@entrorove/skill 0.1.35 → 0.1.36

package/CAPABILITY-MAP.md

@@ -23,7 +23,7 @@
 | 实际进度必须进入 IDE | `cloud-watch` 订阅本人任务 SSE，输出独立 IDE 事件；调用方必须把公开消息和摘要展示到对话进度 |
 | 执行提示与推广可见 | `智能执行中，请勿关闭！` 与服务端选中的真实推广独立输出；保留推广 HTTPS 链接，按事件 ID 去重 |
 | 断线恢复原任务 | `cloud-watch` 带原 `taskId/afterId` 只读续接；`status` 与 `feedback` 查询原请求，不重发业务 POST |
-| 服务端自动评价，无第二次评价写入 | 调用完成事务保存本人原 request 的评价与结果摘要；CLI 校验回执。旧式适配器使用幂等持久化并在同一 HTTP 响应返回 |
+| 调用结束立即确认评价回传 | 调用完成事务保存本人原 request 的评价与结果摘要；CLI 核验后立即回传原回执身份，服务端返回 IDE 接收确认，不重复写评价或计用量；只读恢复保留原执行代次 |
 | 未验证不可记好评 | intake、模型摘要、reported、不完整证据无评分；阻断、失败、P0/P1 不产生好评；发现和状态查询不生成新评价 |
 | 实际 IDE 与原调用绑定 | `ENTROROVE_IDE` 或宿主检测写入原调用标签；每个 OS 用户继续复用受限凭据存储 |
 | 最新官方技能说明生效 | 新调用使用 `npx --yes --prefer-online @entrorove/skill@latest`；安装更新后重新读取 managed `SKILL.md` |

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.36 — 2026-10-13
+
+- 技能调用结束立即确认 IDE 评价回传，提供原账号、原调用与执行代次绑定的接收回执；完善原回执只读恢复与公开合同校验。
+- Confirmed IDE evaluation acknowledgements immediately after skill calls, bound reception receipts to the original account, invocation and generation, and improved read-only recovery and published contract validation.
+
 ## 0.1.35 — 2026-10-13
 
 - 新增协作状态查询、Aimlock 专用规划与八域原生调用；接入账号和设备隔离的任务通知，修复失败接续的评价回执冲突，并完善范围门禁接续。

package/SKILL.md

@@ -5,7 +5,7 @@ description: An engineering skill that understands a task, chooses a fitting wor
 
 # entrorove · 熵巡
 
-Version: 0.1.35.
+Version: 0.1.36.
 
 Read the user's goal and repository instructions first. Preserve the original task through planning, execution and verification. Use the workflow only where it helps; a small, low-risk edit can proceed directly. Never claim a reported step is a verified result.
 
@@ -87,7 +87,7 @@ The website's signed-in bell control enables encrypted Web Push for the current
 
 ### Automatic invocation evaluation and optional user reviews
 
-Every completed or failed execution call receives a server-generated `feedback` receipt bound to the original account, request hash and result digest. Durable calls commit this evaluation in the same transaction as the result; legacy adapters return an idempotent receipt with the same HTTP response. The CLI verifies the original identity and evaluation digest. Preserve `receiptId`, `requestId` and `evaluation.digest`; never generate a score or comment locally. Display the returned evaluation acknowledgement in IDE progress, deduplicated by receipt ID. Read the saved receipt with `npx @entrorove/skill feedback <original requestId>` after a connection loss; this is GET only and never repeats execution or submits another evaluation. An authorized retry before side effects keeps the original request but gets a new server execution generation and immutable receipt. Default feedback reads the latest generation; `feedback <original requestId> <generation>` reads a preserved earlier receipt. Never overwrite a failed receipt or use it as the current retry result. Discovery/status queries create no evaluations.
+Every completed or failed execution call receives a server-generated `feedback` receipt bound to the original account, request hash and result digest. Durable calls commit this evaluation in the same transaction as the result; domain adapters return an idempotent receipt with the same HTTP response. The CLI verifies the original identity and evaluation digest, then immediately returns that exact receipt identity to the authenticated acknowledgement endpoint before finishing the call. Cloud watches do the same as soon as the original evaluation is available. A confirmed `acknowledgement` records the IDE and server reception time without changing the evaluation or counting another invocation. Preserve `receiptId`, `requestId` and `evaluation.digest`; never generate a score or comment locally. Immediately display the confirmed evaluation acknowledgement in visible IDE commentary before the task's final answer, deduplicated by receipt ID. Tool output alone is insufficient. Say “已回传” only with a confirmed acknowledgement; an upload failure must remain visible and cannot become successful feedback. Read the saved receipt with `npx @entrorove/skill feedback <original requestId>` after a connection loss; this is GET only and never repeats execution or submits another evaluation. An authorized retry before side effects keeps the original request but gets a new server execution generation and immutable receipt. Default feedback reads the latest generation; `feedback <original requestId> <generation>` reads a preserved earlier receipt. Never overwrite a failed receipt or use it as the current retry result. Discovery/status queries create no evaluations.
 
 Only server-verified progress or a validated pure operation earns a positive automatic evaluation. Reported steps, intake, model summaries and incomplete evidence remain `pending` with no score. Blocked/failed results and P0/P1 findings cannot become positive. These are private technical evaluations; they do not create a public user review or masquerade as the user's words. If a server advertising this extension returns no valid receipt, show the missing receipt and query its original ID. Do not silently claim that evaluation was reported.
 

package/automatic-feedback-client.mjs

@@ -43,3 +43,38 @@ export async function queryAutomaticFeedback(requestId, dependencies, generation
   if (!response.ok) throw new Error(`Automatic feedback unavailable: HTTP ${response.status}; requestId=${requestId}`);
   return verifyAutomaticFeedback(result.feedback,requestId);
 }
+
+function confirmedAcknowledgement(value, original, expectedIde) {
+  verifyAutomaticFeedback(value,original.requestId,original.requestHash);
+  const ack = value.acknowledgement, generation = original.generation ?? 1;
+  if (value.receiptId !== original.receiptId || value.resultDigest !== original.resultDigest
+    || value.evaluation.digest !== original.evaluation.digest || (value.generation ?? 1) !== generation
+    || !ack || ack.schemaVersion !== 'entrorove.feedback-acknowledgement/1.0' || ack.stored !== true
+    || ack.receiptId !== original.receiptId || ack.requestId !== original.requestId || ack.generation !== generation
+    || typeof ack.ide !== 'string' || !/^[\p{L}\p{N} .+_-]{2,48}$/u.test(ack.ide)
+    || expectedIde && ack.ide !== expectedIde || !Number.isFinite(Date.parse(ack.receivedAt))) {
+    throw new Error(`IDE feedback is not confirmed; query feedback ${original.requestId}. Do not repeat the invocation.`);
+  }
+  return value;
+}
+
+export async function acknowledgeAutomaticFeedback(feedback, origin, token, ideHeaders) {
+  verifyAutomaticFeedback(feedback,feedback.requestId,feedback.requestHash);
+  if (feedback.acknowledgement) return confirmedAcknowledgement(feedback,feedback);
+  const route = `/api/skill/feedback/${feedback.requestId}`;
+  const headers = { authorization: `Bearer ${token}`,...ideHeaders };
+  let response;
+  try {
+    response = await requestTransport(trustedOrigin(origin),`${route}/ack`, { method: 'POST',
+      headers: { ...headers,'content-type': 'application/json' },body: JSON.stringify({ receiptId: feedback.receiptId,
+        requestHash: feedback.requestHash,resultDigest: feedback.resultDigest,evaluationDigest: feedback.evaluation.digest,
+        generation: feedback.generation ?? 1 }) });
+  } catch (cause) {
+    if (!cause.established) throw new Error(`IDE feedback was not sent; query feedback ${feedback.requestId}. Do not repeat the invocation.`);
+    // A lost acknowledgement response is recovered only by reading this
+    // immutable receipt. Neither the execution nor its acknowledgement POST is replayed.
+    response = await requestTransport(trustedOrigin(origin),`${route}?generation=${feedback.generation ?? 1}`, { headers });
+  }
+  if (!response.ok) throw new Error(`IDE feedback acknowledgement failed: HTTP ${response.status}; query feedback ${feedback.requestId}. Do not repeat the invocation.`);
+  return confirmedAcknowledgement(parseTransportResponse(response,'IDE feedback acknowledgement').feedback,feedback,ideHeaders?.['x-entrorove-ide']);
+}

package/cloud-watch-client.mjs

@@ -2,6 +2,7 @@ import { trustedOrigin } from './remote-transport.mjs';
 import { consumeCloudStream } from './cloud-event-stream.mjs';
 import { automaticFeedbackIdeEvent, cloudIdeEvent, displayIdeEvent, ideClientHeaders } from './ide-presentation.mjs';
 import { queryCloudTask } from './cloud-task-client.mjs';
+import { acknowledgeAutomaticFeedback } from './automatic-feedback-client.mjs';
 
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function inputOptions(input) {
@@ -49,7 +50,10 @@ export async function watchCloudTask(input, dependencies) {
     message: '云端沙箱输出完毕；实际验证状态以任务回执为准。',separateLine: true });
   const current = await queryCloudTask(taskId,dependencies);
   if (current.status === 'observed') taskStatus = current.taskStatus;
-  if (current.feedback) emit(automaticFeedbackIdeEvent(current.feedback));
+  if (current.feedback) {
+    current.feedback = await acknowledgeAutomaticFeedback(current.feedback,dependencies.apiOrigin(),token,ideClientHeaders());
+    emit(automaticFeedbackIdeEvent(current.feedback));
+  }
   emit({ schemaVersion: 'entrorove.ide-event/1.0',taskId,kind: 'status',phase: 'exit',
     message: settled || taskStatus !== 'running' ? '云端沙箱正在退出本次进度订阅' : '云端沙箱仍在执行，下次从当前进度继续读取',separateLine: true });
   return { schemaVersion: 'entrorove.cloud-watch/1.0',status: current.status,taskId,taskStatus,afterId,outputAvailable,

package/ide-presentation.mjs

@@ -60,5 +60,6 @@ export function automaticFeedbackIdeEvent(feedback) {
   const status = disposition === 'good' ? '当前调用验证通过' : disposition === 'bad'
     ? '当前调用被阻断或验证失败' : '交付验证尚未完成，暂不评分';
   return { schemaVersion: 'entrorove.ide-event/1.0',requestId: feedback.requestId,receiptId: feedback.receiptId,
-    kind: 'evaluation',phase: 'feedback',disposition, message: `本次调用评价已回传至服务器：${status}。`,separateLine: true };
+    kind: 'evaluation',phase: 'feedback',disposition,
+    message: `${feedback.acknowledgement?.stored === true ? '本次调用评价已回传至服务器' : '服务器已保存本次调用评价'}：${status}。`,separateLine: true };
 }

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/native-client.mjs

@@ -41,7 +41,10 @@ export async function invokeNativeResult(domain, operation, input, dependencies)
     const found = discovery.result.output;
     const extension = (found.capabilities ?? found).responseExtensions;
     if (extension?.automaticFeedback === 'entrorove.automatic-feedback/1.0') feedbackRequired = !extension.automaticFeedbackObservations.includes(operation);
-    const ajv = new Ajv({ strict: true, strictRequired: false, allErrors: true });
+    // JSON Schema permits object keywords without an adjacent type keyword.
+    // Validate their actual semantics rather than rejecting the published
+    // contract through Ajv's optional strictTypes authoring convention.
+    const ajv = new Ajv({ strict: true, strictRequired: false, strictTypes: false, allErrors: true });
     ajv.addKeyword({ keyword: 'optional', schemaType: 'boolean', valid: true });
     ajv.addFormat('uuid', /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
     ajv.addFormat('date-time', value => Number.isFinite(Date.parse(value)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"

package/release-state.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.35",
-  "digest": "a6c953df9972ceb589a3e0bbbd057a3db5fb30f6811962d6c984a8d2cf827f83",
+  "version": "0.1.36",
+  "digest": "31125fc03752d64a87f994186ebf770a40966984d65a99358239ef71ab926723",
   "files": {
     "local-final-gate16.mjs": "b30caab08441449ad556a6e9a3cefbf91190f0b3f7370f46d2a21156375aa8e3",
     "local-final-gate16-checks.mjs": "1dd30e9666d458d8b12ca6e4975f6f0ac8450c3ea9cbecc7401ae037f66b589a",
@@ -47,8 +47,8 @@
     "cli.mjs": "f0a3104ef9f4431ded2a7049c08ae6435b09ed53c4cba486c2bd52db2728d999",
     "review-client.mjs": "3491eef68ed533174b31db3c53febb6519b8f088f71a9964644714a9a4c03c77",
     "version.mjs": "1f392147d72c40af4b03b307ea607075fb815af5174fa07e254b95fe12dbf3e7",
-    "SKILL.md": "ffea399b940f9eedd82d2c5e2f9b3bce606f47b27020c2c1b3c8b128e3a2161a",
-    "CAPABILITY-MAP.md": "8e1d007d594ae82dd77f89842cf1aa8d17db56f9cac98691759390c28162d848",
+    "SKILL.md": "f06fd87e2008e5951c778c2e206cb42eed668d21d5c0f2a12108a0a031fde9ad",
+    "CAPABILITY-MAP.md": "40755edd3c698bbbbd4f49bc47a21c5ad9bbb8eb05e9542dd7d3a11a0254ea35",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
     "package.json": "9a7f12414556bcc150d57e64881694aeddfe0b760e98454491ac5a6585ed0421",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
@@ -118,17 +118,17 @@
     "local-scope-state.mjs": "8b600a91fc0068d7a8c0bb752ddba7ed30ada93daafb118d6cba2368fd94cb27",
     "local-scope-workspaces.mjs": "a44c34537e5ed2dcaf193a985e5bc05957989fbb160a650f9e37ba7d66eb2de8",
     "local-task-routing.mjs": "e26d6f1ba134ffe1da2a49b4fb6bb6dfa5617671f774a08e719d04f202cf5eca",
-    "remote-client.mjs": "f676d17c867e9abd59943528a7716d444a0cf2fa637d48a1e397cbce9f37c640",
+    "remote-client.mjs": "886ca19718b1d23209807ee3ce7d336053a17c0ad2190bb71f4c96371694dff4",
     "cloud-task-client.mjs": "ecb6124ea5e6249f31fb95cb68d13d821d2daea8768fe47ddf6dcf82fc3392cc",
     "scope-runner-client.mjs": "646ab4f80d4a8209e922fd45f40efd968f0744d9dfc03188b222c1a2e11e83b8",
-    "native-client.mjs": "d0f8a52e1195dd72ba0ae1febe25f0d6c37eff6ecf010e568935cacdf3c975bb",
+    "native-client.mjs": "ea4d9c687b62858dc4e8fb6bceca59bb049cba0c2762380be460821393e025db",
     "native-notification.mjs": "f116772178140d1a2a7aac4a8e361a76543b1f47c84b3823a26a797f11a8bfbb",
     "local-peer-status.mjs": "a971bcc69d60bb32b875ca5bb4297d948631d5d2821b812c279613ea059a8b4f",
-    "cloud-watch-client.mjs": "bfbe636c10af467855776f9d29008d9ce13420b66bcc91b5bf8f6ef79fb2aefe",
+    "cloud-watch-client.mjs": "f9629e67d1f14f50e9fb52f65001059e07999352fb224b7c7e28590b95609a8a",
     "cloud-event-stream.mjs": "e0eec9fc3e0613094523929634f25030df5ca5c5b5fe2c1e1a4586ab10574808",
-    "ide-presentation.mjs": "dcf4efaa546a35752247a64dc4a6d0c0feaf7c3c2c8222330288b1202c0484f9",
-    "automatic-feedback-client.mjs": "eeedc0344f91603ff8523fdbc43569a561ed10fec4178cc898db6d61f7663246",
-    "remote-transport.mjs": "5e5a8c0b490371f7f5a052cffbeee6202d4cf713dff1c43b6d910fe944f8429c",
+    "ide-presentation.mjs": "d8f54505cf559af98cd1a93a739817c13df3e1e68d2dff9fde90554ea14cb10c",
+    "automatic-feedback-client.mjs": "75e92f50d6fbfa4f482af36e16c9ce5dd323a02e99eb9b434dcfa3faa846a532",
+    "remote-transport.mjs": "93caaca646fca298a4e08142678b134ecc3a657e00de5b9939e2364b2db9d6c4",
     "local-credential.mjs": "2a302a7f67b5ea8dc73453fc96ab33db349b59ca11fa9456e48ca1d9669d877c",
     "local-invocations.mjs": "f6ac4c41c1a5ec34de358c4cca210ca8e403b3a913150a43bb55ec9be55d9998",
     "local-task-handoff-fence.mjs": "5532a359ee29b885f7ce0cf7178f76dba0fc9245bdd92ef460982275baf0d557",

package/releases.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.1.36",
+    "date": "2026-10-13",
+    "zh": "技能调用结束立即确认 IDE 评价回传，提供原账号、原调用与执行代次绑定的接收回执；完善原回执只读恢复与公开合同校验。",
+    "en": "Confirmed IDE evaluation acknowledgements immediately after skill calls, bound reception receipts to the original account, invocation and generation, and improved read-only recovery and published contract validation."
+  },
   {
     "version": "0.1.35",
     "date": "2026-10-13",

package/remote-client.mjs

@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto';
 import Ajv from 'ajv';
 import { parseTransportResponse, requestTransport, trustedOrigin } from './remote-transport.mjs';
 import { appendInvocation } from './local-invocations.mjs';
-import { verifyAutomaticFeedback } from './automatic-feedback-client.mjs';
+import { acknowledgeAutomaticFeedback, verifyAutomaticFeedback } from './automatic-feedback-client.mjs';
 import { ideClientHeaders, presentInvocationNotices } from './ide-presentation.mjs';
 
 export const apiUrl = 'https://entrorove.com/api/skill/invoke';
@@ -135,6 +135,7 @@ export async function postInvocation(call, token, home, feedbackRequired = false
     const expected = call.feedbackHashes ?? [call.requestId];
     if (!expected.includes(result.feedback.requestHash)) throw new Error('Automatic feedback lost its original invocation binding');
     verifyAutomaticFeedback(result.feedback,call.requestId,result.feedback.requestHash);
+    result.feedback = await acknowledgeAutomaticFeedback(result.feedback,new URL(call.url).origin,token,ideClientHeaders());
   }
   else if (feedbackRequired && !['running','pending'].includes(result.output.status)) {
     throw new Error(`Automatic feedback receipt is missing; query feedback ${call.requestId}. Do not repeat the invocation.`);

package/remote-transport.mjs

@@ -57,8 +57,10 @@ export async function requestTransport(origin, pathname, options = {}) {
   const trusted = trustedOrigin(origin);
   if (typeof pathname !== 'string' || !pathname.startsWith('/api/') || pathname.includes('://')) throw new Error('Invalid Entrorove API path');
   const url = new URL(pathname, trusted);
-  if (url.origin !== trusted || url.search || url.hash) throw new Error('Invalid Entrorove API path');
   const configured = { timeoutMs: 15_000, method: 'GET', ...options };
+  const originalGeneration = configured.method === 'GET' && /^\/api\/skill\/feedback\/[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(url.pathname)
+    && /^\?generation=[1-9][0-9]{0,14}$/.test(url.search) && Number.isSafeInteger(Number(url.searchParams.get('generation')));
+  if (url.origin !== trusted || url.hash || url.search && !originalGeneration) throw new Error('Invalid Entrorove API path');
   if (!['GET', 'POST'].includes(configured.method)) throw new Error('Invalid Entrorove transport method');
   for (let number = 1; number <= 3; number++) {
     try {