@entrorove/skill 0.1.49 → 0.1.51

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.51 — 2026-10-16
+
+- 修复入口阶段将自身生成的带引号 capabilities/unlock 命令误判为原生 Bash；正常 TypeScript 候选探测遇到普通文件祖先时继续回退，真实访问仍严格校验。路径拒绝会报告请求路径、阻断祖先、解析地址和原因。
+- Fixed entry guards misclassifying their own quoted capabilities/unlock commands as native shell. Read-only TypeScript probes skip nonexistent children beneath ordinary files and continue valid fallbacks; actual access remains strict. Rejections identify the requested path, blocking ancestor, resolved target and reason.
+
+## 0.1.50 — 2026-10-16
+
+- 修复 tsconfig 的 npm 配置继承，支持包与子路径、exports/typesVersions 及数组继承；按真实 pnpm 来源解析并记录配置哈希。依赖保持只读，越界及无法确定规范来源的引用报告具体路径和原因，保留原任务重试。
+- Fixed tsconfig inheritance from npm packages, including package subpaths, exports/typesVersions and ordered parent arrays. Resolve pnpm configurations from their actual locations and retain metadata hashes. Dependencies remain read-only; escaping or unrepresentable canonical references report their paths and reasons while preserving the original task for retry.
+
 ## 0.1.49 — 2026-10-16
 
 - 修复本地签名快照扫描大量源码时的内存耗尽：优先分析当前授权目标，为源码与语法树设置内存边界，并及时释放 Vue 解析缓存。未完整分析的引用明确保持未知，全仓文件哈希与变更核验继续保留；超限目标返回具体路径和限制，原 flow、范围与队列可保留后重试。

package/IDE-EXECUTION.md

@@ -4,6 +4,8 @@ Register or sign in by email at https://entrorove.com. Enter the account key onc
 
 If the IDE guard itself is the blocked step, run `entrorove unlock` directly from the affected IDE terminal. The command is offline and records a 15-minute lease bound to that IDE session; it does not call a hook, read a credential, accept the agreement, inspect the protocol or authorize project writes. The host session ID must be present in the environment or supplied as `ENTROROVE_SESSION`. Under the lease, `flow-cancel` and `flow-abandon` recover the original flow; successful `flow-abandon` releases its task binding in both the flow state and the IDE session record, even without a hook callback. Queued requests remain, and other IDE sessions stay guarded.
 
+Capability discovery and offline unlock remain administrative calls during `entry`, before a flow exists. The guard recognizes its own rendered commands with quoted identity assignments, their order changed, or a literal `env` prefix containing only supported host/session identities; it rewrites approved calls to the installed runtime and current session. This does not authorize native scripts or unbound project writes.
+
 To stop using Entrorove on this computer, run `entrorove uninstall` directly. It works offline, removes only the recorded Entrorove host hooks and pristine global skill, and leaves other host settings, credentials and task records in place. A hand-edited file is reported as preserved rather than deleted. This command does not inspect or change another project.
 
 Every invocation rereads that same credential file, including clients already running. After an authenticated account page supplies the current key and `configure` synchronizes it once, all tasks under the same OS user automatically use the new value. A revoked or expired key cannot obtain new permissions for itself: return to the authenticated account page and synchronize once through JSON stdin. Status recovery only queries the original request; it never rotates credentials or repeats the operation.
@@ -64,7 +66,7 @@ The v2 progress sequence is durable and ordered: the first runtime step reports
 
 When intake returns `workflow-gate`, connect the current repository before invoking that gate: run `npx @entrorove/skill scope-connect <absolute repositoryRoot>` with JSON `{"flowId":"<original flowId>","paths":["<existing source file>"]}` on stdin. Use the concrete existing source files in the task's scope; new files belong in the later plan's declared artifacts. The adapter enrolls an OS-private Ed25519 scope signer for this accepted account and task, answers a server challenge, copies and verifies real source files, and submits the signed facts. It sends hashes and scope metadata rather than source contents or the private key. Enrollment grants scope inspection only; execution evidence and write passes retain their separate authority checks. An operator-configured signer cannot be replaced. After a successful connection, use the returned `nextInput` for `continue`, or explicitly send `payload: {"targetFiles":["<same existing source file>"]}` to the original `workflow-gate`. The connector uses `paths`; the gate uses `targetFiles`. Refresh an expired snapshot by reconnecting the same flow and path set. Show an explicit blocked result; query the original request ID after an unknown transport outcome before considering another attempt.
 
-Scope inspection resolves aliases from actual `tsconfig.json` or `jsconfig.json`, including relative `extends`. For plugin source compiled by a host project whose config is outside the source's ancestors, include `importContexts: [{"sourcePrefix":"<plugin source directory>","configPath":"<actual host tsconfig.json>"}]` in `scope-connect` input. Inspect the real build configuration first; never invent an alias or mark an unresolved import as external. These context paths remain inside the repository, their hashes enter the signed facts, and the local task binding freezes them.
+Scope inspection resolves aliases from actual `tsconfig.json` or `jsconfig.json`, including relative and npm `extends` and ordered inheritance arrays. Npm configuration lookup uses the pinned TypeScript JSON-config resolver over controlled metadata reads, including scoped packages, subpaths, package `tsconfig`, `exports` and `typesVersions`. Read-only candidate probes treat a child beneath an ordinary file as absent so normal TypeScript fallbacks continue; actual sources, control files and mutation targets retain strict validation. Rejected paths report the requested path, blocking ancestor, resolved target and reason, including broken or cyclic dependency links. Configurations and package metadata enter the signed hashes; dependencies are read only, never executed. Repository-local pnpm links use their actual configuration location. Read-only external dependency packages support parents and mappings inside their reference boundary; references requiring an unrepresentable external canonical ancestor fail explicitly rather than selecting a different same-name repository package. For plugin source compiled by a host project whose config is outside the source's ancestors, include `importContexts: [{"sourcePrefix":"<plugin source directory>","configPath":"<actual host tsconfig.json>"}]` in `scope-connect` input. Inspect the real build configuration first; never invent an alias or mark an unresolved import as external. These context paths remain inside the repository, their hashes enter the signed facts, and the local task binding freezes them.
 
 Keep snapshot before-images distinct from a frozen execution plan's expected final file hashes. Controlled writes consume the original approved authority; the runner then verifies the actual planned final bytes. Never edit a signed plan or silently substitute a newer snapshot after an unknown or failed gate. Existing changes outside that authority require explicit revalidation of the same original flow.
 

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute an engineering task through Entrorove, preserving its origi
 
 # entrorove · 熵巡
 
-Version: 0.1.49.
+Version: 0.1.51.
 
 Entrorove applies to the whole task once selected. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 

package/ide-command.mjs

@@ -1,5 +1,30 @@
 import path from 'node:path';
 
+function literalWords(header) {
+  const words = [];
+  let word = '', quote = null, started = false;
+  for (let index = 0; index < header.length; index++) {
+    const character = header[index];
+    if (quote) {
+      if (character === quote) quote = null;
+      else if (quote === '"' && character === '\\') {
+        if (!['"', '\\'].includes(header[index + 1])) return null;
+        word += header[++index];
+      } else word += character;
+    } else if (character === "'" || character === '"') {
+      quote = character; started = true;
+    } else if (character === '\\') {
+      if (!["'", '"', '\\', ' ', '\t'].includes(header[index + 1])) return null;
+      word += header[++index]; started = true;
+    } else if (/\s/u.test(character)) {
+      if (started) { words.push(word); word = ''; started = false; }
+    } else { word += character; started = true; }
+  }
+  if (quote) return null;
+  if (started) words.push(word);
+  return words.length ? words : null;
+}
+
 // Deliberately accepts a small literal shell grammar. Unknown commands are not
 // classified as reads: the host must reject them or use the approved runner.
 export function literalCommand(command) {
@@ -14,30 +39,37 @@ export function literalCommand(command) {
     header = here[1];
   }
   if (/[\n\r\0`$<>;&|]/u.test(header)) return null;
-  const words = [], pattern = /\s*(?:'([^']*)'|"([^"\\]*)"|([^\s'"\\]+))/gu;
-  let match, end = 0;
-  while ((match = pattern.exec(header))) {
-    if (match.index !== end) return null;
-    words.push(match[1] ?? match[2] ?? match[3]); end = pattern.lastIndex;
-  }
-  if (end !== header.length || !words.length) return null;
+  const words = literalWords(header);
+  if (!words) return null;
   return { words, ...(input ? { input } : {}) };
 }
 
+function sdkWords(parsed) {
+  const words = [...parsed.words], seen = new Set();
+  const env = ['env', '/usr/bin/env', '/bin/env'].includes(words[0]);
+  if (env) words.shift();
+  while (words[0]?.includes('=')) {
+    const assignment = words.shift(), separator = assignment.indexOf('=');
+    const key = assignment.slice(0, separator), value = assignment.slice(separator + 1);
+    if (seen.has(key)) return null;
+    seen.add(key);
+    if (key === 'ENTROROVE_IDE') {
+      if (!/^[\p{L}\p{N} .+_-]{2,48}$/u.test(value)) return null;
+    } else if (!['ENTROROVE_SESSION', 'CODEX_THREAD_ID', 'CLAUDE_SESSION_ID'].includes(key)
+      || !/^[A-Za-z0-9_-]{1,200}$/u.test(value)) return null;
+  }
+  return words.length && (!env || seen.size) ? words : null;
+}
+
 export function sdkCommand(parsed, runtime) {
   if (!parsed) return null;
-  const words = [...parsed.words];
-  if (words[0]?.startsWith('ENTROROVE_IDE=')) {
-    if (!/^ENTROROVE_IDE=[\p{L}\p{N} .+_-]{2,48}$/u.test(words.shift())) return null;
-    while (['ENTROROVE_SESSION=', 'CODEX_THREAD_ID='].some(prefix => words[0]?.startsWith(prefix))) {
-      if (!/^[A-Z_]+=[A-Za-z0-9_-]{1,200}$/u.test(words.shift())) return null;
-    }
-  }
+  const words = sdkWords(parsed);
+  if (!words) return null;
   let args;
   if ([runtime.node, 'node'].includes(words[0]) && words[1] === runtime.cli) args = words.slice(2);
   else if (['npx', 'npx.cmd'].includes(path.basename(words[0]))) {
     words.shift();
-    while (['--yes', '--prefer-online'].includes(words[0])) words.shift();
+    while (['--yes', '--prefer-online', '--registry=https://registry.npmjs.org'].includes(words[0])) words.shift();
     if (!['@entrorove/skill', '@entrorove/skill@latest', `@entrorove/skill@${runtime.version}`].includes(words.shift())) return null;
     args = words;
   } else if (path.basename(words[0]) === 'entrorove') {
@@ -83,6 +115,6 @@ export function readCommand(parsed) {
 
 export function renderSdkCommand(call, runtime, sessionId, host = process.env.ENTROROVE_IDE ?? 'Codex') {
   const quote = value => `'${String(value).replace(/'/gu, "'\\''")}'`;
-  const header = `ENTROROVE_IDE=${host} ENTROROVE_SESSION=${quote(sessionId)} CODEX_THREAD_ID=${quote(sessionId)} ${[runtime.node, runtime.cli, ...call.args].map(quote).join(' ')}`;
+  const header = `ENTROROVE_IDE=${quote(host)} ENTROROVE_SESSION=${quote(sessionId)} CODEX_THREAD_ID=${quote(sessionId)} ${[runtime.node, runtime.cli, ...call.args].map(quote).join(' ')}`;
   return call.input ? `${header} <<'ENTROROVE_INPUT'\n${JSON.stringify(call.input)}\nENTROROVE_INPUT` : header;
 }

package/local-scope-config-extends.mjs

@@ -0,0 +1,71 @@
+import path from 'node:path';
+import ts from 'typescript';
+
+const virtualRoot = '/entrorove-repository/';
+export function assertScopeConfigReference(from, resolved, boundary, field) {
+  if (boundary && resolved !== boundary.path && !resolved.startsWith(`${boundary.path}/`)) {
+    throw new Error(`Scope tsconfig ${field} from "${from}" (canonical "${boundary.resolved}") resolves to "${resolved}" outside read-only dependency reference "${boundary.path}"; its external canonical base cannot be represented inside the authorized repository`);
+  }
+  return resolved;
+}
+function repositoryPath(filename, within) {
+  const normalized = path.posix.normalize(filename);
+  if (!normalized.startsWith(virtualRoot)) return null;
+  return within('', normalized.slice(virtualRoot.length), false, 'extends resolution');
+}
+function validatePackageConfig(relative, source, within, referenceRoot) {
+  if (!relative.endsWith('/package.json')) return;
+  let manifest;
+  try { manifest = JSON.parse(source); }
+  catch { throw new Error(`Scope npm extends package metadata is invalid JSON: ${relative}`); }
+  if (typeof manifest?.tsconfig === 'string') {
+    const resolved = within(path.posix.dirname(relative), manifest.tsconfig, false, `package tsconfig in ${relative}`);
+    assertScopeConfigReference(relative, resolved, referenceRoot(relative), `package tsconfig ${JSON.stringify(manifest.tsconfig)}`);
+  }
+}
+
+/** Replay the pinned TypeScript resolver over asynchronously authorized metadata only. */
+export async function scopeNpmConfig(metadata, fromConfig, specifier, within, canonicalPath, referenceRoot) {
+  if (specifier.split('/').some(part => !part || part === '.' || part === '..')) {
+    throw new Error(`Scope tsconfig extends has an invalid npm specifier: ${JSON.stringify(specifier)} in ${fromConfig}`);
+  }
+  if (referenceRoot(fromConfig)) {
+    const boundary = referenceRoot(fromConfig);
+    throw new Error(`Scope tsconfig npm extends ${JSON.stringify(specifier)} from "${fromConfig}" resolves through external canonical configuration "${boundary.resolved}"; ancestor package lookup outside dependency reference "${boundary.path}" cannot be represented inside the authorized repository`);
+  }
+  const sources = new Map(), pending = Symbol('authorized-config-read');
+  const lookup = filename => {
+    const relative = repositoryPath(filename, within);
+    if (relative === null) return null;
+    if (!sources.has(relative)) throw { pending, relative };
+    return sources.get(relative);
+  };
+  const host = {
+    fileExists: filename => lookup(filename) !== null,
+    readFile: filename => lookup(filename) ?? undefined,
+    getCurrentDirectory: () => virtualRoot.slice(0, -1),
+    getGlobalTypingsCacheLocation: () => virtualRoot.slice(0, -1),
+    useCaseSensitiveFileNames: true,
+    realpath: filename => {
+      const relative = repositoryPath(filename, within);
+      return relative === null ? filename : virtualRoot + within('', canonicalPath(relative), false, 'dependency realpath');
+    },
+  };
+  for (let probes = 0; probes < 1024; probes++) {
+    try {
+      const result = ts.nodeNextJsonConfigResolver(specifier, virtualRoot + fromConfig, host);
+      if (!result.resolvedModule) {
+        throw new Error(`Scope tsconfig npm extends ${JSON.stringify(specifier)} in ${fromConfig} references a missing or unexported actual configuration within the authorized repository`);
+      }
+      const relative = repositoryPath(result.resolvedModule.resolvedFileName, within);
+      if (relative === null) throw new Error(`Scope tsconfig npm extends ${JSON.stringify(specifier)} resolved outside the authorized repository`);
+      return relative;
+    } catch (error) {
+      if (error?.pending !== pending) throw error;
+      const source = await metadata(error.relative);
+      if (source !== null) validatePackageConfig(error.relative, source, within, referenceRoot);
+      sources.set(error.relative, source);
+    }
+  }
+  throw new Error(`Scope tsconfig npm extends ${JSON.stringify(specifier)} in ${fromConfig} exceeds the 1024-metadata-probe bound`);
+}

package/local-scope-config-imports.mjs

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import ts from 'typescript';
+import { scopeNpmConfig, assertScopeConfigReference } from './local-scope-config-extends.mjs';
 const missing = (error) => ['ENOENT', 'ENOTDIR'].includes(error?.code ?? '');
 function literal(value, field) {
     if (typeof value !== 'string' || !value || value !== value.trim() || value !== value.normalize('NFC')
@@ -81,6 +82,11 @@ function pathMatch(paths, specifier) {
     }
     return selected;
 }
+function configCandidate(resolution, target) {
+    const base = resolution.baseUrl ?? resolution.pathsOrigin;
+    const boundary = resolution.baseUrl === undefined ? resolution.pathsReferenceRoot : resolution.baseUrlReferenceRoot;
+    return assertScopeConfigReference(base || '.', within(base, target), boundary, `mapping ${JSON.stringify(target)}`);
+}
 function importCandidates(resolution, specifier) {
     if (typeof specifier !== 'string' || !specifier)
         throw new Error('Scope tsconfig import specifier must be nonempty');
@@ -92,18 +98,14 @@ function importCandidates(resolution, specifier) {
     }
     const match = pathMatch(resolution?.paths, specifier);
     if (match) {
-        const base = resolution.baseUrl ?? resolution.pathsOrigin;
-        return [...new Set(match.targets.map(target => within(base, target.replace('*', match.wildcard))))];
+        return [...new Set(match.targets.map(target => configCandidate(resolution, target.replace('*', match.wildcard))))];
     }
     if (specifier.startsWith('@/') || specifier.startsWith('#') || specifier.startsWith('~/')) {
         throw new Error('Scope local import alias requires an actual tsconfig or package-import mapping');
     }
-    return resolution?.baseUrl !== undefined ? [within(resolution.baseUrl, specifier)] : [];
+    return resolution?.baseUrl !== undefined ? [configCandidate(resolution, specifier)] : [];
 }
-export async function scopeTsconfigImports(read, fromFile, configPath) {
-    const canonical = within('', fromFile);
-    if (canonical !== fromFile)
-        throw new Error('Scope tsconfig source path must be canonical within the repository');
+function configObservations(read) {
     const observed = new Map();
     const absent = new Set();
     let bytes = 0;
@@ -135,34 +137,50 @@ export async function scopeTsconfigImports(read, fromFile, configPath) {
         observed.set(relative, item);
         return data.toString('utf8');
     };
+    return { metadata, canonicalPath: relative => observed.get(relative)?.realPath ?? relative,
+        referenceRoot: relative => observed.get(relative)?.referenceRoot,
+        observations: () => [...observed.keys()].sort().map(relative => ({ path: relative, sha256: observed.get(relative).sha256 })) };
+}
+export async function scopeTsconfigImports(read, fromFile, configPath) {
+    const canonical = within('', fromFile);
+    if (canonical !== fromFile)
+        throw new Error('Scope tsconfig source path must be canonical within the repository');
+    const { metadata, canonicalPath, referenceRoot, observations } = configObservations(read);
+    let configurations = 0;
     const load = async (relative, ancestors, depth = 0) => {
-        if (depth >= 10)
-            throw new Error('Scope tsconfig extends exceeds the 10-configuration depth bound');
+        if (depth >= 10 || ++configurations > 512)
+            throw new Error('Scope tsconfig extends exceeds its 10-configuration depth or 512-configuration inspection bound');
         let source = await metadata(relative);
         if (source === null && !relative.endsWith('.json')) {
             relative += '.json';
             source = await metadata(relative);
         }
         if (source === null)
-            throw new Error('Scope tsconfig extends references a missing actual configuration');
+            throw new Error(`Scope tsconfig extends references a missing actual configuration: ${relative}`);
         if (ancestors.has(relative))
             throw new Error('Scope tsconfig extends contains a configuration cycle');
         const config = parsedConfig(relative, source);
         const directory = path.posix.dirname(relative) === '.' ? '' : path.posix.dirname(relative);
-        let inherited = { pathsOrigin: directory };
+        let inherited = {};
         if (config.extends !== undefined) {
-            const extended = literal(config.extends, 'extends');
-            if (!extended.startsWith('./') && !extended.startsWith('../'))
-                throw new Error('Scope tsconfig npm extends is unsupported; use an actual repository-relative extends');
-            inherited = await load(within(directory, extended, false, 'extends'), new Set([...ancestors, relative]), depth + 1);
+            const parents = Array.isArray(config.extends) ? config.extends : [config.extends];
+            if (parents.length > 128) throw new Error(`Scope tsconfig extends in ${relative} exceeds the 128-parent bound`);
+            for (const parent of parents) {
+                const extended = literal(parent, 'extends');
+                const target = extended.startsWith('./') || extended.startsWith('../')
+                    ? assertScopeConfigReference(relative, within(directory, extended, false, 'extends'), referenceRoot(relative), `extends ${JSON.stringify(extended)}`)
+                    : await scopeNpmConfig(metadata, relative, extended, within, canonicalPath, referenceRoot);
+                inherited = { ...inherited, ...await load(target, new Set([...ancestors, relative]), depth + 1) };
+            }
         }
         const options = config.compilerOptions === undefined ? {} : config.compilerOptions;
         if (!options || typeof options !== 'object' || Array.isArray(options))
             throw new Error('Scope tsconfig compilerOptions must be an object');
         const own = options;
         return { ...inherited,
-            ...(own.baseUrl === undefined ? {} : { baseUrl: within(directory, own.baseUrl, true, 'baseUrl') }),
-            ...(own.paths === undefined ? {} : { paths: pathsOption(own.paths), pathsOrigin: directory }) };
+            ...(own.baseUrl === undefined ? {} : { baseUrl: assertScopeConfigReference(relative, within(directory, own.baseUrl, true, 'baseUrl'), referenceRoot(relative), `baseUrl ${JSON.stringify(own.baseUrl)}`),
+                baseUrlReferenceRoot: referenceRoot(relative) }),
+            ...(own.paths === undefined ? {} : { paths: pathsOption(own.paths), pathsOrigin: directory, pathsReferenceRoot: referenceRoot(relative) }) };
     };
     let directory = path.posix.dirname(canonical);
     let resolution = null;
@@ -186,12 +204,11 @@ export async function scopeTsconfigImports(read, fromFile, configPath) {
     if (resolution?.paths)
         for (const targets of Object.values(resolution.paths))
             for (const target of targets) {
-                within(resolution.baseUrl ?? resolution.pathsOrigin, target.replace('*', '__scope_wildcard__'), false, 'mapping');
+                configCandidate(resolution, target.replace('*', '__scope_wildcard__'));
             }
     return { candidates: specifier => importCandidates(resolution, specifier), mapped: specifier => {
             if (typeof specifier !== 'string' || !specifier)
                 throw new Error('Scope tsconfig mapping lookup requires a nonempty specifier');
             return pathMatch(resolution?.paths, specifier) !== null;
-        }, observations: [...observed.keys()].sort()
-            .map(relative => ({ path: relative, sha256: observed.get(relative).sha256 })) };
+        }, observations: observations() };
 }

package/local-scope-files.mjs

@@ -36,6 +36,26 @@ async function assertDependencyReference(root, target, relative) {
   }
   return resolved;
 }
+async function invalidScopeTarget(root, relative, current, reason, cause) {
+  let resolved = current, resolutionError;
+  try { resolved = await fs.realpath(current); }
+  catch (error) {
+    resolutionError = error.code;
+    try { resolved = path.resolve(path.dirname(current), await fs.readlink(current)); }
+    catch { /* A non-directory ancestor is already its own blocking target. */ }
+  }
+  const blockingPath = path.relative(root, current).split(path.sep).join('/');
+  const explanation = {
+    'non-directory-ancestor': 'the ancestor is not a directory',
+    'symlink-not-allowed': 'strict scope access does not allow symlinks',
+    'unresolvable-symlink': 'the symlink cannot be resolved to an actual dependency target',
+    'not-regular-file': 'the source must be a regular file',
+    'unsupported-target-type': 'the target must be a regular file or directory',
+  }[reason];
+  const unavailable = cause || resolutionError;
+  throw Object.assign(new Error(`Scope path ${JSON.stringify(relative)} is blocked at ${JSON.stringify(blockingPath)} (${JSON.stringify(current)}), resolved to ${JSON.stringify(resolved)} because ${explanation}${unavailable ? ` (${unavailable})` : ''}`),
+    { code: 'ENTROROVE_FILE_INVALID', reason, path: relative, blockingPath, resolvedPath: resolved });
+}
 export async function scopeTarget(root, relative, allowMissing = false, allowDependency = false) {
   let current = root;
   const parts = scopePath(relative).split('/');
@@ -48,17 +68,32 @@ export async function scopeTarget(root, relative, allowMissing = false, allowDep
       throw error;
     }
     if (stat.isSymbolicLink()) {
-      if (!followDependency) scopeFail('ENTROROVE_FILE_INVALID', 'scope refuses symlink or non-directory ancestors');
-      await assertDependencyReference(root, current, relative);
-      stat = await fs.stat(current);
+      if (!followDependency) await invalidScopeTarget(root, relative, current, 'symlink-not-allowed');
+      try {
+        await assertDependencyReference(root, current, relative);
+        stat = await fs.stat(current);
+      } catch (error) {
+        if (['ENOENT', 'ENOTDIR', 'ELOOP'].includes(error.code)) {
+          await invalidScopeTarget(root, relative, current, 'unresolvable-symlink', error.code);
+        }
+        throw error;
+      }
     }
-    if (index < parts.length - 1 && !stat.isDirectory()) scopeFail('ENTROROVE_FILE_INVALID', 'scope refuses symlink or non-directory ancestors');
+    if (index < parts.length - 1 && !stat.isDirectory()) await invalidScopeTarget(root, relative, current, 'non-directory-ancestor');
     if (index === parts.length - 1) return { target: current, exists: true, stat, dependency: followDependency };
   }
 }
+// Only speculative, read-only resolver candidates may treat a non-directory ancestor as absent.
+export async function scopeProbeTarget(root, relative, allowDependency = false) {
+  try { return await scopeTarget(root, relative, true, allowDependency); }
+  catch (error) {
+    if (error.code !== 'ENTROROVE_FILE_INVALID' || error.reason !== 'non-directory-ancestor') throw error;
+    return { target: path.join(root, relative), exists: false, stat: null };
+  }
+}
 async function safeScopeRead(root, relative, input, allowDependency = true) {
   const dependency = allowDependency && dependencyReference(relative), target = await scopeTarget(root, relative, false, dependency);
-  if (!target.stat.isFile()) scopeFail('ENTROROVE_FILE_INVALID', 'scope source must be a regular file');
+  if (!target.stat.isFile()) await invalidScopeTarget(root, relative, target.target, 'not-regular-file');
   if (target.stat.size > 16_777_216) scopeFail('ENTROROVE_SCOPE_LIMIT', 'scope source exceeds the 16 MiB inspection bound');
   const handle = await fs.open(target.target, constants.O_RDONLY | (dependency ? 0 : (constants.O_NOFOLLOW ?? 0)));
   try {
@@ -87,7 +122,7 @@ export async function scopeFiles(root, requested, knownFiles = []) {
     const item = await scopeTarget(root, relative, known.has(relative));
     if (!item.exists) { found.add(relative); return; }
     if (item.stat.isFile()) { found.add(relative); return; }
-    if (!item.stat.isDirectory()) scopeFail('ENTROROVE_FILE_INVALID', 'scope target must be a regular file or directory');
+    if (!item.stat.isDirectory()) await invalidScopeTarget(root, relative, item.target, 'unsupported-target-type');
     for (const name of (await fs.readdir(item.target)).sort()) if (!excluded.has(name)) await visit(`${relative}/${name}`);
   }
   for (const relative of known) if (requested.some(target => target === '.' || target === relative || relative.startsWith(`${target}/`))) found.add(relative);

package/local-scope-repository.mjs

@@ -5,7 +5,7 @@ import { promisify } from 'node:util';
 import { builtinModules } from 'node:module';
 import ts from 'typescript';
 import { parse as parseVue, parseCache as vueParseCache } from '@vue/compiler-sfc';
-import { lineCount, observedScopeRisk, packageBoundary, scopeFail, scopeFiles, scopeRead, scopeTarget, stableScope } from './local-scope-files.mjs';
+import { lineCount, observedScopeRisk, packageBoundary, scopeFail, scopeFiles, scopeProbeTarget, scopeRead, scopeTarget, stableScope } from './local-scope-files.mjs';
 import { sha256 } from './local-integrity.mjs';
 import { workspaceImport, workspaceIndex } from './local-scope-workspaces.mjs';
 import { assertBudgetRunnerAllowed } from './local-budget-reads.mjs';
@@ -216,11 +216,32 @@ async function resolveImport(root, from, specifier, workspace, input, aliases, c
   return resolveLocalImport(root, relative);
 }
 const dependencyReference = relative => relative.split('/').includes('node_modules');
+async function externalConfigReference(root, relative, resolved) {
+  const parts = relative.split('/'); let previous = root, boundary;
+  for (let index = 1; index <= parts.length; index++) {
+    const prefix = parts.slice(0, index).join('/'), current = await fs.realpath(path.join(root, prefix));
+    if (current !== root && !current.startsWith(`${root}${path.sep}`) && current !== path.join(previous, parts[index - 1])) {
+      boundary = { path: prefix, resolved };
+    }
+    previous = current;
+  }
+  return boundary;
+}
+async function configMetadata(root, relative, input) {
+  const target = await scopeProbeTarget(root, relative, dependencyReference(relative));
+  if (!target.exists || !target.stat.isFile()) throw Object.assign(new Error(`Missing configuration file: ${relative}`), { code: 'ENOENT' });
+  const read = await scopeRead(root, relative, input), resolved = await fs.realpath(target.target);
+  const physical = path.relative(root, resolved).split(path.sep).join('/');
+  const outside = physical === '..' || physical.startsWith('../') || path.isAbsolute(physical);
+  const realPath = outside ? relative : physical;
+  const referenceRoot = outside ? await externalConfigReference(root, relative, resolved) : undefined;
+  return { path: relative, sha256: read.sha256, contentBase64: read.content.toString('base64'), realPath, referenceRoot };
+}
 async function resolveLocalImport(root, relative, required = true) {
   if (relative.startsWith('../') || relative === '..') scopeFail('ENTROROVE_PATH_UNSAFE', 'local import escapes the repository');
   const replacements = /\.js$/.test(relative) ? [relative.replace(/\.js$/, '.ts'), relative.replace(/\.js$/, '.tsx')] : [];
   for (const candidate of [relative, ...replacements, ...['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.vue', '.json', '.d.ts', '.d.mts', '.d.cts', '/index.js', '/index.ts', '/index.d.ts'].map(ext => relative + ext)]) {
-    const item = await scopeTarget(root, candidate, true, dependencyReference(candidate));
+    const item = await scopeProbeTarget(root, candidate, dependencyReference(candidate));
     if (item.exists && item.stat.isFile()) return candidate;
   }
   if (required) scopeFail('ENTROROVE_IMPORT_UNRESOLVED', 'a local import has no resolvable source file');
@@ -248,10 +269,7 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
     const contexts = (input.importContexts ?? []).filter(context => relative === context.sourcePrefix || relative.startsWith(`${context.sourcePrefix}/`))
       .sort((a, b) => b.sourcePrefix.length - a.sourcePrefix.length);
     const configPath = contexts[0]?.configPath;
-    const aliases = await scopeTsconfigImports(async target => {
-      const item = await scopeRead(root, target, input);
-      return { path: target, sha256: item.sha256, contentBase64: item.content.toString('base64') };
-    }, relative, configPath);
+    const aliases = await scopeTsconfigImports(target => configMetadata(root, target, input), relative, configPath);
     for (const observed of aliases.observations) metadata.set(observed.path, observed);
     const declarations = declarationModules(read.content, relative);
     const imports = importSpecifiers(read.content, relative); dynamic ||= imports.dynamic;
@@ -275,10 +293,7 @@ export async function scopeCandidateImports(root, file, input = { repositoryRoot
   const workspace = await workspaceIndex(root, input);
   const context = (input.importContexts ?? []).filter(item => file.path === item.sourcePrefix || file.path.startsWith(`${item.sourcePrefix}/`))
     .sort((a, b) => b.sourcePrefix.length - a.sourcePrefix.length)[0];
-  const aliases = await scopeTsconfigImports(async relative => {
-    const read = await scopeRead(root, relative, input);
-    return { path: relative, sha256: read.sha256, contentBase64: read.content.toString('base64') };
-  }, file.path, context?.configPath);
+  const aliases = await scopeTsconfigImports(relative => configMetadata(root, relative, input), file.path, context?.configPath);
   const declarations = declarationModules(Buffer.from(file.content), file.path), edges = [];
   for (const specifier of parsed.specifiers) {
     const target = await resolveImport(root, file.path, specifier, workspace, input, aliases, context?.configPath, declarations);

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.49",
+  "version": "0.1.51",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.49",
+  "version": "0.1.51",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -135,6 +135,7 @@
     "local-scope-repository.mjs",
     "local-scope-signature.mjs",
     "local-scope-config-imports.mjs",
+    "local-scope-config-extends.mjs",
     "local-scope-snapshot.mjs",
     "local-scope-state.mjs",
     "local-scope-workspaces.mjs",

package/release-state.json

@@ -1,10 +1,10 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.49",
-  "digest": "d30e520019bb53e3293bce84f1a960ccfa65462274c961dcc659194f2ddb3c45",
+  "version": "0.1.51",
+  "digest": "337302626679e547236186da4653bd37c5ed8aec25bd24999920488334426587",
   "files": {
     "ide-code-mode.mjs": "f3f53357ba09727b3b597851976a24de93287c0faca5052448277d0904bb61f7",
-    "ide-command.mjs": "dcd4b48305cc4f106e5e4509e794e4b46ef02de29afa9cccbbc2774308c81ff3",
+    "ide-command.mjs": "86472c2f89c17e13a6fb0e41794add983400aac3e626891dbb3812e34320e229",
     "ide-hook.mjs": "2f00e56de1e1149f117714d5dd334196f1a3f206c3bfab541393bc0f625e0108",
     "ide-install.mjs": "10247efadcfeef5da001022d12080bd0f789e67fdf7862bcc65db73dda3bbe57",
     "ide-session.mjs": "dc256e77b03303932d354768c0e79384340a3137e7421b4ae9c869f7e58e1a3a",
@@ -29,7 +29,7 @@
     "runtime/validator-runtime-v7.0.44.d.mts": "7797edbfe2f7de24da370204dce4dfd22822a1bd80df93514fff900b98afe36f",
     "snapshot-retention.mjs": "4f8919fe8ec49fb4c23e080a8ad2fa3a9282bca3fffe7cf55c64e89ef316697e",
     "snapshot-cleanup-journal.mjs": "76a9684cc95b4eb076e1298d78a9dff37948b00d9607b8f546c599072d3ed331",
-    "IDE-EXECUTION.md": "6c8b9abe17cc8f01aa3da2ab19ed34b2b9be3e3b38c1739fa6a7d763622c4864",
+    "IDE-EXECUTION.md": "2cb952bb919261e9e420c9d83659eba013e5b1b175d80da03b50b660edfe4f31",
     "REUSE-DISCIPLINE.md": "5b214cf313e7f715f52d54e28093a2d038f0f196ca64b15d1c49587b9d8eecf8",
     "reuse-discipline-release.mjs": "20ded9c21bd71b8779c454f5eba4c7c0a943ef99d94117b9bbef891d2ab6e3de",
     "local-final-gate16.mjs": "083aec470670e6cdb7ad2ab27b7a51b53a9ec3a8b4121cb9cbfa17d9940892c2",
@@ -81,9 +81,9 @@
     "CAPABILITY-MAP.md": "a0f0468a098725ced52a96dd8e22bfc7d1ce7681a8446ebf7dae3696c76c3385",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
     "DELIVERY-BOUNDARIES.md": "d1bb2895e23fc14bf1c76707bd1f6f03b39695501a78a0b7289dc37b099889dc",
-    "package.json": "8be823b5756da9b393af966a4152bee301cb49f988823aaf757e8c51bf867085",
+    "package.json": "cdb1f686304d5d29d1feff1b1ec5b75e4e3dcff1f1da841dfb59d0502ab261e8",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
-    "release.mjs": "34a3da868e8b5b586b318f2e8275f2f238d48a20afceb7d51c0f783a120f6973",
+    "release.mjs": "e206cb6cabbb02542317bce283f7ba674621e67765a3eacef5741f2d6b1c58b2",
     "local-cli.mjs": "11461e4cf4f6a8612ff275bf8296ec57ff22281156cb2c72834d3c764ba422a1",
     "local-state-lock.mjs": "1dbf64264642a0851faf043e07ee9f66d2ad0508e9f799b0626246e42fae893e",
     "local-execution.mjs": "46fddd78cd954fb080c660affe90cdaa716695580427336acb820089441a8025",
@@ -121,8 +121,8 @@
     "local-stage-boundary.mjs": "84c3bb5beab29306274c5ca8a78f19a83ed664ae1b93a8372bb493158b304fe3",
     "local-scope-candidate.mjs": "8f0bd9606e70d4a0ebacdd3cd600ec3afed85e2bb3e1760aa1144cf55d4e028a",
     "local-scope-context.mjs": "79753abfc6c76089d17f003a1be537dfaea10d6731c542f7fc53f2a9996ed164",
-    "local-scope-files.mjs": "96c301f2a45e5fa22f0b11fb15e5e564f118e53187fc7749263c78d5ed87b056",
-    "local-scope-repository.mjs": "75ccc7a527b741350c9de5baff031a9606f1b423c951f41307170605d1366360",
+    "local-scope-files.mjs": "4c14a5e226dd5518aeb37f199b1aa896943a66d41e5a1757a3b3fd8a79446d76",
+    "local-scope-repository.mjs": "5bdd92729faec9b30f70d57891d0779b3cbff78b8a6a21c98240cdb62f2109d1",
     "local-scope-git.mjs": "53bbbb6c4795db711b5bc164591a6ad79a561427da046d6bbe997dae6eb82829",
     "local-scope-git-reads.mjs": "5d8a2636bab955cb325cb693db7423e69512355887ae5b5af3b8cb615f5ddad0",
     "local-git-executable.mjs": "9391d716529025b1de3ee006df658a9d765b6ef29ad24ef9b7436829318e651e",
@@ -147,7 +147,8 @@
     "runtime/git-native-linux-v1.mjs": "cf5cb91426a105e62c0f07a8a230dec592dba46f85a3f708b4c4e8cfcd1126c6",
     "runtime/git-native-darwin-v1.mjs": "f88aab72dc86f94eb1115784872957cb8ed0f74205ae70e1ecd1939e7790e310",
     "local-scope-signature.mjs": "bd05e8cf9e23f9511a16844974362297b9e9d11930ff7b8ad2a490e8d7660fe9",
-    "local-scope-config-imports.mjs": "53e510609066355318d886cd96f73a0fc8005a28857f6ab4eb6cb81c4857945b",
+    "local-scope-config-imports.mjs": "a399407227bbdd14468633bb6d25586df7c6a30a1ef0d1a80ab7c7b499d3fadf",
+    "local-scope-config-extends.mjs": "3ab4150b846b247e9e0851221123f220c5574699af651830e751f026ab33659e",
     "local-scope-snapshot.mjs": "c0f851470b98863a1d187825ed61ee6072d1c057b178fdc85ae29af02a3b250f",
     "local-scope-state.mjs": "8b600a91fc0068d7a8c0bb752ddba7ed30ada93daafb118d6cba2368fd94cb27",
     "local-scope-workspaces.mjs": "a44c34537e5ed2dcaf193a985e5bc05957989fbb160a650f9e37ba7d66eb2de8",

package/release.mjs

@@ -90,6 +90,7 @@ const sourceFiles = [
   'runtime/git-native-darwin-v1.mjs',
   'local-scope-signature.mjs',
   'local-scope-config-imports.mjs',
+  'local-scope-config-extends.mjs',
   'local-scope-snapshot.mjs',
   'local-scope-state.mjs',
   'local-scope-workspaces.mjs',
@@ -340,6 +341,7 @@ function releaseLabels() {
     'local-scope-files.mjs': { zh: '范围文件与安全读取', en: 'scope files and guarded reads' },
     'local-scope-repository.mjs': { zh: '真实仓库范围事实', en: 'actual repository scope facts' },
     'local-scope-config-imports.mjs': { zh: 'tsconfig 范围路径与依赖只读引用', en: 'tsconfig scope paths and read-only dependency references' },
+    'local-scope-config-extends.mjs': { zh: 'tsconfig npm 配置继承解析', en: 'tsconfig npm configuration inheritance resolution' },
     'local-scope-git.mjs': { zh: '实际Git范围与变更事实', en: 'actual Git scope and change facts' },
     'local-scope-git-reads.mjs': { zh: '固定Git元数据与源码读取', en: 'fixed Git metadata and source reads' },
     'local-scope-git-comparison.mjs': { zh: 'Git范围比较接线', en: 'Git scope comparison wiring' },

package/releases.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.1.51",
+    "date": "2026-10-16",
+    "zh": "修复入口阶段将自身生成的带引号 capabilities/unlock 命令误判为原生 Bash；正常 TypeScript 候选探测遇到普通文件祖先时继续回退，真实访问仍严格校验。路径拒绝会报告请求路径、阻断祖先、解析地址和原因。",
+    "en": "Fixed entry guards misclassifying their own quoted capabilities/unlock commands as native shell. Read-only TypeScript probes skip nonexistent children beneath ordinary files and continue valid fallbacks; actual access remains strict. Rejections identify the requested path, blocking ancestor, resolved target and reason."
+  },
+  {
+    "version": "0.1.50",
+    "date": "2026-10-16",
+    "zh": "修复 tsconfig 的 npm 配置继承，支持包与子路径、exports/typesVersions 及数组继承；按真实 pnpm 来源解析并记录配置哈希。依赖保持只读，越界及无法确定规范来源的引用报告具体路径和原因，保留原任务重试。",
+    "en": "Fixed tsconfig inheritance from npm packages, including package subpaths, exports/typesVersions and ordered parent arrays. Resolve pnpm configurations from their actual locations and retain metadata hashes. Dependencies remain read-only; escaping or unrepresentable canonical references report their paths and reasons while preserving the original task for retry."
+  },
   {
     "version": "0.1.49",
     "date": "2026-10-16",