@lesliechan721/aw 0.1.0-beta.6 → 0.1.0-beta.60

package/dist/src/utils/plugin-config-write.js

@@ -1,16 +1,83 @@
-import path from 'node:path';
-import { discoverRebuildTargetNames, inspectRebuildTarget, } from '../commands/rebuild-integration.js';
-import { reinstallWriteCommand } from '../commands/write-commands.js';
-import { createNoopDebugLogger } from '../output/debug-log.js';
-import { createNoopReporter } from '../output/reporter.js';
-import { getDefaultNativeCliRunner } from './native-cli.js';
-import { resolveAwHome } from './paths.js';
-import { hasCodexProjectManagedArtifacts } from './codex-project-surface.js';
-import { assertSafePluginConfigSegment, coercePluginConfigUpdates, collectProjectArtifactConfigBoundaryIssues, patchPluginConfigStore, readPluginConfigStore, resetPluginConfigStore, resolveConfigRead, resolveEffectivePluginConfig, resolvePluginConfigSchemaAccess, summarizeEffectivePluginConfig, withPluginConfigTransactionLease, } from './plugin-config.js';
-import { assertProjectSharedConfigPathVisible, ensureProjectPrivateStateIgnore, } from './project-boundary.js';
+import { getCommandPackageId } from '@lesliechan721/aw-plugin-core/manifest';
+import { flattenStatusTargets, statusCommandV8, statusTargetIntent, } from '../commands/status-v6.js';
+import { syncWriteCommand } from '../commands/write-commands.js';
+import { CONFIG_MUTATION_RECEIPT_SCHEMA_VERSION, } from '../types.js';
+import { getDefaultNativeCliRunner, prepareNativeCliExecution } from './native-cli.js';
+import { assertReadyPluginConfigStore, assertPluginConfigMutationCandidate, assertSafePluginConfigSegment, codexNativeRefreshKeys, coercePluginConfigUpdates, patchPluginConfigStore, readPluginConfigStore, readNamespacedPluginConfigStoreIdentity, resetPluginConfigStore, resolveConfigRead, resolveEffectivePluginConfig, resolvePluginConfigStorePath, resolvePluginConfigSchemaAccess, summarizeEffectivePluginConfig, } from './plugin-config.js';
+import { analyzePluginConfigMutationImpact, pluginSharedNativeConfigTargets } from './plugin-config-impact.js';
+import { discoverInstalledPluginManagedCommandPackages, assertManagedCommandPackageNativeToolsUnchanged, syncPluginManagedCommandPackage, } from './managed-command-materialization.js';
+import { managedCommandDiagnostic } from './managed-command-store.js';
+import { collectSensitivePluginConfigValues, redactPluginScriptOutput, } from './plugin-scripts.js';
 import { resolveClaudeProjectKey, resolveCodexProjectKey } from './paths.js';
-import { supportsPlatform } from './platform-support.js';
 import { withAwHomeMutationLock, } from './aw-home-mutation-lock.js';
+import { assertProjectSharedConfigPathVisible, } from './project-boundary.js';
+export function buildConfigMutationReceipt(command, receipt) {
+    return {
+        ...receipt,
+        receiptSchemaVersion: CONFIG_MUTATION_RECEIPT_SCHEMA_VERSION,
+        command,
+    };
+}
+function publicConfigApplyTargetResult(result) {
+    return {
+        target: {
+            pluginName: result.target.pluginName,
+            ...(result.target.pluginId ? { pluginId: result.target.pluginId } : {}),
+            platform: result.target.platform,
+            scope: result.target.scope,
+        },
+        action: result.action,
+        state: result.state,
+        ...(result.message ? { message: result.message } : {}),
+        ...(result.errorCode ? { errorCode: result.errorCode } : {}),
+        ...(result.relation ? { relation: result.relation } : {}),
+        ...(result.requiredBy ? { requiredBy: result.requiredBy } : {}),
+    };
+}
+function publicConfigApplyResult(apply) {
+    if (apply.state === 'skipped')
+        return apply;
+    return {
+        ...apply,
+        targetResults: apply.targetResults.map(publicConfigApplyTargetResult),
+    };
+}
+export function configWriteStateForError(error) {
+    return error?.configWrite === 'failed'
+        ? 'failed'
+        : 'notStarted';
+}
+function markConfigWriteFailed(error) {
+    const failure = error instanceof Error ? error : new Error(String(error));
+    return Object.assign(failure, { configWrite: 'failed' });
+}
+function skippedApply(reason) {
+    return { state: 'skipped', reason, targetResults: [] };
+}
+function unavailableApply(reason, stage, targetResults = [], commandPackages = []) {
+    const messages = {
+        invalidConfig: 'The effective config is invalid for every visible target.',
+        schemaUnavailable: 'The config schema is unavailable after the config commit.',
+        sourceUnavailable: 'The plugin source is unavailable after the config commit.',
+        effectiveConfigUnavailable: 'The effective config cannot be read after the config commit.',
+        targetDiscoveryFailed: 'Visible config apply targets cannot be discovered after the config commit.',
+    };
+    return {
+        state: 'unavailable',
+        reason,
+        targetResults,
+        ...(commandPackages.length > 0 ? { commandResults: commandPackages.map((target) => ({
+                producer: target.producer, state: 'failed', commandIds: [], removedCommandIds: [],
+                errors: [{ code: reason, message: messages[reason] }],
+                recoveryActions: [`aw command package sync ${target.producer.sourceId}/${target.producer.pluginName} ${target.packageKey} --scope ${target.producer.scope} --yes`,
+                    `aw command package remove ${target.packageId} --yes`],
+            })) } : {}),
+        error: { stage, code: reason, message: messages[reason] },
+    };
+}
+function overallStateForApply(apply) {
+    return apply.state === 'succeeded' || apply.state === 'skipped' ? 'succeeded' : 'partial';
+}
 function uniqueInOrder(values) {
     return [...new Set(values)];
 }
@@ -44,154 +111,478 @@ async function createCandidateTarget(options) {
 async function discoverVisibleTargets(options) {
     const targets = [];
     const failures = [];
-    const namedTargets = [];
-    const scopes = options.scope === 'user' ? ['user', 'project'] : ['project'];
-    for (const platform of ['codex', 'claude']) {
-        for (const scope of scopes) {
-            if (!supportsPlatform(options.plugin.manifest, platform))
-                continue;
-            if (platform === 'codex'
-                && scope === 'project'
-                && !hasCodexProjectManagedArtifacts(options.plugin))
+    const selector = options.plugin.pluginId ?? options.pluginName;
+    const status = await statusCommandV8({
+        plugins: [selector],
+        cwd: options.cwd,
+        env: options.env,
+        nativeCliRunner: options.nativeCliRunner,
+        ...(options.scope === 'project' ? { scope: 'project' } : {}),
+        ...(options.rebuildRuntime?.catalogOperationContext
+            ? { catalogOperationContext: options.rebuildRuntime.catalogOperationContext }
+            : {}),
+    });
+    for (const statusTarget of flattenStatusTargets(status.payload.targets)) {
+        const intent = statusTargetIntent(statusTarget);
+        if ((statusTarget.pluginId !== selector && statusTarget.pluginName !== options.pluginName)
+            || !intent.enabled)
+            continue;
+        for (const scope of intent.scopes) {
+            if (options.scope === 'project' && scope !== 'project')
                 continue;
-            const target = await createCandidateTarget({
+            targets.push(await createCandidateTarget({
                 pluginName: options.pluginName,
-                platform,
+                platform: statusTarget.platform,
                 scope,
                 cwd: options.cwd,
+            }));
+        }
+    }
+    return { targets: dedupeTargets(targets), failures };
+}
+async function reinstallVisibleTargets(options) {
+    const nativeCliRunner = options.nativeCliRunner ?? getDefaultNativeCliRunner();
+    const discovered = options.discovered ?? await resolveConfigApplyTargets(options);
+    const targetResults = [...discovered.failures];
+    const commandResults = new Map();
+    const managedCommandProducerCache = options.rebuildRuntime?.managedCommandProducerCache
+        ?? new Map();
+    let runtimeFailed = discovered.failures.length > 0
+        || (discovered.commandDiscoveryErrors?.length ?? 0) > 0;
+    let invalidTargets = 0;
+    let unavailableTargets = 0;
+    const errors = [];
+    if ((discovered.commandDiscoveryErrors?.length ?? 0) > 0) {
+        errors.push(...discovered.commandDiscoveryErrors.map((error) => ({
+            stage: 'targetDiscovery', code: error.code, message: error.message,
+        })));
+    }
+    const reinstall = options.reinstallCommandImpl ?? syncWriteCommand;
+    if (options.plugin.sourceId && !options.plugin.pluginId) {
+        throw new Error(`Plugin "${options.plugin.manifest.name}" is missing its namespaced plugin ID.`);
+    }
+    const selector = options.plugin.sourceId
+        ? options.plugin.pluginId
+        : options.plugin.manifest.name;
+    const nativeFailures = [];
+    for (const target of discovered.commandPackages ?? []) {
+        try {
+            await assertManagedCommandPackageNativeToolsUnchanged({ plugin: options.plugin, producer: target.producer, env: options.env });
+        }
+        catch (error) {
+            nativeFailures.push({ producer: target.producer, state: 'failed', commandIds: [], removedCommandIds: [],
+                errors: [managedCommandDiagnostic(error)],
+                recoveryActions: [`aw command package sync ${selector} ${target.packageKey} --scope ${target.producer.scope} --yes`] });
+        }
+    }
+    if (nativeFailures.length > 0) {
+        return { state: 'partial', commandResults: nativeFailures,
+            targetResults: [...targetResults, ...discovered.targets.map((target) => ({
+                    target, action: 'reinstall', state: 'failed', errorCode: 'nativeToolSyncRequired',
+                    message: 'Run a reviewed producer sync or package sync before configuration apply.',
+                }))] };
+    }
+    const sanitizeFailure = async (message, target) => {
+        let sensitiveValues = [];
+        try {
+            const effective = await resolveEffectivePluginConfig({
+                ...(options.plugin.sourceId ? {
+                    sourceId: options.plugin.sourceId,
+                    sourceIdentity: options.plugin.sourceIdentity,
+                    logicalIdentity: options.plugin.catalogLogicalIdentity,
+                } : {}),
+                pluginName: options.plugin.manifest.name,
+                manifest: options.plugin.manifest,
+                targetScope: target.scope,
+                cwd: options.cwd,
+                env: options.env,
             });
-            try {
-                const names = await discoverRebuildTargetNames({
-                    cwd: options.cwd,
-                    env: options.env,
-                    platform,
-                    scope,
-                    nativeCliRunner: options.nativeCliRunner,
-                    nativeFailureMode: 'ignore',
-                    marketplaceName: options.plugin.marketplaceName,
-                    marketplaceRoot: options.plugin.sourceId
-                        ? path.join(resolveAwHome(options.env), 'marketplaces', options.plugin.sourceId)
-                        : undefined,
-                });
-                if (!names.includes(options.pluginName))
-                    continue;
-                namedTargets.push(target);
-            }
-            catch (error) {
-                failures.push({
+            sensitiveValues = collectSensitivePluginConfigValues(options.plugin.manifest, effective.values);
+        }
+        catch {
+            // Generic credential redaction and known config paths still apply.
+        }
+        let sanitized = redactPluginScriptOutput(message, sensitiveValues);
+        for (const privatePath of [target.projectKey, options.cwd]) {
+            if (privatePath)
+                sanitized = sanitized.split(privatePath).join('<project>');
+        }
+        for (const scope of ['user', 'project']) {
+            const configPath = resolvePluginConfigStorePath({
+                sourceId: options.plugin.sourceId,
+                pluginName: options.plugin.manifest.name,
+                scope,
+                cwd: options.cwd,
+                env: options.env,
+            });
+            const safeTarget = `${scope}/plugin-config/${[
+                options.plugin.sourceId,
+                options.plugin.manifest.name,
+                'config.json',
+            ].filter(Boolean).join('/')}`;
+            sanitized = sanitized.split(configPath).join(safeTarget);
+        }
+        return sanitized;
+    };
+    const sanitizeProjection = async (value, target, freeText = false) => {
+        if (typeof value === 'string')
+            return freeText ? sanitizeFailure(value, target) : value;
+        if (value === null || typeof value !== 'object')
+            return value;
+        if (Array.isArray(value)) {
+            return Promise.all(value.map((entry) => sanitizeProjection(entry, target, freeText)));
+        }
+        return Object.fromEntries(await Promise.all(Object.entries(value).map(async ([key, entry]) => [
+            key,
+            await sanitizeProjection(entry, target, typeof entry === 'string'
+                ? /^(?:message|error|stack|stdout|stderr|output|warning)$/u.test(key)
+                : Array.isArray(entry) && /^(?:messages|warnings)$/u.test(key)),
+        ])));
+    };
+    const preApplyExecutionCache = new Map();
+    for (const target of discovered.targets) {
+        try {
+            const effective = await resolveEffectivePluginConfig({
+                ...(options.plugin.sourceId ? {
+                    sourceId: options.plugin.sourceId,
+                    sourceIdentity: options.plugin.sourceIdentity,
+                    logicalIdentity: options.plugin.catalogLogicalIdentity,
+                } : {}),
+                pluginName: options.plugin.manifest.name,
+                manifest: options.plugin.manifest,
+                targetScope: target.scope,
+                cwd: options.cwd,
+                env: options.env,
+            });
+            if (effective.issues.length > 0) {
+                invalidTargets += 1;
+                targetResults.push({
                     target,
                     action: 'reinstall',
-                    state: 'failed',
-                    message: error instanceof Error ? error.message : String(error),
+                    state: 'skipped',
+                    errorCode: 'invalidConfig',
+                    message: 'The effective config is invalid for this target.',
                 });
+                continue;
             }
         }
-    }
-    if (namedTargets.length === 0)
-        return { targets, failures };
-    const catalog = options.rebuildRuntime?.catalogResolution ?? {
-        rootDir: options.plugin.sourceId
-            ? path.resolve(options.plugin.rootDir, '..', '..')
-            : options.plugin.rootDir,
-        source: 'local',
-    };
-    for (const target of namedTargets) {
+        catch {
+            runtimeFailed = true;
+            unavailableTargets += 1;
+            targetResults.push({
+                target,
+                action: 'reinstall',
+                state: 'failed',
+                errorCode: 'effectiveConfigUnavailable',
+                message: 'The effective config cannot be read for this target.',
+            });
+            errors.push({
+                stage: 'targetValidation',
+                code: 'effectiveConfigUnavailable',
+                message: 'The effective config cannot be read for a visible target.',
+            });
+            continue;
+        }
         try {
-            const inspected = await inspectRebuildTarget({
-                sourceId: options.plugin.sourceId,
-                sourceIdentity: options.plugin.sourceIdentity,
-                pluginId: options.plugin.pluginId,
-                marketplaceName: options.plugin.marketplaceName,
-                marketplaceRoot: options.plugin.sourceId
-                    ? path.join(resolveAwHome(options.env), 'marketplaces', options.plugin.sourceId)
-                    : undefined,
-                plugin: options.plugin,
+            const debugLogger = options.rebuildRuntime?.debugLogger;
+            const reporter = options.rebuildRuntime?.reporter;
+            const result = await reinstall([selector], {
+                cwd: options.cwd,
                 platform: target.platform,
                 scope: target.scope,
-                cwd: options.cwd,
-                catalog,
-                context: {
-                    env: options.env,
-                    nativeCliRunner: options.nativeCliRunner,
-                    reporter: options.rebuildRuntime?.reporter ?? createNoopReporter(),
-                    debugLogger: options.rebuildRuntime?.debugLogger ?? createNoopDebugLogger(),
-                },
+                ...(options.rebuildRuntime?.scriptTimeoutMs === undefined
+                    ? {}
+                    : { scriptTimeoutMs: options.rebuildRuntime.scriptTimeoutMs }),
+            }, {
+                ...options.rebuildRuntime,
+                env: options.env,
+                nativeCliRunner,
+                preApplyConfirmed: options.preApplyConfirmed === true,
+                preApplyExecutionCache,
+                managedCommandProducerCache,
+                ...(debugLogger ? {
+                    debugLogger: {
+                        ...debugLogger,
+                        log: async (value) => debugLogger.log(await sanitizeProjection(value, target)),
+                    },
+                } : {}),
+                ...(reporter ? {
+                    reporter: {
+                        event: async (value) => reporter.event(await sanitizeProjection(value, target)),
+                        notice: async (value) => reporter.notice(await sanitizeProjection(value, target)),
+                    },
+                } : {}),
             });
-            if (inspected.inspection.state === 'present' || inspected.inspection.state === 'partial') {
-                targets.push(target);
+            options.rebuildRuntime?.operationDiagnosticSink?.(result.rebuildResults);
+            for (const producer of result.commandResults ?? []) {
+                commandResults.set(getCommandPackageId(producer.producer), producer);
+                if (producer.state !== 'completed')
+                    runtimeFailed = true;
             }
+            if (result.overallState !== 'succeeded')
+                runtimeFailed = true;
+            targetResults.push(...await Promise.all(result.targetResults.map(async (entry) => ({
+                ...entry,
+                state: entry.action === 'skipped' ? 'skipped' : entry.state,
+                ...(entry.message ? { message: await sanitizeFailure(entry.message, entry.target) } : {}),
+            }))));
         }
         catch (error) {
-            failures.push({
+            runtimeFailed = true;
+            const message = await sanitizeFailure(error instanceof Error ? error.message : String(error), target);
+            targetResults.push({
                 target,
                 action: 'reinstall',
                 state: 'failed',
-                message: error instanceof Error ? error.message : String(error),
+                message,
+            });
+            errors.push({
+                stage: 'apply',
+                code: 'targetApplyFailed',
+                message: 'A visible config apply target failed.',
             });
         }
     }
-    return { targets: dedupeTargets(targets), failures };
+    for (const target of discovered.commandPackages ?? []) {
+        await options.rebuildRuntime?.reporter?.event({
+            type: 'managed-command:producer',
+            source: { plugin: options.plugin.manifest.name, scope: target.producer.scope },
+            data: { packageKey: target.packageKey, phase: 'start' },
+        });
+        let result;
+        if (!target.declared) {
+            result = {
+                producer: target.producer, state: 'failed', commandIds: [], removedCommandIds: [],
+                errors: [{ code: 'commandPackageDeclarationMissing',
+                        message: 'The installed command package is no longer declared by this plugin.' }],
+                recoveryActions: [`aw command package remove ${target.packageId} --yes`],
+            };
+        }
+        else {
+            try {
+                result = await syncPluginManagedCommandPackage({
+                    plugin: options.plugin, packageKey: target.packageKey, scope: target.producer.scope,
+                    cwd: options.cwd, env: options.env, managedCommandProducerCache,
+                    event: options.changedConfigKeys?.length ? 'refresh' : 'install',
+                    changedConfigKeys: options.changedConfigKeys ?? [],
+                });
+            }
+            catch {
+                result = {
+                    producer: target.producer, state: 'failed', commandIds: [], removedCommandIds: [],
+                    errors: [{ code: 'commandPackageApplyFailed', message: 'The managed command package could not be refreshed.' }],
+                    recoveryActions: [`aw command package sync ${selector} ${target.packageKey} --scope ${target.producer.scope} --yes`,
+                        `aw command package remove ${target.packageId} --yes`],
+                };
+            }
+        }
+        result = { ...result, errors: await Promise.all(result.errors.map(async (error) => ({
+                ...error, message: await sanitizeFailure(error.message, { scope: target.producer.scope,
+                    ...(target.producer.projectRoot ? { projectKey: target.producer.projectRoot } : {}) }),
+            }))) };
+        commandResults.set(getCommandPackageId(result.producer), result);
+        await options.rebuildRuntime?.reporter?.event({
+            type: 'managed-command:producer',
+            source: { plugin: options.plugin.manifest.name, scope: target.producer.scope },
+            data: { packageKey: target.packageKey, phase: result.state === 'completed' ? 'success' : 'failure' },
+        });
+        if (result.state !== 'completed')
+            runtimeFailed = true;
+    }
+    const commands = commandResults.size > 0 ? { commandResults: [...commandResults.values()] } : {};
+    const commandTargetCount = (discovered.commandPackages?.length ?? 0);
+    if (discovered.targets.length === 0 && discovered.failures.length === 0
+        && commandTargetCount === 0 && !runtimeFailed) {
+        return skippedApply('noVisibleTarget');
+    }
+    if (discovered.targets.length > 0 && invalidTargets === discovered.targets.length && commandTargetCount === 0) {
+        return { ...unavailableApply('invalidConfig', 'targetValidation', targetResults), ...commands };
+    }
+    if (discovered.targets.length > 0 && unavailableTargets === discovered.targets.length && commandTargetCount === 0) {
+        return { ...unavailableApply('effectiveConfigUnavailable', 'targetValidation', targetResults), ...commands };
+    }
+    if (runtimeFailed
+        || invalidTargets > 0
+        || unavailableTargets > 0
+        || targetResults.some((entry) => entry.state === 'failed' || entry.state === 'skipped')) {
+        return {
+            state: 'partial',
+            targetResults,
+            ...commands,
+            ...(errors.length > 0 ? { errors } : {}),
+        };
+    }
+    return { state: 'succeeded', targetResults, ...commands };
 }
-async function reinstallVisibleTargets(options) {
-    const nativeCliRunner = options.nativeCliRunner ?? getDefaultNativeCliRunner();
-    const discovered = options.applyTargets === undefined
-        ? await discoverVisibleTargets({
+async function resolveConfigApplyTargets(options) {
+    const platformTargets = options.applyTargets !== undefined
+        ? { targets: dedupeTargets(options.applyTargets), failures: [] }
+        : await discoverVisibleTargets({
             pluginName: options.plugin.manifest.name,
             plugin: options.plugin,
             scope: options.scope,
             cwd: options.cwd,
             env: options.env,
-            nativeCliRunner,
+            nativeCliRunner: options.nativeCliRunner ?? getDefaultNativeCliRunner(),
             rebuildRuntime: options.rebuildRuntime,
-        })
-        : { targets: dedupeTargets(options.applyTargets), failures: [] };
-    const targetResults = [...discovered.failures];
-    let runtimeFailed = discovered.failures.length > 0;
-    const reinstall = options.reinstallCommandImpl ?? reinstallWriteCommand;
+        });
+    const commands = await discoverInstalledPluginManagedCommandPackages({
+        plugin: options.plugin, scope: options.scope, cwd: options.cwd, env: options.env,
+        platformTargets: platformTargets.targets,
+    });
+    return { ...platformTargets, commandPackages: commands.packages, commandDiscoveryErrors: commands.errors };
+}
+async function configApplyHasValidSharedNativeTarget(options) {
+    const sharedTargets = pluginSharedNativeConfigTargets(options.plugin);
+    if (options.targets.some((target) => sharedTargets.some((shared) => (shared.platform ?? 'codex') === target.platform))) {
+        const effective = await resolveEffectivePluginConfig({
+            ...(options.plugin.sourceId ? {
+                sourceId: options.plugin.sourceId,
+                sourceIdentity: options.plugin.sourceIdentity,
+                logicalIdentity: options.plugin.catalogLogicalIdentity,
+            } : {}),
+            pluginName: options.plugin.manifest.name,
+            manifest: options.plugin.manifest,
+            targetScope: 'user',
+            cwd: options.cwd,
+            env: options.env,
+        });
+        if (effective.issues.length === 0)
+            return true;
+    }
+    return false;
+}
+async function applyConfigToVisibleTargets(options) {
+    let discovered;
+    if (options.discovered) {
+        discovered = options.discovered;
+    }
+    else {
+        try {
+            discovered = await resolveConfigApplyTargets(options);
+        }
+        catch {
+            return unavailableApply('targetDiscoveryFailed', 'targetDiscovery');
+        }
+    }
+    if (discovered.targets.length === 0
+        && discovered.failures.length === 0
+        && (discovered.commandPackages?.length ?? 0) === 0
+        && options.noVisibleTargetHasInvalidConfig) {
+        return unavailableApply('invalidConfig', 'targetValidation');
+    }
+    return reinstallVisibleTargets({ ...options, discovered });
+}
+export async function resolveConfigPreApplyAuthorization(options) {
+    const applyTargets = dedupeTargets(options.applyTargets);
+    if (applyTargets.length === 0 || !pluginMayRunPreApply(options.plugin)) {
+        return { targets: [], availableApplyTargets: applyTargets, unavailableTargetResults: [] };
+    }
     if (options.plugin.sourceId && !options.plugin.pluginId) {
-        throw new Error(`Plugin "${options.plugin.manifest.name}" is missing its namespaced plugin ID.`);
+        return {
+            targets: [],
+            availableApplyTargets: [],
+            unavailableTargetResults: applyTargets.map((target) => ({
+                target,
+                action: 'reinstall',
+                state: 'failed',
+                errorCode: 'sourceUnavailable',
+                message: 'The preApply authorization scope cannot be resolved for this target.',
+            })),
+        };
     }
     const selector = options.plugin.sourceId
         ? options.plugin.pluginId
         : options.plugin.manifest.name;
-    for (const target of discovered.targets) {
+    const groups = new Map();
+    for (const target of applyTargets) {
+        const targets = groups.get(target.scope) ?? [];
+        targets.push(target);
+        groups.set(target.scope, targets);
+    }
+    const authorization = [];
+    const availableApplyTargets = [];
+    const unavailableTargetResults = [];
+    const resolveGroup = async (targets) => {
+        const platforms = new Set(targets.map((target) => target.platform));
+        const platform = platforms.size === 2 ? 'both' : [...platforms][0];
         try {
-            const result = await reinstall([selector], {
+            const preview = await (options.reinstallCommandImpl ?? syncWriteCommand)([selector], {
                 cwd: options.cwd,
-                platform: target.platform,
-                scope: target.scope,
+                platform,
+                scope: targets[0].scope,
             }, {
                 ...options.rebuildRuntime,
-                env: options.env,
-                nativeCliRunner,
+                env: options.env ?? process.env,
+                nativeCliRunner: options.nativeCliRunner,
+                resolvePreApplyAuthorization: true,
             });
-            if (result.overallState === 'failed')
-                runtimeFailed = true;
-            targetResults.push(...result.targetResults);
+            if (preview.overallState !== 'succeeded' || !preview.preApplyAuthorization)
+                return false;
+            authorization.push(...preview.preApplyAuthorization);
+            availableApplyTargets.push(...targets);
+            return true;
         }
-        catch (error) {
-            runtimeFailed = true;
-            targetResults.push({
+        catch {
+            return false;
+        }
+    };
+    for (const targets of groups.values()) {
+        if (await resolveGroup(targets))
+            continue;
+        for (const target of targets) {
+            if (targets.length > 1 && await resolveGroup([target]))
+                continue;
+            unavailableTargetResults.push({
                 target,
                 action: 'reinstall',
                 state: 'failed',
-                message: error instanceof Error ? error.message : String(error),
+                errorCode: 'sourceUnavailable',
+                message: 'The preApply authorization scope cannot be resolved for this target.',
             });
         }
     }
-    const overallState = runtimeFailed || targetResults.some((entry) => entry.state === 'failed')
-        ? 'failed' : 'succeeded';
     return {
-        overallState,
-        targetResults,
-        ...(discovered.targets.length === 0 && discovered.failures.length === 0
-            ? { applySkippedReason: 'noVisibleTarget' }
-            : {}),
+        targets: [...new Map(authorization.map((target) => [[
+                    target.pluginId,
+                    target.platform,
+                    target.scope,
+                ].join('\0'), target])).values()],
+        availableApplyTargets: dedupeTargets(availableApplyTargets),
+        unavailableTargetResults,
     };
 }
+function pluginMayRunPreApply(plugin) {
+    return plugin.manifest.scripts?.preApply !== undefined
+        || (plugin.manifest.dependencies?.length ?? 0) > 0;
+}
+function throwPreApplyAuthorizationRequired(targets) {
+    const plugins = [...new Set(targets.map((target) => target.pluginId))].join(', ');
+    const error = new Error(`preApplyAuthorizationRequired: Applying this config runs plugin preApply for ${plugins}. Re-run with --yes.`);
+    error.code = 'preApplyAuthorizationRequired';
+    throw error;
+}
+function preApplyAuthorizationIsConfirmed(options) {
+    if (options.confirmed !== true)
+        return false;
+    if (options.authorizedTargets === undefined)
+        return true;
+    const authorized = new Set(options.authorizedTargets.map((target) => [
+        target.pluginId,
+        target.sourceIdentity,
+        target.platform,
+        target.scope,
+    ].join('\0')));
+    return options.required.every((target) => authorized.has([
+        target.pluginId,
+        target.sourceIdentity,
+        target.platform,
+        target.scope,
+    ].join('\0')));
+}
 function otherProjectsWarning(scope) {
     return scope === 'user'
-        ? ['其它项目不会由本次命令扫描或更新。请在每个项目目录中运行对应的 aw reinstall 命令。']
+        ? ['其它项目不会由本次命令扫描或更新，可能需要在对应项目目录中运行 aw sync。']
         : [];
 }
 function buildReceiptFieldEntry(options) {
@@ -202,35 +593,133 @@ function buildReceiptFieldEntry(options) {
         reserved: options.reserved,
         action: options.action,
         scope: options.scope,
-        ...(options.scope === 'project' ? { projectLayer: options.projectLayer } : {}),
         ...(options.valueState ? { valueState: options.valueState } : {}),
     };
 }
 export async function replayConfigRuntimeWrites(options) {
+    if (!options.awHomeMutationToken) {
+        await prepareNativeCliExecution({ env: options.env, runner: options.nativeCliRunner });
+    }
     return withAwHomeMutationLock({
         env: options.env,
         token: options.awHomeMutationToken,
         action: async (awHomeMutationToken) => {
-            const applied = await reinstallVisibleTargets({
+            const env = options.env ?? process.env;
+            const rebuildRuntime = { ...options.rebuildRuntime, awHomeMutationToken };
+            let discovered;
+            try {
+                discovered = await resolveConfigApplyTargets({
+                    plugin: options.plugin,
+                    scope: options.scope,
+                    cwd: options.cwd,
+                    env,
+                    applyTargets: options.applyTargets,
+                    nativeCliRunner: options.nativeCliRunner,
+                    rebuildRuntime,
+                });
+            }
+            catch {
+                const apply = unavailableApply('targetDiscoveryFailed', 'targetDiscovery');
+                return {
+                    configWrite: 'succeeded',
+                    overallState: 'partial',
+                    apply: publicConfigApplyResult(apply),
+                    otherProjectsMayRequireSync: false,
+                };
+            }
+            const preApplyAuthorization = await resolveConfigPreApplyAuthorization({
                 plugin: options.plugin,
                 scope: options.scope,
                 cwd: options.cwd,
-                env: options.env ?? process.env,
+                env,
+                applyTargets: discovered.targets,
+                nativeCliRunner: options.nativeCliRunner,
+                rebuildRuntime,
+                reinstallCommandImpl: options.reinstallCommandImpl,
+            });
+            if (preApplyAuthorization.targets.length > 0 && !preApplyAuthorizationIsConfirmed({
+                required: preApplyAuthorization.targets,
+                confirmed: options.preApplyConfirmed,
+                authorizedTargets: options.preApplyAuthorizedTargets,
+            })) {
+                const apply = {
+                    state: 'partial',
+                    targetResults: preApplyAuthorization.targets.map((target) => ({
+                        target: {
+                            pluginName: target.pluginName,
+                            pluginId: target.pluginId,
+                            platform: target.platform,
+                            scope: target.scope,
+                        },
+                        action: 'reinstall',
+                        state: 'failed',
+                        errorCode: 'preApplyAuthorizationRequired',
+                        message: 'Running plugin preApply requires explicit authorization.',
+                    })),
+                };
+                return {
+                    configWrite: 'succeeded',
+                    overallState: 'partial',
+                    apply: publicConfigApplyResult(apply),
+                    otherProjectsMayRequireSync: false,
+                };
+            }
+            discovered = {
+                ...discovered,
+                targets: preApplyAuthorization.availableApplyTargets,
+                failures: [...discovered.failures, ...preApplyAuthorization.unavailableTargetResults],
+            };
+            if (discovered.targets.length === 0
+                && preApplyAuthorization.unavailableTargetResults.length > 0
+                && (discovered.commandPackages?.length ?? 0) === 0) {
+                const apply = unavailableApply('sourceUnavailable', 'source', preApplyAuthorization.unavailableTargetResults);
+                return {
+                    configWrite: 'succeeded',
+                    overallState: 'partial',
+                    apply: publicConfigApplyResult(apply),
+                    otherProjectsMayRequireSync: false,
+                };
+            }
+            if (options.scope === 'user'
+                && options.sharedNativeApplyConfirmed !== true
+                && pluginHasSharedNativeRefreshKeys(options.plugin)
+                && await configApplyHasValidSharedNativeTarget({
+                    plugin: options.plugin,
+                    targets: discovered.targets,
+                    cwd: options.cwd,
+                    env,
+                })) {
+                throwSharedNativeApplyConfirmationRequired();
+            }
+            const apply = await reinstallVisibleTargets({
+                plugin: options.plugin,
+                scope: options.scope,
+                cwd: options.cwd,
+                env,
                 applyTargets: options.applyTargets,
                 nativeCliRunner: options.nativeCliRunner,
                 reinstallCommandImpl: options.reinstallCommandImpl,
-                rebuildRuntime: { ...options.rebuildRuntime, awHomeMutationToken },
+                rebuildRuntime,
+                discovered,
+                preApplyConfirmed: options.preApplyConfirmed,
             });
             return {
                 configWrite: 'succeeded',
-                overallState: applied.overallState,
-                targetResults: applied.targetResults,
-                ...(applied.applySkippedReason ? { applySkippedReason: applied.applySkippedReason } : {}),
-                otherProjectsRequireReinstall: options.scope === 'user',
+                overallState: overallStateForApply(apply),
+                apply: publicConfigApplyResult(apply),
+                otherProjectsMayRequireSync: false,
             };
         },
     });
 }
+function pluginHasSharedNativeRefreshKeys(plugin) {
+    return pluginSharedNativeConfigTargets(plugin).length > 0;
+}
+function throwSharedNativeApplyConfirmationRequired() {
+    const error = new Error('sharedNativeConfigApplyConfirmationRequired: Applying this user config changes a shared native artifact. Re-run with --yes.');
+    error.code = 'sharedNativeConfigApplyConfirmationRequired';
+    throw error;
+}
 async function applyPluginConfigWriteUnlocked(options) {
     const requestedPluginName = options.pluginName ?? options.plugin?.manifest.name;
     if (!requestedPluginName)
@@ -239,8 +728,8 @@ async function applyPluginConfigWriteUnlocked(options) {
     const configIdentity = options.plugin?.sourceId ? {
         sourceId: options.plugin.sourceId,
         sourceIdentity: options.plugin.sourceIdentity,
+        logicalIdentity: options.plugin.catalogLogicalIdentity,
     } : {};
-    const projectLayer = options.scope === 'project' ? (options.projectLayer ?? 'shared') : 'shared';
     const requestedUpdates = options.request.updates ?? {};
     const requestedRemoveKeys = uniqueInOrder(options.request.removeKeys ?? []);
     const duplicateKeys = requestedRemoveKeys.filter((key) => Object.hasOwn(requestedUpdates, key));
@@ -252,113 +741,229 @@ async function applyPluginConfigWriteUnlocked(options) {
         currentPlugin: options.plugin,
         currentPluginError: options.pluginError,
         scope: options.scope,
-        projectLayer,
         cwd: options.cwd,
         env: options.env,
     });
     const schemaPlugin = schemaAccess.plugin;
-    const schema = schemaPlugin?.manifest.config?.schema;
+    const schema = schemaPlugin?.manifest.config?.fields;
     if (!schema || !schemaPlugin) {
         throw new Error(`configSchemaUnavailable: Plugin "${pluginName}" does not declare an AW config schema.`);
     }
-    for (const key of requestedRemoveKeys) {
-        if (!schema[key])
-            throw new Error(`Unknown config key "${key}".`);
+    if (options.scope === 'project') {
+        const userStore = await readPluginConfigStore({
+            ...configIdentity,
+            pluginName,
+            scope: 'user',
+            cwd: options.cwd,
+            env: options.env,
+            schema,
+        });
+        assertReadyPluginConfigStore(userStore);
     }
-    const updates = await coercePluginConfigUpdates({ schema, updates: requestedUpdates, cwd: options.cwd });
-    if (options.scope === 'project' && projectLayer === 'shared') {
-        for (const key of Object.keys(updates)) {
-            const field = schema[key];
-            if (field.type === 'file' || field.type === 'directory') {
-                throw new Error(`Config "${key}" is a ${field.type} value and cannot be written into project shared config. `
-                    + 'Use `--scope project --local` or user config instead.');
-            }
+    if (options.scope === 'project') {
+        const rejectedSensitiveKeys = Object.keys(requestedUpdates)
+            .filter((key) => schema[key]?.sensitive === true);
+        if (rejectedSensitiveKeys.length > 0) {
+            const error = new Error('sensitiveProjectConfigUnsupported: Sensitive config can only be set in user scope.');
+            error.code = 'sensitiveProjectConfigUnsupported';
+            throw error;
+        }
+        const userOnlyKeys = codexNativeRefreshKeys(schemaPlugin.manifest);
+        const rejectedKeys = Object.keys(requestedUpdates).filter((key) => userOnlyKeys.has(key));
+        if (rejectedKeys.length > 0) {
+            const error = new Error(`sharedNativeConfigUserScopeRequired: Codex native Skill refresh keys can only be set in user scope: ${rejectedKeys.join(', ')}.`);
+            error.code = 'sharedNativeConfigUserScopeRequired';
+            throw error;
         }
     }
-    const store = await readPluginConfigStore({
+    let discovered;
+    let targetDiscoveryFailed = false;
+    if (options.apply !== false) {
+        try {
+            discovered = await resolveConfigApplyTargets({
+                plugin: schemaPlugin,
+                scope: options.scope,
+                cwd: options.cwd,
+                env: options.env ?? process.env,
+                applyTargets: options.applyTargets,
+                nativeCliRunner: options.nativeCliRunner,
+                rebuildRuntime: options.rebuildRuntime,
+            });
+        }
+        catch {
+            targetDiscoveryFailed = true;
+        }
+    }
+    const impact = await analyzePluginConfigMutationImpact({
+        plugin: schemaPlugin,
+        scope: options.scope,
+        cwd: options.cwd,
+        env: options.env,
+        visibleTargets: discovered?.targets ?? [],
+        ...(discovered ? { commandDiscovery: {
+                packages: discovered.commandPackages ?? [], errors: discovered.commandDiscoveryErrors ?? [],
+            } } : {}),
+        mutation: {
+            kind: 'patch',
+            updates: requestedUpdates,
+            removeKeys: requestedRemoveKeys,
+        },
+    });
+    const updates = await coercePluginConfigUpdates({ schema, updates: requestedUpdates, cwd: options.cwd });
+    await assertPluginConfigMutationCandidate({
         ...configIdentity,
         pluginName,
+        manifest: schemaPlugin.manifest,
         scope: options.scope,
-        projectLayer,
         cwd: options.cwd,
         env: options.env,
+        updates,
+        removeKeys: requestedRemoveKeys,
     });
     const warnings = [];
-    if (options.scope === 'project' && projectLayer === 'shared') {
-        await assertProjectSharedConfigPathVisible({ cwd: options.cwd, targetPath: store.path });
-    }
-    if (options.scope === 'project' && projectLayer === 'local') {
-        const ignore = await ensureProjectPrivateStateIgnore({ cwd: options.cwd, targetPath: store.path });
-        if (ignore.warning)
-            warnings.push(ignore.warning);
-    }
-    const removedKeys = requestedRemoveKeys.filter((key) => Object.hasOwn(store.values, key));
-    const updatedKeys = Object.keys(updates);
-    const changedKeys = [...updatedKeys, ...removedKeys];
-    if (options.scope === 'project' && projectLayer === 'shared' && changedKeys.length > 0) {
-        const nextValues = { ...store.values, ...updates };
-        for (const key of requestedRemoveKeys)
-            delete nextValues[key];
-        const boundaryIssues = collectProjectArtifactConfigBoundaryIssues({
-            schema,
-            sharedEntries: nextValues,
-        });
-        if (boundaryIssues.length > 0) {
-            throw new Error([...new Set(boundaryIssues.map((issue) => issue.message))].join(' '));
+    const { updatedKeys, removedKeys, staleRemovedKeys } = impact;
+    let preApplyUnavailableReason;
+    let preApplyUnavailableTargetResults = [];
+    let applyDiscovery = discovered
+        ? { ...discovered, targets: impact.affectedTargets, failures: discovered.failures,
+            commandPackages: impact.affectedCommandPackages }
+        : undefined;
+    const shouldApply = options.apply !== false && impact.storeChanged && !impact.noEffectiveChange;
+    if (shouldApply && pluginMayRunPreApply(schemaPlugin)) {
+        if (applyDiscovery) {
+            const preApplyAuthorization = await resolveConfigPreApplyAuthorization({
+                plugin: schemaPlugin,
+                scope: options.scope,
+                cwd: options.cwd,
+                env: options.env,
+                applyTargets: applyDiscovery.targets,
+                nativeCliRunner: options.nativeCliRunner,
+                rebuildRuntime: options.rebuildRuntime,
+                reinstallCommandImpl: options.reinstallCommandImpl,
+            });
+            if (preApplyAuthorization.targets.length > 0 && !preApplyAuthorizationIsConfirmed({
+                required: preApplyAuthorization.targets,
+                confirmed: options.preApplyConfirmed,
+                authorizedTargets: options.preApplyAuthorizedTargets,
+            })) {
+                throwPreApplyAuthorizationRequired(preApplyAuthorization.targets);
+            }
+            preApplyUnavailableTargetResults = preApplyAuthorization.unavailableTargetResults;
+            applyDiscovery = {
+                ...applyDiscovery,
+                targets: preApplyAuthorization.availableApplyTargets,
+                failures: [...applyDiscovery.failures, ...preApplyUnavailableTargetResults],
+            };
+            if (applyDiscovery.targets.length === 0 && preApplyUnavailableTargetResults.length > 0
+                && (applyDiscovery.commandPackages?.length ?? 0) === 0) {
+                preApplyUnavailableReason = 'sourceUnavailable';
+            }
         }
     }
-    if (changedKeys.length > 0) {
-        await patchPluginConfigStore({
+    if (options.apply !== false
+        && options.scope === 'user'
+        && options.sharedNativeApplyConfirmed !== true
+        && impact.sharedNativeRenderTargets.some((shared) => impact.affectedTargets
+            .some((target) => target.platform === (shared.platform ?? 'codex')))) {
+        throwSharedNativeApplyConfirmationRequired();
+    }
+    if (impact.storeChanged) {
+        try {
+            const write = await patchPluginConfigStore({
+                ...configIdentity,
+                pluginName,
+                scope: options.scope,
+                cwd: options.cwd,
+                env: options.env,
+                updates: Object.fromEntries(updatedKeys.map((key) => [key, updates[key]])),
+                removeKeys: requestedRemoveKeys,
+                schema,
+            });
+            warnings.push(...write.warnings);
+        }
+        catch (error) {
+            throw markConfigWriteFailed(error);
+        }
+    }
+    let effective;
+    try {
+        effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({
             ...configIdentity,
             pluginName,
-            scope: options.scope,
-            projectLayer,
+            manifest: schemaPlugin.manifest,
+            targetScope: options.scope,
             cwd: options.cwd,
             env: options.env,
-            updates,
-            removeKeys: requestedRemoveKeys,
-        });
+        }));
     }
-    const effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({
-        ...configIdentity,
-        pluginName,
-        manifest: schemaPlugin.manifest,
-        cwd: options.cwd,
-        env: options.env,
-    }));
-    const applied = changedKeys.length === 0
-        ? {
-            overallState: 'succeeded',
-            targetResults: [],
-            applySkippedReason: 'noConfigChange',
-        }
-        : await reinstallVisibleTargets({
-            plugin: schemaPlugin,
+    catch {
+        const apply = unavailableApply('effectiveConfigUnavailable', 'effectiveConfig', [], impact.affectedCommandPackages);
+        const otherProjectsMayRequireSync = options.scope === 'user' && impact.storeChanged;
+        if (otherProjectsMayRequireSync)
+            warnings.push(...otherProjectsWarning(options.scope));
+        return {
+            plugin: pluginName,
             scope: options.scope,
-            cwd: options.cwd,
-            env: options.env ?? process.env,
-            applyTargets: options.applyTargets,
-            nativeCliRunner: options.nativeCliRunner,
-            reinstallCommandImpl: options.reinstallCommandImpl,
-            rebuildRuntime: options.rebuildRuntime,
-        });
-    const otherProjectsRequireReinstall = options.scope === 'user'
-        && changedKeys.length > 0;
-    if (otherProjectsRequireReinstall)
+            ...(schemaAccess.schema ? { schema: schemaAccess.schema } : {}),
+            updatedKeys,
+            removedKeys,
+            staleRemovedKeys,
+            configWrite: 'succeeded',
+            overallState: 'partial',
+            apply: publicConfigApplyResult(apply),
+            otherProjectsMayRequireSync,
+            warnings,
+        };
+    }
+    let apply;
+    try {
+        apply = !impact.storeChanged
+            ? skippedApply('noConfigChange')
+            : options.apply === false
+                ? skippedApply('notRequested')
+                : targetDiscoveryFailed
+                    ? unavailableApply('targetDiscoveryFailed', 'targetDiscovery')
+                    : impact.noEffectiveChange
+                        && ((discovered?.targets.length ?? 0) + impact.commandPackages.length > 0
+                            || staleRemovedKeys.length === impact.changedKeys.length)
+                        ? skippedApply('noEffectiveConfigChange')
+                        : preApplyUnavailableReason
+                            ? unavailableApply(preApplyUnavailableReason, preApplyUnavailableReason === 'sourceUnavailable' ? 'source' : 'targetDiscovery', preApplyUnavailableTargetResults)
+                            : await applyConfigToVisibleTargets({
+                                plugin: schemaPlugin,
+                                scope: options.scope,
+                                cwd: options.cwd,
+                                env: options.env ?? process.env,
+                                applyTargets: applyDiscovery?.targets ?? impact.affectedTargets,
+                                nativeCliRunner: options.nativeCliRunner,
+                                reinstallCommandImpl: options.reinstallCommandImpl,
+                                rebuildRuntime: options.rebuildRuntime,
+                                noVisibleTargetHasInvalidConfig: (discovered?.targets.length ?? 0) > 0
+                                    && effective.issues.length > 0,
+                                preApplyConfirmed: options.preApplyConfirmed,
+                                discovered: applyDiscovery,
+                                changedConfigKeys: impact.changedKeys,
+                            });
+    }
+    catch (error) {
+        const failure = error instanceof Error ? error : new Error(String(error));
+        throw Object.assign(failure, { configWrite: 'succeeded' });
+    }
+    const otherProjectsMayRequireSync = options.scope === 'user' && impact.storeChanged;
+    if (otherProjectsMayRequireSync)
         warnings.push(...otherProjectsWarning(options.scope));
     return {
         plugin: pluginName,
         scope: options.scope,
-        projectLayer,
         ...(schemaAccess.schema ? { schema: schemaAccess.schema } : {}),
         updatedKeys,
         removedKeys,
+        staleRemovedKeys,
         effective,
         configWrite: 'succeeded',
-        overallState: applied.overallState,
-        targetResults: applied.targetResults,
-        ...(applied.applySkippedReason ? { applySkippedReason: applied.applySkippedReason } : {}),
-        otherProjectsRequireReinstall,
+        overallState: overallStateForApply(apply),
+        apply: publicConfigApplyResult(apply),
+        otherProjectsMayRequireSync,
         warnings,
     };
 }
@@ -366,162 +971,372 @@ export async function applyPluginConfigWrite(options) {
     const requestedPluginName = options.pluginName ?? options.plugin?.manifest.name;
     if (!requestedPluginName)
         throw new Error('Plugin name is required for config write.');
-    const pluginName = assertSafePluginConfigSegment(requestedPluginName);
+    assertSafePluginConfigSegment(requestedPluginName);
+    if (options.scope === 'project') {
+        const targetPath = resolvePluginConfigStorePath({
+            sourceId: options.plugin?.sourceId,
+            pluginName: requestedPluginName,
+            scope: 'project',
+            cwd: options.cwd,
+            env: options.env,
+        });
+        await assertProjectSharedConfigPathVisible({
+            cwd: options.cwd,
+            targetPath,
+            env: options.env,
+        });
+    }
+    if (options.apply !== false && !options.awHomeMutationToken) {
+        await prepareNativeCliExecution({ env: options.env, runner: options.nativeCliRunner });
+    }
     return withAwHomeMutationLock({
         env: options.env,
         token: options.awHomeMutationToken,
-        action: (awHomeMutationToken) => withPluginConfigTransactionLease({
-            ...(options.plugin?.sourceId ? { sourceId: options.plugin.sourceId } : {}),
-            pluginName,
-            scope: options.scope,
-            projectLayer: options.scope === 'project' ? (options.projectLayer ?? 'shared') : 'shared',
-            cwd: options.cwd,
-            env: options.env,
-            action: async () => {
-                await options.reviewPreflight?.();
-                return applyPluginConfigWriteUnlocked({
+        action: async (awHomeMutationToken) => {
+            await options.reviewPreflight?.();
+            try {
+                return await applyPluginConfigWriteUnlocked({
                     ...options,
                     awHomeMutationToken,
                     rebuildRuntime: { ...options.rebuildRuntime, awHomeMutationToken },
                 });
-            },
-        }),
+            }
+            catch (error) {
+                let sensitiveValues = options.plugin
+                    ? collectSensitivePluginConfigValues(options.plugin.manifest, (options.request.updates ?? {}))
+                    : [];
+                if (options.plugin) {
+                    try {
+                        const effective = await resolveEffectivePluginConfig({
+                            ...(options.plugin.sourceId ? {
+                                sourceId: options.plugin.sourceId,
+                                sourceIdentity: options.plugin.sourceIdentity,
+                                logicalIdentity: options.plugin.catalogLogicalIdentity,
+                            } : {}),
+                            pluginName: options.plugin.manifest.name,
+                            manifest: options.plugin.manifest,
+                            targetScope: options.scope,
+                            cwd: options.cwd,
+                            env: options.env,
+                        });
+                        sensitiveValues = [
+                            ...sensitiveValues,
+                            ...collectSensitivePluginConfigValues(options.plugin.manifest, effective.values),
+                        ];
+                    }
+                    catch {
+                        // Requested sensitive values and generic credential redaction remain available.
+                    }
+                }
+                let message = redactPluginScriptOutput(error instanceof Error ? error.message : String(error), sensitiveValues);
+                message = message.split(options.cwd).join('<project>');
+                for (const scope of ['user', 'project']) {
+                    const configPath = resolvePluginConfigStorePath({
+                        sourceId: options.plugin?.sourceId,
+                        pluginName: requestedPluginName,
+                        scope,
+                        cwd: options.cwd,
+                        env: options.env,
+                    });
+                    message = message.split(configPath).join(`${scope}/plugin-config/${[
+                        options.plugin?.sourceId,
+                        requestedPluginName,
+                        'config.json',
+                    ].filter(Boolean).join('/')}`);
+                }
+                const safeError = new Error(message);
+                const code = error.code;
+                safeError.code = typeof code === 'string' ? code
+                    : message.startsWith('schemaVersionUnsupported:') ? 'schemaVersionUnsupported'
+                        : 'configApplyFailed';
+                const configWrite = error.configWrite;
+                if (configWrite === 'succeeded' || configWriteStateForError(error) === 'failed') {
+                    safeError.configWrite = configWrite === 'succeeded' ? 'succeeded' : 'failed';
+                }
+                if (error && typeof error === 'object' && 'operationDiagnostic' in error) {
+                    safeError.operationDiagnostic = error.operationDiagnostic;
+                }
+                throw safeError;
+            }
+        },
     });
 }
 async function resetPluginConfigWithHelperUnlocked(options) {
     const pluginName = assertSafePluginConfigSegment(options.pluginName);
-    const projectLayer = options.scope === 'project' ? (options.projectLayer ?? 'shared') : 'shared';
-    if (!options.plugin) {
-        throw new Error(`sourceMissing: Plugin "${pluginName}" is unavailable; config reset was not applied.`);
-    }
-    const schemaAccess = await resolvePluginConfigSchemaAccess({
-        pluginName,
-        currentPlugin: options.plugin,
-        scope: options.scope,
-        projectLayer,
-        cwd: options.cwd,
-        env: options.env,
-    });
-    if (!schemaAccess.plugin?.manifest.config?.schema) {
-        throw new Error(`configSchemaUnavailable: Plugin "${pluginName}" does not declare an AW config schema.`);
-    }
-    const configIdentity = options.plugin.sourceId ? {
+    let configIdentity = options.plugin?.sourceId ? {
         sourceId: options.plugin.sourceId,
         sourceIdentity: options.plugin.sourceIdentity,
+        logicalIdentity: options.plugin.catalogLogicalIdentity,
+    } : options.sourceId ? {
+        sourceId: options.sourceId,
+        sourceIdentity: options.sourceIdentity,
+        logicalIdentity: options.logicalIdentity,
     } : {};
-    const store = await readPluginConfigStore({
-        ...configIdentity,
-        pluginName,
-        scope: options.scope,
-        projectLayer,
-        cwd: options.cwd,
-        env: options.env,
-    });
-    const removedKeys = collectRemovedConfigKeys(store.values);
-    const warnings = [];
-    if (options.scope === 'project' && projectLayer === 'shared' && store.exists) {
-        await assertProjectSharedConfigPathVisible({ cwd: options.cwd, targetPath: store.path });
-    }
-    if (options.scope === 'project' && projectLayer === 'local') {
-        const ignore = await ensureProjectPrivateStateIgnore({ cwd: options.cwd, targetPath: store.path });
-        if (ignore.warning)
-            warnings.push(ignore.warning);
-    }
-    const reset = await resetPluginConfigStore({
-        ...configIdentity,
-        pluginName,
-        scope: options.scope,
-        projectLayer,
-        cwd: options.cwd,
-        env: options.env,
-    });
-    let applied = {
-        overallState: 'succeeded',
-        targetResults: [],
-        applySkippedReason: 'noConfigChange',
-    };
-    let effective;
-    if (schemaAccess.plugin) {
-        if (schemaAccess.plugin.manifest.config?.schema) {
-            effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({
-                ...configIdentity,
+    if (options.sourceId && !options.sourceIdentity) {
+        try {
+            const identity = await readNamespacedPluginConfigStoreIdentity({
+                sourceId: options.sourceId,
                 pluginName,
-                manifest: schemaAccess.plugin.manifest,
+                scope: options.scope,
                 cwd: options.cwd,
                 env: options.env,
-            }));
+            });
+            if (identity?.binding.kind === 'source')
+                configIdentity = {
+                    sourceId: options.sourceId,
+                    sourceIdentity: identity.binding.sourceIdentity,
+                };
+            if (identity?.binding.kind === 'catalog')
+                configIdentity = {
+                    sourceId: options.sourceId,
+                    logicalIdentity: identity.binding.logicalIdentity,
+                };
+        }
+        catch {
+            // Reset does not require a readable or valid envelope.
+        }
+    }
+    let removedKeys = [];
+    try {
+        const store = await readPluginConfigStore({
+            ...configIdentity,
+            pluginName,
+            scope: options.scope,
+            cwd: options.cwd,
+            env: options.env,
+        });
+        removedKeys = collectRemovedConfigKeys(store.values);
+    }
+    catch {
+        // Reset is the final recovery boundary and does not require a readable store.
+    }
+    const warnings = [];
+    let impact;
+    let targetDiscoveryFailed = false;
+    let visibleTargets = [];
+    let discovered;
+    if (options.plugin) {
+        if (options.apply !== false) {
+            try {
+                discovered = await resolveConfigApplyTargets({
+                    plugin: options.plugin,
+                    scope: options.scope,
+                    cwd: options.cwd,
+                    env: options.env ?? process.env,
+                    applyTargets: options.applyTargets,
+                    nativeCliRunner: options.nativeCliRunner,
+                    rebuildRuntime: options.rebuildRuntime,
+                });
+                visibleTargets = discovered.targets;
+            }
+            catch {
+                targetDiscoveryFailed = true;
+            }
         }
-        if (reset.deleted) {
-            applied = await reinstallVisibleTargets({
-                plugin: schemaAccess.plugin,
+        try {
+            impact = await analyzePluginConfigMutationImpact({
+                plugin: options.plugin,
                 scope: options.scope,
                 cwd: options.cwd,
-                env: options.env ?? process.env,
-                applyTargets: options.applyTargets,
-                nativeCliRunner: options.nativeCliRunner,
-                reinstallCommandImpl: options.reinstallCommandImpl,
-                rebuildRuntime: options.rebuildRuntime,
+                env: options.env,
+                visibleTargets,
+                ...(discovered ? { commandDiscovery: {
+                        packages: discovered.commandPackages ?? [], errors: discovered.commandDiscoveryErrors ?? [],
+                    } } : {}),
+                mutation: { kind: 'reset' },
             });
+            removedKeys = impact.removedKeys;
+        }
+        catch {
+            // Reset remains available when its before state cannot be read.
+        }
+    }
+    let preApplyUnavailableReason;
+    let preApplyUnavailableTargetResults = [];
+    let applyDiscovery = options.plugin && !targetDiscoveryFailed
+        ? { targets: impact?.affectedTargets ?? visibleTargets, failures: [],
+            commandPackages: impact?.affectedCommandPackages ?? discovered?.commandPackages,
+            commandDiscoveryErrors: impact?.commandDiscoveryErrors ?? discovered?.commandDiscoveryErrors }
+        : undefined;
+    if (options.plugin
+        && options.apply !== false
+        && impact?.storeChanged
+        && !impact.noEffectiveChange
+        && applyDiscovery
+        && pluginMayRunPreApply(options.plugin)) {
+        const preApplyAuthorization = await resolveConfigPreApplyAuthorization({
+            plugin: options.plugin,
+            scope: options.scope,
+            cwd: options.cwd,
+            env: options.env,
+            applyTargets: applyDiscovery.targets,
+            nativeCliRunner: options.nativeCliRunner,
+            rebuildRuntime: options.rebuildRuntime,
+            reinstallCommandImpl: options.reinstallCommandImpl,
+        });
+        if (preApplyAuthorization.targets.length > 0 && !preApplyAuthorizationIsConfirmed({
+            required: preApplyAuthorization.targets,
+            confirmed: options.preApplyConfirmed,
+            authorizedTargets: options.preApplyAuthorizedTargets,
+        })) {
+            throwPreApplyAuthorizationRequired(preApplyAuthorization.targets);
+        }
+        preApplyUnavailableTargetResults = preApplyAuthorization.unavailableTargetResults;
+        applyDiscovery = {
+            ...applyDiscovery,
+            targets: preApplyAuthorization.availableApplyTargets,
+            failures: preApplyUnavailableTargetResults,
+        };
+        if (applyDiscovery.targets.length === 0 && preApplyUnavailableTargetResults.length > 0
+            && (applyDiscovery.commandPackages?.length ?? 0) === 0) {
+            preApplyUnavailableReason = 'sourceUnavailable';
         }
     }
-    const otherProjectsRequireReinstall = Boolean(schemaAccess.plugin)
+    if (options.plugin
+        && options.apply !== false
         && options.scope === 'user'
-        && reset.deleted;
-    if (otherProjectsRequireReinstall)
+        && options.sharedNativeApplyConfirmed !== true
+        && (impact
+            ? impact.sharedNativeRenderTargets.some((shared) => impact.affectedTargets
+                .some((target) => target.platform === (shared.platform ?? 'codex')))
+            : pluginSharedNativeConfigTargets(options.plugin).some((shared) => visibleTargets
+                .some((target) => target.platform === (shared.platform ?? 'codex'))))) {
+        throwSharedNativeApplyConfirmationRequired();
+    }
+    let reset;
+    try {
+        reset = await resetPluginConfigStore({
+            ...configIdentity,
+            pluginName,
+            scope: options.scope,
+            cwd: options.cwd,
+            env: options.env,
+        });
+    }
+    catch (error) {
+        throw markConfigWriteFailed(error);
+    }
+    let schemaAccess;
+    let apply = reset.deleted ? skippedApply('notRequested') : skippedApply('noConfigChange');
+    let effective;
+    if (options.plugin) {
+        try {
+            schemaAccess = await resolvePluginConfigSchemaAccess({
+                pluginName,
+                currentPlugin: options.plugin,
+                scope: options.scope,
+                cwd: options.cwd,
+                env: options.env,
+            });
+        }
+        catch {
+            if (reset.deleted && options.apply !== false) {
+                apply = unavailableApply('sourceUnavailable', 'source');
+            }
+        }
+        const schemaPlugin = schemaAccess?.plugin;
+        if (schemaPlugin?.manifest.config?.fields) {
+            try {
+                effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({
+                    ...configIdentity,
+                    pluginName,
+                    manifest: schemaPlugin.manifest,
+                    targetScope: options.scope,
+                    cwd: options.cwd,
+                    env: options.env,
+                }));
+            }
+            catch {
+                if (reset.deleted && options.apply !== false) {
+                    apply = unavailableApply('effectiveConfigUnavailable', 'effectiveConfig', [], impact?.affectedCommandPackages);
+                }
+            }
+            if (reset.deleted
+                && options.apply !== false
+                && apply.state === 'skipped'
+                && impact?.noEffectiveChange
+                && visibleTargets.length + (impact?.commandPackages.length ?? 0) > 0) {
+                apply = skippedApply('noEffectiveConfigChange');
+            }
+            else if (reset.deleted
+                && options.apply !== false
+                && apply.state === 'skipped'
+                && targetDiscoveryFailed) {
+                apply = unavailableApply('targetDiscoveryFailed', 'targetDiscovery');
+            }
+            else if (reset.deleted && options.apply !== false && apply.state === 'skipped') {
+                apply = preApplyUnavailableReason
+                    ? unavailableApply(preApplyUnavailableReason, 'source', preApplyUnavailableTargetResults)
+                    : await applyConfigToVisibleTargets({
+                        plugin: schemaPlugin,
+                        scope: options.scope,
+                        cwd: options.cwd,
+                        env: options.env ?? process.env,
+                        applyTargets: applyDiscovery?.targets ?? impact?.affectedTargets ?? options.applyTargets,
+                        nativeCliRunner: options.nativeCliRunner,
+                        reinstallCommandImpl: options.reinstallCommandImpl,
+                        rebuildRuntime: options.rebuildRuntime,
+                        noVisibleTargetHasInvalidConfig: (effective?.issues.length ?? 0) > 0,
+                        preApplyConfirmed: options.preApplyConfirmed,
+                        discovered: applyDiscovery,
+                        changedConfigKeys: impact?.changedKeys ?? removedKeys,
+                    });
+            }
+        }
+        else if (reset.deleted && options.apply !== false && apply.state === 'skipped') {
+            apply = unavailableApply('schemaUnavailable', 'schema');
+        }
+    }
+    else if (reset.deleted && options.apply !== false) {
+        apply = options.pluginError
+            ? unavailableApply('sourceUnavailable', 'source')
+            : unavailableApply('schemaUnavailable', 'schema');
+    }
+    const otherProjectsMayRequireSync = options.scope === 'user' && reset.deleted;
+    if (otherProjectsMayRequireSync)
         warnings.push(...otherProjectsWarning(options.scope));
     return {
         plugin: pluginName,
         scope: options.scope,
-        projectLayer,
-        ...(schemaAccess.schema ? { schema: schemaAccess.schema } : {}),
+        ...(schemaAccess?.schema ? { schema: schemaAccess.schema } : {}),
         existed: reset.existed,
         deleted: reset.deleted,
+        resetDisposition: reset.resetDisposition,
+        ...(reset.quarantineBasename ? { quarantineBasename: reset.quarantineBasename } : {}),
         removedKeys,
         ...(effective ? { effective } : {}),
         configWrite: 'succeeded',
-        overallState: applied.overallState,
-        targetResults: applied.targetResults,
-        ...(applied.applySkippedReason ? { applySkippedReason: applied.applySkippedReason } : {}),
-        otherProjectsRequireReinstall,
+        overallState: overallStateForApply(apply),
+        apply: publicConfigApplyResult(apply),
+        otherProjectsMayRequireSync,
         warnings,
     };
 }
 export async function resetPluginConfigWithHelper(options) {
-    const pluginName = assertSafePluginConfigSegment(options.pluginName);
-    if (!options.plugin) {
-        throw new Error(`sourceMissing: Plugin "${pluginName}" is unavailable; config reset was not applied.`);
+    assertSafePluginConfigSegment(options.pluginName);
+    if (options.apply !== false && !options.awHomeMutationToken) {
+        await prepareNativeCliExecution({ env: options.env, runner: options.nativeCliRunner });
     }
-    const sourceId = options.plugin.sourceId;
     return withAwHomeMutationLock({
         env: options.env,
         token: options.awHomeMutationToken,
-        action: (awHomeMutationToken) => withPluginConfigTransactionLease({
-            ...(sourceId ? { sourceId } : {}),
-            pluginName,
-            scope: options.scope,
-            projectLayer: options.scope === 'project' ? (options.projectLayer ?? 'shared') : 'shared',
-            cwd: options.cwd,
-            env: options.env,
-            action: async () => {
-                await options.reviewPreflight?.();
-                return resetPluginConfigWithHelperUnlocked({
-                    ...options,
-                    awHomeMutationToken,
-                    rebuildRuntime: { ...options.rebuildRuntime, awHomeMutationToken },
-                });
-            },
-        }),
+        action: async (awHomeMutationToken) => {
+            await options.reviewPreflight?.();
+            return resetPluginConfigWithHelperUnlocked({
+                ...options,
+                awHomeMutationToken,
+                rebuildRuntime: { ...options.rebuildRuntime, awHomeMutationToken },
+            });
+        },
     });
 }
 export async function describeResetAffectedFields(options) {
-    const projectLayer = options.scope === 'project' ? (options.projectLayer ?? 'shared') : 'shared';
     try {
         const resolved = await resolveConfigRead({
             pluginName: options.pluginName,
             plugin: options.plugin,
             ...(options.pluginError ? { pluginError: options.pluginError } : {}),
             scope: options.scope,
-            projectLayer,
             cwd: options.cwd,
             env: options.env,
         });
@@ -532,7 +1347,6 @@ export async function describeResetAffectedFields(options) {
             reserved: field.reserved,
             action: 'reset',
             scope: options.scope,
-            projectLayer,
             valueState: field.valueState,
         }));
     }
@@ -541,13 +1355,14 @@ export async function describeResetAffectedFields(options) {
             ...(options.plugin?.sourceId ? {
                 sourceId: options.plugin.sourceId,
                 sourceIdentity: options.plugin.sourceIdentity,
+                logicalIdentity: options.plugin.catalogLogicalIdentity,
             } : options.sourceId ? {
                 sourceId: options.sourceId,
                 sourceIdentity: options.sourceIdentity,
+                logicalIdentity: options.logicalIdentity,
             } : {}),
             pluginName: options.pluginName,
             scope: options.scope,
-            projectLayer,
             cwd: options.cwd,
             env: options.env,
         });
@@ -558,7 +1373,6 @@ export async function describeResetAffectedFields(options) {
             reserved: false,
             action: 'reset',
             scope: options.scope,
-            projectLayer,
         }));
     }
 }