const { finalizeCleanup: _finalizeCleanup, ...pathOnlyDriver } = integration.driver;
+                const result = await executeRebuildOperation({ command: 'cleanup', target, driver: pathOnlyDriver });
+                if (cleanupLiveTargets.some((liveTarget) => liveTarget.marketplaceIdentityUnresolved
+                    && liveTarget.pluginId === result.target.pluginId
+                    && liveTarget.platform === result.target.platform
+                    && liveTarget.scope === result.target.scope)) {
+                    result.residual.push('nativeMarketplaceIdentityUnresolved');
+                }
+                return result;
+            }));
+            const warnings = cleanupLiveTargets.flatMap((target) => target.marketplaceIdentityUnresolved
+                ? [`nativeMarketplaceIdentityUnresolved: Preserved ambiguous native registration for ${target.pluginId} on ${target.platform}/${target.scope}.`]
+                : []);
+            return leaseSafeRebuildResult({
+                platforms: [...new Set(forceResults.map((entry) => entry.target.platform))],
+                plugins: forceResults.filter((entry) => entry.status === 'succeeded')
+                    .map((entry) => entry.target.pluginName),
+                warnings,
+                rebuildResults: forceResults,
+                targetResults: forceResults.map(toTargetResult),
+                overallState: forceResults.every((entry) => entry.status === 'succeeded')
+                    ? 'succeeded'
+                    : forceResults.some((entry) => entry.status === 'succeeded') ? 'partial' : 'failed',
+                receiptTargets: forceResults.map((entry) => entry.target),
+                offlineCleanupPlans: forcePlan.evidence,
+                operationPlan,
+            });
+        }
+        if (cleanupLiveTargets.length === 0) {
+            const requestedPlatforms = selectedPlatforms(options.commandOptions.platform);
+            const primarySource = await readCatalogSourcesConfigSnapshot(runtimeEnv)
+                .then((snapshot) => snapshot.config.sources.find((source) => source.primary)?.id)
+                .catch(() => undefined);
+            const unresolvedTargets = requestedPluginNames.flatMap((selector) => {
+                const parsed = parsePluginId(selector);
+                const sourceId = parsed.sourceId ?? primarySource;
+                return sourceId ? requestedPlatforms.map((platform) => ({
+                    pluginId: formatPluginId({ sourceId, pluginName: parsed.pluginName }),
+                    pluginName: parsed.pluginName,
+                    sourceId,
+                    sourceIdentity: 'unavailable',
+                    platform,
+                    scope: options.commandOptions.scope,
+                })) : [];
+            });
+            const qualifiedTargets = requestedPluginNames.flatMap((selector) => {
+                const parsed = parsePluginId(selector);
+                return parsed.sourceId ? [{ sourceId: parsed.sourceId, pluginName: parsed.pluginName }] : [];
+            });
+            const filtered = cleanupInventory && qualifiedTargets.length > 0
+                ? omitSelectedPluginConfigErrors(cleanupInventory, qualifiedTargets)
+                : { inventory: cleanupInventory, omitted: false };
+            malformedSelectedConfigPreserved ||= filtered.omitted;
+            const inventoryError = filtered.inventory?.errors.find((error) => {
+                if (!cleanupForce
+                    || (error.kind !== 'ownerMarkerRead' && error.kind !== 'ownerMarkerValidation')
+                    || error.relevance.global)
+                    return true;
+                const relevant = unresolvedTargets.some((target) => !error.relevance.global
+                    && (error.relevance.sourceId === undefined || error.relevance.sourceId === target.sourceId)
+                    && (error.relevance.pluginName === undefined || error.relevance.pluginName === target.pluginName)
+                    && (error.relevance.platform === undefined || error.relevance.platform === target.platform)
+                    && (error.relevance.scope === undefined || error.relevance.scope === target.scope));
+                return relevant
+                    && !(error.relevance.platform === 'codex' && error.relevance.scope === 'project');
+            });
+            if (inventoryError) {
+                throw namespacedPreflightError(`stateInventoryFailed: ${inventoryError.message}`, unresolvedTargets);
+            }
+            const result = mergeRebuildCommandResults([]);
+            if (malformedSelectedConfigPreserved) {
+                result.warnings.push(MALFORMED_CONFIG_PRESERVED_WARNING);
+            }
+            if (cleanupForce && !options.runtime?.previewOperationPlan) {
+                try {
+                    await (options.runtime?.removeObsoleteInstallationContracts ?? fs.remove)(path.join(resolveAwHome(runtimeEnv), 'installation-contracts'));
+                }
+                catch (error) {
+                    result.warnings.push(`obsoleteContractsCleanupFailed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            return result;
+        }
+        const cleanupSourceSnapshot = await readCatalogSourcesConfigSnapshot(runtimeEnv).catch(() => undefined);
+        const configuredSources = new Set(cleanupSourceSnapshot?.config.sources.map((source) => source.id) ?? []);
+        let evidence = expectedOfflineCleanup
+            ? [expectedOfflineCleanup]
+            : cleanupLiveTargets.flatMap((target) => {
+                const value = offlineCleanupEvidenceFromInventory({
+                    reason: configuredSources.has(target.sourceId) ? 'bundleUnavailable' : 'sourceMissing',
+                    pluginId: target.pluginId,
+                    pluginName: target.pluginName,
+                    sourceId: target.sourceId,
+                    sourceIdentity: target.sourceIdentity,
+                    platform: target.platform,
+                    scope: target.scope,
+                    inventory: cleanupInventory,
+                });
+                return value ? [value] : [];
+            });
+        if (options.runtime?.expectedPlanFingerprint) {
+            assertOperationPlanFingerprint(options.runtime.expectedPlanFingerprint, createOfflineCleanupOperationPlan(evidence));
+        }
+        if (options.runtime?.previewOperationPlan) {
+            const previewResult = await previewOfflineOwnedComponents({
+                targets: cleanupLiveTargets,
+                evidence,
+                cwd: options.commandOptions.cwd,
+                env: runtimeEnv,
+                onPreviewStage: options.runtime.onPreviewStage,
+            });
+            return previewResult;
+        }
+        const cleanupResult = await cleanupOfflineOwnedComponents({
+            targets: cleanupLiveTargets,
+            evidence,
+            cwd: options.commandOptions.cwd,
+            env: runtimeEnv,
+            inventoryErrors: cleanupInventory.errors,
+            removeObsoleteInstallationContracts: options.runtime?.removeObsoleteInstallationContracts,
+            nativeCliRunner: options.runtime?.nativeCliRunner,
+            codexManager: options.runtime?.codexManager,
+        });
+        if (malformedSelectedConfigPreserved) {
+            cleanupResult.warnings.push(MALFORMED_CONFIG_PRESERVED_WARNING);
+        }
+        return cleanupResult;
+    }
+    try {
+        if (options.runtime?.previewOperationPlan) {
+            await options.runtime.onPreviewStage?.('catalog');
+        }
+        if (options.runtime?.catalogBootstrapError !== undefined) {
+            throw options.runtime.catalogBootstrapError;
+        }
+        const catalogOperation = options.runtime?.catalogOperationContext
+            ?? await measureCommandPerformanceStage(options.runtime, 'catalog.load', () => resolveCatalogOperationContext({
+                ...(sourceIds ? { sourceIds } : {}),
+                env: runtimeEnv,
+            }));
+        if (options.runtime?.expectedGenerationSetDigest
+            && catalogOperation?.generationSetDigest !== options.runtime.expectedGenerationSetDigest) {
+            throw new Error('operationReviewStale: Active Catalog generation changed before mutation.');
+        }
+        const resolvedResult = await withResolvedMultiSourceCatalog({
+            cliVersion: resolveRuntimeCliVersion(),
+            ...(sourceIds ? { sourceIds } : {}),
+            ...(catalogOperation ? { operationContext: catalogOperation } : {}),
+            env: runtimeEnv,
+            consume: async (catalog) => {
+                const failedSources = catalog.sources.filter((source) => source.error);
+                if (failedSources.length > 0) {
+                    throw namespacedPreflightError(`Cannot resolve required catalog sources: ${failedSources.map((source) => source.sourceId).join(', ')}.`, liveTargets, legacyLiveTargets);
+                }
+                const availableEntries = catalog.sources.flatMap((item) => {
+                    const source = item.resolution;
+                    return source.manifest.entries.map((entry) => ({
+                        source,
+                        entry,
+                        pluginId: formatPluginId({ sourceId: source.sourceId, pluginName: entry.name }),
+                    }));
+                });
+                const intentCatalogEntries = availableEntries.map((candidate) => ({
+                    pluginId: candidate.pluginId,
+                    dependencyPluginIds: candidate.entry.dependencies.map((dependency) => formatPluginId({
+                        sourceId: candidate.source.sourceId,
+                        pluginName: dependency,
+                    })),
+                }));
+                const selectedEntries = selectors.map((selector, index) => {
+                    const matches = availableEntries.filter((candidate) => candidate.entry.name === selector.pluginName
+                        && (selector.sourceId === undefined || candidate.source.sourceId === selector.sourceId));
+                    if (matches.length === 0) {
+                        throw new Error(`Plugin "${requestedPluginNames[index]}" does not exist in the required catalog source set.`);
+                    }
+                    if (matches.length > 1) {
+                        throw new Error(`Plugin "${selector.pluginName}" is ambiguous across sources: ${matches.map((entry) => entry.source.sourceId).join(', ')}.`);
+                    }
+                    return matches[0];
+                });
+                const dependencyEnabled = options.command === 'install'
+                    || options.command === 'sync'
+                    || options.command === 'reinstall';
+                const entryClosure = (roots) => {
+                    const result = [];
+                    const seen = new Set();
+                    const visiting = new Set();
+                    const byId = new Map(availableEntries.map((candidate) => [candidate.pluginId, candidate]));
+                    const visit = (candidate) => {
+                        if (seen.has(candidate.pluginId))
+                            return;
+                        if (visiting.has(candidate.pluginId))
+                            throw new Error(`Catalog dependency cycle includes "${candidate.pluginId}".`);
+                        visiting.add(candidate.pluginId);
+                        for (const dependency of candidate.entry.dependencies) {
+                            const dependencyId = formatPluginId({ sourceId: candidate.source.sourceId, pluginName: dependency });
+                            const resolved = byId.get(dependencyId);
+                            if (!resolved)
+                                throw new Error(`Catalog plugin "${candidate.pluginId}" depends on missing plugin "${dependency}".`);
+                            visit(resolved);
+                        }
+                        visiting.delete(candidate.pluginId);
+                        seen.add(candidate.pluginId);
+                        result.push(candidate);
+                    };
+                    for (const root of roots)
+                        visit(root);
+                    return result;
+                };
+                const removalConsumerEntries = options.command === 'cleanup' || options.command === 'uninstall'
+                    ? availableEntries.filter((candidate) => selectedEntries.some((selectedEntry) => candidate.source.sourceId === selectedEntry.source.sourceId
+                        && candidate.entry.dependencies.includes(selectedEntry.entry.name)))
+                    : [];
+                const removalDesiredEntries = options.command === 'cleanup' || options.command === 'uninstall'
+                    ? entryClosure(selectedEntries)
+                    : [];
+                const requiredEntryClosure = dependencyEnabled
+                    ? entryClosure(selectedEntries)
+                    : [...new Map([
+                            ...selectedEntries,
+                            ...removalDesiredEntries,
+                            ...removalConsumerEntries,
+                        ].map((candidate) => [candidate.pluginId, candidate])).values()];
+                if (dependencyEnabled) {
+                    for (const candidate of requiredEntryClosure) {
+                        const requiredCapabilities = candidate.entry.requires.aw.capabilities ?? [];
+                        const support = checkAwCapabilitySupport(requiredCapabilities, IMPLEMENTED_AW_CAPABILITIES);
+                        if (!support.supported) {
+                            throw new AwCapabilityUnsupportedError(candidate.pluginId, support.missing);
+                        }
+                    }
+                    await measureCommandPerformanceStage(options.runtime, 'catalog.validation', async () => {
+                        for (const item of catalog.sources) {
+                            const source = item.resolution;
+                            const names = requiredEntryClosure
+                                .filter((candidate) => candidate.source.sourceId === source.sourceId)
+                                .map((candidate) => candidate.entry.name);
+                            if (names.length > 0) {
+                                await validateCatalogSnapshotPluginEntriesComplete(source.rootDir, names);
+                            }
+                        }
+                    });
+                }
+                const available = await Promise.all(requiredEntryClosure.map(async (candidate) => {
+                    const plugin = await readPluginManifest(path.join(candidate.source.rootDir, 'plugins', candidate.entry.name), { mode: 'bundle' });
+                    plugin.sourceId = candidate.source.sourceId;
+                    plugin.sourceIdentity = candidate.source.sourceIdentity;
+                    plugin.pluginId = candidate.pluginId;
+                    return { source: candidate.source, plugin, pluginId: candidate.pluginId };
+                }));
+                const selected = selectedEntries.map((entry) => available.find((candidate) => candidate.pluginId === entry.pluginId));
+                const selectedIds = new Set(selected.map((entry) => entry.pluginId));
+                const preserveOtherCodexScopeRootIds = new Set(selected.flatMap((entry) => analyzeCodexSurface(entry.plugin.manifest).scopeOverlap === 'native-compatible'
+                    ? [entry.pluginId]
+                    : []));
+                const resolveClosureEntries = (rootsBySource) => catalog.sources.flatMap((item) => {
+                    const source = item.resolution;
+                    const roots = rootsBySource
+                        .filter((entry) => entry.source.sourceId === source.sourceId)
+                        .map((entry) => entry.plugin.manifest.name);
+                    if (roots.length === 0)
+                        return [];
+                    const sourcePlugins = available
+                        .filter((entry) => entry.source.sourceId === source.sourceId)
+                        .map((entry) => entry.plugin);
+                    const closure = resolvePluginMetaDependencyClosure(sourcePlugins, roots);
+                    return closure.map((plugin) => available.find((entry) => entry.source.sourceId === source.sourceId
+                        && entry.plugin.manifest.name === plugin.manifest.name));
+                });
+                const closureEntriesByPlatform = new Map();
+                if (dependencyEnabled) {
+                    for (const platform of selectedPlatforms(options.commandOptions.platform)) {
+                        const platformRoots = options.commandOptions.platform === 'both'
+                            ? selected.filter((entry) => supportsPlatform(entry.plugin.manifest, platform))
+                            : selected;
+                        closureEntriesByPlatform.set(platform, resolveClosureEntries(platformRoots));
+                    }
+                }
+                const closureEntries = dependencyEnabled
+                    ? [...new Map([...closureEntriesByPlatform.values()].flat().map((entry) => [entry.pluginId, entry])).values()]
+                    : options.command === 'cleanup'
+                        ? resolveClosureEntries(selected)
+                        : selected;
+                const rawExecutionSelections = options.all
+                    ? liveTargets.flatMap((target) => {
+                        const entry = selected.find((candidate) => candidate.pluginId === target.pluginId);
+                        if (target.sourceIdentity !== 'unavailable'
+                            && entry.source.sourceIdentity !== target.sourceIdentity) {
+                            throw namespacedPreflightError(`sourceChanged: ${target.pluginId} live target has a different source identity.`, liveTargets, legacyLiveTargets);
+                        }
+                        const sourcePlugins = available
+                            .filter((candidate) => candidate.source.sourceId === entry.source.sourceId)
+                            .map((candidate) => candidate.plugin);
+                        return (options.command === 'uninstall'
+                            ? [entry.plugin]
+                            : resolvePluginMetaDependencyClosure(sourcePlugins, [entry.plugin.manifest.name])).map((plugin) => ({
+                            entry: available.find((candidate) => candidate.source.sourceId === entry.source.sourceId
+                                && candidate.plugin.manifest.name === plugin.manifest.name),
+                            platform: target.platform,
+                        }));
+                    })
+                    : selectedPlatforms(options.commandOptions.platform).flatMap((platform) => (dependencyEnabled ? closureEntriesByPlatform.get(platform) ?? [] : closureEntries)
+                        .flatMap((entry) => options.command !== 'cleanup'
+                        && options.command !== 'uninstall'
+                        && options.commandOptions.platform === 'both'
+                        && !supportsPlatform(entry.plugin.manifest, platform)
+                        ? []
+                        : [{ entry, platform }]));
+                let executionSelections = [...new Map(rawExecutionSelections.map((selection) => [[
+                            selection.entry.pluginId,
+                            selection.entry.source.sourceIdentity,
+                            selection.platform,
+                            options.commandOptions.scope,
+                        ].join('\0'), selection])).values()];
+                const preflightTargets = executionSelections.map(({ entry, platform }) => ({
+                    pluginId: entry.pluginId,
+                    pluginName: entry.plugin.manifest.name,
+                    sourceId: entry.source.sourceId,
+                    sourceIdentity: entry.source.sourceIdentity,
+                    pluginVersion: entry.plugin.manifest.version,
+                    platform,
+                    scope: options.commandOptions.scope,
+                }));
+                if (options.runtime?.previewOperationPlan) {
+                    await options.runtime.onPreviewStage?.('inventory');
+                }
+                const stateInventory = await readOrdinaryInventory();
+                const assertWriteInventoryComplete = (inventory, exactOwnedTextErrorLocations, exactSkillMarkerErrorLocations) => {
+                    if (options.command === 'cleanup')
+                        return;
+                    const isExpectedOwnedTextHeaderError = (error) => {
+                        if (error.kind !== 'ownerHeaderParse'
+                            && error.kind !== 'ownerHeaderPathValidation')
+                            return false;
+                        if (exactOwnedTextErrorLocations === undefined)
+                            return true;
+                        const relevance = error.relevance;
+                        if (relevance.global || relevance.platform === undefined || relevance.scope === undefined) {
+                            return false;
+                        }
+                        return [...exactOwnedTextErrorLocations].some((target) => {
+                            const [sourceId, pluginName, platform, scope, location] = target.split('\0');
+                            return (relevance.sourceId === undefined || relevance.sourceId === sourceId)
+                                && (relevance.pluginName === undefined || relevance.pluginName === pluginName)
+                                && relevance.platform === platform
+                                && relevance.scope === scope
+                                && error.location.replaceAll('\\', '/') === location;
+                        });
+                    };
+                    const isExpectedSkillMarkerError = (error) => {
+                        if (error.kind !== 'ownerMarkerRead'
+                            && error.kind !== 'ownerMarkerValidation')
+                            return false;
+                        if (exactSkillMarkerErrorLocations === undefined)
+                            return true;
+                        const relevance = error.relevance;
+                        if (relevance.global || relevance.platform === undefined || relevance.scope === undefined) {
+                            return false;
+                        }
+                        return exactSkillMarkerErrorLocations.has([
+                            relevance.platform,
+                            relevance.scope,
+                            error.location.replaceAll('\\', '/'),
+                        ].join('\0'));
+                    };
+                    assertRebuildCatalogSourceInventoryComplete(options.command === 'reinstall'
+                        ? {
+                            ...inventory,
+                            errors: inventory.errors.filter((error) => !isExpectedSkillMarkerError(error)
+                                && !isExpectedOwnedTextHeaderError(error)),
+                        }
+                        : inventory, options.commandOptions.scope);
+                };
+                const checked = options.command === 'uninstall'
+                    ? omitSelectedPluginConfigErrors(stateInventory, preflightTargets)
+                    : { inventory: stateInventory, omitted: false };
+                malformedSelectedConfigPreserved ||= checked.omitted;
+                if (checked.omitted)
+                    stateInventory.errors = checked.inventory.errors;
+                assertWriteInventoryComplete(checked.inventory);
+                const hasCodexSelection = executionSelections.some((selection) => selection.platform === 'codex');
+                const intentBeforeByScope = hasCodexSelection || dependencyEnabled
+                    ? {
+                        user: await readPluginIntentState({
+                            scope: 'user', cwd: options.commandOptions.cwd, env: runtimeEnv,
+                        }),
+                        project: await readPluginIntentState({
+                            scope: 'project', cwd: options.commandOptions.cwd, env: runtimeEnv,
+                        }),
+                    }
+                    : {
+                        user: createEmptyPluginIntentState(),
+                        project: createEmptyPluginIntentState(),
+                    };
+                const commandProjectKey = await resolveCanonicalRepoProjectKey(options.commandOptions.cwd);
+                const codexScopePathsAlias = codexProjectConfigAliasesUserHome(options.commandOptions.cwd, runtimeEnv);
+                const selectedLegacy = selectedLegacyLiveReferences(stateInventory.references, new Set(executionSelections.map((selection) => selection.platform)), options.commandOptions.scope);
+                const legacy = options.all
+                    ? selectedLegacy
+                    : selectedLegacy.filter((reference) => executionSelections.some((selection) => selection.entry.plugin.manifest.name === reference.pluginName
+                        && selection.platform === reference.platform));
+                if (legacy.length > 0) {
+                    const blockingLegacyTargets = projectLegacyTargets(legacy);
+                    throw namespacedPreflightError(`legacyStateUnsupported: legacy live runtime state exists at ${legacy.map((reference) => reference.location).join(', ')}.`, preflightTargets, blockingLegacyTargets);
+                }
+                for (const entry of closureEntries) {
+                    const changed = stateInventory.references.find((reference) => reference.sourceId === entry.source.sourceId
+                        && reference.sourceIdentity
+                        && reference.sourceIdentity !== entry.source.sourceIdentity);
+                    if (changed) {
+                        throw namespacedPreflightError(`sourceChanged: ${entry.source.sourceId} state at ${changed.location} has a different source identity.`, options.all
+                            ? preflightTargets
+                            : preflightTargets.filter((target) => target.pluginId === entry.pluginId));
+                    }
+                }
+                const marketplaceNamesBySource = new Map();
+                for (const entry of new Map(closureEntries.map((candidate) => [
+                    candidate.source.sourceId,
+                    candidate,
+                ])).values()) {
+                    const sourceNames = new Set(stateInventory.references.flatMap((reference) => (reference.kind === 'namespacedOwner' || reference.kind === 'namespacedMarketplace')
+                        && reference.sourceId === entry.source.sourceId
+                        && (reference.sourceIdentity === undefined
+                            || reference.sourceIdentity === entry.source.sourceIdentity)
+                        && reference.marketplaceName
+                        ? [reference.marketplaceName]
+                        : []));
+                    if (sourceNames.size > 1) {
+                        throw new Error('marketplaceIdentityUnavailable: Multiple canonical native marketplace registrations match the source.');
+                    }
+                    const persistedName = [...sourceNames][0];
+                    const marketplaceRoot = path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId);
+                    let marketplaceName = persistedName
+                        ?? (entry.source.sourceId === catalog.primarySourceId
+                            ? 'aw'
+                            : getNamespacedMarketplaceName(entry.source.sourceId));
+                    if (options.command === 'cleanup' || options.command === 'uninstall') {
+                        marketplaceNamesBySource.set(entry.source.sourceId, marketplaceName);
+                        continue;
+                    }
+                    let registrations = await inspectNativeMarketplaceRegistrations({
+                        marketplaceName,
+                        marketplaceRoot,
+                        cwd: options.commandOptions.cwd,
+                        env: runtimeEnv,
+                    });
+                    if (!persistedName
+                        && marketplaceName === 'aw'
+                        && Object.values(registrations).includes('foreign')) {
+                        marketplaceName = getNamespacedMarketplaceName(entry.source.sourceId);
+                        registrations = await inspectNativeMarketplaceRegistrations({
+                            marketplaceName,
+                            marketplaceRoot,
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                        });
+                    }
+                    const foreignPlatforms = Object.entries(registrations).flatMap(([platform, state]) => state === 'foreign' ? [platform] : []);
+                    if (foreignPlatforms.length > 0) {
+                        throw new Error(`externalOwnershipPresent: Marketplace ${marketplaceName} is foreign on ${foreignPlatforms.join(', ')}.`);
+                    }
+                    marketplaceNamesBySource.set(entry.source.sourceId, marketplaceName);
+                }
+                const marketplaceNameFor = (entry, ..._placement) => {
+                    const marketplaceName = marketplaceNamesBySource.get(entry.source.sourceId);
+                    if (!marketplaceName) {
+                        throw new Error('marketplaceIdentityUnavailable: No marketplace name was selected for the source.');
+                    }
+                    return marketplaceName;
+                };
+                const executionContext = {
+                    env: runtimeEnv,
+                    nativeCliRunner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
+                    reporter: options.runtime?.reporter ?? createNoopReporter(),
+                    debugLogger: options.runtime?.debugLogger ?? createNoopDebugLogger(),
+                    expectedCatalogConfigDigest: catalog.configDigest,
+                };
+                const inspection = createRebuildIntegration({
+                    context: executionContext,
+                    scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
+                });
+                const selectedRootsForPlan = (plan) => [...new Map(plan.targets.flatMap((target) => target.relation === 'requested'
+                        ? [[target.pluginId, {
+                                    pluginId: target.pluginId,
+                                    platforms: plan.targets.flatMap((candidate) => candidate.relation === 'requested'
+                                        && candidate.pluginId === target.pluginId
+                                        ? [candidate.platform]
+                                        : []),
+                                }]]
+                        : [])).values()];
+                let plannedCodexRegistrations = new Map();
+                let plannedOwnedTextTargets = new Map();
+                let plannedSkillMarkerTargets = new Map();
+                const exactOwnedTextTargets = (plan) => {
+                    const output = new Set();
+                    for (const target of plan.targets) {
+                        for (const location of plannedOwnedTextTargets.get([
+                            target.pluginId, target.platform, target.resolvedScope,
+                        ].join('\0')) ?? []) {
+                            output.add([
+                                target.pluginId.split('/', 1)[0],
+                                target.pluginName,
+                                target.platform,
+                                target.resolvedScope,
+                                location,
+                            ].join('\0'));
+                        }
+                    }
+                    return output;
+                };
+                const exactSkillMarkerTargets = (plan) => {
+                    const output = new Set();
+                    for (const target of plan.targets) {
+                        for (const location of plannedSkillMarkerTargets.get([
+                            target.pluginId, target.platform, target.resolvedScope,
+                        ].join('\0')) ?? []) {
+                            output.add([target.platform, target.resolvedScope, location].join('\0'));
+                        }
+                    }
+                    return output;
+                };
+                const createPlan = async (inventory, codexManager) => {
+                    plannedCodexRegistrations = new Map();
+                    plannedOwnedTextTargets = new Map();
+                    plannedSkillMarkerTargets = new Map();
+                    assertWriteInventoryComplete(inventory);
+                    const targets = [];
+                    const placementNodes = [];
+                    const blockingTargets = new Map();
+                    const actualStates = new Map();
+                    for (const [order, { entry, platform }] of executionSelections.entries()) {
+                        const relation = selectedIds.has(entry.pluginId) ? 'requested' : 'dependency';
+                        let resolvedScope = options.commandOptions.scope;
+                        const inspectScope = async (scope) => {
+                            const marketplaceName = marketplaceNameFor(entry, platform, scope);
+                            entry.plugin.marketplaceName = marketplaceName;
+                            const desired = await inspection.buildTarget({
+                                sourceId: entry.source.sourceId,
+                                sourceIdentity: entry.source.sourceIdentity,
+                                pluginId: entry.pluginId,
+                                marketplaceName,
+                                marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
+                                plugin: entry.plugin,
+                                platform,
+                                scope,
+                                cwd: options.commandOptions.cwd,
+                                command: options.command,
+                                catalog: toCatalogResolution(entry.source),
+                                readOnlyInspectionPlan: true,
+                            });
+                            const targetKey = [entry.pluginId, platform, scope].join('\0');
+                            const ownedTextTargets = plannedOwnedTextTargets.get(targetKey) ?? new Set();
+                            const skillMarkerTargets = plannedSkillMarkerTargets.get(targetKey) ?? new Set();
+                            const rawRepoRoot = resolveRepoRootSync(options.commandOptions.cwd);
+                            const sensitiveRoots = [
+                                canonicalizePathThroughExistingAncestorSync(getCodexHome(runtimeEnv)),
+                                canonicalizePathThroughExistingAncestorSync(getClaudeHome(runtimeEnv)),
+                                canonicalizePathThroughExistingAncestorSync(rawRepoRoot),
+                                getCodexHome(runtimeEnv),
+                                getClaudeHome(runtimeEnv),
+                                rawRepoRoot,
+                            ];
+                            for (const component of desired.ownedComponents) {
+                                if (component.kind === 'owned-text-file') {
+                                    ownedTextTargets.add(sanitizeCatalogSourceErrorMessage(component.path, runtimeEnv, sensitiveRoots).replaceAll('\\', '/'));
+                                }
+                                else if (component.kind === 'skill-directory') {
+                                    skillMarkerTargets.add(sanitizeCatalogSourceErrorMessage(path.join(component.path, SKILL_OWNER_MARKER), runtimeEnv, sensitiveRoots).replaceAll('\\', '/'));
+                                }
+                            }
+                            plannedOwnedTextTargets.set(targetKey, ownedTextTargets);
+                            plannedSkillMarkerTargets.set(targetKey, skillMarkerTargets);
+                            const result = await inspectOwnedComponents({
+                                components: desired.ownedComponents,
+                                executor: inspection.driver.ownership,
+                                nativeProbe: inspection.driver.probeNative,
+                                verifyHealth: true,
+                            });
+                            if (result.state === 'error'
+                                || result.components.some((component) => component.state === 'error'))
+                                return result;
+                            const required = new Set(desired.desiredOwnedComponents ?? desired.ownedComponents);
+                            const optional = new Set(desired.optionalOwnedComponents ?? []);
+                            const presentRequired = [...required].every((component) => result.components.some((entry) => entry.component === component && entry.state === 'present'));
+                            const hasUnexpectedPresent = result.components.some((entry) => entry.state === 'present' && !required.has(entry.component) && !optional.has(entry.component));
+                            const hasPartial = result.components.some((entry) => entry.state === 'partial');
+                            const hasAnyPresent = result.components.some((entry) => entry.state === 'present');
+                            const hasAnyOwned = hasAnyPresent || hasPartial;
+                            const state = !hasAnyOwned
+                                ? 'absent'
+                                : hasPartial || hasUnexpectedPresent || !presentRequired
+                                    ? 'partial'
+                                    : required.size > 0
+                                        ? 'present'
+                                        : hasAnyPresent ? 'present' : 'absent';
+                            return { ...result, state };
+                        };
+                        const otherScope = resolvedScope === 'user' ? 'project' : 'user';
+                        const [requestedInspection, otherInspection] = await Promise.all([
+                            inspectScope(resolvedScope),
+                            platform === 'codex' && codexScopePathsAlias && resolvedScope === 'user'
+                                ? Promise.resolve({ state: 'absent', components: [], errors: [] })
+                                : inspectScope(otherScope),
+                        ]);
+                        const surface = platform === 'codex'
+                            ? analyzeCodexSurface(entry.plugin.manifest)
+                            : undefined;
+                        const codexPluginId = `${entry.plugin.manifest.name}@${marketplaceNameFor(entry, platform, resolvedScope)}`;
+                        const codexRegistration = platform === 'codex'
+                            && surface?.classification === 'native'
+                            ? await inspectCodexPluginRegistrationLive({
+                                pluginId: codexPluginId,
+                                cwd: options.commandOptions.cwd,
+                                env: runtimeEnv,
+                                nativeCliRunner: executionContext.nativeCliRunner,
+                                ...(codexManager ? { manager: codexManager } : {}),
+                            })
+                            : undefined;
+                        if (codexRegistration) {
+                            plannedCodexRegistrations.set(codexPluginId, codexRegistration);
+                        }
+                        const placementState = (inspected, scope) => {
+                            if (platform !== 'codex'
+                                || surface?.classification !== 'native'
+                                || options.command === 'cleanup'
+                                || options.command === 'uninstall')
+                                return inspected.state;
+                            if (!codexRegistration)
+                                return inspected.state;
+                            if (codexRegistration.observation.state === 'failed')
+                                return 'error';
+                            if (codexRegistration.observation.state === 'unobserved')
+                                return 'partial';
+                            if (codexRegistration.observation.value === 'absent')
+                                return 'absent';
+                            return codexRegistration.observations[scope]
+                                && codexRegistration.activations[scope] === true
+                                ? inspected.state
+                                : 'partial';
+                        };
+                        const requestedPlacementState = placementState(requestedInspection, options.commandOptions.scope);
+                        let otherPlacementState = placementState(otherInspection, otherScope);
+                        if (surface?.classification === 'native'
+                            && requestedPlacementState === 'present'
+                            && otherPlacementState === 'present') {
+                            otherPlacementState = 'absent';
+                        }
+                        actualStates.set(`${entry.pluginId}\0${platform}\0${options.commandOptions.scope}`, requestedPlacementState);
+                        actualStates.set(`${entry.pluginId}\0${platform}\0${otherScope}`, otherPlacementState);
+                        const allowedScopes = platform === 'codex'
+                            ? [
+                                ...(surface?.ok ? ['user'] : []),
+                                ...(surface?.ok && !codexScopePathsAlias ? ['project'] : []),
+                            ]
+                            : ['project', 'user'];
+                        if (allowedScopes.length === 0)
+                            allowedScopes.push(options.commandOptions.scope);
+                        const hasWiderDesiredRoot = relation === 'dependency'
+                            && options.commandOptions.scope === 'project'
+                            && intentBeforeByScope.user.roots.some((root) => root.pluginId === entry.pluginId && root.platforms.includes(platform));
+                        placementNodes.push({
+                            pluginId: entry.pluginId,
+                            pluginName: entry.plugin.manifest.name,
+                            platform,
+                            relation,
+                            depth: order,
+                            allowedScopes,
+                            ...(relation === 'dependency'
+                                && options.commandOptions.scope === 'project'
+                                && (otherPlacementState === 'present' || hasWiderDesiredRoot)
+                                ? {
+                                    preferredScope: 'user',
+                                    ...(otherPlacementState === 'present'
+                                        ? { preferredScopeReason: 'existingWiderTarget' }
+                                        : {}),
+                                }
+                                : {}),
+                        });
+                        let state = requestedPlacementState;
+                        let action = relation === 'requested'
+                            ? options.command === 'cleanup' || options.command === 'uninstall'
+                                ? 'keep'
+                                : options.command === 'reinstall' ? 'reinstall' : 'install'
+                            : options.command === 'reinstall' ? 'reinstall' : 'install';
+                        let errorCode;
+                        if (dependencyEnabled
+                            && platform === 'codex'
+                            && relation === 'requested'
+                            && surface?.scopeOverlap === 'aw-owned-conflict'
+                            && options.command !== 'sync'
+                            && !(options.command === 'install'
+                                && intentBeforeByScope[otherScope].roots.some((root) => root.pluginId === entry.pluginId && root.platforms.includes(platform)))
+                            && otherInspection.components.some((component) => component.state !== 'absent'
+                                && component.component.kind !== 'native-plugin'
+                                && !component.component.identity.artifactKey.startsWith('activation-')
+                                && !component.component.identity.artifactKey.startsWith('marketplace-'))) {
+                            action = 'block';
+                            errorCode = 'codexExtensionScopeConflict';
+                        }
+                        else if (dependencyEnabled && relation === 'requested'
+                            && (requestedInspection.state === 'error'
+                                || (requestedInspection.state === 'partial'
+                                    && platform !== 'codex'
+                                    && options.command !== 'reinstall'
+                                    && options.command !== 'cleanup'))) {
+                            action = 'block';
+                            errorCode = 'dependencyNotReady';
+                        }
+                        if (relation === 'dependency'
+                            && requestedPlacementState === 'present'
+                            && otherPlacementState === 'present') {
+                            action = 'block';
+                            state = 'partial';
+                            errorCode = 'dependencyScopeConflict';
+                        }
+                        else if (relation === 'dependency'
+                            && options.commandOptions.scope === 'project'
+                            && otherInspection.state === 'present') {
+                            resolvedScope = 'user';
+                            state = 'present';
+                        }
+                        else if (relation === 'dependency'
+                            && options.commandOptions.scope === 'project'
+                            && (otherPlacementState === 'partial' || otherPlacementState === 'error')) {
+                            resolvedScope = 'user';
+                            state = otherPlacementState;
+                            if (otherPlacementState === 'error') {
+                                action = 'block';
+                                errorCode = 'dependencyNotReady';
+                            }
+                        }
+                        else if (relation === 'dependency'
+                            && options.commandOptions.scope === 'user'
+                            && otherPlacementState === 'error') {
+                            action = 'block';
+                            errorCode = 'dependencyNotReady';
+                        }
+                        const resolvedInspection = resolvedScope === options.commandOptions.scope
+                            ? requestedInspection
+                            : otherInspection;
+                        const collisionComponents = relation === 'dependency'
+                            ? resolvedInspection.components
+                            : [...requestedInspection.components, ...otherInspection.components];
+                        const invalidOwnerComponents = relation === 'dependency'
+                            ? resolvedInspection.components
+                            : requestedInspection.components;
+                        const hasForeignCollision = collisionComponents
+                            .some((component) => component.collision !== undefined);
+                        const hasInvalidExclusiveOwner = options.command === 'reinstall'
+                            && invalidOwnerComponents.some((component) => (component.component.kind === 'skill-directory'
+                                || component.component.kind === 'owned-text-file')
+                                && component.collision?.reason === 'unownedContent');
+                        state = resolvedScope === options.commandOptions.scope
+                            ? requestedPlacementState
+                            : otherPlacementState;
+                        if (dependencyEnabled && hasForeignCollision) {
+                            action = 'block';
+                            errorCode = hasInvalidExclusiveOwner
+                                ? 'exclusiveOwnerEvidenceInvalid'
+                                : 'artifactCollision';
+                        }
+                        if (!hasForeignCollision && !errorCode && relation === 'dependency') {
+                            action = state === 'present' ? 'keep' : state === 'partial' ? 'reinstall' : 'install';
+                        }
+                        if (!hasForeignCollision && relation === 'dependency'
+                            && resolvedInspection.state === 'error') {
+                            action = 'block';
+                            state = resolvedInspection.state;
+                            errorCode ??= 'dependencyNotReady';
+                        }
+                        if (entry.plugin.manifest.config?.fields
+                            && (action === 'install' || action === 'reinstall')) {
+                            const effective = resolvedScope === 'project'
+                                ? await resolveArtifactRenderConfig({
+                                    sourceId: entry.source.sourceId,
+                                    sourceIdentity: entry.source.sourceIdentity,
+                                    pluginName: entry.plugin.manifest.name,
+                                    manifest: entry.plugin.manifest,
+                                    scope: 'project',
+                                    cwd: options.commandOptions.cwd,
+                                    env: runtimeEnv,
+                                })
+                                : await resolveEffectivePluginConfig({
+                                    sourceId: entry.source.sourceId,
+                                    sourceIdentity: entry.source.sourceIdentity,
+                                    pluginName: entry.plugin.manifest.name,
+                                    manifest: entry.plugin.manifest,
+                                    targetScope: 'user',
+                                    cwd: options.commandOptions.cwd,
+                                    env: runtimeEnv,
+                                });
+                            if (effective.issues.length > 0) {
+                                action = 'block';
+                                errorCode = 'invalidConfig';
+                            }
+                        }
+                        if (dependencyEnabled
+                            && platform === 'codex'
+                            && resolvedScope === 'project'
+                            && codexScopePathsAlias) {
+                            action = 'block';
+                            errorCode = 'codexScopePathAlias';
+                        }
+                        if (dependencyEnabled && platform === 'codex' && !surface?.ok) {
+                            action = 'block';
+                            errorCode = surface?.errorCode ?? 'codexNativeKindUnsupported';
+                        }
+                        if (errorCode)
+                            blockingTargets.set(`${entry.pluginId}\0${platform}`, errorCode);
+                        targets.push({
+                            pluginId: entry.pluginId,
+                            pluginName: entry.plugin.manifest.name,
+                            platform,
+                            requestedScope: options.commandOptions.scope,
+                            resolvedScope,
+                            relation,
+                            requiredBy: executionSelections.filter((candidate) => candidate.platform === platform
+                                && candidate.entry.source.sourceId === entry.source.sourceId
+                                && candidate.entry.plugin.manifest.dependencies?.includes(entry.plugin.manifest.name))
+                                .map((candidate) => candidate.entry.pluginId).sort(),
+                            state,
+                            action,
+                            order,
+                            ...(errorCode ? { errorCode } : {}),
+                        });
+                    }
+                    if (dependencyEnabled) {
+                        const placement = createDependencyPlacementPlan({
+                            requestedPluginIds: selected.map((entry) => entry.pluginId),
+                            nodes: placementNodes,
+                            roots: placementNodes.flatMap((node) => selectedIds.has(node.pluginId)
+                                ? [{ pluginId: node.pluginId, platform: node.platform, scope: options.commandOptions.scope }]
+                                : []),
+                            dependencyEdges: closureEntries.flatMap((entry) => (entry.plugin.manifest.dependencies ?? []).flatMap((dependency) => {
+                                const dependencyId = formatPluginId({
+                                    sourceId: entry.source.sourceId,
+                                    pluginName: dependency,
+                                });
+                                return ['codex', 'claude'].flatMap((platform) => placementNodes.some((node) => node.pluginId === entry.pluginId && node.platform === platform)
+                                    && placementNodes.some((node) => node.pluginId === dependencyId && node.platform === platform)
+                                    ? [{ from: entry.pluginId, to: dependencyId, platform }]
+                                    : []);
+                            })),
+                            scopeOverrides: effectiveDependencyScopeOverrides({
+                                state: intentBeforeByScope[options.commandOptions.scope],
+                                explicit: options.commandOptions
+                                    .dependencyScopeOverrides ?? [],
+                                nodes: placementNodes,
+                                ignoredPersistedRootIds: selectedIds,
+                            }),
+                        });
+                        return createReconcileOperationPlan({
+                            placement,
+                            actual: placement.targets.map((target) => {
+                                const prior = targets.find((candidate) => candidate.pluginId === target.pluginId && candidate.platform === target.platform);
+                                const state = actualStates.get(`${target.pluginId}\0${target.platform}\0${target.resolvedScope}`) ?? prior.state;
+                                const errorCode = blockingTargets.get(`${target.pluginId}\0${target.platform}`)
+                                    ?? prior.errorCode;
+                                const otherScope = target.resolvedScope === 'user' ? 'project' : 'user';
+                                const otherState = actualStates.get(`${target.pluginId}\0${target.platform}\0${otherScope}`);
+                                const movesExistingPlacement = target.relation === 'dependency'
+                                    && target.resolvedScope === 'user'
+                                    && (state === 'absent' || state === 'partial')
+                                    && (otherState === 'present' || otherState === 'partial');
+                                const preservesWiderPlacement = target.relation === 'dependency'
+                                    && target.resolvedScope === 'project'
+                                    && (state === 'absent' || state === 'partial')
+                                    && (otherState === 'present' || otherState === 'partial');
+                                const action = errorCode
+                                    ? 'block'
+                                    : options.command === 'cleanup' || options.command === 'uninstall'
+                                        ? 'keep'
+                                        : movesExistingPlacement
+                                            ? 'move'
+                                            : target.relation === 'dependency' && state === 'present'
+                                                ? 'keep'
+                                                : state === 'partial' || options.command === 'reinstall'
+                                                    ? 'reinstall'
+                                                    : 'install';
+                                return {
+                                    ...prior,
+                                    state,
+                                    action,
+                                    ...(errorCode ? { errorCode } : {}),
+                                    ...(preservesWiderPlacement ? { preservedScope: 'user' } : {}),
+                                };
+                            }),
+                        });
+                    }
+                    const directPlacement = createDependencyPlacementPlan({
+                        requestedPluginIds: selected.map((entry) => entry.pluginId),
+                        nodes: placementNodes,
+                        roots: placementNodes.map((node) => ({
+                            pluginId: node.pluginId,
+                            platform: node.platform,
+                            scope: options.commandOptions.scope,
+                        })),
+                        dependencyEdges: [],
+                    });
+                    return createReconcileOperationPlan({ placement: directPlacement, actual: targets });
+                };
+                const createCodexPlans = async (plan, activationSupport = 'observed', codexManager) => {
+                    const codexTargets = plan.targets.filter((target) => target.platform === 'codex');
+                    const selectedRoots = selectedRootsForPlan(plan);
+                    const currentScope = options.commandOptions.scope;
+                    const otherScope = currentScope === 'user' ? 'project' : 'user';
+                    const reconciledCodexTargets = codexTargets;
+                    if (reconciledCodexTargets.length === 0)
+                        return [];
+                    const beforeByScope = intentBeforeByScope;
+                    const afterByScope = {
+                        user: beforeByScope.user,
+                        project: beforeByScope.project,
+                    };
+                    afterByScope[currentScope] = deriveDesiredIntentState({
+                        command: options.command,
+                        state: beforeByScope[currentScope],
+                        selectedRoots,
+                        plan,
+                        catalogEntries: intentCatalogEntries,
+                    });
+                    if (options.command === 'install') {
+                        afterByScope[otherScope] = removeSelectedRootPlatformsFromOtherScope({
+                            state: afterByScope[otherScope],
+                            selectedRoots,
+                            preserveCodexRootIds: preserveOtherCodexScopeRootIds,
+                        });
+                    }
+                    const desiredScopesForEntry = (entry) => {
+                        const scopes = new Set();
+                        for (const intentScope of ['user', 'project']) {
+                            const intent = afterByScope[intentScope];
+                            for (const root of intent.roots.filter((candidate) => candidate.platforms.includes('codex'))) {
+                                const rootEntry = availableEntries.find((candidate) => candidate.pluginId === root.pluginId);
+                                if (!rootEntry || rootEntry.source.sourceId !== entry.source.sourceId)
+                                    continue;
+                                let closure;
+                                try {
+                                    closure = entryClosure([rootEntry]);
+                                }
+                                catch {
+                                    closure = [rootEntry];
+                                }
+                                if (!closure.some((candidate) => candidate.pluginId === entry.pluginId)) {
+                                    continue;
+                                }
+                                const currentPlannedScope = intentScope === currentScope
+                                    && selectedRoots.some((selectedRoot) => selectedRoot.pluginId === root.pluginId)
+                                    ? plan.targets.find((target) => target.pluginId === entry.pluginId && target.platform === 'codex')?.resolvedScope
+                                    : undefined;
+                                const override = intent.dependencyScopeOverrides.find((candidate) => candidate.pluginId === entry.pluginId && candidate.platform === 'codex');
+                                const reusedUserDependency = intentScope === 'project'
+                                    && root.pluginId !== entry.pluginId
+                                    && scopes.has('user');
+                                scopes.add(currentPlannedScope
+                                    ?? override?.scope
+                                    ?? (reusedUserDependency ? 'user' : intentScope));
+                            }
+                        }
+                        return [...scopes].sort();
+                    };
+                    const intentScopesForEntry = (entry) => {
+                        const scopes = new Set();
+                        for (const intentScope of ['user', 'project']) {
+                            for (const root of afterByScope[intentScope].roots.filter((candidate) => candidate.platforms.includes('codex'))) {
+                                const rootEntry = availableEntries.find((candidate) => candidate.pluginId === root.pluginId);
+                                if (!rootEntry || rootEntry.source.sourceId !== entry.source.sourceId)
+                                    continue;
+                                let closure;
+                                try {
+                                    closure = entryClosure([rootEntry]);
+                                }
+                                catch {
+                                    closure = [rootEntry];
+                                }
+                                if (closure.some((candidate) => candidate.pluginId === entry.pluginId)) {
+                                    scopes.add(intentScope);
+                                }
+                            }
+                        }
+                        return [...scopes].sort();
+                    };
+                    const inspectBothScopes = options.command !== 'cleanup' && options.command !== 'uninstall';
+                    const readActivationConfig = async (scope) => {
+                        return readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, scope, runtimeEnv).configTomlPath);
+                    };
+                    const [userConfig, projectConfig] = await Promise.all([
+                        readActivationConfig('user'),
+                        readActivationConfig('project'),
+                    ]);
+                    const catalogClosure = [];
+                    const liveEvidence = [];
+                    for (const planned of reconciledCodexTargets) {
+                        const entry = available.find((candidate) => candidate.pluginId === planned.pluginId);
+                        const surface = analyzeCodexSurface(entry.plugin.manifest);
+                        const marketplaceName = marketplaceNameFor(entry, 'codex', planned.resolvedScope);
+                        const codexPluginId = `${entry.plugin.manifest.name}@${marketplaceName}`;
+                        const hasNativeRenderTargets = (entry.plugin.manifest.artifacts?.targets ?? []).some((target) => target.platform === 'codex'
+                            && target.target === 'codex.skill'
+                            && target.delivery?.mode === 'codex-native');
+                        const staticContentDigest = hasNativeRenderTargets
+                            ? undefined
+                            : await calculateCodexSharedNativePayloadDigest(entry.plugin.rootDir);
+                        const desiredScopes = desiredScopesForEntry(entry);
+                        const sharedInspection = surface.nativeKinds.length > 0
+                            ? await inspectCodexSharedNativeLive({
+                                pluginName: entry.plugin.manifest.name,
+                                sourceId: entry.source.sourceId,
+                                desiredVersion: entry.plugin.manifest.version,
+                                ...(staticContentDigest ? { expectedPayloadDigest: staticContentDigest } : {}),
+                                cwd: options.commandOptions.cwd,
+                                env: runtimeEnv,
+                                marketplaceName,
+                                marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
+                                nativeCliRunner: executionContext.nativeCliRunner,
+                                ...(codexManager ? { manager: codexManager } : {}),
+                                ...(plannedCodexRegistrations.get(codexPluginId)
+                                    ? { pluginRegistration: plannedCodexRegistrations.get(codexPluginId) }
+                                    : {}),
+                                ...(hasNativeRenderTargets ? { nativeRenderPlugin: entry.plugin } : {}),
+                            })
+                            : undefined;
+                        const contentDigest = sharedInspection?.expectedPayloadDigest
+                            ?? staticContentDigest
+                            ?? await calculateCodexNativeRenderPayloadDigest(entry.plugin.rootDir);
+                        catalogClosure.push({
+                            pluginId: entry.pluginId,
+                            pluginName: entry.plugin.manifest.name,
+                            codexPluginId,
+                            version: entry.plugin.manifest.version,
+                            payloadDigest: contentDigest,
+                            relation: planned.relation,
+                            resolvedScope: planned.resolvedScope,
+                            desiredScopes,
+                            intentScopes: intentScopesForEntry(entry),
+                            surface,
+                        });
+                        const sharedNative = sharedInspection?.sharedNative
+                            ?? { state: 'unobserved' };
+                        const projectionEntries = [];
+                        const extensions = [];
+                        for (const scope of (inspectBothScopes
+                            ? ['user', 'project']
+                            : [currentScope])) {
+                            const desired = await inspection.buildTarget({
+                                sourceId: entry.source.sourceId,
+                                sourceIdentity: entry.source.sourceIdentity,
+                                pluginId: entry.pluginId,
+                                marketplaceName,
+                                marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
+                                plugin: entry.plugin,
+                                platform: 'codex',
+                                scope,
+                                cwd: options.commandOptions.cwd,
+                                command: options.command,
+                                catalog: toCatalogResolution(entry.source),
+                                readOnlyInspectionPlan: true,
+                            });
+                            const inspected = await inspectOwnedComponents({
+                                components: desired.ownedComponents,
+                                executor: inspection.driver.ownership,
+                                nativeProbe: inspection.driver.probeNative,
+                                verifyHealth: true,
+                            });
+                            const projected = inspected.components.filter((component) => component.component.kind !== 'native-plugin'
+                                && !component.component.identity.artifactKey.startsWith('activation-')
+                                && !component.component.identity.artifactKey.startsWith('marketplace-'));
+                            projectionEntries.push(...projected.map((component) => ({
+                                scope,
+                                artifactKey: component.component.identity.artifactKey,
+                                state: component.state,
+                                collision: component.collision?.reason,
+                            })));
+                            for (const component of surface.components.filter((candidate) => candidate.owner === 'aw')) {
+                                const artifactKeys = new Set();
+                                if (component.key.startsWith('extensions.instructions:')) {
+                                    artifactKeys.add('developer-instructions');
+                                }
+                                else if ((component.key.startsWith('extensions.permissions:')
+                                    || component.key.startsWith('extensions.agents:')) && component.name) {
+                                    artifactKeys.add(buildGeneratedName(entry.plugin.manifest.name, component.name));
+                                }
+                                else if (component.key.startsWith('artifacts.targets:')) {
+                                    const targetId = component.key.slice('artifacts.targets:'.length);
+                                    const target = entry.plugin.manifest.artifacts?.targets?.find((candidate) => candidate.id === targetId);
+                                    const artifactKey = target?.target === 'codex.developerInstructionsBlock'
+                                        ? 'developer-instructions'
+                                        : target?.skillKey ?? target?.roleKey;
+                                    if (artifactKey)
+                                        artifactKeys.add(artifactKey);
+                                }
+                                const componentInspections = projected.filter((candidate) => artifactKeys.has(candidate.component.identity.artifactKey)
+                                    || (candidate.component.kind === 'shared-config'
+                                        && candidate.component.locator.kind === 'codex-role-registration'
+                                        && artifactKeys.has(candidate.component.locator.roleKey)));
+                                const projectionState = componentInspections.some((candidate) => candidate.collision)
+                                    ? planned.action === 'block' ? 'absent' : 'foreign'
+                                    : componentInspections.length > 0
+                                        && componentInspections.every((candidate) => candidate.state === 'present')
+                                        ? 'present'
+                                        : componentInspections.some((candidate) => candidate.state !== 'absent')
+                                            ? 'drifted'
+                                            : 'absent';
+                                extensions.push({ componentKey: component.key, scope, state: projectionState });
+                            }
+                        }
+                        liveEvidence.push({
+                            codexPluginId,
+                            sharedNative,
+                            ...(sharedInspection?.actualPayloadDigest
+                                ? { sharedNativePayloadDigest: sharedInspection.actualPayloadDigest }
+                                : {}),
+                            ...(sharedInspection?.payloadPath
+                                ? { sharedNativePayloadPath: sharedInspection.payloadPath }
+                                : {}),
+                            activations: {
+                                user: sharedInspection?.activations.user
+                                    ?? userConfig?.snapshot.plugins[codexPluginId]?.enabled,
+                                project: projectConfig?.snapshot.plugins[codexPluginId]?.enabled,
+                            },
+                            extensions,
+                            projectionDigest: JSON.stringify(projectionEntries.sort((left, right) => `${left.scope}\0${left.artifactKey}`.localeCompare(`${right.scope}\0${right.artifactKey}`, 'en'))),
+                        });
+                    }
+                    const codexPlan = createCodexReconcilePlan({
+                        scope: currentScope,
+                        cwd: options.commandOptions.cwd,
+                        operation: options.command,
+                        intentBefore: beforeByScope[currentScope],
+                        intentAfter: afterByScope[currentScope],
+                        relatedIntentBefore: beforeByScope[otherScope],
+                        relatedIntentAfter: afterByScope[otherScope],
+                        catalogClosure,
+                        liveEvidence,
+                        activationSupport,
+                    });
+                    const preservedScopes = new Map(plan.targets.flatMap((target) => target.platform === 'codex' && target.preservedScope
+                        ? [[target.pluginId, target.preservedScope]]
+                        : []));
+                    if (preservedScopes.size === 0)
+                        return [codexPlan];
+                    const preservedNativePluginIds = new Set(catalogClosure.flatMap((target) => (options.command === 'install' || options.command === 'reinstall')
+                        && preservedScopes.get(target.pluginId) === 'user'
+                        && liveEvidence.find((evidence) => evidence.codexPluginId === target.codexPluginId)?.activations.user === true
+                        ? [target.pluginId]
+                        : []));
+                    const preservedCodexIds = new Set(codexPlan.sharedNativeActions.flatMap((action) => preservedNativePluginIds.has(action.pluginId) ? [action.codexPluginId] : []));
+                    return [{
+                            ...codexPlan,
+                            desiredTargets: codexPlan.desiredTargets.map((target) => {
+                                const preservedScope = preservedNativePluginIds.has(target.pluginId)
+                                    ? preservedScopes.get(target.pluginId)
+                                    : undefined;
+                                return preservedScope
+                                    ? { ...target, scopes: [...new Set([...target.scopes, preservedScope])].sort() }
+                                    : target;
+                            }),
+                            activationActions: {
+                                user: codexPlan.activationActions.user.map((action) => preservedNativePluginIds.has(action.pluginId)
+                                    ? { ...action, action: 'none', desired: true }
+                                    : action),
+                                project: codexPlan.activationActions.project,
+                            },
+                            extensionRemovals: codexPlan.extensionRemovals.filter((action) => preservedScopes.get(action.pluginId) !== action.scope),
+                            staleActivationRemovals: codexPlan.staleActivationRemovals.filter((action) => !(action.scope === 'user' && preservedCodexIds.has(action.codexPluginId))),
+                            postcheck: {
+                                ...codexPlan.postcheck,
+                                plugins: codexPlan.postcheck.plugins.map((plugin) => preservedNativePluginIds.has(plugin.pluginId)
+                                    ? { ...plugin, expectedUserEnabled: true }
+                                    : plugin),
+                            },
+                        }];
+                };
+                const operationNeedsNativeCli = async (platform, plan) => {
+                    for (const { entry, platform: selectedPlatform } of executionSelections) {
+                        if (selectedPlatform !== platform)
+                            continue;
+                        const planned = plan?.targets.find((target) => target.pluginId === entry.pluginId && target.platform === selectedPlatform);
+                        if (dependencyEnabled && (!planned
+                            || planned.action === 'keep'
+                            || planned.action === 'block'))
+                            continue;
+                        const scope = planned?.resolvedScope ?? options.commandOptions.scope;
+                        const marketplaceName = marketplaceNameFor(entry, selectedPlatform, scope);
+                        entry.plugin.marketplaceName = marketplaceName;
+                        const marketplaceRoot = path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId);
+                        if (!dependencyEnabled && selectedPlatform === 'codex') {
+                            continue;
+                        }
+                        const target = await inspection.buildTarget({
+                            sourceId: entry.source.sourceId,
+                            sourceIdentity: entry.source.sourceIdentity,
+                            pluginId: entry.pluginId,
+                            marketplaceName,
+                            marketplaceRoot,
+                            plugin: entry.plugin,
+                            platform: selectedPlatform,
+                            scope,
+                            cwd: options.commandOptions.cwd,
+                            command: dependencyEnabled
+                                ? planned.action === 'move'
+                                    ? planned.state === 'partial' ? 'reinstall' : 'install'
+                                    : planned.action
+                                : options.command,
+                            catalog: toCatalogResolution(entry.source),
+                            readOnlyInspectionPlan: true,
+                        });
+                        if (dependencyEnabled && (target.writeNativeRequired ?? target.requiresNative))
+                            return true;
+                        const nativeComponents = target.ownedComponents.filter((component) => component.kind === 'native-plugin'
+                            || (component.kind === 'shared-config'
+                                && component.identity.artifactKey.startsWith('marketplace-')));
+                        if (nativeComponents.length === 0)
+                            continue;
+                        const nativeInspection = await inspectOwnedComponents({
+                            components: nativeComponents,
+                            executor: inspection.driver.ownership,
+                            nativeProbe: inspection.driver.probeNative,
+                        });
+                        if (nativeInspection.components.some((component) => component.state === 'present' || component.state === 'partial')) {
+                            return true;
+                        }
+                    }
+                    return false;
+                };
+                const prepareRenderedTargets = async (plan, codexPlans, runTargetHook) => {
+                    const integration = createRebuildIntegration({
+                        context: executionContext,
+                        scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
+                    });
+                    const preparedTargets = new Map();
+                    const preparedTargetErrors = new Map();
+                    const collisionSelections = [];
+                    for (const { entry, platform } of executionSelections) {
+                        const planned = plan.targets.find((candidate) => candidate.pluginId === entry.pluginId && candidate.platform === platform);
+                        if (planned.action === 'block')
+                            continue;
+                        const desiredCleanup = platform === 'codex'
+                            && options.command === 'cleanup'
+                            && codexPlans.some((codexPlan) => codexPlan.desiredTargets.some((target) => target.pluginId === entry.pluginId && target.scopes.includes(planned.resolvedScope)));
+                        const reconcileObsolete = platform === 'codex'
+                            && options.command === 'sync'
+                            && codexPlans.some((codexPlan) => codexPlan.desiredTargets.some((target) => target.pluginId === entry.pluginId && !target.scopes.includes(planned.resolvedScope)));
+                        const buildCommand = reconcileObsolete
+                            ? 'cleanup'
+                            : desiredCleanup || planned.action === 'move'
+                                ? planned.state === 'partial' ? 'reinstall' : 'install'
+                                : planned.relation === 'dependency'
+                                    && (planned.action === 'install' || planned.action === 'reinstall')
+                                    ? planned.action
+                                    : options.command;
+                        const plannedNative = platform === 'codex'
+                            ? codexPlans.flatMap((codexPlan) => codexPlan.sharedNativeActions).find((action) => action.pluginId === entry.pluginId)
+                            : undefined;
+                        const preserveSharedNative = plannedNative?.action === 'reuse'
+                            || plannedNative?.action === 'none';
+                        const marketplaceName = marketplaceNameFor(entry, platform, planned.resolvedScope);
+                        try {
+                            const target = await measureCommandPerformanceStage(options.runtime, 'target.build', () => integration.buildTarget({
+                                sourceId: entry.source.sourceId,
+                                sourceIdentity: entry.source.sourceIdentity,
+                                pluginId: entry.pluginId,
+                                marketplaceName,
+                                marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
+                                plugin: entry.plugin,
+                                platform,
+                                scope: planned.resolvedScope,
+                                cwd: options.commandOptions.cwd,
+                                command: buildCommand,
+                                catalog: toCatalogResolution(entry.source),
+                                preserveCodexSharedNativePayload: platform === 'codex'
+                                    && (buildCommand === 'cleanup'
+                                        || buildCommand === 'uninstall'
+                                        || preserveSharedNative),
+                            }));
+                            if (plannedNative) {
+                                const writesSharedNative = plannedNative.action === 'install'
+                                    || plannedNative.action === 'replace'
+                                    || plannedNative.action === 'repair';
+                                const isActivationComponent = (component) => component.kind === 'shared-config'
+                                    && component.locator.kind === 'codex-activation';
+                                const activationArtifactKeys = new Set(target.ownedComponents
+                                    .filter(isActivationComponent)
+                                    .map((component) => component.identity.artifactKey));
+                                target.ownedComponents = target.ownedComponents.filter((component) => !isActivationComponent(component));
+                                target.desiredOwnedComponents = target.desiredOwnedComponents?.filter((component) => !isActivationComponent(component));
+                                target.optionalOwnedComponents = target.optionalOwnedComponents?.filter((component) => !isActivationComponent(component));
+                                target.artifacts = target.artifacts.filter((artifact) => artifact.artifactKey === undefined
+                                    || !activationArtifactKeys.has(artifact.artifactKey));
+                                target.operationActions = target.operationActions?.filter((action) => action.kind !== 'setActivation');
+                                target.writeNativeRequired = writesSharedNative;
+                                const hasExtensionMutation = codexPlans.some((codexPlan) => [
+                                    ...codexPlan.extensionWrites,
+                                    ...codexPlan.extensionRemovals,
+                                ].some((action) => action.pluginId === entry.pluginId
+                                    && action.scope === planned.resolvedScope));
+                                target.codexNativeObservationExpectation = preserveSharedNative && hasExtensionMutation
+                                    ? (plannedNative.action === 'reuse' ? 'installed' : 'observed')
+                                    : undefined;
+                                if (!writesSharedNative) {
+                                    const isSharedNativeComponent = (component) => component.kind === 'native-plugin'
+                                        || (component.kind === 'shared-config'
+                                            && component.identity.artifactKey.startsWith('marketplace-'));
+                                    target.requiresNative = false;
+                                    target.ownedComponents = target.ownedComponents.filter((component) => !isSharedNativeComponent(component));
+                                    target.desiredOwnedComponents = target.desiredOwnedComponents?.filter((component) => !isSharedNativeComponent(component));
+                                    target.optionalOwnedComponents = target.optionalOwnedComponents?.filter((component) => !isSharedNativeComponent(component));
+                                    target.operationActions = target.operationActions?.filter((action) => action.kind !== 'ensureNativeRegistration');
+                                }
+                            }
+                            preparedTargets.set(`${entry.pluginId}\0${platform}`, {
+                                target,
+                            });
+                            if (runTargetHook) {
+                                await rebuildCommandTestHooks?.afterTargetBuilt?.({
+                                    command: options.command,
+                                    identity: target.identity,
+                                });
+                            }
+                            collisionSelections.push({
+                                pluginId: entry.pluginId,
+                                targetKey: `${platform}/${target.identity.scope}`,
+                                artifactKeys: (target.desiredOwnedComponents ?? target.ownedComponents)
+                                    .filter((component) => !(component.kind === 'shared-config'
+                                    && component.identity.artifactKey.startsWith('marketplace-')))
+                                    .map((component) => 'path' in component
+                                    ? path.resolve(component.path)
+                                    : component.kind === 'native-plugin'
+                                        ? `native:${component.pluginId}`
+                                        : `shared:${component.label}`),
+                            });
+                        }
+                        catch (error) {
+                            preparedTargetErrors.set(`${entry.pluginId}\0${platform}`, error);
+                        }
+                    }
+                    const collisions = preflightDesiredArtifactCollisions(collisionSelections);
+                    if (collisions.length > 0) {
+                        throw namespacedPreflightError(`artifactCollision: ${collisions.map((collision) => `${collision.targetKey} (${collision.pluginIds.join(', ')})`).join('; ')}`, preflightTargets);
+                    }
+                    const configTargets = new Map();
+                    if (options.command !== 'cleanup' && options.command !== 'uninstall') {
+                        for (const { entry, platform } of executionSelections) {
+                            const planned = plan.targets.find((candidate) => candidate.pluginId === entry.pluginId && candidate.platform === platform);
+                            if (!entry.plugin.manifest.config?.fields
+                                || planned.action === 'block'
+                                || !preparedTargets.has(`${entry.pluginId}\0${platform}`))
+                                continue;
+                            configTargets.set(`${entry.pluginId}\0${planned.resolvedScope}`, {
+                                entry,
+                                scope: planned.resolvedScope,
+                            });
+                        }
+                    }
+                    const configDigests = await Promise.all([...configTargets.values()].map(async ({ entry, scope, }) => {
+                        const effective = await resolveEffectivePluginConfig({
+                            sourceId: entry.source.sourceId,
+                            sourceIdentity: entry.source.sourceIdentity,
+                            pluginName: entry.plugin.manifest.name,
+                            manifest: entry.plugin.manifest,
+                            targetScope: scope,
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                        });
+                        return createOperationPlanConfigDigest({
+                            pluginId: entry.pluginId,
+                            scope,
+                            effectiveValues: effective.values,
+                        });
+                    }));
+                    return {
+                        preparedTargets,
+                        preparedTargetErrors,
+                        targetActions: [...preparedTargets.values()].flatMap((prepared) => prepared.target.operationActions ?? []),
+                        configDigests,
+                    };
+                };
+                if (options.runtime?.previewOperationPlan) {
+                    await options.runtime.onPreviewStage?.('dependencyPlan');
+                    const initialPlan = await measureCommandPerformanceStage(options.runtime, 'dependency.plan', () => createPlan(stateInventory));
+                    assertWriteInventoryComplete(stateInventory, exactOwnedTextTargets(initialPlan), exactSkillMarkerTargets(initialPlan));
+                    const provisionalCodexPlans = await createCodexPlans(initialPlan);
+                    const previewNeedsNativeMaterialization = provisionalCodexPlans.some((plan) => plan.sharedNativeActions.some((action) => action.action === 'install'
+                        || action.action === 'replace'
+                        || action.action === 'repair'));
+                    const previewActivationOnly = !previewNeedsNativeMaterialization
+                        && provisionalCodexPlans.some((plan) => plan.postcheck.support === 'observed'
+                            && plan.postcheck.plugins.length > 0);
+                    const previewActivationScope = provisionalCodexPlans.some((plan) => plan.requirement.requiresProjectPluginContract) ? 'project' : 'user';
+                    const previewConsumer = previewActivationOnly
+                        ? await (options.runtime?.codexOperationConsumerResolver ?? resolveCodexOperationConsumer)({
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                            runner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
+                            operationRequirement: getCodexOperationRequirement(previewActivationScope),
+                            requiresNativeMaterialization: false,
+                        })
+                        : undefined;
+                    const initialCodexPlans = previewConsumer?.support === 'assumed'
+                        ? await createCodexPlans(initialPlan, 'assumed')
+                        : provisionalCodexPlans;
+                    const previewPreparation = await prepareRenderedTargets(initialPlan, initialCodexPlans, false);
+                    const preview = mergeRebuildCommandResults([]);
+                    preview.dependencyPlan = initialPlan;
+                    preview.operationPlan = createRebuildOperationPlan({
+                        command: options.command,
+                        scope: options.commandOptions.scope,
+                        dependencyPlan: initialPlan,
+                        codexPlans: initialCodexPlans,
+                        targetActions: previewPreparation.targetActions,
+                        catalogSources: catalog.sources.flatMap((source) => source.resolution ? [source.resolution] : []),
+                        intentBeforeByScope,
+                        configDigests: previewPreparation.configDigests,
+                        catalogEntries: intentCatalogEntries,
+                    });
+                    if (initialCodexPlans.length > 0)
+                        preview.codexReconcilePlans = initialCodexPlans;
+                    if (initialCodexPlans.some((plan) => plan.sharedNativeActions.some((action) => action.action === 'install'
+                        || action.action === 'replace'
+                        || action.action === 'repair'))) {
+                        preview.codexManagerPreview = await (options.runtime.codexManagerPreviewer ?? previewCodexManager)({
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                            runner: options.runtime?.nativeCliRunner,
+                        });
+                    }
+                    return preview;
+                }
+                for (const { entry, platform } of executionSelections.filter((selection) => selectedIds.has(selection.entry.pluginId))) {
+                    await options.runtime?.reviewPreflight?.({
+                        command: options.command,
+                        identity: {
+                            sourceId: entry.source.sourceId,
+                            sourceIdentity: entry.source.sourceIdentity,
+                            pluginId: entry.pluginId,
+                            pluginName: entry.plugin.manifest.name,
+                            pluginVersion: entry.plugin.manifest.version,
+                            platform,
+                            scope: options.commandOptions.scope,
+                            cwd: options.commandOptions.cwd,
+                        },
+                        configDigest: catalog.configDigest,
+                        ...(catalogOperation
+                            ? { generationSetDigest: catalogOperation.generationSetDigest }
+                            : {}),
+                        sourceId: entry.source.sourceId,
+                        sourceIdentity: entry.source.sourceIdentity,
+                        resolvedCommit: entry.source.resolvedCommit,
+                        manifestDigest: entry.source.manifestDigest,
+                        snapshotDigest: entry.source.snapshotDigest,
+                        contentDigest: entry.source.manifest.entries.find((candidate) => candidate.name === entry.plugin.manifest.name)?.contentDigest,
+                    });
+                }
+                let lockedPlan = await measureCommandPerformanceStage(options.runtime, 'dependency.plan', () => createPlan(stateInventory));
+                assertWriteInventoryComplete(stateInventory, exactOwnedTextTargets(lockedPlan), exactSkillMarkerTargets(lockedPlan));
+                const provisionalLockedCodexPlans = await createCodexPlans(lockedPlan);
+                const codexManagerRequired = provisionalLockedCodexPlans.some((plan) => plan.sharedNativeActions.some((action) => action.action === 'install'
+                    || action.action === 'replace'
+                    || action.action === 'repair'));
+                const activationOnlyOperation = !codexManagerRequired
+                    && provisionalLockedCodexPlans.some((plan) => plan.postcheck.support === 'observed'
+                        && plan.postcheck.plugins.length > 0);
+                const activationScope = provisionalLockedCodexPlans.some((plan) => plan.requirement.requiresProjectPluginContract) ? 'project' : 'user';
+                const activationConsumer = activationOnlyOperation
+                    ? await (options.runtime?.codexOperationConsumerResolver ?? resolveCodexOperationConsumer)({
+                        cwd: options.commandOptions.cwd,
+                        env: runtimeEnv,
+                        runner: executionContext.nativeCliRunner,
+                        operationRequirement: getCodexOperationRequirement(activationScope),
+                        requiresNativeMaterialization: false,
+                    })
+                    : undefined;
+                if (activationConsumer?.support === 'observed') {
+                    executionContext.codexManager = activationConsumer.manager;
+                }
+                if (codexManagerRequired) {
+                    const codexRequirementScope = provisionalLockedCodexPlans.some((plan) => plan.requirement.requiresProjectPluginContract)
+                        ? 'project'
+                        : 'user';
+                    if (options.runtime?.codexManagerResolver) {
+                        executionContext.codexManager = await options.runtime.codexManagerResolver({
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                            runner: executionContext.nativeCliRunner,
+                            authorizer: options.runtime?.managedCodexAuthorizer,
+                            operationRequirement: getCodexOperationRequirement(codexRequirementScope),
+                        });
+                    }
+                    else {
+                        const consumer = await (options.runtime?.codexOperationConsumerResolver ?? resolveCodexOperationConsumer)({
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                            runner: executionContext.nativeCliRunner,
+                            authorizer: options.runtime?.managedCodexAuthorizer,
+                            operationRequirement: getCodexOperationRequirement(codexRequirementScope),
+                            requiresNativeMaterialization: true,
+                        });
+                        if (consumer.support !== 'observed') {
+                            throw new Error('Codex native materialization requires an observed CLI consumer.');
+                        }
+                        executionContext.codexManager = consumer.manager;
+                    }
+                }
+                let lockedCodexPlans = activationConsumer?.support === 'assumed'
+                    ? await createCodexPlans(lockedPlan, 'assumed')
+                    : provisionalLockedCodexPlans;
+                if (executionContext.codexManager) {
+                    lockedPlan = await createPlan(stateInventory, executionContext.codexManager);
+                    assertWriteInventoryComplete(stateInventory, exactOwnedTextTargets(lockedPlan), exactSkillMarkerTargets(lockedPlan));
+                    lockedCodexPlans = await createCodexPlans(lockedPlan, 'observed', executionContext.codexManager);
+                }
+                const lockedPreparation = await prepareRenderedTargets(lockedPlan, lockedCodexPlans, true);
+                const lockedOperationPlan = createRebuildOperationPlan({
+                    command: options.command,
+                    scope: options.commandOptions.scope,
+                    dependencyPlan: lockedPlan,
+                    codexPlans: lockedCodexPlans,
+                    targetActions: lockedPreparation.targetActions,
+                    catalogSources: catalog.sources.flatMap((source) => source.resolution ? [source.resolution] : []),
+                    intentBeforeByScope,
+                    configDigests: lockedPreparation.configDigests,
+                    catalogEntries: intentCatalogEntries,
+                });
+                if (options.runtime?.expectedPlanFingerprint) {
+                    try {
+                        assertOperationPlanFingerprint(options.runtime.expectedPlanFingerprint, lockedOperationPlan);
+                    }
+                    catch (error) {
+                        throw namespacedPreflightError(error instanceof Error ? error.message : String(error), preflightTargets);
+                    }
+                }
+                if (options.runtime?.directCli
+                    && options.commandOptions.yes !== true
+                    && (options.command === 'install'
+                        || options.command === 'sync'
+                        || options.command === 'reinstall')) {
+                    const sharedNativeImpact = lockedCodexPlans.some((plan) => plan.review.requiresConfirmation);
+                    if (sharedNativeImpact) {
+                        throw namespacedPreflightError('sharedNativeImpactAuthorizationRequired: Replacing or force-reinstalling shared Codex native state requires --yes.', preflightTargets);
+                    }
+                }
+                if (options.runtime?.awHomeMutationToken) {
+                    const selectedRoots = selectedRootsForPlan(lockedPlan);
+                    await writeDesiredIntentSuperset({
+                        command: options.command,
+                        cwd: options.commandOptions.cwd,
+                        scope: options.commandOptions.scope,
+                        selectedRoots,
+                        plan: lockedPlan,
+                        codexPlan: lockedCodexPlans[0],
+                        preserveOtherCodexScopeRootIds,
+                        catalogEntries: intentCatalogEntries,
+                        env: runtimeEnv,
+                    });
+                }
+                for (const pluginName of new Set(lockedPlan.targets.flatMap((target) => target.platform === 'claude'
+                    && (target.action === 'install'
+                        || target.action === 'reinstall')
+                    ? [target.pluginName]
+                    : []))) {
+                    await assertNoClaudeUnboundNativeNameCollision({
+                        pluginName,
+                        cwd: options.commandOptions.cwd,
+                        env: runtimeEnv,
+                    });
+                }
+                const claudeCliRequired = await operationNeedsNativeCli('claude', lockedPlan);
+                const codexUserActivationDesired = new Set(lockedCodexPlans.flatMap((plan) => plan.activationActions.user.flatMap((action) => action.desired ? [action.codexPluginId] : [])));
+                executionContext.codexUserActivationDesired = codexUserActivationDesired;
+                await assertClaudeVersion({
+                    platforms: claudeCliRequired ? ['claude'] : [],
+                    cwd: options.commandOptions.cwd,
+                    env: runtimeEnv,
+                    runtime: executionContext,
+                });
+                const preparedTargets = lockedPreparation.preparedTargets;
+                const preparedTargetErrors = lockedPreparation.preparedTargetErrors;
+                const removalRequiredConsumers = new Map();
+                if ((options.command === 'cleanup' && !cleanupForce)
+                    || options.command === 'uninstall'
+                    || options.command === 'sync') {
+                    const removalStateInventory = await readInventory({
+                        cwd: options.commandOptions.cwd,
+                        env: runtimeEnv,
+                    });
+                    if (options.command !== 'cleanup') {
+                        const checked = options.command === 'uninstall'
+                            ? omitSelectedPluginConfigErrors(removalStateInventory, preflightTargets)
+                            : { inventory: removalStateInventory, omitted: false };
+                        malformedSelectedConfigPreserved ||= checked.omitted;
+                        assertRebuildCatalogSourceInventoryComplete(checked.inventory, options.commandOptions.scope);
+                    }
+                    const inspectConsumer = async (options_) => {
+                        const marketplaceName = marketplaceNameFor(options_.entry, options_.platform, options_.scope, options_.scope === 'project' ? options_.cwd : null);
+                        options_.entry.plugin.marketplaceName = marketplaceName;
+                        const consumerTarget = await inspection.buildTarget({
+                            sourceId: options_.entry.source.sourceId,
+                            sourceIdentity: options_.entry.source.sourceIdentity,
+                            pluginId: options_.entry.pluginId,
+                            marketplaceName,
+                            marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', options_.entry.source.sourceId),
+                            plugin: options_.entry.plugin,
+                            platform: options_.platform,
+                            scope: options_.scope,
+                            cwd: options_.cwd,
+                            command: 'cleanup',
+                            catalog: toCatalogResolution(options_.entry.source),
+                            readOnlyInspectionPlan: true,
+                        });
+                        const consumerInspection = await inspectOwnedComponents({
+                            components: consumerTarget.ownedComponents,
+                            executor: inspection.driver.ownership,
+                            nativeProbe: inspection.driver.probeNative,
+                            verifyHealth: true,
+                        });
+                        return consumerInspection.state === 'absent' ? 'absent' : 'live';
+                    };
+                    const currentConsumerCandidates = [...new Map(removalStateInventory.references.flatMap((reference) => {
+                            if ((reference.kind !== 'namespacedOwner' && reference.kind !== 'namespacedMarketplace')
+                                || !reference.sourceId
+                                || !reference.pluginName
+                                || (reference.platform !== 'codex' && reference.platform !== 'claude')
+                                || (reference.scope !== 'user' && reference.scope !== 'project'))
+                                return [];
+                            const entry = available.find((candidate) => candidate.source.sourceId === reference.sourceId
+                                && (reference.sourceIdentity === undefined
+                                    || candidate.source.sourceIdentity === reference.sourceIdentity)
+                                && candidate.plugin.manifest.name === reference.pluginName);
+                            if (!entry)
+                                return [];
+                            if (reference.scope === 'project' && !reference.projectKey) {
+                                throw namespacedPreflightError(`dependencyStillRequired: cannot inspect project consumer ${entry.pluginId} without its project identity.`, preflightTargets);
+                            }
+                            const key = [
+                                entry.pluginId,
+                                reference.platform,
+                                reference.scope,
+                                reference.projectKey ?? '',
+                            ].join('\0');
+                            return [[key, {
+                                        entry,
+                                        platform: reference.platform,
+                                        scope: reference.scope,
+                                        projectKey: reference.projectKey ?? null,
+                                    }]];
+                        })).values()];
+                    for (const dependencyTarget of executionSelections) {
+                        const dependencyPluginName = dependencyTarget.entry.plugin.manifest.name;
+                        for (const consumer of currentConsumerCandidates) {
+                            if (consumer.entry.source.sourceId
+                                !== dependencyTarget.entry.source.sourceId
+                                || !consumer.entry.plugin.manifest.dependencies?.includes(dependencyPluginName)
+                                || consumer.platform !== dependencyTarget.platform
+                                || (consumer.scope === 'user'
+                                    && options.commandOptions.scope !== 'user')
+                                || (options.commandOptions.scope === 'project'
+                                    && consumer.scope === 'project'
+                                    && consumer.projectKey !== commandProjectKey))
+                                continue;
+                            const plannedConsumer = executionSelections.find((selection) => selection.entry.pluginId === consumer.entry.pluginId
+                                && selection.platform === consumer.platform
+                                && lockedPlan.targets.some((target) => target.pluginId === selection.entry.pluginId
+                                    && target.platform === selection.platform
+                                    && target.resolvedScope === consumer.scope
+                                    && (consumer.scope === 'user' || consumer.projectKey === commandProjectKey)));
+                            if (plannedConsumer) {
+                                const dependencyExecutionKey = `${dependencyTarget.entry.pluginId}\0${consumer.platform}`;
+                                const required = removalRequiredConsumers.get(dependencyExecutionKey) ?? new Set();
+                                required.add(`${consumer.entry.pluginId}\0${consumer.platform}`);
+                                removalRequiredConsumers.set(dependencyExecutionKey, required);
+                                continue;
+                            }
+                            try {
+                                if (await inspectConsumer({
+                                    entry: consumer.entry,
+                                    platform: consumer.platform,
+                                    scope: consumer.scope,
+                                    cwd: consumer.projectKey ?? options.commandOptions.cwd,
+                                }) !== 'absent') {
+                                    throw new Error('consumer is present, partial, or unreadable');
+                                }
+                            }
+                            catch {
+                                throw namespacedPreflightError(`dependencyStillRequired: ${dependencyTarget.entry.pluginId} is required by ${consumer.entry.pluginId}.`, preflightTargets);
+                            }
+                        }
+                    }
+                    const orderedSelections = [];
+                    const remaining = new Set(executionSelections);
+                    while (remaining.size > 0) {
+                        const ready = [...remaining].filter((candidate) => ![...remaining].some((consumer) => consumer.platform === candidate.platform
+                            && consumer.entry.source.sourceId === candidate.entry.source.sourceId
+                            && consumer.entry.plugin.manifest.dependencies?.includes(candidate.entry.plugin.manifest.name)))
+                            .sort((left, right) => left.entry.pluginId.localeCompare(right.entry.pluginId, 'en'));
+                        if (ready.length === 0) {
+                            throw namespacedPreflightError('dependencyGraphInvalid: removal graph contains a cycle.', preflightTargets);
+                        }
+                        for (const selection of ready) {
+                            orderedSelections.push(selection);
+                            remaining.delete(selection);
+                        }
+                    }
+                    if (options.command === 'cleanup' || options.command === 'uninstall') {
+                        executionSelections = orderedSelections;
+                    }
+                }
+                const results = [];
+                const deferredPostApplyTasks = [];
+                const dependencyStates = new Map();
+                for (const { entry, platform } of executionSelections) {
+                    const planned = lockedPlan.targets.find((target) => target.pluginId === entry.pluginId && target.platform === platform);
+                    const directDependencyIds = (entry.plugin.manifest.dependencies ?? []).map((pluginName) => formatPluginId({ sourceId: entry.source.sourceId, pluginName }));
+                    const failedDependency = directDependencyIds.find((pluginId) => {
+                        const state = dependencyStates.get(`${pluginId}\0${platform}`);
+                        return state === 'failed' || state === 'skipped';
+                    });
+                    const failedConsumer = [...(removalRequiredConsumers.get(`${entry.pluginId}\0${platform}`) ?? [])]
+                        .find((consumerKey) => {
+                        const state = dependencyStates.get(consumerKey);
+                        return state === 'failed' || state === 'skipped';
+                    });
+                    const identity = {
+                        sourceId: entry.source.sourceId,
+                        sourceIdentity: entry.source.sourceIdentity,
+                        pluginId: entry.pluginId,
+                        pluginName: entry.plugin.manifest.name,
+                        pluginVersion: entry.plugin.manifest.version,
+                        platform,
+                        scope: planned.resolvedScope,
+                        cwd: options.commandOptions.cwd,
+                    };
+                    const codexReconcilePlan = platform === 'codex'
+                        ? lockedCodexPlans.find((plan) => plan.desiredTargets.some((target) => target.pluginId === entry.pluginId))
+                        : undefined;
+                    const desiredInCurrentScope = codexReconcilePlan?.desiredTargets.some((target) => target.pluginId === entry.pluginId && target.scopes.includes(planned.resolvedScope)) === true;
+                    const reconcileObsolete = platform === 'codex'
+                        && options.command === 'sync'
+                        && !desiredInCurrentScope;
+                    const desiredCleanupMutation = codexReconcilePlan !== undefined && (codexReconcilePlan.sharedNativeActions.some((action) => action.pluginId === entry.pluginId
+                        && (action.action === 'install'
+                            || action.action === 'replace'
+                            || action.action === 'repair'))
+                        || [...codexReconcilePlan.activationActions.user,
+                            ...codexReconcilePlan.activationActions.project].some((action) => action.pluginId === entry.pluginId && action.action !== 'none')
+                        || [...codexReconcilePlan.extensionWrites,
+                            ...codexReconcilePlan.extensionRemovals].some((action) => action.pluginId === entry.pluginId));
+                    const plannedNativeAction = codexReconcilePlan?.sharedNativeActions.find((action) => action.pluginId === entry.pluginId);
+                    const hasCodexExtensionMutation = codexReconcilePlan !== undefined
+                        && [...codexReconcilePlan.extensionWrites, ...codexReconcilePlan.extensionRemovals]
+                            .some((action) => action.pluginId === entry.pluginId);
+                    const reconcileActivationOnly = platform === 'codex'
+                        && plannedNativeAction !== undefined
+                        && (plannedNativeAction.action === 'reuse'
+                            || plannedNativeAction.action === 'none')
+                        && !hasCodexExtensionMutation;
+                    if (failedDependency || failedConsumer || planned.action === 'block') {
+                        const code = failedConsumer
+                            ? 'dependencyStillRequired'
+                            : failedDependency ? 'dependencyInstallFailed' : planned.errorCode ?? 'dependencyNotReady';
+                        const message = `${code}: ${failedConsumer
+                            ? `${entry.pluginId} retained because consumer ${failedConsumer.split('\0', 1)[0]} was not removed.`
+                            : failedDependency
+                                ? `${entry.pluginId} requires failed dependency ${failedDependency}.`
+                                : code === 'exclusiveOwnerEvidenceInvalid'
+                                    ? `${entry.pluginId} has damaged or missing exclusive owner evidence. Run aw cleanup ${entry.pluginId} --platform ${platform} --scope ${planned.resolvedScope} --force, then run aw reinstall ${entry.pluginId} --platform ${platform} --scope ${planned.resolvedScope}.`
+                                    : code === 'artifactCollision'
+                                        ? `${entry.pluginId} has foreign-owned output. Remove or relocate it, then run cleanup and reinstall.`
+                                        : code === 'dependencyNotReady'
+                                            ? `${entry.pluginId} live state is unreadable. Run cleanup, then reinstall.`
+                                            : `${entry.pluginId} dependency preflight is blocked.`}`;
+                        const result = failedResult(options.command, identity, message);
+                        results.push({
+                            platforms: [platform], plugins: [], warnings: [], rebuildResults: [result],
+                            targetResults: [{
+                                    target: identity,
+                                    action: failedDependency || failedConsumer ? 'skipped' : planned.action,
+                                    state: 'failed',
+                                    errorCode: code,
+                                    message,
+                                    ...(code === 'exclusiveOwnerEvidenceInvalid' ? {
+                                        recoveryActions: [
+                                            `run aw cleanup ${entry.pluginId} --platform ${platform} --scope ${planned.resolvedScope} --force`,
+                                            `then run aw reinstall ${entry.pluginId} --platform ${platform} --scope ${planned.resolvedScope}`,
+                                        ],
+                                    } : {}),
+                                }],
+                            overallState: 'failed',
+                            receiptTargets: [{
+                                    pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                    sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
+                                }],
+                        });
+                        dependencyStates.set(`${entry.pluginId}\0${platform}`, failedDependency || failedConsumer ? 'skipped' : 'failed');
+                        continue;
+                    }
+                    if (reconcileActivationOnly) {
+                        const preparedError = preparedTargetErrors.get(`${entry.pluginId}\0${platform}`);
+                        if (preparedError) {
+                            const message = preparedError instanceof Error
+                                ? preparedError.message
+                                : String(preparedError);
+                            const result = failedResult(options.command, identity, message);
+                            results.push({
+                                platforms: [platform], plugins: [], warnings: [], rebuildResults: [result],
+                                targetResults: [{
+                                        target: identity,
+                                        action: planned.action,
+                                        state: 'failed',
+                                        errorCode: message.split(':', 1)[0] ?? 'targetPreparationFailed',
+                                        message,
+                                    }],
+                                overallState: 'failed',
+                                receiptTargets: [{
+                                        pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                        sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
+                                    }],
+                            });
+                            dependencyStates.set(`${entry.pluginId}\0${platform}`, 'failed');
+                            continue;
+                        }
+                        const warnings = [];
+                        const result = {
+                            status: 'succeeded', command: options.command, target: identity,
+                            actions: [{ name: 'postApply', status: 'succeeded' }],
+                            cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
+                        };
+                        deferredPostApplyTasks.push({
+                            pluginId: entry.pluginId,
+                            run: () => runPostApplyScript({
+                                plugin: entry.plugin,
+                                platform,
+                                scope: planned.resolvedScope,
+                                cwd: options.commandOptions.cwd,
+                                context: executionContext,
+                                artifacts: [],
+                                components: [{
+                                        kind: 'target',
+                                        key: `${platform}:${planned.resolvedScope}`,
+                                        outcome: 'unchanged',
+                                    }],
+                                scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
+                            }),
+                            onFailure: (error) => {
+                                warnings.push(error instanceof Error ? error.message : String(error));
+                                result.actions[0].status = 'failed';
+                            },
+                        });
+                        results.push({
+                            platforms: [platform], plugins: [identity.pluginName], warnings, rebuildResults: [result],
+                            targetResults: [{ target: identity, action: planned.action, state: 'completed' }],
+                            overallState: 'succeeded',
+                            receiptTargets: [{
+                                    pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                    sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
+                                }],
+                        });
+                        dependencyStates.set(`${entry.pluginId}\0${platform}`, 'completed');
+                        continue;
+                    }
+                    if (platform === 'codex'
+                        && desiredInCurrentScope
+                        && (options.command === 'uninstall'
+                            || (options.command === 'cleanup' && !desiredCleanupMutation))) {
+                        const result = {
+                            status: 'succeeded', command: options.command, target: identity, actions: [],
+                            cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
+                        };
+                        results.push({
+                            platforms: [platform], plugins: [identity.pluginName], warnings: [], rebuildResults: [result],
+                            targetResults: [{ target: identity, action: 'keep', state: 'completed' }],
+                            overallState: 'succeeded',
+                            receiptTargets: [{
+                                    pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                    sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
+                                }],
+                        });
+                        dependencyStates.set(`${entry.pluginId}\0${platform}`, 'kept');
+                        continue;
+                    }
+                    if (planned.action === 'keep'
+                        && !reconcileObsolete
+                        && options.command !== 'cleanup'
+                        && options.command !== 'uninstall') {
+                        const warnings = [];
+                        try {
+                            await runPostApplyScript({
+                                plugin: entry.plugin,
+                                platform,
+                                scope: planned.resolvedScope,
+                                cwd: options.commandOptions.cwd,
+                                context: executionContext,
+                                artifacts: [],
+                                components: [{
+                                        kind: 'target',
+                                        key: `${platform}:${planned.resolvedScope}`,
+                                        outcome: 'unchanged',
+                                    }],
+                                scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
+                            });
+                        }
+                        catch (error) {
+                            warnings.push(error instanceof Error ? error.message : String(error));
+                        }
+                        const result = {
+                            status: 'succeeded', command: options.command, target: identity,
+                            actions: [{ name: 'postApply', status: warnings.length > 0 ? 'failed' : 'succeeded' }],
+                            cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
+                        };
+                        results.push({
+                            platforms: [platform], plugins: [identity.pluginName], warnings, rebuildResults: [result],
+                            targetResults: [{ target: identity, action: 'keep', state: 'completed' }],
+                            overallState: 'succeeded',
+                            receiptTargets: [{
+                                    pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                    sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
+                                }],
+                        });
+                        dependencyStates.set(`${entry.pluginId}\0${platform}`, 'kept');
+                        continue;
+                    }
+                    const marketplaceName = marketplaceNameFor(entry, platform, planned.resolvedScope);
+                    const namespacedSource = {
+                        sourceId: entry.source.sourceId,
+                        sourceIdentity: entry.source.sourceIdentity,
+                        marketplaceName,
+                        marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
+                    };
+                    entry.plugin.marketplaceName = marketplaceName;
+                    const reconcileDesiredCleanup = platform === 'codex'
+                        && options.command === 'cleanup'
+                        && desiredInCurrentScope;
+                    const executionResult = await runSingleSourceRebuildCommand({
+                        ...options,
+                        command: reconcileObsolete
+                            ? 'cleanup'
+                            : reconcileDesiredCleanup
+                                ? 'install'
+                                : planned.action === 'move'
+                                    ? planned.state === 'partial' ? 'reinstall' : 'install'
+                                    : planned.relation === 'dependency'
+                                        ? planned.action
+                                        : options.command,
+                        pluginNames: [entry.plugin.manifest.name],
+                        all: false,
+                        commandOptions: { ...options.commandOptions, platform, scope: planned.resolvedScope },
+                        runtime: {
+                            ...options.runtime,
+                            env: runtimeEnv,
+                            ...(executionContext.codexManager
+                                ? { codexManager: executionContext.codexManager }
+                                : {}),
+                            catalogResolution: toCatalogResolution(entry.source),
+                            resolvedCatalogPlugins: available
+                                .filter((candidate) => candidate.source.sourceId === entry.source.sourceId)
+                                .map((candidate) => candidate.plugin),
+                            namespacedSource,
+                            expectedCatalogConfigDigest: catalog.configDigest,
+                            resolvedReviewEvidenceByPlugin: {
+                                [entry.plugin.manifest.name]: {
+                                    configDigest: catalog.configDigest,
+                                    ...(catalogOperation
+                                        ? { generationSetDigest: catalogOperation.generationSetDigest }
+                                        : {}),
+                                    sourceId: entry.source.sourceId,
+                                    sourceIdentity: entry.source.sourceIdentity,
+                                    resolvedCommit: entry.source.resolvedCommit,
+                                    manifestDigest: entry.source.manifestDigest,
+                                    snapshotDigest: entry.source.snapshotDigest,
+                                    contentDigest: entry.source.manifest.entries.find((candidate) => candidate.name === entry.plugin.manifest.name)?.contentDigest,
+                                },
+                            },
+                        },
+                        execution: {
+                            reviewCompleted: true,
+                            targetHookCompleted: true,
+                            prepared: preparedTargets.get(`${entry.pluginId}\0${platform}`),
+                            preparationError: preparedTargetErrors.get(`${entry.pluginId}\0${platform}`),
+                            ...(platform === 'codex' && lockedCodexPlans.length > 0
+                                ? { deferredPostApplyTasks }
+                                : {}),
+                        },
+                    });
+                    if (reconcileDesiredCleanup) {
+                        for (const result of executionResult.rebuildResults)
+                            result.command = 'cleanup';
+                        for (const result of executionResult.targetResults)
+                            result.action = 'cleanup';
+                    }
+                    results.push(executionResult);
+                    dependencyStates.set(`${entry.pluginId}\0${platform}`, executionResult.overallState === 'succeeded' ? 'completed' : 'failed');
+                }
+                const successfulCodexPluginIds = new Set(executionSelections.flatMap(({ entry, platform }) => platform === 'codex'
+                    && (dependencyStates.get(`${entry.pluginId}\0${platform}`) === 'completed'
+                        || dependencyStates.get(`${entry.pluginId}\0${platform}`) === 'kept')
+                    ? [entry.pluginId]
+                    : []));
+                const activationPlans = selectCodexActivationPlans(lockedCodexPlans, successfulCodexPluginIds);
+                if (activationPlans.length > 0 || deferredPostApplyTasks.length > 0) {
+                    let failedActivationPluginIds = new Set();
+                    try {
+                        if (activationPlans.length > 0) {
+                            await executeCodexReconcileActivations({
+                                plans: activationPlans,
+                                cwd: options.commandOptions.cwd,
+                                env: runtimeEnv,
+                                manager: executionContext.codexManager,
+                                runner: executionContext.nativeCliRunner,
+                            });
+                        }
+                    }
+                    catch (error) {
+                        failedActivationPluginIds = failedCodexActivationPluginIds({
+                            error,
+                            plans: activationPlans,
+                            successfulPluginIds: successfulCodexPluginIds,
+                        });
+                        for (const pluginId of failedActivationPluginIds) {
+                            dependencyStates.set(`${pluginId}\0codex`, 'failed');
+                        }
+                        const message = error instanceof Error ? error.message : String(error);
+                        const failedSelections = executionSelections.filter((candidate) => candidate.platform === 'codex'
+                            && failedActivationPluginIds.has(candidate.entry.pluginId));
+                        if (failedSelections.length === 0)
+                            throw error;
+                        for (const selection of failedSelections) {
+                            const planned = lockedPlan.targets.find((target) => target.pluginId === selection.entry.pluginId && target.platform === 'codex');
+                            const identity = {
+                                sourceId: selection.entry.source.sourceId,
+                                sourceIdentity: selection.entry.source.sourceIdentity,
+                                pluginId: selection.entry.pluginId,
+                                pluginName: selection.entry.plugin.manifest.name,
+                                pluginVersion: selection.entry.plugin.manifest.version,
+                                platform: 'codex',
+                                scope: planned.resolvedScope,
+                                cwd: options.commandOptions.cwd,
+                            };
+                            const resultIndex = results.findIndex((candidate) => candidate.targetResults.some((target) => target.target.pluginId === identity.pluginId
+                                && target.target.platform === 'codex'
+                                && target.target.scope === identity.scope));
+                            if (resultIndex === -1)
+                                throw error;
+                            const existing = results[resultIndex];
+                            const failed = failedResult(options.command, identity, message, 'postcheck.inspect');
+                            results[resultIndex] = {
+                                ...existing,
+                                plugins: existing.plugins.filter((pluginName) => pluginName !== identity.pluginName),
+                                rebuildResults: existing.rebuildResults.map((rebuild) => rebuild.target.pluginId === identity.pluginId
+                                    && rebuild.target.platform === 'codex'
+                                    && rebuild.target.scope === identity.scope
+                                    ? failed
+                                    : rebuild),
+                                targetResults: existing.targetResults.map((target) => target.target.pluginId === identity.pluginId
+                                    && target.target.platform === 'codex'
+                                    && target.target.scope === identity.scope
+                                    ? {
+                                        target: identity,
+                                        action: target.action,
+                                        state: 'failed',
+                                        errorCode: message.split(':', 1)[0] ?? 'codexActivationPostcheckFailed',
+                                        message,
+                                    }
+                                    : target),
+                                overallState: 'failed',
+                            };
+                        }
+                    }
+                    for (const task of deferredPostApplyTasks) {
+                        if (failedActivationPluginIds.has(task.pluginId))
+                            continue;
+                        try {
+                            await task.run();
+                        }
+                        catch (error) {
+                            task.onFailure(error);
+                        }
+                    }
+                }
+                for (const result of results) {
+                    result.targetResults = result.targetResults.map((target) => {
+                        if (target.state !== 'completed')
+                            return target;
+                        const planned = lockedPlan.targets.find((candidate) => candidate.pluginId === target.target.pluginId
+                            && candidate.platform === target.target.platform
+                            && candidate.resolvedScope === target.target.scope);
+                        if (!planned?.preservedScope)
+                            return target;
+                        return {
+                            ...target,
+                            recoveryActions: [
+                                `run aw cleanup ${planned.pluginId} --platform ${planned.platform} --scope ${planned.preservedScope}`,
+                                `then run aw sync --all --platform ${planned.platform} --scope ${planned.resolvedScope}`,
+                            ],
+                        };
+                    });
+                }
+                if (options.command === 'install' || options.command === 'sync') {
+                    for (const { entry, platform } of executionSelections) {
+                        const planned = lockedPlan.targets.find((target) => target.pluginId === entry.pluginId && target.platform === platform);
+                        if (dependencyStates.get(`${entry.pluginId}\0${platform}`) !== 'completed')
+                            continue;
+                        const previousScope = planned.resolvedScope === 'user' ? 'project' : 'user';
+                        const removesPreviousScope = planned.resolvedScope === 'user'
+                            && (planned.action === 'move'
+                                || platform === 'codex' && lockedCodexPlans.some((plan) => plan.extensionRemovals.some((action) => action.pluginId === entry.pluginId && action.scope === previousScope)));
+                        if (!removesPreviousScope) {
+                            continue;
+                        }
+                        const marketplaceName = marketplaceNameFor(entry, platform, previousScope);
+                        entry.plugin.marketplaceName = marketplaceName;
+                        const migration = await runSingleSourceRebuildCommand({
+                            command: 'cleanup',
+                            pluginNames: [entry.plugin.manifest.name],
+                            commandOptions: { ...options.commandOptions, platform, scope: previousScope },
+                            runtime: {
+                                ...options.runtime,
+                                env: runtimeEnv,
+                                ...(executionContext.codexManager
+                                    ? { codexManager: executionContext.codexManager }
+                                    : {}),
+                                catalogResolution: toCatalogResolution(entry.source),
+                                resolvedCatalogPlugins: available
+                                    .filter((candidate) => candidate.source.sourceId === entry.source.sourceId)
+                                    .map((candidate) => candidate.plugin),
+                                namespacedSource: {
+                                    sourceId: entry.source.sourceId,
+                                    sourceIdentity: entry.source.sourceIdentity,
+                                    marketplaceName,
+                                    marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
+                                },
+                            },
+                            execution: { reviewCompleted: true },
+                        });
+                        results.push({
+                            ...migration,
+                            targetResults: migration.targetResults.map((target) => ({
+                                ...target,
+                                relation: planned.relation,
+                                requiredBy: planned.requiredBy,
+                            })),
+                        });
+                        if (migration.overallState !== 'succeeded') {
+                            dependencyStates.set(`${entry.pluginId}\0${platform}`, 'failed');
+                        }
+                    }
+                }
+                const merged = mergeRebuildCommandResults(results);
+                if (malformedSelectedConfigPreserved) {
+                    merged.warnings.push(MALFORMED_CONFIG_PRESERVED_WARNING);
+                }
+                merged.dependencyPlan = lockedPlan;
+                merged.overallState = reconcileOverallState(merged.targetResults, lockedPlan);
+                if (lockedCodexPlans.length > 0)
+                    merged.codexReconcilePlans = lockedCodexPlans;
+                merged.operationPlan = lockedOperationPlan;
+                return leaseSafeRebuildResult(merged);
+            },
+        });
+        if (cleanupForce && !options.runtime?.previewOperationPlan) {
+            try {
+                await (options.runtime?.removeObsoleteInstallationContracts ?? fs.remove)(path.join(resolveAwHome(runtimeEnv), 'installation-contracts'));
+            }
+            catch (error) {
+                resolvedResult.warnings.push(`obsoleteContractsCleanupFailed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        return resolvedResult;
+    }
+    catch (error) {
+        if (options.all && (liveTargets.length > 0 || legacyLiveTargets.length > 0)) {
+            const projected = error;
+            error = namespacedPreflightError(error instanceof Error ? error.message : String(error), projected.namespacedTargets ?? liveTargets, projected.legacyTargets ?? legacyLiveTargets);
+        }
+        if (options.command !== 'uninstall')
+            throw error;
+        const message = error instanceof Error ? error.message : String(error);
+        const catalogUnavailable = isOfflineCleanupCatalogGenerationError(error)
+            || message.startsWith('Cannot resolve required catalog sources:')
+            || message.includes('does not exist in the required catalog source set');
+        if (options.command === 'uninstall' && catalogUnavailable) {
+            throw namespacedPreflightError(`catalogSourceUnavailable: ${message} Restore the source to run lifecycle uninstall, or use cleanup; use cleanup --force only for exclusively owned damaged output.`, liveTargets, legacyLiveTargets);
+        }
+        if (catalogGenerationErrorCode(error) === 'catalogGenerationSourceMissing'
+            || message.includes('does not exist in the required catalog source set')) {
+            throw namespacedPreflightError(`sourceMissing: ${message} Run cleanup for owner recovery, or cleanup --force for an exclusively owned damaged target.`, liveTargets, legacyLiveTargets);
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=rebuild-command.js.map