@lesliechan721/aw 0.1.0-beta.63 → 0.1.0-beta.65

package/dist/src/utils/plugin-config.js

@@ -1,65 +1,37 @@
 import crypto from 'node:crypto';
+import { resolveWorkContext } from '../intent/work-context.js';
 import * as nodeFs from 'node:fs/promises';
 import path from 'node:path';
 import fs from 'fs-extra';
-import { canonicalizePluginConfigValues, formatPluginConfigIssue, getPluginConfigDependencyKeys, getPluginConfigDependencyFields, matchPluginConfigPreset, redactPluginConfigValue, stablePluginConfigStringify, validatePluginConfigCandidate, validatePluginConfigDocument, validatePluginConfigValue as validateCorePluginConfigValue, } from '@lesliechan721/aw-plugin-core/manifest';
-import { assertTestReadablePath, assertTestWritablePath, } from './test-path-fence.js';
+import { canonicalizePluginConfigValues, compilePluginConfigDefinition, PLATFORM_TARGETS, formatPluginConfigIssue, getPluginConfigDependencyKeys, getPluginConfigDependencyFields, matchPluginConfigPreset, redactPluginConfigValue, stablePluginConfigStringify, validatePluginConfigCandidate, validatePluginConfigDocument, validatePluginConfigValue as validateCorePluginConfigValue, } from '@lesliechan721/aw-plugin-core/manifest';
 import { canonicalizePathThroughExistingAncestor, resolveAwHome, resolveRepoRootSync, } from './paths.js';
 import { assertRealFileParentWithinRoot, assertSafeFileMutationPath, atomicReplaceSafeFile, } from './safe-fs.js';
-import { assertProjectSharedConfigPathVisible, PROJECT_CONFIG_SHAREABILITY_UNVERIFIED_WARNING, } from './project-boundary.js';
 import { pluginConfigHasExternalReferences, resolvePluginConfigReferenceContext, } from './plugin-config-references.js';
 export { resolvePluginConfigReferenceContext } from './plugin-config-references.js';
 export function codexNativeRefreshKeys(manifest) {
     return new Set((manifest.artifacts?.targets ?? []).flatMap((target) => target.platform === 'codex'
         && target.target === 'codex.skill'
-        && target.delivery?.mode === 'codex-native'
         ? target.refreshKeys
         : []));
 }
-function readPluginConfigBinding(value, scope) {
-    if (!isRecord(value))
-        return null;
-    if (scope === 'user') {
-        return value.kind === 'source'
-            && typeof value.sourceIdentity === 'string'
-            && /^sha256:[0-9a-f]{64}$/u.test(value.sourceIdentity)
-            && Object.keys(value).every((key) => ['kind', 'sourceIdentity'].includes(key))
-            ? { kind: 'source', sourceIdentity: value.sourceIdentity }
-            : null;
-    }
-    return value.kind === 'catalog'
-        && typeof value.logicalIdentity === 'string'
-        && value.logicalIdentity.trim().length > 0
-        && Object.keys(value).every((key) => ['kind', 'logicalIdentity'].includes(key))
-        ? { kind: 'catalog', logicalIdentity: value.logicalIdentity }
-        : null;
-}
-const PLUGIN_CONFIG_ENVELOPE_V5_KEYS = new Set([
-    'schemaVersion',
-    'sourceId',
-    'pluginName',
-    'binding',
-    'values',
-]);
-function readPluginConfigEnvelopeV5(value, scope) {
-    if (!isRecord(value)
-        || value.schemaVersion !== 5
-        || typeof value.sourceId !== 'string'
-        || typeof value.pluginName !== 'string'
-        || !isRecord(value.values)
-        || Object.keys(value).some((key) => !PLUGIN_CONFIG_ENVELOPE_V5_KEYS.has(key))) {
-        return null;
-    }
-    const binding = readPluginConfigBinding(value.binding, scope);
-    if (!binding)
+function readPluginConfigBinding(value) {
+    return isRecord(value) && value.kind === 'source'
+        && typeof value.sourceIdentity === 'string'
+        && /^sha256:[0-9a-f]{64}$/u.test(value.sourceIdentity)
+        && Object.keys(value).every((key) => ['kind', 'sourceIdentity'].includes(key))
+        ? { kind: 'source', sourceIdentity: value.sourceIdentity } : null;
+}
+function readPluginConfigEnvelopeV6(value, _scope) {
+    if (!isRecord(value) || value.schemaVersion !== 6
+        || typeof value.sourceId !== 'string' || typeof value.pluginName !== 'string'
+        || !isRecord(value.common) || !isRecord(value.platforms)
+        || Object.keys(value).some((key) => !['schemaVersion', 'sourceId', 'pluginName', 'binding', 'common', 'platforms'].includes(key))
+        || Object.keys(value.platforms).some((key) => !PLATFORM_TARGETS.includes(key)))
         return null;
-    return {
-        schemaVersion: 5,
-        sourceId: value.sourceId,
-        pluginName: value.pluginName,
-        binding,
-        values: value.values,
-    };
+    const binding = readPluginConfigBinding(value.binding);
+    return binding ? { schemaVersion: 6, sourceId: value.sourceId, pluginName: value.pluginName,
+        binding, common: value.common,
+        platforms: value.platforms } : null;
 }
 export class PluginConfigResetError extends Error {
     code;
@@ -252,10 +224,11 @@ async function calculateConfigSchemaManifestDigestForPlugin(plugin) {
     hash.update(JSON.stringify(plugin.manifest));
     return `sha256:${hash.digest('hex')}`;
 }
-function createConfigSchemaEvidenceFromCurrentCatalog(plugin, manifestDigest) {
+function createConfigSchemaEvidenceFromCurrentCatalog(plugin, manifestDigest, platform) {
     return {
         source: 'currentCatalog',
-        identity: createPluginConfigSchemaIdentity(plugin.manifest),
+        identity: createPluginConfigSchemaIdentity(plugin.manifest, platform),
+        platform,
         pluginVersion: plugin.manifest.version,
         manifestDigest,
     };
@@ -283,41 +256,16 @@ export function resolveAwProjectRoot(cwd) {
     return path.resolve(resolveRepoRootSync(cwd));
 }
 function resolvePluginConfigAllowedRoot(options) {
-    return options.scope === 'user'
-        ? resolveAwHome(options.env)
-        : path.join(resolveAwProjectRoot(options.cwd), '.agent-workflows');
+    return resolveAwHome(options.env);
 }
+/** Scope selects source context. All config values belong to the user document. */
 export function resolvePluginConfigStorePath(options) {
     const pluginName = assertSafePluginConfigSegment(options.pluginName);
-    const sourceId = options.sourceId === undefined
-        ? undefined
-        : assertSafePluginConfigSegment(options.sourceId);
-    const root = options.scope === 'user'
-        ? resolveAwHome(options.env)
-        : path.join(resolveAwProjectRoot(options.cwd), '.agent-workflows');
-    const filePath = path.join(root, CONFIG_DIR, ...(sourceId ? [sourceId] : []), pluginName, CONFIG_FILE);
-    if (options.scope !== 'project') {
-        return filePath;
-    }
-    if (options.access === 'read') {
-        return assertTestReadablePath(filePath, 'project plugin config store (.agent-workflows/plugin-config)', '用 registerReadonlyFixtureRoot() 或 runWithRepositoryCwdAsReadOnly() 登记只读 project fixture 根；需要写入时改用 withSafeTestCwd() 或 registerWritableStateRoot()。');
-    }
-    if (options.access === 'write') {
-        return assertTestWritablePath(filePath, 'project plugin config store (.agent-workflows/plugin-config)', '用 withSafeTestCwd() 切到测试可写 cwd，或通过 registerWritableStateRoot() 登记 project fixture 根。');
-    }
-    return filePath;
+    const sourceId = options.sourceId === undefined ? undefined : assertSafePluginConfigSegment(options.sourceId);
+    return path.join(resolveAwHome(options.env), CONFIG_DIR, ...(sourceId ? [sourceId] : []), pluginName, CONFIG_FILE);
 }
 export function resolvePluginConfigStoreTargets(options) {
-    if (options.scope === 'user') {
-        return [{
-                storeKind: 'user',
-                path: resolvePluginConfigStorePath(options),
-            }];
-    }
-    return [{
-            storeKind: 'project',
-            path: resolvePluginConfigStorePath(options),
-        }];
+    return [{ storeKind: 'user', path: resolvePluginConfigStorePath(options) }];
 }
 function isPluginConfigScalar(value) {
     if (typeof value === 'string' || typeof value === 'boolean')
@@ -417,80 +365,75 @@ function validateStoreValues(options) {
         ? invalidStore(options.filePath, 'invalidValues', issues.join(' '), options.rawDigest)
         : readyStore(options.filePath, values, options.rawDigest);
 }
-async function readStoreFile(filePath) {
+function documentStore(options) {
+    const common = validateStoreValues({ filePath: options.filePath, values: options.common, rawDigest: options.rawDigest });
+    if (common.state === 'invalid')
+        return common;
+    if (!isRecord(options.platforms) || Object.keys(options.platforms).some((key) => !PLATFORM_TARGETS.includes(key))) {
+        return invalidStore(options.filePath, 'invalidValues', 'The platforms field must contain known platform objects.', options.rawDigest);
+    }
+    const platforms = {};
+    for (const [platform, values] of Object.entries(options.platforms)) {
+        const store = validateStoreValues({ filePath: options.filePath, values, rawDigest: options.rawDigest });
+        if (store.state === 'invalid')
+            return store;
+        platforms[platform] = store.values;
+    }
+    return { ...common, common: common.values, platforms, ...(options.platform ? { platform: options.platform } : {}),
+        values: options.platform ? platforms[options.platform] ?? {} : common.values };
+}
+export function pluginConfigStoreForProfile(store, platform) {
+    return { ...store, platform, values: platform ? store.platforms?.[platform] ?? {} : store.common ?? store.values };
+}
+/** Replace one layer in memory without changing any other profile. */
+export function replacePluginConfigStoreLayer(store, values, platform) {
+    const common = platform ? store.common ?? store.values : canonicalizePluginConfigValues(values);
+    const platforms = { ...store.platforms };
+    if (platform) {
+        if (Object.keys(values).length)
+            platforms[platform] = canonicalizePluginConfigValues(values);
+        else
+            delete platforms[platform];
+    }
+    const exists = Object.keys(common).length > 0 || Object.keys(platforms).length > 0;
+    return { ...store, common, platforms, platform, values: platform ? platforms[platform] ?? {} : common,
+        exists, state: exists ? 'ready' : 'missing', issues: [], rawDigest: undefined };
+}
+async function readStoreFile(filePath, platform) {
     const parsed = await parseStoreJson(filePath);
     if (parsed.state === 'invalidJson')
         return parsed.store;
-    return validateStoreValues({ filePath, values: parsed.value, rawDigest: parsed.rawDigest });
+    const raw = parsed.value;
+    if (!isRecord(raw) || raw.schemaVersion !== 6
+        || Object.keys(raw).some((key) => !['schemaVersion', 'common', 'platforms'].includes(key))) {
+        return invalidStore(filePath, 'schemaVersionUnsupported', 'Only plugin config store schemaVersion 6 is supported. Reset the old document, then save the required values.', parsed.rawDigest);
+    }
+    return documentStore({ filePath, common: raw.common, platforms: raw.platforms, rawDigest: parsed.rawDigest, platform });
 }
 async function readNamespacedStoreFile(options) {
     const parsed = await parseStoreJson(options.filePath);
     if (parsed.state === 'invalidJson')
         return parsed.store;
-    const raw = parsed.value;
-    if (!isRecord(raw) || raw.schemaVersion !== 5) {
-        return invalidStore(options.filePath, 'schemaVersionUnsupported', 'Only plugin config store schemaVersion 5 is supported.', parsed.rawDigest);
-    }
-    const envelope = readPluginConfigEnvelopeV5(raw, options.scope);
-    if (!envelope) {
-        return invalidStore(options.filePath, 'schemaVersionUnsupported', 'The plugin config store schemaVersion 5 envelope is invalid.', parsed.rawDigest);
+    const envelope = readPluginConfigEnvelopeV6(parsed.value);
+    if (!envelope)
+        return invalidStore(options.filePath, 'schemaVersionUnsupported', 'Only a valid plugin config store schemaVersion 6 is supported. Reset the old document, then save the required values.', parsed.rawDigest);
+    if (envelope.sourceId !== options.sourceId || envelope.pluginName !== options.pluginName
+        || !options.sourceIdentity || envelope.binding.sourceIdentity !== options.sourceIdentity) {
+        return invalidStore(options.filePath, 'identityMismatch', 'The user store is not bound to the requested source and plugin identity.', parsed.rawDigest);
     }
-    if (envelope.sourceId !== options.sourceId
-        || envelope.pluginName !== options.pluginName) {
-        return invalidStore(options.filePath, 'identityMismatch', 'The store identity does not match its source and namespaced path.', parsed.rawDigest);
-    }
-    const binding = envelope.binding;
-    const matchesBinding = options.scope === 'user'
-        ? binding?.kind === 'source'
-            && typeof options.sourceIdentity === 'string'
-            && binding.sourceIdentity === options.sourceIdentity
-        : binding?.kind === 'catalog'
-            && typeof options.logicalIdentity === 'string'
-            && binding.logicalIdentity === options.logicalIdentity;
-    if (!matchesBinding) {
-        return invalidStore(options.filePath, 'identityMismatch', options.scope === 'user'
-            ? 'The user store is not bound to the requested source identity.'
-            : 'The project store is not bound to the requested Catalog logical identity.', parsed.rawDigest);
-    }
-    return validateStoreValues({
-        filePath: options.filePath,
-        values: envelope.values,
-        rawDigest: parsed.rawDigest,
-    });
+    return documentStore({ filePath: options.filePath, common: envelope.common, platforms: envelope.platforms,
+        rawDigest: parsed.rawDigest, platform: options.platform });
 }
 function namespacedConfigContent(options) {
-    const values = canonicalizePluginConfigValues(options.values);
-    if (!options.sourceId)
-        return `${JSON.stringify(values, null, 2)}\n`;
-    const binding = options.scope === 'user'
-        ? options.sourceIdentity
-            ? { kind: 'source', sourceIdentity: options.sourceIdentity }
-            : (() => { throw new Error('sourceChanged: user plugin config requires a source identity.'); })()
-        : options.logicalIdentity
-            ? { kind: 'catalog', logicalIdentity: options.logicalIdentity }
-            : (() => { throw new Error('catalogUnavailable: project plugin config requires verified Catalog logical identity evidence.'); })();
-    const envelope = {
-        schemaVersion: 5,
-        sourceId: options.sourceId,
-        pluginName: options.pluginName,
-        binding,
-        values,
-    };
-    return `${JSON.stringify(envelope, null, 2)}\n`;
-}
-async function assertNoLegacyConfigCoexistence(options) {
+    const document = { schemaVersion: 6, common: canonicalizePluginConfigValues(options.common),
+        platforms: Object.fromEntries(Object.entries(options.platforms).sort(([a], [b]) => a.localeCompare(b, 'en'))
+            .map(([platform, values]) => [platform, canonicalizePluginConfigValues(values)])) };
     if (!options.sourceId)
-        return;
-    const legacyPath = resolvePluginConfigStorePath({
-        pluginName: options.pluginName,
-        scope: options.scope,
-        cwd: options.cwd,
-        env: options.env,
-        ...(options.scope === 'project' ? { access: 'read' } : {}),
-    });
-    if (await lstatIfExists(legacyPath)) {
-        throw new Error('legacyStateUnsupported: legacy and namespaced plugin config stores cannot coexist.');
-    }
+        return `${JSON.stringify(document, null, 2)}\n`;
+    if (!options.sourceIdentity)
+        throw new Error('sourceChanged: user plugin config requires a source identity.');
+    return `${JSON.stringify({ ...document, sourceId: options.sourceId, pluginName: options.pluginName,
+        binding: { kind: 'source', sourceIdentity: options.sourceIdentity } }, null, 2)}\n`;
 }
 export async function readPluginConfigStore(options) {
     const filePath = resolvePluginConfigStorePath({
@@ -527,8 +470,9 @@ export async function readPluginConfigStore(options) {
             sourceIdentity: options.sourceIdentity,
             logicalIdentity: options.logicalIdentity,
             pluginName: options.pluginName,
+            platform: options.platform,
         })
-        : readStoreFile(filePath);
+        : readStoreFile(filePath, options.platform);
 }
 export async function readNamespacedPluginConfigStoreIdentity(options) {
     const filePath = resolvePluginConfigStorePath({
@@ -541,13 +485,13 @@ export async function readNamespacedPluginConfigStoreIdentity(options) {
     if (parsed.state === 'invalidJson') {
         throw new Error(`${parsed.store.invalidCode}: invalid namespaced plugin config store.`);
     }
-    const envelope = readPluginConfigEnvelopeV5(parsed.value, options.scope);
+    const envelope = readPluginConfigEnvelopeV6(parsed.value, options.scope);
     if (!envelope
         || envelope.sourceId !== options.sourceId
         || envelope.pluginName !== options.pluginName) {
         throw new Error('schemaVersionUnsupported: invalid namespaced plugin config store.');
     }
-    const store = validateStoreValues({ filePath, values: envelope.values });
+    const store = documentStore({ filePath, common: envelope.common, platforms: envelope.platforms, platform: options.platform });
     assertReadyPluginConfigStore(store);
     return {
         binding: envelope.binding,
@@ -578,29 +522,19 @@ async function listConfigStoreDirectoryPluginNames(storeRoot) {
     return pluginNames;
 }
 export async function listPluginConfigStorePluginNames(options) {
-    const projectRoot = resolveAwProjectRoot(options.cwd);
-    const storeRoots = options.scope === 'user'
-        ? [path.join(resolveAwHome(options.env), CONFIG_DIR)]
-        : options.scope === 'project'
-            ? [path.join(projectRoot, '.agent-workflows', CONFIG_DIR)]
-            : [
-                path.join(resolveAwHome(options.env), CONFIG_DIR),
-                path.join(projectRoot, '.agent-workflows', CONFIG_DIR),
-            ];
+    const storeRoots = [path.join(resolveAwHome(options.env), CONFIG_DIR)];
     const pluginNames = (await Promise.all(storeRoots.map((storeRoot) => listConfigStoreDirectoryPluginNames(storeRoot)))).flat();
     return [...new Set(pluginNames)].sort((left, right) => left.localeCompare(right));
 }
 export async function listNamespacedPluginConfigStoreIdentities(options) {
-    const boundaryRoot = options.scope === 'user'
-        ? resolveAwHome(options.env)
-        : resolveAwProjectRoot(options.cwd);
+    const boundaryRoot = resolveAwHome(options.env);
     if (options.scope === 'user') {
         await canonicalizePathThroughExistingAncestor(boundaryRoot);
     }
     else {
         await fs.realpath(boundaryRoot);
     }
-    const storeRoot = path.join(boundaryRoot, ...(options.scope === 'project' ? ['.agent-workflows'] : []), CONFIG_DIR);
+    const storeRoot = path.join(boundaryRoot, CONFIG_DIR);
     if (!await inspectConfigInventoryStoreRoot(boundaryRoot, storeRoot))
         return [];
     const output = [];
@@ -649,16 +583,14 @@ export async function listNamespacedPluginConfigStoreIdentities(options) {
     return output.sort((left, right) => left.pluginId.localeCompare(right.pluginId));
 }
 export async function listNamespacedPluginConfigStores(options) {
-    const boundaryRoot = options.scope === 'user'
-        ? resolveAwHome(options.env)
-        : resolveAwProjectRoot(options.cwd);
+    const boundaryRoot = resolveAwHome(options.env);
     if (options.scope === 'user') {
         await canonicalizePathThroughExistingAncestor(boundaryRoot);
     }
     else {
         await fs.realpath(boundaryRoot);
     }
-    const storeRoot = path.join(boundaryRoot, ...(options.scope === 'project' ? ['.agent-workflows'] : []), CONFIG_DIR);
+    const storeRoot = path.join(boundaryRoot, CONFIG_DIR);
     const output = [];
     if (!await inspectConfigInventoryStoreRoot(boundaryRoot, storeRoot))
         return output;
@@ -684,13 +616,13 @@ export async function listNamespacedPluginConfigStores(options) {
             if (parsed.state === 'invalidJson') {
                 throw new Error(`${parsed.store.invalidCode}: invalid namespaced plugin config store "${filePath}".`);
             }
-            const envelope = readPluginConfigEnvelopeV5(parsed.value, options.scope);
+            const envelope = readPluginConfigEnvelopeV6(parsed.value, options.scope);
             if (!envelope
                 || envelope.sourceId !== sourceId
                 || envelope.pluginName !== pluginName) {
                 throw new Error(`schemaVersionUnsupported: invalid namespaced plugin config store "${filePath}".`);
             }
-            const store = validateStoreValues({ filePath, values: envelope.values });
+            const store = documentStore({ filePath, common: envelope.common, platforms: envelope.platforms });
             assertReadyPluginConfigStore(store);
             output.push({
                 sourceId,
@@ -704,130 +636,51 @@ export async function listNamespacedPluginConfigStores(options) {
     return output.sort((left, right) => left.pluginId.localeCompare(right.pluginId));
 }
 export async function writePluginConfigStore(options) {
-    await assertNoLegacyConfigCoexistence(options);
-    const filePath = resolvePluginConfigStorePath({
-        ...options,
-        ...(options.scope === 'project' ? { access: 'write' } : {}),
-    });
-    const allowedRoot = resolvePluginConfigAllowedRoot(options);
-    const validated = validateStoreValues({ filePath, values: options.values });
+    const current = await readPluginConfigStore(options);
+    assertReadyPluginConfigStore(current);
+    const validated = validateStoreValues({ filePath: current.path, values: options.values });
     assertReadyPluginConfigStore(validated);
-    const warnings = [];
-    await withConfigFileMutation({
-        filePath,
-        allowedRoot,
-        action: async () => {
-            if (!options.sourceId && Object.keys(validated.values).length === 0) {
-                return atomicRemoveConfigFile({ filePath, allowedRoot });
-            }
-            if (options.sourceId && await lstatIfExists(filePath)) {
-                const current = await readNamespacedStoreFile({
-                    filePath,
-                    sourceId: options.sourceId,
-                    scope: options.scope,
-                    sourceIdentity: options.sourceIdentity,
-                    logicalIdentity: options.logicalIdentity,
-                    pluginName: options.pluginName,
-                });
-                assertReadyPluginConfigStore(current);
-            }
-            if (options.scope === 'project') {
-                const visibility = await assertProjectSharedConfigPathVisible({
-                    cwd: options.cwd,
-                    targetPath: filePath,
-                    env: options.env,
-                });
-                if (visibility?.state === 'unverified') {
-                    warnings.push(PROJECT_CONFIG_SHAREABILITY_UNVERIFIED_WARNING);
-                }
-            }
-            return atomicReplaceConfigFile({
-                filePath,
-                allowedRoot,
-                content: namespacedConfigContent({ ...options, values: validated.values }),
-                mode: 0o600,
-            });
-        },
-    });
-    return {
-        pluginName: options.pluginName,
-        scope: options.scope,
-        path: filePath,
-        warnings,
-    };
+    return commitPluginConfigLayer(options, current, validated.values);
 }
-export async function patchPluginConfigStore(options) {
-    await assertNoLegacyConfigCoexistence(options);
-    const filePath = resolvePluginConfigStorePath({
-        ...options,
-        ...(options.scope === 'project' ? { access: 'write' } : {}),
-    });
+async function commitPluginConfigLayer(options, current, values) {
+    const next = replacePluginConfigStoreLayer(current, values, options.platform);
     const allowedRoot = resolvePluginConfigAllowedRoot(options);
+    await withConfigFileMutation({ filePath: current.path, allowedRoot, action: async () => {
+            if (!next.exists)
+                await atomicRemoveConfigFile({ filePath: current.path, allowedRoot });
+            else
+                await atomicReplaceConfigFile({ filePath: current.path, allowedRoot,
+                    content: namespacedConfigContent({ ...options, common: next.common, platforms: next.platforms }), mode: 0o600 });
+        } });
+    return { pluginName: options.pluginName, scope: 'user', platform: options.platform, path: current.path, warnings: [] };
+}
+export async function patchPluginConfigStore(options) {
+    await options.reviewPreflight?.();
+    const current = await readPluginConfigStore(options);
+    assertReadyPluginConfigStore(current);
     const removedKeys = options.removeKeys ?? [];
-    const warnings = [];
-    await withConfigFileMutation({
-        filePath,
-        allowedRoot,
-        action: async () => {
-            await options.reviewPreflight?.();
-            const current = (await lstatIfExists(filePath))
-                ? options.sourceId
-                    ? await readNamespacedStoreFile({
-                        filePath,
-                        sourceId: options.sourceId,
-                        scope: options.scope,
-                        sourceIdentity: options.sourceIdentity,
-                        logicalIdentity: options.logicalIdentity,
-                        pluginName: options.pluginName,
-                    })
-                    : await readStoreFile(filePath)
-                : readyStore(filePath, {});
-            assertReadyPluginConfigStore(current);
-            if (options.requireExistingRemoveKeys) {
-                const missingKey = removedKeys.find((key) => !Object.hasOwn(current.values, key));
-                if (missingKey)
-                    throw new Error(`Unknown config key "${missingKey}".`);
-            }
-            const next = { ...current.values };
-            for (const key of removedKeys) {
-                delete next[key];
-            }
-            for (const [key, value] of Object.entries(options.updates)) {
-                next[key] = value;
-            }
-            if (Object.keys(next).length === 0) {
-                await atomicRemoveConfigFile({ filePath, allowedRoot });
-            }
-            else {
-                if (options.scope === 'project') {
-                    const visibility = await assertProjectSharedConfigPathVisible({
-                        cwd: options.cwd,
-                        targetPath: filePath,
-                        env: options.env,
-                    });
-                    if (visibility?.state === 'unverified') {
-                        warnings.push(PROJECT_CONFIG_SHAREABILITY_UNVERIFIED_WARNING);
-                    }
-                }
-                await atomicReplaceConfigFile({
-                    filePath,
-                    allowedRoot,
-                    content: namespacedConfigContent({ ...options, values: next }),
-                    mode: 0o600,
-                });
-            }
-        },
-    });
-    return {
-        pluginName: options.pluginName,
-        scope: options.scope,
-        path: filePath,
-        warnings,
-        updatedKeys: Object.keys(options.updates),
-        removedKeys,
-    };
+    if (options.requireExistingRemoveKeys) {
+        const missing = removedKeys.find((key) => !Object.hasOwn(current.values, key));
+        if (missing)
+            throw new Error(`Unknown config key "${missing}".`);
+    }
+    const next = Object.assign(Object.create(null), current.values);
+    for (const key of removedKeys)
+        delete next[key];
+    for (const [key, value] of Object.entries(options.updates))
+        next[key] = value;
+    const validated = validateStoreValues({ filePath: current.path, values: next });
+    assertReadyPluginConfigStore(validated);
+    return { ...await commitPluginConfigLayer(options, current, validated.values), updatedKeys: Object.keys(options.updates), removedKeys };
 }
 export async function resetPluginConfigStore(options) {
+    return resetPluginConfigStoreTarget(options, false);
+}
+/** Delete the plugin's complete user document, including every platform profile. */
+export async function deletePluginConfigStore(options) {
+    return resetPluginConfigStoreTarget(options, true);
+}
+async function resetPluginConfigStoreTarget(options, wholeDocument) {
     const filePath = resolvePluginConfigStorePath({
         ...options,
         ...(options.scope === 'project' ? { access: 'write' } : {}),
@@ -846,8 +699,8 @@ export async function resetPluginConfigStore(options) {
             if (!stats) {
                 return {
                     pluginName: options.pluginName,
-                    scope: options.scope,
-                    storeKind: options.scope,
+                    scope: 'user',
+                    storeKind: 'user',
                     path: filePath,
                     existed: false,
                     deleted: false,
@@ -863,8 +716,8 @@ export async function resetPluginConfigStore(options) {
         if (!parentStats) {
             return {
                 pluginName: options.pluginName,
-                scope: options.scope,
-                storeKind: options.scope,
+                scope: 'user',
+                storeKind: 'user',
                 path: filePath,
                 existed: false,
                 deleted: false,
@@ -879,21 +732,35 @@ export async function resetPluginConfigStore(options) {
         if (!target) {
             return {
                 pluginName: options.pluginName,
-                scope: options.scope,
-                storeKind: options.scope,
+                scope: 'user',
+                storeKind: 'user',
                 path: filePath,
                 existed: false,
                 deleted: false,
                 resetDisposition: 'absent',
             };
         }
+        let store;
+        if (target.isFile()) {
+            try {
+                store = await readPluginConfigStore(options);
+            }
+            catch {
+                // A broken document still has the schema-independent reset recovery below.
+            }
+        }
+        if (!wholeDocument && store && store.state !== 'invalid' && replacePluginConfigStoreLayer(store, {}, options.platform).exists) {
+            await commitPluginConfigLayer(options, store, {});
+            return { pluginName: options.pluginName, scope: 'user', platform: options.platform, storeKind: 'user',
+                path: filePath, existed: true, deleted: false, resetDisposition: 'clearedLayer' };
+        }
         if (target.isFile() || target.isSymbolicLink()) {
             await assertNoConfigSymlink(allowedRoot, path.dirname(filePath));
             await nodeFs.unlink(filePath);
             return {
                 pluginName: options.pluginName,
-                scope: options.scope,
-                storeKind: options.scope,
+                scope: 'user',
+                storeKind: 'user',
                 path: filePath,
                 existed: true,
                 deleted: true,
@@ -907,8 +774,8 @@ export async function resetPluginConfigStore(options) {
             await nodeFs.rename(filePath, path.join(path.dirname(filePath), quarantineBasename));
             return {
                 pluginName: options.pluginName,
-                scope: options.scope,
-                storeKind: options.scope,
+                scope: 'user',
+                storeKind: 'user',
                 path: filePath,
                 existed: true,
                 deleted: true,
@@ -982,41 +849,7 @@ function resetTargetInspection(kind, stats) {
     };
 }
 export async function resetPluginConfigStores(options) {
-    await assertNoLegacyConfigCoexistence(options);
-    const targets = resolvePluginConfigStoreTargets({
-        ...options,
-        ...(options.scope === 'project' ? { access: 'write' } : {}),
-    });
-    const allowedRoot = resolvePluginConfigAllowedRoot(options);
-    const receipts = [];
-    const existing = [];
-    for (const target of targets) {
-        await prepareConfigFileParent(target.path, allowedRoot);
-        await assertNoConfigSymlink(allowedRoot, target.path);
-        const stats = await lstatIfExists(target.path);
-        existing.push(stats !== null);
-        if (!stats)
-            continue;
-        if (!stats.isFile() || stats.isSymbolicLink()) {
-            throw new Error(`Config target must be a regular file: ${target.path}`);
-        }
-    }
-    for (const [index, target] of targets.entries()) {
-        const deleted = await atomicRemoveConfigFile({
-            filePath: target.path,
-            allowedRoot,
-        });
-        receipts.push({
-            pluginName: options.pluginName,
-            scope: options.scope,
-            storeKind: target.storeKind,
-            path: target.path,
-            existed: existing[index],
-            deleted,
-            resetDisposition: deleted ? 'deletedFile' : 'absent',
-        });
-    }
-    return receipts;
+    return [await resetPluginConfigStore(options)];
 }
 function coerceConfigValue(key, field, value) {
     let coerced = value;
@@ -1039,19 +872,9 @@ function coerceConfigValue(key, field, value) {
 export async function coercePluginConfigValue(options) {
     return coerceConfigValue(options.key, options.field, options.value);
 }
-function validateConfigReadValue(key, field, value) {
-    const issues = validateCorePluginConfigValue(field, value, key);
-    if (issues.length > 0) {
-        throw new Error(formatPluginConfigIssue(issues[0]));
-    }
-    return value;
-}
 function redactValue(field, value) {
     return redactPluginConfigValue(field, value);
 }
-function sourceForStoreLayer(scope) {
-    return scope === 'user' ? 'user' : 'project';
-}
 async function applyConfigLayer(options) {
     for (const [key, field] of Object.entries(options.schema)) {
         if (!Object.hasOwn(options.entries, key)) {
@@ -1087,65 +910,25 @@ async function applyConfigLayer(options) {
     }
 }
 export async function resolveEffectivePluginConfig(options) {
+    const workContext = options.context ? await resolveWorkContext({ cwd: options.cwd, context: options.context }) : undefined;
     const pluginName = assertSafePluginConfigSegment(options.pluginName ?? options.manifest.name);
-    const schema = options.manifest.config?.fields;
-    if (!schema) {
-        throw new Error(`Plugin "${pluginName}" does not declare an AW config schema.`);
-    }
-    const projectRoot = resolveAwProjectRoot(options.cwd);
-    const userStore = await readPluginConfigStore({
-        sourceId: options.sourceId,
-        sourceIdentity: options.sourceIdentity,
-        logicalIdentity: options.logicalIdentity,
-        pluginName,
-        scope: 'user',
-        cwd: options.cwd,
-        env: options.env,
-    });
-    const projectStore = options.targetScope === 'user'
-        ? undefined
-        : await readPluginConfigStore({
-            sourceId: options.sourceId,
-            sourceIdentity: options.sourceIdentity,
-            logicalIdentity: options.logicalIdentity,
-            pluginName,
-            scope: 'project',
-            cwd: options.cwd,
-            env: options.env,
-        });
-    assertReadyPluginConfigStore(userStore);
-    if (projectStore)
-        assertReadyPluginConfigStore(projectStore);
+    const user = await readPluginConfigStore({ ...options, pluginName, scope: 'user' });
+    assertReadyPluginConfigStore(user);
     const references = !options.referenceContext && pluginConfigHasExternalReferences(options.manifest)
-        ? await resolvePluginConfigReferenceContext({ ...options, scope: options.targetScope ?? 'project', plugins: options.referencePlugins })
-        : undefined;
-    return resolveEffectivePluginConfigFromStores({
-        pluginName,
-        manifest: options.manifest,
-        targetScope: options.targetScope,
-        projectRoot,
-        referenceContext: options.referenceContext ?? references?.context,
-        referenceEvidence: references?.evidence,
-        stores: {
-            user: userStore,
-            ...(projectStore ? { project: projectStore } : {}),
-        },
-    });
+        ? await resolvePluginConfigReferenceContext({ ...options, scope: options.context ?? options.targetScope ?? 'user', plugins: options.referencePlugins }) : undefined;
+    return resolveEffectivePluginConfigFromStores({ ...options, pluginName, projectRoot: workContext?.projectRoot ?? ((options.context ?? options.targetScope) === 'project' ? resolveAwProjectRoot(options.cwd) : ''),
+        referenceContext: options.referenceContext ?? references?.context, referenceEvidence: references?.evidence,
+        stores: { user } });
 }
 export async function resolveEffectivePluginConfigFromStores(options) {
     const pluginName = assertSafePluginConfigSegment(options.pluginName ?? options.manifest.name);
-    const schema = options.manifest.config?.fields;
+    const definition = options.manifest.config ? compilePluginConfigDefinition(options.manifest.config, options.platform) : undefined;
+    const schema = definition?.fields;
     if (!schema) {
-        throw new Error(`Plugin "${pluginName}" does not declare an AW config schema.`);
+        throw new PluginConfigSchemaResolutionError('configSchemaUnavailable', `Plugin "${pluginName}" does not declare an AW config schema.`);
     }
     const userStore = options.stores.user;
-    const projectStore = options.targetScope === 'user' ? undefined : options.stores.project;
     assertReadyPluginConfigStore(userStore);
-    if (!projectStore && options.targetScope !== 'user') {
-        throw new Error(`Project plugin config store is required for ${pluginName}.`);
-    }
-    if (projectStore)
-        assertReadyPluginConfigStore(projectStore);
     const values = {};
     const redactedValues = {};
     const sources = {};
@@ -1154,7 +937,6 @@ export async function resolveEffectivePluginConfigFromStores(options) {
     const unsupportedLayerOverrides = [];
     const dangerousKeyIssues = [];
     const schemaKeys = new Set(Object.keys(schema));
-    const userOnlyKeys = codexNativeRefreshKeys(options.manifest);
     for (const key of schemaKeys) {
         sources[key] = 'missing';
     }
@@ -1172,54 +954,31 @@ export async function resolveEffectivePluginConfigFromStores(options) {
             source: 'default',
         });
     }
-    const layers = options.targetScope === 'user'
-        ? [['user', userStore]]
-        : [
-            ['user', userStore],
-            ['project', projectStore],
-        ];
-    for (const [scope, store] of layers) {
-        const plainEntries = getStoreEntries(store.values);
-        const source = sourceForStoreLayer(scope);
-        const dangerousIssues = new Map(validatePluginConfigDocument(options.manifest.config, plainEntries).filter((issue) => issue.code === 'dangerousKey')
-            .map((issue) => [issue.path.field, issue]));
+    const layers = [
+        { entries: userStore.common ?? userStore.values, source: 'common' },
+        ...(options.platform ? [{ entries: userStore.platforms?.[options.platform] ?? {}, source: 'platform' }] : []),
+    ];
+    for (const { entries, source } of layers) {
+        const plainEntries = getStoreEntries(entries);
+        const dangerousIssues = new Map(validatePluginConfigDocument(definition, plainEntries)
+            .filter((issue) => issue.code === 'dangerousKey').map((issue) => [issue.path.field, issue]));
         for (const key of Object.keys(plainEntries)) {
-            if (!schemaKeys.has(key)) {
-                const dangerousIssue = dangerousIssues.get(key);
-                if (dangerousIssue) {
-                    dangerousKeyIssues.push({
-                        type: 'invalid-config',
-                        code: dangerousIssue.code,
-                        key,
-                        source,
-                        message: formatPluginConfigIssue(dangerousIssue),
-                    });
-                }
-                else {
-                    ignoredUnknownKeys.push({ scope, source, key });
-                }
-            }
+            if (schemaKeys.has(key))
+                continue;
+            const dangerousIssue = dangerousIssues.get(key);
+            if (dangerousIssue)
+                dangerousKeyIssues.push({ type: 'invalid-config', code: dangerousIssue.code,
+                    key, source, message: formatPluginConfigIssue(dangerousIssue) });
+            else
+                ignoredUnknownKeys.push({ scope: 'user', source, key });
         }
-        const supportedEntries = scope === 'project'
-            ? Object.fromEntries(Object.entries(plainEntries).filter(([key]) => {
-                if (!schemaKeys.has(key) || !userOnlyKeys.has(key))
-                    return true;
-                unsupportedLayerOverrides.push({
-                    type: 'configLayerUnsupported',
-                    key,
-                    scope: 'project',
-                    source: 'project',
-                });
-                return false;
-            }))
-            : plainEntries;
         await applyConfigLayer({
             values,
             redactedValues,
             sources,
             fieldStates,
             schema,
-            entries: supportedEntries,
+            entries: plainEntries,
             source,
         });
     }
@@ -1228,12 +987,12 @@ export async function resolveEffectivePluginConfigFromStores(options) {
         const source = sources[key];
         if (source === 'default')
             candidateValues[key] = field.default;
-        if (source === 'user')
-            candidateValues[key] = ownStoreValue(userStore.values, key);
-        if (source === 'project' && projectStore)
-            candidateValues[key] = ownStoreValue(projectStore.values, key);
+        if (source === 'common')
+            candidateValues[key] = ownStoreValue(userStore.common ?? userStore.values, key);
+        if (source === 'platform' && options.platform)
+            candidateValues[key] = ownStoreValue(userStore.platforms?.[options.platform] ?? {}, key);
     }
-    const candidateIssues = validatePluginConfigCandidate(options.manifest.config, candidateValues, undefined, options.referenceContext);
+    const candidateIssues = validatePluginConfigCandidate(definition, candidateValues, undefined, options.referenceContext);
     const referenceIssues = candidateIssues.filter((issue) => issue.code.startsWith('valueRef')
         && (!issue.path.plugin || issue.path.plugin === pluginName));
     const missingReferenceIssues = [];
@@ -1263,7 +1022,7 @@ export async function resolveEffectivePluginConfigFromStores(options) {
             for (const key of schemaKeys) {
                 let dependencies;
                 try {
-                    dependencies = getPluginConfigDependencyFields(options.manifest.config, [key], options.referenceContext);
+                    dependencies = getPluginConfigDependencyFields(definition, [key], options.referenceContext);
                 }
                 catch {
                     continue; // The local association issue already reports the invalid schema.
@@ -1294,7 +1053,7 @@ export async function resolveEffectivePluginConfigFromStores(options) {
     for (const key of schemaKeys) {
         if (invalidKeys.has(key))
             continue;
-        const dependency = getPluginConfigDependencyKeys(options.manifest.config, [key])
+        const dependency = getPluginConfigDependencyKeys(definition, [key])
             .find((dependencyKey) => dependencyKey !== key && invalidKeys.has(dependencyKey));
         if (dependency === undefined)
             continue;
@@ -1333,6 +1092,9 @@ export async function resolveEffectivePluginConfigFromStores(options) {
     }
     return {
         pluginName,
+        platform: options.platform,
+        context: options.context ?? options.targetScope ?? 'user',
+        definition: definition,
         projectRoot: options.projectRoot,
         values,
         redactedValues,
@@ -1344,7 +1106,6 @@ export async function resolveEffectivePluginConfigFromStores(options) {
         schema,
         stores: {
             user: userStore,
-            ...(projectStore ? { project: projectStore } : {}),
         },
         ...(options.referenceContext ? { referenceContext: options.referenceContext } : {}),
         ...(options.referenceEvidence ? { referenceEvidence: options.referenceEvidence } : {}),
@@ -1356,43 +1117,26 @@ function ownStoreValue(values, key) {
 /** Check cross-field relations before saving one complete layer candidate. */
 export async function assertPluginConfigMutationCandidate(options) {
     const user = await readPluginConfigStore({ ...options, scope: 'user' });
-    const project = options.scope === 'project'
-        ? await readPluginConfigStore({ ...options, scope: 'project' })
-        : undefined;
     assertReadyPluginConfigStore(user);
-    if (project)
-        assertReadyPluginConfigStore(project);
-    const edited = options.scope === 'user' ? user : project;
-    const values = { ...edited.values };
+    const values = { ...user.values };
     for (const key of options.removeKeys)
         delete values[key];
     for (const [key, value] of Object.entries(options.updates))
         values[key] = value;
-    const candidateStore = { ...edited, values };
-    const references = pluginConfigHasExternalReferences(options.manifest)
-        ? await resolvePluginConfigReferenceContext({ ...options, plugins: options.referencePlugins }) : undefined;
-    const effective = await resolveEffectivePluginConfigFromStores({
-        pluginName: options.pluginName,
-        manifest: options.manifest,
-        targetScope: options.scope,
-        projectRoot: resolveAwProjectRoot(options.cwd),
-        referenceContext: references?.context,
-        stores: {
-            user: options.scope === 'user' ? candidateStore : user,
-            ...(project ? { project: candidateStore } : {}),
-        },
-    });
-    const before = await resolveEffectivePluginConfigFromStores({ manifest: options.manifest,
-        targetScope: options.scope, projectRoot: resolveAwProjectRoot(options.cwd),
-        stores: { user, ...(project ? { project } : {}) }, referenceContext: references?.context });
-    const existingIssues = new Set(before.issues.map((issue) => `${issue.key}\0${issue.code}\0${issue.message}`));
-    const editedKeys = new Set([...Object.keys(options.updates), ...options.removeKeys]);
-    const issues = effective.issues.filter((issue) => issue.code?.startsWith('valueRef')
-        && (editedKeys.has(issue.key) || !existingIssues.has(`${issue.key}\0${issue.code}\0${issue.message}`)));
-    if (issues.length > 0) {
-        throw Object.assign(new Error(`configReferenceInvalid: ${issues.map((issue) => issue.message).join(' ')}`), {
-            code: 'configReferenceInvalid',
-        });
+    const candidate = replacePluginConfigStoreLayer(user, values, options.platform);
+    const profiles = options.platform ? [options.platform] : [undefined, ...PLATFORM_TARGETS];
+    for (const platform of profiles) {
+        const references = pluginConfigHasExternalReferences(options.manifest)
+            ? await resolvePluginConfigReferenceContext({ ...options, platform, plugins: options.referencePlugins }) : undefined;
+        const resolve = (store) => resolveEffectivePluginConfigFromStores({ ...options, platform,
+            targetScope: options.scope, projectRoot: options.scope === 'project' ? resolveAwProjectRoot(options.cwd) : '', stores: { user: store }, referenceContext: references?.context });
+        const [before, after] = await Promise.all([resolve(user), resolve(candidate)]);
+        const existing = new Set(before.issues.map((issue) => `${issue.key}\0${issue.code}\0${issue.message}`));
+        const editedKeys = new Set([...Object.keys(options.updates), ...options.removeKeys]);
+        const issues = after.issues.filter((issue) => (editedKeys.has(issue.key) && Object.hasOwn(options.updates, issue.key))
+            || !existing.has(`${issue.key}\0${issue.code}\0${issue.message}`));
+        if (issues.length)
+            throw Object.assign(new Error(`configReferenceInvalid: ${platform ?? 'common'}: ${issues.map((issue) => issue.message).join(' ')}`), { code: 'configReferenceInvalid' });
     }
 }
 export async function coercePluginConfigUpdates(options) {
@@ -1414,7 +1158,7 @@ export async function coercePluginConfigUpdates(options) {
 export async function resolveProjectArtifactRenderConfig(options) {
     if (!options.manifest.config?.fields) {
         const pluginName = assertSafePluginConfigSegment(options.pluginName ?? options.manifest.name);
-        const [userStore, projectStore] = await Promise.all([
+        const [userStore] = await Promise.all([
             readPluginConfigStore({
                 sourceId: options.sourceId,
                 sourceIdentity: options.sourceIdentity,
@@ -1424,18 +1168,8 @@ export async function resolveProjectArtifactRenderConfig(options) {
                 cwd: options.cwd,
                 env: options.env,
             }),
-            readPluginConfigStore({
-                sourceId: options.sourceId,
-                sourceIdentity: options.sourceIdentity,
-                logicalIdentity: options.logicalIdentity,
-                pluginName,
-                scope: 'project',
-                cwd: options.cwd,
-                env: options.env,
-            }),
         ]);
         assertReadyPluginConfigStore(userStore);
-        assertReadyPluginConfigStore(projectStore);
         return {
             pluginName,
             projectRoot: resolveAwProjectRoot(options.cwd),
@@ -1445,7 +1179,7 @@ export async function resolveProjectArtifactRenderConfig(options) {
             unsupportedLayerOverrides: [],
             ignoredUnknownKeys: [],
             schema: {},
-            stores: { user: userStore, project: projectStore },
+            stores: { user: userStore },
         };
     }
     const effective = await resolveEffectivePluginConfig({
@@ -1463,101 +1197,11 @@ export async function resolveProjectArtifactRenderConfig(options) {
         schema: effective.schema,
         stores: {
             user: effective.stores.user,
-            project: effective.stores.project,
-        },
-    };
-}
-async function resolveRedactedLayerValue(options) {
-    try {
-        const value = validateConfigReadValue(options.key, options.field, options.value);
-        return {
-            value: redactValue(options.field, value),
-        };
-    }
-    catch (error) {
-        return {
-            issue: {
-                type: 'invalid-config',
-                key: options.key,
-                source: options.source,
-                message: error instanceof Error ? error.message : String(error),
-            },
-        };
-    }
-}
-export async function resolveProjectScopedPluginConfigView(options) {
-    const effective = await resolveEffectivePluginConfig(options);
-    const entries = {};
-    for (const [key, field] of Object.entries(effective.schema)) {
-        const entry = {
-            key,
-            effectiveValue: effective.redactedValues[key],
-            effectiveSource: effective.sources[key] ?? 'missing',
-        };
-        if (field.default !== undefined) {
-            const resolvedDefault = await resolveRedactedLayerValue({
-                key,
-                field,
-                source: 'default',
-                value: field.default,
-            });
-            if (resolvedDefault.value !== undefined) {
-                entry.defaultValue = resolvedDefault.value;
-            }
-        }
-        const userPlainEntries = getStoreEntries(effective.stores.user.values);
-        if (Object.hasOwn(userPlainEntries, key)) {
-            const resolvedUser = await resolveRedactedLayerValue({
-                key,
-                field,
-                source: 'user',
-                value: userPlainEntries[key],
-            });
-            if (resolvedUser.value !== undefined) {
-                entry.userValue = resolvedUser.value;
-            }
-        }
-        const projectPlainEntries = getStoreEntries(effective.stores.project.values);
-        if (Object.hasOwn(projectPlainEntries, key)) {
-            const resolvedProject = await resolveRedactedLayerValue({
-                key,
-                field,
-                source: 'project',
-                value: projectPlainEntries[key],
-            });
-            if (resolvedProject.value !== undefined) {
-                entry.projectValue = resolvedProject.value;
-            }
-        }
-        entries[key] = entry;
-    }
-    return {
-        pluginName: effective.pluginName,
-        projectRoot: effective.projectRoot,
-        schema: effective.schema,
-        stores: {
-            user: effective.stores.user,
-            project: effective.stores.project,
         },
-        redactedValues: effective.redactedValues,
-        sources: effective.sources,
-        entries,
-        issues: effective.issues,
-        unsupportedLayerOverrides: effective.unsupportedLayerOverrides,
-        ignoredUnknownKeys: effective.ignoredUnknownKeys,
     };
 }
 function toConfigSourceLayer(source) {
-    if (source === 'default') {
-        return 'default';
-    }
-    if (source === 'user') {
-        return 'user';
-    }
-    if (source === 'project') {
-        return 'project';
-    }
-    return null;
+    return source === undefined || source === 'missing' ? null : source;
 }
 function configFieldProjection(options) {
     const source = options.source ?? 'missing';
@@ -1578,265 +1222,74 @@ function configFieldProjection(options) {
     };
 }
 async function buildManifestFieldEntries(options) {
-    const schema = options.plugin.manifest.config?.fields;
-    if (!schema) {
-        return [];
-    }
-    const userStore = await readPluginConfigStore({
-        sourceId: options.plugin.sourceId,
-        sourceIdentity: options.plugin.sourceIdentity,
-        logicalIdentity: options.plugin.catalogLogicalIdentity,
-        pluginName: options.plugin.manifest.name,
-        scope: 'user',
-        cwd: options.cwd,
-        env: options.env,
-        schema,
-    });
-    const projectStore = options.scope === 'user'
-        ? undefined
-        : await readPluginConfigStore({
-            sourceId: options.plugin.sourceId,
-            sourceIdentity: options.plugin.sourceIdentity,
-            logicalIdentity: options.plugin.catalogLogicalIdentity,
-            pluginName: options.plugin.manifest.name,
-            scope: 'project',
-            cwd: options.cwd,
-            env: options.env,
-            schema,
-        });
-    assertReadyPluginConfigStore(userStore);
-    if (projectStore)
-        assertReadyPluginConfigStore(projectStore);
-    const userPlainEntries = getStoreEntries(userStore.values);
-    const projectPlainEntries = projectStore ? getStoreEntries(projectStore.values) : {};
     const effective = await resolveEffectivePluginConfig({
         sourceId: options.plugin.sourceId,
         sourceIdentity: options.plugin.sourceIdentity,
         logicalIdentity: options.plugin.catalogLogicalIdentity,
-        pluginName: options.plugin.manifest.name,
         manifest: options.plugin.manifest,
-        targetScope: options.scope === 'user' ? 'user' : 'project',
+        platform: options.platform,
+        targetScope: options.context ?? (options.scope === 'project' ? 'project' : 'user'),
         cwd: options.cwd,
         env: options.env,
     });
-    const userOnlyKeys = codexNativeRefreshKeys(options.plugin.manifest);
-    const projectRemovalFallback = (key) => {
-        const field = schema[key];
-        if (Object.hasOwn(userPlainEntries, key)) {
-            const value = userPlainEntries[key];
-            const validationIssues = validateCorePluginConfigValue(field, value, key);
-            if (validationIssues.length > 0) {
-                return {
-                    state: 'invalid',
-                    sourceLayer: 'user',
-                    issues: validationIssues.map((issue) => ({
-                        type: 'invalid-config',
-                        key,
-                        source: 'user',
-                        message: formatPluginConfigIssue(issue),
-                    })),
-                };
-            }
-            return {
-                state: 'valid',
-                effectiveValue: redactValue(field, value),
-                sourceLayer: 'user',
-            };
-        }
-        if (field.default === undefined)
-            return { state: 'missing' };
-        const validationIssues = validateCorePluginConfigValue(field, field.default, key);
-        if (validationIssues.length > 0) {
-            return {
-                state: 'invalid',
-                sourceLayer: 'default',
-                issues: validationIssues.map((issue) => ({
-                    type: 'invalid-config',
-                    key,
-                    source: 'default',
-                    message: formatPluginConfigIssue(issue),
-                })),
-            };
-        }
-        return {
-            state: 'valid',
-            effectiveValue: redactValue(field, field.default),
-            sourceLayer: 'default',
-        };
-    };
-    const effectiveFieldState = (key) => {
-        const source = effective.sources[key];
-        const sourceLayer = toConfigSourceLayer(source);
-        const field = schema[key];
-        const fieldIssues = effective.issues.filter((entry) => entry.key === key);
-        const fieldState = effective.fieldStates[key];
-        const fallback = options.scope === 'project'
-            ? projectRemovalFallback(key)
-            : fieldState?.fallback
-                ? {
-                    state: 'valid',
-                    effectiveValue: fieldState.fallback.redactedValue,
-                    sourceLayer: fieldState.fallback.source,
-                }
-                : undefined;
-        if (source === undefined || source === 'missing') {
-            return {
-                valueState: fieldIssues.length > 0 ? 'invalid' : 'default',
-                effectiveValue: null,
-                sourceLayer: null,
-                ...configFieldProjection({ field, source: 'missing', issues: fieldIssues }),
-            };
+    const stored = pluginConfigStoreForProfile(effective.stores.user, options.platform).values;
+    const fields = await Promise.all(Object.entries(effective.schema).map(async ([key, field]) => {
+        const state = effective.fieldStates[key];
+        const source = effective.sources[key] ?? 'missing';
+        const issues = effective.issues.filter((issue) => issue.key === key);
+        const hasStored = Object.hasOwn(stored, key);
+        const storedSourceLayer = options.platform ? 'platform' : 'common';
+        let fallback;
+        if (hasStored) {
+            const inherited = { ...stored };
+            delete inherited[key];
+            const withoutOverride = await resolveEffectivePluginConfigFromStores({
+                manifest: options.plugin.manifest,
+                platform: options.platform,
+                projectRoot: effective.projectRoot,
+                stores: { user: replacePluginConfigStoreLayer(effective.stores.user, inherited, options.platform) },
+                referenceContext: effective.referenceContext,
+            });
+            const fallbackIssues = withoutOverride.issues.filter((issue) => issue.key === key);
+            const fallbackSource = withoutOverride.sources[key];
+            fallback = fallbackSource === 'missing' || fallbackSource === undefined
+                ? { state: 'missing' }
+                : fallbackIssues.length
+                    ? { state: 'invalid', sourceLayer: fallbackSource, issues: fallbackIssues }
+                    : { state: 'valid', sourceLayer: fallbackSource, effectiveValue: withoutOverride.redactedValues[key] };
         }
-        const issue = fieldIssues.find((entry) => entry.source === source);
         return {
-            valueState: issue ? 'invalid' : source === 'default' ? 'default' : 'configured',
-            effectiveValue: issue ? null : effective.redactedValues[key] ?? null,
-            sourceLayer,
-            ...(fieldState?.invalidOverride ? {
-                invalidOverride: {
-                    sourceLayer: fieldState.invalidOverride.source,
-                    issues: fieldState.invalidOverride.issues,
-                },
-            } : {}),
-            ...(fallback ? { fallback } : {}),
-            ...configFieldProjection({
-                field,
-                value: issue ? undefined : effective.values[key],
-                source,
-                issues: fieldIssues,
-            }),
-        };
-    };
-    const fields = [];
-    for (const [key, field] of Object.entries(schema)) {
-        const canSet = options.scope !== 'project'
-            || (!userOnlyKeys.has(key) && field.sensitive !== true);
-        const base = {
             key,
             title: field.title ?? key,
             kind: 'manifest',
             reserved: false,
-            writable: canSet,
-            canSet,
-            canUnset: options.scope === 'user'
-                ? Object.hasOwn(userPlainEntries, key)
-                : options.scope === 'project' && Object.hasOwn(projectPlainEntries, key),
-            valueState: 'default',
-            effectiveValue: null,
-            sourceLayer: null,
-            ...configFieldProjection({ field }),
+            writable: true,
+            canSet: true,
+            canUnset: hasStored,
+            valueState: issues.length ? 'invalid' : source === 'default' || source === 'missing' ? 'default' : 'configured',
+            effectiveValue: effective.redactedValues[key] ?? null,
+            sourceLayer: toConfigSourceLayer(source),
+            ...(hasStored ? { storedSourceLayer, ...(validateCorePluginConfigValue(field, stored[key], key).length
+                    ? {} : { storedValue: redactValue(field, stored[key]) }) } : {}),
+            ...(state?.invalidOverride ? { invalidOverride: { sourceLayer: state.invalidOverride.source, issues: state.invalidOverride.issues } } : {}),
+            ...(fallback ? { fallback } : {}),
+            ...configFieldProjection({ field, value: effective.values[key], source, issues }),
         };
-        if (options.scope === 'user') {
-            if (Object.hasOwn(userPlainEntries, key)) {
-                try {
-                    const value = validateConfigReadValue(key, field, userPlainEntries[key]);
-                    fields.push({
-                        ...base,
-                        valueState: 'configured',
-                        effectiveValue: redactValue(field, value),
-                        sourceLayer: 'user',
-                        storedValue: redactValue(field, value),
-                        storedSourceLayer: 'user',
-                        ...configFieldProjection({ field, value, source: 'user' }),
-                    });
-                }
-                catch {
-                    fields.push({
-                        ...base,
-                        valueState: 'invalid',
-                        sourceLayer: 'user',
-                        source: 'user',
-                        storedSourceLayer: 'user',
-                        valid: false,
-                        issues: [{ type: 'invalid-config', key, source: 'user' }],
-                    });
-                }
-                continue;
-            }
-            if (field.default !== undefined) {
-                try {
-                    const value = validateConfigReadValue(key, field, field.default);
-                    fields.push({
-                        ...base,
-                        effectiveValue: redactValue(field, value),
-                        sourceLayer: 'default',
-                        ...configFieldProjection({ field, value, source: 'default' }),
-                    });
-                }
-                catch {
-                    fields.push({
-                        ...base,
-                        valueState: 'invalid',
-                        sourceLayer: 'default',
-                        source: 'default',
-                        valid: false,
-                        issues: [{ type: 'invalid-config', key, source: 'default' }],
-                    });
-                }
-                continue;
-            }
-            fields.push(base);
-            continue;
-        }
-        let storedProjectValue;
-        if (options.scope === 'project' && Object.hasOwn(projectPlainEntries, key)) {
-            try {
-                const value = validateConfigReadValue(key, field, projectPlainEntries[key]);
-                storedProjectValue = {
-                    storedValue: redactValue(field, value),
-                    storedSourceLayer: 'project',
-                };
-            }
-            catch {
-                storedProjectValue = { storedSourceLayer: 'project' };
-            }
-        }
-        fields.push({ ...base, ...effectiveFieldState(key), ...storedProjectValue });
+    }));
+    for (const key of Object.keys(stored).filter((key) => !Object.hasOwn(effective.schema, key)).sort()) {
+        const source = options.platform ? 'platform' : 'common';
+        fields.push({ key, title: key, kind: 'manifest', reserved: false, writable: false, canSet: false, canUnset: true,
+            valueState: 'configured', effectiveValue: '[redacted]', sourceLayer: source, storedSourceLayer: source,
+            value: '[redacted]', source, matchedPreset: null, valid: false, issues: [] });
     }
     return fields;
 }
 async function buildLegacyStoreFieldEntries(options) {
-    const locations = options.scope === 'effective'
-        ? [
-            { scope: 'user', sourceLayer: 'user' },
-            { scope: 'project', sourceLayer: 'project' },
-        ]
-        : [{
-                scope: options.scope,
-                sourceLayer: options.scope === 'user' ? 'user' : 'project',
-            }];
-    const fields = new Map();
-    for (const location of locations) {
-        const store = await readPluginConfigStore({
-            sourceId: options.sourceId,
-            sourceIdentity: options.sourceIdentity,
-            logicalIdentity: options.logicalIdentity,
-            pluginName: options.pluginName,
-            scope: location.scope,
-            cwd: options.cwd,
-            env: options.env,
-        });
-        for (const key of Object.keys(store.values)) {
-            fields.set(key, {
-                key,
-                title: key,
-                kind: 'manifest',
-                reserved: false,
-                writable: false,
-                canSet: false,
-                canUnset: false,
-                valueState: 'configured',
-                effectiveValue: '[redacted]',
-                sourceLayer: location.sourceLayer,
-                value: '[redacted]',
-                source: location.sourceLayer,
-                matchedPreset: null,
-                valid: true,
-                issues: [],
-            });
-        }
-    }
-    return [...fields.values()].sort((left, right) => left.key.localeCompare(right.key));
+    const store = await readPluginConfigStore({ ...options, scope: 'user' });
+    const source = options.platform ? 'platform' : 'common';
+    return Object.keys(store.values).sort().map((key) => ({ key, title: key, kind: 'manifest', reserved: false,
+        writable: false, canSet: false, canUnset: true, valueState: 'configured', effectiveValue: '[redacted]',
+        sourceLayer: source, value: '[redacted]', source, matchedPreset: null, valid: true, issues: [] }));
 }
 export async function resolvePluginConfigSchemaAccess(options) {
     const pluginName = assertSafePluginConfigSegment(options.pluginName);
@@ -1852,15 +1305,18 @@ export async function resolvePluginConfigSchemaAccess(options) {
     return {
         pluginName,
         plugin: options.currentPlugin,
-        schema: createConfigSchemaEvidenceFromCurrentCatalog(options.currentPlugin, await calculateConfigSchemaManifestDigestForPlugin(options.currentPlugin)),
+        schema: createConfigSchemaEvidenceFromCurrentCatalog(options.currentPlugin, await calculateConfigSchemaManifestDigestForPlugin(options.currentPlugin), options.platform),
     };
 }
 export async function resolveConfigRead(options) {
+    if (options.context)
+        await resolveWorkContext({ cwd: options.cwd, context: options.context });
     const pluginName = assertSafePluginConfigSegment(options.pluginName);
     const schemaAccess = await resolvePluginConfigSchemaAccess({
         pluginName,
         currentPlugin: options.plugin,
         currentPluginError: options.pluginError,
+        platform: options.platform,
         scope: options.scope,
         cwd: options.cwd,
         env: options.env,
@@ -1868,6 +1324,8 @@ export async function resolveConfigRead(options) {
     const manifestFields = schemaAccess.plugin
         ? await buildManifestFieldEntries({
             plugin: schemaAccess.plugin,
+            context: options.context,
+            platform: options.platform,
             scope: options.scope,
             cwd: options.cwd,
             env: options.env,
@@ -1878,15 +1336,18 @@ export async function resolveConfigRead(options) {
             logicalIdentity: options.logicalIdentity,
             pluginName,
             scope: options.scope,
+            platform: options.platform,
             cwd: options.cwd,
             env: options.env,
         });
     return {
         pluginName,
+        platform: options.platform,
+        context: options.context ?? 'user',
         scope: options.scope,
         ...(schemaAccess.schema ? { schema: schemaAccess.schema } : {}),
         ...(schemaAccess.plugin?.manifest.config?.fields
-            ? { fieldDefinitions: schemaAccess.plugin.manifest.config.fields }
+            ? { fieldDefinitions: compilePluginConfigDefinition(schemaAccess.plugin.manifest.config, options.platform).fields }
             : {}),
         fields: manifestFields,
     };
@@ -1914,13 +1375,14 @@ export function summarizeEffectivePluginConfig(config) {
         ignoredUnknownKeys: config.ignoredUnknownKeys,
     };
 }
-export function createPluginConfigSchemaIdentity(manifest) {
+export function createPluginConfigSchemaIdentity(manifest, platform) {
     const hash = crypto
         .createHash('sha256')
         .update(JSON.stringify({
         name: manifest.name,
         version: manifest.version,
-        config: manifest.config ?? null,
+        platform: platform ?? null,
+        config: manifest.config ? compilePluginConfigDefinition(manifest.config, platform) : null,
     }))
         .digest('hex');
     return `${manifest.name}:${hash}`;
@@ -1961,9 +1423,9 @@ export function toCliConfigPromptSchema(schema) {
     return promptSchema;
 }
 export function createPluginConfigFormModel(options) {
-    const schema = options.manifest.config?.fields;
+    const schema = options.effective.schema;
     if (!schema) {
-        throw new Error(`Plugin "${options.pluginName ?? options.manifest.name}" does not declare an AW config schema.`);
+        throw new PluginConfigSchemaResolutionError('configSchemaUnavailable', `Plugin "${options.pluginName ?? options.manifest.name}" does not declare an AW config schema.`);
     }
     const requiredKeys = [...new Set(options.effective.issues
             .filter((issue) => issue.type === 'missing-required' || issue.type === 'invalid-config')
@@ -1990,8 +1452,8 @@ export function createPluginConfigFormModel(options) {
     });
     return {
         pluginName: options.pluginName ?? options.manifest.name,
-        allowedScopes: options.allowedScopes ?? ['user', 'project'],
-        initialScope: options.initialScope,
+        allowedScopes: ['user'],
+        initialScope: 'user',
         requiredKeys,
         fields,
     };
@@ -2030,21 +1492,17 @@ export function toCliConfigPromptOptions(model) {
         requiredKeys: [...model.requiredKeys],
     };
 }
-export function formatPluginConfigSetRecoveryCommand(pluginName, key, field, scope) {
-    return field.sensitive === true
-        ? `aw config set ${pluginName} ${key} --scope user --value-stdin`
-        : `aw config set ${pluginName} ${key} --scope ${scope} --value-json '<json>'`;
+export function formatPluginConfigSetRecoveryCommand(pluginName, key, field, context, platform) {
+    const command = `aw plugin config set ${pluginName} ${key} --context ${context}`
+        + (platform ? ` --platform ${platform}` : '');
+    return field.sensitive === true ? `${command} --value-stdin` : `${command} --value-json '<json>'`;
 }
-function formatRequiredConfigSetCommands(pluginName, issues, defaultScope, schema) {
+function formatRequiredConfigSetCommands(pluginName, issues, context, schema, platform) {
     const commands = new Set();
     for (const issue of issues) {
-        const scope = issue.source === 'user' || issue.source === 'project'
-            ? issue.source
-            : defaultScope;
         const field = schema[issue.key];
-        if (!field)
-            continue;
-        commands.add(formatPluginConfigSetRecoveryCommand(pluginName, issue.key, field, scope));
+        if (field)
+            commands.add(formatPluginConfigSetRecoveryCommand(pluginName, issue.key, field, context, platform));
     }
     return [...commands].map((command) => `\`${command}\``).join(' 或 ');
 }
@@ -2057,8 +1515,8 @@ export async function preflightRequiredPluginConfigs(options) {
     };
     for (const target of options.targets) {
         const pluginName = target.pluginName ?? target.manifest.name;
-        const identity = target.schemaSourceIdentity ?? createPluginConfigSchemaIdentity(target.manifest);
-        const dedupeKey = `${pluginName}\0${identity}`;
+        const identity = target.schemaSourceIdentity ?? createPluginConfigSchemaIdentity(target.manifest, target.platform);
+        const dedupeKey = `${pluginName}\0${target.platform ?? 'common'}\0${identity}`;
         if (visited.has(dedupeKey)) {
             continue;
         }
@@ -2067,12 +1525,13 @@ export async function preflightRequiredPluginConfigs(options) {
         if (!target.manifest.config?.fields) {
             continue;
         }
-        let effective = await resolveEffectivePluginConfig({
+        const effective = await resolveEffectivePluginConfig({
             sourceId: target.sourceId,
             sourceIdentity: target.sourceIdentity,
             logicalIdentity: target.logicalIdentity,
             pluginName,
             manifest: target.manifest,
+            platform: target.platform,
             cwd: options.cwd,
             env: options.context.env,
         });
@@ -2081,7 +1540,7 @@ export async function preflightRequiredPluginConfigs(options) {
             continue;
         }
         const details = blockingIssues.map((issue) => issue.key).join(', ');
-        const setCommands = formatRequiredConfigSetCommands(pluginName, blockingIssues, options.defaultScope, target.manifest.config.fields);
+        const setCommands = formatRequiredConfigSetCommands(target.sourceId ? `${target.sourceId}/${pluginName}` : pluginName, blockingIssues, options.defaultScope, effective.schema, target.platform);
         throw new Error(`${pluginName} requires valid AW config before install/upgrade: ${details}. ` +
             `Run ${setCommands}, or open \`aw\` to complete setup.`);
     }