@entrorove/skill 0.1.53 → 0.1.54

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.54 — 2026-10-17
+
+- 修复受管 Node 只读 SHA-256 命令在 Codex 工具门禁中的静态识别与安全改写；按已证明的 createRequire 原目录解析实际安装依赖并记录只读元数据，保留未知上下文和越界拒绝。
+- Fixed static recognition and safe rewriting of managed Node SHA-256 reads in Codex tool guards; resolved installed dependencies from proven createRequire anchors with read-only metadata while preserving unknown-context and path-boundary refusals.
+
 ## 0.1.53 — 2026-10-17
 
 - 补齐原任务受限编辑、真实写后结算与连续修改，保留未知依赖和独立验证边界；沙箱关闭后可运行原批准命令并保存本地观察。修复前置条件、断线恢复和停止循环，独立监督器约束崩溃后的子进程。本地成功不代表独立验证或交付。

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute an engineering task through Entrorove, preserving its origi
 
 # entrorove · 熵巡
 
-Version: 0.1.53.
+Version: 0.1.54.
 
 Entrorove applies to the whole task once selected. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 

package/ide-code-mode.mjs

@@ -1,12 +1,12 @@
 import { createRequire } from 'node:module';
-import { literalCommand, sdkCommand, readCommand } from './ide-command.mjs';
+import { literalCommand, sdkCommand, readCommand, runtimeHashRead } from './ide-command.mjs';
 
-export function inspectIdeCodeMode(code, runtime) {
-  if (typeof code !== 'string' || code.length > 1_000_000) return false;
+export function prepareIdeCodeMode(code, runtime) {
+  if (typeof code !== 'string' || code.length > 1_000_000) return { allowed: false };
   const ts = createRequire(runtime.cli)('typescript');
   const source = ts.createSourceFile('host-call.js', code, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
-  if (source.parseDiagnostics.length) return false;
-  let allowed = true;
+  if (source.parseDiagnostics.length) return { allowed: false };
+  let allowed = true; const replacements = [];
   const literal = node => {
     if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;
     if (ts.isNumericLiteral(node)) return Number(node.text);
@@ -26,8 +26,22 @@ export function inspectIdeCodeMode(code, runtime) {
       const name = node.expression.getText(source);
       if (name === 'tools.exec_command') {
         try {
-          const args = literal(node.arguments[0]), command = literalCommand(args.cmd ?? args.command);
-          if (!(readCommand(command) || sdkCommand(command, runtime))) allowed = false;
+          const argument = node.arguments[0], args = literal(argument), command = literalCommand(args.cmd ?? args.command);
+          const hash = runtimeHashRead(command, runtime);
+          if (hash) {
+            const safe = node.arguments.length === 1 && typeof args.cmd === 'string' && !Object.hasOwn(args, 'command')
+              && Object.keys(args).every(key => ['cmd', 'workdir', 'max_output_tokens', 'yield_time_ms', 'login', 'shell'].includes(key))
+              && (args.shell === undefined || args.shell === '/bin/sh')
+              && (args.login === undefined || args.login === false)
+              && (args.workdir === undefined || typeof args.workdir === 'string')
+              && (args.max_output_tokens === undefined || Number.isSafeInteger(args.max_output_tokens) && args.max_output_tokens > 0)
+              && (args.yield_time_ms === undefined || Number.isSafeInteger(args.yield_time_ms) && args.yield_time_ms >= 0);
+            if (!safe) allowed = false;
+            else {
+              const fixed = { ...args, cmd: hash, shell: '/bin/sh', login: false };
+              replacements.push({ start: argument.getStart(source), end: argument.getEnd(), text: JSON.stringify(fixed) });
+            }
+          } else if (!(readCommand(command) || sdkCommand(command, runtime))) allowed = false;
         } catch { allowed = false; }
       } else if (name === 'tools.update_goal' || name === 'tools.get_goal') {
         try {
@@ -40,5 +54,13 @@ export function inspectIdeCodeMode(code, runtime) {
     }
     ts.forEachChild(node, visit);
   };
-  visit(source); return allowed;
+  visit(source);
+  if (!allowed) return { allowed: false };
+  let prepared = code;
+  for (const item of replacements.sort((a, b) => b.start - a.start)) {
+    prepared = `${prepared.slice(0, item.start)}${item.text}${prepared.slice(item.end)}`;
+  }
+  return { allowed: true, code: prepared };
 }
+
+export function inspectIdeCodeMode(code, runtime) { return prepareIdeCodeMode(code, runtime).allowed; }

package/ide-command.mjs

@@ -113,6 +113,32 @@ export function readCommand(parsed) {
   return false;
 }
 
+const runtimeHashTool = process.platform === 'darwin'
+  ? { name: 'shasum', executable: '/usr/bin/shasum', flags: ['-a', '256'] }
+  : process.platform === 'linux'
+    ? { name: 'sha256sum', executable: '/usr/bin/sha256sum', flags: [] } : null;
+
+export function runtimeHashCommand(runtime) {
+  const node = runtime?.node;
+  if (!runtimeHashTool || typeof node !== 'string' || node.length > 4096 || !path.isAbsolute(node)
+    || path.basename(node) !== 'node' || path.normalize(node) !== node
+    || !/^[A-Za-z0-9/._+@ -]+$/u.test(node)) return null;
+  return `/usr/bin/env -i PATH=/usr/bin:/bin ${runtimeHashTool.executable} ${[...runtimeHashTool.flags, '--'].join(' ')} '${node}'`;
+}
+
+export function runtimeHashRead(parsed, runtime) {
+  const canonical = runtimeHashCommand(runtime);
+  if (!canonical || !parsed || parsed.input) return null;
+  const words = parsed.words, { name, executable, flags } = runtimeHashTool;
+  const normal = [name, ...flags, runtime.node];
+  const absolute = [executable, ...flags, runtime.node];
+  const withSeparator = [executable, ...flags, '--', runtime.node];
+  const protectedCommand = ['/usr/bin/env', '-i', 'PATH=/usr/bin:/bin', ...withSeparator];
+  if ([normal, absolute, withSeparator, protectedCommand].some(expected =>
+    words.length === expected.length && words.every((word, index) => word === expected[index]))) return canonical;
+  return null;
+}
+
 export function renderSdkCommand(call, runtime, sessionId, host = process.env.ENTROROVE_IDE ?? 'Codex') {
   const quote = value => `'${String(value).replace(/'/gu, "'\\''")}'`;
   const header = `ENTROROVE_IDE=${quote(host)} ENTROROVE_SESSION=${quote(sessionId)} CODEX_THREAD_ID=${quote(sessionId)} ${[runtime.node, runtime.cli, ...call.args].map(quote).join(' ')}`;

package/ide-hook.mjs

@@ -4,8 +4,9 @@ import { fileURLToPath } from 'node:url';
 import { ideSession, ideRuntime, bindIdeAccount, ideContext, ideDigest, readBreakGlass,
   ideBlockIdentity, repeatedIdeBlock, observeIdeToolOutcome } from './ide-session.mjs';
 import { isStageTerminal, stageOf } from './local-stage-boundary.mjs';
-import { literalCommand, sdkCommand, readCommand, renderSdkCommand, installerCommand } from './ide-command.mjs';
-import { inspectIdeCodeMode } from './ide-code-mode.mjs';
+import { literalCommand, sdkCommand, readCommand, renderSdkCommand, installerCommand,
+  runtimeHashCommand, runtimeHashRead } from './ide-command.mjs';
+import { prepareIdeCodeMode } from './ide-code-mode.mjs';
 import { pathToFileURL } from 'node:url';
 import path from 'node:path';
 import { parseIdeResults, consumeIdeResults } from './ide-results.mjs';
@@ -35,17 +36,38 @@ function operationOf(call) {
 }
 function isManagementCall(call) { return managementOperations.has(operationOf(call)); }
 function resetBlockStreak(state) { state.blockStreak = 0; delete state.lastBlockKey; delete state.lastBlockIdentity; }
-function blockedReason(state, event, reason) {
+function blockedReason(state, event, reason, detail = {}) {
   const key = ideDigest({ identity: ideBlockIdentity(state), tool: event.tool_name, phase: state.phase, reason });
   const repeated = state.lastBlockKey === key;
   state.blockStreak = repeated ? (state.blockStreak ?? 0) + 1 : 1;
   state.lastBlockKey = key;
   state.lastBlockIdentity = ideBlockIdentity(state);
-  const mechanism = `机制：${state.stateFile ?? '会话状态文件'} 当前 phase=${state.phase}${state.pendingCall ? `，pendingCall=${state.pendingCall.toolUseId}` : ''}；该阶段只放行 Entrorove 管理调用，业务与写操作需先建立原 flow 并取得 nextStep。`;
+  const mechanism = detail.mechanism ?? `机制：${state.stateFile ?? '会话状态文件'} 当前 phase=${state.phase}${state.pendingCall ? `，pendingCall=${state.pendingCall.toolUseId}` : ''}；该阶段只放行 Entrorove 管理调用，业务与写操作需先建立原 flow 并取得 nextStep。`;
   const repeat = repeated && state.blockStreak >= 2 ? `同一阻断已出现 ${state.blockStreak} 次，禁止再次检查：说明机制、给出绕过方案并执行绕过。` : '';
-  return `${reason} ${mechanism} ${repeat}\n绕过方案（离线、无网络、无协议、不经 hook，终端直接运行）：\n${unlockCommand}\n执行后重试原管理调用；项目写入仍需原任务授权。`;
+  const recovery = detail.recovery ?? `绕过方案（离线、无网络、无协议、不经 hook，终端直接运行）：\n${unlockCommand}\n执行后重试原管理调用；项目写入仍需原任务授权。`;
+  return `${reason} ${mechanism} ${repeat}\n${recovery}`;
+}
+const denyBlocked = (state, event, reason, detail) => deny(blockedReason(state, event, reason, detail));
+function runtimeHashAttempt(command, parsed) {
+  const name = parsed?.words[0];
+  return ['shasum', '/usr/bin/shasum', 'sha256sum', '/usr/bin/sha256sum'].includes(name)
+    || name === '/usr/bin/env' && parsed.words[1] === '-i' && parsed.words[2] === 'PATH=/usr/bin:/bin'
+      && ['/usr/bin/shasum', '/usr/bin/sha256sum'].includes(parsed.words[3])
+    || typeof command === 'string' && /^\s*(?:(?:\/usr\/bin\/)?(?:shasum|sha256sum)|\/usr\/bin\/env\s+-i\s+PATH=\/usr\/bin:\/bin\s+\/usr\/bin\/(?:shasum|sha256sum))(?:\s|$)/u.test(command);
+}
+function safeHashToolInput(input) {
+  return input && typeof input === 'object' && Object.keys(input).every(key =>
+    ['cmd', 'command', 'workdir', 'max_output_tokens', 'yield_time_ms', 'shell', 'login'].includes(key))
+    && (input.shell === undefined || input.shell === '/bin/sh')
+    && (input.login === undefined || input.login === false);
+}
+function denyRuntimeHash(state, event, runtime) {
+  const safe = runtimeHashCommand(runtime);
+  return denyBlocked(state, event, 'ENTROROVE_IDE_RUNTIME_HASH_DENIED：仅允许读取本次安装所绑定的 Node 可执行文件 SHA-256。', {
+    mechanism: `机制：哈希路径必须精确等于受管 runtime.node；拒绝其他文件、额外参数、shell 展开和自定义执行器。当前 phase=${state.phase}。`,
+    recovery: `恢复：用固定只读命令重新取得该 Node 文件的哈希：\n${safe ?? '当前平台没有受支持的固定哈希命令；请使用受管安装所绑定的 Node 路径。'}${safe ? `\n代码模式请传静态 tools.exec_command({cmd:${JSON.stringify(safe)},shell:'/bin/sh',login:false})。` : ''}\n本次在 hook 本地预检中拒绝，未发起协议请求，因此没有 requestId。`,
+  });
 }
-const denyBlocked = (state, event, reason) => deny(blockedReason(state, event, reason));
 function lifecycleResult(value, depth = 0) {
   if (!value || typeof value !== 'object' || depth > 4) return null;
   if (value.operation === 'flow-cancel' || value.operation === 'flow-abandon') return value;
@@ -171,9 +193,26 @@ async function beforeTool(event, state, home) {
   if (!state.active) return {};
   if (['exec','functions.exec'].includes(event.tool_name)) {
     const current = await ideRuntime(home), code = typeof event.tool_input === 'string' ? event.tool_input : event.tool_input?.code;
-    return inspectIdeCodeMode(code, current) ? output('PreToolUse', { additionalContext: ideContext(state) }) : denyBlocked(state, event, 'Entrorove：代码模式含未批准的原生执行或动态工具输入；请使用原任务的受控入口。');
+    const prepared = prepareIdeCodeMode(code, current);
+    if (prepared.allowed) return output('PreToolUse', { additionalContext: ideContext(state),
+      ...(prepared.code === code ? {} : { updatedInput: typeof event.tool_input === 'string' ? prepared.code
+        : { ...event.tool_input, code: prepared.code } }) });
+    if (typeof code === 'string' && /\b(?:shasum|sha256sum)\b/u.test(code)) return denyRuntimeHash(state, event, current);
+    return denyBlocked(state, event, 'Entrorove：代码模式含未批准的原生执行或动态工具输入；请使用原任务的受控入口。');
   }
   if (event.tool_name === 'update_goal' && (state.phase === 'setup' || unlocked)) return output('PreToolUse', { additionalContext: ideContext(state) });
+  if (isShell) {
+    const fixedHash = runtimeHashRead(parsed, runtime);
+    if (fixedHash) {
+      if (!safeHashToolInput(event.tool_input)) return denyRuntimeHash(state, event, runtime);
+      resetBlockStreak(state);
+      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: { ...event.tool_input, command: fixedHash,
+        ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: fixedHash } : {}),
+        ...(event.tool_name === 'exec_command' ? { shell: '/bin/sh', login: false } : {}) },
+      additionalContext: ideContext(state) });
+    }
+    if (runtimeHashAttempt(command, parsed)) return denyRuntimeHash(state, event, runtime ?? await ideRuntime(home));
+  }
   if (isShell && readCommand(parsed) || readTools.has(event.tool_name)) return output('PreToolUse', { additionalContext: ideContext(state) });
   return denyBlocked(state, event, `Entrorove：已阻止原生 ${event.tool_name ?? 'unknown'} 调用。当前阶段 ${state.phase}${state.taskNumber ? `，云端任务 ${state.taskNumber}` : ''}。写入、删除、移动及不确定的终端操作必须使用原任务的 guarded-write／guarded-delete／guarded-move 或已批准的执行计划。`);
 }

package/local-scope-create-require.mjs

@@ -0,0 +1,142 @@
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import ts from 'typescript';
+import { createScopeImportResolver, scopeSourceChecker } from './local-scope-import-expressions.mjs';
+import { scopeFail, scopePath } from './local-scope-files.mjs';
+
+const purePathMethods = new Set(['join', 'resolve', 'basename', 'dirname', 'extname', 'isAbsolute', 'normalize',
+  'relative', 'parse', 'format', 'toNamespacedPath', 'matchesGlob']);
+function unwrap(node) { while (node && ts.isParenthesizedExpression(node)) node = node.expression; return node; }
+function imported(declaration) {
+  if (ts.isImportSpecifier(declaration)) return { imported: declaration.propertyName?.text ?? declaration.name.text,
+    module: declaration.parent.parent.parent.moduleSpecifier.text };
+  if (ts.isImportClause(declaration)) return { imported: 'default', module: declaration.parent.moduleSpecifier.text };
+  if (ts.isNamespaceImport(declaration)) return { imported: '*', module: declaration.parent.parent.moduleSpecifier.text };
+  return null;
+}
+function importName(node) {
+  for (let parent = node; parent; parent = parent.parent) {
+    if (ts.isImportDeclaration(parent)) return true;
+    if (ts.isStatement(parent)) return false;
+  }
+  return false;
+}
+function immutable(declaration, source) {
+  return declaration && ts.isVariableDeclaration(declaration) && ts.isVariableDeclarationList(declaration.parent)
+    && declaration.parent.flags & ts.NodeFlags.Const && declaration.initializer && declaration.getSourceFile() === source
+    && !(ts.getCombinedModifierFlags(declaration) & ts.ModifierFlags.Ambient) && !source.isDeclarationFile;
+}
+function staticAnchor(call, source, repositoryRoot, filename, declaration, pathMethod) {
+  if (call.arguments.length !== 1) return null;
+  let visited = 0;
+  const value = (raw, seen = new Set(), depth = 0) => {
+    const node = unwrap(raw);
+    if (!node || depth > 32 || ++visited > 256) return null;
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;
+    if (ts.isPropertyAccessExpression(node) && ts.isMetaProperty(node.expression)
+      && node.expression.keywordToken === ts.SyntaxKind.ImportKeyword && node.expression.name.text === 'meta') {
+      const file = path.resolve(repositoryRoot, filename);
+      return node.name.text === 'dirname' ? path.dirname(file) : node.name.text === 'filename' ? file
+        : node.name.text === 'url' ? pathToFileURL(file).href : null;
+    }
+    if (ts.isCallExpression(node)) {
+      const method = pathMethod(node.expression);
+      if (!['join', 'resolve'].includes(method) || node.arguments.length < 1 || node.arguments.length > 32) return null;
+      const args = node.arguments.map(item => value(item, seen, depth + 1));
+      if (args.some(item => typeof item !== 'string') || method === 'resolve' && !args.some(item => path.isAbsolute(item))) return null;
+      return path[method](...args);
+    }
+    if (!ts.isIdentifier(node)) return null;
+    const bound = declaration(node);
+    return immutable(bound, source) && !seen.has(bound) ? value(bound.initializer, new Set([...seen, bound]), depth + 1) : null;
+  };
+  let absolute = value(call.arguments[0]);
+  if (typeof absolute !== 'string' || !absolute || /[\u0000-\u001f\u007f]/.test(absolute)) return null;
+  if (absolute.startsWith('file:')) { try { absolute = fileURLToPath(absolute); } catch { return null; } }
+  if (!path.isAbsolute(absolute)) return null;
+  const relative = path.relative(repositoryRoot, absolute).split(path.sep).join('/');
+  if (!relative || relative === '..' || relative.startsWith('../') || path.isAbsolute(relative)
+    || relative.split('/').some(part => ['.git', '.entrorove', '.aimlock', '.archguard'].includes(part))) {
+    scopeFail('ENTROROVE_PATH_UNSAFE', `createRequire in "${filename}" resolves its anchor outside the authorized repository or into a reserved control directory`);
+  }
+  return scopePath(relative);
+}
+/** Infer only lexical builtin factories and immutable path expressions; never run scanned code. */
+export function createScopeRequireContexts(source, repositoryRoot, filename) {
+  let checker, safety;
+  const declaration = node => {
+    checker ??= scopeSourceChecker(source);
+    const declarations = checker.getSymbolAtLocation(node)?.declarations;
+    return declarations?.length === 1 && declarations[0].getSourceFile() === source ? declarations[0] : null;
+  };
+  const origin = node => ts.isIdentifier(node) ? imported(declaration(node) ?? source) : null;
+  const factory = node => { const value = node && origin(unwrap(node));
+    return value?.imported === 'createRequire' && ['node:module', 'module'].includes(value.module); };
+  const pathObject = node => { const value = node && origin(unwrap(node));
+    return ['default', '*'].includes(value?.imported) && ['node:path', 'path'].includes(value?.module); };
+  const pathMethod = node => {
+    node = unwrap(node);
+    if (node && ts.isPropertyAccessExpression(node) && pathObject(node.expression)) return node.name.text;
+    const value = node && origin(node);
+    return value && ['node:path', 'path'].includes(value.module) ? value.imported : null;
+  };
+  const factoryCall = node => { node = unwrap(node);
+    return node && ts.isCallExpression(node) && factory(node.expression) ? node : null; };
+  const moduleArguments = createScopeImportResolver(source);
+  const mutableBuiltinLoad = node => {
+    if (!ts.isCallExpression(node) || !node.arguments.length) return false;
+    const callee = unwrap(node.expression), bound = ts.isIdentifier(callee) && declaration(callee);
+    const loading = callee.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(callee) && callee.text === 'require'
+      || factoryCall(callee) || bound && ts.isVariableDeclaration(bound) && factoryCall(bound.initializer);
+    return loading && moduleArguments(node.arguments[0])?.some(name => ['path', 'node:path', 'module', 'node:module'].includes(name));
+  };
+  function safeBuiltins() {
+    if (safety !== undefined) return safety;
+    safety = true;
+    const visit = node => {
+      if (mutableBuiltinLoad(node)) safety = false;
+      if (ts.isIdentifier(node) && !importName(node)) {
+        if (node.text === 'syncBuiltinESMExports') safety = false;
+        if (pathObject(node)) {
+          const member = node.parent, call = member?.parent;
+          if (!ts.isPropertyAccessExpression(member) || member.expression !== node
+            || !(purePathMethods.has(member.name.text) && ts.isCallExpression(call) && call.expression === member)
+              && !['sep', 'delimiter'].includes(member.name.text)) safety = false;
+        }
+        const method = origin(node);
+        if (method && ['node:module', 'module'].includes(method.module)
+          && ['default', '*', 'register', 'registerHooks', 'syncBuiltinESMExports'].includes(method.imported)) safety = false;
+        if (method && ['node:path', 'path'].includes(method.module) && purePathMethods.has(method.imported)
+          && !(ts.isCallExpression(node.parent) && node.parent.expression === node)) safety = false;
+        if (factory(node) && !(ts.isCallExpression(node.parent) && node.parent.expression === node)) safety = false;
+      }
+      ts.forEachChild(node, visit);
+    };
+    visit(source); return safety;
+  }
+  const anchor = call => repositoryRoot && safeBuiltins() ? staticAnchor(call, source, repositoryRoot, filename, declaration, pathMethod) : null;
+  function loader(node) {
+    node = unwrap(node);
+    const direct = factoryCall(node);
+    if (direct) return { anchor: anchor(direct), call: direct };
+    if (!node || !ts.isIdentifier(node)) return null;
+    const bound = declaration(node), creation = bound && ts.isVariableDeclaration(bound) && factoryCall(bound.initializer);
+    if (creation) return { anchor: immutable(bound, source) ? anchor(creation) : null, call: creation, declaration: bound };
+    if (node.text === 'require' && bound) return { anchor: null };
+    return null;
+  }
+  return { loader,
+    knownFactoryReference(node) {
+      const named = ts.isImportSpecifier(node.parent) && imported(node.parent);
+      return importName(node) && (factory(node) || named?.imported === 'createRequire' && ['node:module', 'module'].includes(named.module))
+        || factory(node) && ts.isCallExpression(node.parent)
+        && node.parent.expression === node && anchor(node.parent) !== null;
+    },
+    loaderReference(node) {
+      if (!ts.isIdentifier(node) || importName(node)) return null;
+      const found = loader(node);
+      if (!found) return null;
+      const declared = found.declaration?.name === node;
+      return { safe: Boolean(found.anchor) && (declared || ts.isCallExpression(node.parent) && node.parent.expression === node) };
+    } };
+}

package/local-scope-import-expressions.mjs

@@ -7,7 +7,7 @@ function unwrap(node) {
     || ts.isTypeAssertionExpression(node) || ts.isNonNullExpression(node))) node = node.expression;
   return node;
 }
-function sourceChecker(source) {
+export function scopeSourceChecker(source) {
   const name = path.posix.resolve('/', source.fileName.replaceAll('\\', '/'));
   const matches = value => path.posix.resolve('/', value.replaceAll('\\', '/')) === name;
   const host = { getSourceFile: filename => matches(filename) ? source : undefined,
@@ -47,7 +47,7 @@ export function createScopeImportResolver(source, suppliedChecker) {
         return result;
       }
       if (!ts.isIdentifier(node)) return null;
-      checker ??= sourceChecker(source);
+      checker ??= scopeSourceChecker(source);
       const declarations = checker.getSymbolAtLocation(node)?.declarations;
       if (declarations?.length !== 1) return null;
       const declaration = declarations[0];

package/local-scope-repository.mjs

@@ -15,6 +15,8 @@ import { scopeTsconfigImports } from './local-scope-config-imports.mjs';
 import { scopeGitExecutable } from './local-git-executable.mjs';
 import { createScopeImportResolver, unresolvedImportSite } from './local-scope-import-expressions.mjs';
 import { isTypeOnlyReference, isDynamicFunctionReference } from './local-typescript-function-reference.mjs';
+import { createScopeRequireContexts } from './local-scope-create-require.mjs';
+import { resolveCreatedRequire } from './local-scope-require-resolution.mjs';
 
 const execute = promisify(execFile);
 async function git(root, args, allowed = [], input = { repositoryRoot: root }) {
@@ -107,11 +109,17 @@ function scriptImports(source, filename, context = {}) {
   const parsed = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true,
     scriptKinds.get(path.extname(filename).toLowerCase()) ?? ts.ScriptKind.TS);
   if (parsed.parseDiagnostics.length) scopeFail('ENTROROVE_IMPORT_INVALID', 'source has invalid or unterminated syntax');
-  const found = new Set(), unresolvedImports = [], resolve = createScopeImportResolver(parsed); let dynamic = false;
-  const add = expression => {
+  const found = new Set(), requires = new Map(), unresolvedImports = [], resolve = createScopeImportResolver(parsed); let dynamic = false;
+  const contexts = createScopeRequireContexts(parsed, context.repositoryRoot, context.sourceFilename ?? filename);
+  const unresolved = (expression, reason, message) => { dynamic = true;
+    unresolvedImports.push({ ...unresolvedImportSite(parsed, expression), reason, message }); };
+  const add = (expression, anchor) => {
     const values = resolve(expression);
     if (values === null) { dynamic = true; unresolvedImports.push(unresolvedImportSite(parsed, expression)); }
-    else for (const value of values) found.add(value);
+    else for (const value of values) {
+      if (anchor) requires.set(`${anchor}\0${value}`, { anchor, specifier: value });
+      else found.add(value);
+    }
   };
   const visit = node => {
     if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) { if (node.moduleSpecifier) add(node.moduleSpecifier); }
@@ -120,21 +128,28 @@ function scriptImports(source, filename, context = {}) {
     else if (ts.isCallExpression(node)) {
       const importer = node.expression.kind === ts.SyntaxKind.ImportKeyword;
       const requireCall = ts.isIdentifier(node.expression) && node.expression.text === 'require';
-      if (importer || requireCall) {
+      const created = importer ? null : contexts.loader(node.expression);
+      if (importer || requireCall || created) {
         if (!node.arguments.length || node.arguments.length > (importer ? 2 : 1)) {
           dynamic = true;
           unresolvedImports.push({ ...unresolvedImportSite(parsed, node), reason: 'import-argument-list-not-supported',
             message: 'Import inspection requires one module argument and at most one import-attributes argument' });
         }
-        else add(node.arguments[0]);
+        else if (created && !created.anchor) unresolved(node, 'create-require-context-not-statically-proven',
+          'Require uses a shadowed, mutable or unproven factory/path context; no dependency lookup is authorized');
+        else add(node.arguments[0], created?.anchor);
       }
     }
     const runtimeReference = !isTypeOnlyReference(node);
     if (runtimeReference && ts.isIdentifier(node)) {
-      if (dynamicNames.has(node.text) && (node.text !== 'Function' || isDynamicFunctionReference(node, context))) dynamic = true;
+      if (dynamicNames.has(node.text) && (node.text !== 'Function' || isDynamicFunctionReference(node, context))
+        && !(node.text === 'createRequire' && contexts.knownFactoryReference(node))) dynamic = true;
+      const loader = contexts.loaderReference(node);
+      if (loader && !loader.safe) unresolved(node, 'require-loader-escapes-static-context',
+        'Require loader aliases, mutable bindings and uses outside direct calls remain unresolved');
       if (node.text === 'require' && !(ts.isCallExpression(node.parent) && node.parent.expression === node)
         && !(ts.isPropertyAccessExpression(node.parent) && node.parent.name === node)
-        && !(ts.isMethodDeclaration(node.parent) && node.parent.name === node)) dynamic = true;
+        && !(ts.isMethodDeclaration(node.parent) && node.parent.name === node) && !loader?.safe) dynamic = true;
     }
     if (runtimeReference && ts.isElementAccessExpression(node)) {
       const member = staticString(node.argumentExpression);
@@ -143,7 +158,7 @@ function scriptImports(source, filename, context = {}) {
     if (runtimeReference && ts.isPropertyAccessExpression(node) && node.name.text === 'require' && globalObject(node.expression)) dynamic = true;
     ts.forEachChild(node, visit);
   };
-  visit(parsed); return { specifiers: [...found].sort(), dynamic, unresolvedImports };
+  visit(parsed); return { specifiers: [...found].sort(), requires: [...requires.values()], dynamic, unresolvedImports };
 }
 function vueScripts(source, filename) {
   const { descriptor, errors } = parseVue(source, { filename, sourceMap: false,
@@ -176,14 +191,15 @@ function vueScripts(source, filename) {
   };
   walk(descriptor.template?.ast); return scripts;
 }
-function importSpecifiers(content, filename) {
+function importSpecifiers(content, filename, repositoryRoot) {
   try {
     const source = content.toString('utf8'), parts = path.extname(filename).toLowerCase() === '.vue' ? vueScripts(source, filename) : [{ source, filename }];
-    const specifiers = new Set(), unresolvedImports = []; let dynamic = false;
-    for (const part of parts) { const parsed = scriptImports(part.source, part.filename, part); dynamic ||= parsed.dynamic;
+    const specifiers = new Set(), requires = new Map(), unresolvedImports = []; let dynamic = false;
+    for (const part of parts) { const parsed = scriptImports(part.source, part.filename, { ...part, repositoryRoot, sourceFilename: filename }); dynamic ||= parsed.dynamic;
       unresolvedImports.push(...parsed.unresolvedImports.map(site => ({ ...site, line: site.line + (part.lineOffset ?? 0) })));
+      for (const require of parsed.requires) requires.set(`${require.anchor}\0${require.specifier}`, require);
       for (const specifier of parsed.specifiers) specifiers.add(specifier); }
-    return { specifiers: [...specifiers].sort(), dynamic, unresolvedImports };
+    return { specifiers: [...specifiers].sort(), requires: [...requires.values()], dynamic, unresolvedImports };
   } catch (error) {
     if (typeof error?.code === 'string' && error.code.startsWith('ENTROROVE_')) throw error;
     if (error instanceof RangeError) scopeFail('ENTROROVE_SCOPE_LIMIT', 'dependency syntax exceeds the supported parser or traversal bound');
@@ -280,7 +296,7 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
     const aliases = await scopeTsconfigImports(target => configMetadata(root, target, input), relative, configPath);
     for (const observed of aliases.observations) metadata.set(observed.path, observed);
     const declarations = declarationModules(read.content, relative);
-    const imports = importSpecifiers(read.content, relative); dynamic ||= imports.dynamic;
+    const imports = importSpecifiers(read.content, relative, root); dynamic ||= imports.dynamic;
     unresolvedImports.push(...imports.unresolvedImports.map(site => ({ path: relative, ...site })));
     if (imports.dynamic) dynamicSources.push({ path: relative, sha256: read.sha256 });
     for (const specifier of imports.specifiers.sort()) {
@@ -289,6 +305,12 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
         ...(declarations.has(specifier) ? { declarationOnly: true, declarationPath: relative } : {}) });
       if (target !== null && !visited.has(target)) pending.push(target);
     }
+    for (const request of imports.requires) {
+      const resolved = await resolveCreatedRequire(relative, request.anchor, request.specifier, target => configMetadata(root, target, input));
+      for (const file of resolved.metadata) metadata.set(file.path, file);
+      edges.push({ from: relative, to: resolved.external ? null : resolved.target, external: resolved.external, specifier: request.specifier });
+      if (!resolved.external && resolved.target !== null && !visited.has(resolved.target)) pending.push(resolved.target);
+    }
   }
   const nodes = [...visited.values()].sort((a, b) => a.path.localeCompare(b.path));
   await stableScope(root, nodes, input);
@@ -299,7 +321,7 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
     ...(unresolvedImports.length ? { unresolvedImports } : {}) };
 }
 export async function scopeCandidateImports(root, file, input = { repositoryRoot: root }) {
-  const parsed = importSpecifiers(Buffer.from(file.content), file.path);
+  const parsed = importSpecifiers(Buffer.from(file.content), file.path, root);
   const workspace = await workspaceIndex(root, input);
   const context = (input.importContexts ?? []).filter(item => file.path === item.sourcePrefix || file.path.startsWith(`${item.sourcePrefix}/`))
     .sort((a, b) => b.sourcePrefix.length - a.sourcePrefix.length)[0];
@@ -309,7 +331,12 @@ export async function scopeCandidateImports(root, file, input = { repositoryRoot
     const target = await resolveImport(root, file.path, specifier, workspace, input, aliases, context?.configPath, declarations);
     edges.push({ from: file.path, to: target, external: target === null, specifier });
   }
-  return { edges, dynamic: parsed.dynamic,
+  for (const request of parsed.requires) {
+    const resolved = await resolveCreatedRequire(file.path, request.anchor, request.specifier, target => configMetadata(root, target, input));
+    await stableScope(root, resolved.metadata, input);
+    edges.push({ from: file.path, to: resolved.external ? null : resolved.target, external: resolved.external, specifier: request.specifier });
+  }
+  return { edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)), dynamic: parsed.dynamic,
     ...(parsed.unresolvedImports.length ? { unresolvedImports: parsed.unresolvedImports.map(site => ({ path: file.path, ...site })) } : {}) };
 }
 export async function collectScopeFacts(root, requested, baselineRef, knownFiles = [], input = { repositoryRoot: root }) {

package/local-scope-require-resolution.mjs

@@ -0,0 +1,78 @@
+import path from 'node:path';
+import { builtinModules } from 'node:module';
+import ts from 'typescript';
+import { scopeFail, scopePath } from './local-scope-files.mjs';
+
+const virtualRoot = '/entrorove-repository/';
+const forbidden = new Set(['.git', '.entrorove', '.aimlock', '.archguard']);
+function relativeFile(filename) {
+  const normalized = path.posix.normalize(filename);
+  if (!normalized.startsWith(virtualRoot)) return null;
+  const relative = normalized.slice(virtualRoot.length);
+  if (!relative || relative.split('/').some(part => forbidden.has(part))) return null;
+  return scopePath(relative);
+}
+function checkedManifest(relative, content) {
+  let value;
+  try { value = JSON.parse(content); }
+  catch { scopeFail('ENTROROVE_PACKAGE_INVALID', `createRequire package metadata "${relative}" is invalid JSON`); }
+  const main = value?.main;
+  if (typeof main === 'string' && relativeFile(path.posix.resolve(virtualRoot, path.posix.dirname(relative), main)) === null) {
+    scopeFail('ENTROROVE_PATH_UNSAFE', `createRequire package main in "${relative}" resolves outside the authorized repository or into a reserved directory`);
+  }
+}
+/** Replay CJS package resolution over authorized metadata; neither source nor package entry points execute. */
+export async function resolveCreatedRequire(from, anchor, specifier, metadata) {
+  const observed = new Map(), sources = new Map(), pending = Symbol('authorized-require-read');
+  const read = async relative => {
+    if (sources.has(relative)) return sources.get(relative);
+    let file;
+    try { file = await metadata(relative); }
+    catch (error) { if (!['ENOENT', 'ENOTDIR'].includes(error.code)) throw error; }
+    const content = file ? Buffer.from(file.contentBase64, 'base64').toString('utf8') : null;
+    if (file) {
+      observed.set(relative, { path: relative, sha256: file.sha256 });
+      if (relative.endsWith('/package.json') || relative === 'package.json') checkedManifest(relative, content);
+    }
+    sources.set(relative, content); return content;
+  };
+  if (await read(anchor) === null) scopeFail('ENTROROVE_IMPORT_UNRESOLVED', `${from}: createRequire anchor "${anchor}" has no actual authorized source file`);
+  for (let directory = path.posix.dirname(anchor);; directory = path.posix.dirname(directory)) {
+    for (const name of ['package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock']) {
+      await read(directory === '.' ? name : `${directory}/${name}`);
+    }
+    if (directory === '.') break;
+  }
+  if (builtinModules.includes(specifier) || specifier.startsWith('node:') && builtinModules.includes(specifier.slice(5))) {
+    return { target: null, external: true, metadata: [...observed.values()] };
+  }
+  if (specifier.startsWith('/') || /^[A-Za-z][A-Za-z0-9+.-]*:/.test(specifier) || specifier.includes('\\')) {
+    scopeFail('ENTROROVE_PATH_UNSAFE', `${from}: createRequire module must remain a repository-relative or installed package reference`);
+  }
+  const lookup = filename => {
+    const relative = relativeFile(filename);
+    // Require inspects runtime implementations, never TypeScript declarations or arbitrary TS fallbacks.
+    if (relative === null || /\.(?:[cm]?ts|tsx)$/.test(relative)) return null;
+    if (!sources.has(relative)) throw { pending, relative };
+    return sources.get(relative);
+  };
+  const host = { fileExists: filename => lookup(filename) !== null, readFile: filename => lookup(filename) ?? undefined,
+    getCurrentDirectory: () => virtualRoot.slice(0, -1), realpath: filename => filename,
+    useCaseSensitiveFileNames: true };
+  const options = { module: ts.ModuleKind.NodeNext, moduleResolution: ts.ModuleResolutionKind.NodeNext, allowJs: true,
+    noDtsResolution: true, resolvePackageJsonExports: true, resolvePackageJsonImports: true, customConditions: ['node-addons'] };
+  for (let probes = 0; probes < 1024; probes++) {
+    try {
+      const resolved = ts.resolveModuleName(specifier, virtualRoot + anchor, options, host, undefined, undefined, ts.ModuleKind.CommonJS).resolvedModule;
+      const target = resolved && relativeFile(resolved.resolvedFileName);
+      if (!target) scopeFail('ENTROROVE_IMPORT_UNRESOLVED', `${from}: createRequire(${JSON.stringify(anchor)}) cannot resolve ${JSON.stringify(specifier)} to an actual installed runtime file inside the authorized repository`);
+      await read(target);
+      const external = !specifier.startsWith('.') && !specifier.startsWith('#');
+      return { target, external, metadata: [...observed.values()].filter(file => file.path !== from && (external || file.path !== target)) };
+    } catch (error) {
+      if (error?.pending !== pending) throw error;
+      await read(error.relative);
+    }
+  }
+  scopeFail('ENTROROVE_SCOPE_LIMIT', `${from}: createRequire resolution exceeds the 1024-authorized-file-probe bound`);
+}

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.53",
+  "version": "0.1.54",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.53",
+  "version": "0.1.54",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -140,6 +140,8 @@
     "local-scope-context.mjs",
     "local-scope-files.mjs",
     "local-scope-import-expressions.mjs",
+    "local-scope-create-require.mjs",
+    "local-scope-require-resolution.mjs",
     "local-scope-repository.mjs",
     "local-scope-signature.mjs",
     "local-scope-config-imports.mjs",

package/release-state.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.53",
-  "digest": "3508e9d78536c07403711408fe6dc6d71d137820f34d3d164c4b5898be923df5",
+  "version": "0.1.54",
+  "digest": "36f6f70b3b71f839d5e616e729c998e58232c94f8a3977216820f8fef6b470bf",
   "files": {
     "connected-cli.mjs": "260c0fc99586c24bd4d0351a14e0744849a612ebe6f1bd7951e4fce200daf920",
     "local-approved-process.mjs": "442856df788e63f38757439ba0657d1c689aaf797631a955fae3dd639e844e6d",
@@ -20,9 +20,9 @@
     "local-delegated-modify-analysis.mjs": "f87148ddb023b79e241ca97db582991da8d0e1a51b26b1d9bc2799a76efd7297",
     "mutation-client.mjs": "8d27b267dc660510aa1406c44d4005e44b972a1260f90657de4fa0e75b7b6c3e",
     "cloud-mutation-authority.mjs": "c7226e882a4f3be4d2f55728f515d5a815c0aa1f21aa5e4689314e6e6a8c66a2",
-    "ide-code-mode.mjs": "f3f53357ba09727b3b597851976a24de93287c0faca5052448277d0904bb61f7",
-    "ide-command.mjs": "f2fe57312f83a11b318f1c98db51a6a47a7ff45b53f392acce32e458976bd06c",
-    "ide-hook.mjs": "be328cc646ea6ec5dc18e5458dd1f829897cc386d74bda0b56cbd14f53c98827",
+    "ide-code-mode.mjs": "ca667a00d9f2be82e46f3d7720c6a2bfae437c2a3f26b935075554f989ac2d73",
+    "ide-command.mjs": "5a4aeae387122682caa4dd6383f43cefccbe93d3fa891cec427103e3fcfe9542",
+    "ide-hook.mjs": "190cfa0cd391e60bfe9056a53c2d8c8d0b956089912935c870f99041a11b473e",
     "ide-install.mjs": "10247efadcfeef5da001022d12080bd0f789e67fdf7862bcc65db73dda3bbe57",
     "ide-session.mjs": "453b9510ab825c2927a4fae8250ee8a8eb5ac10b23cf024af84a7c5916ba53dd",
     "break-glass.mjs": "6ec9f97c5d68bb33121b2374c06b9d4c8eb3419b52d00849fec7124bc63e4582",
@@ -32,7 +32,7 @@
     "local-discipline-analysis.mjs": "e887abdd1c6d6ba59ef7323e9035528f0491e5458ca8159985ec26e1ca67a4af",
     "local-discipline-batch.mjs": "2cc90dbae55efdee0c445da399c0a9acafa92e915344c25208ebca554fc4c9e9",
     "local-typescript-function-reference.mjs": "af682b479fe0d69a5ecd62232406bb8078408ec8710733cfed9ae6b059762ba5",
-    "local-scope-import-expressions.mjs": "6623dea5501c4dc24e12c99e0776d65650bbe752c85c9509d022ba1f61bd5111",
+    "local-scope-import-expressions.mjs": "20f1e065582c68d2334e0dfaa130a559ff19886a57f9038dc569f65993bb06c8",
     "local-discipline-contracts.mjs": "6cf8a3d132fdb9074eb1441600afe7aa199df33e88a71a660d9db534c14f19e4",
     "local-discipline-contracts.d.mts": "defc684c78dc88afa1c54340ab4a01ae36db7aa11257cbe1f5cd323f608c78c4",
     "local-discipline-gate.mjs": "e3851157bf1d8bc86eb44212a88acd20acfc2d1152e7d87af6dc2a37afffcd6f",
@@ -100,9 +100,9 @@
     "CAPABILITY-MAP.md": "69b2c49b111d651969dea7430f4df7950d8fdf2f0f151d8386fa04968b872ac0",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
     "DELIVERY-BOUNDARIES.md": "9b9db50ed1bcce9e77ff6527b6bb7eaf12f3b913162ea9cb7fe90db06b393a4f",
-    "package.json": "6a0566be47288eba3fb8b327e19d50df62f47a90e101ff952b49cedd951c04b7",
+    "package.json": "e910dc5cf0db61b1fcb9feffa21a8f8d3c2a244b7d858e8af72202f5b91d403b",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
-    "release.mjs": "6292dd8a4ef82c5674f4aa80a8e70059f378162162b83aae750fa55697ba90d3",
+    "release.mjs": "8b0dc36c47aec72cf9952c9ac1ce5fe27da5ae6829f50cd2339fa101b2eda93c",
     "local-cli.mjs": "41e2a737c8587cb5ce469a7661f6d14b5ea4cd073f8286822fc4dc96b67f56a1",
     "local-state-lock.mjs": "1dbf64264642a0851faf043e07ee9f66d2ad0508e9f799b0626246e42fae893e",
     "local-execution.mjs": "185f34e917440a360b3c4bafd3af245243807d964ae3820b3cffaaa2e6348cc6",
@@ -141,7 +141,9 @@
     "local-scope-candidate.mjs": "8f0bd9606e70d4a0ebacdd3cd600ec3afed85e2bb3e1760aa1144cf55d4e028a",
     "local-scope-context.mjs": "79753abfc6c76089d17f003a1be537dfaea10d6731c542f7fc53f2a9996ed164",
     "local-scope-files.mjs": "4c14a5e226dd5518aeb37f199b1aa896943a66d41e5a1757a3b3fd8a79446d76",
-    "local-scope-repository.mjs": "d9d4c81c3f401c38c33b8dd7bdf8ebaf4658d1afd1cce408a7acd37f8836a6df",
+    "local-scope-repository.mjs": "941eb895c8210da1ca90e8b3d1d6936c24408d10139fe6c3eba2761329248392",
+    "local-scope-create-require.mjs": "6b6a209bfcad8fe1398e99c5c8cc3af189c120b9c38e244a73dd1a99c3d91295",
+    "local-scope-require-resolution.mjs": "b24596462c8776cbefa6f0a74749d665aa928d1643c68d44798eb93e2dd5ad42",
     "local-scope-git.mjs": "53bbbb6c4795db711b5bc164591a6ad79a561427da046d6bbe997dae6eb82829",
     "local-scope-git-reads.mjs": "5d8a2636bab955cb325cb693db7423e69512355887ae5b5af3b8cb615f5ddad0",
     "local-git-executable.mjs": "9391d716529025b1de3ee006df658a9d765b6ef29ad24ef9b7436829318e651e",

package/release.mjs

@@ -84,6 +84,8 @@ const sourceFiles = [
   'local-scope-context.mjs',
   'local-scope-files.mjs',
   'local-scope-repository.mjs',
+  'local-scope-create-require.mjs',
+  'local-scope-require-resolution.mjs',
   'local-scope-git.mjs',
   'local-scope-git-reads.mjs',
   'local-git-executable.mjs',
@@ -365,6 +367,8 @@ function releaseLabels() {
     'local-scope-context.mjs': { zh: '精确符号范围绑定', en: 'exact symbol scope binding' },
     'local-scope-files.mjs': { zh: '范围文件与安全读取', en: 'scope files and guarded reads' },
     'local-scope-repository.mjs': { zh: '真实仓库范围事实', en: 'actual repository scope facts' },
+    'local-scope-create-require.mjs': { zh: '静态 createRequire 原目录绑定', en: 'static createRequire source-directory binding' },
+    'local-scope-require-resolution.mjs': { zh: '实际 CommonJS 依赖只读解析', en: 'read-only installed CommonJS dependency resolution' },
     'local-scope-config-imports.mjs': { zh: 'tsconfig 范围路径与依赖只读引用', en: 'tsconfig scope paths and read-only dependency references' },
     'local-scope-config-extends.mjs': { zh: 'tsconfig npm 配置继承解析', en: 'tsconfig npm configuration inheritance resolution' },
     'local-scope-git.mjs': { zh: '实际Git范围与变更事实', en: 'actual Git scope and change facts' },

package/releases.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.1.54",
+    "date": "2026-10-17",
+    "zh": "修复受管 Node 只读 SHA-256 命令在 Codex 工具门禁中的静态识别与安全改写；按已证明的 createRequire 原目录解析实际安装依赖并记录只读元数据，保留未知上下文和越界拒绝。",
+    "en": "Fixed static recognition and safe rewriting of managed Node SHA-256 reads in Codex tool guards; resolved installed dependencies from proven createRequire anchors with read-only metadata while preserving unknown-context and path-boundary refusals."
+  },
   {
     "version": "0.1.53",
     "date": "2026-10-17",