@lesliechan721/aw 0.1.0-beta.64 → 0.1.0-beta.65

package/dist/src/utils/plugin-config-write.js

@@ -1,18 +1,25 @@
-import { getCommandPackageId } from '@lesliechan721/aw-plugin-core/manifest';
-import { flattenStatusTargets, statusCommandV8, statusTargetIntent, } from '../commands/status-v6.js';
+import { resolveWorkContext } from '../intent/work-context.js';
+import { statusTargetHasLiveConfigConsumer } from '../commands/status-v6.js';
+import { readDemand, demandNativeProjection } from '../recovery/demand.js';
+import { createScopeContext } from '../intent/scope-context.js';
+import { compilePluginConfigDefinition, getCommandPackageId } from '@lesliechan721/aw-plugin-core/manifest';
+import { flattenStatusTargets, statusCommandV8, } from '../commands/status-v6.js';
 import { syncWriteCommand } from '../commands/write-commands.js';
 import { CONFIG_MUTATION_RECEIPT_SCHEMA_VERSION, } from '../types.js';
 import { getDefaultNativeCliRunner, prepareNativeCliExecution } from './native-cli.js';
-import { assertReadyPluginConfigStore, assertPluginConfigMutationCandidate, assertSafePluginConfigSegment, codexNativeRefreshKeys, coercePluginConfigUpdates, patchPluginConfigStore, readPluginConfigStore, readNamespacedPluginConfigStoreIdentity, resetPluginConfigStore, resolveConfigRead, resolveEffectivePluginConfig, resolvePluginConfigStorePath, resolvePluginConfigSchemaAccess, summarizeEffectivePluginConfig, } from './plugin-config.js';
+import { assertPluginConfigMutationCandidate, assertSafePluginConfigSegment, coercePluginConfigUpdates, patchPluginConfigStore, PluginConfigSchemaResolutionError, readPluginConfigStore, readNamespacedPluginConfigStoreIdentity, resetPluginConfigStore, resolveConfigRead, resolveEffectivePluginConfig, resolvePluginConfigStorePath, resolvePluginConfigSchemaAccess, summarizeEffectivePluginConfig, } from './plugin-config.js';
 import { analyzePluginConfigMutationImpact, discoverPluginConfigManagedCommandPackages, pluginConfigTargetRenderScopes, pluginSharedNativeConfigTargets } from './plugin-config-impact.js';
-import { resolvePluginConfigReferencePlugins, resolvePluginConfigReferenceConsumers } from './plugin-config-references.js';
+import { collectPluginConfigReferenceEvidence, resolvePluginConfigReferencePlugins, resolvePluginConfigReferenceConsumers } from './plugin-config-references.js';
 import { orderPluginMetasByDependencies, resolvePluginMetaDependencyClosure } from './plugin-dependencies.js';
-import { assertManagedCommandPackageNativeToolsUnchanged, syncPluginManagedCommandPackage, } from './managed-command-materialization.js';
-import { managedCommandDiagnostic } from './managed-command-store.js';
+import { assertManagedCommandPackageNativeToolsUnchanged, discoverInstalledPluginManagedCommandPackages, syncPluginManagedCommandPackage, } from './managed-command-materialization.js';
+import { listManagedCommandPackages, managedCommandDiagnostic, readInstalledCommandProducer } from './managed-command-store.js';
 import { collectSensitivePluginConfigValues, redactPluginScriptOutput, } from './plugin-scripts.js';
-import { resolveClaudeProjectKey, resolveCodexProjectKey } from './paths.js';
+import { resolveClaudeProjectKey, resolveCodexProjectKey, resolveCliPackageRoot } from './paths.js';
+import { readSafeOperationError } from './safe-operation-diagnostic.js';
 import { withAwHomeMutationLock, } from './aw-home-mutation-lock.js';
-import { assertProjectSharedConfigPathVisible, } from './project-boundary.js';
+import fs from 'fs-extra';
+import path from 'node:path';
+import crypto from 'node:crypto';
 export function buildConfigMutationReceipt(command, receipt) {
     return {
         ...receipt,
@@ -128,21 +135,21 @@ async function discoverVisibleTargets(options) {
             : {}),
     });
     for (const statusTarget of flattenStatusTargets(status.payload.targets)) {
-        const intent = statusTargetIntent(statusTarget);
-        if ((!selectors.includes(statusTarget.pluginId ?? '') && !consumers.some((plugin) => plugin.manifest.name === statusTarget.pluginName)
+        if (!selectors.includes(statusTarget.pluginId ?? '')
+            && !consumers.some((plugin) => plugin.manifest.name === statusTarget.pluginName)
             && statusTarget.pluginId !== selector && statusTarget.pluginName !== options.pluginName)
-            || !intent.enabled)
             continue;
-        for (const scope of intent.scopes) {
-            if (options.scope === 'project' && scope !== 'project')
-                continue;
-            targets.push(await createCandidateTarget({
-                pluginName: statusTarget.pluginName,
-                platform: statusTarget.platform,
-                scope,
-                cwd: options.cwd,
-            }));
-        }
+        // A declaration alone is not a consumer. Config apply cannot install it.
+        if (!statusTargetHasLiveConfigConsumer(statusTarget))
+            continue;
+        if (options.scope === 'user' && statusTarget.scope !== 'user')
+            continue;
+        targets.push(await createCandidateTarget({
+            pluginName: statusTarget.pluginName,
+            platform: statusTarget.platform,
+            scope: statusTarget.scope,
+            cwd: options.cwd,
+        }));
     }
     return { targets: dedupeTargets(targets), failures };
 }
@@ -181,7 +188,7 @@ async function reinstallVisibleTargets(options) {
                     failed.add(`${plugin.manifest.name}\0${target.platform}\0${target.scope}`);
                 results.push(...blocked.map((target) => ({ target, action: 'skipped',
                     state: 'skipped', errorCode: 'dependencyApplyFailed',
-                    message: `A required provider failed. Run aw sync ${plugin.pluginId ?? plugin.manifest.name} --scope ${target.scope} --platform ${target.platform} --yes.` })));
+                    message: `A required provider failed. Run aw plugin sync ${plugin.pluginId ?? plugin.manifest.name} --context ${target.scope} --target ${target.platform} --yes.` })));
             }
             const blockedPackages = packages.filter((target) => {
                 const platforms = plugin.manifest.managedCommands?.packages.find((entry) => entry.key === target.packageKey
@@ -203,7 +210,7 @@ async function reinstallVisibleTargets(options) {
             const own = plugin.manifest.name === options.plugin.manifest.name;
             const result = await reinstallVisibleTargets({ ...options, plugin,
                 changedConfigKeys: own ? options.changedConfigKeys : [],
-                rebuildRuntime: { ...options.rebuildRuntime, managedCommandProducerCache },
+                rebuildRuntime: { ...options.rebuildRuntime, referencePlugins: plugins, managedCommandProducerCache },
                 discovered: { targets: available, failures: [], commandPackages: availablePackages,
                     commandDiscoveryErrors: [] } });
             if (result.state !== 'succeeded' && result.state !== 'skipped') {
@@ -229,277 +236,320 @@ async function reinstallVisibleTargets(options) {
         return { state: partial ? 'partial' : 'succeeded', targetResults: results,
             ...(commandResults.length ? { commandResults } : {}), ...(errors.length ? { errors } : {}) };
     }
-    const targetResults = [...discovered.failures];
-    const commandResults = new Map();
-    let runtimeFailed = discovered.failures.length > 0
-        || (discovered.commandDiscoveryErrors?.length ?? 0) > 0;
-    let invalidTargets = 0;
-    let unavailableTargets = 0;
-    const errors = [];
-    if ((discovered.commandDiscoveryErrors?.length ?? 0) > 0) {
-        errors.push(...discovered.commandDiscoveryErrors.map((error) => ({
-            stage: 'targetDiscovery', code: error.code, message: error.message,
-        })));
-    }
-    const reinstall = options.reinstallCommandImpl ?? syncWriteCommand;
-    if (options.plugin.sourceId && !options.plugin.pluginId) {
-        throw new Error(`Plugin "${options.plugin.manifest.name}" is missing its namespaced plugin ID.`);
-    }
-    const selector = options.plugin.sourceId
-        ? options.plugin.pluginId
-        : options.plugin.manifest.name;
-    const nativeFailures = [];
-    for (const target of discovered.commandPackages ?? []) {
-        try {
-            await assertManagedCommandPackageNativeToolsUnchanged({ plugin: options.plugin, producer: target.producer, env: options.env });
-        }
-        catch (error) {
-            nativeFailures.push({ producer: target.producer, state: 'failed', commandIds: [], removedCommandIds: [],
-                errors: [managedCommandDiagnostic(error)],
-                recoveryActions: [`aw command package sync ${selector} ${target.packageKey} --scope ${target.producer.scope} --yes`] });
-        }
-    }
-    if (nativeFailures.length > 0) {
-        return { state: 'partial', commandResults: nativeFailures,
-            targetResults: [...targetResults, ...discovered.targets.map((target) => ({
-                    target, action: 'reinstall', state: 'failed', errorCode: 'nativeToolSyncRequired',
-                    message: 'Run a reviewed producer sync or package sync before configuration apply.',
-                }))] };
-    }
-    const sanitizeFailure = async (message, target) => {
-        let sensitiveValues = [];
-        try {
-            const effective = await resolveEffectivePluginConfig({
-                ...(options.plugin.sourceId ? {
-                    sourceId: options.plugin.sourceId,
-                    sourceIdentity: options.plugin.sourceIdentity,
-                    logicalIdentity: options.plugin.catalogLogicalIdentity,
-                } : {}),
-                pluginName: options.plugin.manifest.name,
-                manifest: options.plugin.manifest,
-                referencePlugins: options.rebuildRuntime?.referencePlugins,
-                targetScope: target.scope,
-                cwd: options.cwd,
-                env: options.env,
-            });
-            sensitiveValues = collectSensitivePluginConfigValues(options.plugin.manifest, effective.values);
+    const contexts = new Map();
+    const demands = new Map();
+    const failedScopes = new Set();
+    try {
+        const targetResults = [...discovered.failures];
+        const commandResults = new Map();
+        let runtimeFailed = discovered.failures.length > 0
+            || (discovered.commandDiscoveryErrors?.length ?? 0) > 0;
+        let invalidTargets = 0;
+        let unavailableTargets = 0;
+        const errors = [];
+        for (const scope of new Set(discovered.targets.map((target) => target.scope))) {
+            try {
+                const context = await createScopeContext({ scope, cwd: options.cwd, env: options.env });
+                contexts.set(scope, context);
+                const demand = await readDemand({ scope, cwd: context.executionCwd, env: context.env });
+                demandNativeProjection(demand);
+                demands.set(scope, demand);
+            }
+            catch {
+                failedScopes.add(scope);
+                runtimeFailed = true;
+                for (const target of discovered.targets.filter((entry) => entry.scope === scope)) {
+                    targetResults.push({ target, action: 'reinstall', state: 'failed', errorCode: 'configApplyContextUnavailable',
+                        message: 'The target scope or its demand cannot be read safely.' });
+                }
+                errors.push({ stage: 'targetValidation', code: 'configApplyContextUnavailable',
+                    message: 'A visible target scope or its demand cannot be read safely.' });
+            }
         }
-        catch {
-            // Generic credential redaction and known config paths still apply.
+        if ((discovered.commandDiscoveryErrors?.length ?? 0) > 0) {
+            errors.push(...discovered.commandDiscoveryErrors.map((error) => ({
+                stage: 'targetDiscovery', code: error.code, message: error.message,
+            })));
         }
-        let sanitized = redactPluginScriptOutput(message, sensitiveValues);
-        for (const privatePath of [target.projectKey, options.cwd]) {
-            if (privatePath)
-                sanitized = sanitized.split(privatePath).join('<project>');
+        const reinstall = options.reinstallCommandImpl ?? syncWriteCommand;
+        if (options.plugin.sourceId && !options.plugin.pluginId) {
+            throw new Error(`Plugin "${options.plugin.manifest.name}" is missing its namespaced plugin ID.`);
         }
-        for (const scope of ['user', 'project']) {
-            const configPath = resolvePluginConfigStorePath({
-                sourceId: options.plugin.sourceId,
-                pluginName: options.plugin.manifest.name,
-                scope,
-                cwd: options.cwd,
-                env: options.env,
-            });
-            const safeTarget = `${scope}/plugin-config/${[
-                options.plugin.sourceId,
-                options.plugin.manifest.name,
-                'config.json',
-            ].filter(Boolean).join('/')}`;
-            sanitized = sanitized.split(configPath).join(safeTarget);
+        const selector = options.plugin.sourceId
+            ? options.plugin.pluginId
+            : options.plugin.manifest.name;
+        const nativeFailures = [];
+        for (const target of discovered.commandPackages ?? []) {
+            try {
+                await assertManagedCommandPackageNativeToolsUnchanged({ plugin: options.plugin, producer: target.producer, env: options.env });
+            }
+            catch (error) {
+                nativeFailures.push({ producer: target.producer, state: 'failed', commandIds: [], removedCommandIds: [],
+                    errors: [managedCommandDiagnostic(error)],
+                    recoveryActions: [`aw command package sync ${selector} ${target.packageKey} --scope ${target.producer.scope} --yes`] });
+            }
         }
-        return sanitized;
-    };
-    const sanitizeProjection = async (value, target, freeText = false) => {
-        if (typeof value === 'string')
-            return freeText ? sanitizeFailure(value, target) : value;
-        if (value === null || typeof value !== 'object')
-            return value;
-        if (Array.isArray(value)) {
-            return Promise.all(value.map((entry) => sanitizeProjection(entry, target, freeText)));
+        if (nativeFailures.length > 0) {
+            return { state: 'partial', commandResults: nativeFailures,
+                targetResults: [...targetResults, ...discovered.targets.map((target) => ({
+                        target, action: 'reinstall', state: 'failed', errorCode: 'nativeToolSyncRequired',
+                        message: 'Run a reviewed producer sync or package sync before configuration apply.',
+                    }))] };
         }
-        return Object.fromEntries(await Promise.all(Object.entries(value).map(async ([key, entry]) => [
-            key,
-            await sanitizeProjection(entry, target, typeof entry === 'string'
-                ? /^(?:message|error|stack|stdout|stderr|output|warning)$/u.test(key)
-                : Array.isArray(entry) && /^(?:messages|warnings)$/u.test(key)),
-        ])));
-    };
-    const preApplyExecutionCache = new Map();
-    for (const target of discovered.targets) {
-        try {
-            const configs = await Promise.all(pluginConfigTargetRenderScopes(options.plugin, target).map((scope) => resolveEffectivePluginConfig({
-                ...(options.plugin.sourceId ? {
+        const sanitizeFailure = async (message, target) => {
+            let sensitiveValues = [];
+            try {
+                const effective = await resolveEffectivePluginConfig({
+                    ...(options.plugin.sourceId ? {
+                        sourceId: options.plugin.sourceId,
+                        sourceIdentity: options.plugin.sourceIdentity,
+                        logicalIdentity: options.plugin.catalogLogicalIdentity,
+                    } : {}),
+                    pluginName: options.plugin.manifest.name,
+                    manifest: options.plugin.manifest,
+                    referencePlugins: options.rebuildRuntime?.referencePlugins,
+                    targetScope: target.scope,
+                    platform: target.platform ?? undefined,
+                    cwd: options.cwd,
+                    env: options.env,
+                });
+                sensitiveValues = collectSensitivePluginConfigValues(options.plugin.manifest, effective.values, target.platform ?? undefined);
+            }
+            catch {
+                // Generic credential redaction and known config paths still apply.
+            }
+            let sanitized = redactPluginScriptOutput(message, sensitiveValues);
+            for (const privatePath of [target.projectKey, options.cwd]) {
+                if (privatePath)
+                    sanitized = sanitized.split(privatePath).join('<project>');
+            }
+            for (const scope of ['user', 'project']) {
+                const configPath = resolvePluginConfigStorePath({
                     sourceId: options.plugin.sourceId,
-                    sourceIdentity: options.plugin.sourceIdentity,
-                    logicalIdentity: options.plugin.catalogLogicalIdentity,
-                } : {}),
-                pluginName: options.plugin.manifest.name,
-                manifest: options.plugin.manifest,
-                referencePlugins: options.rebuildRuntime?.referencePlugins,
-                targetScope: scope,
-                cwd: options.cwd,
-                env: options.env,
-            })));
-            if (configs.some((effective) => effective.issues.length > 0)) {
-                invalidTargets += 1;
+                    pluginName: options.plugin.manifest.name,
+                    scope,
+                    cwd: options.cwd,
+                    env: options.env,
+                });
+                const safeTarget = `${scope}/plugin-config/${[
+                    options.plugin.sourceId,
+                    options.plugin.manifest.name,
+                    'config.json',
+                ].filter(Boolean).join('/')}`;
+                sanitized = sanitized.split(configPath).join(safeTarget);
+            }
+            return sanitized;
+        };
+        const sanitizeProjection = async (value, target, freeText = false) => {
+            if (typeof value === 'string')
+                return freeText ? sanitizeFailure(value, target) : value;
+            if (value === null || typeof value !== 'object')
+                return value;
+            if (Array.isArray(value)) {
+                return Promise.all(value.map((entry) => sanitizeProjection(entry, target, freeText)));
+            }
+            return Object.fromEntries(await Promise.all(Object.entries(value).map(async ([key, entry]) => [
+                key,
+                await sanitizeProjection(entry, target, typeof entry === 'string'
+                    ? /^(?:message|error|stack|stdout|stderr|output|warning)$/u.test(key)
+                    : Array.isArray(entry) && /^(?:messages|warnings)$/u.test(key)),
+            ])));
+        };
+        const preApplyExecutionCache = new Map();
+        for (const target of discovered.targets) {
+            if (failedScopes.has(target.scope))
+                continue;
+            try {
+                const configs = await Promise.all(pluginConfigTargetRenderScopes(options.plugin, target).map((scope) => resolveEffectivePluginConfig({
+                    ...(options.plugin.sourceId ? {
+                        sourceId: options.plugin.sourceId,
+                        sourceIdentity: options.plugin.sourceIdentity,
+                        logicalIdentity: options.plugin.catalogLogicalIdentity,
+                    } : {}),
+                    pluginName: options.plugin.manifest.name,
+                    manifest: options.plugin.manifest,
+                    referencePlugins: options.rebuildRuntime?.referencePlugins,
+                    targetScope: scope,
+                    platform: target.platform ?? undefined,
+                    cwd: options.cwd,
+                    env: options.env,
+                })));
+                if (configs.some((effective) => effective.issues.length > 0)) {
+                    invalidTargets += 1;
+                    targetResults.push({
+                        target,
+                        action: 'reinstall',
+                        state: 'skipped',
+                        errorCode: 'invalidConfig',
+                        message: 'The effective config is invalid for this target.',
+                    });
+                    continue;
+                }
+            }
+            catch {
+                runtimeFailed = true;
+                unavailableTargets += 1;
                 targetResults.push({
                     target,
                     action: 'reinstall',
-                    state: 'skipped',
-                    errorCode: 'invalidConfig',
-                    message: 'The effective config is invalid for this target.',
+                    state: 'failed',
+                    errorCode: 'effectiveConfigUnavailable',
+                    message: 'The effective config cannot be read for this target.',
+                });
+                errors.push({
+                    stage: 'targetValidation',
+                    code: 'effectiveConfigUnavailable',
+                    message: 'The effective config cannot be read for a visible target.',
                 });
                 continue;
             }
-        }
-        catch {
-            runtimeFailed = true;
-            unavailableTargets += 1;
-            targetResults.push({
-                target,
-                action: 'reinstall',
-                state: 'failed',
-                errorCode: 'effectiveConfigUnavailable',
-                message: 'The effective config cannot be read for this target.',
-            });
-            errors.push({
-                stage: 'targetValidation',
-                code: 'effectiveConfigUnavailable',
-                message: 'The effective config cannot be read for a visible target.',
-            });
-            continue;
-        }
-        try {
-            const debugLogger = options.rebuildRuntime?.debugLogger;
-            const reporter = options.rebuildRuntime?.reporter;
-            const result = await reinstall([selector], {
-                cwd: options.cwd,
-                platform: target.platform,
-                scope: target.scope,
-                ...(options.rebuildRuntime?.scriptTimeoutMs === undefined
-                    ? {}
-                    : { scriptTimeoutMs: options.rebuildRuntime.scriptTimeoutMs }),
-            }, {
-                ...options.rebuildRuntime,
-                env: options.env,
-                nativeCliRunner,
-                preApplyConfirmed: options.preApplyConfirmed === true,
-                preApplyExecutionCache,
-                managedCommandProducerCache,
-                ...(debugLogger ? {
-                    debugLogger: {
-                        ...debugLogger,
-                        log: async (value) => debugLogger.log(await sanitizeProjection(value, target)),
-                    },
-                } : {}),
-                ...(reporter ? {
-                    reporter: {
-                        event: async (value) => reporter.event(await sanitizeProjection(value, target)),
-                        notice: async (value) => reporter.notice(await sanitizeProjection(value, target)),
+            try {
+                const debugLogger = options.rebuildRuntime?.debugLogger;
+                const reporter = options.rebuildRuntime?.reporter;
+                const result = await reinstall([selector], {
+                    cwd: contexts.get(target.scope).executionCwd,
+                    platform: target.platform,
+                    scope: target.scope,
+                    ...(options.rebuildRuntime?.scriptTimeoutMs === undefined
+                        ? {}
+                        : { scriptTimeoutMs: options.rebuildRuntime.scriptTimeoutMs }),
+                }, {
+                    ...options.rebuildRuntime,
+                    env: contexts.get(target.scope).env,
+                    nativeCliRunner,
+                    executionInput: {
+                        context: contexts.get(target.scope),
+                        requirements: demandNativeProjection(demands.get(target.scope)),
+                        selectedTargets: [{ pluginId: selector, platform: target.platform, scope: target.scope }],
+                        preserveOtherObservedTargets: true,
                     },
-                } : {}),
-            });
-            options.rebuildRuntime?.operationDiagnosticSink?.(result.rebuildResults);
-            for (const producer of result.commandResults ?? []) {
-                commandResults.set(getCommandPackageId(producer.producer), producer);
-                if (producer.state !== 'completed')
+                    preApplyConfirmed: options.preApplyConfirmed === true,
+                    preApplyExecutionCache,
+                    managedCommandProducerCache,
+                    ...(debugLogger ? {
+                        debugLogger: {
+                            ...debugLogger,
+                            log: async (value) => debugLogger.log(await sanitizeProjection(value, target)),
+                        },
+                    } : {}),
+                    ...(reporter ? {
+                        reporter: {
+                            event: async (value) => reporter.event(await sanitizeProjection(value, target)),
+                            notice: async (value) => reporter.notice(await sanitizeProjection(value, target)),
+                        },
+                    } : {}),
+                });
+                options.rebuildRuntime?.operationDiagnosticSink?.(result.rebuildResults);
+                for (const producer of result.commandResults ?? []) {
+                    commandResults.set(getCommandPackageId(producer.producer), producer);
+                    if (producer.state !== 'completed')
+                        runtimeFailed = true;
+                }
+                if (result.overallState !== 'succeeded')
                     runtimeFailed = true;
+                targetResults.push(...await Promise.all(result.targetResults.map(async (entry) => ({
+                    ...entry,
+                    state: entry.action === 'skipped' ? 'skipped' : entry.state,
+                    ...(entry.message ? { message: await sanitizeFailure(entry.message, entry.target) } : {}),
+                }))));
             }
-            if (result.overallState !== 'succeeded')
+            catch (error) {
                 runtimeFailed = true;
-            targetResults.push(...await Promise.all(result.targetResults.map(async (entry) => ({
-                ...entry,
-                state: entry.action === 'skipped' ? 'skipped' : entry.state,
-                ...(entry.message ? { message: await sanitizeFailure(entry.message, entry.target) } : {}),
-            }))));
-        }
-        catch (error) {
-            runtimeFailed = true;
-            const message = await sanitizeFailure(error instanceof Error ? error.message : String(error), target);
-            targetResults.push({
-                target,
-                action: 'reinstall',
-                state: 'failed',
-                message,
-            });
-            errors.push({
-                stage: 'apply',
-                code: 'targetApplyFailed',
-                message: 'A visible config apply target failed.',
-            });
-        }
-    }
-    for (const target of discovered.commandPackages ?? []) {
-        await options.rebuildRuntime?.reporter?.event({
-            type: 'managed-command:producer',
-            source: { plugin: options.plugin.manifest.name, scope: target.producer.scope },
-            data: { packageKey: target.packageKey, phase: 'start' },
-        });
-        let result;
-        if (!target.declared) {
-            result = {
-                producer: target.producer, state: 'failed', commandIds: [], removedCommandIds: [],
-                errors: [{ code: 'commandPackageDeclarationMissing',
-                        message: 'The installed command package is no longer declared by this plugin.' }],
-                recoveryActions: [`aw command package remove ${target.packageId} --yes`],
-            };
-        }
-        else {
-            try {
-                result = await syncPluginManagedCommandPackage({
-                    plugin: options.plugin, packageKey: target.packageKey, scope: target.producer.scope,
-                    cwd: options.cwd, env: options.env, managedCommandProducerCache,
-                    referencePlugins: options.rebuildRuntime?.referencePlugins,
-                    event: options.changedConfigKeys?.length ? 'refresh' : 'install',
-                    changedConfigKeys: options.changedConfigKeys ?? [],
+                const message = await sanitizeFailure(error instanceof Error ? error.message : String(error), target);
+                targetResults.push({
+                    target,
+                    action: 'reinstall',
+                    state: 'failed',
+                    message,
+                });
+                errors.push({
+                    stage: 'apply',
+                    code: 'targetApplyFailed',
+                    message: 'A visible config apply target failed.',
                 });
             }
-            catch {
+        }
+        for (const target of discovered.commandPackages ?? []) {
+            await options.rebuildRuntime?.reporter?.event({
+                type: 'managed-command:producer',
+                source: { plugin: options.plugin.manifest.name, scope: target.producer.scope },
+                data: { packageKey: target.packageKey, phase: 'start' },
+            });
+            let result;
+            if (!target.declared) {
                 result = {
                     producer: target.producer, state: 'failed', commandIds: [], removedCommandIds: [],
-                    errors: [{ code: 'commandPackageApplyFailed', message: 'The managed command package could not be refreshed.' }],
-                    recoveryActions: [`aw command package sync ${selector} ${target.packageKey} --scope ${target.producer.scope} --yes`,
-                        `aw command package remove ${target.packageId} --yes`],
+                    errors: [{ code: 'commandPackageDeclarationMissing',
+                            message: 'The installed command package is no longer declared by this plugin.' }],
+                    recoveryActions: [`aw command package remove ${target.packageId} --yes`],
                 };
             }
+            else {
+                try {
+                    result = await syncPluginManagedCommandPackage({
+                        plugin: options.plugin, packageKey: target.packageKey, scope: target.producer.scope,
+                        cwd: options.cwd, env: options.env, managedCommandProducerCache,
+                        referencePlugins: options.rebuildRuntime?.referencePlugins,
+                        event: options.changedConfigKeys?.length ? 'refresh' : 'install',
+                        changedConfigKeys: options.changedConfigKeys ?? [],
+                        signal: options.rebuildRuntime?.signal,
+                        scriptTimeoutMs: options.rebuildRuntime?.scriptTimeoutMs,
+                    });
+                }
+                catch (error) {
+                    if (options.rebuildRuntime?.signal?.aborted
+                        || error instanceof Error && error.name === 'AbortError'
+                        || readSafeOperationError(error))
+                        throw error;
+                    result = {
+                        producer: target.producer, state: 'failed', commandIds: [], removedCommandIds: [],
+                        errors: [{ code: 'commandPackageApplyFailed', message: 'The managed command package could not be refreshed.' }],
+                        recoveryActions: [`aw command package sync ${selector} ${target.packageKey} --scope ${target.producer.scope} --yes`,
+                            `aw command package remove ${target.packageId} --yes`],
+                    };
+                }
+            }
+            result = { ...result, errors: await Promise.all(result.errors.map(async (error) => ({
+                    ...error, message: await sanitizeFailure(error.message, { scope: target.producer.scope,
+                        ...(target.producer.projectRoot ? { projectKey: target.producer.projectRoot } : {}) }),
+                }))) };
+            commandResults.set(getCommandPackageId(result.producer), result);
+            await options.rebuildRuntime?.reporter?.event({
+                type: 'managed-command:producer',
+                source: { plugin: options.plugin.manifest.name, scope: target.producer.scope },
+                data: { packageKey: target.packageKey, phase: result.state === 'completed' ? 'success' : 'failure' },
+            });
+            if (result.state !== 'completed')
+                runtimeFailed = true;
         }
-        result = { ...result, errors: await Promise.all(result.errors.map(async (error) => ({
-                ...error, message: await sanitizeFailure(error.message, { scope: target.producer.scope,
-                    ...(target.producer.projectRoot ? { projectKey: target.producer.projectRoot } : {}) }),
-            }))) };
-        commandResults.set(getCommandPackageId(result.producer), result);
-        await options.rebuildRuntime?.reporter?.event({
-            type: 'managed-command:producer',
-            source: { plugin: options.plugin.manifest.name, scope: target.producer.scope },
-            data: { packageKey: target.packageKey, phase: result.state === 'completed' ? 'success' : 'failure' },
-        });
-        if (result.state !== 'completed')
-            runtimeFailed = true;
-    }
-    const commands = commandResults.size > 0 ? { commandResults: [...commandResults.values()] } : {};
-    const commandTargetCount = (discovered.commandPackages?.length ?? 0);
-    if (discovered.targets.length === 0 && discovered.failures.length === 0
-        && commandTargetCount === 0 && !runtimeFailed) {
-        return skippedApply('noVisibleTarget');
-    }
-    if (discovered.targets.length > 0 && invalidTargets === discovered.targets.length && commandTargetCount === 0) {
-        return { ...unavailableApply('invalidConfig', 'targetValidation', targetResults), ...commands };
-    }
-    if (discovered.targets.length > 0 && unavailableTargets === discovered.targets.length && commandTargetCount === 0) {
-        return { ...unavailableApply('effectiveConfigUnavailable', 'targetValidation', targetResults), ...commands };
+        const commands = commandResults.size > 0 ? { commandResults: [...commandResults.values()] } : {};
+        const commandTargetCount = (discovered.commandPackages?.length ?? 0);
+        if (discovered.targets.length === 0 && discovered.failures.length === 0
+            && commandTargetCount === 0 && !runtimeFailed) {
+            return skippedApply('noVisibleTarget');
+        }
+        if (discovered.targets.length > 0 && invalidTargets === discovered.targets.length && commandTargetCount === 0) {
+            return { ...unavailableApply('invalidConfig', 'targetValidation', targetResults), ...commands };
+        }
+        if (discovered.targets.length > 0 && unavailableTargets === discovered.targets.length && commandTargetCount === 0) {
+            return { ...unavailableApply('effectiveConfigUnavailable', 'targetValidation', targetResults), ...commands };
+        }
+        if (runtimeFailed
+            || invalidTargets > 0
+            || unavailableTargets > 0
+            || targetResults.some((entry) => entry.state === 'failed' || entry.state === 'skipped')) {
+            return {
+                state: 'partial',
+                targetResults,
+                ...commands,
+                ...(errors.length > 0 ? { errors } : {}),
+            };
+        }
+        return { state: 'succeeded', targetResults, ...commands };
     }
-    if (runtimeFailed
-        || invalidTargets > 0
-        || unavailableTargets > 0
-        || targetResults.some((entry) => entry.state === 'failed' || entry.state === 'skipped')) {
-        return {
-            state: 'partial',
-            targetResults,
-            ...commands,
-            ...(errors.length > 0 ? { errors } : {}),
-        };
+    finally {
+        await Promise.all([...contexts.values()].map((context) => context.dispose()));
     }
-    return { state: 'succeeded', targetResults, ...commands };
 }
 async function resolveConfigApplyTargets(options) {
     const platformTargets = options.applyTargets !== undefined
@@ -523,48 +573,19 @@ async function resolveConfigApplyTargets(options) {
 async function configApplyHasValidSharedNativeTarget(options) {
     const plugins = await resolvePluginConfigReferenceConsumers({ plugin: options.plugin, env: options.env, plugins: options.plugins });
     for (const plugin of plugins) {
-        const sharedTargets = pluginSharedNativeConfigTargets(plugin);
-        if (!options.targets.some((target) => target.pluginName === plugin.manifest.name
-            && sharedTargets.some((shared) => (shared.platform ?? 'codex') === target.platform)))
-            continue;
-        const effective = await resolveEffectivePluginConfig({
-            ...(plugin.sourceId ? {
-                sourceId: plugin.sourceId,
-                sourceIdentity: plugin.sourceIdentity,
-                logicalIdentity: plugin.catalogLogicalIdentity,
-            } : {}),
-            pluginName: plugin.manifest.name,
-            manifest: plugin.manifest,
-            referencePlugins: options.plugins,
-            targetScope: 'user',
-            cwd: options.cwd,
-            env: options.env,
-        });
-        if (effective.issues.length === 0)
-            return true;
-    }
-    return false;
-}
-async function applyConfigToVisibleTargets(options) {
-    let discovered;
-    if (options.discovered) {
-        discovered = options.discovered;
-    }
-    else {
-        try {
-            discovered = await resolveConfigApplyTargets(options);
-        }
-        catch {
-            return unavailableApply('targetDiscoveryFailed', 'targetDiscovery');
+        for (const target of options.targets.filter((target) => target.pluginName === plugin.manifest.name)) {
+            const shared = pluginSharedNativeConfigTargets(plugin);
+            if (!shared.some((entry) => (entry.platform ?? 'codex') === target.platform))
+                continue;
+            const effective = await resolveEffectivePluginConfig({ sourceId: plugin.sourceId,
+                sourceIdentity: plugin.sourceIdentity, logicalIdentity: plugin.catalogLogicalIdentity,
+                manifest: plugin.manifest, platform: target.platform, targetScope: 'user',
+                cwd: options.cwd, env: options.env, referencePlugins: options.plugins });
+            if (!effective.issues.length)
+                return true;
         }
     }
-    if (discovered.targets.length === 0
-        && discovered.failures.length === 0
-        && (discovered.commandPackages?.length ?? 0) === 0
-        && options.noVisibleTargetHasInvalidConfig) {
-        return unavailableApply('invalidConfig', 'targetValidation');
-    }
-    return reinstallVisibleTargets({ ...options, discovered });
+    return false;
 }
 export async function resolveConfigPreApplyAuthorization(options) {
     const applyTargets = dedupeTargets(options.applyTargets);
@@ -609,17 +630,27 @@ export async function resolveConfigPreApplyAuthorization(options) {
     const resolveGroup = async (targets) => {
         const platforms = new Set(targets.map((target) => target.platform));
         const platform = platforms.size === 2 ? 'both' : [...platforms][0];
+        let context;
         try {
+            context = await createScopeContext({ scope: targets[0].scope, cwd: options.cwd, env: options.env });
+            const demand = await readDemand({ scope: targets[0].scope,
+                cwd: context.executionCwd, env: context.env });
             const preview = await (options.reinstallCommandImpl ?? syncWriteCommand)([selector], {
-                cwd: options.cwd,
+                cwd: context.executionCwd,
                 platform,
                 scope: targets[0].scope,
             }, {
                 ...options.rebuildRuntime,
-                env: options.env ?? process.env,
+                env: context.env,
                 nativeCliRunner: options.nativeCliRunner,
                 previewOperationPlan: true,
                 resolvePreApplyAuthorization: true,
+                executionInput: {
+                    context, requirements: demandNativeProjection(demand),
+                    selectedTargets: targets.map((target) => ({ pluginId: selector,
+                        platform: target.platform, scope: target.scope })),
+                    preserveOtherObservedTargets: true,
+                },
             });
             if (preview.overallState !== 'succeeded' || !preview.preApplyAuthorization)
                 return false;
@@ -630,6 +661,9 @@ export async function resolveConfigPreApplyAuthorization(options) {
         catch {
             return false;
         }
+        finally {
+            await context?.dispose();
+        }
     };
     for (const targets of groups.values()) {
         if (await resolveGroup(targets))
@@ -686,7 +720,7 @@ function preApplyAuthorizationIsConfirmed(options) {
 }
 function otherProjectsWarning(scope) {
     return scope === 'user'
-        ? ['其它项目不会由本次命令扫描或更新，可能需要在对应项目目录中运行 aw sync。']
+        ? ['其它项目不会由本次命令扫描或更新，可能需要在对应项目目录中运行 aw plugin sync --context project。']
         : [];
 }
 function buildReceiptFieldEntry(options) {
@@ -816,303 +850,397 @@ export async function replayConfigRuntimeWrites(options) {
         },
     });
 }
-function throwSharedNativeApplyConfirmationRequired() {
-    const error = new Error('sharedNativeConfigApplyConfirmationRequired: Applying this user config changes a shared native artifact. Re-run with --yes.');
-    error.code = 'sharedNativeConfigApplyConfirmationRequired';
-    throw error;
+function configApplyRequestedTargets(plan) {
+    return plan.receipt.requestedTargets.filter((target) => !plan.receipt.targetResults.some((result) => result.pluginId === target.pluginId && result.agent === target.agent && result.scope === target.scope
+        && (result.satisfaction === 'unsupported' || result.satisfaction === 'excluded')));
 }
-async function applyPluginConfigWriteUnlocked(options) {
-    const requestedPluginName = options.pluginName ?? options.plugin?.manifest.name;
-    if (!requestedPluginName)
-        throw new Error('Plugin name is required for config write.');
-    const pluginName = assertSafePluginConfigSegment(requestedPluginName);
-    const configIdentity = options.plugin?.sourceId ? {
-        sourceId: options.plugin.sourceId,
-        sourceIdentity: options.plugin.sourceIdentity,
-        logicalIdentity: options.plugin.catalogLogicalIdentity,
-    } : {};
-    const requestedUpdates = options.request.updates ?? {};
-    const requestedRemoveKeys = uniqueInOrder(options.request.removeKeys ?? []);
-    const duplicateKeys = requestedRemoveKeys.filter((key) => Object.hasOwn(requestedUpdates, key));
-    if (duplicateKeys.length > 0) {
-        throw new Error(`Config write cannot update and remove the same key: ${duplicateKeys.join(', ')}.`);
-    }
-    const schemaAccess = await resolvePluginConfigSchemaAccess({
-        pluginName,
-        currentPlugin: options.plugin,
-        currentPluginError: options.pluginError,
-        scope: options.scope,
-        cwd: options.cwd,
-        env: options.env,
-    });
-    const schemaPlugin = schemaAccess.plugin;
-    const schema = schemaPlugin?.manifest.config?.fields;
-    if (!schema || !schemaPlugin) {
-        throw new Error(`configSchemaUnavailable: Plugin "${pluginName}" does not declare an AW config schema.`);
-    }
-    if (options.scope === 'project') {
-        const userStore = await readPluginConfigStore({
-            ...configIdentity,
-            pluginName,
-            scope: 'user',
-            cwd: options.cwd,
-            env: options.env,
-            schema,
-        });
-        assertReadyPluginConfigStore(userStore);
-    }
-    if (options.scope === 'project') {
-        const rejectedSensitiveKeys = Object.keys(requestedUpdates)
-            .filter((key) => schema[key]?.sensitive === true);
-        if (rejectedSensitiveKeys.length > 0) {
-            const error = new Error('sensitiveProjectConfigUnsupported: Sensitive config can only be set in user scope.');
-            error.code = 'sensitiveProjectConfigUnsupported';
-            throw error;
-        }
-        const userOnlyKeys = codexNativeRefreshKeys(schemaPlugin.manifest);
-        const rejectedKeys = Object.keys(requestedUpdates).filter((key) => userOnlyKeys.has(key));
-        if (rejectedKeys.length > 0) {
-            const error = new Error(`sharedNativeConfigUserScopeRequired: Codex native Skill refresh keys can only be set in user scope: ${rejectedKeys.join(', ')}.`);
-            error.code = 'sharedNativeConfigUserScopeRequired';
-            throw error;
+async function prepareConfigApplyPackages(options, plugins, plan, referencePlugins) {
+    const env = options.env ?? process.env;
+    const context = options.context ?? options.scope;
+    const discoveries = [];
+    const scopes = context === 'project' ? ['user', 'project'] : ['user'];
+    const nativeTargets = configApplyRequestedTargets(plan).flatMap((target) => target.agent === 'codex' || target.agent === 'claude'
+        ? [{ pluginName: target.pluginId.split('/').at(-1), pluginId: target.pluginId, platform: target.agent, scope: target.scope }] : []);
+    for (const plugin of plugins) {
+        for (const scope of scopes) {
+            discoveries.push(await discoverInstalledPluginManagedCommandPackages({ plugin, scope, cwd: options.cwd, env,
+                platformTargets: nativeTargets.filter((target) => target.pluginId === (plugin.pluginId ?? plugin.manifest.name)
+                    && (scope === 'user' || target.scope === 'project')) }));
         }
     }
-    let discovered;
-    let targetDiscoveryFailed = false;
-    if (options.apply !== false) {
-        try {
-            discovered = await resolveConfigApplyTargets({
-                plugin: schemaPlugin,
-                scope: options.scope,
-                cwd: options.cwd,
-                env: options.env ?? process.env,
-                applyTargets: options.applyTargets,
-                nativeCliRunner: options.nativeCliRunner,
-                rebuildRuntime: options.rebuildRuntime,
-            });
+    const packages = [...new Map(discoveries.flatMap((discovery) => discovery.packages).filter((target) => {
+            if (options.applyCommandPackages && !options.applyCommandPackages.includes(target.packageId))
+                return false;
+            if (options.platform)
+                return false;
+            if (!options.targets)
+                return true;
+            const plugin = plugins.find((entry) => entry.manifest.name === target.producer.pluginName);
+            const declaration = plugin?.manifest.managedCommands?.packages.find((entry) => entry.key === target.packageKey && entry.scope === target.producer.scope);
+            return declaration?.platforms.some((platform) => options.targets.includes(platform)) ?? false;
+        }).map((target) => [target.packageId, target])).values()];
+    const inventory = await listManagedCommandPackages(env);
+    const entries = await Promise.all(packages.map(async (target) => {
+        const plugin = plugins.find((entry) => entry.manifest.name === target.producer.pluginName);
+        const installed = inventory.packages.find((entry) => entry.id === target.packageId);
+        let recordDigest;
+        let blocker;
+        if (!target.installed || !installed) {
+            blocker = { code: 'configApplyRequiresExistingOutput', message: 'Configuration apply requires an existing command package. Run package sync first.' };
         }
-        catch {
-            targetDiscoveryFailed = true;
+        else if (!target.declared) {
+            blocker = { code: 'commandPackageDeclarationMissing', message: 'The installed command package is no longer declared by this plugin.' };
         }
-    }
-    const impact = await analyzePluginConfigMutationImpact({
-        plugin: schemaPlugin,
-        scope: options.scope,
-        cwd: options.cwd,
-        env: options.env,
-        visibleTargets: discovered?.targets ?? [],
-        referencePlugins: options.rebuildRuntime?.referencePlugins,
-        ...(discovered ? { commandDiscovery: {
-                packages: discovered.commandPackages ?? [], errors: discovered.commandDiscoveryErrors ?? [],
-            } } : {}),
-        mutation: {
-            kind: 'patch',
-            updates: requestedUpdates,
-            removeKeys: requestedRemoveKeys,
+        else {
+            try {
+                const record = await readInstalledCommandProducer(installed.resourceRoot);
+                recordDigest = `sha256:${crypto.createHash('sha256').update(JSON.stringify(record)).digest('hex')}`;
+                await assertManagedCommandPackageNativeToolsUnchanged({ plugin, producer: target.producer, env });
+            }
+            catch (error) {
+                blocker = managedCommandDiagnostic(error);
+            }
+        }
+        return { target, recordDigest, blocker };
+    }));
+    const errors = [...new Map(discoveries.flatMap((discovery) => discovery.errors).map((error) => [JSON.stringify(error), error])).values()];
+    const evidence = { packages: entries, errors };
+    const targets = [...new Map(entries.map(({ target }) => {
+            const plugin = plugins.find((entry) => entry.manifest.name === target.producer.pluginName);
+            const pluginId = plugin.pluginId ?? plugin.manifest.name;
+            const dependencies = resolvePluginMetaDependencyClosure(referencePlugins, [plugin.manifest.name])
+                .filter((entry) => entry.manifest.name !== plugin.manifest.name).map((entry) => entry.pluginId ?? entry.manifest.name);
+            return [`${pluginId}\0${target.producer.scope}`, { pluginId, scope: target.producer.scope, dependencies }];
+        })).values()];
+    const cache = plan.runtime.managedCommandProducerCache ??= new Map();
+    const hook = { targets, evidence,
+        blocked: (pluginId, scope, code) => {
+            const plugin = plugins.find((entry) => (entry.pluginId ?? entry.manifest.name) === pluginId);
+            return entries.filter(({ target }) => target.producer.pluginName === plugin.manifest.name && target.producer.scope === scope)
+                .map(({ target }) => ({
+                producer: target.producer, state: 'failed', commandIds: [], removedCommandIds: [],
+                errors: [{ code, message: 'A required provider failed; the command package was not refreshed.' }],
+                recoveryActions: [`aw command package sync ${pluginId} ${target.packageKey} --scope ${scope} --yes`],
+            }));
         },
-    });
-    const updates = await coercePluginConfigUpdates({ schema, updates: requestedUpdates, cwd: options.cwd });
-    await assertPluginConfigMutationCandidate({
-        ...configIdentity,
-        pluginName,
-        manifest: schemaPlugin.manifest,
-        scope: options.scope,
+        execute: async (pluginId, scope, token) => {
+            const plugin = plugins.find((entry) => (entry.pluginId ?? entry.manifest.name) === pluginId);
+            const selected = entries.filter(({ target }) => target.producer.pluginName === plugin.manifest.name && target.producer.scope === scope);
+            const results = [];
+            let executionContext;
+            try {
+                executionContext = await createScopeContext({ scope, cwd: options.cwd, env });
+                for (const { target, blocker } of selected) {
+                    if (blocker) {
+                        const result = { producer: target.producer, state: 'failed', commandIds: [], removedCommandIds: [],
+                            errors: [blocker], recoveryActions: [target.declared
+                                    ? `aw command package sync ${pluginId} ${target.packageKey} --scope ${scope} --yes`
+                                    : `aw command package remove ${target.packageId} --yes`] };
+                        cache.set(target.packageId, Promise.resolve(result));
+                        results.push(result);
+                        continue;
+                    }
+                    const applied = await reinstallVisibleTargets({ plugin, scope, cwd: executionContext.executionCwd, env: executionContext.env,
+                        changedConfigKeys: [...target.refreshKeys],
+                        rebuildRuntime: { ...options.rebuildRuntime, awHomeMutationToken: token, referencePlugins, managedCommandProducerCache: cache },
+                        discovered: { targets: [], failures: [], commandPackages: [target], commandDiscoveryErrors: [] } });
+                    results.push(...('commandResults' in applied ? applied.commandResults ?? [] : []));
+                }
+                return results;
+            }
+            finally {
+                await executionContext?.dispose();
+            }
+        } };
+    return { packages, evidence, errors, hook };
+}
+/** Prepare the same existing-output plan used by apply, without saving config or output. */
+export async function preparePluginConfigApply(options) {
+    const { prepareRecovery, describeRecoveryPlan } = await import('../recovery/coordinator.js');
+    const context = options.context ?? options.scope;
+    const referencePlugins = await resolvePluginConfigReferencePlugins({ sourceId: options.plugin.sourceId,
+        sourceIdentity: options.plugin.sourceIdentity, logicalIdentity: options.plugin.catalogLogicalIdentity,
+        env: options.env, plugins: options.rebuildRuntime?.referencePlugins });
+    const plugins = await resolvePluginConfigReferenceConsumers({ plugin: options.plugin, env: options.env,
+        plugins: referencePlugins });
+    const selectors = plugins.map((plugin) => plugin.pluginId ?? plugin.manifest.name);
+    const version = options.cliVersion
+        ?? (await fs.readJson(path.join(resolveCliPackageRoot(), 'package.json'))).version;
+    let exactTargets = options.applyTargets?.map((target) => ({
+        pluginId: target.pluginId ?? plugins.find((plugin) => plugin.manifest.name === target.pluginName)?.pluginId ?? target.pluginName,
+        agent: target.platform,
+        scope: target.scope,
+    }));
+    const retainedLegacyTargets = [];
+    if (exactTargets?.some((target) => target.agent === 'codex' || target.agent === 'claude')) {
+        const { readRecoveryStatus } = await import('../recovery/status.js');
+        const observed = await readRecoveryStatus({ context, cwd: options.cwd, env: options.env, cliVersion: version,
+            nativeCliRunner: options.nativeCliRunner ?? options.rebuildRuntime?.nativeCliRunner,
+            codexObservationSession: options.rebuildRuntime?.codexObservationSession });
+        const key = (target) => `${target.pluginId}\0${target.agent}\0${target.scope}`;
+        const live = new Set(observed.existingTargets?.map(key));
+        const owned = new Set(observed.ownedTargets?.map(key));
+        exactTargets = exactTargets.filter((target, index) => {
+            if ((target.agent === 'codex' || target.agent === 'claude') && owned.has(key(target)) && !live.has(key(target))) {
+                retainedLegacyTargets.push(options.applyTargets[index]);
+                return false;
+            }
+            return true;
+        });
+    }
+    const plan = await prepareRecovery('sync', selectors, {
+        scope: context,
+        context,
         cwd: options.cwd,
         env: options.env,
-        updates,
-        removeKeys: requestedRemoveKeys,
-        referencePlugins: options.rebuildRuntime?.referencePlugins,
+        cliVersion: version,
+        existingOnly: true,
+        ...(exactTargets ? { exactTargets } : {}),
+        ...(options.targets ? { targets: options.targets } : options.platform ? { targets: [options.platform] } : {}),
+    }, {
+        ...options.rebuildRuntime,
+        referencePlugins,
+        nativeCliRunner: options.nativeCliRunner,
+        awHomeMutationToken: options.awHomeMutationToken,
+        preApplyConfirmed: options.preApplyConfirmed,
     });
-    if (impact.referenceBlockers?.length) {
-        throw Object.assign(new Error(`configReferenceInUse: ${impact.referenceBlockers.join(' ')}`), { code: 'configReferenceInUse' });
+    try {
+        plan.warnings.push(...retainedLegacyTargets.map((target) => `${target.pluginId ?? target.pluginName}/${target.platform}/${target.scope}：保留已停用的历史输出；配置 apply 不创建激活。`));
+        const commands = await prepareConfigApplyPackages(options, plugins, plan, referencePlugins);
+        plan.runtime.configApplyPackages = commands.hook;
+        const profiles = configApplyRequestedTargets(plan).map((target) => ({
+            pluginName: target.pluginId.split('/').at(-1), scope: target.scope, platform: target.agent,
+        }));
+        // A package has platform=null and always consumes the public common profile.
+        profiles.push(...commands.packages.map((target) => ({ pluginName: target.producer.pluginName,
+            scope: target.producer.scope, platform: undefined })));
+        const references = await collectPluginConfigReferenceEvidence({ plugin: options.plugin, plugins: referencePlugins,
+            profiles, cwd: options.cwd, env: options.env });
+        const authorization = await resolveConfigPreApplyAuthorization({
+            plugin: options.plugin, scope: context, cwd: options.cwd, env: options.env,
+            applyTargets: configApplyRequestedTargets(plan).flatMap((target) => target.agent === 'codex' || target.agent === 'claude'
+                ? [{ pluginName: target.pluginId.split('/').at(-1), pluginId: target.pluginId, platform: target.agent, scope: target.scope }] : []),
+            nativeCliRunner: options.nativeCliRunner,
+            rebuildRuntime: { ...plan.runtime, referencePlugins },
+        });
+        const portableAuthorization = (current) => [
+            ...current.preApplyAuthorization ?? [],
+            ...(current.joint?.children ?? []).flatMap(portableAuthorization),
+        ];
+        const preApplyAuthorization = [...new Map([...authorization.targets, ...portableAuthorization(plan)]
+                .map((target) => [[target.pluginId, target.platform, target.scope].join('\0'), target])).values()];
+        return { plan, retainedLegacyTargets, commandPackages: commands.packages, commandDiscoveryErrors: commands.errors,
+            preApplyAuthorization,
+            evidence: { recovery: describeRecoveryPlan(plan), references, commands: commands.evidence,
+                preApplyAuthorization, retainedLegacyTargets } };
     }
-    const warnings = [...impact.referenceWarnings ?? []];
-    const { updatedKeys, removedKeys, staleRemovedKeys } = impact;
-    let preApplyUnavailableReason;
-    let preApplyUnavailableTargetResults = [];
-    let applyDiscovery = discovered
-        ? { ...discovered, targets: impact.affectedTargets, failures: discovered.failures,
-            commandPackages: impact.affectedCommandPackages }
-        : undefined;
-    const shouldApply = options.apply !== false && impact.storeChanged && !impact.noEffectiveChange;
-    if (shouldApply && (pluginMayRunPreApply(schemaPlugin)
-        || applyDiscovery?.targets.some((target) => target.pluginName !== schemaPlugin.manifest.name))) {
-        if (applyDiscovery) {
-            const preApplyAuthorization = await resolveConfigPreApplyAuthorization({
-                plugin: schemaPlugin,
-                scope: options.scope,
-                cwd: options.cwd,
-                env: options.env,
-                applyTargets: applyDiscovery.targets,
-                nativeCliRunner: options.nativeCliRunner,
-                rebuildRuntime: options.rebuildRuntime,
-                reinstallCommandImpl: options.reinstallCommandImpl,
-            });
-            if (preApplyAuthorization.targets.length > 0 && !preApplyAuthorizationIsConfirmed({
-                required: preApplyAuthorization.targets,
-                confirmed: options.preApplyConfirmed,
-                authorizedTargets: options.preApplyAuthorizedTargets,
-            })) {
-                throwPreApplyAuthorizationRequired(preApplyAuthorization.targets);
+    catch (error) {
+        await disposePluginConfigApply(plan);
+        throw error;
+    }
+}
+export async function disposePluginConfigApply(plan) {
+    for (const child of plan.joint?.children ?? [])
+        await disposePluginConfigApply(child);
+    await plan.context.dispose();
+}
+export async function applyPluginConfig(options) {
+    return withAwHomeMutationLock({ env: options.env, token: options.awHomeMutationToken, action: async (token) => {
+            await options.reviewPreflight?.();
+            let prepared;
+            try {
+                const { executeRecovery } = await import('../recovery/coordinator.js');
+                prepared = await preparePluginConfigApply({ ...options, awHomeMutationToken: token });
+                if (options.expectedEvidence !== undefined
+                    && JSON.stringify(options.expectedEvidence) !== JSON.stringify(prepared.evidence)) {
+                    throw Object.assign(new Error('operationPlanStale: Configuration apply inputs changed. Prepare a new Review.'), { code: 'operationPlanStale' });
+                }
+                const authorization = prepared.preApplyAuthorization;
+                if (authorization.length && !preApplyAuthorizationIsConfirmed({ required: authorization,
+                    confirmed: options.preApplyConfirmed, authorizedTargets: options.preApplyAuthorizedTargets })) {
+                    throwPreApplyAuthorizationRequired(authorization);
+                }
+                if (options.sharedNativeApplyConfirmed !== true && await configApplyHasValidSharedNativeTarget({
+                    plugin: options.plugin, cwd: options.cwd, env: options.env, plugins: options.rebuildRuntime?.referencePlugins,
+                    targets: configApplyRequestedTargets(prepared.plan).flatMap((target) => target.agent === 'codex' || target.agent === 'claude'
+                        ? [{ pluginName: target.pluginId.split('/').at(-1), pluginId: target.pluginId, platform: target.agent, scope: target.scope }] : []),
+                }))
+                    throwSharedNativeApplyConfirmationRequired();
+                const discoveryErrors = prepared.commandDiscoveryErrors.map((error) => ({
+                    stage: 'targetDiscovery', code: error.code, message: error.message,
+                }));
+                const receipt = await executeRecovery(prepared.plan, {
+                    yes: options.sharedNativeApplyConfirmed === true || options.preApplyConfirmed === true,
+                    runtime: { ...options.rebuildRuntime, awHomeMutationToken: token, preApplyConfirmed: options.preApplyConfirmed },
+                });
+                const retainedLegacyTargets = prepared.retainedLegacyTargets.filter((target) => !receipt.targetResults.some((result) => (target.pluginId ? result.pluginId === target.pluginId : result.pluginId.split('/').at(-1) === target.pluginName)
+                    && result.agent === target.platform && result.scope === target.scope));
+                prepared = undefined;
+                const ok = receipt.ok && discoveryErrors.length === 0;
+                const errors = [...discoveryErrors, ...receipt.blockers, ...receipt.errors].map((error) => ({
+                    stage: 'stage' in error ? error.stage : 'apply', code: error.code, message: error.message,
+                }));
+                const apply = {
+                    state: ok ? 'succeeded' : 'partial',
+                    targetResults: [...receipt.targetResults.filter((target) => target.satisfaction !== 'unsupported' && target.satisfaction !== 'excluded').map((target) => ({
+                            target: { pluginName: target.pluginId.split('/').at(-1), pluginId: target.pluginId,
+                                platform: target.agent, scope: target.scope },
+                            action: 'refresh',
+                            state: target.execution === 'applied' || target.execution === 'no-op' ? 'completed'
+                                : target.execution === 'not-run' ? 'skipped' : 'failed',
+                            ...(target.blockers.length ? { errorCode: target.blockers[0].code,
+                                message: target.blockers.map((item) => item.message).join(' ') } : {}),
+                        })), ...retainedLegacyTargets.map((target) => ({
+                            target, action: 'refresh', state: 'skipped',
+                            message: 'The inactive legacy output was preserved. Configuration apply does not create an activation.',
+                        }))],
+                    commandResults: receipt.commandResults,
+                    ...(errors.length ? { errors } : {}),
+                };
+                return { configWrite: 'notStarted', overallState: ok ? 'succeeded' : 'partial', apply,
+                    otherProjectsMayRequireSync: true };
             }
-            preApplyUnavailableTargetResults = preApplyAuthorization.unavailableTargetResults;
-            applyDiscovery = {
-                ...applyDiscovery,
-                targets: preApplyAuthorization.availableApplyTargets,
-                failures: [...applyDiscovery.failures, ...preApplyUnavailableTargetResults],
-            };
-            if (applyDiscovery.targets.length === 0 && preApplyUnavailableTargetResults.length > 0
-                && (applyDiscovery.commandPackages?.length ?? 0) === 0) {
-                preApplyUnavailableReason = 'sourceUnavailable';
+            catch (error) {
+                if (options.rebuildRuntime?.signal?.aborted || error instanceof Error && error.name === 'AbortError'
+                    || readSafeOperationError(error))
+                    throw error;
+                const apply = unavailableApply('targetDiscoveryFailed', 'targetDiscovery');
+                const code = error?.code;
+                if (typeof code === 'string')
+                    apply.error = { stage: 'apply', code,
+                        message: code === 'operationPlanStale' ? 'Configuration apply inputs changed. Prepare a new Review.'
+                            : 'The existing outputs cannot be refreshed with the current authorization.' };
+                return { configWrite: 'notStarted', overallState: 'partial', apply, otherProjectsMayRequireSync: true };
             }
-        }
-    }
-    if (options.apply !== false
-        && options.scope === 'user'
-        && options.sharedNativeApplyConfirmed !== true
-        && impact.sharedNativeRenderTargets.some((shared) => impact.affectedTargets
-            .some((target) => (!shared.pluginName || shared.pluginName === target.pluginName)
-            && target.platform === (shared.platform ?? 'codex')))) {
-        throwSharedNativeApplyConfirmationRequired();
-    }
+            finally {
+                if (prepared)
+                    await disposePluginConfigApply(prepared.plan);
+            }
+        } });
+}
+function throwSharedNativeApplyConfirmationRequired() {
+    const error = new Error('sharedNativeConfigApplyConfirmationRequired: Applying this user config changes a shared native artifact. Re-run with --yes.');
+    error.code = 'sharedNativeConfigApplyConfirmationRequired';
+    throw error;
+}
+async function applyPluginConfigWriteUnlocked(options) {
+    const pluginName = assertSafePluginConfigSegment(options.pluginName ?? options.plugin?.manifest.name ?? '');
+    const identity = options.plugin?.sourceId ? { sourceId: options.plugin.sourceId,
+        sourceIdentity: options.plugin.sourceIdentity, logicalIdentity: options.plugin.catalogLogicalIdentity } : {};
+    const requestedUpdates = options.request.updates ?? {};
+    const removeKeys = uniqueInOrder(options.request.removeKeys ?? []);
+    const duplicateKeys = removeKeys.filter((key) => Object.hasOwn(requestedUpdates, key));
+    if (duplicateKeys.length)
+        throw new Error(`Config write cannot update and remove the same key: ${duplicateKeys.join(', ')}.`);
+    const schemaAccess = await resolvePluginConfigSchemaAccess({ pluginName, currentPlugin: options.plugin,
+        currentPluginError: options.pluginError, scope: options.scope, platform: options.platform, cwd: options.cwd, env: options.env });
+    const plugin = schemaAccess.plugin;
+    const definition = plugin?.manifest.config ? compilePluginConfigDefinition(plugin.manifest.config, options.platform) : undefined;
+    if (!plugin || !definition)
+        throw new PluginConfigSchemaResolutionError('configSchemaUnavailable', `Plugin "${pluginName}" does not declare an AW config schema.`);
+    const updates = await coercePluginConfigUpdates({ schema: definition.fields, updates: requestedUpdates, cwd: options.cwd });
+    const impact = await analyzePluginConfigMutationImpact({ plugin, scope: options.scope, platform: options.platform,
+        cwd: options.cwd, env: options.env, visibleTargets: [], commandDiscovery: { packages: [], errors: [] },
+        referencePlugins: options.rebuildRuntime?.referencePlugins, mutation: { kind: 'patch', updates, removeKeys } });
+    await assertPluginConfigMutationCandidate({ ...identity, pluginName, manifest: plugin.manifest,
+        scope: options.scope, platform: options.platform, cwd: options.cwd, env: options.env, updates, removeKeys,
+        referencePlugins: options.rebuildRuntime?.referencePlugins });
+    if (impact.referenceBlockers?.length)
+        throw Object.assign(new Error(`configReferenceInUse: ${impact.referenceBlockers.join(' ')}`), { code: 'configReferenceInUse' });
     if (impact.storeChanged) {
         try {
-            const write = await patchPluginConfigStore({
-                ...configIdentity,
-                pluginName,
-                scope: options.scope,
-                cwd: options.cwd,
-                env: options.env,
-                updates: Object.fromEntries(updatedKeys.map((key) => [key, updates[key]])),
-                removeKeys: requestedRemoveKeys,
-                schema,
-            });
-            warnings.push(...write.warnings);
+            await patchPluginConfigStore({ ...identity, pluginName, scope: 'user', platform: options.platform,
+                cwd: options.cwd, env: options.env, updates: Object.fromEntries(impact.updatedKeys.map((key) => [key, updates[key]])), removeKeys });
         }
         catch (error) {
             throw markConfigWriteFailed(error);
         }
     }
+    const warnings = [...impact.referenceWarnings ?? []];
     let effective;
     try {
-        effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({
-            ...configIdentity,
-            pluginName,
-            manifest: schemaPlugin.manifest,
-            referencePlugins: options.rebuildRuntime?.referencePlugins,
-            targetScope: options.scope,
-            cwd: options.cwd,
-            env: options.env,
-        }));
+        effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({ ...identity, pluginName,
+            manifest: plugin.manifest, platform: options.platform, targetScope: options.scope, cwd: options.cwd, env: options.env,
+            referencePlugins: options.rebuildRuntime?.referencePlugins }));
     }
     catch {
-        const apply = unavailableApply('effectiveConfigUnavailable', 'effectiveConfig', [], impact.affectedCommandPackages);
-        const otherProjectsMayRequireSync = options.scope === 'user' && impact.storeChanged;
-        if (otherProjectsMayRequireSync)
-            warnings.push(...otherProjectsWarning(options.scope));
-        return {
-            plugin: pluginName,
-            scope: options.scope,
-            ...(schemaAccess.schema ? { schema: schemaAccess.schema } : {}),
-            updatedKeys,
-            removedKeys,
-            staleRemovedKeys,
-            configWrite: 'succeeded',
-            overallState: 'partial',
-            apply: publicConfigApplyResult(apply),
-            otherProjectsMayRequireSync,
-            warnings,
-        };
+        warnings.push('The saved configuration cannot be previewed. Check its schema and reference sources before applying it.');
     }
-    let apply;
+    if (impact.storeChanged)
+        warnings.push(...otherProjectsWarning('user'));
+    return { plugin: pluginName, scope: 'user', context: options.scope, platform: options.platform,
+        ...(schemaAccess.schema ? { schema: schemaAccess.schema } : {}), updatedKeys: impact.updatedKeys,
+        removedKeys: impact.removedKeys, staleRemovedKeys: impact.staleRemovedKeys, effective,
+        configWrite: 'succeeded', overallState: 'succeeded',
+        apply: skippedApply(impact.storeChanged ? 'notRequested' : 'noConfigChange'),
+        otherProjectsMayRequireSync: impact.storeChanged, warnings };
+}
+async function prepareConfigMutationApplySelection(options) {
+    if (options.apply !== true || !options.plugin)
+        return undefined;
+    let prepared;
     try {
-        apply = !impact.storeChanged
-            ? skippedApply('noConfigChange')
-            : options.apply === false
-                ? skippedApply('notRequested')
-                : targetDiscoveryFailed
-                    ? unavailableApply('targetDiscoveryFailed', 'targetDiscovery')
-                    : impact.noEffectiveChange
-                        && ((discovered?.targets.length ?? 0) + impact.commandPackages.length > 0
-                            || staleRemovedKeys.length === impact.changedKeys.length)
-                        ? skippedApply('noEffectiveConfigChange')
-                        : preApplyUnavailableReason
-                            ? unavailableApply(preApplyUnavailableReason, preApplyUnavailableReason === 'sourceUnavailable' ? 'source' : 'targetDiscovery', preApplyUnavailableTargetResults)
-                            : await applyConfigToVisibleTargets({
-                                plugin: schemaPlugin,
-                                scope: options.scope,
-                                cwd: options.cwd,
-                                env: options.env ?? process.env,
-                                applyTargets: applyDiscovery?.targets ?? impact.affectedTargets,
-                                nativeCliRunner: options.nativeCliRunner,
-                                reinstallCommandImpl: options.reinstallCommandImpl,
-                                rebuildRuntime: options.rebuildRuntime,
-                                noVisibleTargetHasInvalidConfig: (discovered?.targets.length ?? 0) > 0
-                                    && effective.issues.length > 0,
-                                preApplyConfirmed: options.preApplyConfirmed,
-                                discovered: applyDiscovery,
-                                changedConfigKeys: impact.changedKeys,
-                            });
+        prepared = await preparePluginConfigApply({ ...options, plugin: options.plugin });
+        const requestedTargets = configApplyRequestedTargets(prepared.plan);
+        if (requestedTargets.some((target) => target.agent !== 'codex' && target.agent !== 'claude'))
+            return undefined;
+        const visibleTargets = requestedTargets.map((target) => ({
+            pluginName: target.pluginId.split('/').at(-1), pluginId: target.pluginId,
+            platform: target.agent, scope: target.scope,
+        }));
+        if (!visibleTargets.length && !prepared.commandPackages.length && !prepared.commandDiscoveryErrors.length) {
+            if (prepared.plan.blockExecution || prepared.plan.receipt.blockers.length || prepared.plan.receipt.errors.length)
+                return undefined;
+            return { skipReason: 'noVisibleTarget' };
+        }
+        const impact = await analyzePluginConfigMutationImpact({ plugin: options.plugin, scope: options.context ?? options.scope,
+            platform: options.platform, cwd: options.cwd, env: options.env, visibleTargets,
+            commandDiscovery: { packages: prepared.commandPackages, errors: prepared.commandDiscoveryErrors },
+            referencePlugins: options.rebuildRuntime?.referencePlugins,
+            mutation: 'request' in options ? { kind: 'patch', ...options.request } : { kind: 'reset' } });
+        return { applyTargets: impact.affectedTargets,
+            applyCommandPackages: impact.affectedCommandPackages.map((target) => target.packageId),
+            ...(impact.noEffectiveChange ? { skipReason: 'noEffectiveConfigChange' } : {}) };
     }
-    catch (error) {
-        const failure = error instanceof Error ? error : new Error(String(error));
-        throw Object.assign(failure, { configWrite: 'succeeded' });
+    catch {
+        // A failed output discovery must not prevent a valid configuration save.
+        return undefined;
+    }
+    finally {
+        if (prepared)
+            await disposePluginConfigApply(prepared.plan);
     }
-    const otherProjectsMayRequireSync = options.scope === 'user' && impact.storeChanged;
-    if (otherProjectsMayRequireSync)
-        warnings.push(...otherProjectsWarning(options.scope));
-    return {
-        plugin: pluginName,
-        scope: options.scope,
-        ...(schemaAccess.schema ? { schema: schemaAccess.schema } : {}),
-        updatedKeys,
-        removedKeys,
-        staleRemovedKeys,
-        effective,
-        configWrite: 'succeeded',
-        overallState: overallStateForApply(apply),
-        apply: publicConfigApplyResult(apply),
-        otherProjectsMayRequireSync,
-        warnings,
-    };
 }
 export async function applyPluginConfigWrite(options) {
+    if (options.context)
+        await resolveWorkContext({ cwd: options.cwd, context: options.context });
     const requestedPluginName = options.pluginName ?? options.plugin?.manifest.name;
     if (!requestedPluginName)
         throw new Error('Plugin name is required for config write.');
     assertSafePluginConfigSegment(requestedPluginName);
-    if (options.scope === 'project') {
-        const targetPath = resolvePluginConfigStorePath({
-            sourceId: options.plugin?.sourceId,
-            pluginName: requestedPluginName,
-            scope: 'project',
-            cwd: options.cwd,
-            env: options.env,
-        });
-        await assertProjectSharedConfigPathVisible({
-            cwd: options.cwd,
-            targetPath,
-            env: options.env,
-        });
-    }
-    if (options.apply !== false && !options.awHomeMutationToken) {
-        await prepareNativeCliExecution({ env: options.env, runner: options.nativeCliRunner });
-    }
     return withAwHomeMutationLock({
         env: options.env,
         token: options.awHomeMutationToken,
         action: async (awHomeMutationToken) => {
             await options.reviewPreflight?.();
+            let configCommitted = false;
             try {
-                return await applyPluginConfigWriteUnlocked({
-                    ...options,
-                    awHomeMutationToken,
-                    rebuildRuntime: { ...options.rebuildRuntime, awHomeMutationToken },
-                });
+                const selection = await prepareConfigMutationApplySelection({ ...options, awHomeMutationToken });
+                const saved = await applyPluginConfigWriteUnlocked({ ...options, scope: options.context ?? options.scope,
+                    apply: false, awHomeMutationToken, rebuildRuntime: { ...options.rebuildRuntime, awHomeMutationToken } });
+                configCommitted = true;
+                if (options.apply !== true || !options.plugin)
+                    return saved;
+                if (saved.apply.state === 'skipped' && saved.apply.reason === 'noConfigChange')
+                    return saved;
+                if (selection?.skipReason)
+                    return { ...saved, apply: skippedApply(selection.skipReason) };
+                const applied = await applyPluginConfig({ ...options, ...selection, plugin: options.plugin, awHomeMutationToken });
+                return { ...saved, overallState: applied.overallState, apply: applied.apply };
             }
             catch (error) {
                 let sensitiveValues = options.plugin
-                    ? collectSensitivePluginConfigValues(options.plugin.manifest, (options.request.updates ?? {}))
+                    ? collectSensitivePluginConfigValues(options.plugin.manifest, (options.request.updates ?? {}), options.platform)
                     : [];
                 if (options.plugin) {
                     try {
@@ -1126,12 +1254,13 @@ export async function applyPluginConfigWrite(options) {
                             manifest: options.plugin.manifest,
                             referencePlugins: options.rebuildRuntime?.referencePlugins,
                             targetScope: options.scope,
+                            platform: options.platform,
                             cwd: options.cwd,
                             env: options.env,
                         });
                         sensitiveValues = [
                             ...sensitiveValues,
-                            ...collectSensitivePluginConfigValues(options.plugin.manifest, effective.values),
+                            ...collectSensitivePluginConfigValues(options.plugin.manifest, effective.values, options.platform),
                         ];
                     }
                     catch {
@@ -1160,8 +1289,8 @@ export async function applyPluginConfigWrite(options) {
                     : message.startsWith('schemaVersionUnsupported:') ? 'schemaVersionUnsupported'
                         : 'configApplyFailed';
                 const configWrite = error.configWrite;
-                if (configWrite === 'succeeded' || configWriteStateForError(error) === 'failed') {
-                    safeError.configWrite = configWrite === 'succeeded' ? 'succeeded' : 'failed';
+                if (configCommitted || configWrite === 'succeeded' || configWriteStateForError(error) === 'failed') {
+                    safeError.configWrite = configCommitted || configWrite === 'succeeded' ? 'succeeded' : 'failed';
                 }
                 if (error && typeof error === 'object' && 'operationDiagnostic' in error) {
                     safeError.operationDiagnostic = error.operationDiagnostic;
@@ -1173,277 +1302,90 @@ export async function applyPluginConfigWrite(options) {
 }
 async function resetPluginConfigWithHelperUnlocked(options) {
     const pluginName = assertSafePluginConfigSegment(options.pluginName);
-    let configIdentity = options.plugin?.sourceId ? {
-        sourceId: options.plugin.sourceId,
-        sourceIdentity: options.plugin.sourceIdentity,
-        logicalIdentity: options.plugin.catalogLogicalIdentity,
-    } : options.sourceId ? {
-        sourceId: options.sourceId,
-        sourceIdentity: options.sourceIdentity,
-        logicalIdentity: options.logicalIdentity,
-    } : {};
-    if (options.sourceId && !options.sourceIdentity) {
+    let identity = options.plugin?.sourceId ? { sourceId: options.plugin.sourceId,
+        sourceIdentity: options.plugin.sourceIdentity, logicalIdentity: options.plugin.catalogLogicalIdentity }
+        : { sourceId: options.sourceId, sourceIdentity: options.sourceIdentity, logicalIdentity: options.logicalIdentity };
+    if (identity.sourceId && !identity.sourceIdentity) {
         try {
-            const identity = await readNamespacedPluginConfigStoreIdentity({
-                sourceId: options.sourceId,
-                pluginName,
-                scope: options.scope,
-                cwd: options.cwd,
-                env: options.env,
-            });
-            if (identity?.binding.kind === 'source')
-                configIdentity = {
-                    sourceId: options.sourceId,
-                    sourceIdentity: identity.binding.sourceIdentity,
-                };
-            if (identity?.binding.kind === 'catalog')
-                configIdentity = {
-                    sourceId: options.sourceId,
-                    logicalIdentity: identity.binding.logicalIdentity,
-                };
-        }
-        catch {
-            // Reset does not require a readable or valid envelope.
+            const stored = await readNamespacedPluginConfigStoreIdentity({ sourceId: identity.sourceId, pluginName,
+                scope: 'user', platform: options.platform, cwd: options.cwd, env: options.env });
+            if (stored)
+                identity = { ...identity, sourceIdentity: stored.binding.sourceIdentity };
         }
+        catch { /* Reset remains available for unreadable identity metadata. */ }
     }
     let removedKeys = [];
     try {
-        const store = await readPluginConfigStore({
-            ...configIdentity,
-            pluginName,
-            scope: options.scope,
-            cwd: options.cwd,
-            env: options.env,
-        });
+        const store = await readPluginConfigStore({ ...identity, pluginName, scope: 'user', platform: options.platform,
+            cwd: options.cwd, env: options.env });
         removedKeys = collectRemovedConfigKeys(store.values);
     }
-    catch {
-        // Reset is the final recovery boundary and does not require a readable store.
-    }
+    catch { /* Broken stores still have the path-based reset boundary. */ }
     const warnings = [];
-    let impact;
-    let targetDiscoveryFailed = false;
-    let visibleTargets = [];
-    let discovered;
     if (options.plugin) {
-        if (options.apply !== false) {
-            try {
-                discovered = await resolveConfigApplyTargets({
-                    plugin: options.plugin,
-                    scope: options.scope,
-                    cwd: options.cwd,
-                    env: options.env ?? process.env,
-                    applyTargets: options.applyTargets,
-                    nativeCliRunner: options.nativeCliRunner,
-                    rebuildRuntime: options.rebuildRuntime,
-                });
-                visibleTargets = discovered.targets;
-            }
-            catch {
-                targetDiscoveryFailed = true;
-            }
-        }
         try {
-            impact = await analyzePluginConfigMutationImpact({
-                plugin: options.plugin,
-                scope: options.scope,
-                cwd: options.cwd,
-                env: options.env,
-                visibleTargets,
-                referencePlugins: options.rebuildRuntime?.referencePlugins,
-                ...(discovered ? { commandDiscovery: {
-                        packages: discovered.commandPackages ?? [], errors: discovered.commandDiscoveryErrors ?? [],
-                    } } : {}),
-                mutation: { kind: 'reset' },
-            });
-            removedKeys = impact.removedKeys;
-            warnings.push(...impact.referenceBlockers ?? []);
-            warnings.push(...impact.referenceWarnings ?? []);
+            const impact = await analyzePluginConfigMutationImpact({ plugin: options.plugin, scope: options.scope,
+                platform: options.platform, cwd: options.cwd, env: options.env, visibleTargets: [],
+                commandDiscovery: { packages: [], errors: [] }, referencePlugins: options.rebuildRuntime?.referencePlugins,
+                mutation: { kind: 'reset' } });
+            warnings.push(...impact.referenceWarnings ?? [], ...impact.referenceBlockers ?? []);
         }
         catch {
-            // Reset remains available when its before state cannot be read.
+            warnings.push('Configuration references could not be checked. Reset will still clear the selected layer.');
         }
     }
-    let preApplyUnavailableReason;
-    let preApplyUnavailableTargetResults = [];
-    let applyDiscovery = options.plugin && !targetDiscoveryFailed
-        ? { targets: impact?.affectedTargets ?? visibleTargets, failures: [],
-            commandPackages: impact?.affectedCommandPackages ?? discovered?.commandPackages,
-            commandDiscoveryErrors: impact?.commandDiscoveryErrors ?? discovered?.commandDiscoveryErrors }
-        : undefined;
-    if (options.plugin
-        && options.apply !== false
-        && impact?.storeChanged
-        && !impact.noEffectiveChange
-        && applyDiscovery
-        && (pluginMayRunPreApply(options.plugin)
-            || applyDiscovery.targets.some((target) => target.pluginName !== options.plugin.manifest.name))) {
-        const preApplyAuthorization = await resolveConfigPreApplyAuthorization({
-            plugin: options.plugin,
-            scope: options.scope,
-            cwd: options.cwd,
-            env: options.env,
-            applyTargets: applyDiscovery.targets,
-            nativeCliRunner: options.nativeCliRunner,
-            rebuildRuntime: options.rebuildRuntime,
-            reinstallCommandImpl: options.reinstallCommandImpl,
-        });
-        if (preApplyAuthorization.targets.length > 0 && !preApplyAuthorizationIsConfirmed({
-            required: preApplyAuthorization.targets,
-            confirmed: options.preApplyConfirmed,
-            authorizedTargets: options.preApplyAuthorizedTargets,
-        })) {
-            throwPreApplyAuthorizationRequired(preApplyAuthorization.targets);
-        }
-        preApplyUnavailableTargetResults = preApplyAuthorization.unavailableTargetResults;
-        applyDiscovery = {
-            ...applyDiscovery,
-            targets: preApplyAuthorization.availableApplyTargets,
-            failures: preApplyUnavailableTargetResults,
-        };
-        if (applyDiscovery.targets.length === 0 && preApplyUnavailableTargetResults.length > 0
-            && (applyDiscovery.commandPackages?.length ?? 0) === 0) {
-            preApplyUnavailableReason = 'sourceUnavailable';
-        }
-    }
-    if (options.plugin
-        && options.apply !== false
-        && options.scope === 'user'
-        && options.sharedNativeApplyConfirmed !== true
-        && (impact
-            ? impact.sharedNativeRenderTargets.some((shared) => impact.affectedTargets
-                .some((target) => (!shared.pluginName || shared.pluginName === target.pluginName)
-                && target.platform === (shared.platform ?? 'codex')))
-            : pluginSharedNativeConfigTargets(options.plugin).some((shared) => visibleTargets
-                .some((target) => (!shared.pluginName || shared.pluginName === target.pluginName)
-                && target.platform === (shared.platform ?? 'codex'))))) {
-        throwSharedNativeApplyConfirmationRequired();
-    }
     let reset;
     try {
-        reset = await resetPluginConfigStore({
-            ...configIdentity,
-            pluginName,
-            scope: options.scope,
-            cwd: options.cwd,
-            env: options.env,
-        });
+        reset = await resetPluginConfigStore({ ...identity, pluginName, scope: 'user', platform: options.platform,
+            cwd: options.cwd, env: options.env });
     }
     catch (error) {
         throw markConfigWriteFailed(error);
     }
-    let schemaAccess;
-    let apply = reset.deleted ? skippedApply('notRequested') : skippedApply('noConfigChange');
     let effective;
+    let schema;
     if (options.plugin) {
         try {
-            schemaAccess = await resolvePluginConfigSchemaAccess({
-                pluginName,
-                currentPlugin: options.plugin,
-                scope: options.scope,
-                cwd: options.cwd,
-                env: options.env,
-            });
+            schema = (await resolvePluginConfigSchemaAccess({ pluginName, currentPlugin: options.plugin,
+                scope: options.scope, platform: options.platform, cwd: options.cwd, env: options.env })).schema;
+            effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({ ...identity, pluginName,
+                manifest: options.plugin.manifest, platform: options.platform, targetScope: options.scope, cwd: options.cwd,
+                env: options.env, referencePlugins: options.rebuildRuntime?.referencePlugins }));
         }
         catch {
-            if (reset.deleted && options.apply !== false) {
-                apply = unavailableApply('sourceUnavailable', 'source');
-            }
-        }
-        const schemaPlugin = schemaAccess?.plugin;
-        if (schemaPlugin?.manifest.config?.fields) {
-            try {
-                effective = summarizeEffectivePluginConfig(await resolveEffectivePluginConfig({
-                    ...configIdentity,
-                    pluginName,
-                    manifest: schemaPlugin.manifest,
-                    referencePlugins: options.rebuildRuntime?.referencePlugins,
-                    targetScope: options.scope,
-                    cwd: options.cwd,
-                    env: options.env,
-                }));
-            }
-            catch {
-                if (reset.deleted && options.apply !== false) {
-                    apply = unavailableApply('effectiveConfigUnavailable', 'effectiveConfig', [], impact?.affectedCommandPackages);
-                }
-            }
-            if (reset.deleted
-                && options.apply !== false
-                && apply.state === 'skipped'
-                && impact?.noEffectiveChange
-                && visibleTargets.length + (impact?.commandPackages.length ?? 0) > 0) {
-                apply = skippedApply('noEffectiveConfigChange');
-            }
-            else if (reset.deleted
-                && options.apply !== false
-                && apply.state === 'skipped'
-                && targetDiscoveryFailed) {
-                apply = unavailableApply('targetDiscoveryFailed', 'targetDiscovery');
-            }
-            else if (reset.deleted && options.apply !== false && apply.state === 'skipped') {
-                apply = preApplyUnavailableReason
-                    ? unavailableApply(preApplyUnavailableReason, 'source', preApplyUnavailableTargetResults)
-                    : await applyConfigToVisibleTargets({
-                        plugin: schemaPlugin,
-                        scope: options.scope,
-                        cwd: options.cwd,
-                        env: options.env ?? process.env,
-                        applyTargets: applyDiscovery?.targets ?? impact?.affectedTargets ?? options.applyTargets,
-                        nativeCliRunner: options.nativeCliRunner,
-                        reinstallCommandImpl: options.reinstallCommandImpl,
-                        rebuildRuntime: options.rebuildRuntime,
-                        noVisibleTargetHasInvalidConfig: (effective?.issues.length ?? 0) > 0,
-                        preApplyConfirmed: options.preApplyConfirmed,
-                        discovered: applyDiscovery,
-                        changedConfigKeys: impact?.changedKeys ?? removedKeys,
-                    });
-            }
+            warnings.push('The cleared configuration cannot be previewed. Check its schema and references before applying it.');
         }
-        else if (reset.deleted && options.apply !== false && apply.state === 'skipped') {
-            apply = unavailableApply('schemaUnavailable', 'schema');
-        }
-    }
-    else if (reset.deleted && options.apply !== false) {
-        apply = options.pluginError
-            ? unavailableApply('sourceUnavailable', 'source')
-            : unavailableApply('schemaUnavailable', 'schema');
     }
-    const otherProjectsMayRequireSync = options.scope === 'user' && reset.deleted;
-    if (otherProjectsMayRequireSync)
-        warnings.push(...otherProjectsWarning(options.scope));
-    return {
-        plugin: pluginName,
-        scope: options.scope,
-        ...(schemaAccess?.schema ? { schema: schemaAccess.schema } : {}),
-        existed: reset.existed,
-        deleted: reset.deleted,
-        resetDisposition: reset.resetDisposition,
-        ...(reset.quarantineBasename ? { quarantineBasename: reset.quarantineBasename } : {}),
-        removedKeys,
-        ...(effective ? { effective } : {}),
-        configWrite: 'succeeded',
-        overallState: overallStateForApply(apply),
-        apply: publicConfigApplyResult(apply),
-        otherProjectsMayRequireSync,
-        warnings,
-    };
+    if (reset.existed)
+        warnings.push(...otherProjectsWarning('user'));
+    return { plugin: pluginName, scope: 'user', context: options.scope, platform: options.platform, schema,
+        existed: reset.existed, deleted: reset.deleted, resetDisposition: reset.resetDisposition,
+        ...(reset.quarantineBasename ? { quarantineBasename: reset.quarantineBasename } : {}), removedKeys, effective,
+        configWrite: 'succeeded', overallState: 'succeeded', apply: skippedApply(reset.existed ? 'notRequested' : 'noConfigChange'),
+        otherProjectsMayRequireSync: reset.existed, warnings };
 }
 export async function resetPluginConfigWithHelper(options) {
+    if (options.context)
+        await resolveWorkContext({ cwd: options.cwd, context: options.context });
     assertSafePluginConfigSegment(options.pluginName);
-    if (options.apply !== false && !options.awHomeMutationToken) {
-        await prepareNativeCliExecution({ env: options.env, runner: options.nativeCliRunner });
-    }
     return withAwHomeMutationLock({
         env: options.env,
         token: options.awHomeMutationToken,
         action: async (awHomeMutationToken) => {
             await options.reviewPreflight?.();
-            return resetPluginConfigWithHelperUnlocked({
-                ...options,
-                awHomeMutationToken,
-                rebuildRuntime: { ...options.rebuildRuntime, awHomeMutationToken },
-            });
+            const selection = await prepareConfigMutationApplySelection({ ...options, awHomeMutationToken });
+            const saved = await resetPluginConfigWithHelperUnlocked({ ...options, scope: options.context ?? options.scope,
+                apply: false, awHomeMutationToken, rebuildRuntime: { ...options.rebuildRuntime, awHomeMutationToken } });
+            if (options.apply !== true)
+                return saved;
+            if (!options.plugin)
+                return { ...saved, overallState: 'partial', apply: unavailableApply('sourceUnavailable', 'source') };
+            if (saved.apply.state === 'skipped' && saved.apply.reason === 'noConfigChange')
+                return saved;
+            if (selection?.skipReason)
+                return { ...saved, apply: skippedApply(selection.skipReason) };
+            const applied = await applyPluginConfig({ ...options, ...selection, plugin: options.plugin, awHomeMutationToken });
+            return { ...saved, overallState: applied.overallState, apply: applied.apply };
         },
     });
 }
@@ -1454,6 +1396,8 @@ export async function describeResetAffectedFields(options) {
             plugin: options.plugin,
             ...(options.pluginError ? { pluginError: options.pluginError } : {}),
             scope: options.scope,
+            context: options.context,
+            platform: options.platform,
             cwd: options.cwd,
             env: options.env,
         });
@@ -1463,7 +1407,8 @@ export async function describeResetAffectedFields(options) {
             kind: field.kind,
             reserved: field.reserved,
             action: 'reset',
-            scope: options.scope,
+            scope: 'user',
+            platform: options.platform,
             valueState: field.valueState,
         }));
     }
@@ -1479,7 +1424,8 @@ export async function describeResetAffectedFields(options) {
                 logicalIdentity: options.logicalIdentity,
             } : {}),
             pluginName: options.pluginName,
-            scope: options.scope,
+            scope: 'user',
+            platform: options.platform,
             cwd: options.cwd,
             env: options.env,
         });
@@ -1489,7 +1435,8 @@ export async function describeResetAffectedFields(options) {
             kind: 'manifest',
             reserved: false,
             action: 'reset',
-            scope: options.scope,
+            scope: 'user',
+            platform: options.platform,
         }));
     }
 }