@entrorove/skill 0.1.28 → 0.1.31

package/CHANGELOG.md

@@ -1,9 +1,24 @@
 # Changelog
 
+## 0.1.31 — 2026-10-11
+
+- 修复云端沙箱任务响应处理并保留可继续的任务上下文。
+- Hardened cloud sandbox responses and preserved continuation task context.
+
+## 0.1.30 — 2026-10-11
+
+- 修复云端沙箱任务路由与逐任务选择交互。
+- Fixed cloud sandbox task routing and per-task choice interaction.
+
+## 0.1.29 — 2026-10-11
+
+- 更新了自动版本与更新日志、远端恢复客户端。
+- Updated automatic versioning and changelog, remote recovery client.
+
 ## 0.1.28 — 2026-10-09
 
-- 更新了协同执行与验证隔离能力、协同执行与验证隔离能力、协同执行与验证隔离能力、协同执行与验证隔离能力、协同执行与验证隔离能力、协同执行与验证隔离能力、协同执行与验证隔离能力、协同执行与验证隔离能力、安装包配置、自动版本与更新日志、统一本地错误信封。
-- Updated coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, package configuration, automatic versioning and changelog, unified local error envelopes.
+- 更新了协同执行与验证隔离能力、安装包配置、自动版本与更新日志、统一本地错误信封。
+- Updated coordination execution and validator isolation capabilities, package configuration, automatic versioning and changelog, unified local error envelopes.
 
 ## 0.1.27 — 2026-10-08
 

package/SKILL.md

@@ -5,7 +5,7 @@ description: An engineering skill that understands a task, chooses a fitting wor
 
 # entrorove · 熵巡
 
-Version: 0.1.28.
+Version: 0.1.31.
 
 Read the user's goal and repository instructions first. Preserve the original task through planning, execution and verification. Use the workflow only where it helps; a small, low-risk edit can proceed directly. Never claim a reported step is a verified result.
 
@@ -25,6 +25,8 @@ On first use or after a material agreement revision, the CLI returns a Confirm P
 
 Send JSON on standard input to `npx @entrorove/skill invoke`. Before every execution call, discover `operation: "capabilities"` with `{}` and validate input against the returned operation schema. The CLI performs remote discovery automatically; local adapters discover the installed contract before execution. Discovery failure stops execution. Adapters that expose the four-step task route can call `task-describe`, `message-route`, `message-accept` and `task-resume` in order; `start` remains the one-call workflow equivalent. Then start with `operation: "start"` and an `input.task` containing the goal, work type, risk, difficulty and observed scope facts. Work types are `implementation`, `documentation`, `calculation`, `merge`, `review`, `decision` and `diagnosis`. Assess facts from the real task and repository; do not invent certainty. entrorove chooses the workflow. A small task may return `decision: "direct"`, meaning the IDE should do the work without another service call. The public envelope is `entrorove.skill.request/2.0`; `requestId` is the SHA-256 digest of `operation + canonical(input)`. Version 1.0 remains accepted for older callers.
 
+`start` creates a normal durable skill flow. It does not create a cloud-sandbox task or contribute to cloud-sandbox usage. To create a real cloud-sandbox task, call `operation: "cloud-task"` with `input.goal`; the CLI returns a Confirm Protocol choice interaction before any cloud request. Continue the same request with `sandboxChoice: "use"` or `sandboxChoice: "local"`. `use` calls the authenticated `/api/cloud-task` endpoint and returns the real `taskId`; `local` skips only this task. A `needs-input`, `blocked` or `failed` result is not a successful dispatch and must be shown to the user.
+
 ### Per-task cloud sandbox choice
 
 When the host exposes an enabled cloud-sandbox preference and a new task is about to dispatch a cloud model, ask once whether this task should use the cloud sandbox. This is a low-risk routing preference, separate from agreement acceptance and the medium/high-risk confirmations below. Offer `use for this task` and `continue locally`; if the user gives no answer, use the cloud sandbox by the host's stated timeout default. An explicit opt-out applies only to the current task and must not change the account-wide sandbox preference. Do not ask again while continuing or resuming the same task. If the account-wide preference is disabled or unavailable, do not dispatch a cloud task and do not show a misleading per-task prompt; preserve the normal local workflow and report the prerequisite clearly. This choice never bypasses the normal task schema, mutation authority, evidence checks, or risk confirmation.

package/cli.mjs

@@ -12,6 +12,7 @@ import { runTaskMessageCli } from './task-message-cli.mjs';
 import { apiUrl, buildInvocation, invokeRemote, queryFlows, queryStatus } from './remote-client.mjs';
 const packageDir = path.dirname(fileURLToPath(import.meta.url));
 import { buildReview, submitSkillFeedback, feedbackNoticeVersion } from './review-client.mjs';
+import { runCloudTask as dispatchCloudTask } from './cloud-task-client.mjs';
 const markerName = '.entrorove-managed.json';
 const installFiles = ['SKILL.md', 'CAPABILITY-MAP.md', 'AGREEMENT.md', 'manifest.json'];
 const markerSchema = 'entrorove.managed-install/1.0';
@@ -381,7 +382,17 @@ export function remoteDependencies(home = os.homedir()) {
   };
 }
 
+export async function runCloudTask(input, dependencies = remoteDependencies()) {
+  const result = await dispatchCloudTask(input, dependencies);
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (['blocked', 'failed', 'incomplete', 'needs-input'].includes(result.status)) process.exitCode = 2;
+  return result;
+}
+
 async function invoke(data) {
+  if (data?.operation === 'cloud-task') {
+    return runCloudTask(data.input, remoteDependencies());
+  }
   return invokeRemote(data, remoteDependencies());
 }
 
@@ -410,6 +421,8 @@ async function main() {
     await invoke(await stdinJson());
   } else if (command === 'host-message') {
     await runTaskMessageCli(args, await stdinJson(), remoteDependencies());
+  } else if (command === 'cloud-task' && args.length === 0) {
+    await runCloudTask(await stdinJson());
   } else if (command === 'review' && args.length === 0) {
     await submitReview(await stdinJson());
   } else if (command === 'status' && args.length === 1) {
@@ -431,7 +444,7 @@ async function main() {
   } else if (command === 'local') {
     await runLocal(args);
   } else {
-    throw new Error('Usage: entrorove install | configure | agreement | invoke | host-message [adapterModulePath] | status <requestId> | flows | review | local (JSON on stdin)');
+    throw new Error('Usage: entrorove install | configure | agreement | invoke | host-message [adapterModulePath] | cloud-task | status <requestId> | flows | review | local (JSON on stdin)');
   }
 }
 if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {

package/cloud-task-client.mjs

@@ -0,0 +1,119 @@
+import { createHash } from 'node:crypto';
+import { appendInvocation } from './local-invocations.mjs';
+import { parseTransportResponse, requestTransport, trustedOrigin } from './remote-transport.mjs';
+
+const CLOUD_TASK_SCHEMA = 'entrorove.cloud-task/1.0';
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;
+  if (value && typeof value === 'object') {
+    return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`;
+  }
+  return JSON.stringify(value);
+}
+
+function requestId(input) {
+  return createHash('sha256').update(`cloud-task${canonical(input)}`).digest('hex');
+}
+
+function validateInput(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('cloud-task input must be a JSON object');
+  if (typeof input.goal !== 'string' || !input.goal.trim() || input.goal.length > 12_000) {
+    throw new Error('cloud-task goal must be a non-empty string of at most 12000 characters');
+  }
+  if (input.ideTaskId !== undefined && (typeof input.ideTaskId !== 'string' || !input.ideTaskId.trim() || input.ideTaskId.length > 200)) {
+    throw new Error('cloud-task ideTaskId must be a non-empty string of at most 200 characters');
+  }
+  if (input.sandboxChoice !== undefined && !['use', 'local'].includes(input.sandboxChoice)) {
+    throw new Error('cloud-task sandboxChoice must be use or local');
+  }
+  return { goal: input.goal, ...(input.ideTaskId === undefined ? {} : { ideTaskId: input.ideTaskId }) };
+}
+
+function validateDependencies(dependencies) {
+  if (!dependencies || !['install', 'agreementAccepted', 'agreementRequired', 'readCredential', 'apiOrigin']
+    .every(key => typeof dependencies[key] === 'function')) {
+    throw new Error('Cloud sandbox client requires installed agreement, credential, and API-origin dependencies');
+  }
+}
+
+export function sandboxChoiceInteraction(id) {
+  return {
+    schemaVersion: 'confirm.interaction/1.0', requestId: id, type: 'choice',
+    question: '是否为本任务使用云端沙箱？',
+    options: [
+      { id: 'use', label: '本任务使用云端沙箱', hint: '创建真实云端任务并持续记录进度' },
+      { id: 'local', label: '继续本地执行', hint: '仅当前任务退出云端沙箱' },
+    ],
+    default: 'use', timeout: 8_000, timeoutAction: 'use', risk: 'low',
+    riskDescription: '这是当前任务的执行位置选择，不改变账号级云端沙箱开关。',
+    rememberable: false, memoryKey: '',
+    callback: { operation: 'cloud-task', payload: { sandboxChoice: 'use' } },
+  };
+}
+
+function envelope(input, status, extra = {}) {
+  return { schemaVersion: CLOUD_TASK_SCHEMA, status, requestId: requestId(input), ...extra };
+}
+
+async function responseBody(response) {
+  try { return parseTransportResponse(response, 'cloud-task'); }
+  catch (cause) { throw Object.assign(new Error('Cloud sandbox returned an invalid response'), { cause }); }
+}
+
+export async function runCloudTask(input, dependencies) {
+  const task = validateInput(input);
+  validateDependencies(dependencies);
+  const id = requestId(task);
+  await dependencies.install();
+  if (!await dependencies.agreementAccepted(dependencies.home)) {
+    return envelope(task, 'blocked', { code: 'agreement-required', interaction: dependencies.agreementRequired(dependencies.home) });
+  }
+  if (input.sandboxChoice === undefined) return envelope(task, 'needs-input', {
+    task, interaction: sandboxChoiceInteraction(id),
+  });
+  if (input.sandboxChoice === 'local') return envelope(task, 'skipped', { reason: 'task' });
+
+  const token = await dependencies.readCredential(dependencies.home);
+  const origin = trustedOrigin(dependencies.apiOrigin());
+  const metadata = { kind: 'remote', operation: 'cloud-task', requestId: id };
+  await appendInvocation({ ...metadata, event: 'started' }, dependencies.home);
+  let response;
+  try {
+    response = await requestTransport(origin, '/api/cloud-task', {
+      method: 'POST', timeoutMs: 30_000,
+      headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+      body: JSON.stringify(task),
+    });
+  } catch (cause) {
+    if (cause.established) await appendInvocation({ ...metadata, event: 'outcome-unknown' }, dependencies.home);
+    else await appendInvocation({ ...metadata, event: 'not-sent' }, dependencies.home);
+    throw cause.established
+      ? Object.assign(new Error(`Cloud sandbox outcome is unknown; requestId=${id}. Query the task list before retrying.`), { requestId: id, outcomeUnknown: true })
+      : cause;
+  }
+  let result;
+  try {
+    result = await responseBody(response);
+  } catch (cause) {
+    await appendInvocation({ ...metadata, event: 'outcome-unknown' }, dependencies.home);
+    throw Object.assign(new Error(`Cloud sandbox returned an unusable response; requestId=${id}. Query the task list before retrying.`), {
+      requestId: id, outcomeUnknown: true, cause,
+    });
+  }
+  if (!response.ok) {
+    await appendInvocation({ ...metadata, event: response.status >= 500 ? 'outcome-unknown' : 'rejected' }, dependencies.home);
+    const code = typeof result?.error === 'string' ? result.error : 'cloud-task-rejected';
+    return envelope(task, response.status === 403 ? 'blocked' : 'failed', { code, message: result?.message ?? code, httpStatus: response.status });
+  }
+  if (!result?.ok || typeof result.taskId !== 'string' || !UUID.test(result.taskId)) {
+    await appendInvocation({ ...metadata, event: 'outcome-unknown' }, dependencies.home);
+    throw new Error(`Cloud sandbox response lost its task identity; requestId=${id}`);
+  }
+  await appendInvocation({ ...metadata, event: 'completed' }, dependencies.home);
+  return envelope(task, 'started', { taskId: result.taskId,
+    taskStatus: typeof result.status === 'string' ? result.status : 'running',
+    executionIsolation: typeof result.executionIsolation === 'string' ? result.executionIsolation : 'worker' });
+}
+

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.28",
+  "version": "0.1.31",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.28",
+  "version": "0.1.31",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -76,6 +76,7 @@
     "local-task-handoff-write-archive.mjs",
     "local-task-handoff-write-receipts.mjs",
     "remote-client.mjs",
+    "cloud-task-client.mjs",
     "remote-transport.mjs",
     "local-credential.mjs",
     "local-invocations.mjs",

package/release-state.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.28",
-  "digest": "45cbb490c5d7fc99eb1ee6d4d852f9695e614ea3fd0c9923e30a6d24e777401e",
+  "version": "0.1.31",
+  "digest": "005df83b58c713b893d715a7480c08a91896301f6295746525f49abd2d746044",
   "files": {
     "local-final-gate16.mjs": "b30caab08441449ad556a6e9a3cefbf91190f0b3f7370f46d2a21156375aa8e3",
     "local-final-gate16-checks.mjs": "1dd30e9666d458d8b12ca6e4975f6f0ac8450c3ea9cbecc7401ae037f66b589a",
@@ -44,15 +44,15 @@
     "local-autocoord17-waits.mjs": "2b0a713987822548a94e1ed3a9a891532db45383797dfc5d5bc8d1e35593cf25",
     "local-validator-isolation17.mjs": "48e94604e28b8fddd567dfb35ff60b73fd094a5803bd49f076388b7f310f92aa",
     "local-calctool-composition17.mjs": "ac89fcb41ab0d0d9b47c1b5696945281b0894eb064820775e36a011c76314e6a",
-    "cli.mjs": "c85289b1cbe0ea469a57e67edb1fc475dc9c626c2beae00f5e0954c00757481d",
+    "cli.mjs": "6b2f31ee3204c8584ac4733a9b2d1c6ca72e2ea205e84f8a314a68f31917f629",
     "review-client.mjs": "3491eef68ed533174b31db3c53febb6519b8f088f71a9964644714a9a4c03c77",
     "version.mjs": "1f392147d72c40af4b03b307ea607075fb815af5174fa07e254b95fe12dbf3e7",
-    "SKILL.md": "87c5e85b0c767c85660ebb9958bccaeb69f3f8c2f122f210f5b38e30df891014",
+    "SKILL.md": "fa3fa41f1551e54512de0cae7940e2d7ad670f81a46c2e642cdc2323b171224f",
     "CAPABILITY-MAP.md": "128ecc8d90b2c17846ce6f0c650eada9e7fa7240f5d3c03b31e3ee01135557b8",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
-    "package.json": "cb54098a13e05f22ef09bcb6a35a47995415bb14732791b61c0334ec7c7d1403",
+    "package.json": "77e29f7740cc2a2284490a992a9945fbb4a3ad3ac044f4ff9a59b1aa83e44ae0",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
-    "release.mjs": "607f63013ed2cdf9448d451c7e5a4e130715be5bae70e8905fb15d874ea7b93a",
+    "release.mjs": "1e6155d10b5e6384414233847815742e13f0945101c5f53253ad9ca827766beb",
     "local-cli.mjs": "ecc85bc5f36a5663fef004e59525374dc7883d3889f5a0cfe219ae5e84b2d3ea",
     "local-state-lock.mjs": "1dbf64264642a0851faf043e07ee9f66d2ad0508e9f799b0626246e42fae893e",
     "local-execution.mjs": "97dfad5e889e679e9cc34434005342526502795abba21078fa40673788073153",
@@ -117,7 +117,8 @@
     "local-scope-state.mjs": "8b600a91fc0068d7a8c0bb752ddba7ed30ada93daafb118d6cba2368fd94cb27",
     "local-scope-workspaces.mjs": "a44c34537e5ed2dcaf193a985e5bc05957989fbb160a650f9e37ba7d66eb2de8",
     "local-task-routing.mjs": "e26d6f1ba134ffe1da2a49b4fb6bb6dfa5617671f774a08e719d04f202cf5eca",
-    "remote-client.mjs": "dabbcc7bd0fd16ba029163f407edb85e914df83cd5914221eb2ce0d061ca8f28",
+    "remote-client.mjs": "ce16258faffb09c9db19609d47a0af6f63fcbc256feb35ba7a14bbb89e69cc6e",
+    "cloud-task-client.mjs": "b7dc4be6c4d2a60404538e3d875cf95533e1b7be3f43ac7f5d49118042ce1d45",
     "remote-transport.mjs": "5e5a8c0b490371f7f5a052cffbeee6202d4cf713dff1c43b6d910fe944f8429c",
     "local-credential.mjs": "2a302a7f67b5ea8dc73453fc96ab33db349b59ca11fa9456e48ca1d9669d877c",
     "local-invocations.mjs": "f6ac4c41c1a5ec34de358c4cca210ca8e403b3a913150a43bb55ec9be55d9998",

package/release.mjs

@@ -89,7 +89,7 @@ const sourceFiles = [
   'local-scope-snapshot.mjs',
   'local-scope-state.mjs',
   'local-scope-workspaces.mjs',
-  'local-task-routing.mjs', 'remote-client.mjs',
+  'local-task-routing.mjs', 'remote-client.mjs', 'cloud-task-client.mjs',
   'remote-transport.mjs', 'local-credential.mjs', 'local-invocations.mjs',
   'local-task-handoff-fence.mjs',
   'local-task-handoff-storage.mjs', 'local-task-handoff-overlay-wire.mjs', 'local-task-handoff-completion-wire.mjs',
@@ -177,6 +177,16 @@ function versionNext(version) {
   return `${parts[0]}.${parts[1]}.${parts[2] + 1}`
 }
 
+function distinctReleaseLabels(changed, labels) {
+  const seen = new Set()
+  return changed.map(name => labels[name]).filter(label => {
+    const key = `${label.zh}\u0000${label.en}`
+    if (seen.has(key)) return false
+    seen.add(key)
+    return true
+  })
+}
+
 const calctoolReleaseLabels = Object.freeze({
   'local-decimal.mjs': { zh: 'Calctool Decimal28 公式与本地执行', en: 'Calctool Decimal28 formulas and local execution' },
   'local-formula-ast.mjs': { zh: 'Calctool Decimal28 公式与本地执行', en: 'Calctool Decimal28 formulas and local execution' },
@@ -333,10 +343,12 @@ function releaseNote(changed) {
     'remote-client.mjs': { zh: '远端恢复客户端', en: 'remote recovery client' },
     'task-message-entry.mjs': { zh: '任务消息实际投递入口', en: 'task message host delivery entry' },
     'task-message-cli.mjs': { zh: '任务消息命令与适配器', en: 'task message command and adapter' },
+    'cloud-task-client.mjs': { zh: '云端沙箱任务路由与逐任务选择', en: 'cloud sandbox task routing and per-task choice' },
   })
+  const distinct = distinctReleaseLabels(changed, labels)
   return {
-    zh: `更新了${changed.map(name => labels[name].zh).join('、')}。`,
-    en: `Updated ${changed.map(name => labels[name].en).join(', ')}.`,
+    zh: `更新了${distinct.map(label => label.zh).join('、')}。`,
+    en: `Updated ${distinct.map(label => label.en).join(', ')}.`,
   }
 }
 

package/releases.json

@@ -1,9 +1,27 @@
 [
+  {
+    "version": "0.1.31",
+    "date": "2026-10-11",
+    "zh": "修复云端沙箱任务响应处理并保留可继续的任务上下文。",
+    "en": "Hardened cloud sandbox responses and preserved continuation task context."
+  },
+  {
+    "version": "0.1.30",
+    "date": "2026-10-11",
+    "zh": "修复云端沙箱任务路由与逐任务选择交互。",
+    "en": "Fixed cloud sandbox task routing and per-task choice interaction."
+  },
+  {
+    "version": "0.1.29",
+    "date": "2026-10-11",
+    "zh": "更新了自动版本与更新日志、远端恢复客户端。",
+    "en": "Updated automatic versioning and changelog, remote recovery client."
+  },
   {
     "version": "0.1.28",
     "date": "2026-10-09",
-    "zh": "更新了协同执行与验证隔离能力、协同执行与验证隔离能力、协同执行与验证隔离能力、协同执行与验证隔离能力、协同执行与验证隔离能力、协同执行与验证隔离能力、协同执行与验证隔离能力、协同执行与验证隔离能力、安装包配置、自动版本与更新日志、统一本地错误信封。",
-    "en": "Updated coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, coordination execution and validator isolation capabilities, package configuration, automatic versioning and changelog, unified local error envelopes."
+    "zh": "更新了协同执行与验证隔离能力、安装包配置、自动版本与更新日志、统一本地错误信封。",
+    "en": "Updated coordination execution and validator isolation capabilities, package configuration, automatic versioning and changelog, unified local error envelopes."
   },
   {
     "version": "0.1.27",

package/remote-client.mjs

@@ -17,6 +17,18 @@ function requestId(operation, input) {
   return createHash('sha256').update(operation + canonical(input)).digest('hex');
 }
 
+// The API advertises JSON Schema formats that are intentionally kept out of
+// Ajv's core package. Register the formats used by the discovered contract so
+// client-side validation can reach the actual operation instead of failing
+// while compiling the schema.
+const discoveredUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function discoveredAjv() {
+  const ajv = new Ajv({ strict: true, strictRequired: false, allErrors: true });
+  ajv.addFormat('uuid', discoveredUuid);
+  ajv.addFormat('date-time', value => Number.isFinite(Date.parse(value)));
+  return ajv;
+}
+
 export function buildInvocation(operation, input) {
   if (!['capabilities', 'task-describe', 'message-route', 'message-accept', 'task-resume', 'task-checkpoint',
     'message-status', 'message-delivery-start', 'message-delivery-report', 'message-resolve', 'message-complete',
@@ -58,7 +70,7 @@ export async function invokeRemote(data, dependencies) {
     const capabilities = discovery.result.output.capabilities;
     const schema = capabilities?.operationSchemas?.[data.operation];
     if (!capabilities?.operations?.includes(data.operation) || !schema) throw new Error(`Capability discovery does not support ${data.operation}`);
-    const validate = new Ajv({ strict: true, strictRequired: false, allErrors: true }).compile(schema);
+    const validate = discoveredAjv().compile(schema);
     if (!validate(data.input)) throw new Error(`Invalid ${data.operation} input: ${validate.errors.map(error => `${error.instancePath || '/'} ${error.message}`).join('; ')}`);
     validateDiscoveredChecks(data.input, capabilities.inputChecks?.[data.operation]);
   }
@@ -120,7 +132,7 @@ function machineOrigin(dependencies) { return trustedOrigin(dependencies.apiOrig
 function validateMachineCapability(operation, input, capabilities) {
   const schema = capabilities?.operationSchemas?.[operation];
   if (!capabilities?.operations?.includes(operation) || !schema) throw new Error(`Capability discovery does not support ${operation}`);
-  const validate = new Ajv({ strict: true, strictRequired: false, allErrors: true }).compile(schema);
+  const validate = discoveredAjv().compile(schema);
   if (!validate(input)) throw new Error(`Invalid ${operation} input: ${validate.errors.map(error => `${error.instancePath || '/'} ${error.message}`).join('; ')}`);
   validateDiscoveredChecks(input, capabilities.inputChecks?.[operation]);
 }