@entrorove/skill 0.1.50 → 0.1.52

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.52 — 2026-10-17
+
+- 修复 Vue/TypeScript 的 Function 类型和真实 Vue 回调 prop 被误判为动态依赖；解析不可变 const 的有限语言模块导入，记录实际依赖与哈希。补齐 Vue 候选依赖检查；未知运行时导入报告文件、行列和原因。测试采用隔离用户目录，越界、动态执行、未知删除与原任务写入校验继续保留。
+- Fixed Vue/TypeScript Function types and genuine Vue callback props being misclassified as dynamic dependencies. Resolve finite immutable const-based language imports with actual dependency hashes and inspect Vue candidate dependencies. Unbounded runtime imports report file, line, column and reason. Tests use isolated user directories while path, dynamic-execution, unknown-deletion and original-task mutation checks remain enforced.
+
+## 0.1.51 — 2026-10-16
+
+- 修复入口阶段将自身生成的带引号 capabilities/unlock 命令误判为原生 Bash；正常 TypeScript 候选探测遇到普通文件祖先时继续回退，真实访问仍严格校验。路径拒绝会报告请求路径、阻断祖先、解析地址和原因。
+- Fixed entry guards misclassifying their own quoted capabilities/unlock commands as native shell. Read-only TypeScript probes skip nonexistent children beneath ordinary files and continue valid fallbacks; actual access remains strict. Rejections identify the requested path, blocking ancestor, resolved target and reason.
+
 ## 0.1.50 — 2026-10-16
 
 - 修复 tsconfig 的 npm 配置继承，支持包与子路径、exports/typesVersions 及数组继承；按真实 pnpm 来源解析并记录配置哈希。依赖保持只读，越界及无法确定规范来源的引用报告具体路径和原因，保留原任务重试。

package/IDE-EXECUTION.md

@@ -4,6 +4,8 @@ Register or sign in by email at https://entrorove.com. Enter the account key onc
 
 If the IDE guard itself is the blocked step, run `entrorove unlock` directly from the affected IDE terminal. The command is offline and records a 15-minute lease bound to that IDE session; it does not call a hook, read a credential, accept the agreement, inspect the protocol or authorize project writes. The host session ID must be present in the environment or supplied as `ENTROROVE_SESSION`. Under the lease, `flow-cancel` and `flow-abandon` recover the original flow; successful `flow-abandon` releases its task binding in both the flow state and the IDE session record, even without a hook callback. Queued requests remain, and other IDE sessions stay guarded.
 
+Capability discovery and offline unlock remain administrative calls during `entry`, before a flow exists. The guard recognizes its own rendered commands with quoted identity assignments, their order changed, or a literal `env` prefix containing only supported host/session identities; it rewrites approved calls to the installed runtime and current session. This does not authorize native scripts or unbound project writes.
+
 To stop using Entrorove on this computer, run `entrorove uninstall` directly. It works offline, removes only the recorded Entrorove host hooks and pristine global skill, and leaves other host settings, credentials and task records in place. A hand-edited file is reported as preserved rather than deleted. This command does not inspect or change another project.
 
 Every invocation rereads that same credential file, including clients already running. After an authenticated account page supplies the current key and `configure` synchronizes it once, all tasks under the same OS user automatically use the new value. A revoked or expired key cannot obtain new permissions for itself: return to the authenticated account page and synchronize once through JSON stdin. Status recovery only queries the original request; it never rotates credentials or repeats the operation.
@@ -64,7 +66,7 @@ The v2 progress sequence is durable and ordered: the first runtime step reports
 
 When intake returns `workflow-gate`, connect the current repository before invoking that gate: run `npx @entrorove/skill scope-connect <absolute repositoryRoot>` with JSON `{"flowId":"<original flowId>","paths":["<existing source file>"]}` on stdin. Use the concrete existing source files in the task's scope; new files belong in the later plan's declared artifacts. The adapter enrolls an OS-private Ed25519 scope signer for this accepted account and task, answers a server challenge, copies and verifies real source files, and submits the signed facts. It sends hashes and scope metadata rather than source contents or the private key. Enrollment grants scope inspection only; execution evidence and write passes retain their separate authority checks. An operator-configured signer cannot be replaced. After a successful connection, use the returned `nextInput` for `continue`, or explicitly send `payload: {"targetFiles":["<same existing source file>"]}` to the original `workflow-gate`. The connector uses `paths`; the gate uses `targetFiles`. Refresh an expired snapshot by reconnecting the same flow and path set. Show an explicit blocked result; query the original request ID after an unknown transport outcome before considering another attempt.
 
-Scope inspection resolves aliases from actual `tsconfig.json` or `jsconfig.json`, including relative and npm `extends` and ordered inheritance arrays. Npm configuration lookup uses the pinned TypeScript JSON-config resolver over controlled metadata reads, including scoped packages, subpaths, package `tsconfig`, `exports` and `typesVersions`. Configurations and package metadata enter the signed hashes; dependencies are read only, never executed. Repository-local pnpm links use their actual configuration location. Read-only external dependency packages support parents and mappings inside their reference boundary; references requiring an unrepresentable external canonical ancestor fail explicitly rather than selecting a different same-name repository package. For plugin source compiled by a host project whose config is outside the source's ancestors, include `importContexts: [{"sourcePrefix":"<plugin source directory>","configPath":"<actual host tsconfig.json>"}]` in `scope-connect` input. Inspect the real build configuration first; never invent an alias or mark an unresolved import as external. These context paths remain inside the repository, their hashes enter the signed facts, and the local task binding freezes them.
+Scope inspection resolves aliases from actual `tsconfig.json` or `jsconfig.json`, including relative and npm `extends` and ordered inheritance arrays. Npm configuration lookup uses the pinned TypeScript JSON-config resolver over controlled metadata reads, including scoped packages, subpaths, package `tsconfig`, `exports` and `typesVersions`. Read-only candidate probes treat a child beneath an ordinary file as absent so normal TypeScript fallbacks continue; actual sources, control files and mutation targets retain strict validation. Rejected paths report the requested path, blocking ancestor, resolved target and reason, including broken or cyclic dependency links. Configurations and package metadata enter the signed hashes; dependencies are read only, never executed. Repository-local pnpm links use their actual configuration location. Read-only external dependency packages support parents and mappings inside their reference boundary; references requiring an unrepresentable external canonical ancestor fail explicitly rather than selecting a different same-name repository package. For plugin source compiled by a host project whose config is outside the source's ancestors, include `importContexts: [{"sourcePrefix":"<plugin source directory>","configPath":"<actual host tsconfig.json>"}]` in `scope-connect` input. Inspect the real build configuration first; never invent an alias or mark an unresolved import as external. These context paths remain inside the repository, their hashes enter the signed facts, and the local task binding freezes them.
 
 Keep snapshot before-images distinct from a frozen execution plan's expected final file hashes. Controlled writes consume the original approved authority; the runner then verifies the actual planned final bytes. Never edit a signed plan or silently substitute a newer snapshot after an unknown or failed gate. Existing changes outside that authority require explicit revalidation of the same original flow.
 

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute an engineering task through Entrorove, preserving its origi
 
 # entrorove · 熵巡
 
-Version: 0.1.50.
+Version: 0.1.52.
 
 Entrorove applies to the whole task once selected. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 

package/ide-command.mjs

@@ -1,5 +1,30 @@
 import path from 'node:path';
 
+function literalWords(header) {
+  const words = [];
+  let word = '', quote = null, started = false;
+  for (let index = 0; index < header.length; index++) {
+    const character = header[index];
+    if (quote) {
+      if (character === quote) quote = null;
+      else if (quote === '"' && character === '\\') {
+        if (!['"', '\\'].includes(header[index + 1])) return null;
+        word += header[++index];
+      } else word += character;
+    } else if (character === "'" || character === '"') {
+      quote = character; started = true;
+    } else if (character === '\\') {
+      if (!["'", '"', '\\', ' ', '\t'].includes(header[index + 1])) return null;
+      word += header[++index]; started = true;
+    } else if (/\s/u.test(character)) {
+      if (started) { words.push(word); word = ''; started = false; }
+    } else { word += character; started = true; }
+  }
+  if (quote) return null;
+  if (started) words.push(word);
+  return words.length ? words : null;
+}
+
 // Deliberately accepts a small literal shell grammar. Unknown commands are not
 // classified as reads: the host must reject them or use the approved runner.
 export function literalCommand(command) {
@@ -14,30 +39,37 @@ export function literalCommand(command) {
     header = here[1];
   }
   if (/[\n\r\0`$<>;&|]/u.test(header)) return null;
-  const words = [], pattern = /\s*(?:'([^']*)'|"([^"\\]*)"|([^\s'"\\]+))/gu;
-  let match, end = 0;
-  while ((match = pattern.exec(header))) {
-    if (match.index !== end) return null;
-    words.push(match[1] ?? match[2] ?? match[3]); end = pattern.lastIndex;
-  }
-  if (end !== header.length || !words.length) return null;
+  const words = literalWords(header);
+  if (!words) return null;
   return { words, ...(input ? { input } : {}) };
 }
 
+function sdkWords(parsed) {
+  const words = [...parsed.words], seen = new Set();
+  const env = ['env', '/usr/bin/env', '/bin/env'].includes(words[0]);
+  if (env) words.shift();
+  while (words[0]?.includes('=')) {
+    const assignment = words.shift(), separator = assignment.indexOf('=');
+    const key = assignment.slice(0, separator), value = assignment.slice(separator + 1);
+    if (seen.has(key)) return null;
+    seen.add(key);
+    if (key === 'ENTROROVE_IDE') {
+      if (!/^[\p{L}\p{N} .+_-]{2,48}$/u.test(value)) return null;
+    } else if (!['ENTROROVE_SESSION', 'CODEX_THREAD_ID', 'CLAUDE_SESSION_ID'].includes(key)
+      || !/^[A-Za-z0-9_-]{1,200}$/u.test(value)) return null;
+  }
+  return words.length && (!env || seen.size) ? words : null;
+}
+
 export function sdkCommand(parsed, runtime) {
   if (!parsed) return null;
-  const words = [...parsed.words];
-  if (words[0]?.startsWith('ENTROROVE_IDE=')) {
-    if (!/^ENTROROVE_IDE=[\p{L}\p{N} .+_-]{2,48}$/u.test(words.shift())) return null;
-    while (['ENTROROVE_SESSION=', 'CODEX_THREAD_ID='].some(prefix => words[0]?.startsWith(prefix))) {
-      if (!/^[A-Z_]+=[A-Za-z0-9_-]{1,200}$/u.test(words.shift())) return null;
-    }
-  }
+  const words = sdkWords(parsed);
+  if (!words) return null;
   let args;
   if ([runtime.node, 'node'].includes(words[0]) && words[1] === runtime.cli) args = words.slice(2);
   else if (['npx', 'npx.cmd'].includes(path.basename(words[0]))) {
     words.shift();
-    while (['--yes', '--prefer-online'].includes(words[0])) words.shift();
+    while (['--yes', '--prefer-online', '--registry=https://registry.npmjs.org'].includes(words[0])) words.shift();
     if (!['@entrorove/skill', '@entrorove/skill@latest', `@entrorove/skill@${runtime.version}`].includes(words.shift())) return null;
     args = words;
   } else if (path.basename(words[0]) === 'entrorove') {
@@ -83,6 +115,6 @@ export function readCommand(parsed) {
 
 export function renderSdkCommand(call, runtime, sessionId, host = process.env.ENTROROVE_IDE ?? 'Codex') {
   const quote = value => `'${String(value).replace(/'/gu, "'\\''")}'`;
-  const header = `ENTROROVE_IDE=${host} ENTROROVE_SESSION=${quote(sessionId)} CODEX_THREAD_ID=${quote(sessionId)} ${[runtime.node, runtime.cli, ...call.args].map(quote).join(' ')}`;
+  const header = `ENTROROVE_IDE=${quote(host)} ENTROROVE_SESSION=${quote(sessionId)} CODEX_THREAD_ID=${quote(sessionId)} ${[runtime.node, runtime.cli, ...call.args].map(quote).join(' ')}`;
   return call.input ? `${header} <<'ENTROROVE_INPUT'\n${JSON.stringify(call.input)}\nENTROROVE_INPUT` : header;
 }

package/local-discipline-analysis.mjs

@@ -1,6 +1,8 @@
 import ts from 'typescript';
 import { archguardScriptSource } from './local-archguard-ast.mjs';
 import { canonical, sha256 } from './local-integrity.mjs';
+import { isTypeOnlyReference, isDynamicFunctionReference } from './local-typescript-function-reference.mjs';
+import { createScopeImportResolver } from './local-scope-import-expressions.mjs';
 
 export const disciplineAnalysisLimits = Object.freeze({ fileBytes: 1_048_576, sourceBytes: 8_388_608, files: 512, nodes: 200_000 });
 function analysisLimit(file, reason, limit, required) {
@@ -77,12 +79,15 @@ function definition(source, node) {
   return { ...location(source, node), symbol, name, exported: Boolean(exported), contract: Boolean(contract),
     signatureDigest: contract ? sha256(signature) : null };
 }
-function unresolvedNode(node) {
-  if (ts.isElementAccessExpression(node) && nameOf(node.argumentExpression) === null) return true;
-  if (ts.isIdentifier(node) && ['eval', 'Function', 'createRequire'].includes(node.text)) return true;
+function unresolvedNode(node, resolve) {
+  if (isTypeOnlyReference(node)) return false;
+  if (ts.isElementAccessExpression(node) && (nameOf(node.argumentExpression) === null
+    || ['eval', 'Function', 'createRequire', 'require'].includes(nameOf(node.argumentExpression)))) return true;
+  if (ts.isIdentifier(node) && (['eval', 'createRequire'].includes(node.text) || isDynamicFunctionReference(node))) return true;
   if (ts.isCallExpression(node)) {
     if (node.expression.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(node.expression) && node.expression.text === 'require') {
-      return node.arguments.length !== 1 || !ts.isStringLiteral(node.arguments[0]);
+      return !node.arguments.length || node.arguments.length > (node.expression.kind === ts.SyntaxKind.ImportKeyword ? 2 : 1)
+        || resolve(node.arguments[0]) === null;
     }
     if (ts.isPropertyAccessExpression(node.expression) && ts.isIdentifier(node.expression.expression)
       && ['Reflect', 'Object'].includes(node.expression.expression.text) && ['get', 'set', 'defineProperty'].includes(node.expression.name.text)) return true;
@@ -148,8 +153,9 @@ export function analyzeDisciplineSources(files, { edges = [], unresolved = [], r
   const program = programFor(sources, edges), checker = program.getTypeChecker(), definitions = [], mappings = [], references = new Map();
   const unknown = [...unresolved, ...unsupported];
   for (const source of sources.values()) {
+    const resolve = createScopeImportResolver(source, checker);
     const visit = node => {
-      if (unresolvedNode(node)) unknown.push({ ...location(source, node), reason: 'dynamic-reference' });
+      if (unresolvedNode(node, resolve)) unknown.push({ ...location(source, node), reason: 'dynamic-reference' });
       if (symbolNode(node)) {
         const entry = definition(source, node);
         if (entry) { const symbol = checker.getSymbolAtLocation(node.name); definitions.push({ entry, symbol, nameNode: node.name }); }

package/local-discipline-repository.mjs

@@ -90,25 +90,28 @@ export async function disciplineRepositoryObservation(input, root, { analyze = f
   if (!analyze) return { comparison };
   // The existing resolver supplies actual aliases, package exports and import edges.
   // Unsupported/dynamic references stay unknown; they are never converted to unused.
-  const roots = sources.filter(file => paths.includes(file.path) && /\.[cm]?[jt]sx?$/i.test(file.path)).map(file => ({ path: file.path, exists: true }));
+  const roots = sources.filter(file => paths.includes(file.path) && /\.(?:[cm]?[jt]sx?|vue)$/i.test(file.path)).map(file => ({ path: file.path, exists: true }));
   let graph;
   try { graph = roots.length ? await importGraph(root, roots, input, disciplineAnalysisLimits) : { edges: [], dynamicSources: [], complete: true }; }
   catch (error) {
     if (!['ENTROROVE_IMPORT_UNRESOLVED', 'ENTROROVE_IMPORT_INVALID', 'ENTROROVE_IMPORT_UNSUPPORTED', 'ENTROROVE_SCOPE_LIMIT', 'ENTROROVE_BUDGET_SCOPE'].includes(error.code)) throw error;
     graph = { edges: [], dynamicSources: [], complete: false }; unresolved.push({ reason: error.code, message: error.message });
   }
-  for (const [relative, content] of overrides) if (semanticSource(relative) && /\.[cm]?[jt]sx?$/i.test(relative)) {
+  for (const [relative, content] of overrides) if (semanticSource(relative) && /\.(?:[cm]?[jt]sx?|vue)$/i.test(relative)) {
     try {
       const candidate = await scopeCandidateImports(root, { path: relative, content }, input);
       graph.edges = [...graph.edges.filter(edge => edge.from !== relative), ...candidate.edges];
-      if (candidate.dynamic) unresolved.push({ path: relative, reason: 'candidate-dynamic-import' });
+      if (candidate.dynamic) unresolved.push(...(candidate.unresolvedImports?.length ? candidate.unresolvedImports
+        : [{ path: relative, reason: 'candidate-dynamic-import' }]));
     } catch (error) {
       if (!['ENTROROVE_IMPORT_UNRESOLVED', 'ENTROROVE_IMPORT_INVALID', 'ENTROROVE_IMPORT_UNSUPPORTED', 'ENTROROVE_BUDGET_SCOPE'].includes(error.code)) throw error;
       unresolved.push({ path: relative, reason: error.code });
     }
   }
   const analysis = analyzeDisciplineSources(sources, { edges: graph.edges, requiredPaths: [...required],
-    unresolved: [...unresolved, ...graph.dynamicSources.map(item => ({ path: item.path, reason: 'dynamic-import' }))] });
+    unresolved: [...unresolved, ...(graph.unresolvedImports ?? []),
+      ...graph.dynamicSources.filter(item => !graph.unresolvedImports?.some(site => site.path === item.path))
+        .map(item => ({ path: item.path, reason: 'dynamic-import' }))] });
   analysis.definitions.push(...await nativeDisciplineDefinitions(sources));
   return { comparison, analysis, scanComplete: graph.complete && analysis.unresolved.length === 0 };
 }

package/local-scope-files.mjs

@@ -36,6 +36,26 @@ async function assertDependencyReference(root, target, relative) {
   }
   return resolved;
 }
+async function invalidScopeTarget(root, relative, current, reason, cause) {
+  let resolved = current, resolutionError;
+  try { resolved = await fs.realpath(current); }
+  catch (error) {
+    resolutionError = error.code;
+    try { resolved = path.resolve(path.dirname(current), await fs.readlink(current)); }
+    catch { /* A non-directory ancestor is already its own blocking target. */ }
+  }
+  const blockingPath = path.relative(root, current).split(path.sep).join('/');
+  const explanation = {
+    'non-directory-ancestor': 'the ancestor is not a directory',
+    'symlink-not-allowed': 'strict scope access does not allow symlinks',
+    'unresolvable-symlink': 'the symlink cannot be resolved to an actual dependency target',
+    'not-regular-file': 'the source must be a regular file',
+    'unsupported-target-type': 'the target must be a regular file or directory',
+  }[reason];
+  const unavailable = cause || resolutionError;
+  throw Object.assign(new Error(`Scope path ${JSON.stringify(relative)} is blocked at ${JSON.stringify(blockingPath)} (${JSON.stringify(current)}), resolved to ${JSON.stringify(resolved)} because ${explanation}${unavailable ? ` (${unavailable})` : ''}`),
+    { code: 'ENTROROVE_FILE_INVALID', reason, path: relative, blockingPath, resolvedPath: resolved });
+}
 export async function scopeTarget(root, relative, allowMissing = false, allowDependency = false) {
   let current = root;
   const parts = scopePath(relative).split('/');
@@ -48,17 +68,32 @@ export async function scopeTarget(root, relative, allowMissing = false, allowDep
       throw error;
     }
     if (stat.isSymbolicLink()) {
-      if (!followDependency) scopeFail('ENTROROVE_FILE_INVALID', 'scope refuses symlink or non-directory ancestors');
-      await assertDependencyReference(root, current, relative);
-      stat = await fs.stat(current);
+      if (!followDependency) await invalidScopeTarget(root, relative, current, 'symlink-not-allowed');
+      try {
+        await assertDependencyReference(root, current, relative);
+        stat = await fs.stat(current);
+      } catch (error) {
+        if (['ENOENT', 'ENOTDIR', 'ELOOP'].includes(error.code)) {
+          await invalidScopeTarget(root, relative, current, 'unresolvable-symlink', error.code);
+        }
+        throw error;
+      }
     }
-    if (index < parts.length - 1 && !stat.isDirectory()) scopeFail('ENTROROVE_FILE_INVALID', 'scope refuses symlink or non-directory ancestors');
+    if (index < parts.length - 1 && !stat.isDirectory()) await invalidScopeTarget(root, relative, current, 'non-directory-ancestor');
     if (index === parts.length - 1) return { target: current, exists: true, stat, dependency: followDependency };
   }
 }
+// Only speculative, read-only resolver candidates may treat a non-directory ancestor as absent.
+export async function scopeProbeTarget(root, relative, allowDependency = false) {
+  try { return await scopeTarget(root, relative, true, allowDependency); }
+  catch (error) {
+    if (error.code !== 'ENTROROVE_FILE_INVALID' || error.reason !== 'non-directory-ancestor') throw error;
+    return { target: path.join(root, relative), exists: false, stat: null };
+  }
+}
 async function safeScopeRead(root, relative, input, allowDependency = true) {
   const dependency = allowDependency && dependencyReference(relative), target = await scopeTarget(root, relative, false, dependency);
-  if (!target.stat.isFile()) scopeFail('ENTROROVE_FILE_INVALID', 'scope source must be a regular file');
+  if (!target.stat.isFile()) await invalidScopeTarget(root, relative, target.target, 'not-regular-file');
   if (target.stat.size > 16_777_216) scopeFail('ENTROROVE_SCOPE_LIMIT', 'scope source exceeds the 16 MiB inspection bound');
   const handle = await fs.open(target.target, constants.O_RDONLY | (dependency ? 0 : (constants.O_NOFOLLOW ?? 0)));
   try {
@@ -87,7 +122,7 @@ export async function scopeFiles(root, requested, knownFiles = []) {
     const item = await scopeTarget(root, relative, known.has(relative));
     if (!item.exists) { found.add(relative); return; }
     if (item.stat.isFile()) { found.add(relative); return; }
-    if (!item.stat.isDirectory()) scopeFail('ENTROROVE_FILE_INVALID', 'scope target must be a regular file or directory');
+    if (!item.stat.isDirectory()) await invalidScopeTarget(root, relative, item.target, 'unsupported-target-type');
     for (const name of (await fs.readdir(item.target)).sort()) if (!excluded.has(name)) await visit(`${relative}/${name}`);
   }
   for (const relative of known) if (requested.some(target => target === '.' || target === relative || relative.startsWith(`${target}/`))) found.add(relative);

package/local-scope-import-expressions.mjs

@@ -0,0 +1,80 @@
+import path from 'node:path';
+import ts from 'typescript';
+
+const limits = Object.freeze({ alternatives: 64, nodes: 512, depth: 32 });
+function unwrap(node) {
+  while (node && (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node)
+    || ts.isTypeAssertionExpression(node) || ts.isNonNullExpression(node))) node = node.expression;
+  return node;
+}
+function sourceChecker(source) {
+  const name = path.posix.resolve('/', source.fileName.replaceAll('\\', '/'));
+  const matches = value => path.posix.resolve('/', value.replaceAll('\\', '/')) === name;
+  const host = { getSourceFile: filename => matches(filename) ? source : undefined,
+    getDefaultLibFileName: () => '/entrorove-no-library.d.ts', writeFile: () => {},
+    getCurrentDirectory: () => '/', getDirectories: () => [], fileExists: matches,
+    readFile: filename => matches(filename) ? source.text : undefined,
+    getCanonicalFileName: filename => filename, useCaseSensitiveFileNames: () => true, getNewLine: () => '\n' };
+  return ts.createProgram([name], { noLib: true, noResolve: true, allowJs: true }, host).getTypeChecker();
+}
+function product(left, right) {
+  if (!left || !right || left.length * right.length > limits.alternatives) return null;
+  return [...new Set(left.flatMap(prefix => right.map(suffix => prefix + suffix)))];
+}
+/** Resolve literal alternatives without executing source, trusting type assertions, or reading other files. */
+export function createScopeImportResolver(source, suppliedChecker) {
+  let checker = suppliedChecker;
+  const resolve = expression => {
+    let nodes = 0;
+    const values = (raw, seen = new Set(), depth = 0) => {
+      const node = unwrap(raw);
+      if (!node || depth > limits.depth || ++nodes > limits.nodes) return null;
+      if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return [node.text];
+      if (ts.isConditionalExpression(node)) {
+        const left = values(node.whenTrue, seen, depth + 1), right = values(node.whenFalse, seen, depth + 1);
+        return left && right && left.length + right.length <= limits.alternatives ? [...new Set([...left, ...right])] : null;
+      }
+      if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+        return product(values(node.left, seen, depth + 1), values(node.right, seen, depth + 1));
+      }
+      if (ts.isTemplateExpression(node)) {
+        let result = [node.head.text];
+        for (const span of node.templateSpans) {
+          result = product(result, values(span.expression, seen, depth + 1));
+          if (!result) return null;
+          result = result.map(value => value + span.literal.text);
+        }
+        return result;
+      }
+      if (!ts.isIdentifier(node)) return null;
+      checker ??= sourceChecker(source);
+      const declarations = checker.getSymbolAtLocation(node)?.declarations;
+      if (declarations?.length !== 1) return null;
+      const declaration = declarations[0];
+      if (seen.has(declaration) || declaration.getSourceFile() !== source) return null;
+      const next = new Set([...seen, declaration]);
+      if (ts.isVariableDeclaration(declaration) && ts.isVariableDeclarationList(declaration.parent)
+        && declaration.parent.flags & ts.NodeFlags.Const && declaration.initializer
+        && !(ts.getCombinedModifierFlags(declaration) & ts.ModifierFlags.Ambient)
+        && !source.isDeclarationFile) return values(declaration.initializer, next, depth + 1);
+      return null;
+    };
+    const alternatives = values(expression);
+    if (alternatives?.some(value => !value || /[\u0000-\u001f\u007f]/.test(value))) {
+      throw Object.assign(new Error('module literal is empty or contains control characters'), { code: 'ENTROROVE_IMPORT_INVALID' });
+    }
+    return alternatives?.sort() ?? null;
+  };
+  return resolve;
+}
+
+export function unresolvedImportSite(source, expression) {
+  const node = unwrap(expression), position = source.getLineAndCharacterOfPosition((node ?? source).getStart(source));
+  const kind = node ? ts.SyntaxKind[node.kind] : 'MissingArgument';
+  const reason = node && ts.isIdentifier(node) ? 'import-binding-not-finite-constant'
+    : node && ts.isTemplateExpression(node) ? 'import-template-has-unbounded-substitution'
+      : node && ts.isBinaryExpression(node) ? 'import-concatenation-has-unbounded-operand'
+        : 'import-expression-not-statically-finite';
+  return { line: position.line + 1, column: position.character + 1, kind, reason,
+    message: `Cannot verify ${kind} import: only immutable literal alternatives (at most ${limits.alternatives}) are statically bounded; runtime values and mutable bindings remain unresolved` };
+}

package/local-scope-repository.mjs

@@ -5,7 +5,7 @@ import { promisify } from 'node:util';
 import { builtinModules } from 'node:module';
 import ts from 'typescript';
 import { parse as parseVue, parseCache as vueParseCache } from '@vue/compiler-sfc';
-import { lineCount, observedScopeRisk, packageBoundary, scopeFail, scopeFiles, scopeRead, scopeTarget, stableScope } from './local-scope-files.mjs';
+import { lineCount, observedScopeRisk, packageBoundary, scopeFail, scopeFiles, scopeProbeTarget, scopeRead, scopeTarget, stableScope } from './local-scope-files.mjs';
 import { sha256 } from './local-integrity.mjs';
 import { workspaceImport, workspaceIndex } from './local-scope-workspaces.mjs';
 import { assertBudgetRunnerAllowed } from './local-budget-reads.mjs';
@@ -13,6 +13,8 @@ import { observeBudgetScopeGit, scopeGitBudgetEnforced } from './local-scope-git
 import { scopeGitMetadata } from './local-scope-git-reads.mjs';
 import { scopeTsconfigImports } from './local-scope-config-imports.mjs';
 import { scopeGitExecutable } from './local-git-executable.mjs';
+import { createScopeImportResolver, unresolvedImportSite } from './local-scope-import-expressions.mjs';
+import { isTypeOnlyReference, isDynamicFunctionReference } from './local-typescript-function-reference.mjs';
 
 const execute = promisify(execFile);
 async function git(root, args, allowed = [], input = { repositoryRoot: root }) {
@@ -94,11 +96,6 @@ function staticString(expression) {
   if (!expression || (!ts.isStringLiteral(expression) && !ts.isNoSubstitutionTemplateLiteral(expression))) return null;
   return expression.text;
 }
-function moduleLiteral(expression) {
-  const value = staticString(expression);
-  if (value !== null && (!value || /[\u0000-\u001f\u007f]/.test(value))) scopeFail('ENTROROVE_IMPORT_INVALID', 'module literal is empty or contains control characters');
-  return value;
-}
 function globalObject(expression) {
   while (expression && (ts.isParenthesizedExpression(expression) || ts.isAsExpression(expression)
     || ts.isTypeAssertionExpression(expression) || ts.isNonNullExpression(expression) || ts.isSatisfiesExpression(expression))) expression = expression.expression;
@@ -106,12 +103,16 @@ function globalObject(expression) {
 }
 // The same pinned TypeScript parser as the cloud scope analyzer visits actual
 // expressions inside templates and JSX; literal bodies never become code.
-function scriptImports(source, filename) {
+function scriptImports(source, filename, context = {}) {
   const parsed = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true,
     scriptKinds.get(path.extname(filename).toLowerCase()) ?? ts.ScriptKind.TS);
   if (parsed.parseDiagnostics.length) scopeFail('ENTROROVE_IMPORT_INVALID', 'source has invalid or unterminated syntax');
-  const found = new Set(); let dynamic = false;
-  const add = expression => { const value = moduleLiteral(expression); if (value === null) dynamic = true; else found.add(value); };
+  const found = new Set(), unresolvedImports = [], resolve = createScopeImportResolver(parsed); let dynamic = false;
+  const add = expression => {
+    const values = resolve(expression);
+    if (values === null) { dynamic = true; unresolvedImports.push(unresolvedImportSite(parsed, expression)); }
+    else for (const value of values) found.add(value);
+  };
   const visit = node => {
     if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) { if (node.moduleSpecifier) add(node.moduleSpecifier); }
     else if (ts.isImportEqualsDeclaration(node) && ts.isExternalModuleReference(node.moduleReference)) add(node.moduleReference.expression);
@@ -120,24 +121,29 @@ function scriptImports(source, filename) {
       const importer = node.expression.kind === ts.SyntaxKind.ImportKeyword;
       const requireCall = ts.isIdentifier(node.expression) && node.expression.text === 'require';
       if (importer || requireCall) {
-        if (!node.arguments.length || node.arguments.length > (importer ? 2 : 1)) dynamic = true;
+        if (!node.arguments.length || node.arguments.length > (importer ? 2 : 1)) {
+          dynamic = true;
+          unresolvedImports.push({ ...unresolvedImportSite(parsed, node), reason: 'import-argument-list-not-supported',
+            message: 'Import inspection requires one module argument and at most one import-attributes argument' });
+        }
         else add(node.arguments[0]);
       }
     }
-    if (ts.isIdentifier(node)) {
-      if (dynamicNames.has(node.text)) dynamic = true;
+    const runtimeReference = !isTypeOnlyReference(node);
+    if (runtimeReference && ts.isIdentifier(node)) {
+      if (dynamicNames.has(node.text) && (node.text !== 'Function' || isDynamicFunctionReference(node, context))) dynamic = true;
       if (node.text === 'require' && !(ts.isCallExpression(node.parent) && node.parent.expression === node)
         && !(ts.isPropertyAccessExpression(node.parent) && node.parent.name === node)
         && !(ts.isMethodDeclaration(node.parent) && node.parent.name === node)) dynamic = true;
     }
-    if (ts.isElementAccessExpression(node)) {
+    if (runtimeReference && ts.isElementAccessExpression(node)) {
       const member = staticString(node.argumentExpression);
       if (dynamicNames.has(member) || member === 'require' || member === null && globalObject(node.expression)) dynamic = true;
     }
-    if (ts.isPropertyAccessExpression(node) && node.name.text === 'require' && globalObject(node.expression)) dynamic = true;
+    if (runtimeReference && ts.isPropertyAccessExpression(node) && node.name.text === 'require' && globalObject(node.expression)) dynamic = true;
     ts.forEachChild(node, visit);
   };
-  visit(parsed); return { specifiers: [...found].sort(), dynamic };
+  visit(parsed); return { specifiers: [...found].sort(), dynamic, unresolvedImports };
 }
 function vueScripts(source, filename) {
   const { descriptor, errors } = parseVue(source, { filename, sourceMap: false,
@@ -152,7 +158,8 @@ function vueScripts(source, filename) {
     const language = block.lang ?? 'js';
     if (!['js', 'javascript', 'ts', 'typescript', 'jsx', 'tsx'].includes(language)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'component script language is unsupported');
     const extension = { javascript: 'js', typescript: 'ts' }[language] ?? language;
-    scripts.push({ source: block.src ? `import ${JSON.stringify(block.src)};` : block.content, filename: `${filename}.${extension}` });
+    scripts.push({ source: block.src ? `import ${JSON.stringify(block.src)};` : block.content, filename: `${filename}.${extension}`,
+      lineOffset: block.loc.start.line - 1, vueComponent: true, vueSetup: block === descriptor.scriptSetup });
   }
   const seen = new WeakSet();
   const walk = node => {
@@ -172,10 +179,11 @@ function vueScripts(source, filename) {
 function importSpecifiers(content, filename) {
   try {
     const source = content.toString('utf8'), parts = path.extname(filename).toLowerCase() === '.vue' ? vueScripts(source, filename) : [{ source, filename }];
-    const specifiers = new Set(); let dynamic = false;
-    for (const part of parts) { const parsed = scriptImports(part.source, part.filename); dynamic ||= parsed.dynamic;
+    const specifiers = new Set(), unresolvedImports = []; let dynamic = false;
+    for (const part of parts) { const parsed = scriptImports(part.source, part.filename, part); dynamic ||= parsed.dynamic;
+      unresolvedImports.push(...parsed.unresolvedImports.map(site => ({ ...site, line: site.line + (part.lineOffset ?? 0) })));
       for (const specifier of parsed.specifiers) specifiers.add(specifier); }
-    return { specifiers: [...specifiers].sort(), dynamic };
+    return { specifiers: [...specifiers].sort(), dynamic, unresolvedImports };
   } catch (error) {
     if (typeof error?.code === 'string' && error.code.startsWith('ENTROROVE_')) throw error;
     if (error instanceof RangeError) scopeFail('ENTROROVE_SCOPE_LIMIT', 'dependency syntax exceeds the supported parser or traversal bound');
@@ -228,7 +236,7 @@ async function externalConfigReference(root, relative, resolved) {
   return boundary;
 }
 async function configMetadata(root, relative, input) {
-  const target = await scopeTarget(root, relative, true, dependencyReference(relative));
+  const target = await scopeProbeTarget(root, relative, dependencyReference(relative));
   if (!target.exists || !target.stat.isFile()) throw Object.assign(new Error(`Missing configuration file: ${relative}`), { code: 'ENOENT' });
   const read = await scopeRead(root, relative, input), resolved = await fs.realpath(target.target);
   const physical = path.relative(root, resolved).split(path.sep).join('/');
@@ -241,7 +249,7 @@ async function resolveLocalImport(root, relative, required = true) {
   if (relative.startsWith('../') || relative === '..') scopeFail('ENTROROVE_PATH_UNSAFE', 'local import escapes the repository');
   const replacements = /\.js$/.test(relative) ? [relative.replace(/\.js$/, '.ts'), relative.replace(/\.js$/, '.tsx')] : [];
   for (const candidate of [relative, ...replacements, ...['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.vue', '.json', '.d.ts', '.d.mts', '.d.cts', '/index.js', '/index.ts', '/index.d.ts'].map(ext => relative + ext)]) {
-    const item = await scopeTarget(root, candidate, true, dependencyReference(candidate));
+    const item = await scopeProbeTarget(root, candidate, dependencyReference(candidate));
     if (item.exists && item.stat.isFile()) return candidate;
   }
   if (required) scopeFail('ENTROROVE_IMPORT_UNRESOLVED', 'a local import has no resolvable source file');
@@ -250,7 +258,7 @@ async function resolveLocalImport(root, relative, required = true) {
 export async function importGraph(root, originals, input = { repositoryRoot: root }, limits = {}) {
   const pending = originals.filter(file => file.exists !== false).map(file => file.path); const visited = new Map(); const edges = []; let dynamic = false;
   let sourceBytes = 0;
-  const dynamicSources = [];
+  const dynamicSources = [], unresolvedImports = [];
   const workspace = await workspaceIndex(root, input);
   const metadata = new Map(workspace.metadata.map(item => [item.path, item]));
   while (pending.length) {
@@ -273,6 +281,7 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
     for (const observed of aliases.observations) metadata.set(observed.path, observed);
     const declarations = declarationModules(read.content, relative);
     const imports = importSpecifiers(read.content, relative); dynamic ||= imports.dynamic;
+    unresolvedImports.push(...imports.unresolvedImports.map(site => ({ path: relative, ...site })));
     if (imports.dynamic) dynamicSources.push({ path: relative, sha256: read.sha256 });
     for (const specifier of imports.specifiers.sort()) {
       const target = await resolveImport(root, relative, specifier, workspace, input, aliases, configPath, declarations);
@@ -286,7 +295,8 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
   const workspaceMetadata = [...metadata.values()].sort((a, b) => a.path.localeCompare(b.path));
   await stableScope(root, workspaceMetadata, input);
   return { nodes, edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)),
-    dynamic, complete: !dynamic, dynamicSources: dynamicSources.sort((a, b) => a.path.localeCompare(b.path)), workspaceMetadata };
+    dynamic, complete: !dynamic, dynamicSources: dynamicSources.sort((a, b) => a.path.localeCompare(b.path)), workspaceMetadata,
+    ...(unresolvedImports.length ? { unresolvedImports } : {}) };
 }
 export async function scopeCandidateImports(root, file, input = { repositoryRoot: root }) {
   const parsed = importSpecifiers(Buffer.from(file.content), file.path);
@@ -299,7 +309,8 @@ export async function scopeCandidateImports(root, file, input = { repositoryRoot
     const target = await resolveImport(root, file.path, specifier, workspace, input, aliases, context?.configPath, declarations);
     edges.push({ from: file.path, to: target, external: target === null, specifier });
   }
-  return { edges, dynamic: parsed.dynamic };
+  return { edges, dynamic: parsed.dynamic,
+    ...(parsed.unresolvedImports.length ? { unresolvedImports: parsed.unresolvedImports.map(site => ({ path: file.path, ...site })) } : {}) };
 }
 export async function collectScopeFacts(root, requested, baselineRef, knownFiles = [], input = { repositoryRoot: root }) {
   const selected = await scopeFiles(root, requested, knownFiles); const files = [];

package/local-typescript-function-reference.mjs

@@ -0,0 +1,98 @@
+import ts from 'typescript';
+
+const bindings = new WeakMap();
+const propertyName = node => node && (ts.isIdentifier(node) || ts.isStringLiteral(node)) ? node.text : null;
+const wrapper = node => ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)
+  || ts.isNonNullExpression(node) || ts.isSatisfiesExpression(node);
+const unwrap = node => {
+  while (node && wrapper(node)) node = node.expression;
+  return node;
+};
+export function isTypeOnlyReference(node) {
+  for (let current = node; current?.parent; current = current.parent) {
+    const parent = current.parent;
+    if (ts.isExpressionWithTypeArguments(parent) && ts.isHeritageClause(parent.parent)) {
+      return parent.parent.token !== ts.SyntaxKind.ExtendsKeyword
+        || !(ts.isClassDeclaration(parent.parent.parent) || ts.isClassExpression(parent.parent.parent));
+    }
+    if (ts.isTypeNode(parent) || ts.isInterfaceDeclaration(parent) || ts.isTypeAliasDeclaration(parent)
+      || ts.isTypeParameterDeclaration(parent)) return true;
+    if ((ts.isImportClause(parent) || ts.isImportSpecifier(parent)) && parent.isTypeOnly) return true;
+  }
+  return false;
+}
+function bindingNames(node) {
+  if (ts.isIdentifier(node)) return [node.text];
+  if (ts.isObjectBindingPattern(node) || ts.isArrayBindingPattern(node)) {
+    return node.elements.flatMap(element => ts.isBindingElement(element) ? bindingNames(element.name) : []);
+  }
+  return [];
+}
+function sourceBindings(source) {
+  if (bindings.has(source)) return bindings.get(source);
+  const found = new Map();
+  const add = (name, api = null) => found.set(name, [...found.get(name) ?? [], api]);
+  const visit = node => {
+    if (ts.isImportSpecifier(node) || ts.isNamespaceImport(node)) {
+      let declaration = node.parent;
+      while (declaration && !ts.isImportDeclaration(declaration)) declaration = declaration.parent;
+      const vue = declaration && ts.isStringLiteral(declaration.moduleSpecifier) && declaration.moduleSpecifier.text === 'vue'
+        && !declaration.importClause?.isTypeOnly && !node.isTypeOnly;
+      add(node.name.text, vue ? ts.isNamespaceImport(node) ? '*' : (node.propertyName ?? node.name).text : null);
+    } else if (ts.isImportClause(node) && node.name) add(node.name.text);
+    else if (ts.isVariableDeclaration(node) || ts.isParameter(node)) bindingNames(node.name).forEach(name => add(name));
+    else if ((ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isClassDeclaration(node)
+      || ts.isClassExpression(node) || ts.isImportEqualsDeclaration(node) || ts.isEnumDeclaration(node)) && node.name) add(node.name.text);
+    ts.forEachChild(node, visit);
+  };
+  visit(source); bindings.set(source, found); return found;
+}
+function vueCall(node, api, context) {
+  if (!ts.isCallExpression(node) || node.arguments.length !== 1) return false;
+  const expression = unwrap(node.expression), found = sourceBindings(node.getSourceFile());
+  if (ts.isIdentifier(expression)) {
+    const declarations = found.get(expression.text) ?? [];
+    return declarations.length === 1 && declarations[0] === api
+      || api === 'defineProps' && context.vueSetup === true && expression.text === api && !declarations.length;
+  }
+  return ts.isPropertyAccessExpression(expression) && expression.name.text === api && ts.isIdentifier(expression.expression)
+    && found.get(expression.expression.text)?.length === 1 && found.get(expression.expression.text)[0] === '*';
+}
+function transparentParent(node) {
+  while (node.parent && wrapper(node.parent) && node.parent.expression === node) node = node.parent;
+  return node;
+}
+function vuePropsContainer(node, context) {
+  const value = transparentParent(node), parent = value.parent;
+  if (parent && vueCall(parent, 'defineProps', context) && parent.arguments[0] === value) return true;
+  if (!ts.isPropertyAssignment(parent) || propertyName(parent.name) !== 'props' || parent.initializer !== value) return false;
+  const component = transparentParent(parent.parent), owner = component.parent;
+  return context.vueComponent === true && ts.isExportAssignment(owner) && owner.expression === component
+    || owner && vueCall(owner, 'defineComponent', context) && owner.arguments[0] === component;
+}
+function vueFunctionMetadata(node, context) {
+  let value = transparentParent(node);
+  if (ts.isArrayLiteralExpression(value.parent)) value = transparentParent(value.parent);
+  const field = value.parent;
+  if (!ts.isPropertyAssignment(field) || field.initializer !== value) return false;
+  let props = field.parent;
+  if (ts.isObjectLiteralExpression(props) && vuePropsContainer(props, context)) return true;
+  if (propertyName(field.name) === 'type') {
+    const descriptor = transparentParent(props), property = descriptor.parent;
+    if (!ts.isPropertyAssignment(property) || property.initializer !== descriptor) return false;
+    props = property.parent;
+  }
+  return ts.isObjectLiteralExpression(props) && vuePropsContainer(props, context);
+}
+function declarationName(node) {
+  const parent = node.parent;
+  return parent?.name === node && (ts.isPropertyAssignment(parent) || ts.isPropertySignature(parent)
+    || ts.isMethodDeclaration(parent) || ts.isMethodSignature(parent) || ts.isPropertyDeclaration(parent)
+    || ts.isFunctionDeclaration(parent) || ts.isClassDeclaration(parent) || ts.isVariableDeclaration(parent)
+    || ts.isParameter(parent) || ts.isEnumDeclaration(parent) || ts.isEnumMember(parent)
+    || ts.isImportSpecifier(parent) || ts.isImportClause(parent));
+}
+export function isDynamicFunctionReference(node, context = {}) {
+  if (!ts.isIdentifier(node) || node.text !== 'Function') return false;
+  return !isTypeOnlyReference(node) && !declarationName(node) && !vueFunctionMetadata(node, context);
+}

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -132,6 +132,7 @@
     "local-scope-candidate.mjs",
     "local-scope-context.mjs",
     "local-scope-files.mjs",
+    "local-scope-import-expressions.mjs",
     "local-scope-repository.mjs",
     "local-scope-signature.mjs",
     "local-scope-config-imports.mjs",
@@ -212,6 +213,7 @@
     "ide-queue.mjs",
     "local-discipline-actions.mjs",
     "local-discipline-analysis.mjs",
+    "local-typescript-function-reference.mjs",
     "local-discipline-batch.mjs",
     "local-discipline-contracts.mjs",
     "local-discipline-gate.mjs",
@@ -233,7 +235,7 @@
     "reuse-discipline-release.mjs"
   ],
   "scripts": {
-    "test": "node --test --test-concurrency=1 test/*.test.mjs",
+    "test": "node test/run.mjs",
     "prepublishOnly": "node release.mjs",
     "prepare:archguard": "node archguard-runtime-build.mjs",
     "check:archguard": "node archguard-runtime-build.mjs --check",

package/release-state.json

@@ -1,10 +1,10 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.50",
-  "digest": "c749866399a99cf122f71c00dca31cf49706a76f0998b7f3197d0763968468b5",
+  "version": "0.1.52",
+  "digest": "81fb53f113036a9ffdaa64ac99f3f9c0cc4180c623997ee009d4bc63e58a9ab8",
   "files": {
     "ide-code-mode.mjs": "f3f53357ba09727b3b597851976a24de93287c0faca5052448277d0904bb61f7",
-    "ide-command.mjs": "dcd4b48305cc4f106e5e4509e794e4b46ef02de29afa9cccbbc2774308c81ff3",
+    "ide-command.mjs": "86472c2f89c17e13a6fb0e41794add983400aac3e626891dbb3812e34320e229",
     "ide-hook.mjs": "2f00e56de1e1149f117714d5dd334196f1a3f206c3bfab541393bc0f625e0108",
     "ide-install.mjs": "10247efadcfeef5da001022d12080bd0f789e67fdf7862bcc65db73dda3bbe57",
     "ide-session.mjs": "dc256e77b03303932d354768c0e79384340a3137e7421b4ae9c869f7e58e1a3a",
@@ -12,14 +12,16 @@
     "ide-results.mjs": "dfe0d3f773c65a9fc21056538d7005012c982ed4509bc0410d7f62813d0863fd",
     "ide-queue.mjs": "806e716c775fd0079417027b135977c8516f47dddb0bc5ca19e32a355dab0e9e",
     "local-discipline-actions.mjs": "2379c08d0f49c44068f8239db7e514d75885f4606b1b88a7a36e4ff19167caca",
-    "local-discipline-analysis.mjs": "f49e67a2eb2f19f8eb7c4226d481842b38c0f19b495ad0149cbf649baae16bb9",
+    "local-discipline-analysis.mjs": "e887abdd1c6d6ba59ef7323e9035528f0491e5458ca8159985ec26e1ca67a4af",
     "local-discipline-batch.mjs": "2cc90dbae55efdee0c445da399c0a9acafa92e915344c25208ebca554fc4c9e9",
+    "local-typescript-function-reference.mjs": "af682b479fe0d69a5ecd62232406bb8078408ec8710733cfed9ae6b059762ba5",
+    "local-scope-import-expressions.mjs": "6623dea5501c4dc24e12c99e0776d65650bbe752c85c9509d022ba1f61bd5111",
     "local-discipline-contracts.mjs": "6cf8a3d132fdb9074eb1441600afe7aa199df33e88a71a660d9db534c14f19e4",
     "local-discipline-contracts.d.mts": "defc684c78dc88afa1c54340ab4a01ae36db7aa11257cbe1f5cd323f608c78c4",
     "local-discipline-gate.mjs": "04b1ba092d7f4342a0e77cfbeb44d9634dbce9fec0c79e6a1e4b11a662d904ac",
     "local-discipline-native.mjs": "8b99b5ce951cab3c1426428ad807650c61c0ffb2c346d747b73b99057b382049",
     "local-discipline-operations.mjs": "9fcb7b8889b7718d42e1d37936485d8198d5017d405e0cdbbabdbbd12fcc9d48",
-    "local-discipline-repository.mjs": "ffd31e9b2946a9784d4ab59cee5345318d2152816ce995ed5dac11efa4096bc4",
+    "local-discipline-repository.mjs": "b6392e02ecae333dfdc8df41f203fd69bed035d88b15b16d112ab1897b3c297c",
     "local-discipline-snapshot.mjs": "8fd35b2cfbece8f64579f144f589a66dec9b6022d50fe931c4c1f886cb83134d",
     "local-runner-discipline.mjs": "86f451de2f1e12a24f5596a29828891c1eba13cd4714ed0c18a77d66cecef934",
     "local-integrity.d.mts": "21357f306234bd841c0d3d90bf2d09f7663f63746f897b9f38190428ae8198b3",
@@ -29,9 +31,9 @@
     "runtime/validator-runtime-v7.0.44.d.mts": "7797edbfe2f7de24da370204dce4dfd22822a1bd80df93514fff900b98afe36f",
     "snapshot-retention.mjs": "4f8919fe8ec49fb4c23e080a8ad2fa3a9282bca3fffe7cf55c64e89ef316697e",
     "snapshot-cleanup-journal.mjs": "76a9684cc95b4eb076e1298d78a9dff37948b00d9607b8f546c599072d3ed331",
-    "IDE-EXECUTION.md": "4e76abb3b2e357de07665d7422204ce710af3cafc0ef946816de73bf1a8998e6",
+    "IDE-EXECUTION.md": "2cb952bb919261e9e420c9d83659eba013e5b1b175d80da03b50b660edfe4f31",
     "REUSE-DISCIPLINE.md": "5b214cf313e7f715f52d54e28093a2d038f0f196ca64b15d1c49587b9d8eecf8",
-    "reuse-discipline-release.mjs": "20ded9c21bd71b8779c454f5eba4c7c0a943ef99d94117b9bbef891d2ab6e3de",
+    "reuse-discipline-release.mjs": "2935898d1aa807fb982a78d7ab5cb1abe05e3c8fc945dc0909da8098872aa1ac",
     "local-final-gate16.mjs": "083aec470670e6cdb7ad2ab27b7a51b53a9ec3a8b4121cb9cbfa17d9940892c2",
     "local-final-gate16-checks.mjs": "1dd30e9666d458d8b12ca6e4975f6f0ac8450c3ea9cbecc7401ae037f66b589a",
     "local-final-gate16-worker.mjs": "344d64b6c1c5552b96960e0d8514a876a3dbfa9762ab9eb749038e8351727121",
@@ -81,7 +83,7 @@
     "CAPABILITY-MAP.md": "a0f0468a098725ced52a96dd8e22bfc7d1ce7681a8446ebf7dae3696c76c3385",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
     "DELIVERY-BOUNDARIES.md": "d1bb2895e23fc14bf1c76707bd1f6f03b39695501a78a0b7289dc37b099889dc",
-    "package.json": "cdb1f686304d5d29d1feff1b1ec5b75e4e3dcff1f1da841dfb59d0502ab261e8",
+    "package.json": "d385aa543bff1f373a1fb8464c712c4ea04e1b2938a8603ddecca903161cbac3",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
     "release.mjs": "e206cb6cabbb02542317bce283f7ba674621e67765a3eacef5741f2d6b1c58b2",
     "local-cli.mjs": "11461e4cf4f6a8612ff275bf8296ec57ff22281156cb2c72834d3c764ba422a1",
@@ -121,8 +123,8 @@
     "local-stage-boundary.mjs": "84c3bb5beab29306274c5ca8a78f19a83ed664ae1b93a8372bb493158b304fe3",
     "local-scope-candidate.mjs": "8f0bd9606e70d4a0ebacdd3cd600ec3afed85e2bb3e1760aa1144cf55d4e028a",
     "local-scope-context.mjs": "79753abfc6c76089d17f003a1be537dfaea10d6731c542f7fc53f2a9996ed164",
-    "local-scope-files.mjs": "96c301f2a45e5fa22f0b11fb15e5e564f118e53187fc7749263c78d5ed87b056",
-    "local-scope-repository.mjs": "56d7874326de2f90e47cf13d6b9839372044ea70ab15fbb7f7125bd13a87a087",
+    "local-scope-files.mjs": "4c14a5e226dd5518aeb37f199b1aa896943a66d41e5a1757a3b3fd8a79446d76",
+    "local-scope-repository.mjs": "d9d4c81c3f401c38c33b8dd7bdf8ebaf4658d1afd1cce408a7acd37f8836a6df",
     "local-scope-git.mjs": "53bbbb6c4795db711b5bc164591a6ad79a561427da046d6bbe997dae6eb82829",
     "local-scope-git-reads.mjs": "5d8a2636bab955cb325cb693db7423e69512355887ae5b5af3b8cb615f5ddad0",
     "local-git-executable.mjs": "9391d716529025b1de3ee006df658a9d765b6ef29ad24ef9b7436829318e651e",

package/releases.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.1.52",
+    "date": "2026-10-17",
+    "zh": "修复 Vue/TypeScript 的 Function 类型和真实 Vue 回调 prop 被误判为动态依赖；解析不可变 const 的有限语言模块导入，记录实际依赖与哈希。补齐 Vue 候选依赖检查；未知运行时导入报告文件、行列和原因。测试采用隔离用户目录，越界、动态执行、未知删除与原任务写入校验继续保留。",
+    "en": "Fixed Vue/TypeScript Function types and genuine Vue callback props being misclassified as dynamic dependencies. Resolve finite immutable const-based language imports with actual dependency hashes and inspect Vue candidate dependencies. Unbounded runtime imports report file, line, column and reason. Tests use isolated user directories while path, dynamic-execution, unknown-deletion and original-task mutation checks remain enforced."
+  },
+  {
+    "version": "0.1.51",
+    "date": "2026-10-16",
+    "zh": "修复入口阶段将自身生成的带引号 capabilities/unlock 命令误判为原生 Bash；正常 TypeScript 候选探测遇到普通文件祖先时继续回退，真实访问仍严格校验。路径拒绝会报告请求路径、阻断祖先、解析地址和原因。",
+    "en": "Fixed entry guards misclassifying their own quoted capabilities/unlock commands as native shell. Read-only TypeScript probes skip nonexistent children beneath ordinary files and continue valid fallbacks; actual access remains strict. Rejections identify the requested path, blocking ancestor, resolved target and reason."
+  },
   {
     "version": "0.1.50",
     "date": "2026-10-16",

package/reuse-discipline-release.mjs

@@ -1,5 +1,6 @@
 const ide = ['ide-code-mode.mjs', 'ide-command.mjs', 'ide-hook.mjs', 'ide-install.mjs', 'ide-session.mjs', 'break-glass.mjs', 'ide-results.mjs', 'ide-queue.mjs'];
 const discipline = ['local-discipline-actions.mjs', 'local-discipline-analysis.mjs', 'local-discipline-batch.mjs',
+  'local-typescript-function-reference.mjs', 'local-scope-import-expressions.mjs',
   'local-discipline-contracts.mjs', 'local-discipline-contracts.d.mts', 'local-discipline-gate.mjs',
   'local-discipline-native.mjs', 'local-discipline-operations.mjs', 'local-discipline-repository.mjs',
   'local-discipline-snapshot.mjs', 'local-runner-discipline.mjs', 'local-integrity.d.mts'];
@@ -15,4 +16,6 @@ export const reuseDisciplineReleaseLabels = Object.fromEntries([
   ...cleanup.map(file => [file, { zh: '验收后快照自动清理', en: 'verified snapshot cleanup' }]),
   ...documentation.map(file => [file, { zh: 'IDE 执行与复用纪律文档', en: 'IDE execution and reuse discipline documentation' }]),
   ['reuse-discipline-release.mjs', { zh: '复用纪律版本追踪', en: 'reuse discipline release tracking' }],
+  ['local-typescript-function-reference.mjs', { zh: 'TypeScript 类型与 Vue 属性构造器引用分析', en: 'TypeScript type and Vue prop constructor references' }],
+  ['local-scope-import-expressions.mjs', { zh: '不可变有限动态导入与逐站点未核实诊断', en: 'immutable finite imports and precise unresolved import diagnostics' }],
 ]);