@lesliechan721/aw 0.1.0-beta.7 → 0.1.0-beta.9

package/dist/src/index.js

@@ -4,14 +4,17 @@ import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { Command, CommanderError, Option } from 'commander';
+import { doctorEvalProviders } from '@lesliechan721/agent-skill-eval';
 import { initCommand } from './commands/init.js';
+import { resolveCatalogWorkspaceRoot } from './commands/catalog-workspace-resolution.js';
 import { addCatalogSourceCommand, explicitRefPolicy, listCatalogSources, removeCatalogSourceCommand, setPrimaryCatalogSourceCommand, updateCatalogSourceCommand, } from './commands/catalog-source.js';
+import { catalogSourceStatusCommand, syncCatalogSourceCommand, } from './commands/catalog-generation.js';
 import { cleanupWriteCommand as cleanupCommand, installWriteCommand as installCommand, reinstallWriteCommand as reinstallCommand, uninstallWriteCommand as uninstallCommand, upgradeWriteCommand as upgradeCommand, } from './commands/write-commands.js';
+import { syncCommand } from './commands/sync-command.js';
 import { formatInteractiveConsoleUnavailableMessage, runConsoleController, } from './commands/console.js';
 import { runCommandWizard, toWizardCandidates, WizardExecutionError, } from './commands/wizard.js';
 import { createCliExecutionContext, emitCommandEvent, } from './commands/runtime.js';
-import { loadConsoleItemsResult } from './commands/status.js';
-import { statusCommandV4 } from './commands/status-v4.js';
+import { loadConsoleItemsResult, statusCommandV6 } from './commands/status-v6.js';
 import { normalizeUninstallCommandOptions, normalizeCleanupCommandOptions, resolveConfigReadResolution, resolveConfigProjectLayer, resolveConfigWriteScope, normalizeInstallCommandOptions, normalizeReinstallCommandOptions, normalizeUpgradeCommandOptions, } from './commands/options.js';
 import { isCommandWarningError, } from './types.js';
 import { formatWarnings } from './output/reporter.js';
@@ -26,6 +29,8 @@ import { writeCandidateEligibility } from './utils/target-eligibility.js';
 import { assertCatalogSourceReferencesSupported, inventoryLegacyConfigReferences, } from './utils/catalog-source-references.js';
 import { parsePluginId, withResolvedCatalogPlugin, withResolvedMultiSourceCatalog, } from './utils/multi-source-catalog.js';
 import { sanitizeCatalogSourceError } from './utils/catalog-public-error.js';
+import { catalogGenerationErrorCode } from './utils/catalog-generation-error.js';
+import { resolveCatalogOperationContext, } from './utils/catalog-operation-context.js';
 import { formatConfigCommandValue, parseConfigValue, } from './utils/config-value.js';
 import { withAwHomeMutationLock, } from './utils/aw-home-mutation-lock.js';
 import { installPortableSkills, materializePortableSkillsToDirectory, PortableCommandError, renderPortableReview, } from './portable/commands.js';
@@ -33,9 +38,12 @@ import { SkillsCliError } from './portable/skills-cli.js';
 import { computeReviewComponentDigest, listReviewRecords, parseReviewAttachment, publishReviewRecord, showReviewRecord, verifyReviewRecord, } from './commands/review-publication.js';
 import { resolveRepoRoot } from './utils/state-paths.js';
 import { runCatalogBuildCommand, runCatalogInitCommand, runCatalogValidateCommand, runCatalogVersionCommand, runPluginBuildCommand, runPluginTestCommand, } from './authoring/workspace-commands.js';
-import { runCatalogPublishCommand } from './commands/catalog-publish.js';
+import { runCatalogPublishApplyCommand, runCatalogPublishPlanCommand, } from './commands/catalog-publish.js';
 import { getCatalogStatus, renderCatalogStatus } from './commands/catalog-status.js';
+import { activateCatalogDevSource, catalogDevSourceError, createCatalogDevFailureReceipt, deactivateCatalogDevSource, getCatalogDevSourceStatus, } from './commands/catalog-dev-source.js';
 import { getPluginCapabilitiesResult, parsePluginCapabilitySurface, renderPluginCapabilities, } from './commands/plugin-capabilities.js';
+import { AwCapabilityUnsupportedError, checkCurrentAw, describeCurrentAw, inspectPluginRequirements, } from './commands/aw-capabilities.js';
+import { prepareSkillEval } from './commands/skill-eval.js';
 function createDefaultIo() {
     return {
         stdout: (text) => process.stdout.write(text),
@@ -61,6 +69,148 @@ function resolveCommandReceiptExitCode(result) {
     }
     return 0;
 }
+class WriteCommandRequestError extends Error {
+    code = 'invalidArguments';
+}
+function normalizeWriteRequest(normalize) {
+    try {
+        return normalize();
+    }
+    catch (error) {
+        throw new WriteCommandRequestError(error instanceof Error ? error.message : String(error));
+    }
+}
+function writeCommandFailure(error) {
+    const message = redactString(error instanceof Error ? error.message : String(error));
+    if (error instanceof CommanderError || error instanceof WriteCommandRequestError) {
+        return { code: 'invalidArguments', message };
+    }
+    const explicitCode = error?.code;
+    if (typeof explicitCode === 'string' && /^[A-Za-z][A-Za-z0-9]*$/u.test(explicitCode)) {
+        return { code: explicitCode, message };
+    }
+    const separator = message.indexOf(':');
+    const prefix = separator > 0 ? message.slice(0, separator) : '';
+    return {
+        code: /^[A-Za-z][A-Za-z0-9]*$/u.test(prefix) ? prefix : 'writeCommandFailed',
+        message,
+    };
+}
+function preparseWriteReceiptRequest(argv) {
+    const request = { json: false, plugins: [] };
+    let positionalOnly = false;
+    for (let index = 1; index < argv.length; index += 1) {
+        const token = argv[index];
+        if (positionalOnly) {
+            request.plugins.push(token);
+            continue;
+        }
+        if (token === '--') {
+            positionalOnly = true;
+            continue;
+        }
+        if (token === '--json') {
+            request.json = true;
+            continue;
+        }
+        if (token === '--platform' || token === '--scope') {
+            const value = argv[index + 1];
+            if (token === '--platform')
+                request.platform = value;
+            else
+                request.scope = value;
+            index += 1;
+            continue;
+        }
+        if (token.startsWith('--platform=')) {
+            request.platform = token.slice('--platform='.length);
+            continue;
+        }
+        if (token.startsWith('--scope=')) {
+            request.scope = token.slice('--scope='.length);
+            continue;
+        }
+        if (token === '--dependency-scope' || token === '--script-timeout' || token === '--log-file') {
+            index += 1;
+            continue;
+        }
+        if (token.startsWith('--'))
+            continue;
+        if (token.startsWith('-') && token !== '-') {
+            const shortOptions = token.slice(1);
+            for (let offset = 0; offset < shortOptions.length; offset += 1) {
+                const option = shortOptions[offset];
+                if (option === 'j') {
+                    request.json = true;
+                    continue;
+                }
+                if (option === 'p' || option === 's') {
+                    const value = shortOptions.slice(offset + 1) || argv[index + 1];
+                    if (option === 'p')
+                        request.platform = value;
+                    else
+                        request.scope = value;
+                    if (shortOptions.length === offset + 1)
+                        index += 1;
+                    break;
+                }
+            }
+            continue;
+        }
+        request.plugins.push(token);
+    }
+    return request;
+}
+function jsonWriteCommandRequest(argv) {
+    const command = argv[0];
+    if (!['install', 'upgrade', 'reinstall', 'uninstall', 'cleanup', 'sync'].includes(command ?? '')) {
+        return null;
+    }
+    const request = preparseWriteReceiptRequest(argv);
+    if (!request.json)
+        return null;
+    const rawPlatform = request.platform;
+    const platform = rawPlatform === 'codex' || rawPlatform === 'claude' || rawPlatform === 'both'
+        ? rawPlatform
+        : 'codex';
+    return {
+        command: command,
+        plugins: request.plugins,
+        platform,
+        scope: request.scope === 'project' ? 'project' : 'user',
+    };
+}
+function writeCommandFailureReceipt(write, request, error) {
+    const platforms = request.platform === 'both'
+        ? ['codex', 'claude']
+        : [request.platform];
+    writeJsonReceipt(write, buildRebuildReceiptJson(request.command, {
+        platforms,
+        plugins: request.plugins,
+        warnings: [],
+        overallState: 'failed',
+        errors: [writeCommandFailure(error)],
+        receiptTargets: request.plugins.flatMap((selector) => platforms.map((platform) => {
+            let pluginName = selector;
+            let sourceId;
+            try {
+                const parsed = parsePluginId(selector);
+                pluginName = parsed.pluginName;
+                sourceId = parsed.sourceId;
+            }
+            catch {
+                // Keep the raw selector in the failed receipt.
+            }
+            return {
+                pluginName,
+                pluginId: selector,
+                ...(sourceId ? { sourceId } : {}),
+                platform,
+                scope: request.scope,
+            };
+        })),
+    }));
+}
 async function runAuthoringScript(options) {
     const scriptPath = path.join(resolveCliPackageRoot(), 'dist', 'authoring', 'scripts', options.scriptName);
     return new Promise((resolve, reject) => {
@@ -141,6 +291,12 @@ export function buildEquivalentWriteCommandTokens(command, selection, rawOptions
         selection.platform ?? 'both',
         '--scope',
         selection.scope ?? 'user',
+        ...(rawOptions.allowManagedCodexInstall === true
+            ? ['--allow-managed-codex-install']
+            : []),
+        ...(command === 'install'
+            ? (rawOptions.dependencyScope ?? []).flatMap((value) => ['--dependency-scope', value])
+            : []),
         ...(command === 'cleanup' ? [] : optionTokens('--script-timeout', rawOptions.scriptTimeout)),
         ...(!all && selection.plugins.length > 0 ? ['--', ...selection.plugins] : []),
     ];
@@ -209,7 +365,6 @@ async function loadWizardCandidates(context, rawOptions) {
         cwd: context.cwd,
         scope: rawOptions.scope,
         platform: rawOptions.platform,
-        includeCatalogOnly: true,
     }, context);
     return toWizardCandidates(loaded.items);
 }
@@ -301,7 +456,6 @@ async function resolveStoredOnlyConfigIdentity(options) {
     const sourceIdentity = [...identities][0];
     await withResolvedMultiSourceCatalog({
         cliVersion: resolveCliVersion(),
-        freshnessPolicy: 'cacheFirst',
         sourceIds: [parsed.sourceId],
         env: options.context.env,
         consume: async (catalog) => {
@@ -330,7 +484,6 @@ async function resolveMultiSourceConfigRead(options) {
     return withResolvedCatalogPlugin({
         selector: options.selector,
         cliVersion: resolveCliVersion(),
-        freshnessPolicy: 'cacheFirst',
         env: options.context.env,
         consume: async ({ pluginId, source, plugin }) => {
             const result = await resolveConfigRead({
@@ -389,9 +542,23 @@ async function resolveMultiSourceConfigRead(options) {
         return { ...stored, result };
     });
 }
-async function executeWriteCommand(command, pluginNames, rawOptions, context) {
+export function createManagedCodexAuthorizer(rawOptions, context) {
+    if (rawOptions.allowManagedCodexInstall === true)
+        return async () => true;
+    if (!(context.interactive && context.isTty && !context.isCi && rawOptions.json !== true)
+        || !context.prompt.confirm)
+        return undefined;
+    return async () => {
+        const response = await context.prompt.confirm({
+            message: '系统中没有可用的 Codex CLI。是否获取本次操作所需的 AW-managed Codex runtime？',
+            defaultValue: false,
+        });
+        return !response.cancelled && response.value === true;
+    };
+}
+async function executeWriteCommand(command, pluginNames, rawOptions, context, directCli = false) {
     const raw = { cwd: context.cwd, ...rawOptions };
-    const commandOptions = command === 'install'
+    const commandOptions = normalizeWriteRequest(() => command === 'install'
         ? normalizeInstallCommandOptions(raw)
         : command === 'upgrade'
             ? normalizeUpgradeCommandOptions(raw)
@@ -399,25 +566,32 @@ async function executeWriteCommand(command, pluginNames, rawOptions, context) {
                 ? normalizeUninstallCommandOptions(raw)
                 : command === 'cleanup'
                     ? normalizeCleanupCommandOptions(raw)
-                    : normalizeReinstallCommandOptions(raw);
+                    : normalizeReinstallCommandOptions(raw));
     await emitCommandEvent(context, {
         type: 'options:normalized',
         data: { plugins: pluginNames, options: commandOptions },
     });
+    const managedCodexAuthorizer = createManagedCodexAuthorizer(rawOptions, context);
+    const runtime = {
+        ...context,
+        directCli,
+        ...(managedCodexAuthorizer ? { managedCodexAuthorizer } : {}),
+    };
     switch (command) {
-        case 'install': return installCommand(pluginNames, commandOptions, context);
-        case 'upgrade': return upgradeCommand(pluginNames, commandOptions, context);
-        case 'uninstall': return uninstallCommand(pluginNames, commandOptions, context);
-        case 'cleanup': return cleanupCommand(pluginNames, commandOptions, context);
-        case 'reinstall': return reinstallCommand(pluginNames, commandOptions, context);
+        case 'install': return installCommand(pluginNames, commandOptions, runtime);
+        case 'upgrade': return upgradeCommand(pluginNames, commandOptions, runtime);
+        case 'uninstall': return uninstallCommand(pluginNames, commandOptions, runtime);
+        case 'cleanup': return cleanupCommand(pluginNames, commandOptions, runtime);
+        case 'reinstall': return reinstallCommand(pluginNames, commandOptions, runtime);
     }
 }
 async function runWriteCommandAction(command, pluginNames, rawOptions, context) {
     if ((command === 'cleanup' || command === 'reinstall') && pluginNames.length > 1) {
-        throw new Error(`${command} 命令当前只支持单个插件目标。`);
+        throw new WriteCommandRequestError(`${command} 命令当前只支持单个插件目标。`);
+    }
+    if (command === 'upgrade') {
+        normalizeWriteRequest(() => assertUpgradeAllConflict(pluginNames, rawOptions.all === true));
     }
-    if (command === 'upgrade')
-        assertUpgradeAllConflict(pluginNames, rawOptions.all === true);
     const missingPlugin = pluginNames.length === 0 && !(command === 'upgrade' && rawOptions.all === true);
     const missingPlatform = rawOptions.platform === undefined;
     const missingScope = command === 'cleanup' && rawOptions.scope === undefined;
@@ -433,17 +607,16 @@ async function runWriteCommandAction(command, pluginNames, rawOptions, context)
     if (!missing) {
         return {
             cancelled: false,
-            result: await executeWriteCommand(command, pluginNames, rawOptions, context),
+            result: await executeWriteCommand(command, pluginNames, rawOptions, context, true),
         };
     }
     if (!isWizardAvailable(context, rawOptions)) {
-        throw new Error(writeCommandUsage(command));
+        throw new WriteCommandRequestError(writeCommandUsage(command));
     }
     const loaded = await loadConsoleItemsResult({
         cwd: context.cwd,
         scope: rawOptions.scope,
         platform: rawOptions.platform,
-        includeCatalogOnly: true,
     }, context);
     if (loaded.catalogUnavailable) {
         throw new Error('插件目录不可用。请运行 `aw init` 或 `aw init --force`，或使用完整参数重试。');
@@ -676,9 +849,32 @@ export function buildProgram(options = {}) {
     const plugin = program
         .command('plugin')
         .description('Create and validate AW plugin source');
+    const self = program
+        .command('self')
+        .description('Describe and check this AW executable');
+    self
+        .command('describe')
+        .description('Describe implemented AW capabilities')
+        .requiredOption('--json', 'emit one machine-readable JSON object')
+        .action(() => {
+        writeJsonReceipt(io.stdout, describeCurrentAw(resolveCliVersion()));
+    });
+    self
+        .command('check')
+        .description('Check nearby plugin requirements against this AW executable')
+        .option('--from <path>', 'start discovery from this file or directory')
+        .requiredOption('--json', 'emit one machine-readable JSON object')
+        .action(async (rawOptions) => {
+        const result = await checkCurrentAw({
+            awVersion: resolveCliVersion(),
+            from: path.resolve(cwd, rawOptions.from ?? '.'),
+        });
+        writeJsonReceipt(io.stdout, result);
+        commandExitState.exitCode = result.ok ? 0 : 1;
+    });
     plugin
         .command('capabilities')
-        .description('Show the current plugin authoring capability contract')
+        .description('Show the current plugin manifest authoring surface')
         .option('--surface <surface>', 'manifest | build-config | extensions | slash-commands | mcp-apps | config | lifecycle | artifacts')
         .option('--json', 'emit one machine-readable JSON object', false)
         .action((rawOptions) => {
@@ -701,9 +897,128 @@ export function buildProgram(options = {}) {
             commandExitState.exitCode = 1;
         }
     });
+    plugin
+        .command('requirements')
+        .description('Inspect or update effective AW capabilities required by a plugin')
+        .argument('<plugin-directory>', 'plugin source directory')
+        .option('--workspace-root <root>', 'Catalog Workspace root (default: nearest ancestor from plugin directory)')
+        .option('--add <capability>', 'add one declared AW capability')
+        .option('--remove <capability>', 'remove one declared AW capability')
+        .requiredOption('--json', 'emit one machine-readable JSON object')
+        .action(async (pluginDirectory, rawOptions) => {
+        try {
+            const result = await inspectPluginRequirements({
+                pluginDirectory,
+                ...(rawOptions.workspaceRoot ? { workspaceRoot: rawOptions.workspaceRoot } : {}),
+                ...(rawOptions.add ? { add: rawOptions.add } : {}),
+                ...(rawOptions.remove ? { remove: rawOptions.remove } : {}),
+                cwd,
+            });
+            writeJsonReceipt(io.stdout, result);
+            if (result.observations.some((observation) => observation.blocking)) {
+                commandExitState.exitCode = 1;
+            }
+        }
+        catch (error) {
+            writeJsonReceipt(io.stdout, {
+                schemaVersion: 1,
+                command: 'plugin:requirements',
+                ok: false,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            commandExitState.exitCode = 1;
+        }
+    });
     const skill = program
         .command('skill')
         .description('Install, materialize, or validate Agent Skills');
+    const skillEval = skill
+        .command('eval')
+        .description('Prepare or diagnose deterministic Agent Skill Eval inputs');
+    skillEval
+        .command('doctor')
+        .description('Inspect Agent Skill Eval provider readiness without model execution')
+        .requiredOption('--json', 'emit one provider doctor JSON object')
+        .action(async () => {
+        try {
+            writeJsonReceipt(io.stdout, await doctorEvalProviders({ sourceEnv: env }));
+        }
+        catch (error) {
+            writeJsonReceipt(io.stdout, {
+                ok: false,
+                error: redactString(error instanceof Error ? error.message : String(error)),
+            });
+            commandExitState.exitCode = 1;
+        }
+    });
+    skillEval
+        .command('prepare')
+        .description('Prepare one complete Agent Skill Eval input directory')
+        .argument('<plugin>', 'canonical Workspace plugin name')
+        .argument('<skill>', 'owner Skill name')
+        .option('--suite <suite>', 'Eval suite ID')
+        .option('--profile <profile>', 'Eval profile ID')
+        .option('--workspace-root <root>', 'Catalog Workspace root')
+        .option('--split <split>', 'case split filter')
+        .option('--case <id>', 'case ID filter')
+        .option('--runs <count>', 'runs per selected case')
+        .option('--timeout-ms <milliseconds>', 'timeout for each provider attempt')
+        .option('--baseline <mode>', 'append without-skill comparison')
+        .option('--previous-version <runtime-skill-root>', 'append a previous-version comparison')
+        .option('--keep-workspace', 'retain the preparation materialization workspace', false)
+        .requiredOption('--output <spec-directory>', 'new EvalSpec directory')
+        .requiredOption('--json', 'emit one preparation receipt JSON object')
+        .action(async (pluginName, skillName, rawOptions) => {
+        try {
+            const workspace = await resolveCatalogWorkspaceRoot({
+                cwd,
+                ...(rawOptions.workspaceRoot === undefined ? {} : { explicitRoot: rawOptions.workspaceRoot }),
+                mode: 'existing',
+                env,
+            });
+            const runs = rawOptions.runs === undefined
+                ? undefined
+                : (/^[1-9][0-9]*$/u.test(rawOptions.runs) ? Number(rawOptions.runs) : Number.NaN);
+            const timeoutMs = rawOptions.timeoutMs === undefined
+                ? undefined
+                : (/^[1-9][0-9]*$/u.test(rawOptions.timeoutMs) ? Number(rawOptions.timeoutMs) : Number.NaN);
+            const receipt = await prepareSkillEval({
+                workspaceRoot: workspace.workspaceRoot,
+                workspaceRootResolvedFrom: workspace.workspaceRootResolvedFrom,
+                pluginName,
+                skillName,
+                ...(rawOptions.suite === undefined ? {} : { suiteId: rawOptions.suite }),
+                ...(rawOptions.profile === undefined ? {} : { profileId: rawOptions.profile }),
+                output: rawOptions.output,
+                cwd,
+                env,
+                ...(rawOptions.split === undefined ? {} : { split: rawOptions.split }),
+                ...(rawOptions.case === undefined ? {} : { caseId: rawOptions.case }),
+                ...(runs === undefined ? {} : { runs }),
+                ...(timeoutMs === undefined ? {} : { timeoutMs }),
+                ...(rawOptions.baseline === undefined ? {} : {
+                    baseline: rawOptions.baseline,
+                }),
+                ...(rawOptions.previousVersion === undefined ? {} : {
+                    previousVersion: rawOptions.previousVersion,
+                }),
+                ...(rawOptions.keepWorkspace === true ? { keepWorkspace: true } : {}),
+            });
+            writeJsonReceipt(io.stdout, receipt);
+        }
+        catch (error) {
+            writeJsonReceipt(io.stdout, {
+                schemaVersion: 1,
+                command: 'skill:eval:prepare',
+                ok: false,
+                errors: [{
+                        code: 'evalPreparationFailed',
+                        message: redactString(error instanceof Error ? error.message : String(error)),
+                    }],
+            });
+            commandExitState.exitCode = 1;
+        }
+    });
     const review = program
         .command('review')
         .description('Publish and inspect immutable review records');
@@ -864,15 +1179,17 @@ export function buildProgram(options = {}) {
         .option('--skill <name...>', 'install only selected Skill names')
         .option('--agent <id...>', 'install to explicit Agent IDs')
         .option('-y, --yes', 'confirm the reviewed install', false)
-        .option('-j, --json', 'emit one receipt v4 JSON object', false)
+        .option('-j, --json', 'emit one receipt v5 JSON object', false)
         .action(async (selector, rawOptions) => {
         const context = createActionContext('skill:install', {});
         const writeFailure = (error) => {
-            const code = error instanceof PortableCommandError || error instanceof SkillsCliError
-                ? error.code
-                : 'portableInstallFailed';
+            const capabilityError = error instanceof AwCapabilityUnsupportedError ? error : undefined;
+            const code = capabilityError?.code
+                ?? (error instanceof PortableCommandError || error instanceof SkillsCliError
+                    ? error.code
+                    : 'portableInstallFailed');
             writeJsonReceipt(io.stdout, {
-                receiptSchemaVersion: 4,
+                receiptSchemaVersion: 5,
                 command: 'skill:install',
                 ok: false,
                 status: 'failed',
@@ -888,7 +1205,15 @@ export function buildProgram(options = {}) {
                 materializationDigest: null,
                 verification: { records: [], missing: [] },
                 warnings: [],
-                failures: [{ code, message: `${code}: portable Skill 安装未执行。` }],
+                failures: [{
+                        code,
+                        message: capabilityError?.message ?? `${code}: portable Skill 安装未执行。`,
+                        ...(capabilityError ? {
+                            plugin: capabilityError.plugin,
+                            missingCapabilities: capabilityError.missingCapabilities,
+                            availableCapabilities: capabilityError.availableCapabilities,
+                        } : {}),
+                    }],
             });
         };
         if (rawOptions.json && !rawOptions.yes) {
@@ -958,7 +1283,7 @@ export function buildProgram(options = {}) {
         .requiredOption('-s, --scope <scope>', 'project or user')
         .requiredOption('--out <dir>', 'output directory')
         .option('--skill <name...>', 'write only selected Skill names')
-        .option('-j, --json', 'emit one receipt v4 JSON object', false)
+        .option('-j, --json', 'emit one receipt v5 JSON object', false)
         .action(async (selector, rawOptions) => {
         const context = createActionContext('skill:materialize', {});
         try {
@@ -979,11 +1304,13 @@ export function buildProgram(options = {}) {
         catch (error) {
             if (!rawOptions.json)
                 throw error;
-            const code = error instanceof PortableCommandError || error instanceof SkillsCliError
-                ? error.code
-                : 'portableMaterializeFailed';
+            const capabilityError = error instanceof AwCapabilityUnsupportedError ? error : undefined;
+            const code = capabilityError?.code
+                ?? (error instanceof PortableCommandError || error instanceof SkillsCliError
+                    ? error.code
+                    : 'portableMaterializeFailed');
             writeJsonReceipt(io.stdout, {
-                receiptSchemaVersion: 4,
+                receiptSchemaVersion: 5,
                 command: 'skill:materialize',
                 ok: false,
                 plugin: { id: selector },
@@ -995,7 +1322,15 @@ export function buildProgram(options = {}) {
                 configDigest: null,
                 materializationDigest: null,
                 outputDigest: null,
-                errors: [{ code, message: `${code}: portable Skill 导出未执行。` }],
+                errors: [{
+                        code,
+                        message: capabilityError?.message ?? `${code}: portable Skill 导出未执行。`,
+                        ...(capabilityError ? {
+                            plugin: capabilityError.plugin,
+                            missingCapabilities: capabilityError.missingCapabilities,
+                            availableCapabilities: capabilityError.availableCapabilities,
+                        } : {}),
+                    }],
             });
             commandExitState.exitCode = 1;
         }
@@ -1007,7 +1342,7 @@ export function buildProgram(options = {}) {
         '',
         'During development, keep the current stable target when production content changes.',
         'Next, run `aw plugin validate`, `aw plugin test`, `aw plugin build`, and `aw catalog build`.',
-        'Publish only as an explicit later step; inspect `aw catalog publish --help` first.',
+        'Publish only as an explicit later step; inspect `aw catalog publish plan --help` first.',
         '',
     ].join('\n'))
         .argument('<plugin-name>', 'lowercase hyphen-case plugin name')
@@ -1019,9 +1354,7 @@ export function buildProgram(options = {}) {
         .option('--skill-short-description <text>', 'initial Skill UI summary (25-64 characters)')
         .option('--skill-invocation <mode>', 'model | manual | claude-model-only (default: model)')
         .option('--version <semver>', 'initial stable plugin version (default: 0.1.0)')
-        .option('--min-version <semver>', 'compatibility.aw.minVersion')
-        .option('--catalog-min-version <semver>', 'target catalog compatibility minimum')
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: current directory)')
+        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from current directory)')
         .option('--no-skills', 'create the plugin without a skills directory')
         .option('--with-mcp', 'add a minimal .mcp.json', false)
         .option('--with-apps', 'add a minimal .app.json', false)
@@ -1034,7 +1367,7 @@ export function buildProgram(options = {}) {
         '',
         'During development, keep the current stable target when production content changes.',
         'Next, run `aw plugin validate`, `aw plugin test`, `aw plugin build`, and `aw catalog build`.',
-        'Publish only as an explicit later step; inspect `aw catalog publish --help` first.',
+        'Publish only as an explicit later step; inspect `aw catalog publish plan --help` first.',
         '',
     ].join('\n'))
         .argument('<plugin-name>', 'existing lowercase hyphen-case plugin name')
@@ -1042,35 +1375,39 @@ export function buildProgram(options = {}) {
         .option('--skill-description <text>', 'Skill goal and discovery description (required)')
         .option('--skill-short-description <text>', 'Skill UI summary (25-64 characters)')
         .option('--skill-invocation <mode>', 'model | manual | claude-model-only (default: model)')
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: current directory)');
+        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from current directory)');
     plugin
         .command('remove')
         .description('Remove one committed and unchanged canonical plugin source tree')
         .argument('<plugin-name>', 'existing lowercase hyphen-case plugin name')
-        .requiredOption('--workspace-root <path>', 'Catalog Workspace root')
+        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from current directory)')
         .option('--yes', 'confirm plugin source deletion', false)
         .option('--json', 'emit one schema 1 JSON object', false);
     plugin
         .command('validate')
         .description('Validate one source plugin directory')
         .argument('<plugin-directory>', 'source plugin directory')
-        .option('--catalog-min-version <semver>', 'validate compatibility against a target catalog')
         .option('--strict-agent-skills', 'allow only Agent Skills portable core frontmatter', false)
         .option('--claude-skill-profile <profile>', 'minimum | current (default: minimum)')
         .option('--version-base <git-ref>', 'production bundle comparison base (default: HEAD)')
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: current directory)')
+        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from plugin directory)')
         .option('--json', 'emit one machine-readable JSON result', false);
     plugin
         .command('test')
         .description('Run deterministic Node tests declared by one source plugin')
         .argument('<plugin-directory>', 'source plugin directory')
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: current directory)')
+        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from plugin directory)')
         .option('--json', 'emit one machine-readable JSON result', false)
         .action(async (pluginDirectory, rawOptions) => {
         try {
+            const workspace = await resolveCatalogWorkspaceRoot({
+                cwd: path.resolve(cwd, pluginDirectory),
+                ...(rawOptions.workspaceRoot === undefined ? {} : { explicitRoot: path.resolve(cwd, rawOptions.workspaceRoot) }),
+                mode: 'existing',
+            });
             commandExitState.exitCode = await runPluginTestCommand({
-                workspaceRoot: path.resolve(cwd, rawOptions.workspaceRoot ?? '.'),
-                pluginDirectory,
+                ...workspace,
+                pluginDirectory: path.resolve(cwd, pluginDirectory),
                 json: rawOptions.json,
                 io,
             });
@@ -1087,15 +1424,20 @@ export function buildProgram(options = {}) {
         .command('build')
         .description('Build and inspect one source plugin bundle')
         .argument('<plugin-directory>', 'source plugin directory')
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: current directory)')
+        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from plugin directory)')
         .option('--out <path>', 'output path inside the Catalog Workspace')
         .option('--force', 'replace an existing generated output', false)
         .option('--json', 'emit one machine-readable JSON result', false)
         .action(async (pluginDirectory, rawOptions) => {
         try {
+            const workspace = await resolveCatalogWorkspaceRoot({
+                cwd: path.resolve(cwd, pluginDirectory),
+                ...(rawOptions.workspaceRoot === undefined ? {} : { explicitRoot: path.resolve(cwd, rawOptions.workspaceRoot) }),
+                mode: 'existing',
+            });
             await runPluginBuildCommand({
-                workspaceRoot: path.resolve(cwd, rawOptions.workspaceRoot ?? '.'),
-                pluginDirectory,
+                ...workspace,
+                pluginDirectory: path.resolve(cwd, pluginDirectory),
                 out: rawOptions.out,
                 force: rawOptions.force,
                 json: rawOptions.json,
@@ -1117,15 +1459,7 @@ export function buildProgram(options = {}) {
         .option('--all', 'check every current Catalog Workspace plugin', false)
         .option('--base <git-ref>', 'explicit Git comparison base')
         .option('--json', 'emit one schema v3 JSON document', false)
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: current directory)');
-    plugin
-        .command('check-versions')
-        .description('Deprecated alias for plugin status')
-        .argument('[plugin-name]', 'one explicit plugin name')
-        .option('--all', 'check every plugin changed relative to the Git base', false)
-        .option('--base <git-ref>', 'explicit Git comparison base')
-        .option('--json', 'emit one schema v3 JSON document', false)
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: current directory)');
+        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from current directory)');
     skill
         .command('validate')
         .description('Validate one Agent Skill directory')
@@ -1139,7 +1473,7 @@ export function buildProgram(options = {}) {
     catalog
         .command('init')
         .description('Initialize a local AW Catalog Workspace')
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: current directory)')
+        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor, then Git worktree root, then current directory)')
         .option('--owner-name <name>', 'catalog owner name')
         .option('--owner-url <url>', 'catalog owner URL')
         .option('--display-name <name>', 'catalog display name')
@@ -1148,9 +1482,15 @@ export function buildProgram(options = {}) {
         .option('--json', 'emit one machine-readable JSON result', false)
         .action(async (rawOptions) => {
         try {
+            const workspace = await resolveCatalogWorkspaceRoot({
+                cwd,
+                ...(rawOptions.workspaceRoot === undefined ? {} : { explicitRoot: rawOptions.workspaceRoot }),
+                mode: 'initialize',
+                env,
+            });
             await runCatalogInitCommand({
                 ...rawOptions,
-                workspaceRoot: path.resolve(cwd, rawOptions.workspaceRoot ?? '.'),
+                ...workspace,
                 io,
             });
         }
@@ -1167,12 +1507,17 @@ export function buildProgram(options = {}) {
         .description('Read or set the Catalog version')
         .argument('[version]', 'stable or x.y.z-beta.N catalog version')
         .option('--bump <level>', 'bump the stable SemVer base: patch, minor, or major')
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: current directory)')
+        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from current directory)')
         .option('--json', 'emit one machine-readable JSON result', false)
         .action(async (version, rawOptions) => {
         try {
+            const workspace = await resolveCatalogWorkspaceRoot({
+                cwd,
+                ...(rawOptions.workspaceRoot === undefined ? {} : { explicitRoot: rawOptions.workspaceRoot }),
+                mode: 'existing',
+            });
             await runCatalogVersionCommand({
-                workspaceRoot: path.resolve(cwd, rawOptions.workspaceRoot ?? '.'),
+                ...workspace,
                 version,
                 bump: rawOptions.bump,
                 json: rawOptions.json,
@@ -1190,14 +1535,19 @@ export function buildProgram(options = {}) {
     catalog
         .command('build')
         .description('Build a deterministic development Catalog snapshot')
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: current directory)')
+        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from current directory)')
         .option('--out <path>', 'output path inside the Catalog Workspace')
         .option('--force', 'replace an existing generated output', false)
         .option('--json', 'emit one machine-readable JSON result', false)
         .action(async (rawOptions) => {
         try {
+            const workspace = await resolveCatalogWorkspaceRoot({
+                cwd,
+                ...(rawOptions.workspaceRoot === undefined ? {} : { explicitRoot: rawOptions.workspaceRoot }),
+                mode: 'existing',
+            });
             await runCatalogBuildCommand({
-                workspaceRoot: path.resolve(cwd, rawOptions.workspaceRoot ?? '.'),
+                ...workspace,
                 out: rawOptions.out,
                 force: rawOptions.force,
                 json: rawOptions.json,
@@ -1214,7 +1564,7 @@ export function buildProgram(options = {}) {
     });
     catalog
         .command('validate')
-        .description('Validate a schema 4 Catalog snapshot')
+        .description('Validate a schema 6 Catalog snapshot')
         .argument('<snapshot-directory>', 'Catalog snapshot directory')
         .option('--json', 'emit one machine-readable JSON result', false)
         .action(async (snapshotDirectory, rawOptions) => {
@@ -1235,18 +1585,13 @@ export function buildProgram(options = {}) {
     });
     catalog
         .command('status')
-        .description('Inspect a Catalog Workspace; --preflight executes plugin validation and build code')
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: current directory)')
-        .option('--remote <name>', 'configured Git remote name for preflight (default: origin)')
-        .option('--branch <name>', 'dedicated Catalog branch for preflight (default: catalog)')
-        .option('--preflight', 'run publication validation and temporary plugin builds (executes plugin code)', false)
+        .description('Inspect static Catalog Workspace, snapshot, and Git facts')
+        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from current directory)')
         .option('--json', 'emit one machine-readable JSON status object', false)
         .action(async (rawOptions) => {
         const receipt = await getCatalogStatus({
-            workspaceRoot: path.resolve(cwd, rawOptions.workspaceRoot ?? '.'),
-            remote: rawOptions.remote,
-            branch: rawOptions.branch,
-            preflight: rawOptions.preflight,
+            cwd,
+            workspaceRoot: rawOptions.workspaceRoot,
             env,
         });
         if (rawOptions.json)
@@ -1255,23 +1600,70 @@ export function buildProgram(options = {}) {
             io.stdout(renderCatalogStatus(receipt));
         commandExitState.exitCode = receipt.ok ? 0 : 1;
     });
-    catalog
+    const catalogPublish = catalog
         .command('publish')
-        .description('Publish a versioned Catalog snapshot to a configured Git remote')
-        .option('--workspace-root <path>', 'Catalog Workspace root (default: current directory)')
-        .option('--remote <name>', 'configured Git remote name (default: origin)')
+        .description('Plan or apply a versioned Catalog publication');
+    catalogPublish
+        .command('plan')
+        .description('Prepare and inspect the exact Catalog publication plan')
+        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from current directory)')
+        .option('--remote <name>', 'Git remote (default: origin, otherwise sole remote; explicit if ambiguous)')
+        .option('--branch <name>', 'dedicated Catalog branch (default: catalog)')
+        .option('--json', 'emit one machine-readable JSON result', false)
+        .action(async (rawOptions) => {
+        try {
+            const result = await runCatalogPublishPlanCommand({
+                cwd,
+                workspaceRoot: rawOptions.workspaceRoot,
+                remote: rawOptions.remote,
+                branch: rawOptions.branch,
+                env,
+                io,
+            });
+            if (rawOptions.json)
+                writeJsonReceipt(io.stdout, result);
+            else {
+                writeLine(io.stdout, `Workspace identity: ${result.workspaceIdentity}`);
+                writeLine(io.stdout, `Source HEAD: ${result.sourceHead}`);
+                writeLine(io.stdout, `Remote identity: ${result.descriptor.remote.identityDigest}`);
+                writeLine(io.stdout, `Remote: ${result.remote} (${result.remoteUrl})`);
+                writeLine(io.stdout, `Branch: refs/heads/${result.branch}`);
+                writeLine(io.stdout, `Parent: ${result.parent ?? '<root>'}`);
+                writeLine(io.stdout, `Tag: refs/tags/${result.tag}`);
+                writeLine(io.stdout, `Snapshot digest: ${result.snapshotDigest}`);
+                writeLine(io.stdout, `Plan digest: ${result.planDigest}`);
+            }
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (rawOptions.json)
+                writeJsonReceipt(io.stdout, {
+                    command: 'catalog:publish:plan',
+                    ok: false,
+                    errors: [{ message }],
+                });
+            writeLine(io.stderr, message);
+            commandExitState.exitCode = 1;
+        }
+    });
+    catalogPublish
+        .command('apply')
+        .description('Apply an authorized Catalog publication plan')
+        .option('--workspace-root <path>', 'Catalog Workspace root (default: nearest ancestor from current directory)')
+        .option('--remote <name>', 'Git remote (default: origin, otherwise sole remote; explicit if ambiguous)')
         .option('--branch <name>', 'dedicated Catalog branch (default: catalog)')
-        .option('--expected-descriptor-digest <digest>', 'required exact descriptor returned by publication preflight')
+        .requiredOption('--expected-plan-digest <sha256>', 'exact plan digest returned by catalog publish plan')
         .option('-y, --yes', 'confirm publication without a prompt', false)
         .option('--json', 'emit one machine-readable JSON result', false)
         .action(async (rawOptions) => {
         try {
-            const context = createActionContext('catalog:publish', {});
-            const result = await runCatalogPublishCommand({
-                workspaceRoot: path.resolve(cwd, rawOptions.workspaceRoot ?? '.'),
+            const context = createActionContext('catalog:publish:apply', {});
+            const result = await runCatalogPublishApplyCommand({
+                cwd,
+                workspaceRoot: rawOptions.workspaceRoot,
                 remote: rawOptions.remote,
                 branch: rawOptions.branch,
-                expectedDescriptorDigest: rawOptions.expectedDescriptorDigest,
+                expectedPlanDigest: rawOptions.expectedPlanDigest,
                 yes: rawOptions.yes,
                 json: rawOptions.json,
                 env,
@@ -1300,7 +1692,7 @@ export function buildProgram(options = {}) {
             const message = error instanceof Error ? error.message : String(error);
             if (rawOptions.json)
                 writeJsonReceipt(io.stdout, {
-                    command: 'catalog:publish',
+                    command: 'catalog:publish:apply',
                     ok: false,
                     errors: [{ message }],
                 });
@@ -1308,6 +1700,82 @@ export function buildProgram(options = {}) {
             commandExitState.exitCode = 1;
         }
     });
+    const catalogDev = catalog
+        .command('dev')
+        .description('Manage the current Catalog Workspace development source');
+    catalogDev
+        .command('activate')
+        .option('--workspace-root <path>', 'explicit Catalog Workspace root')
+        .option('--source-id <id>', 'explicit managed source ID')
+        .option('--primary', 'make the development source primary', false)
+        .option('--force-build', 'rebuild a current snapshot', false)
+        .requiredOption('--json', 'emit one schema 2 JSON receipt')
+        .action(async (rawOptions) => {
+        try {
+            const receipt = await activateCatalogDevSource({
+                cwd,
+                workspaceRoot: rawOptions.workspaceRoot,
+                sourceId: rawOptions.sourceId,
+                primary: rawOptions.primary,
+                forceBuild: rawOptions.forceBuild,
+                cliVersion: resolveCliVersion(),
+                env,
+            });
+            writeJsonReceipt(io.stdout, receipt);
+            commandExitState.exitCode = receipt.ok ? 0 : 1;
+        }
+        catch (error) {
+            const failure = catalogDevSourceError(error);
+            writeJsonReceipt(io.stdout, createCatalogDevFailureReceipt({
+                command: 'activate', cwd, workspaceRoot: rawOptions.workspaceRoot,
+                sourceId: rawOptions.sourceId, ...failure,
+            }));
+            commandExitState.exitCode = 1;
+        }
+    });
+    catalogDev
+        .command('status')
+        .option('--workspace-root <path>', 'explicit Catalog Workspace root')
+        .requiredOption('--json', 'emit one schema 3 JSON receipt')
+        .action(async (rawOptions) => {
+        const receipt = await getCatalogDevSourceStatus({
+            cwd,
+            workspaceRoot: rawOptions.workspaceRoot,
+            cliVersion: resolveCliVersion(),
+            env,
+        });
+        writeJsonReceipt(io.stdout, receipt);
+        commandExitState.exitCode = receipt.ok ? 0 : 1;
+    });
+    catalogDev
+        .command('deactivate')
+        .option('--workspace-root <path>', 'explicit Catalog Workspace root')
+        .option('--source-id <id>', 'recover one managed source by exact ID')
+        .option('--replacement-primary <id>', 'replacement when the target source is primary')
+        .option('-y, --yes', 'confirm recovery by source ID', false)
+        .requiredOption('--json', 'emit one schema 2 JSON receipt')
+        .action(async (rawOptions) => {
+        try {
+            const receipt = await deactivateCatalogDevSource({
+                cwd,
+                workspaceRoot: rawOptions.workspaceRoot,
+                sourceId: rawOptions.sourceId,
+                replacementPrimary: rawOptions.replacementPrimary,
+                yes: rawOptions.yes,
+                env,
+            });
+            writeJsonReceipt(io.stdout, receipt);
+            commandExitState.exitCode = receipt.ok ? 0 : 1;
+        }
+        catch (error) {
+            const failure = catalogDevSourceError(error);
+            writeJsonReceipt(io.stdout, createCatalogDevFailureReceipt({
+                command: 'deactivate', cwd, workspaceRoot: rawOptions.workspaceRoot,
+                sourceId: rawOptions.sourceId, ...failure,
+            }));
+            commandExitState.exitCode = 1;
+        }
+    });
     const catalogSource = catalog
         .command('source')
         .description('Manage catalog sources');
@@ -1316,7 +1784,7 @@ export function buildProgram(options = {}) {
         const message = failure instanceof Error ? failure.message : String(error);
         if (json) {
             writeJsonReceipt(io.stdout, {
-                receiptSchemaVersion: 4,
+                receiptSchemaVersion: 5,
                 command,
                 ok: false,
                 changed: false,
@@ -1328,20 +1796,43 @@ export function buildProgram(options = {}) {
         writeLine(io.stderr, message);
         commandExitState.exitCode = 1;
     };
+    const writeCatalogGenerationFailure = (command, sourceId, json, error) => {
+        const failure = sanitizeCatalogSourceError(error, env);
+        const message = redactString(failure.message);
+        if (json) {
+            writeJsonReceipt(io.stdout, {
+                ...(command === 'catalog:source:sync'
+                    ? { catalogGenerationSchemaVersion: 1 }
+                    : { catalogGenerationStatusSchemaVersion: 1 }),
+                command,
+                ok: false,
+                ...(sourceId ? { sourceId } : {}),
+                errors: [{ code: catalogGenerationErrorCode(error), message }],
+            });
+        }
+        writeLine(io.stderr, message);
+        commandExitState.exitCode = 1;
+    };
     const writeConfigMutationFailure = (command, plugin, json, error) => {
         const message = error instanceof Error ? error.message : String(error);
-        const code = message.includes('legacyStateUnsupported')
-            ? 'legacyStateUnsupported'
-            : message.includes('sourceChanged')
-                ? 'sourceChanged'
-                : message.includes('sourceMissing')
-                    ? 'sourceMissing'
-                    : message.startsWith('Cannot resolve required catalog sources:')
-                        ? 'catalogSourceUnavailable'
-                        : message.split(':', 1)[0] || 'configMutationFailed';
+        const generationCode = catalogGenerationErrorCode(error);
+        const code = generationCode === 'catalogGenerationUnavailable'
+            || generationCode === 'catalogGenerationSourceMissing'
+            ? 'catalogSourceUnavailable'
+            : generationCode !== 'catalogGenerationFailed'
+                ? generationCode
+                : message.includes('legacyStateUnsupported')
+                    ? 'legacyStateUnsupported'
+                    : message.includes('sourceChanged')
+                        ? 'sourceChanged'
+                        : message.includes('sourceMissing')
+                            ? 'sourceMissing'
+                            : message.startsWith('Cannot resolve required catalog sources:')
+                                ? 'catalogSourceUnavailable'
+                                : message.split(':', 1)[0] || 'configMutationFailed';
         if (json && !message.includes('Usage:')) {
             writeJsonReceipt(io.stdout, {
-                receiptSchemaVersion: 4,
+                receiptSchemaVersion: 5,
                 command,
                 ok: false,
                 overallState: 'failed',
@@ -1352,16 +1843,25 @@ export function buildProgram(options = {}) {
         writeLine(io.stderr, message);
         commandExitState.exitCode = 1;
     };
-    const withResolvedConfigMutationPlugin = (context, selector, consume) => withAwHomeMutationLock({
-        env: context.env,
-        action: (awHomeMutationToken) => withResolvedCatalogPlugin({
-            selector,
-            cliVersion: resolveCliVersion(),
-            freshnessPolicy: 'requireRemote',
+    const withResolvedConfigMutationPlugin = (context, selector, consume) => (async () => {
+        const parsed = parsePluginId(selector);
+        return withAwHomeMutationLock({
             env: context.env,
-            consume: (resolution) => consume(resolution, awHomeMutationToken),
-        }),
-    });
+            action: async (awHomeMutationToken) => {
+                const catalogOperationContext = await resolveCatalogOperationContext({
+                    ...(parsed.sourceId ? { sourceIds: [parsed.sourceId] } : {}),
+                    env: context.env,
+                });
+                return withResolvedCatalogPlugin({
+                    selector,
+                    cliVersion: resolveCliVersion(),
+                    operationContext: catalogOperationContext,
+                    env: context.env,
+                    consume: (resolution) => consume(resolution, awHomeMutationToken, catalogOperationContext),
+                });
+            },
+        });
+    })();
     catalogSource
         .command('list')
         .option('-j, --json', 'print catalog sources as JSON', false)
@@ -1376,6 +1876,60 @@ export function buildProgram(options = {}) {
             writeLine(io.stdout, `${source.primary ? '*' : '-'} ${source.id} ${source.type} ${source.sourceIdentity}`);
         }
     });
+    catalogSource
+        .command('sync')
+        .argument('<id>')
+        .option('--check', 'fetch and validate without changing the Catalog store or Active state', false)
+        .option('-j, --json', 'print the source sync result as JSON', false)
+        .action(async (id, rawOptions) => {
+        try {
+            const result = await syncCatalogSourceCommand({
+                sourceId: id,
+                cliVersion: resolveCliVersion(),
+                check: rawOptions.check === true,
+                env,
+            });
+            if (rawOptions.json) {
+                writeJsonReceipt(io.stdout, {
+                    ...result,
+                    command: 'catalog:source:sync',
+                    ok: true,
+                });
+            }
+            else {
+                writeLine(io.stdout, rawOptions.check
+                    ? `Catalog source ${id} is valid.`
+                    : `Catalog source ${id}: ${result.outcome}.`);
+            }
+        }
+        catch (error) {
+            writeCatalogGenerationFailure('catalog:source:sync', id, rawOptions.json === true, error);
+        }
+    });
+    catalogSource
+        .command('status')
+        .argument('[id]')
+        .option('-j, --json', 'print offline Catalog source status as JSON', false)
+        .action(async (id, rawOptions) => {
+        try {
+            const result = await catalogSourceStatusCommand({ sourceId: id, env });
+            if (rawOptions.json) {
+                writeJsonReceipt(io.stdout, result);
+            }
+            else {
+                for (const source of result.sources) {
+                    const active = source.active
+                        ? `Active ${source.active.snapshotDigest}`
+                        : 'no Active';
+                    const readiness = source.activeReady ? 'ready' : 'not ready';
+                    writeLine(io.stdout, `${source.sourceId}: ${active}, ${readiness}`);
+                }
+            }
+        }
+        catch (error) {
+            writeCatalogGenerationFailure('catalog:source:status', id, rawOptions.json === true, error);
+        }
+    });
     catalogSource
         .command('add')
         .argument('<id>')
@@ -1520,7 +2074,6 @@ export function buildProgram(options = {}) {
     });
     program
         .command('init')
-        .option('-f, --force', 're-fetch and rebuild the current catalog cache entry', false)
         .option('-j, --json', 'print receipt as JSON', false)
         .option('-v, --verbose', 'show command diagnostics', false)
         .option('-D, --debug', 'write debug diagnostics to a log file', false)
@@ -1528,8 +2081,6 @@ export function buildProgram(options = {}) {
         .action(async (rawOptions) => {
         const context = createActionContext('init', rawOptions);
         const result = await runActionWithContext(context, () => initCommand({
-            force: rawOptions.force,
-            cliVersion: resolveCliVersion(),
             env: context.env,
         }));
         if (rawOptions.json) {
@@ -1540,19 +2091,68 @@ export function buildProgram(options = {}) {
                 writeLine(io.stdout, line);
             }
         }
-        writeWarnings(io.stderr, result.warnings, { actionableOnly: true });
         for (const source of result.sources) {
             if (!source.ok && source.error)
                 writeLine(io.stderr, `${source.id}: ${source.error}`);
         }
         commandExitState.exitCode = result.ok ? 0 : 1;
     });
+    program
+        .command('sync')
+        .description('Reconcile Codex actual state from existing desired intent')
+        .argument('[plugins...]')
+        .requiredOption('-s, --scope <scope>', 'project or user')
+        .requiredOption('-p, --platform <platform>', 'codex')
+        .option('-a, --all', 'reconcile every desired plugin in the selected scope', false)
+        .option('-y, --yes', 'authorize shared native replacement or forced repair', false)
+        .option('--allow-managed-codex-install', 'allow this command to acquire or rebuild the pinned AW-managed Codex runtime', false)
+        .option('-j, --json', 'print sync receipt as JSON', false)
+        .option('-v, --verbose', 'show command diagnostics', false)
+        .option('-D, --debug', 'write debug diagnostics to a log file', false)
+        .option('--log-file <path>', 'write debug diagnostics to the specified file')
+        .action(async (plugins, rawOptions) => {
+        const context = createActionContext('sync', rawOptions);
+        const normalized = normalizeWriteRequest(() => normalizeInstallCommandOptions({
+            cwd: context.cwd,
+            scope: rawOptions.scope,
+            platform: rawOptions.platform,
+            allowManagedCodexInstall: rawOptions.allowManagedCodexInstall,
+        }));
+        if (normalized.platform !== 'codex') {
+            throw new Error('syncPlatformUnsupported: sync requires --platform codex.');
+        }
+        const syncPlatform = normalized.platform;
+        const result = await runActionWithContext(context, () => syncCommand(plugins ?? [], {
+            cwd: context.cwd,
+            env: context.env,
+            platform: syncPlatform,
+            scope: normalized.scope,
+            all: rawOptions.all,
+            yes: rawOptions.yes,
+            json: rawOptions.json,
+            interactive: context.interactive && context.isTty && !context.isCi,
+            prompt: context.prompt,
+            allowManagedCodexInstall: rawOptions.allowManagedCodexInstall,
+        }, context));
+        if (rawOptions.json) {
+            writeJsonReceipt(io.stdout, buildRebuildReceiptJson('sync', result));
+        }
+        else {
+            for (const line of renderRebuildReceipt('sync', result))
+                writeLine(io.stdout, line);
+        }
+        writeWarnings(io.stderr, result.warnings, { actionableOnly: true });
+        commandExitState.exitCode = resolveCommandReceiptExitCode(result);
+    });
     program
         .command('install')
         .argument('[plugins...]')
         .option('-s, --scope <scope>', 'project or user')
         .option('-p, --platform <platform>', 'codex | claude | both')
+        .option('--dependency-scope <pluginId[#platform]=scope>', 'place one dependency at project or user scope; repeat for more dependencies', (value, previous) => [...previous, value], [])
         .option('--script-timeout <ms>', 'override plugin lifecycle script timeout in milliseconds')
+        .option('--allow-managed-codex-install', 'allow this command to acquire or rebuild the pinned AW-managed Codex runtime', false)
+        .option('-y, --yes', 'authorize shared Codex native replacement', false)
         .option('-j, --json', 'print receipt as JSON', false)
         .option('-v, --verbose', 'show command diagnostics', false)
         .option('-D, --debug', 'write debug diagnostics to a log file', false)
@@ -1580,6 +2180,7 @@ export function buildProgram(options = {}) {
         .option('-s, --scope <scope>', 'project or user')
         .option('-p, --platform <platform>', 'codex | claude | both')
         .option('--script-timeout <ms>', 'override plugin lifecycle script timeout in milliseconds')
+        .option('--allow-managed-codex-install', 'allow this command to acquire or rebuild the pinned AW-managed Codex runtime', false)
         .option('-j, --json', 'print receipt as JSON', false)
         .option('-v, --verbose', 'show command diagnostics', false)
         .option('-D, --debug', 'write debug diagnostics to a log file', false)
@@ -1608,6 +2209,8 @@ export function buildProgram(options = {}) {
         .option('-s, --scope <scope>', 'project or user')
         .option('-p, --platform <platform>', 'codex | claude | both')
         .option('--script-timeout <ms>', 'override plugin lifecycle script timeout in milliseconds')
+        .option('--allow-managed-codex-install', 'allow this command to acquire or rebuild the pinned AW-managed Codex runtime', false)
+        .option('-y, --yes', 'authorize shared Codex native replacement', false)
         .option('-j, --json', 'print receipt as JSON', false)
         .option('-v, --verbose', 'show command diagnostics', false)
         .option('-D, --debug', 'write debug diagnostics to a log file', false)
@@ -1636,6 +2239,7 @@ export function buildProgram(options = {}) {
         .option('-p, --platform <platform>', 'codex | claude | both')
         .option('-j, --json', 'print cleanup result as JSON', false)
         .option('--force', 'remove exclusively owned plugin output without dependency protection', false)
+        .option('--allow-managed-codex-install', 'allow this command to acquire or rebuild the pinned AW-managed Codex runtime', false)
         .option('-v, --verbose', 'show command diagnostics', false)
         .option('-D, --debug', 'write debug diagnostics to a log file', false)
         .option('--log-file <path>', 'write debug diagnostics to the specified file')
@@ -1662,6 +2266,8 @@ export function buildProgram(options = {}) {
         .option('-s, --scope <scope>', 'project or user')
         .option('-p, --platform <platform>', 'codex | claude | both')
         .option('--script-timeout <ms>', 'override plugin lifecycle script timeout in milliseconds')
+        .option('--allow-managed-codex-install', 'allow this command to acquire or rebuild the pinned AW-managed Codex runtime', false)
+        .option('-y, --yes', 'authorize shared Codex native replacement or forced reinstall', false)
         .option('-j, --json', 'print receipt as JSON', false)
         .option('-v, --verbose', 'show command diagnostics', false)
         .option('-D, --debug', 'write debug diagnostics to a log file', false)
@@ -1852,7 +2458,7 @@ export function buildProgram(options = {}) {
             outcome = await runActionWithContext(context, async () => {
                 const scope = resolveConfigWriteScope(rawOptions.scope);
                 const projectLayer = resolveConfigProjectLayer(rawOptions);
-                const execute = async (selectedPlugin, selectedKey, inputValue) => withResolvedConfigMutationPlugin(context, selectedPlugin, async ({ pluginId, source, plugin }, awHomeMutationToken) => {
+                const execute = async (selectedPlugin, selectedKey, inputValue) => withResolvedConfigMutationPlugin(context, selectedPlugin, async ({ pluginId, source, plugin }, awHomeMutationToken, catalogOperationContext) => {
                     if (!plugin.manifest.config?.schema) {
                         throw new Error(`configSchemaUnavailable: Plugin "${selectedPlugin}" does not declare an AW config schema.`);
                     }
@@ -1867,7 +2473,12 @@ export function buildProgram(options = {}) {
                         cwd: context.cwd,
                         env: context.env,
                         nativeCliRunner: context.nativeCliRunner,
-                        rebuildRuntime: { ...context, awHomeMutationToken },
+                        rebuildRuntime: {
+                            ...context,
+                            awHomeMutationToken,
+                            catalogOperationContext,
+                            expectedGenerationSetDigest: catalogOperationContext.generationSetDigest,
+                        },
                         awHomeMutationToken,
                         request: {
                             updates: { [selectedKey]: inputValue },
@@ -1875,7 +2486,7 @@ export function buildProgram(options = {}) {
                     });
                     return {
                         ok: writeReceipt.overallState === 'succeeded',
-                        receiptSchemaVersion: 4,
+                        receiptSchemaVersion: 5,
                         command: 'config:set',
                         ...writeReceipt,
                         plugin: plugin.manifest.name,
@@ -1993,7 +2604,7 @@ export function buildProgram(options = {}) {
             outcome = await runActionWithContext(context, async () => {
                 const scope = resolveConfigWriteScope(rawOptions.scope);
                 const projectLayer = resolveConfigProjectLayer(rawOptions);
-                const execute = async (selectedPlugin, selectedKey) => withResolvedConfigMutationPlugin(context, selectedPlugin, async ({ pluginId, source, plugin }, awHomeMutationToken) => {
+                const execute = async (selectedPlugin, selectedKey) => withResolvedConfigMutationPlugin(context, selectedPlugin, async ({ pluginId, source, plugin }, awHomeMutationToken, catalogOperationContext) => {
                     if (plugin.manifest.config?.schema && !plugin.manifest.config.schema[selectedKey]) {
                         throw new Error(`Unknown config key "${selectedKey}".`);
                     }
@@ -2017,7 +2628,12 @@ export function buildProgram(options = {}) {
                         cwd: context.cwd,
                         env: context.env,
                         nativeCliRunner: context.nativeCliRunner,
-                        rebuildRuntime: { ...context, awHomeMutationToken },
+                        rebuildRuntime: {
+                            ...context,
+                            awHomeMutationToken,
+                            catalogOperationContext,
+                            expectedGenerationSetDigest: catalogOperationContext.generationSetDigest,
+                        },
                         awHomeMutationToken,
                         request: {
                             removeKeys: [selectedKey],
@@ -2025,7 +2641,7 @@ export function buildProgram(options = {}) {
                     });
                     return {
                         ok: writeReceipt.overallState === 'succeeded',
-                        receiptSchemaVersion: 4,
+                        receiptSchemaVersion: 5,
                         command: 'config:unset',
                         ...writeReceipt,
                         plugin: plugin.manifest.name,
@@ -2122,7 +2738,7 @@ export function buildProgram(options = {}) {
                     if (!confirmed) {
                         throw new Error(`Reset requires confirmation. Re-run \`aw config reset ${selectedPlugin} -s ${selectedScope}${projectLayer === 'local' ? ' --local' : ''} --yes\` to delete this store.`);
                     }
-                    return withResolvedConfigMutationPlugin(context, selectedPlugin, async ({ pluginId, source, plugin }, awHomeMutationToken) => {
+                    return withResolvedConfigMutationPlugin(context, selectedPlugin, async ({ pluginId, source, plugin }, awHomeMutationToken, catalogOperationContext) => {
                         const affectedFields = await describeResetAffectedFields({
                             pluginName: plugin.manifest.name,
                             plugin,
@@ -2138,13 +2754,18 @@ export function buildProgram(options = {}) {
                             cwd: context.cwd,
                             env: context.env,
                             nativeCliRunner: context.nativeCliRunner,
-                            rebuildRuntime: { ...context, awHomeMutationToken },
+                            rebuildRuntime: {
+                                ...context,
+                                awHomeMutationToken,
+                                catalogOperationContext,
+                                expectedGenerationSetDigest: catalogOperationContext.generationSetDigest,
+                            },
                             awHomeMutationToken,
                             plugin,
                         });
                         return {
                             ok: resetReceipt.overallState === 'succeeded',
-                            receiptSchemaVersion: 4,
+                            receiptSchemaVersion: 5,
                             command: 'config:reset',
                             ...resetReceipt,
                             plugin: plugin.manifest.name,
@@ -2252,7 +2873,7 @@ export function buildProgram(options = {}) {
         .option('-j, --json', 'print status as JSON', false)
         .action(async (plugins, rawOptions) => {
         const context = createActionContext('status', rawOptions);
-        const result = await runActionWithContext(context, () => statusCommandV4({
+        const result = await runActionWithContext(context, () => statusCommandV6({
             plugins: plugins ?? [],
             cwd,
             env: context.env,
@@ -2295,10 +2916,17 @@ export async function runCli(argv, options = {}) {
         ...options.io,
     };
     const jsonAuthoringCommand = argv.includes('--json')
-        && ((argv[0] === 'catalog' && ['init', 'version', 'build', 'validate', 'status', 'publish'].includes(argv[1] ?? ''))
-            || (argv[0] === 'plugin' && ['build', 'test'].includes(argv[1] ?? '')))
+        && ((argv[0] === 'catalog' && ['init', 'context', 'version', 'build', 'validate', 'status', 'publish'].includes(argv[1] ?? ''))
+            || (argv[0] === 'plugin' && ['build', 'test', 'validate', 'status', 'remove'].includes(argv[1] ?? '')))
         ? `${argv[0]}:${argv[1]}`
         : null;
+    const jsonCatalogDevCommand = argv.includes('--json')
+        && argv[0] === 'catalog'
+        && argv[1] === 'dev'
+        && ['activate', 'status', 'deactivate'].includes(argv[2] ?? '')
+        ? argv[2]
+        : null;
+    const jsonWriteRequest = jsonWriteCommandRequest(argv);
     try {
         const authoringScriptByCommand = {
             init: 'init-plugin.mjs',
@@ -2306,7 +2934,6 @@ export async function runCli(argv, options = {}) {
             remove: 'remove-plugin.mjs',
             validate: 'validate-plugin.mjs',
             status: 'plugin-status.mjs',
-            'check-versions': 'check-plugin-versions.mjs',
         };
         const authoringScript = argv[0] === 'plugin'
             ? authoringScriptByCommand[argv[1] ?? '']
@@ -2315,16 +2942,52 @@ export async function runCli(argv, options = {}) {
                 : undefined;
         if (authoringScript && !argv.includes('--help') && !argv.includes('-h')) {
             const authoringArgs = argv.slice(2);
+            let authoringEnv = options.env ?? process.env;
             if (argv[0] === 'plugin'
-                && argv[1] === 'validate'
-                && !authoringArgs.some((token) => token === '--workspace-root' || token.startsWith('--workspace-root='))) {
-                authoringArgs.push('--workspace-root', options.cwd ?? process.cwd());
+                && !authoringArgs.some((token) => token === '--plugin-root' || token.startsWith('--plugin-root='))) {
+                let explicitRoot;
+                for (let index = 0; index < authoringArgs.length; index += 1) {
+                    const token = authoringArgs[index];
+                    if (token.startsWith('--workspace-root='))
+                        explicitRoot = token.slice('--workspace-root='.length);
+                    if (token === '--workspace-root')
+                        explicitRoot = authoringArgs[index + 1];
+                }
+                const originalCwd = options.cwd ?? process.cwd();
+                let discoveryCwd = originalCwd;
+                if (argv[1] === 'validate') {
+                    const valueOptions = new Set(['--workspace-root', '--claude-skill-profile', '--version-base']);
+                    for (let index = 0; index < authoringArgs.length; index += 1) {
+                        const token = authoringArgs[index];
+                        if (valueOptions.has(token)) {
+                            index += 1;
+                            continue;
+                        }
+                        if (!token.startsWith('-')) {
+                            discoveryCwd = path.resolve(originalCwd, token);
+                            authoringArgs[index] = discoveryCwd;
+                            break;
+                        }
+                    }
+                }
+                const workspace = await resolveCatalogWorkspaceRoot({
+                    cwd: discoveryCwd,
+                    ...(explicitRoot === undefined ? {} : { explicitRoot: path.resolve(options.cwd ?? process.cwd(), explicitRoot) }),
+                    mode: 'existing',
+                });
+                authoringEnv = {
+                    ...authoringEnv,
+                    AW_AUTHORING_WORKSPACE_ROOT: workspace.workspaceRoot,
+                    AW_AUTHORING_WORKSPACE_ROOT_RESOLVED_FROM: workspace.workspaceRootResolvedFrom,
+                };
+                if (explicitRoot === undefined)
+                    authoringArgs.push('--workspace-root', workspace.workspaceRoot);
             }
             return runAuthoringScript({
                 scriptName: authoringScript,
                 args: authoringArgs,
                 cwd: options.cwd ?? process.cwd(),
-                env: options.env ?? process.env,
+                env: authoringEnv,
                 io,
             });
         }
@@ -2333,7 +2996,7 @@ export async function runCli(argv, options = {}) {
             const message = 'option --subdir cannot be used with option --no-subdir';
             if (argv.includes('--json') && argv[0] === 'catalog' && argv[1] === 'source' && argv[2] === 'update') {
                 writeJsonReceipt(io.stdout, {
-                    receiptSchemaVersion: 4,
+                    receiptSchemaVersion: 5,
                     command: 'catalog:source:update',
                     ok: false,
                     changed: false,
@@ -2367,7 +3030,9 @@ export async function runCli(argv, options = {}) {
         }
         const program = buildProgram({
             ...options,
-            io,
+            io: jsonCatalogDevCommand || jsonWriteRequest
+                ? { ...io, stderr: () => undefined }
+                : io,
             diagnostics: {
                 ...options.diagnostics,
                 metadata: {
@@ -2380,6 +3045,78 @@ export async function runCli(argv, options = {}) {
         return program.__awCommandExitState?.exitCode ?? 0;
     }
     catch (error) {
+        if (jsonCatalogDevCommand) {
+            const workspaceRootIndex = argv.findIndex((token) => token === '--workspace-root');
+            const workspaceRootOption = argv.find((token) => token.startsWith('--workspace-root='));
+            const workspaceRoot = workspaceRootOption?.slice('--workspace-root='.length)
+                ?? (workspaceRootIndex >= 0 ? argv[workspaceRootIndex + 1] : undefined);
+            const sourceIdIndex = argv.findIndex((token) => token === '--source-id');
+            const sourceIdOption = argv.find((token) => token.startsWith('--source-id='));
+            const sourceId = sourceIdOption?.slice('--source-id='.length)
+                ?? (sourceIdIndex >= 0 ? argv[sourceIdIndex + 1] : undefined);
+            const failure = error instanceof CommanderError
+                ? { code: 'invalidArguments', message: error.message }
+                : catalogDevSourceError(error);
+            writeJsonReceipt(io.stdout, createCatalogDevFailureReceipt({
+                command: jsonCatalogDevCommand,
+                cwd: options.cwd ?? process.cwd(),
+                workspaceRoot,
+                sourceId,
+                ...failure,
+            }));
+            return 1;
+        }
+        if (jsonWriteRequest) {
+            writeCommandFailureReceipt(io.stdout, jsonWriteRequest, error);
+            return 1;
+        }
+        if (jsonAuthoringCommand && !(error instanceof CommanderError)) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (jsonAuthoringCommand === 'plugin:validate') {
+                writeJsonReceipt(io.stdout, {
+                    ok: false,
+                    profile: 'unknown',
+                    warnings: [],
+                    errors: [message],
+                });
+            }
+            else if (jsonAuthoringCommand === 'plugin:status') {
+                writeJsonReceipt(io.stdout, {
+                    schemaVersion: 3,
+                    policy: 'development',
+                    ok: false,
+                    base: null,
+                    requestedBase: null,
+                    baseCommit: null,
+                    checkedPlugins: 0,
+                    checks: [],
+                    workspaceRoot: null,
+                    workspaceRootResolvedFrom: null,
+                    errors: [{ code: 'workspaceResolutionFailed', message }],
+                });
+            }
+            else if (jsonAuthoringCommand === 'plugin:remove') {
+                writeJsonReceipt(io.stdout, {
+                    schemaVersion: 1,
+                    command: 'plugin:remove',
+                    ok: false,
+                    workspaceRoot: null,
+                    workspaceRootResolvedFrom: null,
+                    baseCommit: null,
+                    plugin: null,
+                    removed: false,
+                    errors: [{ code: 'workspaceResolutionFailed', message }],
+                });
+            }
+            else {
+                writeJsonReceipt(io.stdout, {
+                    command: jsonAuthoringCommand,
+                    ok: false,
+                    errors: [{ code: 'workspaceResolutionFailed', message }],
+                });
+            }
+            return 1;
+        }
         if (jsonAuthoringCommand && error instanceof CommanderError) {
             writeJsonReceipt(io.stdout, {
                 command: jsonAuthoringCommand,