@entrorove/skill 0.1.49 → 0.1.50

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.50 — 2026-10-16
+
+- 修复 tsconfig 的 npm 配置继承，支持包与子路径、exports/typesVersions 及数组继承；按真实 pnpm 来源解析并记录配置哈希。依赖保持只读，越界及无法确定规范来源的引用报告具体路径和原因，保留原任务重试。
+- Fixed tsconfig inheritance from npm packages, including package subpaths, exports/typesVersions and ordered parent arrays. Resolve pnpm configurations from their actual locations and retain metadata hashes. Dependencies remain read-only; escaping or unrepresentable canonical references report their paths and reasons while preserving the original task for retry.
+
 ## 0.1.49 — 2026-10-16
 
 - 修复本地签名快照扫描大量源码时的内存耗尽：优先分析当前授权目标，为源码与语法树设置内存边界，并及时释放 Vue 解析缓存。未完整分析的引用明确保持未知，全仓文件哈希与变更核验继续保留；超限目标返回具体路径和限制，原 flow、范围与队列可保留后重试。

package/IDE-EXECUTION.md

@@ -64,7 +64,7 @@ The v2 progress sequence is durable and ordered: the first runtime step reports
 
 When intake returns `workflow-gate`, connect the current repository before invoking that gate: run `npx @entrorove/skill scope-connect <absolute repositoryRoot>` with JSON `{"flowId":"<original flowId>","paths":["<existing source file>"]}` on stdin. Use the concrete existing source files in the task's scope; new files belong in the later plan's declared artifacts. The adapter enrolls an OS-private Ed25519 scope signer for this accepted account and task, answers a server challenge, copies and verifies real source files, and submits the signed facts. It sends hashes and scope metadata rather than source contents or the private key. Enrollment grants scope inspection only; execution evidence and write passes retain their separate authority checks. An operator-configured signer cannot be replaced. After a successful connection, use the returned `nextInput` for `continue`, or explicitly send `payload: {"targetFiles":["<same existing source file>"]}` to the original `workflow-gate`. The connector uses `paths`; the gate uses `targetFiles`. Refresh an expired snapshot by reconnecting the same flow and path set. Show an explicit blocked result; query the original request ID after an unknown transport outcome before considering another attempt.
 
-Scope inspection resolves aliases from actual `tsconfig.json` or `jsconfig.json`, including relative `extends`. For plugin source compiled by a host project whose config is outside the source's ancestors, include `importContexts: [{"sourcePrefix":"<plugin source directory>","configPath":"<actual host tsconfig.json>"}]` in `scope-connect` input. Inspect the real build configuration first; never invent an alias or mark an unresolved import as external. These context paths remain inside the repository, their hashes enter the signed facts, and the local task binding freezes them.
+Scope inspection resolves aliases from actual `tsconfig.json` or `jsconfig.json`, including relative and npm `extends` and ordered inheritance arrays. Npm configuration lookup uses the pinned TypeScript JSON-config resolver over controlled metadata reads, including scoped packages, subpaths, package `tsconfig`, `exports` and `typesVersions`. Configurations and package metadata enter the signed hashes; dependencies are read only, never executed. Repository-local pnpm links use their actual configuration location. Read-only external dependency packages support parents and mappings inside their reference boundary; references requiring an unrepresentable external canonical ancestor fail explicitly rather than selecting a different same-name repository package. For plugin source compiled by a host project whose config is outside the source's ancestors, include `importContexts: [{"sourcePrefix":"<plugin source directory>","configPath":"<actual host tsconfig.json>"}]` in `scope-connect` input. Inspect the real build configuration first; never invent an alias or mark an unresolved import as external. These context paths remain inside the repository, their hashes enter the signed facts, and the local task binding freezes them.
 
 Keep snapshot before-images distinct from a frozen execution plan's expected final file hashes. Controlled writes consume the original approved authority; the runner then verifies the actual planned final bytes. Never edit a signed plan or silently substitute a newer snapshot after an unknown or failed gate. Existing changes outside that authority require explicit revalidation of the same original flow.
 

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute an engineering task through Entrorove, preserving its origi
 
 # entrorove · 熵巡
 
-Version: 0.1.49.
+Version: 0.1.50.
 
 Entrorove applies to the whole task once selected. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 

package/local-scope-config-extends.mjs

@@ -0,0 +1,71 @@
+import path from 'node:path';
+import ts from 'typescript';
+
+const virtualRoot = '/entrorove-repository/';
+export function assertScopeConfigReference(from, resolved, boundary, field) {
+  if (boundary && resolved !== boundary.path && !resolved.startsWith(`${boundary.path}/`)) {
+    throw new Error(`Scope tsconfig ${field} from "${from}" (canonical "${boundary.resolved}") resolves to "${resolved}" outside read-only dependency reference "${boundary.path}"; its external canonical base cannot be represented inside the authorized repository`);
+  }
+  return resolved;
+}
+function repositoryPath(filename, within) {
+  const normalized = path.posix.normalize(filename);
+  if (!normalized.startsWith(virtualRoot)) return null;
+  return within('', normalized.slice(virtualRoot.length), false, 'extends resolution');
+}
+function validatePackageConfig(relative, source, within, referenceRoot) {
+  if (!relative.endsWith('/package.json')) return;
+  let manifest;
+  try { manifest = JSON.parse(source); }
+  catch { throw new Error(`Scope npm extends package metadata is invalid JSON: ${relative}`); }
+  if (typeof manifest?.tsconfig === 'string') {
+    const resolved = within(path.posix.dirname(relative), manifest.tsconfig, false, `package tsconfig in ${relative}`);
+    assertScopeConfigReference(relative, resolved, referenceRoot(relative), `package tsconfig ${JSON.stringify(manifest.tsconfig)}`);
+  }
+}
+
+/** Replay the pinned TypeScript resolver over asynchronously authorized metadata only. */
+export async function scopeNpmConfig(metadata, fromConfig, specifier, within, canonicalPath, referenceRoot) {
+  if (specifier.split('/').some(part => !part || part === '.' || part === '..')) {
+    throw new Error(`Scope tsconfig extends has an invalid npm specifier: ${JSON.stringify(specifier)} in ${fromConfig}`);
+  }
+  if (referenceRoot(fromConfig)) {
+    const boundary = referenceRoot(fromConfig);
+    throw new Error(`Scope tsconfig npm extends ${JSON.stringify(specifier)} from "${fromConfig}" resolves through external canonical configuration "${boundary.resolved}"; ancestor package lookup outside dependency reference "${boundary.path}" cannot be represented inside the authorized repository`);
+  }
+  const sources = new Map(), pending = Symbol('authorized-config-read');
+  const lookup = filename => {
+    const relative = repositoryPath(filename, within);
+    if (relative === null) return null;
+    if (!sources.has(relative)) throw { pending, relative };
+    return sources.get(relative);
+  };
+  const host = {
+    fileExists: filename => lookup(filename) !== null,
+    readFile: filename => lookup(filename) ?? undefined,
+    getCurrentDirectory: () => virtualRoot.slice(0, -1),
+    getGlobalTypingsCacheLocation: () => virtualRoot.slice(0, -1),
+    useCaseSensitiveFileNames: true,
+    realpath: filename => {
+      const relative = repositoryPath(filename, within);
+      return relative === null ? filename : virtualRoot + within('', canonicalPath(relative), false, 'dependency realpath');
+    },
+  };
+  for (let probes = 0; probes < 1024; probes++) {
+    try {
+      const result = ts.nodeNextJsonConfigResolver(specifier, virtualRoot + fromConfig, host);
+      if (!result.resolvedModule) {
+        throw new Error(`Scope tsconfig npm extends ${JSON.stringify(specifier)} in ${fromConfig} references a missing or unexported actual configuration within the authorized repository`);
+      }
+      const relative = repositoryPath(result.resolvedModule.resolvedFileName, within);
+      if (relative === null) throw new Error(`Scope tsconfig npm extends ${JSON.stringify(specifier)} resolved outside the authorized repository`);
+      return relative;
+    } catch (error) {
+      if (error?.pending !== pending) throw error;
+      const source = await metadata(error.relative);
+      if (source !== null) validatePackageConfig(error.relative, source, within, referenceRoot);
+      sources.set(error.relative, source);
+    }
+  }
+  throw new Error(`Scope tsconfig npm extends ${JSON.stringify(specifier)} in ${fromConfig} exceeds the 1024-metadata-probe bound`);
+}

package/local-scope-config-imports.mjs

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import ts from 'typescript';
+import { scopeNpmConfig, assertScopeConfigReference } from './local-scope-config-extends.mjs';
 const missing = (error) => ['ENOENT', 'ENOTDIR'].includes(error?.code ?? '');
 function literal(value, field) {
     if (typeof value !== 'string' || !value || value !== value.trim() || value !== value.normalize('NFC')
@@ -81,6 +82,11 @@ function pathMatch(paths, specifier) {
     }
     return selected;
 }
+function configCandidate(resolution, target) {
+    const base = resolution.baseUrl ?? resolution.pathsOrigin;
+    const boundary = resolution.baseUrl === undefined ? resolution.pathsReferenceRoot : resolution.baseUrlReferenceRoot;
+    return assertScopeConfigReference(base || '.', within(base, target), boundary, `mapping ${JSON.stringify(target)}`);
+}
 function importCandidates(resolution, specifier) {
     if (typeof specifier !== 'string' || !specifier)
         throw new Error('Scope tsconfig import specifier must be nonempty');
@@ -92,18 +98,14 @@ function importCandidates(resolution, specifier) {
     }
     const match = pathMatch(resolution?.paths, specifier);
     if (match) {
-        const base = resolution.baseUrl ?? resolution.pathsOrigin;
-        return [...new Set(match.targets.map(target => within(base, target.replace('*', match.wildcard))))];
+        return [...new Set(match.targets.map(target => configCandidate(resolution, target.replace('*', match.wildcard))))];
     }
     if (specifier.startsWith('@/') || specifier.startsWith('#') || specifier.startsWith('~/')) {
         throw new Error('Scope local import alias requires an actual tsconfig or package-import mapping');
     }
-    return resolution?.baseUrl !== undefined ? [within(resolution.baseUrl, specifier)] : [];
+    return resolution?.baseUrl !== undefined ? [configCandidate(resolution, specifier)] : [];
 }
-export async function scopeTsconfigImports(read, fromFile, configPath) {
-    const canonical = within('', fromFile);
-    if (canonical !== fromFile)
-        throw new Error('Scope tsconfig source path must be canonical within the repository');
+function configObservations(read) {
     const observed = new Map();
     const absent = new Set();
     let bytes = 0;
@@ -135,34 +137,50 @@ export async function scopeTsconfigImports(read, fromFile, configPath) {
         observed.set(relative, item);
         return data.toString('utf8');
     };
+    return { metadata, canonicalPath: relative => observed.get(relative)?.realPath ?? relative,
+        referenceRoot: relative => observed.get(relative)?.referenceRoot,
+        observations: () => [...observed.keys()].sort().map(relative => ({ path: relative, sha256: observed.get(relative).sha256 })) };
+}
+export async function scopeTsconfigImports(read, fromFile, configPath) {
+    const canonical = within('', fromFile);
+    if (canonical !== fromFile)
+        throw new Error('Scope tsconfig source path must be canonical within the repository');
+    const { metadata, canonicalPath, referenceRoot, observations } = configObservations(read);
+    let configurations = 0;
     const load = async (relative, ancestors, depth = 0) => {
-        if (depth >= 10)
-            throw new Error('Scope tsconfig extends exceeds the 10-configuration depth bound');
+        if (depth >= 10 || ++configurations > 512)
+            throw new Error('Scope tsconfig extends exceeds its 10-configuration depth or 512-configuration inspection bound');
         let source = await metadata(relative);
         if (source === null && !relative.endsWith('.json')) {
             relative += '.json';
             source = await metadata(relative);
         }
         if (source === null)
-            throw new Error('Scope tsconfig extends references a missing actual configuration');
+            throw new Error(`Scope tsconfig extends references a missing actual configuration: ${relative}`);
         if (ancestors.has(relative))
             throw new Error('Scope tsconfig extends contains a configuration cycle');
         const config = parsedConfig(relative, source);
         const directory = path.posix.dirname(relative) === '.' ? '' : path.posix.dirname(relative);
-        let inherited = { pathsOrigin: directory };
+        let inherited = {};
         if (config.extends !== undefined) {
-            const extended = literal(config.extends, 'extends');
-            if (!extended.startsWith('./') && !extended.startsWith('../'))
-                throw new Error('Scope tsconfig npm extends is unsupported; use an actual repository-relative extends');
-            inherited = await load(within(directory, extended, false, 'extends'), new Set([...ancestors, relative]), depth + 1);
+            const parents = Array.isArray(config.extends) ? config.extends : [config.extends];
+            if (parents.length > 128) throw new Error(`Scope tsconfig extends in ${relative} exceeds the 128-parent bound`);
+            for (const parent of parents) {
+                const extended = literal(parent, 'extends');
+                const target = extended.startsWith('./') || extended.startsWith('../')
+                    ? assertScopeConfigReference(relative, within(directory, extended, false, 'extends'), referenceRoot(relative), `extends ${JSON.stringify(extended)}`)
+                    : await scopeNpmConfig(metadata, relative, extended, within, canonicalPath, referenceRoot);
+                inherited = { ...inherited, ...await load(target, new Set([...ancestors, relative]), depth + 1) };
+            }
         }
         const options = config.compilerOptions === undefined ? {} : config.compilerOptions;
         if (!options || typeof options !== 'object' || Array.isArray(options))
             throw new Error('Scope tsconfig compilerOptions must be an object');
         const own = options;
         return { ...inherited,
-            ...(own.baseUrl === undefined ? {} : { baseUrl: within(directory, own.baseUrl, true, 'baseUrl') }),
-            ...(own.paths === undefined ? {} : { paths: pathsOption(own.paths), pathsOrigin: directory }) };
+            ...(own.baseUrl === undefined ? {} : { baseUrl: assertScopeConfigReference(relative, within(directory, own.baseUrl, true, 'baseUrl'), referenceRoot(relative), `baseUrl ${JSON.stringify(own.baseUrl)}`),
+                baseUrlReferenceRoot: referenceRoot(relative) }),
+            ...(own.paths === undefined ? {} : { paths: pathsOption(own.paths), pathsOrigin: directory, pathsReferenceRoot: referenceRoot(relative) }) };
     };
     let directory = path.posix.dirname(canonical);
     let resolution = null;
@@ -186,12 +204,11 @@ export async function scopeTsconfigImports(read, fromFile, configPath) {
     if (resolution?.paths)
         for (const targets of Object.values(resolution.paths))
             for (const target of targets) {
-                within(resolution.baseUrl ?? resolution.pathsOrigin, target.replace('*', '__scope_wildcard__'), false, 'mapping');
+                configCandidate(resolution, target.replace('*', '__scope_wildcard__'));
             }
     return { candidates: specifier => importCandidates(resolution, specifier), mapped: specifier => {
             if (typeof specifier !== 'string' || !specifier)
                 throw new Error('Scope tsconfig mapping lookup requires a nonempty specifier');
             return pathMatch(resolution?.paths, specifier) !== null;
-        }, observations: [...observed.keys()].sort()
-            .map(relative => ({ path: relative, sha256: observed.get(relative).sha256 })) };
+        }, observations: observations() };
 }

package/local-scope-repository.mjs

@@ -216,6 +216,27 @@ async function resolveImport(root, from, specifier, workspace, input, aliases, c
   return resolveLocalImport(root, relative);
 }
 const dependencyReference = relative => relative.split('/').includes('node_modules');
+async function externalConfigReference(root, relative, resolved) {
+  const parts = relative.split('/'); let previous = root, boundary;
+  for (let index = 1; index <= parts.length; index++) {
+    const prefix = parts.slice(0, index).join('/'), current = await fs.realpath(path.join(root, prefix));
+    if (current !== root && !current.startsWith(`${root}${path.sep}`) && current !== path.join(previous, parts[index - 1])) {
+      boundary = { path: prefix, resolved };
+    }
+    previous = current;
+  }
+  return boundary;
+}
+async function configMetadata(root, relative, input) {
+  const target = await scopeTarget(root, relative, true, dependencyReference(relative));
+  if (!target.exists || !target.stat.isFile()) throw Object.assign(new Error(`Missing configuration file: ${relative}`), { code: 'ENOENT' });
+  const read = await scopeRead(root, relative, input), resolved = await fs.realpath(target.target);
+  const physical = path.relative(root, resolved).split(path.sep).join('/');
+  const outside = physical === '..' || physical.startsWith('../') || path.isAbsolute(physical);
+  const realPath = outside ? relative : physical;
+  const referenceRoot = outside ? await externalConfigReference(root, relative, resolved) : undefined;
+  return { path: relative, sha256: read.sha256, contentBase64: read.content.toString('base64'), realPath, referenceRoot };
+}
 async function resolveLocalImport(root, relative, required = true) {
   if (relative.startsWith('../') || relative === '..') scopeFail('ENTROROVE_PATH_UNSAFE', 'local import escapes the repository');
   const replacements = /\.js$/.test(relative) ? [relative.replace(/\.js$/, '.ts'), relative.replace(/\.js$/, '.tsx')] : [];
@@ -248,10 +269,7 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
     const contexts = (input.importContexts ?? []).filter(context => relative === context.sourcePrefix || relative.startsWith(`${context.sourcePrefix}/`))
       .sort((a, b) => b.sourcePrefix.length - a.sourcePrefix.length);
     const configPath = contexts[0]?.configPath;
-    const aliases = await scopeTsconfigImports(async target => {
-      const item = await scopeRead(root, target, input);
-      return { path: target, sha256: item.sha256, contentBase64: item.content.toString('base64') };
-    }, relative, configPath);
+    const aliases = await scopeTsconfigImports(target => configMetadata(root, target, input), relative, configPath);
     for (const observed of aliases.observations) metadata.set(observed.path, observed);
     const declarations = declarationModules(read.content, relative);
     const imports = importSpecifiers(read.content, relative); dynamic ||= imports.dynamic;
@@ -275,10 +293,7 @@ export async function scopeCandidateImports(root, file, input = { repositoryRoot
   const workspace = await workspaceIndex(root, input);
   const context = (input.importContexts ?? []).filter(item => file.path === item.sourcePrefix || file.path.startsWith(`${item.sourcePrefix}/`))
     .sort((a, b) => b.sourcePrefix.length - a.sourcePrefix.length)[0];
-  const aliases = await scopeTsconfigImports(async relative => {
-    const read = await scopeRead(root, relative, input);
-    return { path: relative, sha256: read.sha256, contentBase64: read.content.toString('base64') };
-  }, file.path, context?.configPath);
+  const aliases = await scopeTsconfigImports(relative => configMetadata(root, relative, input), file.path, context?.configPath);
   const declarations = declarationModules(Buffer.from(file.content), file.path), edges = [];
   for (const specifier of parsed.specifiers) {
     const target = await resolveImport(root, file.path, specifier, workspace, input, aliases, context?.configPath, declarations);

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.49",
+  "version": "0.1.50",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.49",
+  "version": "0.1.50",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -135,6 +135,7 @@
     "local-scope-repository.mjs",
     "local-scope-signature.mjs",
     "local-scope-config-imports.mjs",
+    "local-scope-config-extends.mjs",
     "local-scope-snapshot.mjs",
     "local-scope-state.mjs",
     "local-scope-workspaces.mjs",

package/release-state.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.49",
-  "digest": "d30e520019bb53e3293bce84f1a960ccfa65462274c961dcc659194f2ddb3c45",
+  "version": "0.1.50",
+  "digest": "c749866399a99cf122f71c00dca31cf49706a76f0998b7f3197d0763968468b5",
   "files": {
     "ide-code-mode.mjs": "f3f53357ba09727b3b597851976a24de93287c0faca5052448277d0904bb61f7",
     "ide-command.mjs": "dcd4b48305cc4f106e5e4509e794e4b46ef02de29afa9cccbbc2774308c81ff3",
@@ -29,7 +29,7 @@
     "runtime/validator-runtime-v7.0.44.d.mts": "7797edbfe2f7de24da370204dce4dfd22822a1bd80df93514fff900b98afe36f",
     "snapshot-retention.mjs": "4f8919fe8ec49fb4c23e080a8ad2fa3a9282bca3fffe7cf55c64e89ef316697e",
     "snapshot-cleanup-journal.mjs": "76a9684cc95b4eb076e1298d78a9dff37948b00d9607b8f546c599072d3ed331",
-    "IDE-EXECUTION.md": "6c8b9abe17cc8f01aa3da2ab19ed34b2b9be3e3b38c1739fa6a7d763622c4864",
+    "IDE-EXECUTION.md": "4e76abb3b2e357de07665d7422204ce710af3cafc0ef946816de73bf1a8998e6",
     "REUSE-DISCIPLINE.md": "5b214cf313e7f715f52d54e28093a2d038f0f196ca64b15d1c49587b9d8eecf8",
     "reuse-discipline-release.mjs": "20ded9c21bd71b8779c454f5eba4c7c0a943ef99d94117b9bbef891d2ab6e3de",
     "local-final-gate16.mjs": "083aec470670e6cdb7ad2ab27b7a51b53a9ec3a8b4121cb9cbfa17d9940892c2",
@@ -81,9 +81,9 @@
     "CAPABILITY-MAP.md": "a0f0468a098725ced52a96dd8e22bfc7d1ce7681a8446ebf7dae3696c76c3385",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
     "DELIVERY-BOUNDARIES.md": "d1bb2895e23fc14bf1c76707bd1f6f03b39695501a78a0b7289dc37b099889dc",
-    "package.json": "8be823b5756da9b393af966a4152bee301cb49f988823aaf757e8c51bf867085",
+    "package.json": "cdb1f686304d5d29d1feff1b1ec5b75e4e3dcff1f1da841dfb59d0502ab261e8",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
-    "release.mjs": "34a3da868e8b5b586b318f2e8275f2f238d48a20afceb7d51c0f783a120f6973",
+    "release.mjs": "e206cb6cabbb02542317bce283f7ba674621e67765a3eacef5741f2d6b1c58b2",
     "local-cli.mjs": "11461e4cf4f6a8612ff275bf8296ec57ff22281156cb2c72834d3c764ba422a1",
     "local-state-lock.mjs": "1dbf64264642a0851faf043e07ee9f66d2ad0508e9f799b0626246e42fae893e",
     "local-execution.mjs": "46fddd78cd954fb080c660affe90cdaa716695580427336acb820089441a8025",
@@ -122,7 +122,7 @@
     "local-scope-candidate.mjs": "8f0bd9606e70d4a0ebacdd3cd600ec3afed85e2bb3e1760aa1144cf55d4e028a",
     "local-scope-context.mjs": "79753abfc6c76089d17f003a1be537dfaea10d6731c542f7fc53f2a9996ed164",
     "local-scope-files.mjs": "96c301f2a45e5fa22f0b11fb15e5e564f118e53187fc7749263c78d5ed87b056",
-    "local-scope-repository.mjs": "75ccc7a527b741350c9de5baff031a9606f1b423c951f41307170605d1366360",
+    "local-scope-repository.mjs": "56d7874326de2f90e47cf13d6b9839372044ea70ab15fbb7f7125bd13a87a087",
     "local-scope-git.mjs": "53bbbb6c4795db711b5bc164591a6ad79a561427da046d6bbe997dae6eb82829",
     "local-scope-git-reads.mjs": "5d8a2636bab955cb325cb693db7423e69512355887ae5b5af3b8cb615f5ddad0",
     "local-git-executable.mjs": "9391d716529025b1de3ee006df658a9d765b6ef29ad24ef9b7436829318e651e",
@@ -147,7 +147,8 @@
     "runtime/git-native-linux-v1.mjs": "cf5cb91426a105e62c0f07a8a230dec592dba46f85a3f708b4c4e8cfcd1126c6",
     "runtime/git-native-darwin-v1.mjs": "f88aab72dc86f94eb1115784872957cb8ed0f74205ae70e1ecd1939e7790e310",
     "local-scope-signature.mjs": "bd05e8cf9e23f9511a16844974362297b9e9d11930ff7b8ad2a490e8d7660fe9",
-    "local-scope-config-imports.mjs": "53e510609066355318d886cd96f73a0fc8005a28857f6ab4eb6cb81c4857945b",
+    "local-scope-config-imports.mjs": "a399407227bbdd14468633bb6d25586df7c6a30a1ef0d1a80ab7c7b499d3fadf",
+    "local-scope-config-extends.mjs": "3ab4150b846b247e9e0851221123f220c5574699af651830e751f026ab33659e",
     "local-scope-snapshot.mjs": "c0f851470b98863a1d187825ed61ee6072d1c057b178fdc85ae29af02a3b250f",
     "local-scope-state.mjs": "8b600a91fc0068d7a8c0bb752ddba7ed30ada93daafb118d6cba2368fd94cb27",
     "local-scope-workspaces.mjs": "a44c34537e5ed2dcaf193a985e5bc05957989fbb160a650f9e37ba7d66eb2de8",

package/release.mjs

@@ -90,6 +90,7 @@ const sourceFiles = [
   'runtime/git-native-darwin-v1.mjs',
   'local-scope-signature.mjs',
   'local-scope-config-imports.mjs',
+  'local-scope-config-extends.mjs',
   'local-scope-snapshot.mjs',
   'local-scope-state.mjs',
   'local-scope-workspaces.mjs',
@@ -340,6 +341,7 @@ function releaseLabels() {
     'local-scope-files.mjs': { zh: '范围文件与安全读取', en: 'scope files and guarded reads' },
     'local-scope-repository.mjs': { zh: '真实仓库范围事实', en: 'actual repository scope facts' },
     'local-scope-config-imports.mjs': { zh: 'tsconfig 范围路径与依赖只读引用', en: 'tsconfig scope paths and read-only dependency references' },
+    'local-scope-config-extends.mjs': { zh: 'tsconfig npm 配置继承解析', en: 'tsconfig npm configuration inheritance resolution' },
     'local-scope-git.mjs': { zh: '实际Git范围与变更事实', en: 'actual Git scope and change facts' },
     'local-scope-git-reads.mjs': { zh: '固定Git元数据与源码读取', en: 'fixed Git metadata and source reads' },
     'local-scope-git-comparison.mjs': { zh: 'Git范围比较接线', en: 'Git scope comparison wiring' },

package/releases.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.1.50",
+    "date": "2026-10-16",
+    "zh": "修复 tsconfig 的 npm 配置继承，支持包与子路径、exports/typesVersions 及数组继承；按真实 pnpm 来源解析并记录配置哈希。依赖保持只读，越界及无法确定规范来源的引用报告具体路径和原因，保留原任务重试。",
+    "en": "Fixed tsconfig inheritance from npm packages, including package subpaths, exports/typesVersions and ordered parent arrays. Resolve pnpm configurations from their actual locations and retain metadata hashes. Dependencies remain read-only; escaping or unrepresentable canonical references report their paths and reasons while preserving the original task for retry."
+  },
   {
     "version": "0.1.49",
     "date": "2026-10-16",