@lesliechan721/aw 0.1.0-beta.64 → 0.1.0-beta.65

package/dist/src/index.js

@@ -1,41 +1,36 @@
 #!/usr/bin/env node
+import { describeNativeToolClosure } from './utils/native-tool-review.js';
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { Command, CommanderError, InvalidArgumentError, Option } from 'commander';
 import { doctorEvalProviders } from '@lesliechan721/agent-skill-eval';
+import { compilePluginConfigDefinition, PLATFORM_TARGETS, PORTABLE_PLATFORM_TARGETS } from '@lesliechan721/aw-plugin-core/manifest';
 import { initCommand } from './commands/init.js';
 import { resolveCatalogWorkspaceRoot } from './commands/catalog-workspace-resolution.js';
 import { addCatalogSourceCommand, preflightCatalogSourceMutation, explicitRefPolicy, listCatalogSources, removeCatalogSourceCommand, setPrimaryCatalogSourceCommand, updateCatalogSourceCommand, } from './commands/catalog-source.js';
 import { catalogSourceStatusCommand, syncCatalogSourceCommand, } from './commands/catalog-generation.js';
 import { catalogStoreErrorCode, catalogStorePrune, catalogStoreStatus, } from './commands/catalog-store.js';
-import { cleanupWriteCommand as cleanupCommand, installWriteCommand as installCommand, reinstallWriteCommand as reinstallCommand, uninstallWriteCommand as uninstallCommand, } from './commands/write-commands.js';
-import { syncCommand } from './commands/sync-command.js';
 import { formatInteractiveConsoleUnavailableMessage, runConsoleController, } from './commands/console.js';
-import { runCommandWizard, toWizardCandidates, WizardExecutionError, } from './commands/wizard.js';
+import { WizardExecutionError, } from './commands/wizard.js';
 import { createCliExecutionContext, emitCommandEvent, } from './commands/runtime.js';
-import { loadConsoleItemsResult, statusCommandV8 } from './commands/status-v6.js';
-import { normalizeUninstallCommandOptions, normalizeCleanupCommandOptions, resolveConfigReadResolution, resolveConfigWriteScope, normalizeInstallCommandOptions, normalizeReinstallCommandOptions, resolveScriptTimeoutMs, } from './commands/options.js';
+import { parseContextValue, parsePlatformTargetValue, parseScopeValue, resolveScriptTimeoutMs, } from './commands/options.js';
 import { isCommandWarningError, } from './types.js';
 import { formatWarnings } from './output/reporter.js';
 import { redactString, redactValue } from './output/redact.js';
-import { renderShellCommand, } from './output/equivalent-command.js';
-import { buildRebuildReceiptJson, buildInitReceiptJson, renderRebuildReceipt, renderInitReceipt, } from './output/command-receipt.js';
+import { buildInitReceiptJson, renderInitReceipt, } from './output/command-receipt.js';
 import { resolveCliPackageRoot } from './utils/paths.js';
-import { prepareNativeCliExecution } from './utils/native-cli.js';
-import { findConfigFieldEntry, formatPluginConfigSetRecoveryCommand, listNamespacedPluginConfigStores, listPluginConfigStorePluginNames, readPluginConfigStore, renderPluginConfigValueForDisplay, resolveConfigRead, } from './utils/plugin-config.js';
-import { applyPluginConfigWrite, buildConfigMutationReceipt, configWriteStateForError, describeResetAffectedFields, resetPluginConfigWithHelper, } from './utils/plugin-config-write.js';
+import { findConfigFieldEntry, formatPluginConfigSetRecoveryCommand, listNamespacedPluginConfigStores, readPluginConfigStore, renderPluginConfigValueForDisplay, resolveConfigRead, } from './utils/plugin-config.js';
+import { applyPluginConfigWrite, applyPluginConfig, buildConfigMutationReceipt, configWriteStateForError, resetPluginConfigWithHelper, } from './utils/plugin-config-write.js';
 import { assertStrictSemVer } from './utils/manifest.js';
-import { writeCandidateEligibility } from './utils/target-eligibility.js';
 import { assertCatalogSourceReferencesSupported, inventoryLegacyConfigReferences, } from './utils/catalog-source-references.js';
 import { parsePluginId, withResolvedCatalogPlugin, withResolvedMultiSourceCatalog, } from './utils/multi-source-catalog.js';
 import { sanitizeCatalogSourceError, sanitizeCatalogSourceErrorMessage, } from './utils/catalog-public-error.js';
 import { catalogGenerationErrorCode } from './utils/catalog-generation-error.js';
 import { resolveCatalogOperationContext, } from './utils/catalog-operation-context.js';
 import { withAwHomeMutationLock, } from './utils/aw-home-mutation-lock.js';
-import { installPortableSkills, materializePortableSkillsToDirectory, PortableCommandError, renderPortableReview, } from './portable/commands.js';
-import { SkillsCliError } from './portable/skills-cli.js';
+import { materializePortableSkillsToDirectory, PortableCommandError } from './portable/commands.js';
 import { createReviewInspectionFailure, getReviewInspectionExitCode, inspectReviewTarget, } from './commands/review-inspection.js';
 import { prepareReviewTarget, } from './commands/review-preparation.js';
 import { runCatalogBuildCommand, runCatalogInitCommand, runCatalogValidateCommand, runCatalogVersionCommand, runPluginBuildCommand, runPluginTestCommand, } from './authoring/workspace-commands.js';
@@ -46,6 +41,13 @@ import { activateCatalogDevSource, catalogDevSourceError, createCatalogDevFailur
 import { getPluginCapabilitiesResult, parsePluginCapabilitySurface, renderPluginCapabilities, } from './commands/plugin-capabilities.js';
 import { AwCapabilityUnsupportedError, checkCurrentAw, describeCurrentAw, inspectPluginRequirements, } from './commands/aw-capabilities.js';
 import { prepareSkillEval } from './commands/skill-eval.js';
+import { readRecoveryStatus, checkRecovery } from './recovery/status.js';
+import { intentAdd, intentRemove, intentList } from './commands/intent-command.js';
+import { targetsSet, targetsList, targetsChangeExclusion } from './commands/targets-command.js';
+import { runRecovery } from './recovery/coordinator.js';
+import { runRetire } from './recovery/retirement.js';
+import { normalizeAgents } from './intent/deployment-preferences.js';
+import { resolveWorkContext } from './intent/work-context.js';
 import { registerManagedCommandCli, runManagedCommandCli } from './commands/managed-commands.js';
 function createDefaultIo() {
     return {
@@ -69,7 +71,7 @@ function strictValueOption(flags, description, choices) {
         return value;
     });
 }
-function collectUniqueOption(value, previous) {
+function collectUniqueOption(value, previous = []) {
     return previous.includes(value) ? previous : [...previous, value];
 }
 function renderReviewSkills(write, skills, issues) {
@@ -110,9 +112,6 @@ function resolveCliVersion() {
     const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
     return assertStrictSemVer(packageJson.version, 'packages/cli/package.json version');
 }
-function resolveCommandReceiptExitCode(result) {
-    return result.overallState === 'succeeded' ? 0 : 1;
-}
 class WriteCommandRequestError extends Error {
     code = 'invalidArguments';
 }
@@ -140,122 +139,47 @@ function writeCommandFailure(error) {
         message,
     };
 }
-function preparseWriteReceiptRequest(argv) {
-    const request = { json: false, plugins: [] };
-    let positionalOnly = false;
-    for (let index = 1; index < argv.length; index += 1) {
-        const token = argv[index];
-        if (positionalOnly) {
-            request.plugins.push(token);
-            continue;
-        }
-        if (token === '--') {
-            positionalOnly = true;
-            continue;
-        }
-        if (token === '--json') {
-            request.json = true;
-            continue;
-        }
-        if (token === '--platform' || token === '--scope') {
-            const value = argv[index + 1];
-            if (token === '--platform')
-                request.platform = value;
-            else
-                request.scope = value;
-            index += 1;
-            continue;
-        }
-        if (token.startsWith('--platform=')) {
-            request.platform = token.slice('--platform='.length);
-            continue;
-        }
-        if (token.startsWith('--scope=')) {
-            request.scope = token.slice('--scope='.length);
-            continue;
-        }
-        if (token === '--dependency-scope' || token === '--script-timeout' || token === '--log-file') {
-            index += 1;
-            continue;
-        }
-        if (token.startsWith('--'))
-            continue;
-        if (token.startsWith('-') && token !== '-') {
-            const shortOptions = token.slice(1);
-            for (let offset = 0; offset < shortOptions.length; offset += 1) {
-                const option = shortOptions[offset];
-                if (option === 'j') {
-                    request.json = true;
-                    continue;
-                }
-                if (option === 'p' || option === 's') {
-                    const value = shortOptions.slice(offset + 1) || argv[index + 1];
-                    if (option === 'p')
-                        request.platform = value;
-                    else
-                        request.scope = value;
-                    if (shortOptions.length === offset + 1)
-                        index += 1;
-                    break;
-                }
-            }
-            continue;
-        }
-        request.plugins.push(token);
-    }
-    return request;
-}
-function jsonWriteCommandRequest(argv) {
-    const command = argv[0];
-    if (!['install', 'reinstall', 'uninstall', 'cleanup', 'sync'].includes(command ?? '')) {
+function recoveryRequest(argv) {
+    const nested = argv[0] === 'plugin';
+    const args = nested ? argv.slice(1) : argv;
+    const family = args[0] ?? '';
+    if (nested && ['remove', 'status'].includes(family)
+        && args.some((value) => value === '--workspace-root' || value.startsWith('--workspace-root=')))
         return null;
-    }
-    const request = preparseWriteReceiptRequest(argv);
-    if (!request.json)
+    if (!['intent', 'targets', 'sync', 'install', 'remove', 'reinstall', 'uninstall', 'cleanup', 'status', 'project'].includes(family))
         return null;
-    const rawPlatform = request.platform;
-    const platform = rawPlatform === 'codex' || rawPlatform === 'claude' || rawPlatform === 'both'
-        ? rawPlatform
-        : 'codex';
+    let rawScope;
+    let json = false;
+    for (let index = 1; index < args.length; index++) {
+        const value = args[index];
+        if (value === '--')
+            break;
+        if (value === '--scope')
+            rawScope = args[++index];
+        else if (value.startsWith('--scope='))
+            rawScope = value.slice('--scope='.length);
+        else if (value === '--json' || (/^-[ajvyD]+$/u.test(value) && value.includes('j')))
+            json = true;
+        else if (['--target', '--context', '--script-timeout', '--log-file'].includes(value))
+            index++;
+    }
     return {
-        command: command,
-        plugins: request.plugins,
-        platform,
-        scope: request.scope === 'project' ? 'project' : 'user',
+        command: ['intent', 'targets', 'project'].includes(family) ? `${family}:${args[1] ?? ''}` : family,
+        scope: rawScope === 'user' || rawScope === 'project' ? rawScope : null,
+        json,
     };
 }
-function writeCommandFailureReceipt(write, request, error) {
-    const platforms = request.platform === 'both'
-        ? ['codex', 'claude']
-        : [request.platform];
-    writeJsonReceipt(write, buildRebuildReceiptJson(request.command, {
-        platforms,
-        plugins: request.plugins,
-        warnings: [],
-        overallState: 'failed',
-        errors: [writeCommandFailure(error)],
-        receiptTargets: request.plugins.flatMap((selector) => platforms.map((platform) => {
-            let pluginName = selector;
-            let sourceId;
-            try {
-                const parsed = parsePluginId(selector);
-                pluginName = parsed.pluginName;
-                sourceId = parsed.sourceId;
-            }
-            catch {
-                // Keep the raw selector in the failed receipt.
-            }
-            return {
-                pluginName,
-                pluginId: selector,
-                ...(sourceId ? { sourceId } : {}),
-                platform,
-                scope: request.scope,
-            };
-        })),
-    }));
+function recoveryFailureReceipt(command, scope, error) {
+    const failure = writeCommandFailure(error);
+    return {
+        schemaVersion: 1, kind: 'aw-recovery', scope, command, ok: false,
+        intent: { state: 'unreadable', roots: null }, requestedRoots: [], requestedTargets: [],
+        selection: { agents: [], origin: 'none', preferences: 'unreadable' },
+        blockers: [failure], errors: [failure], targetResults: [], remainingTargets: [], recoveryActions: [],
+        declarationChanged: false, preferencesChanged: false, configChanged: false, outputsMayHaveChanged: false,
+    };
 }
-function scanConfigMutationShortOptions(token, command) {
+function scanConfigMutationShortOptions(token) {
     if (!/^-[^-].*/u.test(token))
         return { json: false, consumesNextValue: false };
     let json = false;
@@ -271,7 +195,7 @@ function scanConfigMutationShortOptions(token, command) {
             json = true;
             continue;
         }
-        if (option === 'v' || option === 'D' || (option === 'y' && command === 'config:reset')) {
+        if (option === 'v' || option === 'D' || option === 'y') {
             continue;
         }
         break;
@@ -279,15 +203,16 @@ function scanConfigMutationShortOptions(token, command) {
     return { json, consumesNextValue: false };
 }
 function jsonConfigMutationRequest(argv) {
-    if (argv[0] !== 'config' || !['set', 'unset', 'reset'].includes(argv[1] ?? '')) {
+    const args = argv[0] === 'plugin' ? argv.slice(1) : argv;
+    if (args[0] !== 'config' || !['set', 'edit', 'unset', 'reset', 'apply'].includes(args[1] ?? '')) {
         return null;
     }
-    const command = `config:${argv[1]}`;
+    const command = `config:${args[1]}`;
     let json = false;
     let plugin;
-    const valueOptions = new Set(['--scope', '--value-json', '--preset', '--log-file']);
-    for (let index = 2; index < argv.length; index += 1) {
-        const token = argv[index];
+    const valueOptions = new Set(['--platform', '--context', '--target', '--value-json', '--preset', '--log-file', '--script-timeout']);
+    for (let index = 2; index < args.length; index += 1) {
+        const token = args[index];
         if (token === '--')
             break;
         if (valueOptions.has(token)) {
@@ -298,7 +223,7 @@ function jsonConfigMutationRequest(argv) {
             json = true;
             continue;
         }
-        const shortOptions = scanConfigMutationShortOptions(token, command);
+        const shortOptions = scanConfigMutationShortOptions(token);
         if (shortOptions.json)
             json = true;
         if (shortOptions.consumesNextValue)
@@ -314,6 +239,24 @@ function jsonConfigMutationRequest(argv) {
         ...(plugin ? { plugin } : {}),
     };
 }
+function jsonConfigReadRequested(argv) {
+    if (argv[0] !== 'plugin' || argv[1] !== 'config'
+        || !['schema', 'list', 'get'].includes(argv[2] ?? ''))
+        return false;
+    const values = new Set(['--platform', '--context', '--target', '--script-timeout', '--log-file']);
+    for (let index = 3; index < argv.length; index++) {
+        const token = argv[index];
+        if (token === '--')
+            break;
+        if (values.has(token)) {
+            index++;
+            continue;
+        }
+        if (token === '--json' || /^-[jvD]+$/u.test(token) && token.includes('j'))
+            return true;
+    }
+    return false;
+}
 function configMutationFailure(error, env, cwd) {
     const configWrite = configWriteStateForError(error);
     if (error instanceof CommanderError) {
@@ -404,35 +347,6 @@ function toCliDiagnosticsOptions(commandName, rawOptions, runtimeDiagnostics) {
 function isWizardAvailable(context, rawOptions) {
     return context.interactive && context.isTty && !context.isCi && rawOptions.json !== true;
 }
-function shellCommand(tokens) {
-    return renderShellCommand(tokens, 'posix');
-}
-function optionTokens(flag, value) {
-    return value === undefined ? [] : [flag, value];
-}
-function writeCommandUsage(command) {
-    const cardinality = command === 'reinstall' || command === 'cleanup' ? '<plugin>' : '<plugin...>';
-    const scope = command === 'cleanup' ? ' --scope <project|user>' : ' [--scope <project|user>]';
-    return [
-        `${command} 命令缺少必要参数。`,
-        `Usage: aw ${command} ${cardinality} --platform <codex|claude|both>${scope}`,
-        `Example: aw ${command} example-plugin --platform codex --scope user`,
-    ].join('\n');
-}
-function configCommandUsage(command) {
-    const argumentsByCommand = {
-        list: '<plugin>',
-        get: '<plugin> [key]',
-        set: '<plugin> <field> --scope <project|user> (--value-json <json> | --value-stdin | --preset <id>)',
-        unset: '<plugin> <key>',
-        reset: '<plugin> --scope <project|user> --yes',
-    };
-    return [
-        `config ${command} 命令缺少必要参数。`,
-        `Usage: aw config ${command} ${argumentsByCommand[command]}`,
-        `Example: aw config ${command} example-plugin${command === 'set' ? ' mode --scope user --value-json \'"safe"\'' : command === 'unset' ? ' key' : command === 'reset' ? ' --scope user --yes' : ''}`,
-    ].join('\n');
-}
 async function readUtf8Stdin(stdin) {
     const chunks = [];
     for await (const chunk of stdin) {
@@ -440,137 +354,6 @@ async function readUtf8Stdin(stdin) {
     }
     return Buffer.concat(chunks).toString('utf8');
 }
-function equivalentWriteCommand(command, selection, rawOptions) {
-    return shellCommand(buildEquivalentWriteCommandTokens(command, selection, rawOptions));
-}
-export function buildEquivalentWriteCommandTokens(command, selection, rawOptions) {
-    return [
-        'aw',
-        command,
-        '--platform',
-        selection.platform ?? 'both',
-        '--scope',
-        selection.scope ?? 'user',
-        ...(rawOptions.allowManagedCodexInstall === true
-            ? ['--allow-managed-codex-install']
-            : []),
-        ...(command === 'cleanup' ? ['--yes'] : []),
-        ...(command === 'install'
-            ? (rawOptions.dependencyScope ?? []).flatMap((value) => ['--dependency-scope', value])
-            : []),
-        ...((command === 'install' || command === 'reinstall')
-            ? optionTokens('--script-timeout', rawOptions.scriptTimeout)
-            : []),
-        ...(selection.plugins.length > 0 ? ['--', ...selection.plugins] : []),
-    ];
-}
-function equivalentConfigCommand(options) {
-    return shellCommand(buildEquivalentConfigCommandTokens(options));
-}
-function equivalentConfigCommandProjection(resolve) {
-    return {
-        equivalentCommand: (selection) => equivalentConfigCommand(resolve(selection)),
-        equivalentCommandTokens: (selection) => buildEquivalentConfigCommandTokens(resolve(selection)),
-    };
-}
-export function buildEquivalentConfigCommandTokens(options) {
-    return [
-        'aw',
-        'config',
-        options.command,
-        ...optionTokens('--scope', options.scope),
-        ...optionTokens('--value-json', options.valueJson),
-        ...optionTokens('--preset', options.preset),
-        ...(options.confirmed ? ['--yes'] : []),
-        '--',
-        options.plugin,
-        ...(options.key === undefined ? [] : [options.key]),
-        ...(options.value === undefined ? [] : [options.value]),
-    ];
-}
-function hasSelectableWriteCandidate(command, candidates, selection, options) {
-    const platforms = options.missingPlatform
-        ? ['codex', 'claude', 'both']
-        : [selection.platform ?? 'both'];
-    const scopes = options.missingScope ? ['user', 'project'] : [selection.scope ?? 'user'];
-    return candidates.some((candidate) => platforms.some((platform) => scopes.some((scope) => writeCandidateEligibility(command, candidate, { ...selection, platform, scope }).selectable)));
-}
-function hasConfigSchemaKeys(candidate) {
-    return candidate.configSchema !== undefined && Object.keys(candidate.configSchema).length > 0;
-}
-async function loadWizardCandidates(context, rawOptions) {
-    const loaded = await loadConsoleItemsResult({
-        cwd: context.cwd,
-        scope: rawOptions.scope,
-        platform: rawOptions.platform,
-    }, context);
-    return toWizardCandidates(loaded.items);
-}
-function mergeWizardCandidates(current, stored) {
-    const merged = new Map(current.map((candidate) => [candidate.pluginName, candidate]));
-    for (const candidate of stored) {
-        const existing = merged.get(candidate.pluginName);
-        if (!existing) {
-            merged.set(candidate.pluginName, candidate);
-        }
-        else if (!existing.configSchema) {
-            merged.set(candidate.pluginName, { ...candidate, ...existing });
-        }
-    }
-    return [...merged.values()];
-}
-async function loadStoredConfigWizardCandidates(context, locations, options = {}) {
-    const legacy = await listPluginConfigStorePluginNames({ cwd: context.cwd, env: context.env });
-    if (legacy.length > 0) {
-        throw new Error('legacyStateUnsupported: legacy bare-name config stores are not supported.');
-    }
-    const storesByPlugin = new Map();
-    for (const location of locations) {
-        const stores = await listNamespacedPluginConfigStores({
-            cwd: context.cwd,
-            env: context.env,
-            scope: location.scope,
-        });
-        for (const store of stores) {
-            const keys = Object.keys(store.values);
-            if (keys.length === 0 && options.includeEmptyStores !== true)
-                continue;
-            const existing = storesByPlugin.get(store.pluginId) ?? {
-                sourceId: store.sourceId,
-                ...(store.binding.kind === 'source'
-                    ? { sourceIdentity: store.binding.sourceIdentity }
-                    : {}),
-                keys: new Set(),
-            };
-            for (const key of keys)
-                existing.keys.add(key);
-            storesByPlugin.set(store.pluginId, existing);
-        }
-    }
-    return [...storesByPlugin]
-        .sort(([left], [right]) => left.localeCompare(right))
-        .map(([pluginId, store]) => ({
-        pluginName: pluginId,
-        pluginId,
-        sourceId: store.sourceId,
-        ...(store.sourceIdentity ? { sourceIdentity: store.sourceIdentity } : {}),
-        targets: [],
-        configKeys: [...store.keys].sort((left, right) => left.localeCompare(right)),
-    }));
-}
-function configReadStoreLocations(rawOptions) {
-    if (rawOptions.scope === 'user')
-        return [{ scope: 'user' }];
-    if (rawOptions.scope === 'project')
-        return [{ scope: 'project' }];
-    return [
-        { scope: 'user' },
-        { scope: 'project' },
-    ];
-}
-function overallResultState(value) {
-    return value.overallState === 'succeeded' ? 'succeeded' : 'failed';
-}
 async function resolveStoredConfigResetIdentity(options) {
     const parsed = parsePluginId(options.selector);
     if (parsed.sourceId) {
@@ -596,27 +379,21 @@ async function resolveStoredConfigResetIdentity(options) {
         pluginName: match.pluginName,
         pluginId: match.pluginId,
         sourceId: match.sourceId,
-        ...(match.binding.kind === 'source'
-            ? { sourceIdentity: match.binding.sourceIdentity }
-            : { logicalIdentity: match.binding.logicalIdentity }),
+        sourceIdentity: match.binding.sourceIdentity,
     };
 }
 async function resolveStoredOnlyConfigIdentity(options) {
     const parsed = parsePluginId(options.selector);
     if (!parsed.sourceId)
         throw new Error(`Plugin "${options.selector}" is not a qualified stored config target.`);
-    const stores = (await Promise.all(options.locations.map((location) => listNamespacedPluginConfigStores({
-        cwd: options.context.cwd,
-        env: options.context.env,
-        scope: location.scope,
-    })))).flat().filter((store) => store.pluginId === options.selector);
+    const stores = (await listNamespacedPluginConfigStores({
+        cwd: options.context.cwd, env: options.context.env, scope: 'user',
+    })).filter((store) => store.pluginId === options.selector);
     if (stores.length === 0)
         throw new Error(`Plugin "${options.selector}" does not have a namespaced config store.`);
     const sourceBindings = stores.flatMap((store) => store.binding.kind === 'source'
         ? [store.binding.sourceIdentity] : []);
-    const catalogBindings = stores.flatMap((store) => store.binding.kind === 'catalog'
-        ? [store.binding.logicalIdentity] : []);
-    if (new Set(sourceBindings).size > 1 || new Set(catalogBindings).size > 1) {
+    if (new Set(sourceBindings).size > 1) {
         throw new Error(`identityMismatch: ${options.selector} config stores have different bindings.`);
     }
     const currentSource = await withResolvedMultiSourceCatalog({
@@ -637,9 +414,6 @@ async function resolveStoredOnlyConfigIdentity(options) {
     if (sourceBindings[0] && sourceBindings[0] !== currentSource.sourceIdentity) {
         throw new Error(`identityMismatch: ${options.selector} user config does not match the current source identity.`);
     }
-    if (catalogBindings[0] && catalogBindings[0] !== currentSource.logicalIdentity) {
-        throw new Error(`identityMismatch: ${options.selector} project config does not match the current Catalog logical identity.`);
-    }
     return {
         pluginName: parsed.pluginName,
         pluginId: options.selector,
@@ -652,6 +426,7 @@ async function resolveMultiSourceConfigRead(options) {
     const inventory = await inventoryLegacyConfigReferences({
         cwd: options.context.cwd,
         env: options.context.env,
+        scope: options.rawOptions.context === 'project' ? 'project' : 'user',
     });
     assertCatalogSourceReferencesSupported(inventory);
     return withResolvedCatalogPlugin({
@@ -662,13 +437,14 @@ async function resolveMultiSourceConfigRead(options) {
             const result = await resolveConfigRead({
                 pluginName: plugin.manifest.name,
                 plugin,
-                scope: resolveConfigReadResolution(options.rawOptions.scope),
+                scope: options.rawOptions.context === 'project' ? 'project' : 'user',
+                platform: options.rawOptions.platform,
                 cwd: options.context.cwd,
                 env: options.context.env,
             });
             if (options.key !== undefined) {
                 const field = findConfigFieldEntry(result.fields, options.key);
-                if (!field && plugin.manifest.config?.fields?.[options.key] === undefined) {
+                if (!field && compilePluginConfigDefinition(plugin.manifest.config, options.rawOptions.platform).fields[options.key] === undefined) {
                     throw new Error(`Unknown config key "${options.key}".`);
                 }
                 if (field)
@@ -689,7 +465,6 @@ async function resolveMultiSourceConfigRead(options) {
         const stored = await resolveStoredOnlyConfigIdentity({
             selector: options.selector,
             context: options.context,
-            locations: configReadStoreLocations(options.rawOptions),
         });
         const result = await resolveConfigRead({
             sourceId: stored.sourceId,
@@ -697,7 +472,8 @@ async function resolveMultiSourceConfigRead(options) {
             logicalIdentity: stored.logicalIdentity,
             pluginName: stored.pluginName,
             plugin: null,
-            scope: resolveConfigReadResolution(options.rawOptions.scope),
+            scope: options.rawOptions.context === 'project' ? 'project' : 'user',
+            platform: options.rawOptions.platform,
             cwd: options.context.cwd,
             env: options.context.env,
         });
@@ -710,6 +486,46 @@ async function resolveMultiSourceConfigRead(options) {
         return { ...stored, result };
     });
 }
+function renderRecoveryReceipt(write, value) {
+    writeLine(write, `${value.command} [${value.scope}]: ${value.ok ? 'ok' : 'failed'}`);
+    writeLine(write, `需求：${value.intent.roots?.join('、') || (value.intent.roots === null ? '不可读' : '无')}`);
+    writeLine(write, `本机工具：${value.selection.agents.join('、') || '未配置'}`);
+    writeLine(write, `变化：声明 ${value.declarationChanged ? '已保存' : '无'}；偏好 ${value.preferencesChanged ? '已保存' : '无'}；配置 ${value.configChanged ? '已保存' : '无'}；输出 ${value.outputsMayHaveChanged ? '可能已变更' : '无'}`);
+    for (const target of value.targetResults) {
+        writeLine(write, `${target.pluginId} / ${target.agent} [${target.scope}]: ${target.execution}; ${target.content ?? target.observation}`);
+    }
+    for (const result of value.commandResults ?? []) {
+        const producer = result.producer;
+        writeLine(write, `托管命令 ${producer.sourceId}/${producer.pluginName}/${producer.key} [${producer.scope}]: ${result.state}`);
+    }
+    for (const change of value.nativeToolChanges ?? []) {
+        for (const phase of ['before', 'after']) {
+            const closure = change[phase];
+            if (closure)
+                for (const description of describeNativeToolClosure(closure)) {
+                    writeLine(write, `原生工具 ${change.producer.sourceId}/${change.producer.pluginName} ${phase}: ${description}`);
+                }
+        }
+    }
+    const diagnostics = new Map([...value.blockers, ...value.errors,
+        ...value.targetResults.flatMap((target) => target.blockers),
+        ...(value.commandResults ?? []).flatMap((result) => result.errors),
+    ].map((item) => [`${item.code}:${item.message}`, item]));
+    for (const item of diagnostics.values())
+        writeLine(write, `${item.code}: ${item.message}`);
+    for (const action of value.recoveryActions)
+        writeLine(write, action);
+}
+function renderRecoveryStatus(write, value) {
+    writeLine(write, `status [${value.scope}]: ${value.ok ? 'ok' : 'failed'}`);
+    writeLine(write, `本机工具：${value.selection.agents.join('、') || '未配置'}`);
+    writeLine(write, `全部满足：${value.allSatisfied === null ? '未知' : value.allSatisfied ? '是' : '否'}`);
+    for (const root of value.inventory ?? []) {
+        writeLine(write, `${root.pluginId}: ${root.targetResults.length ? root.targetResults.map((target) => `${target.agent}/${target.content ?? target.observation}`).join(', ') : 'localTargetsRequired'}`);
+    }
+    for (const error of value.errors)
+        writeLine(write, `${error.code}: ${error.message}`);
+}
 export function createManagedCodexAuthorizer(rawOptions, context) {
     if (rawOptions.allowManagedCodexInstall === true)
         return async () => true;
@@ -724,152 +540,14 @@ export function createManagedCodexAuthorizer(rawOptions, context) {
         return !response.cancelled && response.value === true;
     };
 }
-async function executeWriteCommand(command, pluginNames, rawOptions, context, directCli = false, expectedPlanFingerprint) {
-    const raw = { cwd: context.cwd, ...rawOptions };
-    const commandOptions = normalizeWriteRequest(() => command === 'install'
-        ? normalizeInstallCommandOptions(raw)
-        : command === 'uninstall'
-            ? normalizeUninstallCommandOptions(raw)
-            : command === 'cleanup'
-                ? normalizeCleanupCommandOptions(raw)
-                : normalizeReinstallCommandOptions(raw));
-    await emitCommandEvent(context, {
-        type: 'options:normalized',
-        data: { plugins: pluginNames, options: commandOptions },
-    });
+function recoveryRuntime(context, rawOptions, directCli) {
     const managedCodexAuthorizer = createManagedCodexAuthorizer(rawOptions, context);
-    const runtime = {
+    return {
         ...context,
         directCli,
         preApplyConfirmed: rawOptions.yes === true,
-        ...(expectedPlanFingerprint ? { expectedPlanFingerprint } : {}),
         ...(managedCodexAuthorizer ? { managedCodexAuthorizer } : {}),
     };
-    switch (command) {
-        case 'install': return installCommand(pluginNames, commandOptions, runtime);
-        case 'uninstall': return uninstallCommand(pluginNames, commandOptions, runtime);
-        case 'cleanup': return cleanupCommand(pluginNames, commandOptions, runtime);
-        case 'reinstall': return reinstallCommand(pluginNames, commandOptions, runtime);
-    }
-}
-async function runWriteCommandAction(command, pluginNames, rawOptions, context) {
-    if ((command === 'cleanup' || command === 'reinstall') && pluginNames.length > 1) {
-        throw new WriteCommandRequestError(`${command} 命令当前只支持单个插件目标。`);
-    }
-    const missingPlugin = pluginNames.length === 0;
-    const missingPlatform = rawOptions.platform === undefined;
-    const missingScope = command === 'cleanup' && rawOptions.scope === undefined;
-    const missing = missingPlugin || missingPlatform || missingScope;
-    // Validate every value already supplied by the caller before opening the TUI.
-    const validationOptions = {
-        cwd: context.cwd,
-        ...rawOptions,
-        platform: rawOptions.platform ?? 'both',
-        ...(command === 'cleanup' ? { scope: rawOptions.scope ?? 'user' } : {}),
-    };
-    void validationOptions;
-    if (!missing) {
-        if (command === 'cleanup' && rawOptions.force !== true && rawOptions.yes !== true
-            && isWizardAvailable(context, rawOptions) && context.prompt.confirm) {
-            const preview = await cleanupCommand(pluginNames, normalizeCleanupCommandOptions({
-                cwd: context.cwd,
-                ...rawOptions,
-            }), { ...context, previewOperationPlan: true });
-            if ((preview.removedPluginCleanupIds?.length ?? 0) > 0) {
-                if (!preview.operationPlan) {
-                    throw new WriteCommandRequestError('cleanupPlanUnavailable: 无法建立可信的整体清理预览。');
-                }
-                const response = await context.prompt.confirm({
-                    message: `清理已删除插件 ${preview.removedPluginCleanupIds.join('、')}：将处理 Codex、Claude Code 的用户与当前项目位置，删除保存设置、安装意图、专属输出和共享原生安装。其他项目可能因此无法继续使用该插件；其本地记录不会修改。即使指定了 --platform 或 --scope，本次仍覆盖上述全部位置。继续？`,
-                    defaultValue: false,
-                });
-                if (response.cancelled || response.value !== true)
-                    return { cancelled: true };
-                return {
-                    cancelled: false,
-                    result: await executeWriteCommand(command, pluginNames, {
-                        ...rawOptions, yes: true,
-                    }, context, true, preview.operationPlan.planFingerprint),
-                };
-            }
-        }
-        return {
-            cancelled: false,
-            result: await executeWriteCommand(command, pluginNames, rawOptions, context, true),
-        };
-    }
-    if (!isWizardAvailable(context, rawOptions)) {
-        throw new WriteCommandRequestError(writeCommandUsage(command));
-    }
-    const loaded = await loadConsoleItemsResult({
-        cwd: context.cwd,
-        scope: rawOptions.scope,
-        platform: rawOptions.platform,
-    }, context);
-    if (loaded.catalogUnavailable) {
-        throw new Error('插件目录不可用。请运行 `aw init` 或 `aw init --force`，或使用完整参数重试。');
-    }
-    const candidates = missingPlugin ? toWizardCandidates(loaded.items) : [];
-    const initialSelection = {
-        plugins: pluginNames,
-        platform: rawOptions.platform,
-        scope: (rawOptions.scope ?? 'user'),
-    };
-    if (missingPlugin && !hasSelectableWriteCandidate(command, candidates, initialSelection, {
-        missingPlatform,
-        missingScope,
-    })) {
-        throw new Error('没有可执行此操作的目标。请运行 `aw status` 检查当前状态。');
-    }
-    const result = await runCommandWizard(context, {
-        command,
-        candidates,
-        initial: initialSelection,
-        pluginMode: missingPlugin
-            ? command === 'cleanup' || command === 'reinstall' ? 'single' : 'multiple'
-            : 'none',
-        promptForPlatform: missingPlatform,
-        promptForScope: missingScope,
-        destructive: command === 'uninstall' || command === 'cleanup',
-        equivalentCommand: (selection) => equivalentWriteCommand(command, selection, rawOptions),
-        equivalentCommandTokens: (selection) => buildEquivalentWriteCommandTokens(command, selection, rawOptions),
-        isPluginSelectable: (candidate, selection) => writeCandidateEligibility(command, candidate, selection),
-        resultState: overallResultState,
-        ...(command === 'cleanup' ? {
-            reviewDetails: async (selection) => {
-                const preview = await cleanupCommand(selection.plugins, normalizeCleanupCommandOptions({
-                    cwd: context.cwd,
-                    ...rawOptions,
-                    platform: selection.platform,
-                    scope: selection.scope,
-                }), { ...context, previewOperationPlan: true });
-                if ((preview.removedPluginCleanupIds?.length ?? 0) === 0)
-                    return { lines: [] };
-                if (!preview.operationPlan) {
-                    throw new WriteCommandRequestError('cleanupPlanUnavailable: 无法建立可信的整体清理预览。');
-                }
-                return {
-                    lines: [
-                        `已删除插件：${preview.removedPluginCleanupIds.join('、')}`,
-                        '实际清理范围：Codex、Claude Code；用户与当前项目。',
-                        '将删除保存设置、安装意图、专属输出和共享原生安装。',
-                        '其他项目可能失去此插件；其本地记录不会修改。',
-                        '当前 --platform / --scope 选择不会限制整体清理范围。',
-                    ],
-                    expectedPlanFingerprint: preview.operationPlan.planFingerprint,
-                };
-            },
-        } : {}),
-        execute: (selection, expectedPlanFingerprint) => executeWriteCommand(command, selection.plugins, {
-            ...rawOptions,
-            platform: selection.platform,
-            scope: selection.scope,
-            ...(command === 'cleanup' ? { yes: true } : {}),
-        }, context, false, expectedPlanFingerprint),
-    });
-    if (result.cancelled)
-        return { cancelled: true };
-    return { cancelled: false, result: result.value };
 }
 function parseBareConsoleOptions(argv) {
     if (argv.length === 0) {
@@ -976,12 +654,6 @@ async function runActionWithContext(context, action) {
 function writeJsonReceipt(write, payload) {
     writeLine(write, JSON.stringify(payload, null, 2));
 }
-function configLayerLabel(scope) {
-    if (scope === 'user') {
-        return '个人';
-    }
-    return '当前项目';
-}
 function writeConfigApplyNotice(write, receipt) {
     const sanitizeMessage = (message) => redactString(message)
         .replace(/https?:\/\/\S+/giu, '[REDACTED URL]')
@@ -995,9 +667,9 @@ function writeConfigApplyNotice(write, receipt) {
                 : entry.errorCode
                     ? `失败原因：${entry.errorCode}。`
                     : '未提供安全失败原因。';
-            const command = `aw reinstall ${receipt.plugin} -p ${entry.target.platform} -s ${entry.target.scope}`;
+            const command = `aw plugin sync ${receipt.plugin} --rebuild --target ${entry.target.platform} --context ${entry.target.scope}`;
             const recovery = entry.errorCode === 'invalidConfig'
-                ? ' 请修复无效配置后运行 aw sync。'
+                ? ` 请修复无效配置后运行 ${command}。`
                 : entry.errorCode === 'preApplyAuthorizationRequired'
                     || entry.errorCode === 'sharedNativeConfigApplyConfirmationRequired'
                     || entry.errorCode === 'sharedNativeImpactAuthorizationRequired'
@@ -1011,9 +683,9 @@ function writeConfigApplyNotice(write, receipt) {
     const targetResults = receipt.apply.targetResults;
     if (receipt.apply.state === 'skipped') {
         const message = receipt.apply.reason === 'noConfigChange'
-            ? '配置内容没有变化，因此没有运行 reinstall。'
+            ? '配置内容没有变化，因此没有刷新输出。'
             : receipt.apply.reason === 'noEffectiveConfigChange'
-                ? '配置存储已更新，但有效配置没有变化，因此没有运行 reinstall。'
+                ? '配置存储已更新，但有效配置没有变化，因此没有刷新输出。'
                 : receipt.apply.reason === 'notRequested'
                     ? '配置已保存，但未请求应用配置。'
                     : '配置已保存。当前没有可见的 AW 安装目标，因此没有应用配置。';
@@ -1031,12 +703,12 @@ function writeConfigApplyNotice(write, receipt) {
             ? `${receipt.apply.error.code}：${sanitizeMessage(receipt.apply.error.message)}`
             : `${receipt.apply.reason}：${fallbackMessages[receipt.apply.reason]}`;
         const recovery = receipt.apply.reason === 'invalidConfig'
-            ? '请修复无效配置后运行 aw sync。'
+            ? '请修复无效配置，再运行 aw plugin sync <source/plugin>。'
             : receipt.apply.reason === 'effectiveConfigUnavailable'
-                ? '请修复配置后运行 aw sync。'
+                ? '请修复配置，再运行 aw plugin sync <source/plugin>。'
                 : receipt.apply.reason === 'schemaUnavailable' || receipt.apply.reason === 'sourceUnavailable'
-                    ? '请修复插件来源或配置后运行 aw sync。'
-                    : '请修复来源或配置后运行 aw sync。';
+                    ? '请修复插件来源或配置，再运行 aw plugin sync <source/plugin>。'
+                    : '请修复来源或配置，再运行 aw plugin sync <source/plugin>。';
         writeLine(write, `配置已保存，但当前无法应用配置。${detail} ${recovery}`);
         writeTargetFailures();
     }
@@ -1044,7 +716,7 @@ function writeConfigApplyNotice(write, receipt) {
         const completed = targetResults.filter((entry) => entry.state === 'completed').length;
         const failed = targetResults.filter((entry) => entry.state === 'failed').length;
         const skipped = targetResults.filter((entry) => entry.state === 'skipped').length;
-        writeLine(write, `配置已保存。已重装 ${completed} 个当前可见目标；失败 ${failed} 个；跳过 ${skipped} 个。`);
+        writeLine(write, `配置已保存。已刷新 ${completed} 个当前可见目标；失败 ${failed} 个；跳过 ${skipped} 个。`);
         writeTargetFailures();
     }
     writeWarnings(write, receipt.warnings);
@@ -1066,16 +738,14 @@ function writeConfigReadHuman(write, resolved, pluginName) {
             writeLine(write, `  stored=${field.storedSourceLayer} ${renderPluginConfigValueForDisplay(field.storedValue)}`);
         }
         if (field.kind === 'manifest' && field.valueState === 'invalid') {
-            const sourceScope = field.sourceLayer === 'project'
-                ? 'project'
-                : 'user';
+            const context = resolved.context ?? 'user';
             const definition = resolved.fieldDefinitions?.[field.key];
             if (definition) {
-                writeLine(write, `  ${formatPluginConfigSetRecoveryCommand(pluginName, field.key, definition, sourceScope)}`);
+                writeLine(write, `  ${formatPluginConfigSetRecoveryCommand(pluginName, field.key, definition, context, resolved.platform)}`);
             }
-            const scopeOption = ` -s ${sourceScope}`;
-            writeLine(write, `  aw config unset ${pluginName} ${field.key}${scopeOption}`);
-            writeLine(write, `  aw config reset ${pluginName}${scopeOption}`);
+            const profileOptions = ` --context ${context}${resolved.platform ? ` --platform ${resolved.platform}` : ''}`;
+            writeLine(write, `  aw plugin config unset ${pluginName} ${field.key}${profileOptions}`);
+            writeLine(write, `  aw plugin config reset ${pluginName}${profileOptions} --yes`);
         }
     }
 }
@@ -1108,7 +778,7 @@ export function buildProgram(options = {}) {
     });
     const plugin = program
         .command('plugin')
-        .description('Create and validate AW plugin source');
+        .description('Manage plugin demand, outputs, configuration, and author sources');
     registerManagedCommandCli(program, () => createActionContext('command', {}), {
         cliEntry: fileURLToPath(import.meta.url),
         cliVersion: resolveCliVersion(),
@@ -1296,7 +966,7 @@ export function buildProgram(options = {}) {
         .argument('<target>', 'Catalog Workspace, Plugin, or source Skill path')
         .addOption(strictValueOption('--workspace-root <root>', 'explicit Catalog Workspace root'))
         .option('--skill <name>', 'select one declared Skill', collectUniqueOption, [])
-        .addOption(strictValueOption('--platform <platform>', 'select codex, claude, or agent-skills', ['codex', 'claude', 'agent-skills']))
+        .addOption(strictValueOption('--platform <platform>', 'select a canonical platform target', PLATFORM_TARGETS))
         .addOption(strictValueOption('--scope <scope>', 'select user or project scope', ['user', 'project']))
         .addOption(strictValueOption('--config <file>', 'review config JSON file'))
         .option('--materialization <receipt>', 'validate one aw-source-binding receipt', collectUniqueOption, [])
@@ -1340,7 +1010,7 @@ export function buildProgram(options = {}) {
         .argument('<target>', 'Plugin or source Skill path')
         .addOption(strictValueOption('--workspace-root <root>', 'explicit Catalog Workspace root'))
         .option('--skill <name>', 'select one declared Skill', collectUniqueOption, [])
-        .addOption(strictValueOption('--platform <platform>', 'select codex, claude, or agent-skills', ['codex', 'claude', 'agent-skills']).makeOptionMandatory())
+        .addOption(strictValueOption('--platform <platform>', 'select a canonical platform target', PLATFORM_TARGETS).makeOptionMandatory())
         .addOption(strictValueOption('--scope <scope>', 'select user or project scope', ['user', 'project']).makeOptionMandatory())
         .addOption(strictValueOption('--config <file>', 'review config JSON file'))
         .addOption(strictValueOption('--out <new-dir>', 'new output directory').makeOptionMandatory())
@@ -1365,117 +1035,12 @@ export function buildProgram(options = {}) {
             renderReviewPreparation(io.stdout, result.receipt);
         commandExitState.exitCode = result.exitCode;
     });
-    skill
-        .command('install')
-        .description('Install portable Skills through the skills CLI')
-        .argument('<plugin>', 'plugin or source/plugin selector')
-        .requiredOption('-s, --scope <scope>', 'project or user')
-        .option('--skill <name...>', 'install only selected Skill names')
-        .option('--agent <id...>', 'install to explicit Agent IDs')
-        .option('-y, --yes', 'confirm the reviewed install', false)
-        .option('-j, --json', 'emit one receipt v5 JSON object', false)
-        .action(async (selector, rawOptions) => {
-        const context = createActionContext('skill:install', {});
-        const writeFailure = (error) => {
-            const capabilityError = error instanceof AwCapabilityUnsupportedError ? error : undefined;
-            const code = capabilityError?.code
-                ?? (error instanceof PortableCommandError || error instanceof SkillsCliError
-                    ? error.code
-                    : 'portableInstallFailed');
-            writeJsonReceipt(io.stdout, {
-                receiptSchemaVersion: 5,
-                command: 'skill:install',
-                ok: false,
-                status: 'failed',
-                plugin: { id: selector },
-                scope: rawOptions.scope,
-                selectedSkills: [],
-                ...(rawOptions.skill ? { requestedSkills: rawOptions.skill } : {}),
-                agentMode: rawOptions.agent ? 'explicit' : 'automatic',
-                requestedAgents: rawOptions.agent ?? [],
-                skillsCliVersion: null,
-                collisions: [],
-                dependencies: [],
-                materializationDigest: null,
-                verification: { records: [], missing: [] },
-                warnings: [],
-                failures: [{
-                        code,
-                        message: capabilityError?.message ?? `${code}: portable Skill 安装未执行。`,
-                        ...(capabilityError ? {
-                            plugin: capabilityError.plugin,
-                            missingCapabilities: capabilityError.missingCapabilities,
-                            availableCapabilities: capabilityError.availableCapabilities,
-                        } : {}),
-                    }],
-            });
-        };
-        if (rawOptions.json && !rawOptions.yes) {
-            writeFailure(new PortableCommandError('confirmationRequired', '写入型 --json 必须同时使用 --yes。'));
-            commandExitState.exitCode = 1;
-            return;
-        }
-        try {
-            const receipt = await runActionWithContext(context, () => installPortableSkills({
-                selector,
-                scope: rawOptions.scope,
-                ...(rawOptions.skill ? { requestedSkills: rawOptions.skill } : {}),
-                ...(rawOptions.agent ? { requestedAgents: rawOptions.agent } : {}),
-                yes: rawOptions.yes,
-                cwd: context.cwd,
-                cliVersion: resolveCliVersion(),
-                env: context.env,
-                ...(context.interactive && context.prompt.confirm ? {
-                    confirm: async () => context.prompt.confirm({
-                        message: '确认按以上 Review 安装 portable Skills？',
-                        defaultValue: false,
-                    }),
-                } : {}),
-                ...(!rawOptions.json ? {
-                    onReview: (review) => {
-                        for (const line of renderPortableReview(review))
-                            writeLine(io.stdout, line);
-                    },
-                } : {}),
-            }));
-            if (rawOptions.json)
-                writeJsonReceipt(io.stdout, receipt);
-            else if (receipt.ok)
-                writeLine(io.stdout, `portable Skill 安装完成：${receipt.selectedSkills.length} 项。`);
-            else {
-                const sanitize = (value) => redactString(value)
-                    .replace(/https?:\/\/\S+/giu, '[REDACTED URL]')
-                    .replace(/file:\/\/\S+/giu, '[REDACTED PATH]')
-                    .replace(/(?:file:\/\/)?(?:\/[\w.@+-]+){2,}/gu, '[REDACTED PATH]')
-                    .replace(/[A-Za-z]:\\(?:[^\s\\]+\\)+[^\s\\]*/gu, '[REDACTED PATH]');
-                const lines = new Set();
-                for (const failure of receipt.failures) {
-                    lines.add(`${failure.code}: ${sanitize(failure.message)}`);
-                }
-                for (const warning of receipt.warnings)
-                    lines.add(`警告：${sanitize(warning)}`);
-                const recoveries = receipt.failures.map((failure) => failure.recovery).filter(Boolean);
-                const recovery = recoveries.find((entry) => entry.includes('aw skill install')
-                    && entry.includes('skills remove'))
-                    ?? '重新运行 aw skill install；如需清理外部写入，请使用 skills remove。';
-                lines.add(`恢复：${sanitize(recovery)}`);
-                for (const line of lines)
-                    writeLine(io.stderr, line);
-            }
-            commandExitState.exitCode = receipt.ok ? 0 : 1;
-        }
-        catch (error) {
-            if (!rawOptions.json)
-                throw error;
-            writeFailure(error);
-            commandExitState.exitCode = 1;
-        }
-    });
     skill
         .command('materialize')
         .description('Write portable Skills to a safe output directory')
         .argument('<plugin>', 'plugin or source/plugin selector')
-        .requiredOption('-s, --scope <scope>', 'project or user')
+        .addOption(strictValueOption('--platform <target>', 'Portable platform target', PORTABLE_PLATFORM_TARGETS).makeOptionMandatory())
+        .addOption(strictValueOption('-s, --scope <scope>', 'artifact scope', ['user', 'project']).makeOptionMandatory())
         .requiredOption('--out <dir>', 'output directory')
         .option('--skill <name...>', 'write only selected Skill names')
         .option('-j, --json', 'emit one receipt v5 JSON object', false)
@@ -1484,6 +1049,7 @@ export function buildProgram(options = {}) {
         try {
             const receipt = await runActionWithContext(context, () => materializePortableSkillsToDirectory({
                 selector,
+                platform: rawOptions.platform,
                 scope: rawOptions.scope,
                 out: rawOptions.out,
                 ...(rawOptions.skill ? { requestedSkills: rawOptions.skill } : {}),
@@ -1501,7 +1067,7 @@ export function buildProgram(options = {}) {
                 throw error;
             const capabilityError = error instanceof AwCapabilityUnsupportedError ? error : undefined;
             const code = capabilityError?.code
-                ?? (error instanceof PortableCommandError || error instanceof SkillsCliError
+                ?? (error instanceof PortableCommandError
                     ? error.code
                     : 'portableMaterializeFailed');
             writeJsonReceipt(io.stdout, {
@@ -1510,6 +1076,7 @@ export function buildProgram(options = {}) {
                 ok: false,
                 plugin: { id: selector },
                 scope: rawOptions.scope,
+                platform: rawOptions.platform,
                 out: path.resolve(context.cwd, rawOptions.out),
                 selectedSkills: [],
                 ...(rawOptions.skill ? { requestedSkills: rawOptions.skill } : {}),
@@ -1571,13 +1138,6 @@ export function buildProgram(options = {}) {
         .option('--skill-short-description <text>', 'Skill UI summary (25-64 characters)')
         .option('--skill-invocation <mode>', 'model | manual | claude-model-only (default: model)')
         .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from current directory)');
-    plugin
-        .command('remove')
-        .description('Remove one committed and unchanged canonical plugin source tree')
-        .argument('<plugin-name>', 'existing lowercase hyphen-case plugin name')
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from current directory)')
-        .option('--yes', 'confirm plugin source deletion', false)
-        .option('--json', 'emit one schema 1 JSON object', false);
     plugin
         .command('validate')
         .description('Validate one source plugin directory')
@@ -1651,14 +1211,6 @@ export function buildProgram(options = {}) {
             commandExitState.exitCode = 1;
         }
     });
-    plugin
-        .command('status')
-        .description('Show current plugin status or compare against an explicit Git base')
-        .argument('[plugin-name]', 'one explicit plugin name')
-        .option('--all', 'check every current Catalog Workspace plugin', false)
-        .option('--base <git-ref>', 'explicit Git comparison base')
-        .option('--json', 'emit one schema v3 JSON document', false)
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from current directory)');
     skill
         .command('validate')
         .description('Validate one Agent Skill directory')
@@ -2035,12 +1587,10 @@ export function buildProgram(options = {}) {
             ? failure.message
             : redactString(sanitizeCatalogSourceErrorMessage(error instanceof Error ? error.message : String(error), env, [cwd]));
         writeLine(io.stderr, message);
-        commandExitState.exitCode = 1;
+        commandExitState.exitCode = failure.code === 'invalidArguments' ? 2 : 1;
     };
-    const withResolvedConfigMutationPlugin = (context, selector, consume, apply = false) => (async () => {
+    const withResolvedConfigMutationPlugin = (context, selector, consume, _apply = false) => (async () => {
         const parsed = parsePluginId(selector);
-        if (apply)
-            await prepareNativeCliExecution({ env: context.env, runner: context.nativeCliRunner });
         return withAwHomeMutationLock({
             env: context.env,
             action: async (awHomeMutationToken) => {
@@ -2449,777 +1999,409 @@ export function buildProgram(options = {}) {
         }
         commandExitState.exitCode = result.ok ? 0 : 1;
     });
-    program
-        .command('sync')
-        .description('Reconcile actual state from existing desired intent')
-        .argument('[plugins...]')
-        .requiredOption('-s, --scope <scope>', 'project or user')
-        .requiredOption('-p, --platform <platform>', 'codex, claude, or both')
-        .option('-a, --all', 'reconcile every desired plugin in the selected scope', false)
-        .option('--refresh', 'refresh only Catalog sources required by selected intent roots', false)
-        .option('--script-timeout <ms>', 'override plugin preApply script timeout in milliseconds')
-        .option('-y, --yes', 'authorize preApply and shared native replacement or forced repair', false)
-        .option('--allow-managed-codex-install', 'allow this command to acquire or rebuild the pinned AW-managed Codex runtime', false)
-        .option('-j, --json', 'print sync receipt as JSON', false)
-        .option('-v, --verbose', 'show command diagnostics', false)
-        .option('-D, --debug', 'write debug diagnostics to a log file', false)
-        .option('--log-file <path>', 'write debug diagnostics to the specified file')
-        .action(async (plugins, rawOptions) => {
-        const context = createActionContext('sync', rawOptions);
-        const normalized = normalizeWriteRequest(() => normalizeInstallCommandOptions({
-            cwd: context.cwd,
-            scope: rawOptions.scope,
-            platform: rawOptions.platform,
-            scriptTimeout: rawOptions.scriptTimeout,
-            allowManagedCodexInstall: rawOptions.allowManagedCodexInstall,
-        }));
-        const syncPlatform = normalized.platform;
-        const result = await runActionWithContext(context, () => syncCommand(plugins ?? [], {
-            cwd: context.cwd,
-            env: context.env,
-            platform: syncPlatform,
-            scope: normalized.scope,
-            all: rawOptions.all,
-            refresh: rawOptions.refresh,
-            cliVersion: resolveCliVersion(),
-            yes: rawOptions.yes,
-            json: rawOptions.json,
-            interactive: context.interactive && context.isTty && !context.isCi,
-            prompt: context.prompt,
-            allowManagedCodexInstall: rawOptions.allowManagedCodexInstall,
-            scriptTimeoutMs: normalized.scriptTimeoutMs,
-        }, context));
-        if (rawOptions.json) {
-            writeJsonReceipt(io.stdout, buildRebuildReceiptJson('sync', result));
-        }
-        else {
-            for (const line of renderRebuildReceipt('sync', result))
-                writeLine(io.stdout, line);
-        }
-        writeWarnings(io.stderr, result.warnings, { actionableOnly: true });
-        commandExitState.exitCode = resolveCommandReceiptExitCode(result);
-    });
-    program
-        .command('install')
-        .argument('[plugins...]')
-        .option('-s, --scope <scope>', 'project or user')
-        .option('-p, --platform <platform>', 'codex | claude | both')
-        .option('--dependency-scope <pluginId[#platform]=scope>', 'place one dependency at project or user scope; repeat for more dependencies', (value, previous) => [...previous, value], [])
-        .option('--script-timeout <ms>', 'override plugin preApply script timeout in milliseconds')
-        .option('--allow-managed-codex-install', 'allow this command to acquire or rebuild the pinned AW-managed Codex runtime', false)
-        .option('-y, --yes', 'authorize preApply and shared Codex native replacement', false)
-        .option('-j, --json', 'print receipt as JSON', false)
-        .option('-v, --verbose', 'show command diagnostics', false)
-        .option('-D, --debug', 'write debug diagnostics to a log file', false)
-        .option('--log-file <path>', 'write debug diagnostics to the specified file')
-        .action(async (plugins, rawOptions) => {
-        const context = createActionContext('install', rawOptions);
-        const outcome = await runActionWithContext(context, () => runWriteCommandAction('install', plugins ?? [], rawOptions, context));
-        if (outcome.cancelled)
-            return;
-        const receipt = outcome.result;
-        if (rawOptions.json) {
-            writeJsonReceipt(io.stdout, buildRebuildReceiptJson('install', receipt));
-        }
-        else {
-            for (const line of renderRebuildReceipt('install', receipt)) {
-                writeLine(io.stdout, line);
-            }
-        }
-        writeWarnings(io.stderr, receipt.warnings, { actionableOnly: true });
-        commandExitState.exitCode = resolveCommandReceiptExitCode(receipt);
-    });
-    program
-        .command('uninstall')
-        .argument('[plugins...]')
-        .option('-s, --scope <scope>', 'project or user')
-        .option('-p, --platform <platform>', 'codex | claude | both')
-        .option('--allow-managed-codex-install', 'allow this command to acquire or rebuild the pinned AW-managed Codex runtime', false)
-        .option('-y, --yes', 'confirm changes to installed native tool declarations', false)
-        .option('-j, --json', 'print receipt as JSON', false)
+    const recoveryCommand = (command) => command
+        .option('-j, --json', 'print one recovery receipt as JSON', false)
         .option('-v, --verbose', 'show command diagnostics', false)
         .option('-D, --debug', 'write debug diagnostics to a log file', false)
-        .option('--log-file <path>', 'write debug diagnostics to the specified file')
-        .action(async (plugins, rawOptions) => {
-        const context = createActionContext('uninstall', rawOptions);
-        const outcome = await runActionWithContext(context, () => runWriteCommandAction('uninstall', plugins ?? [], rawOptions, context));
-        if (outcome.cancelled)
-            return;
-        const receipt = outcome.result;
-        if (rawOptions.json) {
-            writeJsonReceipt(io.stdout, buildRebuildReceiptJson('uninstall', receipt));
-        }
-        else {
-            for (const line of renderRebuildReceipt('uninstall', receipt)) {
-                writeLine(io.stdout, line);
-            }
-        }
-        writeWarnings(io.stderr, receipt.warnings, { actionableOnly: true });
-        commandExitState.exitCode = resolveCommandReceiptExitCode(receipt);
-    });
-    program
-        .command('cleanup')
-        .argument('[plugins...]')
-        .option('-s, --scope <scope>', 'project or user')
-        .option('-p, --platform <platform>', 'codex | claude | both')
-        .option('-j, --json', 'print cleanup result as JSON', false)
-        .option('--force', 'use exact shallow evidence for exclusively owned damaged output; preserve foreign/shared content; no deleted-plugin-wide cleanup', false)
-        .option('-y, --yes', 'authorize cleanup of a deleted plugin across Codex, Claude Code, user and current project, including saved settings and shared native install', false)
-        .option('--allow-managed-codex-install', 'allow this command to acquire or rebuild the pinned AW-managed Codex runtime', false)
-        .option('-v, --verbose', 'show command diagnostics', false)
-        .option('-D, --debug', 'write debug diagnostics to a log file', false)
-        .option('--log-file <path>', 'write debug diagnostics to the specified file')
-        .action(async (plugins, rawOptions) => {
-        const context = createActionContext('cleanup', rawOptions);
-        const outcome = await runActionWithContext(context, () => runWriteCommandAction('cleanup', plugins ?? [], rawOptions, context));
-        if (outcome.cancelled)
-            return;
-        const result = outcome.result;
-        if (rawOptions.json) {
-            writeJsonReceipt(io.stdout, buildRebuildReceiptJson('cleanup', result));
-        }
-        else {
-            for (const line of renderRebuildReceipt('cleanup', result)) {
-                writeLine(io.stdout, line);
-            }
-        }
-        writeWarnings(io.stderr, result.warnings, { actionableOnly: true });
-        commandExitState.exitCode = resolveCommandReceiptExitCode(result);
-    });
-    program
-        .command('reinstall')
-        .argument('[plugins...]')
-        .option('-s, --scope <scope>', 'project or user')
-        .option('-p, --platform <platform>', 'codex | claude | both')
-        .option('--script-timeout <ms>', 'override plugin preApply script timeout in milliseconds')
-        .option('--allow-managed-codex-install', 'allow this command to acquire or rebuild the pinned AW-managed Codex runtime', false)
-        .option('-y, --yes', 'authorize preApply and shared Codex native replacement or forced reinstall', false)
-        .option('-j, --json', 'print receipt as JSON', false)
-        .option('-v, --verbose', 'show command diagnostics', false)
-        .option('-D, --debug', 'write debug diagnostics to a log file', false)
-        .option('--log-file <path>', 'write debug diagnostics to the specified file')
-        .action(async (plugins, rawOptions) => {
-        const context = createActionContext('reinstall', rawOptions);
-        const outcome = await runActionWithContext(context, () => runWriteCommandAction('reinstall', plugins ?? [], rawOptions, context));
-        if (outcome.cancelled)
-            return;
-        const receipt = outcome.result;
-        if (rawOptions.json) {
-            writeJsonReceipt(io.stdout, buildRebuildReceiptJson('reinstall', receipt));
-        }
-        else {
-            const lines = renderRebuildReceipt('reinstall', receipt);
-            for (const line of lines) {
-                writeLine(io.stdout, line);
-            }
-        }
-        writeWarnings(io.stderr, receipt.warnings, { actionableOnly: true });
-        commandExitState.exitCode = resolveCommandReceiptExitCode(receipt);
-    });
-    const config = program
-        .command('config')
-        .description('Manage AW plugin configuration');
-    config
-        .command('list')
-        .argument('[plugin]')
-        .option('-s, --scope <scope>', 'read only project or user config')
-        .option('-j, --json', 'print config as JSON', false)
-        .option('-v, --verbose', 'show command diagnostics', false)
-        .option('-D, --debug', 'write debug diagnostics to a log file', false)
-        .option('--log-file <path>', 'write debug diagnostics to the specified file')
-        .action(async (pluginName, rawOptions) => {
-        const context = createActionContext('config:list', rawOptions);
-        const outcome = await runActionWithContext(context, async () => {
-            resolveConfigReadResolution(rawOptions.scope);
-            const execute = async (selectedPlugin) => resolveMultiSourceConfigRead({
-                selector: selectedPlugin,
-                rawOptions,
-                context,
-            });
-            if (pluginName)
-                return { cancelled: false, pluginName, value: await execute(pluginName) };
-            if (!isWizardAvailable(context, rawOptions))
-                throw new Error(configCommandUsage('list'));
-            const currentCandidates = await loadWizardCandidates(context, {});
-            const storedCandidates = await loadStoredConfigWizardCandidates(context, configReadStoreLocations(rawOptions));
-            const candidates = mergeWizardCandidates(currentCandidates, storedCandidates);
-            if (candidates.length === 0) {
-                throw new Error('No plugin config candidates exist in the selected location.');
-            }
-            const result = await runCommandWizard(context, {
-                command: 'config:list',
-                candidates,
-                initial: { plugins: [], scope: rawOptions.scope },
-                pluginMode: 'single',
-                ...equivalentConfigCommandProjection((selection) => ({
-                    command: 'list',
-                    plugin: selection.plugins[0],
-                    scope: rawOptions.scope,
-                })),
-                execute: (selection) => execute(selection.plugins[0]),
-            });
-            return result.cancelled
-                ? { cancelled: true }
-                : { cancelled: false, pluginName: result.selection.plugins[0], value: result.value };
+        .option('--log-file <path>', 'write debug diagnostics to the specified file');
+    const scopedCommand = (command) => recoveryCommand(command)
+        .addOption(strictValueOption('--scope <scope>', 'requirement or physical scope', ['user', 'project']).makeOptionMandatory());
+    const contextualCommand = (command) => recoveryCommand(command)
+        .addOption(strictValueOption('--context <context>', 'user only, or user and current project', ['user', 'project']));
+    const recoveryScope = (rawOptions) => normalizeWriteRequest(() => parseScopeValue(rawOptions.scope));
+    const recoveryTargets = (rawOptions) => rawOptions.target === undefined
+        ? undefined : normalizeWriteRequest(() => normalizeAgents(typeof rawOptions.target === 'string' ? [rawOptions.target] : rawOptions.target));
+    const recoveryContext = (rawOptions) => rawOptions.context === undefined
+        ? undefined : normalizeWriteRequest(() => parseContextValue(rawOptions.context));
+    const runRecoveryAction = async (command, rawOptions, action) => {
+        const context = createActionContext(command, rawOptions);
+        const result = await runActionWithContext(context, () => action(context));
+        if (rawOptions.json)
+            writeJsonReceipt(io.stdout, result);
+        else
+            renderRecoveryReceipt(io.stdout, result);
+        commandExitState.exitCode = result.ok ? 0
+            : result.errors.some((error) => error.code === 'invalidArguments') ? 2 : 1;
+    };
+    const showWorkContext = async (context, rawOptions) => {
+        if (rawOptions.scope === 'project' && rawOptions.context === 'user') {
+            throw new WriteCommandRequestError('--scope project cannot be combined with --context user.');
+        }
+        const work = await resolveWorkContext({ cwd: context.cwd, context: recoveryContext(rawOptions),
+            ...(rawOptions.scope === undefined ? {} : { scope: recoveryScope(rawOptions) }) });
+        if (!rawOptions.json)
+            writeLine(io.stdout, work.projectRoot
+                ? `工作上下文：用户与当前项目 ${work.projectRoot}` : '工作上下文：仅用户');
+        return work;
+    };
+    const intent = plugin.command('intent').description('Manage user or project plugin requirements');
+    scopedCommand(intent.command('add').argument('<plugins...>'))
+        .action(async (plugins, rawOptions) => runRecoveryAction('intent:add', rawOptions, (context) => intentAdd({ scope: recoveryScope(rawOptions), cwd: context.cwd, env: context.env, selectors: plugins })));
+    scopedCommand(intent.command('remove').argument('<plugins...>'))
+        .action(async (plugins, rawOptions) => runRecoveryAction('intent:remove', rawOptions, (context) => intentRemove({ scope: recoveryScope(rawOptions), cwd: context.cwd, env: context.env, selectors: plugins })));
+    scopedCommand(intent.command('list'))
+        .action(async (rawOptions) => runRecoveryAction('intent:list', rawOptions, (context) => intentList({ scope: recoveryScope(rawOptions), cwd: context.cwd, env: context.env })));
+    scopedCommand(intent.command('retire').argument('<plugin>'))
+        .description('Retire a plugin proven absent from its healthy Catalog')
+        .option('--target <target>', 'limit output changes to a platform target', collectUniqueOption)
+        .option('--delete-config', 'also delete saved user plugin configuration', false)
+        .option('-y, --yes', 'confirm the reviewed retirement changes', false)
+        .option('--allow-managed-codex-install', 'allow acquisition of the pinned AW-managed Codex runtime', false)
+        .action(async (selector, rawOptions) => runRecoveryAction('intent:retire', rawOptions, (context) => runRetire({ scope: recoveryScope(rawOptions), cwd: context.cwd, env: context.env, selector,
+        cliVersion: resolveCliVersion(), targets: recoveryTargets(rawOptions),
+        deleteConfig: rawOptions.deleteConfig, yes: rawOptions.yes,
+        interactive: isWizardAvailable(context, rawOptions), prompt: context.prompt,
+    }, recoveryRuntime(context, rawOptions, true))));
+    const targets = plugin.command('targets').description('Manage the local platform policy');
+    contextualCommand(targets.command('set').argument('[targets...]'))
+        .option('--none', 'save an empty target set', false)
+        .option('--apply', 'apply the saved target policy in this work context', false)
+        .option('-y, --yes', 'confirm reviewed output changes', false)
+        .action(async (agents, rawOptions) => {
+        if (rawOptions.none ? agents.length > 0 : agents.length === 0) {
+            throw new WriteCommandRequestError('Use target IDs or --none, but not both.');
+        }
+        const normalized = normalizeWriteRequest(() => normalizeAgents(agents));
+        await runRecoveryAction('targets:set', rawOptions, async (context) => {
+            await showWorkContext(context, rawOptions);
+            return targetsSet({ cwd: context.cwd, env: context.env, targets: normalized,
+                context: recoveryContext(rawOptions), apply: rawOptions.apply, yes: rawOptions.yes,
+                cliVersion: resolveCliVersion(), runtime: recoveryRuntime(context, rawOptions, true) });
         });
-        if (outcome.cancelled)
-            return;
-        const resolved = outcome.value;
-        const selectedPluginName = resolved.pluginName;
-        if (rawOptions.json) {
-            writeJsonReceipt(io.stdout, {
-                ok: true,
-                configSchemaVersion: 4,
-                command: 'config:list',
-                plugin: selectedPluginName,
-                pluginName: selectedPluginName,
-                pluginId: resolved.pluginId,
-                sourceId: resolved.sourceId,
-                sourceIdentity: resolved.sourceIdentity,
-                scope: rawOptions.scope ?? 'effective',
-                ...(resolved.result.schema ? { schema: resolved.result.schema } : {}),
-                fields: resolved.result.fields,
-            });
-        }
-        else {
-            writeConfigReadHuman(io.stdout, resolved.result, resolved.pluginId);
-        }
     });
-    config
-        .command('get')
-        .argument('[plugin]')
-        .argument('[key]')
-        .option('-s, --scope <scope>', 'read only project or user config')
-        .option('-j, --json', 'print config as JSON', false)
-        .option('-v, --verbose', 'show command diagnostics', false)
-        .option('-D, --debug', 'write debug diagnostics to a log file', false)
-        .option('--log-file <path>', 'write debug diagnostics to the specified file')
-        .action(async (pluginName, key, rawOptions) => {
-        const context = createActionContext('config:get', rawOptions);
-        const outcome = await runActionWithContext(context, async () => {
-            resolveConfigReadResolution(rawOptions.scope);
-            const execute = async (selectedPlugin) => resolveMultiSourceConfigRead({
-                selector: selectedPlugin,
-                ...(key === undefined ? {} : { key }),
-                rawOptions,
-                context,
+    contextualCommand(targets.command('list'))
+        .action(async (rawOptions) => runRecoveryAction('targets:list', rawOptions, (context) => targetsList({ cwd: context.cwd, env: context.env, context: recoveryContext(rawOptions) })));
+    for (const action of ['exclude', 'include']) {
+        contextualCommand(targets.command(action).argument('<plugin>'))
+            .addOption(strictValueOption('--target <target>', 'one canonical platform target', PLATFORM_TARGETS).makeOptionMandatory())
+            .option('--apply', 'apply the saved exclusion policy in this work context', false)
+            .option('-y, --yes', 'confirm reviewed output changes', false)
+            .action(async (selector, rawOptions) => {
+            await runRecoveryAction(`targets:${action}`, rawOptions, async (context) => {
+                await showWorkContext(context, rawOptions);
+                return targetsChangeExclusion({ cwd: context.cwd, env: context.env, context: recoveryContext(rawOptions),
+                    selector, target: rawOptions.target, excluded: action === 'exclude', apply: rawOptions.apply,
+                    yes: rawOptions.yes, cliVersion: resolveCliVersion(), runtime: recoveryRuntime(context, rawOptions, true) });
             });
-            if (pluginName)
-                return { cancelled: false, pluginName, value: await execute(pluginName) };
-            if (!isWizardAvailable(context, rawOptions))
-                throw new Error(configCommandUsage('get'));
-            const currentCandidates = await loadWizardCandidates(context, {});
-            const storedCandidates = await loadStoredConfigWizardCandidates(context, configReadStoreLocations(rawOptions));
-            const candidates = mergeWizardCandidates(currentCandidates, storedCandidates);
-            if (candidates.length === 0) {
-                throw new Error('No plugin config candidates exist in the selected location.');
+        });
+    }
+    for (const command of ['sync', 'install', 'remove', 'cleanup']) {
+        const entry = command === 'cleanup'
+            ? scopedCommand(plugin.command(command).argument('[plugins...]'))
+            : contextualCommand(plugin.command(command).argument(command === 'sync' ? '[plugins...]' : '<plugins...>'));
+        entry.option('-y, --yes', 'authorize reviewed scripts or output changes', false)
+            .option('--allow-managed-codex-install', 'allow acquisition of the pinned AW-managed Codex runtime', false);
+        if (command === 'install' || command === 'remove')
+            entry
+                .addOption(strictValueOption('--scope <scope>', 'requirement document to edit', ['user', 'project']));
+        if (command === 'remove')
+            entry.option('--workspace-root <path>', 'delete plugin source from this explicit Catalog Workspace');
+        if (command === 'sync')
+            entry
+                .option('--target <target>', 'limit execution to a canonical platform target', collectUniqueOption)
+                .option('--rebuild', 'rebuild selected desired outputs', false)
+                .option('--check', 'observe without preparing or writing', false)
+                .option('--refresh', 'refresh required Catalog sources before review', false);
+        if (command === 'cleanup')
+            entry
+                .addOption(strictValueOption('--target <target>', 'physical platform target to clean', PLATFORM_TARGETS).makeOptionMandatory())
+                .option('--force', 'clean provably owned output despite damaged weak state', false);
+        if (command === 'install' || command === 'sync')
+            entry
+                .option('--script-timeout <ms>', 'override plugin preApply timeout in milliseconds');
+        entry.action(async (plugins, rawOptions) => {
+            if (rawOptions.check && (rawOptions.refresh || rawOptions.rebuild)) {
+                throw new WriteCommandRequestError('--check cannot be combined with --refresh or --rebuild.');
             }
-            const result = await runCommandWizard(context, {
-                command: 'config:get',
-                candidates,
-                initial: { plugins: [], key, scope: rawOptions.scope },
-                pluginMode: 'single',
-                ...equivalentConfigCommandProjection((selection) => ({
-                    command: 'get',
-                    plugin: selection.plugins[0],
-                    key,
-                    scope: rawOptions.scope,
-                })),
-                execute: (selection) => execute(selection.plugins[0]),
+            await runRecoveryAction(command, rawOptions, async (context) => {
+                if (command !== 'cleanup')
+                    await showWorkContext(context, rawOptions);
+                const targetValues = typeof rawOptions.target === 'string' ? [rawOptions.target] : rawOptions.target;
+                const options = {
+                    ...(rawOptions.scope === undefined ? {} : { scope: recoveryScope(rawOptions) }),
+                    context: recoveryContext(rawOptions), cwd: context.cwd, env: context.env, cliVersion: resolveCliVersion(),
+                    targets: targetValues === undefined ? undefined : normalizeWriteRequest(() => normalizeAgents(targetValues)),
+                    all: command === 'sync' && plugins.length === 0,
+                    yes: rawOptions.yes, force: rawOptions.force, refresh: rawOptions.refresh,
+                    allowManagedCodexInstall: rawOptions.allowManagedCodexInstall,
+                    scriptTimeoutMs: normalizeWriteRequest(() => resolveScriptTimeoutMs(rawOptions)),
+                    interactive: isWizardAvailable(context, rawOptions), prompt: context.prompt,
+                };
+                const backendCommand = command === 'remove' ? 'uninstall'
+                    : command === 'sync' && rawOptions.rebuild ? 'reinstall' : command;
+                const result = rawOptions.check ? await checkRecovery(plugins, options)
+                    : await runRecovery(backendCommand, plugins, options, recoveryRuntime(context, rawOptions, true));
+                return { ...result, command };
             });
-            return result.cancelled
-                ? { cancelled: true }
-                : { cancelled: false, pluginName: result.selection.plugins[0], value: result.value };
         });
-        if (outcome.cancelled)
-            return;
-        const resolved = outcome.value;
-        const selectedPluginName = resolved.pluginName;
-        if (rawOptions.json) {
-            writeJsonReceipt(io.stdout, {
-                ok: true,
-                configSchemaVersion: 4,
-                command: 'config:get',
-                plugin: selectedPluginName,
-                pluginName: selectedPluginName,
-                pluginId: resolved.pluginId,
-                sourceId: resolved.sourceId,
-                sourceIdentity: resolved.sourceIdentity,
-                key,
-                scope: rawOptions.scope ?? 'effective',
-                ...(resolved.result.schema ? { schema: resolved.result.schema } : {}),
-                fields: resolved.result.fields,
-            });
-        }
-        else {
-            writeConfigReadHuman(io.stdout, resolved.result, resolved.pluginId);
-        }
-    });
-    config
-        .command('set')
-        .argument('[plugin]')
-        .argument('[field]')
-        .option('-s, --scope <scope>', 'project or user')
-        .option('--value-json <json>', 'set the field to an exact JSON value')
-        .option('--value-stdin', 'read the exact string value from stdin until EOF', false)
-        .option('--preset <id>', 'set the field to the current manifest preset value')
-        .option('--apply', 'apply the saved config to visible desired placements', false)
-        .option('--script-timeout <ms>', 'override plugin preApply script timeout in milliseconds')
-        .option('-y, --yes', 'confirm preApply and shared Codex native config apply', false)
-        .option('-j, --json', 'print receipt as JSON', false)
+    }
+    const config = plugin.command('config').description('Manage user common and platform configuration');
+    const configCommand = (command) => command
+        .addOption(strictValueOption('--platform <target>', 'configuration platform; omitted means common', PLATFORM_TARGETS))
+        .addOption(strictValueOption('--context <context>', 'definition and reference context', ['user', 'project']))
+        .option('-j, --json', 'print one JSON object', false)
         .option('-v, --verbose', 'show command diagnostics', false)
         .option('-D, --debug', 'write debug diagnostics to a log file', false)
-        .option('--log-file <path>', 'write debug diagnostics to the specified file')
-        .action(async (pluginName, key, rawOptions) => {
-        if (!pluginName || !key)
-            throw new Error(configCommandUsage('set'));
-        const context = createActionContext('config:set', rawOptions);
-        let outcome;
-        try {
-            outcome = await runActionWithContext(context, async () => {
-                const scope = resolveConfigWriteScope(rawOptions.scope);
-                const scriptTimeoutMs = resolveScriptTimeoutMs(rawOptions);
-                const explicitValueCount = [
-                    rawOptions.valueJson !== undefined,
-                    rawOptions.valueStdin === true,
-                    rawOptions.preset !== undefined,
-                ].filter(Boolean).length;
-                if (explicitValueCount > 1
-                    || (explicitValueCount === 0
-                        && !(context.interactive && context.isTty && !context.isCi && rawOptions.json !== true))) {
-                    throw new Error('Use exactly one of --value-json <json>, --value-stdin, or --preset <id>.');
+        .option('--log-file <path>', 'write debug diagnostics to the specified file');
+    const configMutation = (command) => configCommand(command)
+        .option('--apply', 'refresh existing affected outputs after saving', false)
+        .option('--script-timeout <ms>', 'override plugin preApply timeout in milliseconds')
+        .option('-y, --yes', 'confirm reviewed output changes', false);
+    const configContext = async (context, rawOptions, apply = rawOptions.apply === true) => {
+        const requested = rawOptions.context === undefined ? apply ? undefined : 'user'
+            : normalizeWriteRequest(() => parseContextValue(rawOptions.context));
+        const work = await resolveWorkContext({ cwd: context.cwd, context: requested });
+        if (apply && !rawOptions.json)
+            writeLine(io.stdout, work.projectRoot
+                ? `工作上下文：用户与当前项目 ${work.projectRoot}` : '工作上下文：仅用户');
+        return work;
+    };
+    const configPlatform = (rawOptions) => rawOptions.platform === undefined
+        ? undefined : normalizeWriteRequest(() => parsePlatformTargetValue(rawOptions.platform));
+    for (const command of ['schema', 'list', 'get']) {
+        const entry = configCommand(config.command(command).argument('<plugin>'));
+        if (command === 'get')
+            entry.argument('[key]');
+        entry.action(async (...args) => {
+            const selector = args[0];
+            const key = command === 'get' ? args[1] : undefined;
+            const rawOptions = args[command === 'get' ? 2 : 1];
+            const context = createActionContext(`config:${command}`, rawOptions);
+            const work = await configContext(context, rawOptions);
+            const resolved = await runActionWithContext(context, () => resolveMultiSourceConfigRead({
+                selector, key, rawOptions: { ...rawOptions, context: work.context }, context,
+            }));
+            if (rawOptions.json)
+                writeJsonReceipt(io.stdout, {
+                    ok: true, configSchemaVersion: 5, command: `config:${command}`,
+                    plugin: resolved.pluginName, pluginName: resolved.pluginName, pluginId: resolved.pluginId,
+                    sourceId: resolved.sourceId, sourceIdentity: resolved.sourceIdentity,
+                    context: work, platform: configPlatform(rawOptions) ?? 'common',
+                    ...(resolved.result.schema ? { schema: resolved.result.schema } : {}),
+                    fields: command === 'schema' ? resolved.result.fieldDefinitions ?? {} : resolved.result.fields,
+                    ...(key === undefined ? {} : { key }),
+                });
+            else if (command === 'schema')
+                writeJsonReceipt(io.stdout, resolved.result.fieldDefinitions ?? {});
+            else
+                writeConfigReadHuman(io.stdout, resolved.result, resolved.pluginId);
+        });
+    }
+    for (const command of ['set', 'edit', 'unset']) {
+        const entry = configMutation(config.command(command).argument('<plugin>'));
+        if (command !== 'edit')
+            entry.argument('<field>');
+        if (command === 'set')
+            entry
+                .option('--value-json <json>', 'set an exact JSON value')
+                .option('--value-stdin', 'read the exact string value until stdin EOF', false)
+                .option('--preset <id>', 'use a declared preset');
+        entry.action(async (...args) => {
+            const selector = args[0];
+            const rawOptions = args[command === 'edit' ? 1 : 2];
+            let key = command === 'edit' ? undefined : args[1];
+            const context = createActionContext(`config:${command}`, rawOptions);
+            try {
+                const work = await configContext(context, rawOptions);
+                const platform = configPlatform(rawOptions);
+                const scriptTimeoutMs = normalizeWriteRequest(() => resolveScriptTimeoutMs(rawOptions));
+                if (command === 'edit' && (!isWizardAvailable(context, rawOptions) || !context.prompt.select || !context.prompt.input)) {
+                    throw new WriteCommandRequestError('config edit requires an interactive terminal. Use config set for scripts.');
                 }
-                return withResolvedConfigMutationPlugin(context, pluginName, async ({ pluginId, source, plugin }, awHomeMutationToken, catalogOperationContext) => {
-                    if (!plugin.manifest.config?.fields) {
-                        throw new Error(`configSchemaUnavailable: Plugin "${pluginName}" does not declare an AW config schema.`);
-                    }
-                    const field = plugin.manifest.config.fields[key];
-                    if (!field) {
-                        throw new Error(`Unknown config key "${key}".`);
-                    }
-                    const sensitive = field.sensitive === true;
-                    if (sensitive && scope !== 'user') {
-                        const error = new Error('sensitiveProjectConfigUnsupported: Sensitive config can only be set in user scope.');
-                        error.code = 'sensitiveProjectConfigUnsupported';
-                        throw error;
-                    }
-                    if (sensitive && (rawOptions.valueJson !== undefined || rawOptions.preset !== undefined)) {
-                        const error = new Error('sensitiveConfigInputUnsupported: Sensitive config cannot use --value-json or --preset.');
-                        error.code = 'sensitiveConfigInputUnsupported';
-                        throw error;
+                const explicitValueCount = [rawOptions.valueJson !== undefined, rawOptions.valueStdin === true,
+                    rawOptions.preset !== undefined].filter(Boolean).length;
+                if (command === 'set' && (explicitValueCount > 1 || explicitValueCount === 0
+                    && !(context.interactive && context.isTty && !context.isCi && !rawOptions.json))) {
+                    throw new WriteCommandRequestError('Use exactly one of --value-json, --value-stdin, or --preset.');
+                }
+                const receipt = await runActionWithContext(context, () => withResolvedConfigMutationPlugin(context, selector, async ({ pluginId, source, plugin }, awHomeMutationToken, catalogOperationContext) => {
+                    if (!plugin.manifest.config)
+                        throw Object.assign(new Error(`configSchemaUnavailable: Plugin "${plugin.manifest.name}" does not declare an AW config schema.`), { code: 'configSchemaUnavailable' });
+                    const fields = compilePluginConfigDefinition(plugin.manifest.config, platform).fields;
+                    if (command === 'edit') {
+                        const selected = await context.prompt.select({ message: `编辑用户${platform ?? 'common'}配置`,
+                            choices: Object.entries(fields).map(([value, field]) => ({ value, label: field.title ?? value })) });
+                        if (selected.cancelled || selected.action !== 'select' || selected.value === undefined)
+                            return undefined;
+                        key = selected.value;
                     }
-                    if (!sensitive && explicitValueCount !== 1) {
-                        throw new Error('Use exactly one of --value-json <json>, --value-stdin, or --preset <id>.');
+                    const field = fields[key];
+                    const store = await readPluginConfigStore({ sourceId: source.sourceId,
+                        sourceIdentity: source.sourceIdentity, logicalIdentity: source.logicalIdentity,
+                        pluginName: plugin.manifest.name, scope: 'user', platform, cwd: context.cwd, env: context.env,
+                        schema: fields });
+                    if (command === 'unset') {
+                        if (!Object.hasOwn(store.values, key))
+                            throw new WriteCommandRequestError(`Unknown config key "${key}" in the selected layer.`);
                     }
+                    else if (!field)
+                        throw new WriteCommandRequestError(`Unknown config key "${key}".`);
                     let inputValue;
-                    if (rawOptions.valueStdin === true) {
-                        inputValue = await readUtf8Stdin(context.stdin);
-                    }
-                    else if (sensitive) {
-                        if (!(context.interactive && context.isTty && !context.isCi && rawOptions.json !== true)
-                            || !context.prompt.password) {
-                            const error = new Error('sensitiveConfigStdinRequired: Use --value-stdin for sensitive config outside an interactive terminal.');
-                            error.code = 'sensitiveConfigStdinRequired';
-                            throw error;
+                    if (command !== 'unset') {
+                        const sensitive = field.sensitive === true;
+                        if (sensitive && (rawOptions.valueJson !== undefined || rawOptions.preset !== undefined)) {
+                            throw new Error('sensitiveConfigInputUnsupported: Sensitive config requires --value-stdin.');
                         }
-                        const response = await context.prompt.password({
-                            message: `输入 ${field.title ?? key}`,
-                            mask: true,
-                        });
-                        if (response.cancelled || response.action !== 'select' || response.value === undefined) {
-                            const error = new Error('sensitiveConfigInputCancelled: Sensitive config input was cancelled.');
-                            error.code = 'sensitiveConfigInputCancelled';
-                            throw error;
+                        if (rawOptions.valueStdin)
+                            inputValue = await readUtf8Stdin(context.stdin);
+                        else if (sensitive) {
+                            if (!context.interactive || !context.isTty || context.isCi || rawOptions.json || !context.prompt.password) {
+                                throw new Error('sensitiveConfigStdinRequired: Use --value-stdin outside an interactive terminal.');
+                            }
+                            const response = await context.prompt.password({ message: `输入 ${field.title ?? key}`, mask: true });
+                            if (response.cancelled || response.action !== 'select' || response.value === undefined)
+                                return undefined;
+                            inputValue = response.value;
                         }
-                        inputValue = response.value;
-                    }
-                    else if (rawOptions.valueJson !== undefined) {
-                        try {
-                            inputValue = JSON.parse(rawOptions.valueJson);
+                        else if (command === 'edit' || explicitValueCount === 0) {
+                            if (!context.prompt.input)
+                                throw new WriteCommandRequestError('Use --value-json, --value-stdin, or --preset.');
+                            const response = await context.prompt.input({ message: `输入 ${field.title ?? key} 的 JSON 值`,
+                                defaultValue: JSON.stringify(store.values[key]) });
+                            if (response.cancelled || response.action !== 'select' || response.value === undefined)
+                                return undefined;
+                            try {
+                                inputValue = JSON.parse(response.value);
+                            }
+                            catch {
+                                throw new WriteCommandRequestError('Enter a valid JSON value.');
+                            }
                         }
-                        catch {
-                            throw new Error('--value-json must contain valid JSON.');
+                        else if (rawOptions.valueJson !== undefined) {
+                            try {
+                                inputValue = JSON.parse(rawOptions.valueJson);
+                            }
+                            catch {
+                                throw new WriteCommandRequestError('--value-json must contain valid JSON.');
+                            }
+                        }
+                        else {
+                            const preset = field.choices?.presets.find((candidate) => candidate.id === rawOptions.preset);
+                            if (!preset)
+                                throw new WriteCommandRequestError(`Unknown preset "${rawOptions.preset}".`);
+                            inputValue = structuredClone(preset.value);
                         }
                     }
-                    else {
-                        const preset = field.choices?.presets.find((entry) => entry.id === rawOptions.preset);
-                        if (!preset)
-                            throw new Error(`Unknown preset "${rawOptions.preset}" for config key "${key}".`);
-                        inputValue = structuredClone(preset.value);
-                    }
-                    const writeReceipt = await applyPluginConfigWrite({
-                        plugin,
-                        pluginName: plugin.manifest.name,
-                        scope,
-                        cwd: context.cwd,
-                        env: context.env,
-                        nativeCliRunner: context.nativeCliRunner,
-                        rebuildRuntime: {
-                            ...context,
-                            awHomeMutationToken,
-                            catalogOperationContext,
+                    const writeReceipt = await applyPluginConfigWrite({ plugin, pluginName: plugin.manifest.name,
+                        scope: work.context, context: work.context, platform, cliVersion: resolveCliVersion(),
+                        cwd: context.cwd, env: context.env, nativeCliRunner: context.nativeCliRunner,
+                        rebuildRuntime: { ...context, awHomeMutationToken, catalogOperationContext,
                             expectedGenerationSetDigest: catalogOperationContext.generationSetDigest,
-                            ...(scriptTimeoutMs === undefined ? {} : { scriptTimeoutMs }),
-                        },
-                        awHomeMutationToken,
-                        request: {
-                            updates: { [key]: inputValue },
-                        },
-                        apply: rawOptions.apply === true,
-                        sharedNativeApplyConfirmed: rawOptions.yes === true,
-                        preApplyConfirmed: rawOptions.yes === true,
-                    });
-                    return buildConfigMutationReceipt('config:set', {
-                        ok: writeReceipt.overallState === 'succeeded',
-                        ...writeReceipt,
-                        plugin: plugin.manifest.name,
-                        pluginName: plugin.manifest.name,
-                        pluginId,
-                        sourceId: source.sourceId,
-                        sourceIdentity: source.sourceIdentity,
-                        affectedFields: [{
-                                key,
-                                title: field.title ?? key,
-                                kind: 'manifest',
-                                reserved: false,
-                                action: 'set',
-                                scope,
-                            }],
+                            ...(scriptTimeoutMs === undefined ? {} : { scriptTimeoutMs }) },
+                        awHomeMutationToken, request: command === 'unset' ? { removeKeys: [key] } : { updates: { [key]: inputValue } },
+                        apply: rawOptions.apply === true, sharedNativeApplyConfirmed: rawOptions.yes === true,
+                        preApplyConfirmed: rawOptions.yes === true });
+                    return buildConfigMutationReceipt(`config:${command}`, {
+                        ...writeReceipt, ok: writeReceipt.overallState === 'succeeded', plugin: plugin.manifest.name,
+                        pluginName: plugin.manifest.name, pluginId, sourceId: source.sourceId, sourceIdentity: source.sourceIdentity,
+                        context: work, platform: platform ?? 'common',
+                        ...(command === 'unset' ? { removedKey: key, existed: true } : {}),
+                        affectedFields: [{ key: key, title: field?.title ?? key, kind: 'manifest', reserved: false,
+                                action: command === 'unset' ? 'unset' : 'set', scope: 'user',
+                                ...(writeReceipt.staleRemovedKeys?.includes(key) ? { stale: true } : {}) }],
                     });
-                }, rawOptions.apply === true);
-            });
-        }
-        catch (error) {
-            writeConfigMutationFailure('config:set', pluginName, rawOptions.json === true, error);
-            return;
-        }
-        const receipt = outcome;
-        if (rawOptions.json) {
-            writeJsonReceipt(io.stdout, receipt);
-        }
-        else {
-            writeLine(io.stdout, `已写入 ${receipt.plugin}.${key}（${configLayerLabel(receipt.scope)}配置）。`);
-            writeConfigApplyNotice(io.stderr, receipt);
-        }
-        commandExitState.exitCode = receipt.overallState === 'succeeded' ? 0 : 1;
-    });
-    config
-        .command('unset')
-        .argument('[plugin]')
-        .argument('[key]')
-        .option('-s, --scope <scope>', 'project or user')
-        .option('--apply', 'apply the saved config to visible desired placements', false)
-        .option('--script-timeout <ms>', 'override plugin preApply script timeout in milliseconds')
-        .option('-y, --yes', 'confirm preApply and shared Codex native config apply', false)
-        .option('-j, --json', 'print receipt as JSON', false)
-        .option('-v, --verbose', 'show command diagnostics', false)
-        .option('-D, --debug', 'write debug diagnostics to a log file', false)
-        .option('--log-file <path>', 'write debug diagnostics to the specified file')
-        .action(async (pluginName, key, rawOptions) => {
-        const context = createActionContext('config:unset', rawOptions);
-        let outcome;
-        try {
-            outcome = await runActionWithContext(context, async () => {
-                const scope = resolveConfigWriteScope(rawOptions.scope);
-                const scriptTimeoutMs = resolveScriptTimeoutMs(rawOptions);
-                const execute = async (selectedPlugin, selectedKey, confirmed) => withResolvedConfigMutationPlugin(context, selectedPlugin, async ({ pluginId, source, plugin }, awHomeMutationToken, catalogOperationContext) => {
-                    const store = await readPluginConfigStore({
-                        sourceId: source.sourceId,
-                        sourceIdentity: source.sourceIdentity,
-                        logicalIdentity: source.logicalIdentity,
-                        pluginName: plugin.manifest.name,
-                        scope,
-                        cwd: context.cwd,
-                        env: context.env,
-                        schema: plugin.manifest.config?.fields,
-                    });
-                    const existed = Object.hasOwn(store.values, selectedKey);
-                    if (!existed)
-                        throw new Error(`Unknown config key "${selectedKey}".`);
-                    const writeReceipt = await applyPluginConfigWrite({
-                        plugin,
-                        pluginName: plugin.manifest.name,
-                        scope,
-                        cwd: context.cwd,
-                        env: context.env,
-                        nativeCliRunner: context.nativeCliRunner,
-                        rebuildRuntime: {
-                            ...context,
-                            awHomeMutationToken,
-                            catalogOperationContext,
-                            expectedGenerationSetDigest: catalogOperationContext.generationSetDigest,
-                            ...(scriptTimeoutMs === undefined ? {} : { scriptTimeoutMs }),
-                        },
-                        awHomeMutationToken,
-                        request: {
-                            removeKeys: [selectedKey],
-                        },
-                        apply: rawOptions.apply === true,
-                        sharedNativeApplyConfirmed: confirmed,
-                        preApplyConfirmed: rawOptions.yes === true,
-                    });
-                    return buildConfigMutationReceipt('config:unset', {
-                        ok: writeReceipt.overallState === 'succeeded',
-                        ...writeReceipt,
-                        plugin: plugin.manifest.name,
-                        pluginName: plugin.manifest.name,
-                        pluginId,
-                        sourceId: source.sourceId,
-                        sourceIdentity: source.sourceIdentity,
-                        removedKey: selectedKey,
-                        existed,
-                        affectedFields: [{
-                                key: selectedKey,
-                                title: plugin?.manifest.config?.fields?.[selectedKey]?.title ?? selectedKey,
-                                kind: 'manifest',
-                                reserved: false,
-                                action: 'unset',
-                                scope,
-                                ...(!plugin.manifest.config?.fields?.[selectedKey] ? { stale: true } : {}),
-                            }],
-                    });
-                }, rawOptions.apply === true);
-                if (pluginName && key) {
-                    return {
-                        cancelled: false,
-                        value: await execute(pluginName, key, rawOptions.yes === true),
-                    };
-                }
-                if (!isWizardAvailable(context, rawOptions))
-                    throw new Error(configCommandUsage('unset'));
-                const loadedCurrentCandidates = await loadWizardCandidates(context, {});
-                const currentCandidates = loadedCurrentCandidates.filter(hasConfigSchemaKeys);
-                const candidates = currentCandidates;
-                if (pluginName && !candidates.some((entry) => entry.pluginName === pluginName)) {
-                    throw new Error(`Unknown plugin "${pluginName}".`);
+                }, rawOptions.apply === true));
+                if (!receipt)
+                    return;
+                if (rawOptions.json)
+                    writeJsonReceipt(io.stdout, receipt);
+                else {
+                    writeLine(io.stdout, `已保存 ${receipt.plugin}.${key}（用户 ${platform ?? 'common'} 配置）。`);
+                    writeConfigApplyNotice(io.stderr, receipt);
                 }
-                if (candidates.length === 0) {
-                    throw new Error('No plugin config candidates exist in the selected location.');
-                }
-                const result = await runCommandWizard(context, {
-                    command: 'config:unset',
-                    candidates,
-                    initial: { plugins: pluginName ? [pluginName] : [], key, scope },
-                    pluginMode: pluginName ? 'none' : 'single',
-                    promptForKey: key === undefined,
-                    destructive: true,
-                    ...equivalentConfigCommandProjection((selection) => ({
-                        command: 'unset',
-                        plugin: selection.plugins[0],
-                        key: selection.key,
-                        scope: selection.scope ?? 'user',
-                    })),
-                    resultState: overallResultState,
-                    execute: (selection) => execute(selection.plugins[0], selection.key, true),
-                });
-                return result.cancelled
-                    ? { cancelled: true }
-                    : { cancelled: false, value: result.value };
-            });
-        }
-        catch (error) {
-            writeConfigMutationFailure('config:unset', pluginName, rawOptions.json === true, error);
-            return;
-        }
-        if (outcome.cancelled)
-            return;
-        const receipt = outcome.value;
-        if (rawOptions.json) {
-            writeJsonReceipt(io.stdout, receipt);
-        }
-        else {
-            writeLine(io.stdout, receipt.existed
-                ? `已删除 ${receipt.plugin}.${receipt.removedKey}（${configLayerLabel(receipt.scope)}配置）。`
-                : `${receipt.plugin}.${receipt.removedKey}（${configLayerLabel(receipt.scope)}配置）原本不存在。`);
-            writeConfigApplyNotice(io.stderr, receipt);
-        }
-        commandExitState.exitCode = receipt.overallState === 'succeeded' ? 0 : 1;
-    });
-    config
-        .command('reset')
-        .argument('[plugin]')
-        .option('-s, --scope <scope>', 'project or user')
-        .option('--apply', 'apply the saved config to visible desired placements', false)
-        .option('--script-timeout <ms>', 'override plugin preApply script timeout in milliseconds')
-        .option('-y, --yes', 'confirm destructive reset and preApply/shared Codex native config apply', false)
-        .option('-j, --json', 'print receipt as JSON', false)
-        .option('-v, --verbose', 'show command diagnostics', false)
-        .option('-D, --debug', 'write debug diagnostics to a log file', false)
-        .option('--log-file <path>', 'write debug diagnostics to the specified file')
-        .action(async (pluginName, rawOptions) => {
+                commandExitState.exitCode = receipt.overallState === 'succeeded' ? 0 : 1;
+            }
+            catch (error) {
+                writeConfigMutationFailure(`config:${command}`, selector, rawOptions.json === true, error);
+            }
+        });
+    }
+    configMutation(config.command('reset').argument('<plugin>'))
+        .action(async (selector, rawOptions) => {
         const context = createActionContext('config:reset', rawOptions);
-        let outcome;
         try {
-            outcome = await runActionWithContext(context, async () => {
-                const execute = async (selectedPlugin, selectedScope, confirmed) => {
-                    const scriptTimeoutMs = resolveScriptTimeoutMs(rawOptions);
-                    if (!confirmed) {
-                        throw new Error(`Reset requires confirmation. Re-run \`aw config reset ${selectedPlugin} -s ${selectedScope} --yes\` to delete this store.`);
-                    }
-                    const located = await resolveStoredConfigResetIdentity({
-                        selector: selectedPlugin,
-                        context,
-                        scope: selectedScope,
-                    });
-                    const resetLocatedStore = async (plugin, pluginError) => {
-                        const affectedFields = await describeResetAffectedFields({
-                            sourceId: located.sourceId,
-                            sourceIdentity: located.sourceIdentity,
-                            logicalIdentity: located.logicalIdentity,
-                            pluginName: located.pluginName,
-                            plugin,
-                            pluginError,
-                            scope: selectedScope,
-                            cwd: context.cwd,
-                            env: context.env,
-                        }).catch(() => []);
-                        const resetReceipt = await resetPluginConfigWithHelper({
-                            sourceId: located.sourceId,
-                            sourceIdentity: located.sourceIdentity,
-                            logicalIdentity: located.logicalIdentity,
-                            pluginName: located.pluginName,
-                            scope: selectedScope,
-                            cwd: context.cwd,
-                            env: context.env,
-                            nativeCliRunner: context.nativeCliRunner,
-                            plugin,
-                            pluginError,
-                            apply: rawOptions.apply === true,
-                            rebuildRuntime: scriptTimeoutMs === undefined ? undefined : { scriptTimeoutMs },
-                            sharedNativeApplyConfirmed: confirmed,
-                            preApplyConfirmed: rawOptions.yes === true,
-                        });
-                        return buildConfigMutationReceipt('config:reset', {
-                            ok: resetReceipt.overallState === 'succeeded',
-                            ...resetReceipt,
-                            plugin: located.pluginName,
-                            pluginName: located.pluginName,
-                            pluginId: located.pluginId,
-                            sourceId: located.sourceId,
-                            ...(located.sourceIdentity ? { sourceIdentity: located.sourceIdentity } : {}),
-                            affectedFields,
-                        });
-                    };
-                    let resetStarted = false;
-                    try {
-                        return await withResolvedCatalogPlugin({
-                            selector: located.pluginId,
-                            cliVersion: resolveCliVersion(),
-                            env: context.env,
-                            consume: async ({ plugin }) => {
-                                resetStarted = true;
-                                return resetLocatedStore(plugin, null);
-                            },
-                        });
-                    }
-                    catch (error) {
-                        if (resetStarted)
-                            throw error;
-                        return resetLocatedStore(null, error instanceof Error ? error : new Error(String(error)));
-                    }
-                };
-                const scope = resolveConfigWriteScope(rawOptions.scope);
-                const needsWizard = pluginName === undefined || rawOptions.yes !== true;
-                if (!needsWizard) {
-                    return {
-                        cancelled: false,
-                        value: await execute(pluginName, scope, true),
-                    };
-                }
-                if (!isWizardAvailable(context, rawOptions)) {
-                    if (!pluginName)
-                        throw new Error(configCommandUsage('reset'));
-                    return {
-                        cancelled: false,
-                        value: await execute(pluginName, scope, false),
-                    };
-                }
-                const currentCandidates = pluginName ? [] : await loadWizardCandidates(context, {});
-                const candidatesByScope = new Map();
-                if (!pluginName && (rawOptions.scope === undefined || scope === 'user')) {
-                    candidatesByScope.set('user', mergeWizardCandidates(currentCandidates, await loadStoredConfigWizardCandidates(context, [{ scope: 'user' }], { includeEmptyStores: true })));
-                }
-                if (!pluginName && (rawOptions.scope === undefined || scope === 'project')) {
-                    candidatesByScope.set('project', mergeWizardCandidates(currentCandidates, await loadStoredConfigWizardCandidates(context, [{ scope: 'project' }], { includeEmptyStores: true })));
+            const work = await configContext(context, rawOptions);
+            const platform = configPlatform(rawOptions);
+            if (!rawOptions.yes) {
+                if (!isWizardAvailable(context, rawOptions) || !context.prompt.confirm)
+                    throw new WriteCommandRequestError('config reset requires --yes.');
+                const confirmed = await context.prompt.confirm({ message: `删除 ${selector} 的用户 ${platform ?? 'common'} 覆盖？`, defaultValue: false });
+                if (confirmed.cancelled || confirmed.value !== true)
+                    return;
+            }
+            const located = await resolveStoredConfigResetIdentity({ selector, context, scope: 'user' });
+            const resetStore = async (plugin, pluginError) => resetPluginConfigWithHelper({ ...located, plugin, pluginError, platform, scope: work.context,
+                context: work.context, cliVersion: resolveCliVersion(), cwd: context.cwd, env: context.env,
+                nativeCliRunner: context.nativeCliRunner, apply: rawOptions.apply === true,
+                rebuildRuntime: { ...context, scriptTimeoutMs: resolveScriptTimeoutMs(rawOptions) },
+                sharedNativeApplyConfirmed: true, preApplyConfirmed: rawOptions.yes === true });
+            let started = false;
+            const resetReceipt = await runActionWithContext(context, async () => {
+                try {
+                    return await withResolvedCatalogPlugin({ selector: located.pluginId, cliVersion: resolveCliVersion(), env: context.env,
+                        consume: ({ plugin }) => { started = true; return resetStore(plugin, null); } });
                 }
-                const candidates = mergeWizardCandidates(candidatesByScope.get('user') ?? [], candidatesByScope.get('project') ?? []);
-                if (!pluginName && candidates.length === 0) {
-                    throw new Error('No plugin config candidates exist in the selected location.');
+                catch (error) {
+                    if (started)
+                        throw error;
+                    return resetStore(null, error instanceof Error ? error : new Error(String(error)));
                 }
-                const result = await runCommandWizard(context, {
-                    command: 'config:reset',
-                    candidates,
-                    initial: { plugins: pluginName ? [pluginName] : [], scope },
-                    pluginMode: pluginName ? 'none' : 'single',
-                    promptForScope: rawOptions.scope === undefined,
-                    destructive: true,
-                    isPluginVisible: (candidate, selection) => candidatesByScope
-                        .get(selection.scope ?? 'user')
-                        ?.some((entry) => entry.pluginName === candidate.pluginName) !== false,
-                    ...equivalentConfigCommandProjection((selection) => ({
-                        command: 'reset',
-                        plugin: selection.plugins[0],
-                        scope: selection.scope ?? 'user',
-                        confirmed: true,
-                    })),
-                    resultState: overallResultState,
-                    execute: (selection) => execute(selection.plugins[0], selection.scope ?? 'user', true),
-                });
-                return result.cancelled
-                    ? { cancelled: true }
-                    : { cancelled: false, value: result.value };
             });
+            const receipt = buildConfigMutationReceipt('config:reset', { ...resetReceipt,
+                ok: resetReceipt.overallState === 'succeeded', ...located, plugin: located.pluginName,
+                context: work, platform: platform ?? 'common' });
+            if (rawOptions.json)
+                writeJsonReceipt(io.stdout, receipt);
+            else {
+                writeLine(io.stdout, `已恢复 ${receipt.plugin} 的用户 ${platform ?? 'common'} 默认配置。`);
+                writeConfigApplyNotice(io.stderr, receipt);
+            }
+            commandExitState.exitCode = receipt.overallState === 'succeeded' ? 0 : 1;
         }
         catch (error) {
-            writeConfigMutationFailure('config:reset', pluginName, rawOptions.json === true, error);
-            return;
-        }
-        if (outcome.cancelled)
-            return;
-        const receipt = outcome.value;
-        if (rawOptions.json) {
-            writeJsonReceipt(io.stdout, receipt);
+            writeConfigMutationFailure('config:reset', selector, rawOptions.json === true, error);
         }
+    });
+    contextualCommand(config.command('apply').argument('<plugin>'))
+        .option('--target <target>', 'limit existing-output refresh to this platform target', collectUniqueOption)
+        .option('-y, --yes', 'confirm reviewed output changes', false)
+        .option('--script-timeout <ms>', 'override plugin preApply timeout in milliseconds')
+        .action(async (selector, rawOptions) => {
+        const context = createActionContext('config:apply', rawOptions);
+        const work = await configContext(context, rawOptions, true);
+        const targets = rawOptions.target?.map((target) => normalizeWriteRequest(() => parsePlatformTargetValue(target)));
+        const receipt = await runActionWithContext(context, () => withResolvedConfigMutationPlugin(context, selector, async ({ plugin, pluginId, source }, awHomeMutationToken) => ({
+            ...await applyPluginConfig({ plugin, scope: work.context, context: work.context, targets,
+                cliVersion: resolveCliVersion(), cwd: context.cwd, env: context.env, awHomeMutationToken,
+                nativeCliRunner: context.nativeCliRunner, sharedNativeApplyConfirmed: rawOptions.yes === true,
+                preApplyConfirmed: rawOptions.yes === true, rebuildRuntime: { ...context, scriptTimeoutMs: resolveScriptTimeoutMs(rawOptions) } }),
+            command: 'config:apply', plugin: plugin.manifest.name, pluginId, sourceId: source.sourceId,
+            context: work,
+        }), true));
+        const result = buildConfigMutationReceipt('config:apply', { ...receipt,
+            ok: receipt.overallState === 'succeeded' });
+        if (rawOptions.json)
+            writeJsonReceipt(io.stdout, result);
         else {
-            writeLine(io.stdout, receipt.deleted
-                ? `已重置 ${receipt.plugin} 的${configLayerLabel(receipt.scope)}配置。`
-                : `${receipt.plugin} 没有可重置的${configLayerLabel(receipt.scope)}配置。`);
-            writeConfigApplyNotice(io.stderr, receipt);
+            writeLine(io.stdout, `配置应用：${result.ok ? '完成' : '部分失败'}。`);
+            writeConfigApplyNotice(io.stderr, { ...result, warnings: [] });
         }
-        commandExitState.exitCode = receipt.overallState === 'succeeded' ? 0 : 1;
+        commandExitState.exitCode = result.ok ? 0 : 1;
     });
-    program
-        .command('status')
-        .argument('[plugins...]')
-        .option('-s, --scope <scope>', 'filter by scope')
-        .option('-p, --platform <platform>', 'filter by platform')
-        .option('-v, --verbose', 'show status details and command diagnostics', false)
-        .option('-D, --debug', 'write debug diagnostics to a log file', false)
-        .option('--log-file <path>', 'write debug diagnostics to the specified file')
-        .option('-j, --json', 'print status as JSON', false)
-        .action(async (plugins, rawOptions) => {
+    contextualCommand(plugin.command('status'))
+        .description('Observe user and current project demand and output state')
+        .action(async (rawOptions) => {
         const context = createActionContext('status', rawOptions);
-        const result = await runActionWithContext(context, () => statusCommandV8({
-            plugins: plugins ?? [],
-            cwd,
-            env: context.env,
-            cliVersion: resolveCliVersion(),
-            platform: rawOptions.platform,
-            scope: rawOptions.scope,
-            json: rawOptions.json,
-            verbose: rawOptions.verbose,
+        await showWorkContext(context, rawOptions);
+        const result = await runActionWithContext(context, () => readRecoveryStatus({
+            context: recoveryContext(rawOptions), cwd: context.cwd, env: context.env, cliVersion: resolveCliVersion(),
+            nativeCliRunner: context.nativeCliRunner,
         }));
-        commandExitState.exitCode = result.hasErrors ? 1 : 0;
-        writeLine(io.stdout, result.output);
-        for (const source of result.payload.catalog.sources) {
-            if (rawOptions.json && source.error)
-                writeLine(io.stderr, `${source.id}: ${source.error}`);
-        }
-        for (const error of result.payload.errors) {
-            if (rawOptions.json && error.code !== 'nativeStateUnreadable' && error.code !== 'stateInventoryFailed') {
-                writeLine(io.stderr, error.message);
-            }
-        }
+        if (rawOptions.json)
+            writeJsonReceipt(io.stdout, result);
+        else
+            renderRecoveryStatus(io.stdout, result);
+        commandExitState.exitCode = result.errors.length ? 1 : 0;
     });
     Object.assign(program, { __awCommandExitState: commandExitState });
     return program;
@@ -3251,9 +2433,16 @@ export async function runCli(argv, options = {}) {
         ? argv[1]
         : null;
     const jsonReviewCommand = reviewCommand !== null && argv.includes('--json');
+    const jsonMaterialize = argv[0] === 'skill' && argv[1] === 'materialize'
+        && (argv.includes('--json') || argv.includes('-j'));
+    const jsonConfigCommand = jsonConfigReadRequested(argv);
+    const explicitWorkspace = argv.some((token) => token === '--workspace-root' || token.startsWith('--workspace-root='));
+    const authoringPluginCommand = argv[0] === 'plugin'
+        && (['build', 'test', 'validate', 'init', 'add-skill'].includes(argv[1] ?? '')
+            || ['remove', 'status'].includes(argv[1] ?? '') && explicitWorkspace);
     const jsonAuthoringCommand = argv.includes('--json')
         && ((argv[0] === 'catalog' && ['init', 'context', 'version', 'build', 'validate', 'status', 'publish'].includes(argv[1] ?? ''))
-            || (argv[0] === 'plugin' && ['build', 'test', 'validate', 'status', 'remove'].includes(argv[1] ?? ''))
+            || authoringPluginCommand
             || reviewCommand !== null)
         ? `${argv[0]}:${argv[1]}`
         : null;
@@ -3263,7 +2452,8 @@ export async function runCli(argv, options = {}) {
         && ['activate', 'status', 'deactivate'].includes(argv[2] ?? '')
         ? argv[2]
         : null;
-    const jsonWriteRequest = jsonWriteCommandRequest(argv);
+    const recovery = recoveryRequest(argv);
+    const jsonRecoveryRequest = recovery?.json ? recovery : null;
     const jsonConfigMutation = jsonConfigMutationRequest(argv);
     try {
         const authoringScriptByCommand = {
@@ -3273,12 +2463,13 @@ export async function runCli(argv, options = {}) {
             validate: 'validate-plugin.mjs',
             status: 'plugin-status.mjs',
         };
-        const authoringScript = argv[0] === 'plugin'
+        const authoringScript = authoringPluginCommand
             ? authoringScriptByCommand[argv[1] ?? '']
             : argv[0] === 'skill' && argv[1] === 'validate'
                 ? 'validate-skill.mjs'
                 : undefined;
-        if (authoringScript && !argv.includes('--help') && !argv.includes('-h')) {
+        if (authoringScript && ((!argv.includes('--help') && !argv.includes('-h'))
+            || explicitWorkspace && ['remove', 'status'].includes(argv[1] ?? ''))) {
             const authoringArgs = argv.slice(2);
             let authoringEnv = options.env ?? process.env;
             if (argv[0] === 'plugin'
@@ -3388,7 +2579,7 @@ export async function runCli(argv, options = {}) {
         }
         let catalogPublicationActionStarted = false;
         let configMutationActionStarted = false;
-        const programIo = jsonCatalogDevCommand || jsonWriteRequest || jsonReviewCommand
+        const programIo = jsonCatalogDevCommand || jsonRecoveryRequest || jsonReviewCommand || jsonMaterialize || jsonConfigCommand
             ? { ...io, stderr: () => undefined }
             : jsonConfigMutation
                 ? {
@@ -3432,6 +2623,16 @@ export async function runCli(argv, options = {}) {
         return program.__awCommandExitState?.exitCode ?? 0;
     }
     catch (error) {
+        if (jsonMaterialize && error instanceof CommanderError) {
+            if (error.exitCode === 0)
+                return 0;
+            writeJsonReceipt(io.stdout, {
+                receiptSchemaVersion: 5, command: 'skill:materialize', ok: false,
+                selectedSkills: [], dependencies: [], configDigest: null, materializationDigest: null,
+                outputDigest: null, errors: [{ code: 'invalidArguments', message: error.message }],
+            });
+            return 2;
+        }
         if (reviewCommand && error instanceof CommanderError) {
             if (error.exitCode === 0)
                 return 0;
@@ -3464,9 +2665,36 @@ export async function runCli(argv, options = {}) {
             }));
             return 1;
         }
-        if (jsonWriteRequest) {
-            writeCommandFailureReceipt(io.stdout, jsonWriteRequest, error);
-            return 1;
+        if (jsonConfigCommand && !jsonConfigMutation) {
+            if (error instanceof CommanderError && error.exitCode === 0)
+                return 0;
+            const failure = configMutationFailure(error, options.env ?? process.env, options.cwd ?? process.cwd());
+            writeJsonReceipt(io.stdout, { ok: false, command: `config:${argv[2] ?? ''}`, errors: [failure] });
+            return failure.code === 'invalidArguments' ? 2 : 1;
+        }
+        if (recovery) {
+            if (error instanceof CommanderError && error.exitCode === 0)
+                return 0;
+            const failure = writeCommandFailure(error);
+            if (argv[0] === 'project' || argv.some((value) => value === '-p' || value === '--platform' || value.startsWith('--platform='))) {
+                failure.message += '\n使用 aw plugin intent、aw plugin targets 或 aw plugin install/remove/sync/cleanup/status。安装归属使用 --scope；工作上下文使用 --context。';
+            }
+            if (jsonRecoveryRequest) {
+                if (recovery.command === 'status')
+                    writeJsonReceipt(io.stdout, {
+                        schemaVersion: 1, kind: 'aw-recovery-status', scope: recovery.scope, ok: false,
+                        intent: { state: 'unreadable', roots: null },
+                        selection: { agents: [], origin: 'none', preferences: 'unreadable' },
+                        inventory: null, extraObserved: [], coverage: null, counts: null, allSatisfied: null,
+                        errors: [failure],
+                    });
+                else
+                    writeJsonReceipt(io.stdout, { ...recoveryFailureReceipt(recovery.command, recovery.scope, error),
+                        blockers: [failure], errors: [failure] });
+            }
+            else
+                writeLine(io.stderr, failure.message);
+            return failure.code === 'invalidArguments' ? 2 : 1;
         }
         if (jsonConfigMutation) {
             if (error instanceof CommanderError && error.exitCode === 0)
@@ -3476,7 +2704,15 @@ export async function runCli(argv, options = {}) {
                 ? { command: jsonConfigMutation.command }
                 : jsonConfigMutation, failure);
             writeLine(io.stderr, failure.message);
-            return 1;
+            return failure.code === 'invalidArguments' ? 2 : 1;
+        }
+        if ((argv[0] === 'plugin' && argv[1] === 'config'
+            || argv[0] === 'skill' && argv[1] === 'materialize')
+            && (error instanceof CommanderError || error instanceof WriteCommandRequestError)) {
+            if (error instanceof CommanderError)
+                return error.exitCode === 0 ? 0 : 2;
+            writeLine(io.stderr, error.message);
+            return 2;
         }
         if (jsonAuthoringCommand === 'catalog:publish' && error instanceof CommanderError) {
             const failure = catalogPublicationFailure({