@lesliechan721/aw 0.1.0-beta.6 → 0.1.0-beta.60

package/dist/authoring/scripts/validate-plugin.mjs

@@ -6,7 +6,7 @@ import { createRequire } from 'node:module';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
-import { getPluginAuthoringAcceptedValues as getCorePluginAuthoringAcceptedValues, getSkillFrontmatterCapabilityRegistry, } from '@lesliechan721/aw-plugin-core/manifest';
+import { AW_RUNTIME_CONFIG_READER_PATH, createNativeToolReaderSource, createRuntimeConfigSnapshot, getPluginAuthoringAcceptedValues as getCorePluginAuthoringAcceptedValues, getSkillFrontmatterCapabilityRegistry, getManagedCommandArtifactTargets, normalizePluginConfigDefinition, parseManagedCommandPlaceholders, replaceManagedCommandPlaceholders, validateCommandEntryFiles, } from '@lesliechan721/aw-plugin-core/manifest';
 import { checkPluginVersions } from './lib/plugin-version-check.mjs';
 import { scanJavaScriptImportSpecifiers } from './lib/javascript-import-scanner.mjs';
 import { assertAuthoringPluginPathFence, assertCanonicalAuthoringPluginRoot, } from './lib/plugin-root.mjs';
@@ -18,7 +18,8 @@ const CLI_PACKAGE_ROOT = path.basename(authoringRuntimeRoot) === 'dist'
     : authoringRuntimeRoot;
 const errors = [];
 const warnings = [];
-const SOURCE_PLUGIN_MANIFEST_CONTRACT_VERSION = 7;
+const SOURCE_PLUGIN_MANIFEST_CONTRACT_VERSION = 18;
+let capabilityDiagnostic = null;
 const MAX_SKILL_NAME_LEN = 64;
 const MAX_SKILL_DESCRIPTION_LEN = 1024;
 const MAX_SKILL_COMPATIBILITY_LEN = 500;
@@ -124,13 +125,8 @@ const TEMPLATE_TEXT_FILE_EXTENSIONS = /\.(md|markdown|txt|json|yaml|yml|toml|rul
 const SLASH_COMMAND_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 const DEFAULT_SLASH_COMMANDS_DIR = 'slash-commands';
 const SCRIPT_NODE_EXTENSIONS = new Set(['.js', '.mjs', '.cjs']);
-const SCRIPT_AUTO_EXTENSIONS = new Set(['.js', '.mjs', '.cjs', '.sh', '.ps1', '.cmd', '.bat']);
-const SCRIPT_RUNNERS = new Set(['node', 'sh', 'bash', 'pwsh', 'powershell', 'cmd', 'auto']);
-const SCRIPT_OS_SELECTORS = new Set(['default', 'unix', 'windows', 'linux', 'darwin', 'win32']);
-const SCRIPT_LIFECYCLE_EVENTS = new Set(['install', 'upgrade', 'uninstall']);
 const SCRIPT_TIMEOUT_MIN_MS = 1000;
-const SCRIPT_TIMEOUT_MAX_MS = 300000;
-const CONFIG_FIELD_TYPES = new Set(getPluginAuthoringAcceptedValues('config', 'config.schema.<key>.type'));
+const SCRIPT_TIMEOUT_MAX_MS = 1800000;
 const ARTIFACT_TARGETS = new Set(getPluginAuthoringAcceptedValues('artifacts', 'artifacts.targets[].target'));
 const ARTIFACT_STATES = new Set(getPluginAuthoringAcceptedValues('artifacts', 'artifacts.targets[].states'));
 const ARTIFACT_SCOPES = new Set(['user', 'project']);
@@ -149,22 +145,9 @@ const ARTIFACT_PROJECT_MANAGED_KIND_BY_TARGET = {
     'codex.skill': 'skill',
 };
 const PLUGIN_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-const PLUGIN_EVAL_SCHEMA_VERSION = 2;
-const PLUGIN_EVAL_CASE_SCHEMA_VERSION = 1;
-const PLUGIN_EVAL_SCOPES = new Set(['user', 'project']);
-const PLUGIN_EVAL_SPLITS = new Set(['train', 'validation', 'sanity', 'all']);
-const PLUGIN_EVAL_TRIGGER_CASE_SPLITS = new Set(['train', 'validation', 'sanity']);
-const PLUGIN_EVAL_COMMAND_SUPPORTS = new Set([
-    'split',
-    'runs',
-    'case',
-    'model',
-    'codexBin',
-    'timeout',
-    'allowEnvironmentSkips',
-]);
 let yamlParser = null;
 let pluginVersionCheckResult = null;
+let skillEvalManifestTools = null;
 function error(msg) {
     errors.push(msg);
 }
@@ -331,15 +314,26 @@ function loadSkillFrontmatterCapabilityRegistry() {
 async function tryLoadCliManifestTools() {
     const manifestModulePath = path.join(CLI_PACKAGE_ROOT, 'dist', 'src', 'utils', 'manifest.js');
     const runtimeProjectionModulePath = path.join(CLI_PACKAGE_ROOT, 'dist', 'src', 'utils', 'catalog-runtime-projection.js');
-    if (!fs.existsSync(manifestModulePath) || !fs.existsSync(runtimeProjectionModulePath))
+    const capabilityModulePath = path.join(CLI_PACKAGE_ROOT, 'dist', 'src', 'commands', 'aw-capabilities.js');
+    const artifactPlanPath = path.join(CLI_PACKAGE_ROOT, 'dist', 'src', 'utils', 'artifact-plan.js');
+    const artifactRequestPath = path.join(CLI_PACKAGE_ROOT, 'dist', 'src', 'utils', 'artifact-request.js');
+    const commandMaterializationPath = path.join(CLI_PACKAGE_ROOT, 'dist', 'src', 'utils', 'managed-command-materialization.js');
+    if (!fs.existsSync(manifestModulePath)
+        || !fs.existsSync(runtimeProjectionModulePath)
+        || !fs.existsSync(capabilityModulePath))
         return null;
     try {
-        const [manifestModule, runtimeProjectionModule] = await Promise.all([
+        const [manifestModule, runtimeProjectionModule, capabilityModule, artifactPlanModule, artifactRequestModule, commandModule] = await Promise.all([
             import(pathToFileURL(manifestModulePath).href),
             import(pathToFileURL(runtimeProjectionModulePath).href),
+            import(pathToFileURL(capabilityModulePath).href),
+            import(pathToFileURL(artifactPlanPath).href),
+            import(pathToFileURL(artifactRequestPath).href),
+            import(pathToFileURL(commandMaterializationPath).href),
         ]);
         if (manifestModule.SOURCE_PLUGIN_MANIFEST_CONTRACT_VERSION
-            !== SOURCE_PLUGIN_MANIFEST_CONTRACT_VERSION) {
+            !== SOURCE_PLUGIN_MANIFEST_CONTRACT_VERSION
+            || typeof artifactRequestModule.requiresNonSensitiveArtifactInput !== 'function') {
             return null;
         }
         return {
@@ -347,7 +341,14 @@ async function tryLoadCliManifestTools() {
             validateSourcePluginManifest: manifestModule.validateSourcePluginManifest ?? null,
             readPluginManifest: manifestModule.readPluginManifest ?? null,
             discoverPlugins: manifestModule.discoverPlugins ?? null,
+            resolvePluginRequirements: manifestModule.resolvePluginRequirements ?? null,
+            implementedCapabilities: capabilityModule.IMPLEMENTED_AW_CAPABILITIES ?? null,
             createRuntimeResolver: runtimeProjectionModule.createCatalogRuntimeImportResolver ?? null,
+            validateArtifactPlan: artifactPlanModule.validateArtifactPlan,
+            requiresNonSensitiveArtifactInput: artifactRequestModule.requiresNonSensitiveArtifactInput,
+            prepareManagedCommandPackageFiles: commandModule.prepareManagedCommandPackageFiles,
+            managedCommandProducerIdentity: commandModule.managedCommandProducerIdentity,
+            createManagedCommandReferenceResolver: commandModule.createManagedCommandReferenceResolver,
         };
     }
     catch {
@@ -498,11 +499,12 @@ function validateManifestLightweight(manifest) {
         error('top-level "commands" has been removed; use "slashCommands" instead');
     }
     validateAllowedKeys(input, 'plugin manifest', [
+        'schemaVersion',
         'name',
         'version',
         'description',
         'dependencies',
-        'compatibility',
+        'requires',
         'skills',
         'slashCommands',
         'mcpServers',
@@ -515,6 +517,7 @@ function validateManifestLightweight(manifest) {
         'scripts',
         'config',
         'artifacts',
+        'managedCommands',
     ]);
     if (manifest.dependencies !== undefined) {
         if (!Array.isArray(manifest.dependencies)) {
@@ -613,7 +616,7 @@ function validatePortableNativeArtifactCapabilityLightweight(manifest) {
         && Array.isArray(target.states)
         && target.states.includes('present'));
     if (!hasOtherNativeDeclaration && !hasPresentNativeArtifact) {
-        const message = 'Invalid plugin manifest: portable-only plugins are not supported in V1. Declare at least one non-empty native capability.';
+        const message = 'Invalid plugin manifest: portable-only plugins are not supported. Declare at least one non-empty native capability.';
         if (!errors.includes(message))
             error(message);
     }
@@ -950,703 +953,19 @@ function validateNonEmptyString(value, fieldName, maxLength) {
     }
     return trimmed;
 }
-function isPathInsideOrEqual(root, candidate) {
-    const relative = path.relative(root, candidate);
-    return relative === '' || (relative !== '..' &&
-        !relative.startsWith(`..${path.sep}`) &&
-        !path.isAbsolute(relative));
-}
-function validateRealPathBoundary(boundary, candidate, fieldName, boundaryName) {
-    const canonicalBoundary = fs.realpathSync(boundary);
-    const canonicalCandidate = fs.realpathSync(candidate);
-    if (!isPathInsideOrEqual(canonicalBoundary, canonicalCandidate)) {
-        error(`${fieldName} must stay inside the ${boundaryName}`);
-        return false;
-    }
-    return true;
-}
-function validateEvalRelativeFile(evalDir, value, fieldName) {
-    const relativePath = validateNonEmptyString(value, fieldName);
-    if (!relativePath)
-        return null;
-    const normalized = stripDotSlash(relativePath).split('\\').join('/');
-    if (path.isAbsolute(normalized) || normalized.split('/').includes('..')) {
-        error(`${fieldName} must stay inside the Skill eval directory`);
-        return null;
-    }
-    const absolutePath = path.resolve(evalDir, normalized);
-    const relativeToRoot = path.relative(evalDir, absolutePath);
-    if (relativeToRoot.startsWith('..') || path.isAbsolute(relativeToRoot)) {
-        error(`${fieldName} must stay inside the Skill eval directory`);
-        return null;
-    }
-    if (!fs.existsSync(absolutePath) || !fs.statSync(absolutePath).isFile()) {
-        error(`${fieldName} does not exist: ${normalized}`);
-        return null;
-    }
-    if (!validateRealPathBoundary(evalDir, absolutePath, fieldName, 'Skill eval directory')) {
-        return null;
-    }
-    return absolutePath;
-}
-function validateEvalWorkspacePath(value, fieldName, options = {}) {
-    const raw = validateNonEmptyString(value, fieldName);
-    if (!raw)
-        return null;
-    const treePattern = options.allowTreePattern === true && raw.endsWith('/**');
-    const candidate = treePattern ? raw.slice(0, -3) : raw;
-    if (candidate === '' ||
-        candidate.includes('\0') ||
-        candidate.includes('\\') ||
-        candidate.includes('*') ||
-        candidate.includes('?') ||
-        candidate.includes('[') ||
-        candidate.includes(']') ||
-        path.isAbsolute(candidate) ||
-        path.posix.normalize(candidate) !== candidate ||
-        candidate.split('/').includes('..')) {
-        error(`${fieldName} must be a normalized POSIX path inside the eval workspace`);
-        return null;
-    }
-    const firstSegment = candidate.split('/')[0];
-    if (firstSegment === '.git' || firstSegment === '.agents' || firstSegment === '.codex') {
-        error(`${fieldName} must not target an eval control directory`);
-        return null;
-    }
-    return raw;
-}
-function evalWorkspacePathMatchesPattern(relativePath, pattern) {
-    if (pattern.endsWith('/**')) {
-        const prefix = pattern.slice(0, -3);
-        return relativePath === prefix || relativePath.startsWith(`${prefix}/`);
-    }
-    return relativePath === pattern;
-}
-function validateConversationCaseCorpus(evalDir, suite, fieldName) {
-    const casesPath = validateEvalRelativeFile(evalDir, suite.cases, `${fieldName}.cases`);
-    if (!casesPath)
-        return;
-    let document;
-    try {
-        document = JSON.parse(fs.readFileSync(casesPath, 'utf8'));
-    }
-    catch (e) {
-        error(`${fieldName}.cases is not valid JSON: ${e.message}`);
-        return;
-    }
-    const corpus = expectRecord(document, `${fieldName}.cases document`);
-    if (!corpus)
-        return;
-    const skillName = validateNonEmptyString(corpus.skill_name, `${fieldName}.cases.skill_name`);
-    if (skillName && skillName !== suite.skill) {
-        error(`${fieldName}.cases.skill_name must match ${JSON.stringify(suite.skill)}`);
-    }
-    if (!Array.isArray(corpus.evals) || corpus.evals.length === 0) {
-        error(`${fieldName}.cases.evals must be a non-empty array`);
-        return;
-    }
-    const ids = new Set();
-    corpus.evals.forEach((value, caseIndex) => {
-        const caseField = `${fieldName}.cases.evals[${caseIndex}]`;
-        const entry = expectRecord(value, caseField);
-        if (!entry)
-            return;
-        const id = validateNonEmptyString(entry.id, `${caseField}.id`);
-        if (id && ids.has(id)) {
-            error(`${fieldName}.cases has duplicate case id ${JSON.stringify(id)}`);
-        }
-        else if (id) {
-            ids.add(id);
-        }
-        validateNonEmptyString(entry.prompt, `${caseField}.prompt`);
-        const sandbox = entry.sandbox === undefined
-            ? 'read-only'
-            : validateNonEmptyString(entry.sandbox, `${caseField}.sandbox`);
-        if (sandbox && sandbox !== 'read-only' && sandbox !== 'workspace-write') {
-            error(`${caseField}.sandbox must be "read-only" or "workspace-write"`);
-        }
-        if (!Array.isArray(entry.scripted_replies)) {
-            error(`${caseField}.scripted_replies must be an array`);
-        }
-        else {
-            entry.scripted_replies.forEach((reply, replyIndex) => {
-                const replyField = `${caseField}.scripted_replies[${replyIndex}]`;
-                if (typeof reply === 'string')
-                    return;
-                const replyEntry = expectRecord(reply, replyField);
-                if (!replyEntry)
-                    return;
-                if (!Array.isArray(replyEntry.answers_by_index) || replyEntry.answers_by_index.some((answer) => typeof answer !== 'string')) {
-                    error(`${replyField}.answers_by_index must be an array of strings`);
-                }
-                if (replyEntry.expected_question_count !== undefined &&
-                    (!Number.isInteger(replyEntry.expected_question_count) ||
-                        replyEntry.expected_question_count < 0)) {
-                    error(`${replyField}.expected_question_count must be a non-negative integer`);
-                }
-                validateNonEmptyString(replyEntry.unexpected_question_answer, `${replyField}.unexpected_question_answer`);
-            });
-        }
-        validateNonEmptyString(entry.expected_output, `${caseField}.expected_output`);
-        if (entry.workspace_files !== undefined) {
-            const workspaceFiles = expectRecord(entry.workspace_files, `${caseField}.workspace_files`);
-            if (workspaceFiles) {
-                const workspaceFileEntries = Object.entries(workspaceFiles);
-                if (workspaceFileEntries.length === 0) {
-                    error(`${caseField}.workspace_files must contain at least one file`);
-                }
-                workspaceFileEntries.forEach(([relativePath, content]) => {
-                    validateEvalWorkspacePath(relativePath, `${caseField}.workspace_files.${relativePath}`, { allowTreePattern: false });
-                    validateNonEmptyString(content, `${caseField}.workspace_files.${relativePath}`);
-                });
-            }
-        }
-        const review = expectRecord(entry.review, `${caseField}.review`);
-        if (review) {
-            if (!Array.isArray(review.checks) || review.checks.length === 0 || review.checks.some((check) => typeof check !== 'string' || check.trim() === '')) {
-                error(`${caseField}.review.checks must be a non-empty array of strings`);
-            }
-            if (review.workspace_unchanged !== undefined &&
-                typeof review.workspace_unchanged !== 'boolean') {
-                error(`${caseField}.review.workspace_unchanged must be boolean`);
-            }
-            const allowedWorkspaceChanges = [];
-            if (review.allowed_workspace_changes !== undefined) {
-                if (!Array.isArray(review.allowed_workspace_changes) ||
-                    review.allowed_workspace_changes.length === 0) {
-                    error(`${caseField}.review.allowed_workspace_changes must be a non-empty array`);
-                }
-                else {
-                    review.allowed_workspace_changes.forEach((pathValue, pathIndex) => {
-                        const normalized = validateEvalWorkspacePath(pathValue, `${caseField}.review.allowed_workspace_changes[${pathIndex}]`, { allowTreePattern: true });
-                        if (normalized)
-                            allowedWorkspaceChanges.push(normalized);
-                    });
-                }
-            }
-            const artifactPaths = [];
-            if (review.artifacts !== undefined) {
-                if (!Array.isArray(review.artifacts) || review.artifacts.length === 0) {
-                    error(`${caseField}.review.artifacts must be a non-empty array`);
-                }
-                else {
-                    review.artifacts.forEach((artifactValue, artifactIndex) => {
-                        const artifactField = `${caseField}.review.artifacts[${artifactIndex}]`;
-                        const artifact = expectRecord(artifactValue, artifactField);
-                        if (!artifact)
-                            return;
-                        validateAllowedKeys(artifact, artifactField, ['path', 'exists', 'contains', 'not_contains', 'json']);
-                        const artifactPath = validateEvalWorkspacePath(artifact.path, `${artifactField}.path`);
-                        if (artifactPath)
-                            artifactPaths.push(artifactPath);
-                        if (artifact.exists !== undefined && typeof artifact.exists !== 'boolean') {
-                            error(`${artifactField}.exists must be boolean`);
-                        }
-                        for (const key of ['contains', 'not_contains']) {
-                            if (artifact[key] !== undefined &&
-                                (!Array.isArray(artifact[key]) || artifact[key].length === 0 || artifact[key].some((fragment) => typeof fragment !== 'string' || fragment.length === 0))) {
-                                error(`${artifactField}.${key} must be a non-empty array of strings`);
-                            }
-                        }
-                        if (artifact.json !== undefined && !isRecord(artifact.json)) {
-                            error(`${artifactField}.json must be an object`);
-                        }
-                    });
-                }
-            }
-            if (new Set(artifactPaths).size !== artifactPaths.length) {
-                error(`${caseField}.review.artifacts contains duplicate paths`);
-            }
-            if (sandbox === 'workspace-write') {
-                if (review.workspace_unchanged !== false) {
-                    error(`${caseField} workspace-write requires review.workspace_unchanged=false`);
-                }
-                if (allowedWorkspaceChanges.length === 0 || artifactPaths.length === 0) {
-                    error(`${caseField} workspace-write requires allowed changes and artifacts`);
-                }
-                const unmatchedArtifact = artifactPaths.find((artifactPath) => !allowedWorkspaceChanges.some((pattern) => evalWorkspacePathMatchesPattern(artifactPath, pattern)));
-                if (unmatchedArtifact) {
-                    error(`${caseField} artifact ${JSON.stringify(unmatchedArtifact)} is outside allowed changes`);
-                }
-            }
-        }
-    });
-}
-function validateTriggerCaseCorpus(evalDir, suite, fieldName) {
-    const casesPath = validateEvalRelativeFile(evalDir, suite.cases, `${fieldName}.cases`);
-    if (!casesPath)
-        return;
-    let document;
-    try {
-        document = JSON.parse(fs.readFileSync(casesPath, 'utf8'));
-    }
-    catch (e) {
-        error(`${fieldName}.cases is not valid JSON: ${e.message}`);
-        return;
-    }
-    const corpus = expectRecord(document, `${fieldName}.cases document`);
-    if (!corpus)
-        return;
-    if (corpus.schemaVersion !== PLUGIN_EVAL_CASE_SCHEMA_VERSION) {
-        error(`${fieldName}.cases.schemaVersion must be ${PLUGIN_EVAL_CASE_SCHEMA_VERSION}`);
-    }
-    if (corpus.skill !== suite.skill) {
-        error(`${fieldName}.cases.skill must match ${JSON.stringify(suite.skill)}`);
-    }
-    if (!Array.isArray(corpus.cases) || corpus.cases.length === 0) {
-        error(`${fieldName}.cases.cases must be a non-empty array`);
-        return;
-    }
-    const ids = new Set();
-    const seenSplits = new Set();
-    let hasWorkspaceFixture = false;
-    corpus.cases.forEach((value, caseIndex) => {
-        const caseField = `${fieldName}.cases.cases[${caseIndex}]`;
-        const entry = expectRecord(value, caseField);
-        if (!entry)
-            return;
-        const id = validateNonEmptyString(entry.id, `${caseField}.id`);
-        if (id && !/^[a-z0-9][a-z0-9_]*$/.test(id)) {
-            error(`${caseField}.id must use lowercase snake_case`);
-        }
-        else if (id && ids.has(id)) {
-            error(`${fieldName}.cases has duplicate case id ${JSON.stringify(id)}`);
-        }
-        else if (id) {
-            ids.add(id);
-        }
-        if (!PLUGIN_EVAL_TRIGGER_CASE_SPLITS.has(entry.split)) {
-            error(`${caseField}.split must be train, validation, or sanity`);
-        }
-        else {
-            seenSplits.add(entry.split);
-        }
-        validateNonEmptyString(entry.query, `${caseField}.query`);
-        const usesLegacyExpectation = entry.should_load_skill !== undefined;
-        const usesRouteExpectation = entry.expected_loaded_skills !== undefined;
-        if (usesLegacyExpectation === usesRouteExpectation) {
-            error(`${caseField} must declare exactly one of should_load_skill or expected_loaded_skills`);
-        }
-        else if (usesLegacyExpectation && typeof entry.should_load_skill !== 'boolean') {
-            error(`${caseField}.should_load_skill must be boolean`);
-        }
-        else if (usesRouteExpectation) {
-            if (!Array.isArray(entry.expected_loaded_skills)) {
-                error(`${caseField}.expected_loaded_skills must be an array`);
-            }
-            else {
-                const expectedSkills = entry.expected_loaded_skills;
-                expectedSkills.forEach((skillName, skillIndex) => {
-                    if (typeof skillName !== 'string' || skillName.trim() === '') {
-                        error(`${caseField}.expected_loaded_skills[${skillIndex}] must be a non-empty string`);
-                    }
-                    else if (!suite.skills.includes(skillName)) {
-                        error(`${caseField}.expected_loaded_skills[${skillIndex}] must name a participant Skill`);
-                    }
-                });
-                if (new Set(expectedSkills).size !== expectedSkills.length) {
-                    error(`${caseField}.expected_loaded_skills must not contain duplicates`);
-                }
-                if (suite.forbidMultipleSkillLoads === true && expectedSkills.length > 1) {
-                    error(`${caseField} expects multiple Skills but the suite forbids multiple Skill loads`);
-                }
-            }
-        }
-        if (suite.observeSpawnAgent === true) {
-            if (typeof entry.should_spawn_agent !== 'boolean') {
-                error(`${caseField}.should_spawn_agent is required when observeSpawnAgent=true`);
-            }
-        }
-        else if (entry.should_spawn_agent !== undefined) {
-            error(`${caseField}.should_spawn_agent requires observeSpawnAgent=true`);
-        }
-        if (entry.workspace_fixture !== undefined) {
-            hasWorkspaceFixture = true;
-            validateNonEmptyString(entry.workspace_fixture, `${caseField}.workspace_fixture`);
-        }
-        if (entry.use_project_rules !== undefined &&
-            typeof entry.use_project_rules !== 'boolean') {
-            error(`${caseField}.use_project_rules must be boolean`);
-        }
-        if (entry.tags !== undefined) {
-            if (!Array.isArray(entry.tags) || entry.tags.length === 0) {
-                error(`${caseField}.tags must be a non-empty array`);
-            }
-            else {
-                entry.tags.forEach((tag, tagIndex) => {
-                    validateNonEmptyString(tag, `${caseField}.tags[${tagIndex}]`);
-                });
-            }
-        }
-    });
-    if (hasWorkspaceFixture && suite.fixtureModule === undefined) {
-        error(`${fieldName}.fixtureModule is required when cases declare workspace_fixture`);
-    }
-    if (Array.isArray(suite.releaseSplits)) {
-        suite.releaseSplits.forEach((split) => {
-            if (split !== 'all' && !seenSplits.has(split)) {
-                error(`${fieldName}.cases has no cases for release split ${JSON.stringify(split)}`);
-            }
-        });
-    }
-}
-function resolveEvalProfilePlugin(pluginDir, ownerManifest, pluginName, fieldName) {
-    if (pluginName === ownerManifest.name) {
-        return { pluginDir, manifest: ownerManifest };
-    }
-    const companionDir = path.join(path.dirname(pluginDir), pluginName);
-    const manifestPath = path.join(companionDir, '.agents-plugin', 'plugin.json');
-    if (!fs.existsSync(manifestPath)) {
-        error(`${fieldName} must reference repo-local plugin "${pluginName}"`);
-        return null;
-    }
-    let manifest;
+async function loadSkillEvalManifestTools() {
+    if (skillEvalManifestTools)
+        return skillEvalManifestTools;
+    const modulePath = path.join(CLI_PACKAGE_ROOT, 'dist', 'src', 'eval', 'manifest-v1.js');
     try {
-        manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+        skillEvalManifestTools = await import(pathToFileURL(modulePath).href);
+        return skillEvalManifestTools;
     }
-    catch (e) {
-        error(`${fieldName} companion manifest is not valid JSON: ${e.message}`);
-        return null;
-    }
-    if (!isRecord(manifest) || manifest.name !== pluginName) {
-        error(`${fieldName} companion source must declare plugin name "${pluginName}"`);
+    catch {
         return null;
     }
-    return { pluginDir: companionDir, manifest };
-}
-function validateOnePluginEvalManifest(pluginDir, pluginManifest, evalDir, expectedSkill) {
-    const evalManifestPath = path.join(evalDir, 'manifest.json');
-    const manifestField = path.relative(pluginDir, evalManifestPath).split(path.sep).join('/');
-    let document;
-    try {
-        document = JSON.parse(fs.readFileSync(evalManifestPath, 'utf8'));
-    }
-    catch (e) {
-        error(`${manifestField} is not valid JSON: ${e.message}`);
-        return;
-    }
-    const manifest = expectRecord(document, manifestField);
-    if (!manifest)
-        return;
-    validateAllowedKeys(manifest, manifestField, ['schemaVersion', 'plugin', 'skill', 'profiles', 'suites']);
-    if (manifest.schemaVersion !== PLUGIN_EVAL_SCHEMA_VERSION) {
-        error(`${manifestField}.schemaVersion must be ${PLUGIN_EVAL_SCHEMA_VERSION}`);
-    }
-    if (manifest.plugin !== pluginManifest.name) {
-        error(`${manifestField}.plugin must match plugin name ${JSON.stringify(pluginManifest.name)}`);
-    }
-    const skill = validateNonEmptyString(manifest.skill, `${manifestField}.skill`);
-    if (skill && skill !== expectedSkill) {
-        error(`${manifestField}.skill must match owning Skill ${JSON.stringify(expectedSkill)}`);
-    }
-    if (skill && !collectDeclaredSkillNames(pluginDir, pluginManifest).all.has(skill)) {
-        error(`${manifestField}.skill must reference a declared static or dynamic skill`);
-    }
-    if (!Array.isArray(manifest.profiles) || manifest.profiles.length === 0) {
-        error(`${manifestField}.profiles must be a non-empty array`);
-        return;
-    }
-    const profilesById = new Map();
-    manifest.profiles.forEach((value, index) => {
-        const fieldName = `${manifestField}.profiles[${index}]`;
-        const profile = expectRecord(value, fieldName);
-        if (!profile)
-            return;
-        validateAllowedKeys(profile, fieldName, ['id', 'scope', 'plugins', 'runModel', 'requiredForRelease']);
-        const id = validateNonEmptyString(profile.id, `${fieldName}.id`);
-        if (id && !PLUGIN_NAME_PATTERN.test(id)) {
-            error(`${fieldName}.id must use lowercase kebab-case`);
-        }
-        else if (id && profilesById.has(id)) {
-            error(`${manifestField} has duplicate profile id ${JSON.stringify(id)}`);
-        }
-        if (!PLUGIN_EVAL_SCOPES.has(profile.scope)) {
-            error(`${fieldName}.scope must be user or project`);
-        }
-        const skillOwners = new Map();
-        const installedPlugins = new Set();
-        if (!Array.isArray(profile.plugins) || profile.plugins.length === 0) {
-            error(`${fieldName}.plugins must be a non-empty array`);
-        }
-        else {
-            profile.plugins.forEach((value, pluginIndex) => {
-                const pluginField = `${fieldName}.plugins[${pluginIndex}]`;
-                const installation = expectRecord(value, pluginField);
-                if (!installation)
-                    return;
-                validateAllowedKeys(installation, pluginField, ['name', 'config']);
-                const pluginName = validateNonEmptyString(installation.name, `${pluginField}.name`);
-                if (!pluginName)
-                    return;
-                if (!PLUGIN_NAME_PATTERN.test(pluginName)) {
-                    error(`${pluginField}.name must use lowercase kebab-case`);
-                }
-                if (installedPlugins.has(pluginName)) {
-                    error(`${fieldName}.plugins has duplicate plugin ${JSON.stringify(pluginName)}`);
-                    return;
-                }
-                installedPlugins.add(pluginName);
-                if (installation.config !== undefined && !isRecord(installation.config)) {
-                    error(`${pluginField}.config must be an object`);
-                }
-                const source = resolveEvalProfilePlugin(pluginDir, pluginManifest, pluginName, `${pluginField}.name`);
-                if (!source)
-                    return;
-                for (const skillName of collectDeclaredSkillNames(source.pluginDir, source.manifest).all) {
-                    const existing = skillOwners.get(skillName);
-                    if (existing && existing !== pluginName) {
-                        error(`${fieldName} installs duplicate Skill key ${JSON.stringify(skillName)} ` +
-                            `from plugins ${JSON.stringify(existing)} and ${JSON.stringify(pluginName)}`);
-                    }
-                    else {
-                        skillOwners.set(skillName, pluginName);
-                    }
-                }
-            });
-        }
-        if (!installedPlugins.has(pluginManifest.name)) {
-            error(`${fieldName}.plugins must include owner plugin ${JSON.stringify(pluginManifest.name)}`);
-        }
-        if (typeof profile.runModel !== 'boolean') {
-            error(`${fieldName}.runModel must be boolean`);
-        }
-        if (typeof profile.requiredForRelease !== 'boolean') {
-            error(`${fieldName}.requiredForRelease must be boolean`);
-        }
-        if (profile.scope === 'user' && profile.runModel === true) {
-            error(`${fieldName}: eval schema v2 does not allow real model execution for user scope`);
-        }
-        if (id && PLUGIN_NAME_PATTERN.test(id) && !profilesById.has(id)) {
-            profilesById.set(id, { ...profile, skillOwners });
-        }
-    });
-    if (!manifest.profiles.some((profile) => isRecord(profile) && profile.scope === 'project' && profile.runModel === true)) {
-        error(`${manifestField} must define at least one project profile with runModel=true`);
-    }
-    if (!Array.isArray(manifest.suites) || manifest.suites.length === 0) {
-        error(`${manifestField}.suites must be a non-empty array`);
-        return;
-    }
-    const suiteIds = new Set();
-    manifest.suites.forEach((value, index) => {
-        const fieldName = `${manifestField}.suites[${index}]`;
-        const suite = expectRecord(value, fieldName);
-        if (!suite)
-            return;
-        const id = validateNonEmptyString(suite.id, `${fieldName}.id`);
-        if (id && !PLUGIN_NAME_PATTERN.test(id)) {
-            error(`${fieldName}.id must use lowercase kebab-case`);
-        }
-        else if (id && suiteIds.has(id)) {
-            error(`${manifestField} has duplicate suite id ${JSON.stringify(id)}`);
-        }
-        else if (id) {
-            suiteIds.add(id);
-        }
-        if (suite.kind !== 'command' && suite.kind !== 'conversation' && suite.kind !== 'trigger') {
-            error(`${fieldName}.kind must be command, conversation, or trigger`);
-        }
-        const suiteSkills = new Set();
-        if (!Array.isArray(suite.skills) || suite.skills.length === 0) {
-            error(`${fieldName}.skills must be a non-empty array`);
-        }
-        else {
-            suite.skills.forEach((skillName, skillIndex) => {
-                const skillField = `${fieldName}.skills[${skillIndex}]`;
-                const normalized = validateNonEmptyString(skillName, skillField);
-                if (!normalized)
-                    return;
-                if (!PLUGIN_NAME_PATTERN.test(normalized)) {
-                    error(`${skillField} must use lowercase kebab-case`);
-                }
-                else if (suiteSkills.has(normalized)) {
-                    error(`${fieldName}.skills has duplicate Skill ${JSON.stringify(normalized)}`);
-                }
-                else {
-                    suiteSkills.add(normalized);
-                }
-            });
-        }
-        if (skill && !suiteSkills.has(skill)) {
-            error(`${fieldName}.skills must include owner Skill ${JSON.stringify(skill)}`);
-        }
-        if (!Array.isArray(suite.profiles) || suite.profiles.length === 0) {
-            error(`${fieldName}.profiles must be a non-empty array`);
-        }
-        else {
-            suite.profiles.forEach((profileId, profileIndex) => {
-                const profileField = `${fieldName}.profiles[${profileIndex}]`;
-                if (typeof profileId !== 'string' || profileId.trim() === '') {
-                    error(`${profileField} must be a non-empty string`);
-                    return;
-                }
-                const profile = profilesById.get(profileId);
-                if (!profile) {
-                    error(`${fieldName} references unknown profile ${JSON.stringify(profileId)}`);
-                }
-                else if (profile.runModel !== true) {
-                    error(`${fieldName} cannot execute materialize-only profile ${JSON.stringify(profileId)}`);
-                }
-                if (profile) {
-                    for (const skillName of suiteSkills) {
-                        if (!profile.skillOwners.has(skillName)) {
-                            error(`${fieldName} requires Skill ${JSON.stringify(skillName)}, but profile ` +
-                                `${JSON.stringify(profileId)} does not install a plugin that declares it`);
-                        }
-                    }
-                }
-            });
-        }
-        if (!Number.isInteger(suite.defaultRuns) || suite.defaultRuns <= 0) {
-            error(`${fieldName}.defaultRuns must be a positive integer`);
-        }
-        if (!Number.isInteger(suite.perRunTimeoutMs) || suite.perRunTimeoutMs <= 0) {
-            error(`${fieldName}.perRunTimeoutMs must be a positive integer`);
-        }
-        if (typeof suite.requiredForRelease !== 'boolean') {
-            error(`${fieldName}.requiredForRelease must be boolean`);
-        }
-        if (!Array.isArray(suite.releaseSplits)) {
-            error(`${fieldName}.releaseSplits must be an array`);
-        }
-        else {
-            suite.releaseSplits.forEach((split, splitIndex) => {
-                if (!PLUGIN_EVAL_SPLITS.has(split)) {
-                    error(`${fieldName}.releaseSplits[${splitIndex}] is unsupported`);
-                }
-            });
-        }
-        if (suite.kind === 'command') {
-            validateAllowedKeys(suite, fieldName, [
-                'id', 'kind', 'skills', 'entry', 'cases', 'profiles', 'defaultRuns', 'releaseSplits',
-                'requiredForRelease', 'perRunTimeoutMs', 'suiteTimeoutMs', 'supports',
-            ]);
-            validateEvalRelativeFile(evalDir, suite.entry, `${fieldName}.entry`);
-            if (!Number.isInteger(suite.suiteTimeoutMs) || suite.suiteTimeoutMs <= 0) {
-                error(`${fieldName}.suiteTimeoutMs must be a positive integer`);
-            }
-            else if (suite.suiteTimeoutMs < suite.perRunTimeoutMs) {
-                error(`${fieldName}.suiteTimeoutMs must be greater than or equal to perRunTimeoutMs`);
-            }
-            if (!Array.isArray(suite.supports)) {
-                error(`${fieldName}.supports must be an array`);
-            }
-            else {
-                suite.supports.forEach((support, supportIndex) => {
-                    if (!PLUGIN_EVAL_COMMAND_SUPPORTS.has(support)) {
-                        error(`${fieldName}.supports[${supportIndex}] is unsupported`);
-                    }
-                });
-                if (Array.isArray(suite.releaseSplits) &&
-                    suite.releaseSplits.length > 0 &&
-                    !suite.supports.includes('split')) {
-                    error(`${fieldName} declares releaseSplits but does not support split`);
-                }
-                const supportsCase = suite.supports.includes('case');
-                if (supportsCase && suite.cases === undefined) {
-                    error(`${fieldName}.cases is required when supports includes case`);
-                }
-                else if (!supportsCase && suite.cases !== undefined) {
-                    error(`${fieldName}.cases requires supports to include case`);
-                }
-                if (supportsCase && suite.cases !== undefined) {
-                    const casesPath = validateEvalRelativeFile(evalDir, suite.cases, `${fieldName}.cases`);
-                    if (casesPath) {
-                        try {
-                            const casesDocument = JSON.parse(fs.readFileSync(casesPath, 'utf8'));
-                            if (!isRecord(casesDocument) || casesDocument.skill_name !== skill) {
-                                error(`${fieldName}.cases.skill_name must match ${JSON.stringify(skill)}`);
-                            }
-                            else if (!Array.isArray(casesDocument.evals) || casesDocument.evals.length === 0) {
-                                error(`${fieldName}.cases.evals must be a non-empty array`);
-                            }
-                            else {
-                                const caseIds = new Set();
-                                casesDocument.evals.forEach((entry, caseIndex) => {
-                                    const caseField = `${fieldName}.cases.evals[${caseIndex}]`;
-                                    if (!isRecord(entry) || typeof entry.id !== 'string' || !/^[a-z0-9_]+$/.test(entry.id)) {
-                                        error(`${caseField}.id must use lowercase snake_case`);
-                                    }
-                                    else if (caseIds.has(entry.id)) {
-                                        error(`${fieldName}.cases has duplicate case id ${JSON.stringify(entry.id)}`);
-                                    }
-                                    else {
-                                        caseIds.add(entry.id);
-                                    }
-                                });
-                            }
-                        }
-                        catch (cause) {
-                            error(`${fieldName}.cases is not valid JSON: ${cause.message}`);
-                        }
-                    }
-                }
-            }
-        }
-        else if (suite.kind === 'conversation' || suite.kind === 'trigger') {
-            const normalizedSuite = { ...suite, skill };
-            const isolation = suite.isolation ?? 'standard';
-            if (isolation !== 'standard' && isolation !== 'strict') {
-                error(`${fieldName}.isolation must be standard or strict`);
-            }
-            if (suite.kind === 'conversation') {
-                validateAllowedKeys(suite, fieldName, [
-                    'id', 'kind', 'skills', 'cases', 'profiles', 'defaultRuns', 'releaseSplits',
-                    'requiredForRelease', 'perRunTimeoutMs', 'isolation',
-                ]);
-                if (Array.isArray(suite.releaseSplits) && suite.releaseSplits.length > 0) {
-                    error(`${fieldName} cannot declare releaseSplits because conversation cases do not support split filtering`);
-                }
-                validateConversationCaseCorpus(evalDir, normalizedSuite, fieldName);
-            }
-            else {
-                validateAllowedKeys(suite, fieldName, [
-                    'id', 'kind', 'skills', 'cases', 'fixtureModule', 'observeSpawnAgent', 'isolation',
-                    'strictNegativeSplits', 'minimumPassRate', 'forbidMultipleSkillLoads',
-                    'profiles', 'defaultRuns', 'releaseSplits',
-                    'requiredForRelease', 'perRunTimeoutMs',
-                ]);
-                if (typeof suite.observeSpawnAgent !== 'boolean') {
-                    error(`${fieldName}.observeSpawnAgent must be boolean`);
-                }
-                if (!Array.isArray(suite.strictNegativeSplits)) {
-                    error(`${fieldName}.strictNegativeSplits must be an array`);
-                }
-                else {
-                    suite.strictNegativeSplits.forEach((split, splitIndex) => {
-                        if (!PLUGIN_EVAL_TRIGGER_CASE_SPLITS.has(split)) {
-                            error(`${fieldName}.strictNegativeSplits[${splitIndex}] is unsupported`);
-                        }
-                    });
-                }
-                if (suite.minimumPassRate !== undefined &&
-                    (typeof suite.minimumPassRate !== 'number' ||
-                        !Number.isFinite(suite.minimumPassRate) ||
-                        suite.minimumPassRate <= 0 ||
-                        suite.minimumPassRate > 1)) {
-                    error(`${fieldName}.minimumPassRate must be greater than 0 and at most 1`);
-                }
-                if (suite.forbidMultipleSkillLoads !== undefined &&
-                    typeof suite.forbidMultipleSkillLoads !== 'boolean') {
-                    error(`${fieldName}.forbidMultipleSkillLoads must be boolean`);
-                }
-                if (suite.fixtureModule !== undefined) {
-                    const fixturePath = validateEvalRelativeFile(evalDir, suite.fixtureModule, `${fieldName}.fixtureModule`);
-                    if (fixturePath && path.extname(fixturePath) !== '.mjs') {
-                        error(`${fieldName}.fixtureModule must reference an .mjs file`);
-                    }
-                }
-                validateTriggerCaseCorpus(evalDir, normalizedSuite, fieldName);
-            }
-        }
-    });
-    if (skill
-        && collectDeclaredSkillNames(pluginDir, pluginManifest).dynamic.has(skill)
-        && !manifest.suites.some((suite) => isRecord(suite) && suite.requiredForRelease === true)) {
-        error(`${manifestField}.suites must include at least one release-required suite for dynamic Skill ${JSON.stringify(skill)}`);
-    }
 }
-function validatePluginEvalManifest(pluginDir, pluginManifest) {
+async function validatePluginEvalManifest(pluginDir, pluginManifest) {
     const legacyRoot = path.join(pluginDir, 'evals');
     if (fs.existsSync(legacyRoot)) {
         error('Plugin-root evals/ is legacy; put evals/ inside its owning static or dynamic Skill directory.');
@@ -1655,17 +974,33 @@ function validatePluginEvalManifest(pluginDir, pluginManifest) {
         .sort()
         .map((skill) => ({ skill, root: path.join(pluginDir, 'skills', skill) }));
     const seenSkills = new Set();
+    let manifestTools = null;
     for (const owner of skillRoots) {
         const evalDir = path.join(owner.root, 'evals');
         const manifestPath = path.join(evalDir, 'manifest.json');
         if (!fs.existsSync(manifestPath))
             continue;
+        const manifestField = path.relative(pluginDir, manifestPath).split(path.sep).join('/');
         if (seenSkills.has(owner.skill)) {
             error(`Skill ${JSON.stringify(owner.skill)} has more than one evals/manifest.json owner`);
             continue;
         }
         seenSkills.add(owner.skill);
-        validateOnePluginEvalManifest(pluginDir, pluginManifest, evalDir, owner.skill);
+        manifestTools ??= await loadSkillEvalManifestTools();
+        if (typeof manifestTools?.validateAwSkillEvalManifest !== 'function') {
+            error('Canonical AwSkillEvalManifest v1 validator is unavailable; run the current built aw CLI.');
+            continue;
+        }
+        const validation = await manifestTools.validateAwSkillEvalManifest({
+            plugin: {
+                rootDir: pluginDir,
+                manifestPath: path.join(pluginDir, '.agents-plugin', 'plugin.json'),
+                manifest: pluginManifest,
+            },
+            skill: owner.skill,
+        });
+        for (const message of validation.errors)
+            error(`${manifestField}: ${message}`);
     }
 }
 function countCharacters(value) {
@@ -2058,33 +1393,6 @@ function validateDeclaredNativeAssets(pluginDir, manifest) {
         }
     }
 }
-function validatePluginVersionContracts(manifest, options) {
-    if (manifest.compatibility === undefined) {
-        error('Invalid compatibility.aw.minVersion: expected a strict SemVer 2.0.0 string. Received undefined.');
-        return;
-    }
-    const compatibility = expectRecord(manifest.compatibility, 'compatibility');
-    if (!compatibility) {
-        return;
-    }
-    validateAllowedKeys(compatibility, 'compatibility', ['aw']);
-    if (compatibility.aw === undefined) {
-        error('Invalid compatibility.aw.minVersion: expected a strict SemVer 2.0.0 string. Received undefined.');
-        return;
-    }
-    const aw = expectRecord(compatibility.aw, 'compatibility.aw');
-    if (!aw) {
-        return;
-    }
-    validateAllowedKeys(aw, 'compatibility.aw', ['minVersion']);
-    const pluginMinVersion = validateStrictSemVerString(aw.minVersion, 'compatibility.aw.minVersion');
-    if (!pluginMinVersion || !options.catalogMinVersion) {
-        return;
-    }
-    if (compareStrictSemVer(pluginMinVersion, options.catalogMinVersion) > 0) {
-        error(`Invalid compatibility.aw.minVersion for plugin "${pluginNameForError(manifest)}": received ${JSON.stringify(pluginMinVersion)}, which is higher than target catalog minimum ${JSON.stringify(options.catalogMinVersion)}.`);
-    }
-}
 function collectDeclaredSkillNames(pluginDir, manifest) {
     const skillsRoot = typeof manifest.skills === 'string'
         ? path.join(pluginDir, manifest.skills)
@@ -2129,9 +1437,6 @@ function collectDeclaredSkillNames(pluginDir, manifest) {
 function isNodeRunnablePath(relativePath) {
     return SCRIPT_NODE_EXTENSIONS.has(path.posix.extname(normalizeRelativePath(relativePath)));
 }
-function isAutoRunnablePath(relativePath) {
-    return SCRIPT_AUTO_EXTENSIONS.has(path.posix.extname(normalizeRelativePath(relativePath)).toLowerCase());
-}
 function normalizePluginScriptPath(pluginDir, value, fieldName) {
     if (typeof value !== 'string' || value.trim() === '') {
         error(`${fieldName} must be a non-empty string`);
@@ -2180,17 +1485,11 @@ function validateScriptEntry(pluginDir, value, fieldName, options = {}) {
     }
     validateAllowedKeys(entry, fieldName, ['runner', 'path', 'args']);
     const runner = validateManifestString(entry.runner, `${fieldName}.runner`);
-    if (runner && !SCRIPT_RUNNERS.has(runner)) {
-        error(`${fieldName}.runner has unsupported runner "${runner}"`);
-    }
-    if (options.requireNodeRunner && runner !== 'node') {
+    if (runner !== 'node') {
         error(`${fieldName}.runner must be "node"`);
     }
     const relativePath = normalizePluginScriptPath(pluginDir, entry.path, `${fieldName}.path`);
     validateDeclaredScriptFile(pluginDir, relativePath, `${fieldName}.path`);
-    if (runner === 'auto' && relativePath && !isAutoRunnablePath(relativePath)) {
-        error(`${fieldName}.path uses runner "auto" but has no supported extension (${[...SCRIPT_AUTO_EXTENSIONS].join(', ')})`);
-    }
     if (options.requireNodePath && relativePath && !isNodeRunnablePath(relativePath)) {
         error(`${fieldName}.path must use a Node runnable extension (.js, .mjs, or .cjs)`);
     }
@@ -2208,51 +1507,6 @@ function validateScriptEntry(pluginDir, value, fieldName, options = {}) {
     }
     return runner && relativePath ? { runner, path: relativePath } : null;
 }
-function validateLifecycleDefinition(pluginDir, value, fieldName, runtimeEntries) {
-    if (typeof value === 'string') {
-        const relativePath = normalizePluginScriptPath(pluginDir, value, fieldName);
-        validateDeclaredScriptFile(pluginDir, relativePath, fieldName);
-        if (relativePath && !isAutoRunnablePath(relativePath)) {
-            error(`${fieldName} uses runner "auto" but has no supported extension (${[...SCRIPT_AUTO_EXTENSIONS].join(', ')})`);
-        }
-        if (relativePath && isNodeRunnablePath(relativePath)) {
-            runtimeEntries.push({ path: relativePath, fieldName });
-        }
-        return { default: relativePath ? { runner: 'auto', path: relativePath } : null };
-    }
-    const selector = expectRecord(value, fieldName);
-    if (!selector)
-        return {};
-    if ('runner' in selector || 'path' in selector || 'command' in selector) {
-        error(`${fieldName} must declare lifecycle scripts under OS selectors`);
-    }
-    for (const selectorName of Object.keys(selector)) {
-        if (!SCRIPT_OS_SELECTORS.has(selectorName)) {
-            error(`${fieldName} has unknown OS selector "${selectorName}"`);
-        }
-    }
-    const normalized = {};
-    for (const [selectorName, entryValue] of Object.entries(selector)) {
-        const entry = validateScriptEntry(pluginDir, entryValue, `${fieldName}.${selectorName}`);
-        if (entry) {
-            normalized[selectorName] = entry;
-            if (entry.runner === 'node' || (entry.runner === 'auto' && isNodeRunnablePath(entry.path))) {
-                runtimeEntries.push({ path: entry.path, fieldName: `${fieldName}.${selectorName}.path` });
-            }
-        }
-    }
-    const orders = {
-        linux: ['linux', 'unix', 'default'],
-        darwin: ['darwin', 'unix', 'default'],
-        win32: ['win32', 'windows', 'default'],
-    };
-    for (const [osName, order] of Object.entries(orders)) {
-        if (!order.some((selectorName) => normalized[selectorName])) {
-            error(`${fieldName} must include an entry that resolves on ${osName}`);
-        }
-    }
-    return normalized;
-}
 function isNonRegistryDependencySpecifier(specifier) {
     const trimmed = String(specifier).trim();
     return (/^(?:workspace|file|link|portal):/i.test(trimmed) ||
@@ -2390,6 +1644,12 @@ function scanNodeImportContract(pluginDir, entryPaths, options) {
                     continue;
                 }
                 if (!resolved.path) {
+                    const requested = path.posix.normalize(path.posix.join(path.posix.dirname(relativePath), specifier));
+                    if (options.nativeToolReader && requested === options.nativeToolReader)
+                        continue;
+                    if ((options.runtimeConfigSkillRoots ?? []).some((root) => (relativePath.startsWith(`${root}/`)
+                        && requested === path.posix.join(root, AW_RUNTIME_CONFIG_READER_PATH))))
+                        continue;
                     error(`${options.label}: unable to resolve relative import "${specifier}" from "${relativePath}"`);
                     continue;
                 }
@@ -2439,271 +1699,61 @@ function listFilesRecursive(rootDir) {
     walk(rootDir);
     return output;
 }
-function validateConfigValueLightweight(field, value, fieldName) {
-    if (!isRecord(field) || !CONFIG_FIELD_TYPES.has(field.type))
-        return;
-    if (field.type === 'string' || field.type === 'file' || field.type === 'directory') {
-        validateManifestString(value, fieldName);
-        return;
-    }
-    if (field.type === 'boolean') {
-        if (typeof value !== 'boolean') {
-            error(`${fieldName} must be a boolean`);
-        }
-        return;
-    }
-    if (field.type === 'number') {
-        if (typeof value !== 'number' || !Number.isFinite(value)) {
-            error(`${fieldName} must be a finite number`);
-            return;
-        }
-        if (typeof field.min === 'number' && value < field.min) {
-            error(`${fieldName} must be greater than or equal to ${field.min}`);
-        }
-        if (typeof field.max === 'number' && value > field.max) {
-            error(`${fieldName} must be less than or equal to ${field.max}`);
-        }
-        return;
-    }
-    if (field.type === 'enum') {
-        if (typeof value !== 'string' || !Array.isArray(field.values) || !field.values.includes(value)) {
-            error(`${fieldName} must be one of config schema values`);
-        }
-    }
-}
-function validateConfigPresentationLightweight(presentation, schema) {
-    if (presentation === undefined)
-        return;
-    const root = expectRecord(presentation, 'config.presentation');
-    if (!root)
-        return;
-    validateAllowedKeys(root, 'config.presentation', ['groups', 'fields', 'presets']);
-    const schemaKeys = new Set(Object.keys(schema));
-    if (root.groups !== undefined) {
-        if (!Array.isArray(root.groups)) {
-            error('config.presentation.groups must be an array');
-        }
-        else {
-            const groupIds = new Set();
-            const groupedFields = new Set();
-            root.groups.forEach((rawGroup, index) => {
-                const fieldName = `config.presentation.groups[${index}]`;
-                const group = expectRecord(rawGroup, fieldName);
-                if (!group)
-                    return;
-                validateAllowedKeys(group, fieldName, ['id', 'title', 'description', 'fields', 'advanced']);
-                const validId = validateManifestString(group.id, `${fieldName}.id`);
-                const id = validId ? group.id : null;
-                if (id && groupIds.has(id)) {
-                    error(`${fieldName}.id has duplicate group id "${id}"`);
-                }
-                else if (id) {
-                    groupIds.add(id);
-                }
-                validateManifestString(group.title, `${fieldName}.title`);
-                if (group.description !== undefined) {
-                    validateManifestString(group.description, `${fieldName}.description`);
-                }
-                if (group.advanced !== undefined && typeof group.advanced !== 'boolean') {
-                    error(`${fieldName}.advanced must be a boolean`);
-                }
-                if (!Array.isArray(group.fields)) {
-                    error(`${fieldName}.fields must be an array`);
-                    return;
-                }
-                group.fields.forEach((key, fieldIndex) => {
-                    const keyFieldName = `${fieldName}.fields[${fieldIndex}]`;
-                    const validKey = validateManifestString(key, keyFieldName);
-                    if (!validKey)
-                        return;
-                    if (!schemaKeys.has(key)) {
-                        error(`${keyFieldName} references unknown config key "${key}"`);
-                    }
-                    if (groupedFields.has(key)) {
-                        error(`${keyFieldName} assigns config key "${key}" to more than one group`);
-                    }
-                    else {
-                        groupedFields.add(key);
-                    }
-                });
-            });
-        }
-    }
-    if (root.fields !== undefined) {
-        const fields = expectRecord(root.fields, 'config.presentation.fields');
-        if (fields) {
-            for (const [key, rawField] of Object.entries(fields)) {
-                const fieldName = `config.presentation.fields.${key}`;
-                const schemaField = schema[key];
-                if (!schemaKeys.has(key)) {
-                    error(`config.presentation.fields references unknown config key "${key}"`);
-                }
-                const field = expectRecord(rawField, fieldName);
-                if (!field)
-                    continue;
-                validateAllowedKeys(field, fieldName, [
-                    'valueLabels',
-                    'recommendedValue',
-                    'placeholder',
-                    'unit',
-                    'advanced',
-                ]);
-                if (field.placeholder !== undefined) {
-                    validateManifestString(field.placeholder, `${fieldName}.placeholder`);
-                }
-                if (field.unit !== undefined) {
-                    validateManifestString(field.unit, `${fieldName}.unit`);
-                }
-                if (field.advanced !== undefined && typeof field.advanced !== 'boolean') {
-                    error(`${fieldName}.advanced must be a boolean`);
-                }
-                if (field.valueLabels !== undefined) {
-                    const labels = expectRecord(field.valueLabels, `${fieldName}.valueLabels`);
-                    if (isRecord(schemaField) && schemaField.type !== 'enum') {
-                        error(`${fieldName}.valueLabels is only supported for enum config`);
-                    }
-                    if (labels) {
-                        for (const [token, label] of Object.entries(labels)) {
-                            if (!isRecord(schemaField) || !Array.isArray(schemaField.values) || !schemaField.values.includes(token)) {
-                                error(`${fieldName}.valueLabels references unknown enum token "${token}"`);
-                            }
-                            validateManifestString(label, `${fieldName}.valueLabels.${token}`);
-                        }
-                    }
-                }
-                if (field.recommendedValue !== undefined) {
-                    validateConfigValueLightweight(schemaField, field.recommendedValue, `${fieldName}.recommendedValue`);
-                }
-            }
-        }
-    }
-    if (root.presets !== undefined) {
-        if (!Array.isArray(root.presets)) {
-            error('config.presentation.presets must be an array');
-        }
-        else {
-            const presetIds = new Set();
-            root.presets.forEach((rawPreset, index) => {
-                const fieldName = `config.presentation.presets[${index}]`;
-                const preset = expectRecord(rawPreset, fieldName);
-                if (!preset)
-                    return;
-                validateAllowedKeys(preset, fieldName, ['id', 'title', 'description', 'values']);
-                const validId = validateManifestString(preset.id, `${fieldName}.id`);
-                const id = validId ? preset.id : null;
-                if (id && presetIds.has(id)) {
-                    error(`${fieldName}.id has duplicate preset id "${id}"`);
-                }
-                else if (id) {
-                    presetIds.add(id);
-                }
-                validateManifestString(preset.title, `${fieldName}.title`);
-                if (preset.description !== undefined) {
-                    validateManifestString(preset.description, `${fieldName}.description`);
-                }
-                const values = expectRecord(preset.values, `${fieldName}.values`);
-                if (!values)
-                    return;
-                for (const [key, value] of Object.entries(values)) {
-                    if (!schemaKeys.has(key)) {
-                        error(`${fieldName}.values references unknown config key "${key}"`);
-                        continue;
-                    }
-                    const schemaField = schema[key];
-                    if (isRecord(schemaField)
-                        && (schemaField.sensitive === true
-                            || schemaField.type === 'file'
-                            || schemaField.type === 'directory')) {
-                        error(`${fieldName}.values.${key} cannot contain sensitive, file, or directory config values`);
-                        continue;
-                    }
-                    validateConfigValueLightweight(schemaField, value, `${fieldName}.values.${key}`);
-                }
-            });
-        }
-    }
-}
 function validateConfigSchemaLightweight(config) {
     if (config === undefined)
         return;
-    const configRoot = expectRecord(config, 'config');
-    if (!configRoot)
-        return;
-    validateAllowedKeys(configRoot, 'config', ['schema', 'presentation']);
-    const schema = expectRecord(configRoot.schema, 'config.schema');
-    if (!schema)
-        return;
-    for (const [key, rawField] of Object.entries(schema)) {
-        if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(key)) {
-            error(`config.schema has invalid key "${key}"`);
-        }
-        const fieldName = `config.schema.${key}`;
-        const field = expectRecord(rawField, fieldName);
-        if (!field)
-            continue;
-        validateAllowedKeys(field, fieldName, [
-            'type',
-            'title',
-            'description',
-            'default',
-            'required',
-            'sensitive',
-            'values',
-            'min',
-            'max',
-        ]);
-        if (typeof field.type !== 'string' || !CONFIG_FIELD_TYPES.has(field.type)) {
-            error(`${fieldName}.type must be string, number, boolean, enum, file, or directory`);
-        }
-        if (field.required !== undefined && typeof field.required !== 'boolean') {
-            error(`${fieldName}.required must be a boolean`);
-        }
-        if (field.sensitive !== undefined && typeof field.sensitive !== 'boolean') {
-            error(`${fieldName}.sensitive must be a boolean`);
-        }
-        if (field.values !== undefined) {
-            if (field.type !== 'enum' || !Array.isArray(field.values) || field.values.length === 0) {
-                error(`${fieldName}.values is only supported for enum config and must be non-empty`);
-            }
-        }
-        else if (field.type === 'enum') {
-            error(`${fieldName}.values is required for enum config`);
-        }
-        if (field.type !== 'number' && (field.min !== undefined || field.max !== undefined)) {
-            error(`${fieldName}.min/max are only supported for number config`);
-        }
-        if (field.min !== undefined && typeof field.min !== 'number') {
-            error(`${fieldName}.min must be a number`);
-        }
-        if (field.max !== undefined && typeof field.max !== 'number') {
-            error(`${fieldName}.max must be a number`);
-        }
-        if (typeof field.min === 'number' && typeof field.max === 'number' && field.min > field.max) {
-            error(`${fieldName}.min must be less than or equal to max`);
-        }
+    try {
+        normalizePluginConfigDefinition(config);
+    }
+    catch (validationError) {
+        error(validationError instanceof Error ? validationError.message : String(validationError));
     }
-    validateConfigPresentationLightweight(configRoot.presentation, schema);
 }
 function configSchemaKeys(manifest) {
-    const schema = manifest.config?.schema;
+    const schema = manifest.config?.fields;
     return isRecord(schema) ? new Set(Object.keys(schema)) : new Set();
 }
-function configSchemaField(manifest, key) {
-    const field = manifest.config?.schema?.[key];
-    return isRecord(field) ? field : null;
-}
 function defaultConfigValues(manifest) {
-    const schema = manifest.config?.schema;
+    const schema = manifest.config?.fields;
     const values = {};
     if (!isRecord(schema))
         return values;
     for (const [key, field] of Object.entries(schema)) {
-        if (isRecord(field) && Object.prototype.hasOwnProperty.call(field, 'default')) {
+        if (isRecord(field) && field.default !== undefined) {
             values[key] = field.default;
         }
     }
     return values;
 }
+function configFieldContainsSensitiveValue(field) {
+    if (!isRecord(field))
+        return false;
+    if (field.sensitive === true)
+        return true;
+    if (field.type !== 'object')
+        return false;
+    return ((isRecord(field.properties)
+        && Object.values(field.properties).some((child) => isRecord(child) && child.sensitive === true))
+        || (isRecord(field.additionalProperties)
+            && field.additionalProperties.sensitive === true));
+}
+function codexStaticNativeComponentKeys(manifest) {
+    if (!isCodexTargeted(manifest))
+        return [];
+    const keys = [];
+    if (manifest.skills)
+        keys.push('skills');
+    if (manifest.mcpServers)
+        keys.push('mcpServers');
+    if ((Array.isArray(manifest.extensions?.hooks)
+        && manifest.extensions.hooks.some((hook) => hook?.agentOverrides?.codex !== null))
+        || (Array.isArray(manifest.extensions?.nativeHooks?.codex)
+            && manifest.extensions.nativeHooks.codex.length > 0))
+        keys.push('hooks');
+    if (manifest.apps)
+        keys.push('apps');
+    return keys;
+}
 function validateArtifactId(value, fieldName) {
     const id = validateManifestString(value, fieldName);
     if (!id)
@@ -2764,7 +1814,7 @@ function validateStringArray(value, fieldName, options = {}) {
     }
     return output;
 }
-function validateArtifactTargetEntry(entry, index, manifest, seen, pluginDir) {
+function validateArtifactTargetEntry(entry, index, manifest, pluginDir) {
     const fieldName = `artifacts.targets[${index}]`;
     const target = expectRecord(entry, fieldName);
     if (!target)
@@ -2779,11 +1829,13 @@ function validateArtifactTargetEntry(entry, index, manifest, seen, pluginDir) {
         'projectManagedKind',
         'states',
         'refreshKeys',
+        'delivery',
         'requiresCodexProjectConfig',
         'roleKey',
         'skillKey',
         'sourceDirs',
         'runtimeImports',
+        'runtimeConfig',
     ]);
     const id = validateArtifactId(target.id, `${fieldName}.id`);
     const artifactTarget = validateManifestString(target.target, `${fieldName}.target`);
@@ -2791,6 +1843,30 @@ function validateArtifactTargetEntry(entry, index, manifest, seen, pluginDir) {
         error(`${fieldName}.target: unsupported artifact target "${artifactTarget}"`);
     }
     const portable = artifactTarget === 'agent-skills.skill';
+    let delivery;
+    if (artifactTarget === 'codex.skill') {
+        delivery = expectRecord(target.delivery, `${fieldName}.delivery`);
+        if (delivery) {
+            if (delivery.mode === 'aw-extension') {
+                validateAllowedKeys(delivery, `${fieldName}.delivery`, ['mode']);
+            }
+            else if (delivery.mode === 'codex-native') {
+                validateAllowedKeys(delivery, `${fieldName}.delivery`, ['mode', 'identity', 'renderProfile']);
+                if (delivery.identity !== 'shared') {
+                    error(`${fieldName}.delivery.identity: expected "shared"`);
+                }
+                if (delivery.renderProfile !== 'user') {
+                    error(`${fieldName}.delivery.renderProfile: expected "user"`);
+                }
+            }
+            else {
+                error(`${fieldName}.delivery.mode: expected "codex-native" or "aw-extension"`);
+            }
+        }
+    }
+    else if (target.delivery !== undefined) {
+        error(`${fieldName}.delivery: delivery is only supported for codex.skill targets`);
+    }
     const platform = portable || target.platform === undefined
         ? undefined
         : validateManifestString(target.platform, `${fieldName}.platform`);
@@ -2814,13 +1890,6 @@ function validateArtifactTargetEntry(entry, index, manifest, seen, pluginDir) {
             error(`${fieldName}.distribution: platform targets do not support distribution`);
         }
     }
-    const key = id && artifactTarget ? `${id}:${artifactTarget}` : null;
-    if (key) {
-        if (seen.has(key)) {
-            error(`${fieldName}: duplicate artifact id + target "${key}"`);
-        }
-        seen.add(key);
-    }
     const expectedKind = ARTIFACT_KIND_BY_TARGET[artifactTarget];
     const kind = target.kind === undefined
         ? expectedKind
@@ -2863,10 +1932,15 @@ function validateArtifactTargetEntry(entry, index, manifest, seen, pluginDir) {
             error(`${fieldName}.refreshKeys[${refreshIndex}]: unknown config key "${refreshKey}"`);
             continue;
         }
-        const field = configSchemaField(manifest, refreshKey);
-        if (scopes.includes('project') &&
-            (field?.type === 'file' || field?.type === 'directory')) {
-            error(`${fieldName}.refreshKeys[${refreshIndex}]: project-scope repo-visible artifacts cannot depend on "${field.type}" config key "${refreshKey}"; use a portable string key or keep the path in user/project local config for lifecycle/helper code.`);
+        const sensitiveRefreshKey = configFieldContainsSensitiveValue(manifest.config?.fields?.[refreshKey]);
+        const skillTarget = artifactTarget === 'codex.skill'
+            || artifactTarget === 'claude.skill'
+            || artifactTarget === 'agent-skills.skill';
+        if (skillTarget && sensitiveRefreshKey) {
+            const native = delivery?.mode === 'codex-native';
+            error(`${native ? 'codexNativeRenderSensitiveRefreshKey' : 'skillRenderSensitiveRefreshKey'}: ` +
+                `${fieldName}.refreshKeys[${refreshIndex}]: ` +
+                `${native ? 'codex-native renderers' : 'Skill renderers'} cannot read sensitive config field "${refreshKey}"`);
         }
     }
     if (target.requiresCodexProjectConfig !== undefined &&
@@ -2955,9 +2029,11 @@ function validateArtifactTargetEntry(entry, index, manifest, seen, pluginDir) {
         projectManagedKind,
         states,
         refreshKeys,
+        delivery,
         roleKey,
         skillKey,
         sourceDirs,
+        runtimeConfig: target.runtimeConfig,
         runtimeImports: Array.isArray(target.runtimeImports) ? target.runtimeImports : [],
     };
 }
@@ -2974,10 +2050,69 @@ function validateArtifactsConfigLightweight(pluginDir, manifest) {
         error('artifacts.targets must be an array');
         return [];
     }
-    const seen = new Set();
     const declarations = artifacts.targets
-        .map((entry, index) => validateArtifactTargetEntry(entry, index, manifest, seen, pluginDir))
+        .map((entry, index) => validateArtifactTargetEntry(entry, index, manifest, pluginDir))
         .filter(Boolean);
+    const idsBySurfaceScope = new Map();
+    const nativeIds = new Map();
+    const nativeSkillKeys = new Map();
+    for (const [declarationIndex, declaration] of declarations.entries()) {
+        for (const scope of declaration.scopes) {
+            const surface = declaration.platform ?? declaration.distribution;
+            const key = `${surface}:${scope}:${declaration.id}`;
+            const existing = idsBySurfaceScope.get(key);
+            if (existing !== undefined) {
+                error(`artifacts.targets has duplicate artifact id "${declaration.id}" for surface/scope "${surface}:${scope}" in targets[${existing}] and targets[${declarationIndex}]`);
+            }
+            else {
+                idsBySurfaceScope.set(key, declarationIndex);
+            }
+        }
+        if (declaration.delivery?.mode === 'codex-native') {
+            const existingId = nativeIds.get(declaration.id);
+            if (existingId !== undefined) {
+                error(`artifacts.targets has duplicate codex-native artifact id "${declaration.id}" in the shared projection at targets[${existingId}] and targets[${declarationIndex}]`);
+            }
+            else {
+                nativeIds.set(declaration.id, declarationIndex);
+            }
+            const existingSkillKey = nativeSkillKeys.get(declaration.skillKey);
+            if (existingSkillKey !== undefined) {
+                error(`artifacts.targets has duplicate codex-native skillKey "${declaration.skillKey}" in the shared projection at targets[${existingSkillKey}] and targets[${declarationIndex}]`);
+            }
+            else {
+                nativeSkillKeys.set(declaration.skillKey, declarationIndex);
+            }
+        }
+    }
+    const nativeComponents = codexStaticNativeComponentKeys(manifest).map((key) => ({
+        key,
+        scopes: ['project', 'user'],
+    }));
+    declarations.forEach((declaration, index) => {
+        if (declaration.delivery?.mode === 'codex-native') {
+            nativeComponents.push({ key: `artifacts.targets[${index}]`, scopes: declaration.scopes });
+        }
+    });
+    const expectedNativeComponent = nativeComponents[0];
+    if (expectedNativeComponent) {
+        const canonicalScopes = (component) => [...component.scopes].sort().join(',');
+        const expectedScopes = canonicalScopes(expectedNativeComponent);
+        const mismatch = nativeComponents.find((component) => canonicalScopes(component) !== expectedScopes);
+        if (mismatch) {
+            error(`codexSharedNativeScopeMismatch: Codex native component scope sets must match exactly; ` +
+                `${expectedNativeComponent.key} has {${expectedScopes}} but ${mismatch.key} has ` +
+                `{${canonicalScopes(mismatch)}}`);
+        }
+    }
+    const staticSkillNames = new Set(collectDeclaredSkillNames(pluginDir, manifest).static);
+    for (const [index, declaration] of declarations.entries()) {
+        if (declaration.target === 'codex.skill'
+            && declaration.delivery?.mode === 'codex-native'
+            && staticSkillNames.has(declaration.skillKey)) {
+            error(`artifacts.targets[${index}].skillKey: native dynamic Skill "${declaration.skillKey}" conflicts with a static Skill of the same name`);
+        }
+    }
     const owners = new Map();
     for (const declaration of declarations) {
         if ((declaration.target !== 'codex.skill' && declaration.target !== 'claude.skill' && declaration.target !== 'agent-skills.skill') ||
@@ -3244,19 +2379,28 @@ function validateRenderedSkillTree(options) {
     if (!readme || readme.toString('utf8').trim() === '') {
         error(`${fieldName} final file tree must contain a non-empty README.md`);
     }
-    const sensitiveValues = Object.entries(manifest.config?.schema ?? {})
-        .filter(([, field]) => isRecord(field) && field.sensitive === true)
-        .map(([key, field]) => Object.prototype.hasOwnProperty.call(field, 'default')
-        ? String(field.default)
-        : String(defaultConfigValues(manifest)[key] ?? ''))
-        .filter(Boolean);
     for (const [relativePath, content] of files) {
         const text = content.toString('utf8');
-        if (/\{\{[^{}]+\}\}/u.test(text)) {
-            error(`${fieldName} final file tree contains an unresolved template in "${relativePath}"`);
+        let remaining = text;
+        if (relativePath.endsWith('.md')) {
+            try {
+                const placeholders = parseManagedCommandPlaceholders(text);
+                if (placeholders.length > 0 && !(manifest.requires?.aw?.capabilities ?? []).includes('aw.managed-commands.v1')) {
+                    error(`${fieldName} managed command references require aw.managed-commands.v1`);
+                }
+                if (declaration.target === 'agent-skills.skill' && placeholders.length > 0) {
+                    error(`${fieldName} managedCommandPortableUnsupported: Portable Skills cannot contain managed command references`);
+                }
+                else if (options.managedTrees) {
+                    remaining = replaceManagedCommandPlaceholders(text, () => `cmdp_${'0'.repeat(16)}`);
+                }
+            }
+            catch (cause) {
+                error(`${fieldName} ${cause.message}`);
+            }
         }
-        if (sensitiveValues.some((value) => text.includes(value))) {
-            error(`${fieldName} final file tree exposes sensitive config in "${relativePath}"`);
+        if (/\{\{[^{}]+\}\}/u.test(remaining)) {
+            error(`${fieldName} final file tree contains an unresolved template in "${relativePath}"`);
         }
     }
     if (declaration.target === 'codex.skill') {
@@ -3274,6 +2418,7 @@ function validateRenderedSkillTree(options) {
     if (declaration.target === 'codex.skill' && files.has('agents/openai.yaml')) {
         validateOpenAiYaml(path.join(materializedRoot, 'agents', 'openai.yaml'), declaration.skillKey, true, manifest, materializedRoot, skillValidationTools);
     }
+    options.managedTrees?.push({ declaration, files, scope: options.managedScope });
 }
 function validateStaticPortableFinalTrees(pluginDir, manifest, runtimeImports, skillValidationTools) {
     const portableRoot = manifest.distributions?.agentSkills?.skills;
@@ -3333,6 +2478,12 @@ function validateRenderedArtifactPlan(plan, declarations, scopeLabel, options) {
         const entry = expectRecord(artifact, fieldName);
         if (!entry)
             return;
+        if (entry.target === 'aw.command-set' || entry.target === 'aw.command-package') {
+            const declaration = byKey.get(`${entry.id}:${entry.target}`);
+            if (declaration)
+                returned.add(`${entry.id}:${entry.target}`);
+            return; // Shared ArtifactPlan validation owns command response fields.
+        }
         validateAllowedKeys(entry, fieldName, [
             'id',
             'platform',
@@ -3439,6 +2590,8 @@ function validateRenderedArtifactPlan(plan, declarations, scopeLabel, options) {
                     runtimeImports: options.runtimeImports,
                     materializedRoot: path.join(options.tempRoot, `${declaration.platform ?? declaration.distribution}-${scopeLabel.split('/')[1]}-${index}`),
                     skillValidationTools: options.skillValidationTools,
+                    managedTrees: options.managedTrees,
+                    managedScope: scopeLabel.split('/')[1],
                 });
             }
         }
@@ -3453,26 +2606,81 @@ function validateRenderedArtifactPlan(plan, declarations, scopeLabel, options) {
         }
     }
 }
-function runArtifactRendererFixture(pluginDir, manifest, renderEntry, declarations, resolvedRuntimeImports, skillValidationTools) {
+function resolveArtifactRendererFixtureRequests(declarations, manifest, requiresNonSensitiveArtifactInput) {
+    const awOwned = new Map();
+    const codexNative = new Map();
+    for (const declaration of declarations) {
+        if (declaration.delivery?.mode === 'codex-native') {
+            const scope = declaration.scopes.includes('user') ? 'user' : 'project';
+            const request = codexNative.get(scope) ?? {
+                kind: 'codex-native',
+                surface: 'codex',
+                scope,
+                configScope: 'user',
+                declarations: [],
+            };
+            request.declarations.push(declaration);
+            codexNative.set(scope, request);
+            continue;
+        }
+        const surface = declaration.surface?.kind === 'aw'
+            ? declaration.surface.name
+            : declaration.platform ?? declaration.distribution;
+        if (!surface)
+            continue;
+        for (const scope of declaration.scopes) {
+            const key = `${surface}:${scope}`;
+            const request = awOwned.get(key) ?? {
+                kind: 'aw-owned',
+                surface,
+                scope,
+                configScope: scope,
+                declarations: [],
+            };
+            request.declarations.push(declaration);
+            awOwned.set(key, request);
+        }
+    }
+    const partitionedAwOwned = [...awOwned.values()].flatMap((request) => {
+        const hasNonSensitiveTarget = request.declarations.some(requiresNonSensitiveArtifactInput);
+        const hasSensitiveOtherTarget = request.declarations.some((declaration) => !requiresNonSensitiveArtifactInput(declaration)
+            && declaration.refreshKeys.some((key) => configFieldContainsSensitiveValue(manifest.config?.fields?.[key])));
+        if (!hasNonSensitiveTarget || !hasSensitiveOtherTarget)
+            return [request];
+        const nonSensitiveDeclarations = request.declarations.filter(requiresNonSensitiveArtifactInput);
+        const otherDeclarations = request.declarations.filter((declaration) => !requiresNonSensitiveArtifactInput(declaration));
+        return [
+            { ...request, declarations: nonSensitiveDeclarations },
+            { ...request, declarations: otherDeclarations },
+        ];
+    });
+    return [...partitionedAwOwned, ...codexNative.values()];
+}
+async function runArtifactRendererFixture(pluginDir, manifest, renderEntry, declarations, resolvedRuntimeImports, skillValidationTools, managedContext, requiresNonSensitiveArtifactInput) {
     if (!renderEntry || declarations.length === 0)
-        return;
-    const surfaceScopes = [...new Set(declarations.flatMap((target) => target.scopes.map((scope) => `${target.platform ?? target.distribution}:${scope}`)))];
+        return [];
+    const requests = resolveArtifactRendererFixtureRequests(declarations, manifest, requiresNonSensitiveArtifactInput);
     const values = defaultConfigValues(manifest);
     const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'aw-artifact-render-'));
+    const returnedArtifacts = [];
     try {
-        for (const surfaceScope of surfaceScopes) {
-            const [surface, scope] = surfaceScope.split(':');
+        for (const [requestIndex, request] of requests.entries()) {
+            const { kind, surface, scope, configScope, declarations: scopedDeclarations, } = request;
             const distribution = surface === 'agent-skills' ? surface : undefined;
-            const platform = distribution ? undefined : surface;
+            const awSurface = surface === 'managed-commands';
+            const platform = distribution || awSurface ? undefined : surface;
             const event = distribution ? 'materialize' : 'install';
-            const scopedDeclarations = declarations.filter((target) => (distribution ? target.distribution === distribution : target.platform === platform)
-                && target.scopes.includes(scope));
-            const contextPath = path.join(tempRoot, `context-${surface}-${scope}.json`);
-            const runtimeImports = scopedDeclarations.flatMap((target) => target.runtimeImports.map((runtimeImport, importIndex) => {
+            const requestRoot = path.join(tempRoot, `${requestIndex}-${kind}-${surface}-${scope}`);
+            const rendererAwHome = path.join(requestRoot, 'aw-home');
+            const rendererCodexHome = path.join(requestRoot, 'codex-home');
+            const rendererClaudeHome = path.join(requestRoot, 'claude-home');
+            fs.mkdirSync(requestRoot, { recursive: true });
+            const contextPath = path.join(requestRoot, 'context.json');
+            const runtimeImports = scopedDeclarations.flatMap((target) => (target.runtimeImports ?? []).map((runtimeImport, importIndex) => {
                 const resolved = resolvedRuntimeImports?.artifactImports.get(authorRuntimeImportKey(target.id, importIndex));
                 if (!resolved)
                     return null;
-                const importPath = path.join(tempRoot, `runtime-${target.id}-${importIndex}`);
+                const importPath = path.join(requestRoot, `runtime-${target.id}-${importIndex}`);
                 fs.writeFileSync(importPath, resolved.bytes);
                 return {
                     artifactId: target.id,
@@ -3483,9 +2691,40 @@ function runArtifactRendererFixture(pluginDir, manifest, renderEntry, declaratio
                     digest: resolved.digest,
                 };
             }).filter(Boolean));
+            const refreshKeys = [...new Set(scopedDeclarations.flatMap((target) => target.refreshKeys))];
+            const scopedSchema = Object.fromEntries(refreshKeys.flatMap((key) => manifest.config?.fields?.[key] === undefined
+                ? []
+                : [[key, manifest.config.fields[key]]]));
+            const scopedValues = Object.fromEntries(refreshKeys.flatMap((key) => Object.prototype.hasOwnProperty.call(values, key) ? [[key, values[key]]] : []));
+            try {
+                for (const target of scopedDeclarations.filter((declaration) => declaration.runtimeConfig)) {
+                    const definition = normalizePluginConfigDefinition(manifest.config);
+                    createRuntimeConfigSnapshot({
+                        installedIdentity: {
+                            sourceId: 'authoring',
+                            sourceIdentity: 'authoring',
+                            pluginId: `authoring/${manifest.name}`,
+                            pluginName: manifest.name,
+                            pluginVersion: manifest.version,
+                            platform: target.platform,
+                            scope: target.delivery?.mode === 'codex-native' ? 'user' : scope,
+                            configScope,
+                            artifactId: target.id,
+                            skillKey: target.skillKey,
+                        },
+                        declaration: target.runtimeConfig,
+                        definition,
+                        values,
+                    });
+                }
+            }
+            catch (runtimeConfigError) {
+                error(`scripts.artifacts.render fixture (${surface}/${scope}) runtime config failed: ${runtimeConfigError.message}`);
+                continue;
+            }
             fs.writeFileSync(contextPath, JSON.stringify({
                 event,
-                surface: distribution
+                surface: awSurface ? { kind: 'aw', name: 'managed-commands' } : distribution
                     ? { kind: 'distribution', name: distribution }
                     : { kind: 'platform', name: platform },
                 ...(platform ? { platform } : {}),
@@ -3498,29 +2737,31 @@ function runArtifactRendererFixture(pluginDir, manifest, renderEntry, declaratio
                 },
                 config: {
                     mode: 'artifact-render',
-                    targetScope: scope,
-                    schema: manifest.config?.schema ?? {},
-                    values,
-                    sources: Object.fromEntries(Object.keys(values).map((key) => [key, 'default'])),
+                    targetScope: configScope,
+                    ...(manifest.config?.fields === undefined ? {} : { schema: scopedSchema }),
+                    values: scopedValues,
+                    sources: Object.fromEntries(Object.keys(scopedValues).map((key) => [key, 'default'])),
                     issues: [],
                 },
                 changedConfigKeys: [],
+                requestedArtifactIds: scopedDeclarations.map((target) => target.id),
                 previousArtifacts: [],
-                artifactSources: scopedDeclarations.map((target) => ({
+                artifactSources: declarations.filter((target) => (target.target === 'codex.skill' || target.target === 'claude.skill' || target.target === 'agent-skills.skill')
+                    && (distribution ? target.distribution === distribution : target.platform === platform)
+                    && target.scopes.includes(scope)).map((target) => ({
                     id: target.id,
                     target: target.target,
                     sourceDirs: target.sourceDirs.map((sourceDir) => path.join(pluginDir, normalizeRelativePath(sourceDir))),
                 })),
+                commandSources: (managedContext?.manifest.managedCommands?.packages ?? [])
+                    .filter((entry) => scopedDeclarations.some((target) => target.packageKey === entry.key))
+                    .map((entry) => ({ packageKey: entry.key, sourceDir: path.join(pluginDir, normalizeRelativePath(entry.sourceDir)) })),
                 runtimeImports,
                 paths: {
-                    awHome: path.join(tempRoot, 'aw-home'),
-                    codexHome: path.join(tempRoot, 'codex-home'),
-                    claudeHome: path.join(tempRoot, 'claude-home'),
+                    awHome: rendererAwHome,
+                    codexHome: rendererCodexHome,
+                    claudeHome: rendererClaudeHome,
                     manifestPath: path.join(pluginDir, '.agents-plugin', 'plugin.json'),
-                    configStores: {
-                        user: path.join(tempRoot, 'config-user.json'),
-                        project: path.join(tempRoot, 'config-project.json'),
-                    },
                 },
                 renderer: {
                     runner: renderEntry.runner,
@@ -3530,14 +2771,17 @@ function runArtifactRendererFixture(pluginDir, manifest, renderEntry, declaratio
                     rendererDigest: 'author-validator-fixture',
                 },
             }), 'utf8');
-            const rendererHome = path.join(tempRoot, 'home');
-            const rendererTemp = path.join(tempRoot, 'tmp');
+            const rendererHome = path.join(requestRoot, 'home');
+            const rendererTemp = path.join(requestRoot, 'tmp');
+            for (const rendererStateHome of [rendererAwHome, rendererCodexHome, rendererClaudeHome]) {
+                fs.mkdirSync(rendererStateHome, { recursive: true });
+            }
             fs.mkdirSync(rendererHome, { recursive: true });
             fs.mkdirSync(rendererTemp, { recursive: true });
             const rendererEnv = {
-                AW_HOME: path.join(tempRoot, 'aw-home'),
-                AW_CODEX_HOME: path.join(tempRoot, 'codex-home'),
-                AW_CLAUDE_HOME: path.join(tempRoot, 'claude-home'),
+                AW_HOME: rendererAwHome,
+                AW_CODEX_HOME: rendererCodexHome,
+                AW_CLAUDE_HOME: rendererClaudeHome,
                 PATH: process.env.PATH ?? process.env.Path ?? '',
                 AW_PLUGIN_CONTEXT: contextPath,
                 AW_PLUGIN_ROOT: pluginDir,
@@ -3546,6 +2790,7 @@ function runArtifactRendererFixture(pluginDir, manifest, renderEntry, declaratio
                 AW_PLUGIN_EVENT: event,
                 ...(platform ? { AW_PLUGIN_PLATFORM: platform } : {}),
                 ...(distribution ? { AW_PLUGIN_DISTRIBUTION: distribution } : {}),
+                ...(awSurface ? { AW_PLUGIN_SURFACE: 'managed-commands' } : {}),
                 AW_PLUGIN_SCOPE: scope,
             };
             if (process.platform === 'win32') {
@@ -3592,24 +2837,165 @@ function runArtifactRendererFixture(pluginDir, manifest, renderEntry, declaratio
                 runtimeImports: resolvedRuntimeImports,
                 tempRoot,
                 skillValidationTools,
+                managedTrees: managedContext?.trees,
             });
+            if (managedContext) {
+                try {
+                    const validated = managedContext.tools.validateArtifactPlan({
+                        manifest: managedContext.manifest,
+                        plan,
+                        platform: surface,
+                        scope,
+                        requestedArtifactIds: scopedDeclarations.map((target) => target.id),
+                        renderConfig: { values: scopedValues, sources: Object.fromEntries(Object.keys(scopedValues).map((key) => [key, 'default'])), issues: [] },
+                    });
+                    returnedArtifacts.push(...validated.artifacts.map((artifact) => ({ artifact, scope, surface })));
+                }
+                catch (cause) {
+                    error(`${fieldName}: ${cause.message}`);
+                }
+            }
         }
     }
     finally {
         fs.rmSync(tempRoot, { recursive: true, force: true });
     }
+    return returnedArtifacts;
 }
-function validateDynamicArtifactsLightweight(pluginDir, manifest, renderEntry, runtimeImports, skillValidationTools) {
+async function validateDynamicArtifactsLightweight(pluginDir, manifest, renderEntry, runtimeImports, skillValidationTools, managedContext, requiresNonSensitiveArtifactInput) {
     const declarations = validateArtifactsConfigLightweight(pluginDir, manifest);
+    if (managedContext)
+        declarations.push(...getManagedCommandArtifactTargets(managedContext.manifest));
     const hasTargets = declarations.length > 0;
     const hasRenderer = Boolean(manifest.scripts?.artifacts?.render);
     if (hasTargets && !hasRenderer) {
         error('artifacts.targets requires scripts.artifacts.render');
     }
     if (hasRenderer && !hasTargets) {
-        error('scripts.artifacts.render requires artifacts.targets');
+        error('scripts.artifacts.render requires artifacts.targets or dynamic managedCommands targets');
+    }
+    return runArtifactRendererFixture(pluginDir, manifest, renderEntry, declarations, runtimeImports, skillValidationTools, managedContext, requiresNonSensitiveArtifactInput);
+}
+async function validateAuthorManagedCommands(pluginDir, manifest, rendered, context) {
+    const { tools, trees } = context;
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'aw-author-commands-'));
+    const env = { AW_HOME: path.join(tempRoot, 'aw-home'), AW_CODEX_HOME: path.join(tempRoot, 'codex-home'), AW_CLAUDE_HOME: path.join(tempRoot, 'claude-home') };
+    const plugin = { manifest, rootDir: pluginDir, sourceId: 'authoring', sourceIdentity: `sha256:${'0'.repeat(64)}` };
+    const candidates = [];
+    const cleanups = [];
+    try {
+        const root = manifest.skills && path.join(pluginDir, normalizeRelativePath(manifest.skills));
+        if (root && fs.existsSync(root)) {
+            for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+                if (!entry.isDirectory())
+                    continue;
+                for (const platform of targetedPlatforms(manifest)) {
+                    if ((manifest.artifacts?.targets ?? []).some((target) => target.platform === platform && target.kind === 'skill' && target.skillKey === entry.name))
+                        continue;
+                    const files = new Map();
+                    collectArtifactSourceFiles(path.join(root, entry.name), `static Skill ${entry.name}`, files);
+                    for (const [relative, bytes] of files) {
+                        if (isTemplateTextFile(relative))
+                            files.set(relative, Buffer.from(renderTemplateForPlatform(manifest, `${normalizeRelativePath(manifest.skills)}/${entry.name}/${relative}`, bytes.toString('utf8'), platform)));
+                    }
+                    const producer = await tools.managedCommandProducerIdentity({
+                        plugin,
+                        producer: { kind: 'static-skill', platform, skillKey: entry.name },
+                        scope: 'user',
+                        cwd: pluginDir,
+                    });
+                    trees.push({ declaration: { target: `${platform}.skill`, platform, skillKey: entry.name, staticSkill: true }, files, scope: producer.scope });
+                }
+            }
+        }
+        const setOutputs = (set, platform, scope) => {
+            if (set.mode === 'static')
+                return { set: set.set, state: 'present', entries: set.entries };
+            const output = rendered.find((entry) => entry.artifact.id === `command-set.${set.set}` && entry.scope === scope && entry.surface === platform)?.artifact;
+            if (!output)
+                throw new Error(`commandReferenceInvalid: dynamic command set ${set.set} was not returned`);
+            return { set: set.set, state: output.state, entries: output.entries };
+        };
+        for (const commandPackage of manifest.managedCommands?.packages ?? []) {
+            const sets = (manifest.managedCommands?.sets ?? [])
+                .filter((set) => set.producer.kind === 'package' && set.producer.packageKey === commandPackage.key)
+                .map((set) => setOutputs(set, 'managed-commands', commandPackage.scope));
+            const sourceRoot = path.join(pluginDir, normalizeRelativePath(commandPackage.sourceDir));
+            const files = { ...(rendered.find((entry) => entry.artifact.id === `command-package.${commandPackage.key}`)?.artifact.files ?? {}) };
+            if (manifest.nativeTools) {
+                const readerPath = path.join(pluginDir, normalizeRelativePath(manifest.nativeTools.reader));
+                const relativeReader = path.relative(sourceRoot, readerPath);
+                if (relativeReader && relativeReader !== '..' && !relativeReader.startsWith(`..${path.sep}`) && !path.isAbsolute(relativeReader) && !fs.existsSync(readerPath)) {
+                    const readerFile = relativeReader.split(path.sep).join('/');
+                    const readerSource = createNativeToolReaderSource();
+                    if (Object.hasOwn(files, readerFile) && files[readerFile] !== readerSource)
+                        throw new Error('nativeToolReaderMismatch');
+                    files[readerFile] = readerSource;
+                }
+            }
+            const prepared = await tools.prepareManagedCommandPackageFiles({ sourceRoot, files, entries: sets.flatMap((set) => set.entries) });
+            cleanups.push(prepared.cleanup);
+            candidates.push({ producer: await tools.managedCommandProducerIdentity({ plugin, producer: { kind: 'package', packageKey: commandPackage.key }, scope: commandPackage.scope, cwd: pluginDir }), sets });
+        }
+        for (const [index, tree] of trees.entries()) {
+            const { declaration } = tree;
+            const scope = declaration.delivery?.mode === 'codex-native' ? 'user' : tree.scope;
+            if (!declaration.platform)
+                continue;
+            const producer = declaration.staticSkill
+                ? { kind: 'static-skill', platform: declaration.platform, skillKey: declaration.skillKey }
+                : { kind: 'artifact', artifactId: declaration.id };
+            const sets = (manifest.managedCommands?.sets ?? []).filter((set) => JSON.stringify(set.producer) === JSON.stringify(producer))
+                .map((set) => setOutputs(set, declaration.platform, scope));
+            const resourceRoot = path.join(tempRoot, `skill-${index}`);
+            for (const [relative, bytes] of tree.files) {
+                const target = path.join(resourceRoot, ...relative.split('/'));
+                fs.mkdirSync(path.dirname(target), { recursive: true });
+                fs.writeFileSync(target, bytes);
+            }
+            await validateCommandEntryFiles(resourceRoot, sets.flatMap((set) => set.entries));
+            candidates.push({ producer: await tools.managedCommandProducerIdentity({ plugin, producer, scope, cwd: pluginDir }), sets });
+        }
+        for (const tree of trees) {
+            if (!tree.declaration.platform)
+                continue;
+            const scope = tree.declaration.delivery?.mode === 'codex-native' ? 'user' : tree.scope;
+            const resolve = await tools.createManagedCommandReferenceResolver({ plugin, platform: tree.declaration.platform, scope, cwd: pluginDir, env, candidates });
+            for (const [relative, bytes] of tree.files) {
+                if (!relative.endsWith('.md'))
+                    continue;
+                const text = bytes.toString('utf8');
+                if (parseManagedCommandPlaceholders(text).length > 0 && !(manifest.requires?.aw?.capabilities ?? []).includes('aw.managed-commands.v1'))
+                    throw new Error('managed command references require aw.managed-commands.v1');
+                replaceManagedCommandPlaceholders(text, resolve);
+            }
+        }
+        for (const permission of manifest.extensions?.permissions ?? []) {
+            for (const platform of targetedPlatforms(manifest)) {
+                for (const scope of platform === 'codex' ? ['user'] : ['user', 'project']) {
+                    const resolve = await tools.createManagedCommandReferenceResolver({ plugin, platform, scope, cwd: pluginDir, env, candidates });
+                    const override = permission.agentOverrides?.[platform];
+                    if (override === null)
+                        continue;
+                    for (const decision of ['allow', 'ask', 'deny'])
+                        for (const rule of override?.[decision] ?? permission[decision] ?? [])
+                            if (typeof rule !== 'string')
+                                resolve(rule.command);
+                    if (platform === 'claude')
+                        for (const rule of override?.sandbox?.excludedCommands ?? [])
+                            resolve(rule.command);
+                }
+            }
+        }
+    }
+    catch (cause) {
+        error(`managed command authoring candidate: ${cause.message}`);
+    }
+    finally {
+        for (const cleanup of cleanups)
+            await cleanup();
+        fs.rmSync(tempRoot, { recursive: true, force: true });
     }
-    runArtifactRendererFixture(pluginDir, manifest, renderEntry, declarations, runtimeImports, skillValidationTools);
 }
 function validateScriptsLightweight(pluginDir, manifest) {
     validateConfigSchemaLightweight(manifest.config);
@@ -3618,16 +3004,15 @@ function validateScriptsLightweight(pluginDir, manifest) {
     const scripts = expectRecord(manifest.scripts, 'scripts');
     if (!scripts)
         return null;
-    validateAllowedKeys(scripts, 'scripts', ['timeoutMs', 'lifecycle', 'helpers', 'node', 'artifacts', 'tests']);
-    if (scripts.timeoutMs !== undefined &&
-        (!Number.isInteger(scripts.timeoutMs) ||
-            scripts.timeoutMs < SCRIPT_TIMEOUT_MIN_MS ||
-            scripts.timeoutMs > SCRIPT_TIMEOUT_MAX_MS)) {
-        error(`scripts.timeoutMs must be an integer between ${SCRIPT_TIMEOUT_MIN_MS} and ${SCRIPT_TIMEOUT_MAX_MS}`);
-    }
+    validateAllowedKeys(scripts, 'scripts', ['preApply', 'helpers', 'node', 'artifacts', 'tests']);
     const runtimeNodeEntries = [];
     let artifactRenderEntry = null;
     let packageMeta = null;
+    const nativeToolReader = manifest.nativeTools ? normalizeRelativePath(manifest.nativeTools.reader ?? './.aw/native-tool-reader.mjs') : undefined;
+    const runtimeConfigSkillRoots = (manifest.artifacts?.targets ?? [])
+        .filter((target) => target.runtimeConfig !== undefined)
+        .flatMap((target) => target.sourceDirs ?? [])
+        .map(normalizeRelativePath);
     if (scripts.helpers !== undefined) {
         const helpers = expectRecord(scripts.helpers, 'scripts.helpers');
         if (helpers) {
@@ -3641,17 +3026,21 @@ function validateScriptsLightweight(pluginDir, manifest) {
                 runtimeNodeEntries.push({ path: helperPath, fieldName: 'scripts.helpers.config' });
         }
     }
-    if (scripts.lifecycle !== undefined) {
-        const lifecycle = expectRecord(scripts.lifecycle, 'scripts.lifecycle');
-        if (lifecycle) {
-            validateAllowedKeys(lifecycle, 'scripts.lifecycle', [...SCRIPT_LIFECYCLE_EVENTS]);
-            for (const [eventName, definition] of Object.entries(lifecycle)) {
-                if (!SCRIPT_LIFECYCLE_EVENTS.has(eventName)) {
-                    error(`scripts.lifecycle has unsupported event "${eventName}"`);
-                    continue;
-                }
-                validateLifecycleDefinition(pluginDir, definition, `scripts.lifecycle.${eventName}`, runtimeNodeEntries);
+    if (scripts.preApply !== undefined) {
+        const preApply = expectRecord(scripts.preApply, 'scripts.preApply');
+        if (preApply) {
+            validateAllowedKeys(preApply, 'scripts.preApply', ['path', 'timeoutMs']);
+            const preApplyPath = normalizePluginScriptPath(pluginDir, preApply.path, 'scripts.preApply.path');
+            validateDeclaredScriptFile(pluginDir, preApplyPath, 'scripts.preApply.path');
+            if (preApplyPath && !isNodeRunnablePath(preApplyPath)) {
+                error('scripts.preApply.path must use a Node runnable extension (.js, .mjs, or .cjs)');
+            }
+            if (preApply.timeoutMs !== undefined && (!Number.isInteger(preApply.timeoutMs)
+                || preApply.timeoutMs < SCRIPT_TIMEOUT_MIN_MS || preApply.timeoutMs > SCRIPT_TIMEOUT_MAX_MS)) {
+                error(`scripts.preApply.timeoutMs must be an integer between ${SCRIPT_TIMEOUT_MIN_MS} and ${SCRIPT_TIMEOUT_MAX_MS}`);
             }
+            if (preApplyPath)
+                runtimeNodeEntries.push({ path: preApplyPath, fieldName: 'scripts.preApply.path' });
         }
     }
     if (scripts.node !== undefined) {
@@ -3671,6 +3060,8 @@ function validateScriptsLightweight(pluginDir, manifest) {
                         label: 'scripts.node.build import contract',
                         packageMeta,
                         allowDevDependencies: true,
+                        runtimeConfigSkillRoots,
+                        nativeToolReader,
                     });
                 }
             }
@@ -3720,6 +3111,8 @@ function validateScriptsLightweight(pluginDir, manifest) {
                         label: 'scripts.tests.node import contract',
                         packageMeta,
                         allowDevDependencies: true,
+                        runtimeConfigSkillRoots,
+                        nativeToolReader,
                     });
                 }
             }
@@ -3729,6 +3122,8 @@ function validateScriptsLightweight(pluginDir, manifest) {
         label: 'runtime Node import contract',
         packageMeta,
         allowDevDependencies: false,
+        runtimeConfigSkillRoots,
+        nativeToolReader,
     });
     return artifactRenderEntry;
 }
@@ -4130,8 +3525,6 @@ function printUsage() {
   aw plugin validate <plugin-directory> [options]
 
 Options:
-  --catalog-min-version <semver>
-                               Validate compatibility.aw.minVersion against a target catalog.
   --strict-agent-skills        Allow only Agent Skills portable core frontmatter.
   --claude-skill-profile <minimum|current>
                                Validate Claude fields at AW minimum 2.1.88 (default) or current docs.
@@ -4200,8 +3593,32 @@ async function validatePluginDir(pluginDir, options) {
         }
     }
     const skillValidationTools = await tryLoadCliSkillValidationTools();
+    let normalizedManifest;
     try {
-        await cliManifestTools.validateSourcePluginManifest(pluginDir, manifest);
+        normalizedManifest = await cliManifestTools.validateSourcePluginManifest(pluginDir, manifest);
+        // Renderer fixtures consume the same compiled config as installed runtime consumers.
+        if (normalizedManifest.config)
+            manifest.config = normalizedManifest.config;
+        const requirements = await cliManifestTools.resolvePluginRequirements({
+            pluginRoot: pluginDir,
+            manifest: normalizedManifest,
+            implementedCapabilities: cliManifestTools.implementedCapabilities,
+        });
+        if (requirements.unsupportedByCurrentAw.length > 0) {
+            capabilityDiagnostic = {
+                errorCode: 'awCapabilityUnsupported',
+                missingCapabilities: requirements.unsupportedByCurrentAw,
+                availableCapabilities: [...cliManifestTools.implementedCapabilities].sort(),
+            };
+            error(`[awCapabilityUnsupported] missingCapabilities=${JSON.stringify(requirements.unsupportedByCurrentAw)}`);
+        }
+        const satisfiedCapabilities = new Set([...requirements.declared, ...requirements.derived]);
+        const advisoryObservations = requirements.observations.filter((observation) => (observation.code !== 'aw-command-detected'
+            || observation.capability === undefined
+            || !satisfiedCapabilities.has(observation.capability)));
+        for (const observation of advisoryObservations) {
+            warn(`[awCapabilityObservation] ${observation.path}: ${observation.message}`);
+        }
     }
     catch (e) {
         error(e.message);
@@ -4212,8 +3629,7 @@ async function validatePluginDir(pluginDir, options) {
     validateNoBuildOutputDirs(pluginDir);
     validateDeclaredNativeAssets(pluginDir, manifest);
     validateCanonicalSkillLayout(pluginDir, manifest);
-    validatePluginVersionContracts(manifest, options);
-    validatePluginEvalManifest(pluginDir, manifest);
+    await validatePluginEvalManifest(pluginDir, manifest);
     const artifactRenderEntry = validateScriptsLightweight(pluginDir, manifest);
     const runtimeImports = await resolveAuthorRuntimeImports({
         pluginDir,
@@ -4222,7 +3638,12 @@ async function validatePluginDir(pluginDir, options) {
         cliManifestTools,
     });
     validateStaticPortableFinalTrees(pluginDir, manifest, runtimeImports, skillValidationTools);
-    validateDynamicArtifactsLightweight(pluginDir, manifest, artifactRenderEntry, runtimeImports, skillValidationTools);
+    const managedContext = normalizedManifest
+        ? { manifest: normalizedManifest, tools: cliManifestTools, trees: [] }
+        : undefined;
+    const rendered = await validateDynamicArtifactsLightweight(pluginDir, manifest, artifactRenderEntry, runtimeImports, skillValidationTools, managedContext, cliManifestTools.requiresNonSensitiveArtifactInput);
+    if (managedContext)
+        await validateAuthorManagedCommands(pluginDir, normalizedManifest, rendered ?? [], managedContext);
     validateMcpContent(pluginDir, manifest);
     validateAppsContent(pluginDir, manifest);
     warnCodexProjectScopeLimitations(manifest);
@@ -4263,7 +3684,6 @@ function parseArgs(argv) {
     const args = argv.slice(2);
     const options = {
         pluginDir: null,
-        catalogMinVersion: null,
         strictAgentSkills: false,
         claudeSkillProfile: 'minimum',
         versionBase: 'HEAD',
@@ -4320,18 +3740,6 @@ function parseArgs(argv) {
             }
             exitCliError(`Unknown argument: ${arg}`, options.json);
         }
-        if (arg === '--catalog-min-version') {
-            const value = args[index + 1];
-            if (!value || value.startsWith('--')) {
-                exitCliError('--catalog-min-version requires a value.', options.json);
-            }
-            index += 1;
-            if (!STRICT_SEMVER_PATTERN.test(value)) {
-                exitCliError(`Invalid --catalog-min-version: expected a strict SemVer 2.0.0 string. Received ${JSON.stringify(value)}.`, options.json);
-            }
-            options.catalogMinVersion = value;
-            continue;
-        }
         exitCliError(`Unknown option: ${arg}`, options.json);
     }
     return options;
@@ -4363,7 +3771,6 @@ async function main() {
     const repoRoot = requestedWorkspaceRoot ?? discoverCanonicalRepoRoot(repoRootCandidate);
     const gitRoot = discoverCanonicalRepoRoot(findRepoRootCandidate(resolved));
     await validatePluginDir(resolved, {
-        catalogMinVersion: args.catalogMinVersion,
         strictAgentSkills: args.strictAgentSkills,
         claudeSkillProfile: args.claudeSkillProfile,
         versionBase: args.versionBase,
@@ -4377,9 +3784,12 @@ async function main() {
             profile: args.strictAgentSkills ? 'agent-skills-portable-core' : 'aw-source',
             claudeSkillProfile: args.claudeSkillProfile,
             pluginDirectory: resolved,
+            workspaceRoot: process.env.AW_AUTHORING_WORKSPACE_ROOT ?? repoRoot,
+            workspaceRootResolvedFrom: process.env.AW_AUTHORING_WORKSPACE_ROOT_RESOLVED_FROM ?? 'explicit',
             versionCheck: pluginVersionCheckResult,
             warnings,
             errors,
+            ...(capabilityDiagnostic ?? {}),
         }, null, 2));
         if (errors.length > 0) {
             process.exit(1);