@entrorove/skill 0.1.2 → 0.1.21

package/AGREEMENT.md

@@ -1,33 +1,34 @@
-# Entrorove 使用、隐私与广告信息协议
+# entrorove 使用、隐私与广告信息协议
 
-版本：2026-09-29
+版本：2026-10-02.1
 
-本协议是首次使用 Entrorove 技能时的合并告知与使用条款。只有用户明确选择“同意”后，技能请求才会发送。IDE 的“完全访问”权限只是本地权限，不代表同意本协议。
+本协议是首次使用 entrorove 技能时的合并告知与使用条款。只有用户明确选择“同意”后，技能请求才会发送。IDE 的“完全访问”权限只是本地权限，不代表同意本协议。
 
 ## 1. 技能与权限
 
-- Entrorove 会按用户与 IDE 明确提供的任务、上下文和权限辅助分析、修改代码及运行检查。
+- entrorove 会按用户与 IDE 明确提供的任务、上下文和权限辅助分析、修改代码及运行检查。
 - 高权限操作可能修改或删除文件、运行命令或调用外部服务。用户应检查范围、保留备份，并对有重大后果的操作单独确认。
 - 本协议不扩大 IDE 已授予的权限，也不替代具体高风险操作所需的单独确认。
 
 ## 2. 隐私与数据
 
-- 安装包不会因安装本身自动扫描或上传项目文件。只有在发起技能调用时，才会向 Entrorove API 发送 IDE 明确组装的请求负载。
+- 安装包不会因安装本身自动扫描或上传项目文件。只有在发起技能调用时，才会向 entrorove API 发送 IDE 明确组装的请求负载。
 - 账号服务会处理登录邮箱、密钥哈希与前缀、加密保存的完整密钥、会话与安全记录、调用时间/数量，以及用户自愿提交的留言。已登录用户可再次复制自己的完整密钥。
-- 当前实现不将项目源文件或技能任务负载写入业务数据库，不使用个人信息决定广告展示，不出售个人信息。
+- 用户主动提交并明确同意公开的 IDE 评价会展示 IDE 名称、评分、评价文字和时间；公开列表最多展示最近 30 条。
+- 当前实现不将项目源文件或技能任务负载写入业务数据库，不出售个人信息。推广选择使用密钥的连续调用时长和调用次数判断展示时机，不分析项目内容或建立跨站画像。
 - 本地同意回执仅保存协议版本、同意结果和时间，不包含邮箱、项目内容或密钥。
 
 ## 3. 消息与广告
 
 - 在长时间任务的“请勿关闭”提示下，服务可按后台配置追加一条带 HTTPS 链接的消息。
 - 商业内容以后台配置的分类标签显示为 `【分类】`，不伪装成执行结果、系统警告或独立推荐。
-- 推广仅在配置的有效期内按权重随机展示；多条推广的权重共同决定展示概率及选择频率。选择不使用用户画像、项目内容或个人信息。
+- 推广仅在配置的有效期和任务使用时段内展示。后台可设置候选权重与概率范围；服务根据同一密钥的连续调用时长及次数调整概率，不分析任务文本或项目文件。
 - 广告链接指向第三方时，第三方的内容、隐私与条款由其自行负责。
 
 ## 4. 风险与责任限制
 
 - 技能按现状提供，不保证所有结果均正确、完整、不中断或适合特定目的。用户应在合并、发布或用于生产前审查修改并运行适当检查。
-- 在适用法律允许的最大范围内，Entrorove 不承担因使用或无法使用技能导致的间接、附带、特殊或后果性损失。
+- 在适用法律允许的最大范围内，entrorove 不承担因使用或无法使用技能导致的间接、附带、特殊或后果性损失。
 - 上述限制不排除法律不允许排除的责任，也不限制欺诈、故意不当行为或适用法律规定的强制性消费者权利。
 
 ## 5. 同意、拒绝与更新
@@ -38,14 +39,15 @@
 
 ---
 
-# Entrorove Terms, Privacy and Advertising Notice
+# entrorove Terms, Privacy and Advertising Notice
 
-Version: 2026-09-29
+Version: 2026-10-02.1
 
 This combined notice applies on first use. A skill request is sent only after an explicit **Accept** choice. Granting an IDE “full access” permission does not accept this agreement.
 
-- **Use and access.** Entrorove acts only on tasks, context and permissions supplied by the user and IDE. Elevated permissions may permit file changes, command execution and external calls. Review scope, keep backups and separately confirm consequential actions.
-- **Data.** Installation alone does not scan or upload project files. The account service processes login email, key hashes and prefixes, an encrypted copy of the full key that a signed-in user can copy again, sessions and security records, invocation time/count, and messages submitted voluntarily. Skill request payloads are received for execution; the current implementation does not store project source files or task payloads in its business database. It does not sell personal information or use personal information to select ads.
-- **Advertising.** A configured message may appear beneath a long-running-task notice. Commercial content carries its configured category label as `【Category】`, includes an HTTPS link, and is selected by the weights of eligible messages without profiling or targeting. Third-party links are governed by their operators.
-- **Risk.** The skill is provided as available without a guarantee that every result is correct, complete, uninterrupted or fit for a particular purpose. Review and test changes before production use. To the maximum extent permitted by applicable law, Entrorove excludes indirect, incidental, special and consequential losses. Nothing excludes non-waivable liability, fraud, wilful misconduct or mandatory consumer rights.
+- **Use and access.** entrorove acts only on tasks, context and permissions supplied by the user and IDE. Elevated permissions may permit file changes, command execution and external calls. Review scope, keep backups and separately confirm consequential actions.
+- **Data.** Installation alone does not scan or upload project files. The account service processes login email, key hashes and prefixes, an encrypted copy of the full key that a signed-in user can copy again, sessions and security records, invocation time/count, and messages submitted voluntarily. Skill request payloads are received for execution; the current implementation does not store project source files or task payloads in its business database. It does not sell personal information. Promotion timing uses consecutive invocation duration and count for the same key, without examining project content or building a cross-site profile.
+- **Public reviews.** An IDE review is published only after the user submits it and explicitly consents to public display; the public list may show the IDE name, rating, review text and timestamp, limited to the latest 30 entries.
+- **Advertising.** A configured message may appear beneath a long-running-task notice. Commercial content carries its configured category label as `【Category】` and includes an HTTPS link. Administrators set active dates, task-duration windows, selection weights and probability bounds. The service adjusts display probability using consecutive invocation duration and count, without inspecting task text or project files. Third-party links are governed by their operators.
+- **Risk.** The skill is provided as available without a guarantee that every result is correct, complete, uninterrupted or fit for a particular purpose. Review and test changes before production use. To the maximum extent permitted by applicable law, entrorove excludes indirect, incidental, special and consequential losses. Nothing excludes non-waivable liability, fraud, wilful misconduct or mandatory consumer rights.
 - **Choice.** Declining prevents the skill request from being sent. Material changes require a new explicit acceptance. Mandatory local laws may provide additional rights. Qualified counsel should review this notice before production release for the actual operating and user jurisdictions.

package/CHANGELOG.md

@@ -0,0 +1,101 @@
+# Changelog
+
+## 0.1.21 — 2026-10-04
+
+- 更新了本地执行闸门与预算。
+- Updated local execution gates and budgets.
+
+## 0.1.20 — 2026-10-04
+
+- 更新了本地状态并发锁、本地执行闸门与预算、执行与链路台账。
+- Updated local state concurrency lock, local execution gates and budgets, execution and chain ledger.
+
+## 0.1.19 — 2026-10-04
+
+- 更新了安装包配置、自动版本与更新日志、本地状态并发锁、本地执行闸门与预算、预算续期确认、本地任务路由。
+- Updated package configuration, automatic versioning and changelog, local state concurrency lock, local execution gates and budgets, budget renewal confirmation, local task routing.
+
+## 0.1.18 — 2026-10-04
+
+- 更新了冻结计划执行器。
+- Updated frozen plan runner.
+
+## 0.1.17 — 2026-10-04
+
+- 更新了本地执行命令、冻结计划执行器。
+- Updated local execution command, frozen plan runner.
+
+## 0.1.16 — 2026-10-04
+
+- 更新了远端恢复客户端。
+- Updated remote recovery client.
+
+## 0.1.15 — 2026-10-04
+
+- 更新了IDE 工作流程说明。
+- Updated IDE workflow instructions.
+
+## 0.1.14 — 2026-10-02
+
+- 更新了本地执行闸门与预算。
+- Updated local execution gates and budgets.
+
+## 0.1.13 — 2026-10-02
+
+- 更新了执行与链路台账、预算续期确认、本地任务路由。
+- Updated execution and chain ledger, budget renewal confirmation, local task routing.
+
+## 0.1.12 — 2026-10-02
+
+- 更新了远端恢复客户端。
+- Updated remote recovery client.
+
+## 0.1.11 — 2026-10-02
+
+- 更新了本地执行闸门与预算。
+- Updated local execution gates and budgets.
+
+## 0.1.10 — 2026-10-02
+
+- 更新了本地执行闸门与预算。
+- Updated local execution gates and budgets.
+
+## 0.1.9 — 2026-10-02
+
+- 更新了自动版本与更新日志、本地执行闸门与预算、证据与回执验签、执行与链路台账、冻结计划执行器。
+- Updated automatic versioning and changelog, local execution gates and budgets, evidence and receipt verification, execution and chain ledger, frozen plan runner.
+
+## 0.1.8 — 2026-10-02
+
+- 恢复本地执行层与质量闭环：快照隔离、签名写入、预算、协作、验证回执、公式和任务路由。
+- Restored the local execution and quality workflow: snapshots, signed writes, budgets, coordination, receipts, formulas, and task routing.
+
+## 0.1.7 — 2026-10-02
+
+- 恢复统一技能全集、本地执行层与安全复制流程。
+- Restored the complete unified skill set, local execution layer, and secure copy flow.
+
+## 0.1.6 — 2026-09-29
+
+- 配置密钥前检查凭据目录，拒绝符号链接目录，避免密钥写入非预期位置。
+- Reject symlinked credential directories before writing a key to prevent storage at an unintended location.
+
+## 0.1.5 — 2026-09-29
+
+- 发布前自动检测安装包、技能说明与清单变更，递增版本并同步更新日志；凭据继续跨升级留存。
+- Automatically detect package, skill instruction, and manifest changes before publishing, increment the version, and update release notes while retaining credentials across upgrades.
+
+## 0.1.4 — 2026-09-29
+
+- 品牌展示统一为小写 entrorove，保留原有密钥存储路径以确保升级不丢失凭据。
+- Standardized the displayed brand as lowercase entrorove while preserving existing credential storage paths across upgrades.
+
+## 0.1.3 — 2026-09-29
+
+- 安装后密钥持久留存；升级时只保留一个受管技能并阻止旧版覆盖，同时明确说明按连续使用时长与调用次数调整推广概率。
+- Keep the key across upgrades, preserve one managed skill and reject downgrades, and disclose usage-based promotion timing.
+
+## 0.1.2 — 2026-09-29
+
+- 已加入统一技能安装、持久化账号密钥和首次使用确认。
+- Added the unified skill installer, persistent account key, and explicit first-use agreement.

package/SKILL.md

@@ -5,19 +5,19 @@ description: An engineering skill that understands a task, chooses a fitting wor
 
 # entrorove · 熵巡
 
-Version: 0.1.2.
+Version: 0.1.21.
 
 Read the user's goal and repository instructions first. Preserve the original task through planning, execution and verification. Use the workflow only where it helps; a small, low-risk edit can proceed directly. Never claim a reported step is a verified result.
 
-Install or update the managed copy with `npx @entrorove/skill install`. The installer removes only pristine duplicate entrorove installations and preserves unmanaged files.
+Install or update the managed copy with `npx @entrorove/skill install`. The installer keeps one global managed entrorove skill, replaces its older pristine version, removes only pristine duplicate installations, and preserves hand-edited files. An older package cannot overwrite a newer managed version.
 
-Register or sign in by email at https://entrorove.com. Enter the account key with `npx @entrorove/skill configure` and `{"token":"..."}` on standard input. Never place it in arguments, URLs, project files or logs. Entrorove accounts and keys are independent of other services.
+Register or sign in by email at https://entrorove.com. Enter the account key once with `npx @entrorove/skill configure` and `{"token":"..."}` on standard input. The credential persists in the current OS user's restricted local store across skill upgrades. Before asking again, use the stored credential; a missing or invalid credential must be reported explicitly. Never place the key in arguments, URLs, project files or logs. entrorove accounts and keys are independent of other services.
 
-On first use, the CLI returns a Confirm Protocol-compatible agreement interaction. Render it with the IDE's native confirmation UI, or show its `chatFallback` text when no adapter exists. The user must explicitly accept with `npx @entrorove/skill agreement` and JSON `{"version":"2026-09-29","answer":"accept"}` on standard input before retrying the skill request. A full-access IDE permission never counts as agreement acceptance. The combined terms, privacy and advertising notice is installed as `AGREEMENT.md`.
+On first use or after a material agreement revision, the CLI returns a Confirm Protocol-compatible agreement interaction. Render it with the IDE's native confirmation UI, or show its `chatFallback` text when no adapter exists. The user must explicitly accept with `npx @entrorove/skill agreement` and JSON `{"version":"2026-10-02.1","answer":"accept"}` on standard input before retrying the skill request. A full-access IDE permission never counts as agreement acceptance. The combined terms, privacy and advertising notice is installed as `AGREEMENT.md`.
 
 ## Work with a task
 
-Send JSON on standard input to `npx @entrorove/skill invoke`. Start with `operation: "start"` and an `input.task` containing the goal, work type, risk, difficulty and observed scope facts. Work types are `implementation`, `documentation`, `calculation`, `merge`, `review` and `decision`. Assess facts from the real task and repository; do not invent certainty. Entrorove chooses the workflow. A small task may return `decision: "direct"`, meaning the IDE should do the work without another service call.
+Send JSON on standard input to `npx @entrorove/skill invoke`. Call `operation: "capabilities"` with `{}` first when an adapter needs the live operation and schema list. Adapters that expose the four-step task route can call `task-describe`, `message-route`, `message-accept` and `task-resume` in order; `start` remains the one-call workflow equivalent. Then start with `operation: "start"` and an `input.task` containing the goal, work type, risk, difficulty and observed scope facts. Work types are `implementation`, `documentation`, `calculation`, `merge`, `review`, `decision` and `diagnosis`. Assess facts from the real task and repository; do not invent certainty. entrorove chooses the workflow. A small task may return `decision: "direct"`, meaning the IDE should do the work without another service call. The public envelope is `entrorove.skill.request/2.0`; `requestId` is the SHA-256 digest of `operation + canonical(input)`. Version 1.0 remains accepted for older callers.
 
 ```json
 {"operation":"start","input":{"task":{"goal":"Update the checkout flow and verify it","workType":"implementation","risk":"medium","difficulty":"medium","crossModule":true,"parallel":false,"unclear":false,"architectureContract":false}}}
@@ -25,8 +25,12 @@ Send JSON on standard input to `npx @entrorove/skill invoke`. Start with `operat
 
 For a returned `flowId`, continue with `{"operation":"continue","input":{"flowId":"<returned ID>","operation":"<next operation>","payload":{}}}`. Fill `payload` with the next operation's required input. Keep the same task and evidence in the IDE. For later work, `input.task.phase` may be `plan`, `coordinate`, `architecture`, `verify`, `merge` or `decision`; it remains the same skill entry point. Never treat an unknown request outcome as permission to retry a paid or mutating action; query the original request ID when the workflow supports it.
 
+The v2 progress sequence is durable and ordered: the first runtime step reports `intake`, then the applicability `gate` is recorded and verified, then the selected contract or plan steps run. Every step can be `pending`, `running`, `reported`, `verified`, `blocked` or `failed`; only a completed verdict with trusted evidence is green.
+
 For a decision, include `input.task.interaction` with `type` (`confirm`, `choice`, `multi` or `input`), a `question`, `options` (two or more with unique `id` and `label`, or an empty array for input), and a `callback` containing its `operation` and `payload`. Medium- and high-risk decisions also need a `riskDescription`. The decision waits for an explicit answer; it never chooses a default on timeout.
 
-The live API and install package must be deployed and published before this command works outside the local checkout.
+Use `npx @entrorove/skill status <requestId>` after a connection loss. It performs a read-only GET lookup and never resends a POST. Use `npx @entrorove/skill flows` to list recoverable flow steps. A v2 flow has its own `flowId` and progresses through `pending`, `running`, `reported`, `verified`, `blocked` or `failed`; a reported result is not a verified result.
+
+The local execution layer is available through `npx @entrorove/skill local <operation> [repositoryRoot]` with a JSON object on standard input. `local capabilities` lists the complete contract. Operations include `snapshot-plan`, `snapshot-verify`, `mutate-gate`, `gate-issue`, `gate-verify`, `guarded-write`, `budget-init`, `budget-context`, `budget-read`, `budget-status`, `budget-extend`, budget renewal confirmation, `peer-coordinate`, `spawn-bind`, `peer-complete`, `lease-verify`, `probe`, `reassess`, execution ledger and virtual branch records, `chain-init`, `chain-resume`, `chain-status`, `chain-answer`, `evidence-sign`, `evidence-verify`, `merge-verified`, `rollback`, `formula-evaluate`, `formula-graph`, `formula-final-gate`, `run-approved-plan` and `final-gate`. State is kept only under `~/.entrorove/`; snapshots never create Git branches or worktrees. Guarded writes require a short-lived Ed25519 pass bound to the flow, step, snapshot digest and path set. Local evidence uses `entrorove.test-evidence/2.0`; unsigned local evidence remains incomplete and verified delivery requires a trusted receipt. Approved plan execution requires a frozen plan, matching approval and unchanged files; without a configured runner signer it reports local evidence as incomplete.
 
-When the user gives an actual evaluation after using the skill, offer to publish that feedback. Only after they explicitly agree to public display, send their own words, IDE name and 1–5 rating as JSON on standard input to `npx @entrorove/skill review` with `publicConsent: true`. Never invent, rewrite or infer a review from task completion. The website reads accepted reviews directly from Entrorove's independent database.
+When the user gives an actual evaluation after using the skill, offer to publish that feedback. Only after they explicitly agree to public display, send their own words, IDE name and 1–5 rating as JSON on standard input to `npx @entrorove/skill review` with `publicConsent: true`. Never invent, rewrite or infer a review from task completion. The website reads accepted reviews directly from entrorove's independent database.

package/cli.mjs

@@ -5,24 +5,25 @@ import { promises as fs, realpathSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-
+import { compareVersions } from './version.mjs';
+import { runLocal } from './local-cli.mjs';
+import { apiUrl, buildInvocation, invokeRemote, queryFlows, queryStatus } from './remote-client.mjs';
 const packageDir = path.dirname(fileURLToPath(import.meta.url));
-const apiUrl = 'https://entrorove.com/api/skill/invoke';
 const reviewUrl = 'https://entrorove.com/api/ide-reviews';
 const markerName = '.entrorove-managed.json';
 const installFiles = ['SKILL.md', 'AGREEMENT.md', 'manifest.json'];
 const markerSchema = 'entrorove.managed-install/1.0';
 const credentialSchema = 'entrorove.credential/1.0';
 const agreementSchema = 'entrorove.agreement-acceptance/1.0';
-const invocationTimeoutMs = 135_000;
 const installLockWaitMs = 10_000;
 const installLockStaleMs = 120_000;
-export const agreementVersion = '2026-09-29';
+export const agreementVersion = '2026-10-02.1';
 
 function sha256(content) {
   return createHash('sha256').update(content).digest('hex');
 }
 
+
 async function readJson(file) {
   const value = JSON.parse(await fs.readFile(file, 'utf8'));
   if (!value || typeof value !== 'object' || Array.isArray(value)) {
@@ -37,7 +38,7 @@ async function sourceBundle() {
   if (manifest.schemaVersion !== 'entrorove.skill-manifest/1.0'
     || manifest.name !== 'entrorove'
     || manifest.endpoint !== 'https://entrorove.com'
-    || manifest.requestSchemaVersion !== 'entrorove.skill.request/1.0'
+    || !['entrorove.skill.request/1.0', 'entrorove.skill.request/2.0'].includes(manifest.requestSchemaVersion)
     || !/^\d+\.\d+\.\d+$/.test(manifest.version)
     || packageMetadata.name !== '@entrorove/skill'
     || packageMetadata.version !== manifest.version) {
@@ -48,7 +49,7 @@ async function sourceBundle() {
     content.set(name, await fs.readFile(path.join(packageDir, name)));
   }
   if (!content.get('SKILL.md').toString('utf8').includes(`Version: ${manifest.version}.`)) {
-    throw new Error('Entrorove skill instructions have a mismatched version');
+    throw new Error('entrorove skill instructions have a mismatched version');
   }
   const hashes = Object.fromEntries(installFiles.map((name) => [name, sha256(content.get(name))]));
   return { manifest, content, hashes };
@@ -79,7 +80,7 @@ export function agreementInteraction() {
     schemaVersion: 'confirm.interaction/1.0',
     requestId: `entrorove-agreement-${agreementVersion}`,
     type: 'confirm',
-    question: `首次使用前，请阅读 Entrorove 使用、隐私与广告信息协议（${agreementVersion}）。是否同意？`,
+    question: `首次使用前，请阅读 entrorove 使用、隐私与广告信息协议（${agreementVersion}）。是否同意？`,
     options: [
       { id: 'accept', label: '同意', hint: '记录本地回执并允许后续技能调用' },
       { id: 'decline', label: '不同意', hint: '不发送技能请求' },
@@ -104,7 +105,7 @@ function agreementRequired(home) {
     agreement,
     interaction: agreementInteraction(),
     chatFallback: [
-      `Entrorove 首次使用确认（${agreementVersion}）`,
+      `entrorove 首次使用确认（${agreementVersion}）`,
       `请先阅读：${agreement}`,
       '1. accept — 同意并继续',
       '2. decline — 不同意，不发送请求',
@@ -168,7 +169,7 @@ async function removeStaleInstallLock(lock) {
   const state = await statOrNull(lock);
   if (!state) return true;
   if (!state.isDirectory() || state.isSymbolicLink()) {
-    throw new Error('Entrorove install lock is not a directory');
+    throw new Error('entrorove install lock is not a directory');
   }
   if (Date.now() - state.mtimeMs < installLockStaleMs) return false;
   let owner;
@@ -195,7 +196,7 @@ async function removeStaleInstallLock(lock) {
   const moved = await fs.lstat(quarantine);
   if (moved.ino !== state.ino || moved.dev !== state.dev) {
     await fs.rename(quarantine, lock);
-    throw new Error('Entrorove install lock changed during stale recovery');
+    throw new Error('entrorove install lock changed during stale recovery');
   }
   await fs.rm(quarantine, { recursive: true });
   return true;
@@ -211,7 +212,7 @@ async function withInstallLock(parent, action) {
     } catch (error) {
       if (error.code !== 'EEXIST') throw error;
       if (await removeStaleInstallLock(lock)) continue;
-      if (Date.now() >= deadline) throw new Error('Entrorove install is busy');
+      if (Date.now() >= deadline) throw new Error('entrorove install is busy');
       await new Promise(resolve => setTimeout(resolve, 100));
     }
   }
@@ -229,6 +230,9 @@ async function updateGlobalInstall(target, bundle) {
   await fs.mkdir(parent, { recursive: true, mode: 0o700 });
   const previous = await managedState(target);
   if (previous === false) throw new Error('Global entrorove skill is not pristine and managed; refusing overwrite');
+  if (previous && compareVersions(previous.version, bundle.manifest.version) > 0) {
+    throw new Error('A newer managed entrorove skill is installed; use the latest package');
+  }
   if (previous?.version === bundle.manifest.version
     && installFiles.every((name) => previous.files[name] === bundle.hashes[name])) return false;
   const stage = path.join(parent, `.entrorove-stage-${randomUUID()}`);
@@ -314,14 +318,20 @@ async function stdinJson() {
   return value;
 }
 
+async function preparePrivateDirectory(parent) {
+  await fs.mkdir(parent, { recursive: true, mode: 0o700 });
+  const state = await fs.lstat(parent);
+  if (!state.isDirectory() || state.isSymbolicLink()) throw new Error('Credential directory must be a real directory');
+  if (process.platform !== 'win32') await fs.chmod(parent, 0o700);
+}
+
 async function writeCredential(token, home) {
-  if (typeof token !== 'string' || !/^ent_[A-Za-z0-9_-]{16,256}$/.test(token)) {
+  if (typeof token !== 'string' || !/^ent_[A-Za-z0-9_-]{43}$/.test(token)) {
     throw new Error('Invalid entrorove key');
   }
   const file = credentialPath(home);
   const parent = path.dirname(file);
-  await fs.mkdir(parent, { recursive: true, mode: 0o700 });
-  if (process.platform !== 'win32') await fs.chmod(parent, 0o700);
+  await preparePrivateDirectory(parent);
   const existing = await statOrNull(file);
   if (existing && (!existing.isFile() || existing.isSymbolicLink())) throw new Error('Credential path is not a regular file');
   const stage = path.join(parent, `.credential-${randomUUID()}.tmp`);
@@ -343,7 +353,7 @@ async function readCredential(home) {
   if (process.platform !== 'win32' && (stat.mode & 0o077) !== 0) throw new Error('Credential permissions must be 0600');
   const data = await readJson(file);
   if (data.schemaVersion !== credentialSchema || typeof data.token !== 'string'
-    || !/^ent_[A-Za-z0-9_-]{16,256}$/.test(data.token)) throw new Error('Invalid credential file');
+    || !/^ent_[A-Za-z0-9_-]{43}$/.test(data.token)) throw new Error('Invalid credential file');
   return data.token;
 }
 
@@ -369,8 +379,7 @@ async function writeAgreementAcceptance(data, home) {
   if (data.answer === 'decline') return false;
   const file = agreementPath(home);
   const parent = path.dirname(file);
-  await fs.mkdir(parent, { recursive: true, mode: 0o700 });
-  if (process.platform !== 'win32') await fs.chmod(parent, 0o700);
+  await preparePrivateDirectory(parent);
   const existing = await statOrNull(file);
   if (existing && (!existing.isFile() || existing.isSymbolicLink())) {
     throw new Error('Agreement path is not a regular file');
@@ -387,43 +396,17 @@ async function writeAgreementAcceptance(data, home) {
   return true;
 }
 
-export function buildInvocation(operation, input) {
-  if (operation !== 'start' && operation !== 'continue') throw new Error('Invalid entrorove operation');
-  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Input must be a JSON object');
-  const requestId = randomUUID();
-  return { url: apiUrl, requestId, body: { schemaVersion: 'entrorove.skill.request/1.0', requestId, operation, input } };
+export { buildInvocation };
+
+function remoteDependencies() {
+  return {
+    install, agreementAccepted, agreementRequired, readCredential, home: os.homedir(),
+    apiOrigin: () => new URL(apiUrl).origin,
+  };
 }
 
 async function invoke(data) {
-  await install();
-  if (!await agreementAccepted(os.homedir())) {
-    process.stdout.write(JSON.stringify(agreementRequired(os.homedir())) + '\n');
-    process.exitCode = 2;
-    return;
-  }
-  const call = buildInvocation(data.operation, data.input);
-  const token = await readCredential(os.homedir());
-  let response;
-  try {
-    response = await fetch(call.url, {
-      method: 'POST', redirect: 'error', signal: AbortSignal.timeout(invocationTimeoutMs),
-      headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
-      body: JSON.stringify(call.body),
-    });
-  } catch {
-    throw new Error(`Invocation outcome is unknown; requestId=${call.requestId}. Do not automatically resend this request.`);
-  }
-  if (!response.ok) throw new Error(`entrorove invocation failed: HTTP ${response.status}; requestId=${call.requestId}`);
-  let result;
-  try {
-    result = await response.json();
-  } catch {
-    throw new Error(`Invocation outcome is unknown; requestId=${call.requestId}. Do not automatically resend this request.`);
-  }
-  if (result?.ok !== true || result.output?.requestId !== call.requestId) {
-    throw new Error(`Invalid entrorove response; requestId=${call.requestId}`);
-  }
-  process.stdout.write(JSON.stringify(result) + '\n');
+  return invokeRemote(data, remoteDependencies());
 }
 
 export function buildReview(data) {
@@ -477,11 +460,28 @@ async function main() {
     await invoke(await stdinJson());
   } else if (command === 'review' && args.length === 0) {
     await submitReview(await stdinJson());
+  } else if (command === 'status' && args.length === 1) {
+    await install();
+    if (!await agreementAccepted(os.homedir())) {
+      process.stdout.write(JSON.stringify(agreementRequired(os.homedir())) + '\n');
+      process.exitCode = 2;
+      return;
+    }
+    await queryStatus(args[0], remoteDependencies());
+  } else if (command === 'flows' && args.length === 0) {
+    await install();
+    if (!await agreementAccepted(os.homedir())) {
+      process.stdout.write(JSON.stringify(agreementRequired(os.homedir())) + '\n');
+      process.exitCode = 2;
+      return;
+    }
+    await queryFlows(remoteDependencies());
+  } else if (command === 'local') {
+    await runLocal(args);
   } else {
-    throw new Error('Usage: entrorove install | configure | agreement | invoke | review (JSON on stdin)');
+    throw new Error('Usage: entrorove install | configure | agreement | invoke | status <requestId> | flows | review | local (JSON on stdin)');
   }
 }
-
 if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
   main().catch((error) => {
     process.stderr.write(`${error.message}\n`);

package/local-approved-plan.mjs

@@ -0,0 +1,81 @@
+import { createHash, createPrivateKey, createPublicKey, randomUUID, sign } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { promises as fs, constants } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { performance } from 'node:perf_hooks';
+
+export const RUNNER_SCHEMA = 'entrorove.validator-local-runner/1.0';
+export const PLAN_SCHEMA = 'validator.execution-plan/1.0';
+export const APPROVAL_SCHEMA = 'validator.runner-approval/1.0';
+export const SIGNER_SCHEMA = 'validator.runner-signer/1.0';
+export const RECEIPT_SCHEMA = 'validator.execution-receipt/1.0';
+export const RUNNER_LIMITS = Object.freeze({ maxFiles: 512, maxFileBytes: 16 * 1024 * 1024, maxControlBytes: 1024 * 1024, maxExecutableBytes: 256 * 1024 * 1024, maxTimeoutMs: 300_000, maxOutputBytes: 1024 * 1024, maxApprovalLifetimeMs: 86_400_000, maxReceiptLifetimeMs: 600_000 });
+const SHA256 = /^[0-9a-f]{64}$/; const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/; const ENV = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function fail(code, message) { const error = new Error(message); error.code = code; throw error; }
+function digest(value) { return createHash('sha256').update(value).digest('hex'); }
+function canonical(value) { if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`; if (value && typeof value === 'object') return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`; return JSON.stringify(value); }
+function safeRelative(value, label = 'path') { if (typeof value !== 'string' || !value || value !== value.normalize('NFC') || path.isAbsolute(value) || /^[A-Za-z]:/.test(value) || value.includes('\\') || /[\u0000-\u001f\u007f]/.test(value) || value.split('/').some(part => !part || part === '.' || part === '..')) fail('ENTROROVE_PATH_UNSAFE', `${label} must be a normalized relative path`); return value; }
+function inside(root, target, label) { const relative = path.relative(root, target); if (relative === '' || (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`))) return; fail('ENTROROVE_PATH_ESCAPE', `${label} escapes repositoryRoot`); }
+async function rootOf(value) { if (typeof value !== 'string' || !path.isAbsolute(value)) fail('ENTROROVE_ROOT_INVALID', 'repositoryRoot must be absolute'); const stat = await fs.lstat(value); if (!stat.isDirectory() || stat.isSymbolicLink()) fail('ENTROROVE_ROOT_INVALID', 'repositoryRoot must be a real directory'); return fs.realpath(value); }
+async function regular(file, max, privateFile = false) { const stat = await fs.lstat(file); if (!stat.isFile() || stat.isSymbolicLink() || stat.size > max) fail('ENTROROVE_FILE_INVALID', 'control file must be a bounded regular file'); if (privateFile && process.platform !== 'win32' && ((typeof process.getuid === 'function' && stat.uid !== process.getuid()) || (stat.mode & 0o777) !== 0o600 || stat.nlink !== 1)) fail('ENTROROVE_CONTROL_PERMISSIONS', 'control file must be owned and mode 0600'); return { bytes: await fs.readFile(file), sha256: digest(await fs.readFile(file)) }; }
+async function projectFile(root, relative) { const safe = safeRelative(relative); const target = path.resolve(root, ...safe.split('/')); inside(root, target, safe); const stat = await fs.lstat(target); if (!stat.isFile() || stat.isSymbolicLink() || await fs.realpath(target) !== target) fail('ENTROROVE_FILE_INVALID', `${safe} must be a regular file`); return { path: safe, target, stat, ...(await regular(target, RUNNER_LIMITS.maxFileBytes)) }; }
+async function externalFile(root, value, label) { if (typeof value !== 'string' || !path.isAbsolute(value)) fail('ENTROROVE_CONTROL_PATH', `${label} must be an absolute path`); const entry = await fs.lstat(value); if (!entry.isFile() || entry.isSymbolicLink()) fail('ENTROROVE_CONTROL_FILE', `${label} must be a regular non-symlink file`); const target = await fs.realpath(value); const relative = path.relative(root, target); if (relative === '' || (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`))) fail('ENTROROVE_PATH_ESCAPE', `${label} must be outside repositoryRoot`); return { path: target, ...(await regular(target, RUNNER_LIMITS.maxControlBytes, true)) }; }
+function exactObject(value, fields, label) { if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).sort().join('|') !== [...fields].sort().join('|')) fail('ENTROROVE_PLAN_FIELDS', `${label} has invalid fields`); return value; }
+function boundedInt(value, max, label) { if (!Number.isSafeInteger(value) || value <= 0 || value > max) fail('ENTROROVE_LIMIT_INVALID', `${label} must be a positive bounded integer`); }
+function planArtifact(files) { return digest(canonical(files)); }
+
+function validatePlan(plan) {
+  exactObject(plan, ['schemaVersion', 'frozen', 'planId', 'validationRunId', 'memberId', 'chainId', 'artifactSha256', 'files', 'tests', 'policy', 'goldenBaseline', 'contracts'], 'execution plan');
+  if (plan.schemaVersion !== PLAN_SCHEMA || plan.frozen !== true || !ID.test(plan.planId) || !ID.test(plan.validationRunId) || !ID.test(plan.memberId) || !ID.test(plan.chainId) || !SHA256.test(plan.artifactSha256) || !Array.isArray(plan.files) || plan.files.length === 0 || plan.files.length > RUNNER_LIMITS.maxFiles) fail('ENTROROVE_PLAN_INVALID', 'plan must be frozen and bounded');
+  for (let i = 0; i < plan.files.length; i += 1) { const file = exactObject(plan.files[i], ['path', 'sha256'], 'manifest entry'); safeRelative(file.path); if (!SHA256.test(file.sha256) || (i > 0 && plan.files[i - 1].path >= file.path)) fail('ENTROROVE_PLAN_MANIFEST', 'manifest paths must be sorted and unique'); }
+  if (planArtifact(plan.files) !== plan.artifactSha256) fail('ENTROROVE_PLAN_MANIFEST', 'artifact manifest digest mismatch');
+  const policy = exactObject(plan.policy, ['executable', 'executableSha256', 'args', 'environment', 'timeoutMs', 'maxOutputBytes', 'requiredExitCode'], 'execution policy');
+  if (typeof policy.executable !== 'string' || !path.isAbsolute(policy.executable) || !SHA256.test(policy.executableSha256) || !Array.isArray(policy.args) || policy.args.length > 128 || policy.args.some(value => typeof value !== 'string' || value.includes('\0') || value.length > 4096)) fail('ENTROROVE_POLICY_INVALID', 'executable and args are invalid');
+  if (!policy.environment || typeof policy.environment !== 'object' || Array.isArray(policy.environment) || Object.keys(policy.environment).length > 64 || Object.entries(policy.environment).some(([key, value]) => !ENV.test(key) || typeof value !== 'string' || value.includes('\0') || value.length > 16_384)) fail('ENTROROVE_POLICY_ENVIRONMENT', 'environment must be explicit bounded strings');
+  boundedInt(policy.timeoutMs, RUNNER_LIMITS.maxTimeoutMs, 'timeoutMs'); boundedInt(policy.maxOutputBytes, RUNNER_LIMITS.maxOutputBytes, 'maxOutputBytes'); if (policy.requiredExitCode !== 0) fail('ENTROROVE_POLICY_EXIT', 'requiredExitCode must be zero');
+  if (!Array.isArray(plan.tests) || plan.tests.length === 0 || plan.tests.length > RUNNER_LIMITS.maxFiles) fail('ENTROROVE_PLAN_TESTS', 'tests must be non-empty');
+  for (const test of plan.tests) { exactObject(test, ['testId', 'path'], 'test'); if (!ID.test(test.testId) || !plan.files.some(file => file.path === test.path) || !policy.args.includes(test.path)) fail('ENTROROVE_PLAN_TESTS', 'each test must be in the manifest and explicit in args'); }
+  if (plan.contracts?.archguard?.driftStatus === 'red') fail('ENTROROVE_ARCHGUARD_BLOCKED', 'ArchGuard red blocks execution'); return plan;
+}
+
+async function validateApproval(root, input, planSha256) {
+  const file = await externalFile(root, input.approvalPath, 'approvalPath'); let approval; try { approval = JSON.parse(file.bytes.toString('utf8')); } catch (cause) { fail('ENTROROVE_APPROVAL_INVALID', `approval JSON is invalid: ${cause.message}`); }
+  exactObject(approval, ['schemaVersion', 'repositoryRoot', 'planSha256', 'approvedBy', 'approvedAt', 'expiresAt'], 'runner approval'); const approvedAt = Date.parse(approval.approvedAt); const expiresAt = Date.parse(approval.expiresAt); let approvedRoot = null; try { approvedRoot = await fs.realpath(approval.repositoryRoot); } catch {}
+  if (approval.schemaVersion !== APPROVAL_SCHEMA || approvedRoot !== root || approval.planSha256 !== planSha256 || !ID.test(approval.approvedBy) || !Number.isFinite(approvedAt) || !Number.isFinite(expiresAt) || approvedAt > Date.now() || expiresAt <= Date.now() || expiresAt <= approvedAt || expiresAt - approvedAt > RUNNER_LIMITS.maxApprovalLifetimeMs) fail('ENTROROVE_APPROVAL_INVALID', 'approval is expired or does not match the frozen plan'); return { ...file, approval };
+}
+async function signer(root, input, policy) {
+  if (input.signerConfigPath === null) return null; const file = await externalFile(root, input.signerConfigPath, 'signerConfigPath'); let config; try { config = JSON.parse(file.bytes.toString('utf8')); } catch (cause) { fail('ENTROROVE_SIGNER_INVALID', `signer JSON is invalid: ${cause.message}`); }
+  exactObject(config, ['schemaVersion', 'privateKeyPath', 'keyId', 'receiptTtlMs'], 'runner signer'); if (config.schemaVersion !== SIGNER_SCHEMA || !SHA256.test(config.keyId)) fail('ENTROROVE_SIGNER_INVALID', 'signer config is invalid'); boundedInt(config.receiptTtlMs, RUNNER_LIMITS.maxReceiptLifetimeMs, 'receiptTtlMs'); const privateFile = await externalFile(root, config.privateKeyPath, 'privateKeyPath');
+  let privateKey; try { privateKey = createPrivateKey(privateFile.bytes); if (privateKey.asymmetricKeyType !== 'ed25519' || digest(createPublicKey(privateKey).export({ format: 'der', type: 'spki' })) !== config.keyId) fail('ENTROROVE_SIGNER_INVALID', 'signer public key fingerprint mismatch'); } finally { privateFile.bytes.fill(0); }
+  if (JSON.stringify([policy.args, policy.environment]).includes(privateFile.path) || JSON.stringify([policy.args, policy.environment]).includes(file.path)) fail('ENTROROVE_SIGNER_SCOPE', 'signer path may not be passed to child'); return { config, file, privateKey };
+}
+
+async function authority(input) {
+  if (process.platform === 'win32' || typeof process.getuid !== 'function') fail('ENTROROVE_POSIX_REQUIRED', 'approved plan runner requires POSIX');
+  exactObject(input, ['repositoryRoot', 'planPath', 'approvalPath', 'signerConfigPath'], 'runner input'); const root = await rootOf(input.repositoryRoot); const planFile = await projectFile(root, input.planPath); if (planFile.bytes.length > RUNNER_LIMITS.maxControlBytes) fail('ENTROROVE_PLAN_SIZE', 'plan exceeds control limit');
+  let plan; try { plan = validatePlan(JSON.parse(planFile.bytes.toString('utf8'))); } catch (cause) { throw cause; } const approval = await validateApproval(root, input, planFile.sha256); const signing = await signer(root, input, plan.policy); const executable = await regular(plan.policy.executable, RUNNER_LIMITS.maxExecutableBytes); if (executable.sha256 !== plan.policy.executableSha256) fail('ENTROROVE_EXECUTABLE_HASH', 'executable SHA-256 mismatch');
+  for (const file of plan.files) { const actual = await projectFile(root, file.path); if (actual.sha256 !== file.sha256) fail('ENTROROVE_PLAN_FILE_HASH', `${file.path} changed before execution`); }
+  return { root, plan, planFile, approval, signing };
+}
+
+function runCommand(authority) {
+  return new Promise((resolve, reject) => {
+    const started = performance.now(); const { policy } = authority.plan; const child = spawn(policy.executable, policy.args, { cwd: authority.root, env: { ...policy.environment }, shell: false, detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
+    const stdout = []; const stderr = []; let bytes = 0; let dropped = 0; let timedOut = false; let terminating = false; let timer; const stdoutHash = createHash('sha256'); const stderrHash = createHash('sha256');
+    const terminate = () => { if (terminating) return; terminating = true; try { process.kill(-child.pid, 'SIGTERM'); } catch {} setTimeout(() => { try { process.kill(-child.pid, 'SIGKILL'); } catch {} }, 250).unref(); };
+    const consume = (target, hash, chunk) => { const data = Buffer.from(chunk); hash.update(data); const keep = Math.max(0, Math.min(data.length, policy.maxOutputBytes - bytes)); if (keep) target.push(data.subarray(0, keep)); bytes += keep; dropped += data.length - keep; if (dropped) terminate(); };
+    child.stdout.on('data', chunk => consume(stdout, stdoutHash, chunk)); child.stderr.on('data', chunk => consume(stderr, stderrHash, chunk)); child.once('error', reject); timer = setTimeout(() => { timedOut = true; terminate(); }, policy.timeoutMs);
+    child.once('close', (exitCode, signal) => { clearTimeout(timer); resolve({ schemaVersion: RUNNER_SCHEMA, status: exitCode === 0 && signal === null && !timedOut && !dropped ? 'succeeded' : 'failed', exitCode, signal, timedOut, outputLimitExceeded: dropped > 0, durationMs: Math.max(0, Math.round(performance.now() - started)), stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8'), stdoutSha256: stdoutHash.digest('hex'), stderrSha256: stderrHash.digest('hex'), capturedBytes: bytes, droppedBytes: dropped }); });
+  });
+}
+function subject(authority, result) { return { schemaVersion: 'validator.validation-subject/1.0', artifactSha256: authority.plan.artifactSha256, memberId: authority.plan.memberId, chainId: authority.plan.chainId, executedAt: new Date().toISOString(), files: authority.plan.files, validationRunId: authority.plan.validationRunId, planId: authority.plan.planId, tests: authority.plan.tests, policy: { command: [authority.plan.policy.executable, ...authority.plan.policy.args].map(value => JSON.stringify(value)).join(' '), requiredExitCode: 0, executionPlanSha256: authority.planFile.sha256 }, goldenBaseline: authority.plan.goldenBaseline, contracts: authority.plan.contracts, execution: { exitCode: result.exitCode, signal: result.signal, timedOut: result.timedOut, outputLimitExceeded: result.outputLimitExceeded } }; }
+function evidence(authority, result, sub) { const summary = result.timedOut ? 'Approved validation command exceeded its deadline' : result.outputLimitExceeded ? 'Approved validation command exceeded its output limit' : result.signal ? `Approved validation command ended on signal ${result.signal}` : `Approved validation command exited with code ${result.exitCode}`; const base = { schemaVersion: 'entrorove.test-evidence/2.0', evidenceId: `${authority.plan.validationRunId}:process`, kind: 'test', runner: authority.signing ? 'trusted-runner' : 'local', command: [authority.plan.policy.executable, ...authority.plan.policy.args].map(value => JSON.stringify(value)).join(' '), exitCode: result.exitCode, durationMs: result.durationMs, summary, artifactSha256: authority.plan.artifactSha256, subject: sub, subjectDigest: digest(canonical(sub)) };
+  if (!authority.signing || !Number.isInteger(result.exitCode)) return base; const privateKey = authority.signing.privateKey; const receiptCore = { schemaVersion: RECEIPT_SCHEMA, keyId: authority.signing.config.keyId, subjectDigest: base.subjectDigest, nonce: randomUUID(), issuedAt: new Date().toISOString(), expiresAt: new Date(Date.now() + authority.signing.config.receiptTtlMs).toISOString(), result: { runner: 'trusted-runner', passed: result.status === 'succeeded', exitCode: result.exitCode, durationMs: result.durationMs, summary } }; const receipt = { ...receiptCore, signature: sign(null, Buffer.from(canonical(receiptCore)), privateKey).toString('base64url') }; return { ...base, receipt };
+}
+
+export async function runApprovedPlan(input) { const owner = await authority(input); const result = await runCommand(owner); try { const after = await authority(input); if (after.planFile.sha256 !== owner.planFile.sha256) fail('ENTROROVE_PLAN_CHANGED', 'plan changed during execution'); } catch (cause) { const execution = { schemaVersion: RUNNER_SCHEMA, status: 'failed', error: cause.message, process: result, evidence: [] }; const error = new Error(cause.message); error.code = cause.code; error.execution = execution; throw error; }
+  const sub = subject(owner, result); const item = evidence(owner, result, sub); const status = !owner.signing && result.status === 'succeeded' ? 'incomplete' : result.status; return { schemaVersion: RUNNER_SCHEMA, status, planSha256: owner.planFile.sha256, approvalSha256: owner.approval.sha256, approvedBy: owner.approval.approval.approvedBy, subject: sub, process: result, evidence: [item], receipt: item.receipt ?? null, ...(owner.signing ? { receiptPublicKey: createPublicKey(owner.signing.privateKey).export({ format: 'der', type: 'spki' }).toString('base64') } : {}), signingBoundary: owner.signing ? 'configured-signature-only' : 'local-evidence-only' };
+}
+
+export const RUNNER_CAPABILITIES = Object.freeze({ schemaVersion: RUNNER_SCHEMA, operations: ['capabilities', 'run-approved-plan'], operationSchemas: { capabilities: { type: 'object', additionalProperties: false, required: [] }, 'run-approved-plan': { type: 'object', additionalProperties: false, required: ['repositoryRoot', 'planPath', 'approvalPath', 'signerConfigPath'] } }, limits: RUNNER_LIMITS, boundary: 'POSIX subprocess runner; external approval is required; local evidence remains incomplete without a configured signer.' });

package/local-budget-renewal.mjs

@@ -0,0 +1,37 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { withStateLock } from './local-state-lock.mjs';
+
+const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+function fail(code, message) { const error = new Error(message); error.code = code; throw error; }
+function digest(value) { return createHash('sha256').update(value).digest('hex'); }
+function canonical(value) { if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`; if (value && typeof value === 'object') return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`; return JSON.stringify(value); }
+function rootHome(home = os.homedir()) { if (typeof home !== 'string' || !path.isAbsolute(home)) fail('ENTROROVE_HOME_INVALID', 'home must be absolute'); return path.join(home, '.entrorove'); }
+async function privateDir(directory) { await fs.mkdir(directory, { recursive: true, mode: 0o700 }); const stat = await fs.lstat(directory); if (!stat.isDirectory() || stat.isSymbolicLink()) fail('ENTROROVE_STATE_INVALID', 'state directory must be a real directory'); if (process.platform !== 'win32') await fs.chmod(directory, 0o700); }
+async function repo(value) { if (typeof value !== 'string' || !path.isAbsolute(value)) fail('ENTROROVE_ROOT_INVALID', 'repositoryRoot must be absolute'); const stat = await fs.lstat(value); if (!stat.isDirectory() || stat.isSymbolicLink()) fail('ENTROROVE_ROOT_INVALID', 'repositoryRoot must be a real directory'); return fs.realpath(value); }
+function statePath(home, root, flowId) { return path.join(rootHome(home), 'budgets', digest(root).slice(0, 32), flowId, 'budget.json'); }
+async function load(input) { const root = await repo(input.repositoryRoot); if (typeof input.flowId !== 'string' || !ID.test(input.flowId)) fail('ENTROROVE_ID_INVALID', 'flowId must be a safe identifier'); const file = statePath(input.home, root, input.flowId); await privateDir(path.dirname(file)); const stat = await fs.lstat(file); if (!stat.isFile() || stat.isSymbolicLink()) fail('ENTROROVE_STATE_INVALID', 'budget state must be a regular file'); const state = JSON.parse(await fs.readFile(file, 'utf8')); if (state.flowId !== input.flowId || state.repositoryDigest !== digest(root).slice(0, 32)) fail('ENTROROVE_BUDGET_SCOPE', 'budget state does not match repository and flow'); return { root, file, state }; }
+async function save(file, state) { await privateDir(path.dirname(file)); const temp = `${file}.${randomUUID()}.tmp`; await fs.writeFile(temp, `${canonical(state)}\n`, { flag: 'wx', mode: 0o600 }); await fs.rename(temp, file); if (process.platform !== 'win32') await fs.chmod(file, 0o600); }
+export async function consumeBudgetRenewal({ file, state, now = Date.now() }) {
+  if (!state.enforced || !state.autoRenew || state.autoRenew.status !== 'authorized') return state;
+  const elapsed = state.elapsedMs + now - Date.parse(state.startedAt); const used = state.autoRenew.renewalsUsed ?? 0;
+  if (elapsed < state.maxDurationMs || used >= state.autoRenew.policy.maxRenewals) return state;
+  const updated = { ...state, startedAt: new Date(now).toISOString(), elapsedMs: 0, autoRenew: { ...state.autoRenew, renewalsUsed: used + 1, lastRenewedAt: new Date(now).toISOString() } };
+  await save(file, updated); return updated;
+}
+function scope(input) { if (!input.scope || typeof input.scope.goal !== 'string' || !Array.isArray(input.scope.allowedPaths) || !input.scope.allowedPaths.length) fail('ENTROROVE_RENEWAL_SCOPE', 'renewal scope must include goal and allowedPaths'); return { goal: input.scope.goal, allowedPaths: [...new Set(input.scope.allowedPaths)].sort() }; }
+function policy(input) { if (!input.policy || !Number.isSafeInteger(input.policy.intervalMs) || input.policy.intervalMs < 1 || !Number.isSafeInteger(input.policy.maxRenewals) || input.policy.maxRenewals < 1 || input.policy.maxRenewals > 100) fail('ENTROROVE_RENEWAL_POLICY', 'renewal policy must have bounded intervalMs and maxRenewals'); return { intervalMs: input.policy.intervalMs, maxRenewals: input.policy.maxRenewals }; }
+async function renewalRequestUnlocked(input) { const current = await load(input); const requested = scope(input); const renewalPolicy = policy(input); if (!input.requestId || typeof input.requestId !== 'string' || !ID.test(input.requestId)) fail('ENTROROVE_REQUEST_ID', 'requestId must be a safe identifier'); if (current.state.autoRenew?.status === 'authorized') fail('ENTROROVE_RENEWAL_EXISTS', 'this budget already has an immutable renewal authorization'); const record = { requestId: input.requestId, chainId: input.flowId, scope: requested, scopeDigest: digest(canonical(requested)), policy: renewalPolicy, status: 'pending', createdAt: new Date().toISOString() }; const state = { ...current.state, autoRenew: record }; await save(current.file, state); return { schemaVersion: 'entrorove.local-execution/1.0', status: 'waiting', interaction: { schemaVersion: 'confirm.interaction/1.0', interactionId: `renew-${randomUUID()}`, risk: 'medium', question: `Allow automatic read-time renewal for chain ${input.flowId}?`, options: [{ id: 'approve', label: 'Approve' }, { id: 'reject', label: 'Reject' }], default: null, expiresAt: new Date(Date.now() + 300_000).toISOString(), callback: { operation: 'budget-auto-renew', requestId: input.requestId } }, requestId: input.requestId, scope: requested, policy: renewalPolicy }; }
+export async function budgetAutoRenewRequest(input) { const current = await load(input); return withStateLock(current.file, () => renewalRequestUnlocked(input)); }
+async function renewalUnlocked(input) { const current = await load(input); const pending = current.state.autoRenew; const requested = scope(input); const renewalPolicy = policy(input); const confirmation = input.confirmation; if (!pending || pending.requestId !== input.requestId || pending.status !== 'pending' || confirmation?.answer !== 'approve' || confirmation.requestId !== input.requestId || pending.scopeDigest !== digest(canonical(requested)) || canonical(pending.policy) !== canonical(renewalPolicy)) return { schemaVersion: 'entrorove.local-execution/1.0', status: 'blocked', allowed: false, code: 'ENTROROVE_CONFIRMATION_BINDING' }; const state = { ...current.state, autoRenew: { ...pending, status: 'authorized', approvedAt: new Date().toISOString(), renewalsUsed: 0 } }; await save(current.file, state); return { schemaVersion: 'entrorove.local-execution/1.0', status: 'verified', allowed: true, chainId: input.flowId, requestId: input.requestId, scope: requested, policy: renewalPolicy, renewalsUsed: 0 }; }
+export async function budgetAutoRenew(input) { const current = await load(input); return withStateLock(current.file, () => renewalUnlocked(input)); }
+async function renewalStopUnlocked(input) { const current = await load(input); const reason = input.reason; if (!['revoked', 'completed'].includes(reason)) fail('ENTROROVE_RENEWAL_REASON', 'reason must be revoked or completed'); if (!current.state.autoRenew || current.state.autoRenew.status !== 'authorized') return { schemaVersion: 'entrorove.local-execution/1.0', status: 'verified', stopped: false, reason }; const state = { ...current.state, autoRenew: { ...current.state.autoRenew, status: 'stopped', stoppedAt: new Date().toISOString(), stopReason: reason } }; await save(current.file, state); return { schemaVersion: 'entrorove.local-execution/1.0', status: 'verified', stopped: true, reason, renewalsUsed: state.autoRenew.renewalsUsed ?? 0 }; }
+export async function budgetAutoRenewStop(input) { const current = await load(input); return withStateLock(current.file, () => renewalStopUnlocked(input)); }
+export const LOCAL_RENEWAL_OPERATIONS = Object.freeze({ 'budget-auto-renew-request': budgetAutoRenewRequest, 'budget-auto-renew': budgetAutoRenew, 'budget-auto-renew-stop': budgetAutoRenewStop });
+export const LOCAL_RENEWAL_SCHEMAS = Object.freeze({
+  'budget-auto-renew-request': { type: 'object', additionalProperties: false, required: ['repositoryRoot', 'flowId', 'requestId', 'scope', 'policy'] },
+  'budget-auto-renew': { type: 'object', additionalProperties: false, required: ['repositoryRoot', 'flowId', 'requestId', 'scope', 'policy', 'confirmation'] },
+  'budget-auto-renew-stop': { type: 'object', additionalProperties: false, required: ['repositoryRoot', 'flowId', 'reason'] },
+});