@entrorove/skill 0.1.53 → 0.1.55

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.55 — 2026-10-17
+
+- 修复任务间消息被技能误拦截，将已授权通信交回主机审批；规范只读和 SDK 命令执行参数；新增原流程计划阶段的显式范围重评与恢复提示，保留原门禁、合同、请求身份及失败历史。
+- Restored host-approved task messaging, constrained read and SDK execution inputs, and added explicit planning-scope reassessment with phase-correct recovery while retaining original gates, contracts, request identities, and failure history.
+
+## 0.1.54 — 2026-10-17
+
+- 修复受管 Node 只读 SHA-256 命令在 Codex 工具门禁中的静态识别与安全改写；按已证明的 createRequire 原目录解析实际安装依赖并记录只读元数据，保留未知上下文和越界拒绝。
+- Fixed static recognition and safe rewriting of managed Node SHA-256 reads in Codex tool guards; resolved installed dependencies from proven createRequire anchors with read-only metadata while preserving unknown-context and path-boundary refusals.
+
 ## 0.1.53 — 2026-10-17
 
 - 补齐原任务受限编辑、真实写后结算与连续修改，保留未知依赖和独立验证边界；沙箱关闭后可运行原批准命令并保存本地观察。修复前置条件、断线恢复和停止循环，独立监督器约束崩溃后的子进程。本地成功不代表独立验证或交付。

package/IDE-EXECUTION.md

@@ -6,6 +6,10 @@ If the IDE guard itself is the blocked step, run `entrorove unlock` directly fro
 
 Capability discovery and offline unlock remain administrative calls during `entry`, before a flow exists. The guard recognizes its own rendered commands with quoted identity assignments, their order changed, or a literal `env` prefix containing only supported host/session identities; it rewrites approved calls to the installed runtime and current session. This does not authorize native scripts or unbound project writes.
 
+Approved Codex `exec_command` reads and SDK calls run with `/bin/sh` and `login:false`; static code mode uses the same execution input check. Its noninteractive workdir and output controls pass through. Other hosts keep their adapter's command schema, including timeout where supported, with custom executors and permission expansion rejected.
+
+For a Codex task-to-task report explicitly authorized by the human user, the guard passes the exact `mcp__codex_app__send_message_to_thread` tool through unchanged, including a static `tools.mcp__codex_app__send_message_to_thread({...})` call inside `functions.exec`. Codex still decides whether the user authorized the message. Its text and response grant no Entrorove flow, file, shell or task-creation authority.
+
 To stop using Entrorove on this computer, run `entrorove uninstall` directly. It works offline, removes only the recorded Entrorove host hooks and pristine global skill, and leaves other host settings, credentials and task records in place. A hand-edited file is reported as preserved rather than deleted. This command does not inspect or change another project.
 
 Every invocation rereads that same credential file, including clients already running. After an authenticated account page supplies the current key and `configure` synchronizes it once, all tasks under the same OS user automatically use the new value. A revoked or expired key cannot obtain new permissions for itself: return to the authenticated account page and synchronize once through JSON stdin. Status recovery only queries the original request; it never rotates credentials or repeats the operation.

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute an engineering task through Entrorove, preserving its origi
 
 # entrorove · 熵巡
 
-Version: 0.1.53.
+Version: 0.1.55.
 
 Entrorove applies to the whole task once selected. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 
@@ -19,8 +19,8 @@ Entrorove applies to the whole task once selected. Reading this document or call
    With cloud sandbox disabled, the IDE performs its own planning and continues the original API flow. Do not require a cloud model call or create a sandbox task to perform local work.
    When the model produces a task contract, preserve its `workType`, `risk`, `difficulty`, `crossModule`, `parallel`, `unclear`, `architectureContract`, optional `baselineRef`, and optional `interaction` as returned. Valid work types are `implementation`, `documentation`, `calculation`, `merge`, `review`, `decision`, and `diagnosis`. A `merge` requires a concrete `baselineRef` identifying the branch, tag, commit, or review baseline; keep that baseline unchanged through independent verification. A `decision` requires `interaction`, including a risk description for medium or high risk. Do not fill missing required fields by guessing.
 4. After real cloud acceptance, immediately display **云端任务 <taskNumber> · 已进入**. Preserve `taskNumber` verbatim: it is the homepage sandbox tab number. Keep its UUID `taskId` separately. Run the returned `cloud-watch`, show each real public event and its cursor, and continue the original accepted flow from status. A command log alone is insufficient. No accepted cloud task means no cloud ID or model-execution claim.
-5. For an accepted `flowId`, execute the returned `nextStep` with its required payload. Discover the schema before constructing input. An empty payload is valid only when that operation's schema allows it. Reconnect and refresh only the original flow. A changed snapshot is a binding failure to investigate; do not invent a fresh successful baseline, rebuild a flow to evade it, or erase the old failure. If the terminal flow truly owns a stale task slot, use the explicit `flow-abandon` lifecycle operation described below before routing the original task again.
-6. All governed mutations use the original authority: `local guarded-write`, `local guarded-delete`, `local guarded-move`, or the original frozen approved runner plan. Native patches, scripts, terminal writes, database mutations and unknown MCP operations must not substitute for the controlled entry. **A failed gate or unknown outcome must never be replaced with another executor or reported as local success.** Query the original request read-only, repair the cause, and obtain the original flow's valid authority before proceeding.
+5. For an accepted `flowId`, execute the returned `nextStep` with its required payload. Discover the schema before constructing input. An empty payload is valid only when that operation's schema allows it. Reconnect and refresh only the original flow. A changed snapshot is a binding failure to investigate; do not invent a fresh successful baseline, rebuild a flow to evade it, or erase the old failure. If a fresh scope proof returns `ENTROROVE_SCOPE_PLANNING_REASSESSMENT_REQUIRED` before plan freeze, follow its explicit `workflow-scope-reassess` recovery and retry the original complete request; a local reassessment or snapshot refresh alone does not renew the accepted gate. If the terminal flow truly owns a stale task slot, use the explicit `flow-abandon` lifecycle operation described below before routing the original task again.
+6. All governed mutations use the original authority: `local guarded-write`, `local guarded-delete`, `local guarded-move`, or the original frozen approved runner plan. Native patches, scripts, terminal writes, database mutations and unknown MCP operations must not substitute for the controlled entry. User-authorized task messages use the host's message tool and remain subject to host approval; sending a report does not change the flow or grant execution authority. **A failed gate or unknown outcome must never be replaced with another executor or reported as local success.** Query the original request read-only, repair the cause, and obtain the original flow's valid authority before proceeding.
    For a restricted member scope, follow a returned `localAction` before submitting execution evidence. `mutation-connect` obtains only the original task's limited editing pass; it keeps unresolved loader files and project configuration read only. After actual writes, refresh the original scope and run `mutation-settle`. Use the returned `previousPassId` for further edits. With sandbox disabled, `workflow-observe-step` runs the original approved command and preserves its real local result without a validator private key; independent verification remains pending. See [IDE-EXECUTION.md](IDE-EXECUTION.md#restricted-member-editing).
 7. Read [REUSE-DISCIPLINE.md](REUSE-DISCIPLINE.md) when modifying an existing system. The comparison baseline is the existing implementation in that same repository. It never means another project, another account, or copying external systems.
 8. Read [DELIVERY-BOUNDARIES.md](DELIVERY-BOUNDARIES.md) before claiming a delivered stage or showing consumption. A delivered stage requires a clean boundary and uses `delivered-stage-N`. Blocked or unknown work can wait with recovery data intact; it is not a delivered stage. Display consumption only with a measured baseline.

package/ide-code-mode.mjs

@@ -1,12 +1,21 @@
 import { createRequire } from 'node:module';
-import { literalCommand, sdkCommand, readCommand } from './ide-command.mjs';
+import { literalCommand, sdkCommand, readCommand, runtimeHashRead, prepareIdeShellInput } from './ide-command.mjs';
 
-export function inspectIdeCodeMode(code, runtime) {
-  if (typeof code !== 'string' || code.length > 1_000_000) return false;
+export const hostTaskMessageTool = 'mcp__codex_app__send_message_to_thread';
+export function hostTaskMessageInput(value) {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    && typeof value.threadId === 'string' && value.threadId.trim().length > 0
+    && typeof value.prompt === 'string' && value.prompt.trim().length > 0
+    && Object.entries(value).every(([key, item]) =>
+      ['threadId', 'prompt', 'hostId', 'model', 'thinking'].includes(key) && typeof item === 'string');
+}
+
+export function prepareIdeCodeMode(code, runtime) {
+  if (typeof code !== 'string' || code.length > 1_000_000) return { allowed: false };
   const ts = createRequire(runtime.cli)('typescript');
   const source = ts.createSourceFile('host-call.js', code, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
-  if (source.parseDiagnostics.length) return false;
-  let allowed = true;
+  if (source.parseDiagnostics.length) return { allowed: false };
+  let allowed = true, unsafeShellInput = false; const replacements = [];
   const literal = node => {
     if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;
     if (ts.isNumericLiteral(node)) return Number(node.text);
@@ -21,13 +30,38 @@ export function inspectIdeCodeMode(code, runtime) {
     throw new Error('Dynamic tool arguments');
   };
   const visit = node => {
-    if (ts.isImportDeclaration(node) || ts.isNewExpression(node) || ts.isElementAccessExpression(node) || ts.isFunctionExpression(node)) allowed = false;
+    if (ts.isImportDeclaration(node) || ts.isNewExpression(node) || ts.isElementAccessExpression(node)
+      || ts.isFunctionExpression(node) || ts.isTaggedTemplateExpression(node)) allowed = false;
     if (ts.isCallExpression(node)) {
       const name = node.expression.getText(source);
       if (name === 'tools.exec_command') {
         try {
-          const args = literal(node.arguments[0]), command = literalCommand(args.cmd ?? args.command);
-          if (!(readCommand(command) || sdkCommand(command, runtime))) allowed = false;
+          const argument = node.arguments[0], args = literal(argument), command = literalCommand(args.cmd ?? args.command);
+          const hash = runtimeHashRead(command, runtime);
+          if (hash) {
+            const safe = node.arguments.length === 1 && typeof args.cmd === 'string' && !Object.hasOwn(args, 'command')
+              && Object.keys(args).every(key => ['cmd', 'workdir', 'max_output_tokens', 'yield_time_ms', 'login', 'shell'].includes(key))
+              && (args.shell === undefined || args.shell === '/bin/sh')
+              && (args.login === undefined || args.login === false)
+              && (args.workdir === undefined || typeof args.workdir === 'string')
+              && (args.max_output_tokens === undefined || Number.isSafeInteger(args.max_output_tokens) && args.max_output_tokens > 0)
+              && (args.yield_time_ms === undefined || Number.isSafeInteger(args.yield_time_ms) && args.yield_time_ms >= 0);
+            if (!safe) allowed = false;
+            else {
+              const fixed = { ...args, cmd: hash, shell: '/bin/sh', login: false };
+              replacements.push({ start: argument.getStart(source), end: argument.getEnd(), text: JSON.stringify(fixed) });
+            }
+          } else if (!(readCommand(command) || sdkCommand(command, runtime))) allowed = false;
+          else {
+            const fixed = node.arguments.length === 1 && !node.questionDotToken
+              && prepareIdeShellInput('exec_command', args, args.cmd);
+            if (!fixed) { allowed = false; unsafeShellInput = true; }
+            else replacements.push({ start: argument.getStart(source), end: argument.getEnd(), text: JSON.stringify(fixed) });
+          }
+        } catch { allowed = false; }
+      } else if (name === `tools.${hostTaskMessageTool}`) {
+        try {
+          if (node.questionDotToken || node.arguments.length !== 1 || !hostTaskMessageInput(literal(node.arguments[0]))) allowed = false;
         } catch { allowed = false; }
       } else if (name === 'tools.update_goal' || name === 'tools.get_goal') {
         try {
@@ -40,5 +74,13 @@ export function inspectIdeCodeMode(code, runtime) {
     }
     ts.forEachChild(node, visit);
   };
-  visit(source); return allowed;
+  visit(source);
+  if (!allowed) return { allowed: false, ...(unsafeShellInput ? { reason: 'shell-input' } : {}) };
+  let prepared = code;
+  for (const item of replacements.sort((a, b) => b.start - a.start)) {
+    prepared = `${prepared.slice(0, item.start)}${item.text}${prepared.slice(item.end)}`;
+  }
+  return { allowed: true, code: prepared };
 }
+
+export function inspectIdeCodeMode(code, runtime) { return prepareIdeCodeMode(code, runtime).allowed; }

package/ide-command.mjs

@@ -113,6 +113,59 @@ export function readCommand(parsed) {
   return false;
 }
 
+const safeShellKeys = {
+  exec_command: new Set(['cmd', 'command', 'workdir', 'max_output_tokens', 'yield_time_ms', 'tty', 'shell', 'login']),
+  Bash: new Set(['command', 'cmd', 'workdir', 'timeout', 'description', 'max_output_chars', 'max_output_tokens', 'yield_time_ms', 'tty']),
+  shell_command: new Set(['command', 'cmd', 'workdir', 'timeout', 'description', 'max_output_chars', 'max_output_tokens', 'yield_time_ms', 'tty']),
+};
+
+export function prepareIdeShellInput(toolName, input, normalizedCommand, mirrorCommand = false) {
+  const keys = safeShellKeys[toolName];
+  if (!keys || !input || typeof input !== 'object' || Array.isArray(input)
+    || typeof normalizedCommand !== 'string' || !Reflect.ownKeys(input).every(key => keys.has(key))) return null;
+  const primary = toolName === 'exec_command' ? 'cmd' : 'command';
+  if (typeof input[primary] !== 'string' || input.cmd !== undefined && input.command !== undefined
+    && input.cmd !== input.command || input.tty !== undefined && input.tty !== false
+    || input.workdir !== undefined && typeof input.workdir !== 'string'
+    || input.description !== undefined && typeof input.description !== 'string'
+    || input.timeout !== undefined && (!Number.isSafeInteger(input.timeout) || input.timeout <= 0)
+    || ['max_output_chars', 'max_output_tokens'].some(key => input[key] !== undefined
+      && (!Number.isSafeInteger(input[key]) || input[key] <= 0))
+    || input.yield_time_ms !== undefined && (!Number.isSafeInteger(input.yield_time_ms) || input.yield_time_ms < 0)
+    || input.shell !== undefined && input.shell !== '/bin/sh'
+    || input.login !== undefined && input.login !== false) return null;
+  const { cmd: _cmd, command: _command, ...options } = input;
+  return { ...options, [primary]: normalizedCommand,
+    ...(toolName === 'exec_command' && mirrorCommand ? { command: normalizedCommand } : {}),
+    ...(toolName === 'exec_command' ? { shell: '/bin/sh', login: false } : {}) };
+}
+
+const runtimeHashTool = process.platform === 'darwin'
+  ? { name: 'shasum', executable: '/usr/bin/shasum', flags: ['-a', '256'] }
+  : process.platform === 'linux'
+    ? { name: 'sha256sum', executable: '/usr/bin/sha256sum', flags: [] } : null;
+
+export function runtimeHashCommand(runtime) {
+  const node = runtime?.node;
+  if (!runtimeHashTool || typeof node !== 'string' || node.length > 4096 || !path.isAbsolute(node)
+    || path.basename(node) !== 'node' || path.normalize(node) !== node
+    || !/^[A-Za-z0-9/._+@ -]+$/u.test(node)) return null;
+  return `/usr/bin/env -i PATH=/usr/bin:/bin ${runtimeHashTool.executable} ${[...runtimeHashTool.flags, '--'].join(' ')} '${node}'`;
+}
+
+export function runtimeHashRead(parsed, runtime) {
+  const canonical = runtimeHashCommand(runtime);
+  if (!canonical || !parsed || parsed.input) return null;
+  const words = parsed.words, { name, executable, flags } = runtimeHashTool;
+  const normal = [name, ...flags, runtime.node];
+  const absolute = [executable, ...flags, runtime.node];
+  const withSeparator = [executable, ...flags, '--', runtime.node];
+  const protectedCommand = ['/usr/bin/env', '-i', 'PATH=/usr/bin:/bin', ...withSeparator];
+  if ([normal, absolute, withSeparator, protectedCommand].some(expected =>
+    words.length === expected.length && words.every((word, index) => word === expected[index]))) return canonical;
+  return null;
+}
+
 export function renderSdkCommand(call, runtime, sessionId, host = process.env.ENTROROVE_IDE ?? 'Codex') {
   const quote = value => `'${String(value).replace(/'/gu, "'\\''")}'`;
   const header = `ENTROROVE_IDE=${quote(host)} ENTROROVE_SESSION=${quote(sessionId)} CODEX_THREAD_ID=${quote(sessionId)} ${[runtime.node, runtime.cli, ...call.args].map(quote).join(' ')}`;

package/ide-hook.mjs

@@ -4,8 +4,9 @@ import { fileURLToPath } from 'node:url';
 import { ideSession, ideRuntime, bindIdeAccount, ideContext, ideDigest, readBreakGlass,
   ideBlockIdentity, repeatedIdeBlock, observeIdeToolOutcome } from './ide-session.mjs';
 import { isStageTerminal, stageOf } from './local-stage-boundary.mjs';
-import { literalCommand, sdkCommand, readCommand, renderSdkCommand, installerCommand } from './ide-command.mjs';
-import { inspectIdeCodeMode } from './ide-code-mode.mjs';
+import { literalCommand, sdkCommand, readCommand, renderSdkCommand, installerCommand,
+  runtimeHashCommand, runtimeHashRead, prepareIdeShellInput } from './ide-command.mjs';
+import { hostTaskMessageInput, hostTaskMessageTool, prepareIdeCodeMode } from './ide-code-mode.mjs';
 import { pathToFileURL } from 'node:url';
 import path from 'node:path';
 import { parseIdeResults, consumeIdeResults } from './ide-results.mjs';
@@ -35,17 +36,44 @@ function operationOf(call) {
 }
 function isManagementCall(call) { return managementOperations.has(operationOf(call)); }
 function resetBlockStreak(state) { state.blockStreak = 0; delete state.lastBlockKey; delete state.lastBlockIdentity; }
-function blockedReason(state, event, reason) {
+function blockedReason(state, event, reason, detail = {}) {
   const key = ideDigest({ identity: ideBlockIdentity(state), tool: event.tool_name, phase: state.phase, reason });
   const repeated = state.lastBlockKey === key;
   state.blockStreak = repeated ? (state.blockStreak ?? 0) + 1 : 1;
   state.lastBlockKey = key;
   state.lastBlockIdentity = ideBlockIdentity(state);
-  const mechanism = `机制：${state.stateFile ?? '会话状态文件'} 当前 phase=${state.phase}${state.pendingCall ? `，pendingCall=${state.pendingCall.toolUseId}` : ''}；该阶段只放行 Entrorove 管理调用，业务与写操作需先建立原 flow 并取得 nextStep。`;
+  const mechanism = detail.mechanism ?? `机制：${state.stateFile ?? '会话状态文件'} 当前 phase=${state.phase}${state.pendingCall ? `，pendingCall=${state.pendingCall.toolUseId}` : ''}；该阶段只放行 Entrorove 管理调用及主机明确授权的任务间报告，业务与写操作需先建立原 flow 并取得 nextStep。`;
   const repeat = repeated && state.blockStreak >= 2 ? `同一阻断已出现 ${state.blockStreak} 次，禁止再次检查：说明机制、给出绕过方案并执行绕过。` : '';
-  return `${reason} ${mechanism} ${repeat}\n绕过方案（离线、无网络、无协议、不经 hook，终端直接运行）：\n${unlockCommand}\n执行后重试原管理调用；项目写入仍需原任务授权。`;
+  const recovery = detail.recovery ?? `绕过方案（离线、无网络、无协议、不经 hook，终端直接运行）：\n${unlockCommand}\n执行后重试原管理调用；项目写入仍需原任务授权。`;
+  return `${reason} ${mechanism} ${repeat}\n${recovery}`;
+}
+const denyBlocked = (state, event, reason, detail) => deny(blockedReason(state, event, reason, detail));
+function runtimeHashAttempt(command, parsed) {
+  const name = parsed?.words[0];
+  return ['shasum', '/usr/bin/shasum', 'sha256sum', '/usr/bin/sha256sum'].includes(name)
+    || name === '/usr/bin/env' && parsed.words[1] === '-i' && parsed.words[2] === 'PATH=/usr/bin:/bin'
+      && ['/usr/bin/shasum', '/usr/bin/sha256sum'].includes(parsed.words[3])
+    || typeof command === 'string' && /^\s*(?:(?:\/usr\/bin\/)?(?:shasum|sha256sum)|\/usr\/bin\/env\s+-i\s+PATH=\/usr\/bin:\/bin\s+\/usr\/bin\/(?:shasum|sha256sum))(?:\s|$)/u.test(command);
+}
+function safeHashToolInput(input) {
+  return input && typeof input === 'object' && Object.keys(input).every(key =>
+    ['cmd', 'command', 'workdir', 'max_output_tokens', 'yield_time_ms', 'shell', 'login'].includes(key))
+    && (input.shell === undefined || input.shell === '/bin/sh')
+    && (input.login === undefined || input.login === false);
+}
+function denyRuntimeHash(state, event, runtime) {
+  const safe = runtimeHashCommand(runtime);
+  return denyBlocked(state, event, 'ENTROROVE_IDE_RUNTIME_HASH_DENIED：仅允许读取本次安装所绑定的 Node 可执行文件 SHA-256。', {
+    mechanism: `机制：哈希路径必须精确等于受管 runtime.node；拒绝其他文件、额外参数、shell 展开和自定义执行器。当前 phase=${state.phase}。`,
+    recovery: `恢复：用固定只读命令重新取得该 Node 文件的哈希：\n${safe ?? '当前平台没有受支持的固定哈希命令；请使用受管安装所绑定的 Node 路径。'}${safe ? `\n代码模式请传静态 tools.exec_command({cmd:${JSON.stringify(safe)},shell:'/bin/sh',login:false})。` : ''}\n本次在 hook 本地预检中拒绝，未发起协议请求，因此没有 requestId。`,
+  });
+}
+function denyUnsafeShellInput(state, event) {
+  return denyBlocked(state, event, 'ENTROROVE_IDE_EXEC_INPUT_DENIED：只读或 SDK 命令含不安全的执行参数。', {
+    mechanism: '机制：仅接受静态命令及只读的 workdir、输出上限和超时参数；自定义 shell、登录模式、环境变量、交互终端或权限扩张均不属于受管调用。',
+    recovery: '恢复：移除执行器和权限扩张参数。exec_command 将固定为 /bin/sh 且 login=false；本次在 hook 本地预检中拒绝，未发起协议请求。',
+  });
 }
-const denyBlocked = (state, event, reason) => deny(blockedReason(state, event, reason));
 function lifecycleResult(value, depth = 0) {
   if (!value || typeof value !== 'object' || depth > 4) return null;
   if (value.operation === 'flow-cancel' || value.operation === 'flow-abandon') return value;
@@ -108,12 +136,11 @@ async function beforeTool(event, state, home) {
   const isShell = ['Bash', 'exec_command', 'shell_command'].includes(event.tool_name);
   const installer = isShell && installerCommand(parsed);
   if (installer) {
-    if (state.active) {
-      state.readCalls ??= {};
-      state.readCalls[event.tool_use_id] = { toolUseId: event.tool_use_id, command: 'install' };
-    }
-    return output('PreToolUse', { permissionDecision: 'allow', updatedInput: { ...event.tool_input, command: installer,
-      ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: installer } : {}) } });
+    const safeInput = prepareIdeShellInput(event.tool_name, event.tool_input, installer, true);
+    if (!safeInput) return denyUnsafeShellInput(state, event);
+    if (state.active) { state.readCalls ??= {};
+      state.readCalls[event.tool_use_id] = { toolUseId: event.tool_use_id, command: 'install' }; }
+    return output('PreToolUse', { permissionDecision: 'allow', updatedInput: safeInput });
   }
   const namedSdk = parsed?.words.some(word => word === 'entrorove' || /^@entrorove\/skill(?:@[^ ]+)?$/u.test(word)
     || /(?:@entrorove\/skill|entrorove-skill)\/cli\.mjs$/u.test(word));
@@ -121,20 +148,20 @@ async function beforeTool(event, state, home) {
   const runtime = isShell && parsed ? await ideRuntime(home) : null;
   const call = runtime && sdkCommand(parsed, runtime);
   if (call) {
+    if (!prepareIdeShellInput(event.tool_name, event.tool_input, command, true)) return denyUnsafeShellInput(state, event);
     if (call.args[0] === 'uninstall') {
       state.active = false; state.phase = 'user-exited';
-      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: { ...event.tool_input,
-        command: renderSdkCommand(call, runtime, state.sessionId),
-        ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: renderSdkCommand(call, runtime, state.sessionId) } : {}) } });
+      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: prepareIdeShellInput(event.tool_name,
+        event.tool_input, renderSdkCommand(call, runtime, state.sessionId), true) });
     }
     state.active = true;
     if (call.args[0] !== 'configure' && call.args[0] !== 'unlock') await bindIdeAccount(state, home);
-    if (state.phase === 'setup' && !unlocked && !isManagementCall(call)) return denyBlocked(state, event, 'Entrorove：自举阶段只放行 Entrorove 管理调用（建 flow、改目标、scope-connect、capabilities、status、queue 等）；业务与写操作需先建立原 flow。');
+    if (state.phase === 'setup' && !unlocked && !isManagementCall(call)) return denyBlocked(state, event, 'Entrorove：自举阶段只放行 Entrorove 管理调用及主机明确授权的任务间报告；业务与写操作需先建立原 flow。');
     if (call.args[0] === 'unlock') {
       resetBlockStreak(state);
       const rewritten = renderSdkCommand(call, runtime, state.sessionId);
-      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: { ...event.tool_input, command: rewritten,
-        ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: rewritten } : {}) }, additionalContext: `${ideContext(state)}离线管理解锁已放行。` });
+      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: prepareIdeShellInput(event.tool_name,
+        event.tool_input, rewritten, true), additionalContext: `${ideContext(state)}离线管理解锁已放行。` });
     }
     const newStart = call.args[0] === 'cloud-task' || call.args[0] === 'invoke' && ['start','cloud-task'].includes(call.input?.operation);
     if (newStart && (state.flowId || state.taskId) && state.phase !== 'ended') return denyBlocked(state, event, 'Entrorove：必须继续原任务，禁止用第二次 start 或 cloud-task 绕过原门禁。');
@@ -165,16 +192,40 @@ async function beforeTool(event, state, home) {
     } else state.pendingCall = pending;
     const installation = call.args[0] === 'install' && parsed.words.some(word => ['npx','npx.cmd'].includes(word));
     const rewritten = renderSdkCommand(call, runtime, state.sessionId);
-    return output('PreToolUse', { permissionDecision: 'allow', ...(installation ? {} : { updatedInput: { ...event.tool_input, command: rewritten,
-      ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: rewritten } : {}) } }), additionalContext: ideContext(state) });
+    return output('PreToolUse', { permissionDecision: 'allow', updatedInput: prepareIdeShellInput(event.tool_name,
+      event.tool_input, installation ? command : rewritten, true), additionalContext: ideContext(state) });
   }
   if (!state.active) return {};
+  // The host owns user authorization for peer messages; this hook does not rewrite or grant it.
+  if (event.tool_name === hostTaskMessageTool && hostTaskMessageInput(event.tool_input)) return output('PreToolUse', { additionalContext: ideContext(state) });
   if (['exec','functions.exec'].includes(event.tool_name)) {
     const current = await ideRuntime(home), code = typeof event.tool_input === 'string' ? event.tool_input : event.tool_input?.code;
-    return inspectIdeCodeMode(code, current) ? output('PreToolUse', { additionalContext: ideContext(state) }) : denyBlocked(state, event, 'Entrorove：代码模式含未批准的原生执行或动态工具输入；请使用原任务的受控入口。');
+    const prepared = prepareIdeCodeMode(code, current);
+    if (prepared.allowed) return output('PreToolUse', { additionalContext: ideContext(state),
+      ...(prepared.code === code ? {} : { updatedInput: typeof event.tool_input === 'string' ? prepared.code
+        : { ...event.tool_input, code: prepared.code } }) });
+    if (prepared.reason === 'shell-input') return denyUnsafeShellInput(state, event);
+    if (typeof code === 'string' && /\b(?:shasum|sha256sum)\b/u.test(code)) return denyRuntimeHash(state, event, current);
+    return denyBlocked(state, event, 'Entrorove：代码模式含未批准的原生执行或动态工具输入；请使用原任务的受控入口。');
   }
   if (event.tool_name === 'update_goal' && (state.phase === 'setup' || unlocked)) return output('PreToolUse', { additionalContext: ideContext(state) });
-  if (isShell && readCommand(parsed) || readTools.has(event.tool_name)) return output('PreToolUse', { additionalContext: ideContext(state) });
+  if (isShell) {
+    const fixedHash = runtimeHashRead(parsed, runtime);
+    if (fixedHash) {
+      if (!safeHashToolInput(event.tool_input)) return denyRuntimeHash(state, event, runtime);
+      resetBlockStreak(state);
+      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: { ...event.tool_input, command: fixedHash,
+        ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: fixedHash } : {}),
+        ...(event.tool_name === 'exec_command' ? { shell: '/bin/sh', login: false } : {}) },
+      additionalContext: ideContext(state) });
+    }
+    if (runtimeHashAttempt(command, parsed)) return denyRuntimeHash(state, event, runtime ?? await ideRuntime(home));
+  }
+  if (isShell && readCommand(parsed)) {
+    const safeInput = prepareIdeShellInput(event.tool_name, event.tool_input, command);
+    return safeInput ? output('PreToolUse', { updatedInput: safeInput, additionalContext: ideContext(state) }) : denyUnsafeShellInput(state, event);
+  }
+  if (readTools.has(event.tool_name)) return output('PreToolUse', { additionalContext: ideContext(state) });
   return denyBlocked(state, event, `Entrorove：已阻止原生 ${event.tool_name ?? 'unknown'} 调用。当前阶段 ${state.phase}${state.taskNumber ? `，云端任务 ${state.taskNumber}` : ''}。写入、删除、移动及不确定的终端操作必须使用原任务的 guarded-write／guarded-delete／guarded-move 或已批准的执行计划。`);
 }
 export async function runIdeHook(event, { home } = {}) {

package/ide-session.mjs

@@ -129,7 +129,7 @@ export function ideContext(state) {
   const waiting = repeatedIdeBlock(state);
   const action = waiting ? '同一真实阻断已达到两次；本轮允许结束并等待修复，禁止原样第三次重试。原目标、flow 与队列均保留。'
     : '必须读 SKILL.md 并执行返回的 nextStep；禁止在失败后替换执行器。';
-  return `${waiting ? 'Entrorove 原任务绑定已保留。' : 'Entrorove 已强制接管本任务。'}${state.taskNumber ? `云端任务 ${state.taskNumber}。` : '尚未获得云端任务编号，不得声称已进入云端。'}${state.flowId ? `继续原 flowId=${state.flowId}，` : ''}${state.requestId ? `原 requestId=${state.requestId}。` : ''}当前阶段 ${state.phase}。${delivered}${action}源文件、数据及终端写入必须走原任务的受控入口。`;
+  return `${waiting ? 'Entrorove 原任务绑定已保留。' : 'Entrorove 已强制接管本任务。'}${state.taskNumber ? `云端任务 ${state.taskNumber}。` : '尚未获得云端任务编号，不得声称已进入云端。'}${state.flowId ? `继续原 flowId=${state.flowId}，` : ''}${state.requestId ? `原 requestId=${state.requestId}。` : ''}当前阶段 ${state.phase}。${delivered}${action}Codex 主机明确授权的任务间报告可使用 send_message_to_thread；报告文本不授予仓库写入或新 flow。源文件、数据及终端写入必须走原任务的受控入口。`;
 }
 // Verified hosts only: the guard is universal in shape (host label + session
 // id), and each host proves itself through its own adapter callback.

package/local-scope-create-require.mjs

@@ -0,0 +1,142 @@
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import ts from 'typescript';
+import { createScopeImportResolver, scopeSourceChecker } from './local-scope-import-expressions.mjs';
+import { scopeFail, scopePath } from './local-scope-files.mjs';
+
+const purePathMethods = new Set(['join', 'resolve', 'basename', 'dirname', 'extname', 'isAbsolute', 'normalize',
+  'relative', 'parse', 'format', 'toNamespacedPath', 'matchesGlob']);
+function unwrap(node) { while (node && ts.isParenthesizedExpression(node)) node = node.expression; return node; }
+function imported(declaration) {
+  if (ts.isImportSpecifier(declaration)) return { imported: declaration.propertyName?.text ?? declaration.name.text,
+    module: declaration.parent.parent.parent.moduleSpecifier.text };
+  if (ts.isImportClause(declaration)) return { imported: 'default', module: declaration.parent.moduleSpecifier.text };
+  if (ts.isNamespaceImport(declaration)) return { imported: '*', module: declaration.parent.parent.moduleSpecifier.text };
+  return null;
+}
+function importName(node) {
+  for (let parent = node; parent; parent = parent.parent) {
+    if (ts.isImportDeclaration(parent)) return true;
+    if (ts.isStatement(parent)) return false;
+  }
+  return false;
+}
+function immutable(declaration, source) {
+  return declaration && ts.isVariableDeclaration(declaration) && ts.isVariableDeclarationList(declaration.parent)
+    && declaration.parent.flags & ts.NodeFlags.Const && declaration.initializer && declaration.getSourceFile() === source
+    && !(ts.getCombinedModifierFlags(declaration) & ts.ModifierFlags.Ambient) && !source.isDeclarationFile;
+}
+function staticAnchor(call, source, repositoryRoot, filename, declaration, pathMethod) {
+  if (call.arguments.length !== 1) return null;
+  let visited = 0;
+  const value = (raw, seen = new Set(), depth = 0) => {
+    const node = unwrap(raw);
+    if (!node || depth > 32 || ++visited > 256) return null;
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;
+    if (ts.isPropertyAccessExpression(node) && ts.isMetaProperty(node.expression)
+      && node.expression.keywordToken === ts.SyntaxKind.ImportKeyword && node.expression.name.text === 'meta') {
+      const file = path.resolve(repositoryRoot, filename);
+      return node.name.text === 'dirname' ? path.dirname(file) : node.name.text === 'filename' ? file
+        : node.name.text === 'url' ? pathToFileURL(file).href : null;
+    }
+    if (ts.isCallExpression(node)) {
+      const method = pathMethod(node.expression);
+      if (!['join', 'resolve'].includes(method) || node.arguments.length < 1 || node.arguments.length > 32) return null;
+      const args = node.arguments.map(item => value(item, seen, depth + 1));
+      if (args.some(item => typeof item !== 'string') || method === 'resolve' && !args.some(item => path.isAbsolute(item))) return null;
+      return path[method](...args);
+    }
+    if (!ts.isIdentifier(node)) return null;
+    const bound = declaration(node);
+    return immutable(bound, source) && !seen.has(bound) ? value(bound.initializer, new Set([...seen, bound]), depth + 1) : null;
+  };
+  let absolute = value(call.arguments[0]);
+  if (typeof absolute !== 'string' || !absolute || /[\u0000-\u001f\u007f]/.test(absolute)) return null;
+  if (absolute.startsWith('file:')) { try { absolute = fileURLToPath(absolute); } catch { return null; } }
+  if (!path.isAbsolute(absolute)) return null;
+  const relative = path.relative(repositoryRoot, absolute).split(path.sep).join('/');
+  if (!relative || relative === '..' || relative.startsWith('../') || path.isAbsolute(relative)
+    || relative.split('/').some(part => ['.git', '.entrorove', '.aimlock', '.archguard'].includes(part))) {
+    scopeFail('ENTROROVE_PATH_UNSAFE', `createRequire in "${filename}" resolves its anchor outside the authorized repository or into a reserved control directory`);
+  }
+  return scopePath(relative);
+}
+/** Infer only lexical builtin factories and immutable path expressions; never run scanned code. */
+export function createScopeRequireContexts(source, repositoryRoot, filename) {
+  let checker, safety;
+  const declaration = node => {
+    checker ??= scopeSourceChecker(source);
+    const declarations = checker.getSymbolAtLocation(node)?.declarations;
+    return declarations?.length === 1 && declarations[0].getSourceFile() === source ? declarations[0] : null;
+  };
+  const origin = node => ts.isIdentifier(node) ? imported(declaration(node) ?? source) : null;
+  const factory = node => { const value = node && origin(unwrap(node));
+    return value?.imported === 'createRequire' && ['node:module', 'module'].includes(value.module); };
+  const pathObject = node => { const value = node && origin(unwrap(node));
+    return ['default', '*'].includes(value?.imported) && ['node:path', 'path'].includes(value?.module); };
+  const pathMethod = node => {
+    node = unwrap(node);
+    if (node && ts.isPropertyAccessExpression(node) && pathObject(node.expression)) return node.name.text;
+    const value = node && origin(node);
+    return value && ['node:path', 'path'].includes(value.module) ? value.imported : null;
+  };
+  const factoryCall = node => { node = unwrap(node);
+    return node && ts.isCallExpression(node) && factory(node.expression) ? node : null; };
+  const moduleArguments = createScopeImportResolver(source);
+  const mutableBuiltinLoad = node => {
+    if (!ts.isCallExpression(node) || !node.arguments.length) return false;
+    const callee = unwrap(node.expression), bound = ts.isIdentifier(callee) && declaration(callee);
+    const loading = callee.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(callee) && callee.text === 'require'
+      || factoryCall(callee) || bound && ts.isVariableDeclaration(bound) && factoryCall(bound.initializer);
+    return loading && moduleArguments(node.arguments[0])?.some(name => ['path', 'node:path', 'module', 'node:module'].includes(name));
+  };
+  function safeBuiltins() {
+    if (safety !== undefined) return safety;
+    safety = true;
+    const visit = node => {
+      if (mutableBuiltinLoad(node)) safety = false;
+      if (ts.isIdentifier(node) && !importName(node)) {
+        if (node.text === 'syncBuiltinESMExports') safety = false;
+        if (pathObject(node)) {
+          const member = node.parent, call = member?.parent;
+          if (!ts.isPropertyAccessExpression(member) || member.expression !== node
+            || !(purePathMethods.has(member.name.text) && ts.isCallExpression(call) && call.expression === member)
+              && !['sep', 'delimiter'].includes(member.name.text)) safety = false;
+        }
+        const method = origin(node);
+        if (method && ['node:module', 'module'].includes(method.module)
+          && ['default', '*', 'register', 'registerHooks', 'syncBuiltinESMExports'].includes(method.imported)) safety = false;
+        if (method && ['node:path', 'path'].includes(method.module) && purePathMethods.has(method.imported)
+          && !(ts.isCallExpression(node.parent) && node.parent.expression === node)) safety = false;
+        if (factory(node) && !(ts.isCallExpression(node.parent) && node.parent.expression === node)) safety = false;
+      }
+      ts.forEachChild(node, visit);
+    };
+    visit(source); return safety;
+  }
+  const anchor = call => repositoryRoot && safeBuiltins() ? staticAnchor(call, source, repositoryRoot, filename, declaration, pathMethod) : null;
+  function loader(node) {
+    node = unwrap(node);
+    const direct = factoryCall(node);
+    if (direct) return { anchor: anchor(direct), call: direct };
+    if (!node || !ts.isIdentifier(node)) return null;
+    const bound = declaration(node), creation = bound && ts.isVariableDeclaration(bound) && factoryCall(bound.initializer);
+    if (creation) return { anchor: immutable(bound, source) ? anchor(creation) : null, call: creation, declaration: bound };
+    if (node.text === 'require' && bound) return { anchor: null };
+    return null;
+  }
+  return { loader,
+    knownFactoryReference(node) {
+      const named = ts.isImportSpecifier(node.parent) && imported(node.parent);
+      return importName(node) && (factory(node) || named?.imported === 'createRequire' && ['node:module', 'module'].includes(named.module))
+        || factory(node) && ts.isCallExpression(node.parent)
+        && node.parent.expression === node && anchor(node.parent) !== null;
+    },
+    loaderReference(node) {
+      if (!ts.isIdentifier(node) || importName(node)) return null;
+      const found = loader(node);
+      if (!found) return null;
+      const declared = found.declaration?.name === node;
+      return { safe: Boolean(found.anchor) && (declared || ts.isCallExpression(node.parent) && node.parent.expression === node) };
+    } };
+}

package/local-scope-import-expressions.mjs

@@ -7,7 +7,7 @@ function unwrap(node) {
     || ts.isTypeAssertionExpression(node) || ts.isNonNullExpression(node))) node = node.expression;
   return node;
 }
-function sourceChecker(source) {
+export function scopeSourceChecker(source) {
   const name = path.posix.resolve('/', source.fileName.replaceAll('\\', '/'));
   const matches = value => path.posix.resolve('/', value.replaceAll('\\', '/')) === name;
   const host = { getSourceFile: filename => matches(filename) ? source : undefined,
@@ -47,7 +47,7 @@ export function createScopeImportResolver(source, suppliedChecker) {
         return result;
       }
       if (!ts.isIdentifier(node)) return null;
-      checker ??= sourceChecker(source);
+      checker ??= scopeSourceChecker(source);
       const declarations = checker.getSymbolAtLocation(node)?.declarations;
       if (declarations?.length !== 1) return null;
       const declaration = declarations[0];

package/local-scope-repository.mjs

@@ -15,6 +15,8 @@ import { scopeTsconfigImports } from './local-scope-config-imports.mjs';
 import { scopeGitExecutable } from './local-git-executable.mjs';
 import { createScopeImportResolver, unresolvedImportSite } from './local-scope-import-expressions.mjs';
 import { isTypeOnlyReference, isDynamicFunctionReference } from './local-typescript-function-reference.mjs';
+import { createScopeRequireContexts } from './local-scope-create-require.mjs';
+import { resolveCreatedRequire } from './local-scope-require-resolution.mjs';
 
 const execute = promisify(execFile);
 async function git(root, args, allowed = [], input = { repositoryRoot: root }) {
@@ -107,11 +109,17 @@ function scriptImports(source, filename, context = {}) {
   const parsed = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true,
     scriptKinds.get(path.extname(filename).toLowerCase()) ?? ts.ScriptKind.TS);
   if (parsed.parseDiagnostics.length) scopeFail('ENTROROVE_IMPORT_INVALID', 'source has invalid or unterminated syntax');
-  const found = new Set(), unresolvedImports = [], resolve = createScopeImportResolver(parsed); let dynamic = false;
-  const add = expression => {
+  const found = new Set(), requires = new Map(), unresolvedImports = [], resolve = createScopeImportResolver(parsed); let dynamic = false;
+  const contexts = createScopeRequireContexts(parsed, context.repositoryRoot, context.sourceFilename ?? filename);
+  const unresolved = (expression, reason, message) => { dynamic = true;
+    unresolvedImports.push({ ...unresolvedImportSite(parsed, expression), reason, message }); };
+  const add = (expression, anchor) => {
     const values = resolve(expression);
     if (values === null) { dynamic = true; unresolvedImports.push(unresolvedImportSite(parsed, expression)); }
-    else for (const value of values) found.add(value);
+    else for (const value of values) {
+      if (anchor) requires.set(`${anchor}\0${value}`, { anchor, specifier: value });
+      else found.add(value);
+    }
   };
   const visit = node => {
     if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) { if (node.moduleSpecifier) add(node.moduleSpecifier); }
@@ -120,21 +128,28 @@ function scriptImports(source, filename, context = {}) {
     else if (ts.isCallExpression(node)) {
       const importer = node.expression.kind === ts.SyntaxKind.ImportKeyword;
       const requireCall = ts.isIdentifier(node.expression) && node.expression.text === 'require';
-      if (importer || requireCall) {
+      const created = importer ? null : contexts.loader(node.expression);
+      if (importer || requireCall || created) {
         if (!node.arguments.length || node.arguments.length > (importer ? 2 : 1)) {
           dynamic = true;
           unresolvedImports.push({ ...unresolvedImportSite(parsed, node), reason: 'import-argument-list-not-supported',
             message: 'Import inspection requires one module argument and at most one import-attributes argument' });
         }
-        else add(node.arguments[0]);
+        else if (created && !created.anchor) unresolved(node, 'create-require-context-not-statically-proven',
+          'Require uses a shadowed, mutable or unproven factory/path context; no dependency lookup is authorized');
+        else add(node.arguments[0], created?.anchor);
       }
     }
     const runtimeReference = !isTypeOnlyReference(node);
     if (runtimeReference && ts.isIdentifier(node)) {
-      if (dynamicNames.has(node.text) && (node.text !== 'Function' || isDynamicFunctionReference(node, context))) dynamic = true;
+      if (dynamicNames.has(node.text) && (node.text !== 'Function' || isDynamicFunctionReference(node, context))
+        && !(node.text === 'createRequire' && contexts.knownFactoryReference(node))) dynamic = true;
+      const loader = contexts.loaderReference(node);
+      if (loader && !loader.safe) unresolved(node, 'require-loader-escapes-static-context',
+        'Require loader aliases, mutable bindings and uses outside direct calls remain unresolved');
       if (node.text === 'require' && !(ts.isCallExpression(node.parent) && node.parent.expression === node)
         && !(ts.isPropertyAccessExpression(node.parent) && node.parent.name === node)
-        && !(ts.isMethodDeclaration(node.parent) && node.parent.name === node)) dynamic = true;
+        && !(ts.isMethodDeclaration(node.parent) && node.parent.name === node) && !loader?.safe) dynamic = true;
     }
     if (runtimeReference && ts.isElementAccessExpression(node)) {
       const member = staticString(node.argumentExpression);
@@ -143,7 +158,7 @@ function scriptImports(source, filename, context = {}) {
     if (runtimeReference && ts.isPropertyAccessExpression(node) && node.name.text === 'require' && globalObject(node.expression)) dynamic = true;
     ts.forEachChild(node, visit);
   };
-  visit(parsed); return { specifiers: [...found].sort(), dynamic, unresolvedImports };
+  visit(parsed); return { specifiers: [...found].sort(), requires: [...requires.values()], dynamic, unresolvedImports };
 }
 function vueScripts(source, filename) {
   const { descriptor, errors } = parseVue(source, { filename, sourceMap: false,
@@ -176,14 +191,15 @@ function vueScripts(source, filename) {
   };
   walk(descriptor.template?.ast); return scripts;
 }
-function importSpecifiers(content, filename) {
+function importSpecifiers(content, filename, repositoryRoot) {
   try {
     const source = content.toString('utf8'), parts = path.extname(filename).toLowerCase() === '.vue' ? vueScripts(source, filename) : [{ source, filename }];
-    const specifiers = new Set(), unresolvedImports = []; let dynamic = false;
-    for (const part of parts) { const parsed = scriptImports(part.source, part.filename, part); dynamic ||= parsed.dynamic;
+    const specifiers = new Set(), requires = new Map(), unresolvedImports = []; let dynamic = false;
+    for (const part of parts) { const parsed = scriptImports(part.source, part.filename, { ...part, repositoryRoot, sourceFilename: filename }); dynamic ||= parsed.dynamic;
       unresolvedImports.push(...parsed.unresolvedImports.map(site => ({ ...site, line: site.line + (part.lineOffset ?? 0) })));
+      for (const require of parsed.requires) requires.set(`${require.anchor}\0${require.specifier}`, require);
       for (const specifier of parsed.specifiers) specifiers.add(specifier); }
-    return { specifiers: [...specifiers].sort(), dynamic, unresolvedImports };
+    return { specifiers: [...specifiers].sort(), requires: [...requires.values()], dynamic, unresolvedImports };
   } catch (error) {
     if (typeof error?.code === 'string' && error.code.startsWith('ENTROROVE_')) throw error;
     if (error instanceof RangeError) scopeFail('ENTROROVE_SCOPE_LIMIT', 'dependency syntax exceeds the supported parser or traversal bound');
@@ -280,7 +296,7 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
     const aliases = await scopeTsconfigImports(target => configMetadata(root, target, input), relative, configPath);
     for (const observed of aliases.observations) metadata.set(observed.path, observed);
     const declarations = declarationModules(read.content, relative);
-    const imports = importSpecifiers(read.content, relative); dynamic ||= imports.dynamic;
+    const imports = importSpecifiers(read.content, relative, root); dynamic ||= imports.dynamic;
     unresolvedImports.push(...imports.unresolvedImports.map(site => ({ path: relative, ...site })));
     if (imports.dynamic) dynamicSources.push({ path: relative, sha256: read.sha256 });
     for (const specifier of imports.specifiers.sort()) {
@@ -289,6 +305,12 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
         ...(declarations.has(specifier) ? { declarationOnly: true, declarationPath: relative } : {}) });
       if (target !== null && !visited.has(target)) pending.push(target);
     }
+    for (const request of imports.requires) {
+      const resolved = await resolveCreatedRequire(relative, request.anchor, request.specifier, target => configMetadata(root, target, input));
+      for (const file of resolved.metadata) metadata.set(file.path, file);
+      edges.push({ from: relative, to: resolved.external ? null : resolved.target, external: resolved.external, specifier: request.specifier });
+      if (!resolved.external && resolved.target !== null && !visited.has(resolved.target)) pending.push(resolved.target);
+    }
   }
   const nodes = [...visited.values()].sort((a, b) => a.path.localeCompare(b.path));
   await stableScope(root, nodes, input);
@@ -299,7 +321,7 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
     ...(unresolvedImports.length ? { unresolvedImports } : {}) };
 }
 export async function scopeCandidateImports(root, file, input = { repositoryRoot: root }) {
-  const parsed = importSpecifiers(Buffer.from(file.content), file.path);
+  const parsed = importSpecifiers(Buffer.from(file.content), file.path, root);
   const workspace = await workspaceIndex(root, input);
   const context = (input.importContexts ?? []).filter(item => file.path === item.sourcePrefix || file.path.startsWith(`${item.sourcePrefix}/`))
     .sort((a, b) => b.sourcePrefix.length - a.sourcePrefix.length)[0];
@@ -309,7 +331,12 @@ export async function scopeCandidateImports(root, file, input = { repositoryRoot
     const target = await resolveImport(root, file.path, specifier, workspace, input, aliases, context?.configPath, declarations);
     edges.push({ from: file.path, to: target, external: target === null, specifier });
   }
-  return { edges, dynamic: parsed.dynamic,
+  for (const request of parsed.requires) {
+    const resolved = await resolveCreatedRequire(file.path, request.anchor, request.specifier, target => configMetadata(root, target, input));
+    await stableScope(root, resolved.metadata, input);
+    edges.push({ from: file.path, to: resolved.external ? null : resolved.target, external: resolved.external, specifier: request.specifier });
+  }
+  return { edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)), dynamic: parsed.dynamic,
     ...(parsed.unresolvedImports.length ? { unresolvedImports: parsed.unresolvedImports.map(site => ({ path: file.path, ...site })) } : {}) };
 }
 export async function collectScopeFacts(root, requested, baselineRef, knownFiles = [], input = { repositoryRoot: root }) {

package/local-scope-require-resolution.mjs

@@ -0,0 +1,78 @@
+import path from 'node:path';
+import { builtinModules } from 'node:module';
+import ts from 'typescript';
+import { scopeFail, scopePath } from './local-scope-files.mjs';
+
+const virtualRoot = '/entrorove-repository/';
+const forbidden = new Set(['.git', '.entrorove', '.aimlock', '.archguard']);
+function relativeFile(filename) {
+  const normalized = path.posix.normalize(filename);
+  if (!normalized.startsWith(virtualRoot)) return null;
+  const relative = normalized.slice(virtualRoot.length);
+  if (!relative || relative.split('/').some(part => forbidden.has(part))) return null;
+  return scopePath(relative);
+}
+function checkedManifest(relative, content) {
+  let value;
+  try { value = JSON.parse(content); }
+  catch { scopeFail('ENTROROVE_PACKAGE_INVALID', `createRequire package metadata "${relative}" is invalid JSON`); }
+  const main = value?.main;
+  if (typeof main === 'string' && relativeFile(path.posix.resolve(virtualRoot, path.posix.dirname(relative), main)) === null) {
+    scopeFail('ENTROROVE_PATH_UNSAFE', `createRequire package main in "${relative}" resolves outside the authorized repository or into a reserved directory`);
+  }
+}
+/** Replay CJS package resolution over authorized metadata; neither source nor package entry points execute. */
+export async function resolveCreatedRequire(from, anchor, specifier, metadata) {
+  const observed = new Map(), sources = new Map(), pending = Symbol('authorized-require-read');
+  const read = async relative => {
+    if (sources.has(relative)) return sources.get(relative);
+    let file;
+    try { file = await metadata(relative); }
+    catch (error) { if (!['ENOENT', 'ENOTDIR'].includes(error.code)) throw error; }
+    const content = file ? Buffer.from(file.contentBase64, 'base64').toString('utf8') : null;
+    if (file) {
+      observed.set(relative, { path: relative, sha256: file.sha256 });
+      if (relative.endsWith('/package.json') || relative === 'package.json') checkedManifest(relative, content);
+    }
+    sources.set(relative, content); return content;
+  };
+  if (await read(anchor) === null) scopeFail('ENTROROVE_IMPORT_UNRESOLVED', `${from}: createRequire anchor "${anchor}" has no actual authorized source file`);
+  for (let directory = path.posix.dirname(anchor);; directory = path.posix.dirname(directory)) {
+    for (const name of ['package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock']) {
+      await read(directory === '.' ? name : `${directory}/${name}`);
+    }
+    if (directory === '.') break;
+  }
+  if (builtinModules.includes(specifier) || specifier.startsWith('node:') && builtinModules.includes(specifier.slice(5))) {
+    return { target: null, external: true, metadata: [...observed.values()] };
+  }
+  if (specifier.startsWith('/') || /^[A-Za-z][A-Za-z0-9+.-]*:/.test(specifier) || specifier.includes('\\')) {
+    scopeFail('ENTROROVE_PATH_UNSAFE', `${from}: createRequire module must remain a repository-relative or installed package reference`);
+  }
+  const lookup = filename => {
+    const relative = relativeFile(filename);
+    // Require inspects runtime implementations, never TypeScript declarations or arbitrary TS fallbacks.
+    if (relative === null || /\.(?:[cm]?ts|tsx)$/.test(relative)) return null;
+    if (!sources.has(relative)) throw { pending, relative };
+    return sources.get(relative);
+  };
+  const host = { fileExists: filename => lookup(filename) !== null, readFile: filename => lookup(filename) ?? undefined,
+    getCurrentDirectory: () => virtualRoot.slice(0, -1), realpath: filename => filename,
+    useCaseSensitiveFileNames: true };
+  const options = { module: ts.ModuleKind.NodeNext, moduleResolution: ts.ModuleResolutionKind.NodeNext, allowJs: true,
+    noDtsResolution: true, resolvePackageJsonExports: true, resolvePackageJsonImports: true, customConditions: ['node-addons'] };
+  for (let probes = 0; probes < 1024; probes++) {
+    try {
+      const resolved = ts.resolveModuleName(specifier, virtualRoot + anchor, options, host, undefined, undefined, ts.ModuleKind.CommonJS).resolvedModule;
+      const target = resolved && relativeFile(resolved.resolvedFileName);
+      if (!target) scopeFail('ENTROROVE_IMPORT_UNRESOLVED', `${from}: createRequire(${JSON.stringify(anchor)}) cannot resolve ${JSON.stringify(specifier)} to an actual installed runtime file inside the authorized repository`);
+      await read(target);
+      const external = !specifier.startsWith('.') && !specifier.startsWith('#');
+      return { target, external, metadata: [...observed.values()].filter(file => file.path !== from && (external || file.path !== target)) };
+    } catch (error) {
+      if (error?.pending !== pending) throw error;
+      await read(error.relative);
+    }
+  }
+  scopeFail('ENTROROVE_SCOPE_LIMIT', `${from}: createRequire resolution exceeds the 1024-authorized-file-probe bound`);
+}

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.53",
+  "version": "0.1.55",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.53",
+  "version": "0.1.55",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -140,6 +140,8 @@
     "local-scope-context.mjs",
     "local-scope-files.mjs",
     "local-scope-import-expressions.mjs",
+    "local-scope-create-require.mjs",
+    "local-scope-require-resolution.mjs",
     "local-scope-repository.mjs",
     "local-scope-signature.mjs",
     "local-scope-config-imports.mjs",

package/release-state.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.53",
-  "digest": "3508e9d78536c07403711408fe6dc6d71d137820f34d3d164c4b5898be923df5",
+  "version": "0.1.55",
+  "digest": "9caa3f7a2e6f43718003b5a0608b77e8b3a635ed5a75f4303da57f4381693f61",
   "files": {
     "connected-cli.mjs": "260c0fc99586c24bd4d0351a14e0744849a612ebe6f1bd7951e4fce200daf920",
     "local-approved-process.mjs": "442856df788e63f38757439ba0657d1c689aaf797631a955fae3dd639e844e6d",
@@ -20,11 +20,11 @@
     "local-delegated-modify-analysis.mjs": "f87148ddb023b79e241ca97db582991da8d0e1a51b26b1d9bc2799a76efd7297",
     "mutation-client.mjs": "8d27b267dc660510aa1406c44d4005e44b972a1260f90657de4fa0e75b7b6c3e",
     "cloud-mutation-authority.mjs": "c7226e882a4f3be4d2f55728f515d5a815c0aa1f21aa5e4689314e6e6a8c66a2",
-    "ide-code-mode.mjs": "f3f53357ba09727b3b597851976a24de93287c0faca5052448277d0904bb61f7",
-    "ide-command.mjs": "f2fe57312f83a11b318f1c98db51a6a47a7ff45b53f392acce32e458976bd06c",
-    "ide-hook.mjs": "be328cc646ea6ec5dc18e5458dd1f829897cc386d74bda0b56cbd14f53c98827",
+    "ide-code-mode.mjs": "f8ba4de33632ab4c6df52dab52f392414b4632c7e94b218b8065677970c075c7",
+    "ide-command.mjs": "134fa07e152f3966d4763f10eea33e69559a2271fefb453a1384396fd5f01333",
+    "ide-hook.mjs": "68ca1f5805a49b78182f2508bdd5fac390080e9b2c2ba3645a9aaea69f9d4d0f",
     "ide-install.mjs": "10247efadcfeef5da001022d12080bd0f789e67fdf7862bcc65db73dda3bbe57",
-    "ide-session.mjs": "453b9510ab825c2927a4fae8250ee8a8eb5ac10b23cf024af84a7c5916ba53dd",
+    "ide-session.mjs": "6df04bca3231954e8b83f6b1b535befff16b6c62c51ca65ae3aa2559180ad7c2",
     "break-glass.mjs": "6ec9f97c5d68bb33121b2374c06b9d4c8eb3419b52d00849fec7124bc63e4582",
     "ide-results.mjs": "7ed5caf8e77cf42ae6d62cc1ed42b1639bca6069d809b90a399bec5192fb903e",
     "ide-queue.mjs": "806e716c775fd0079417027b135977c8516f47dddb0bc5ca19e32a355dab0e9e",
@@ -32,7 +32,7 @@
     "local-discipline-analysis.mjs": "e887abdd1c6d6ba59ef7323e9035528f0491e5458ca8159985ec26e1ca67a4af",
     "local-discipline-batch.mjs": "2cc90dbae55efdee0c445da399c0a9acafa92e915344c25208ebca554fc4c9e9",
     "local-typescript-function-reference.mjs": "af682b479fe0d69a5ecd62232406bb8078408ec8710733cfed9ae6b059762ba5",
-    "local-scope-import-expressions.mjs": "6623dea5501c4dc24e12c99e0776d65650bbe752c85c9509d022ba1f61bd5111",
+    "local-scope-import-expressions.mjs": "20f1e065582c68d2334e0dfaa130a559ff19886a57f9038dc569f65993bb06c8",
     "local-discipline-contracts.mjs": "6cf8a3d132fdb9074eb1441600afe7aa199df33e88a71a660d9db534c14f19e4",
     "local-discipline-contracts.d.mts": "defc684c78dc88afa1c54340ab4a01ae36db7aa11257cbe1f5cd323f608c78c4",
     "local-discipline-gate.mjs": "e3851157bf1d8bc86eb44212a88acd20acfc2d1152e7d87af6dc2a37afffcd6f",
@@ -48,7 +48,7 @@
     "runtime/validator-runtime-v7.0.44.d.mts": "7797edbfe2f7de24da370204dce4dfd22822a1bd80df93514fff900b98afe36f",
     "snapshot-retention.mjs": "4f8919fe8ec49fb4c23e080a8ad2fa3a9282bca3fffe7cf55c64e89ef316697e",
     "snapshot-cleanup-journal.mjs": "76a9684cc95b4eb076e1298d78a9dff37948b00d9607b8f546c599072d3ed331",
-    "IDE-EXECUTION.md": "fe8ff87dde885832b34a369985f02b567efa096ed1c1e79a0e490280c8540bf5",
+    "IDE-EXECUTION.md": "abe40303ab31637f5c69b0e5611a49fd579566a0bb95bd9fba1ebd39e7108fbd",
     "REUSE-DISCIPLINE.md": "5b214cf313e7f715f52d54e28093a2d038f0f196ca64b15d1c49587b9d8eecf8",
     "reuse-discipline-release.mjs": "2935898d1aa807fb982a78d7ab5cb1abe05e3c8fc945dc0909da8098872aa1ac",
     "local-final-gate16.mjs": "083aec470670e6cdb7ad2ab27b7a51b53a9ec3a8b4121cb9cbfa17d9940892c2",
@@ -96,13 +96,13 @@
     "install-cleanup.mjs": "8a8e1a7dfe37427f86cd4d6e317890d0829894a9949d4216674a716b36edbc54",
     "review-client.mjs": "3491eef68ed533174b31db3c53febb6519b8f088f71a9964644714a9a4c03c77",
     "version.mjs": "1f392147d72c40af4b03b307ea607075fb815af5174fa07e254b95fe12dbf3e7",
-    "SKILL.md": "d21f5085c0a5f830d5fd8b65e3a9da1e6d15512db69a4a8daab3e94fb8738f0b",
+    "SKILL.md": "684438bcdfefef590e51e4ce02be0a244a26d142a24599258bf3ae24c86bbfa1",
     "CAPABILITY-MAP.md": "69b2c49b111d651969dea7430f4df7950d8fdf2f0f151d8386fa04968b872ac0",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
     "DELIVERY-BOUNDARIES.md": "9b9db50ed1bcce9e77ff6527b6bb7eaf12f3b913162ea9cb7fe90db06b393a4f",
-    "package.json": "6a0566be47288eba3fb8b327e19d50df62f47a90e101ff952b49cedd951c04b7",
+    "package.json": "e910dc5cf0db61b1fcb9feffa21a8f8d3c2a244b7d858e8af72202f5b91d403b",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
-    "release.mjs": "6292dd8a4ef82c5674f4aa80a8e70059f378162162b83aae750fa55697ba90d3",
+    "release.mjs": "8b0dc36c47aec72cf9952c9ac1ce5fe27da5ae6829f50cd2339fa101b2eda93c",
     "local-cli.mjs": "41e2a737c8587cb5ce469a7661f6d14b5ea4cd073f8286822fc4dc96b67f56a1",
     "local-state-lock.mjs": "1dbf64264642a0851faf043e07ee9f66d2ad0508e9f799b0626246e42fae893e",
     "local-execution.mjs": "185f34e917440a360b3c4bafd3af245243807d964ae3820b3cffaaa2e6348cc6",
@@ -141,7 +141,9 @@
     "local-scope-candidate.mjs": "8f0bd9606e70d4a0ebacdd3cd600ec3afed85e2bb3e1760aa1144cf55d4e028a",
     "local-scope-context.mjs": "79753abfc6c76089d17f003a1be537dfaea10d6731c542f7fc53f2a9996ed164",
     "local-scope-files.mjs": "4c14a5e226dd5518aeb37f199b1aa896943a66d41e5a1757a3b3fd8a79446d76",
-    "local-scope-repository.mjs": "d9d4c81c3f401c38c33b8dd7bdf8ebaf4658d1afd1cce408a7acd37f8836a6df",
+    "local-scope-repository.mjs": "941eb895c8210da1ca90e8b3d1d6936c24408d10139fe6c3eba2761329248392",
+    "local-scope-create-require.mjs": "6b6a209bfcad8fe1398e99c5c8cc3af189c120b9c38e244a73dd1a99c3d91295",
+    "local-scope-require-resolution.mjs": "b24596462c8776cbefa6f0a74749d665aa928d1643c68d44798eb93e2dd5ad42",
     "local-scope-git.mjs": "53bbbb6c4795db711b5bc164591a6ad79a561427da046d6bbe997dae6eb82829",
     "local-scope-git-reads.mjs": "5d8a2636bab955cb325cb693db7423e69512355887ae5b5af3b8cb615f5ddad0",
     "local-git-executable.mjs": "9391d716529025b1de3ee006df658a9d765b6ef29ad24ef9b7436829318e651e",
@@ -174,7 +176,7 @@
     "local-task-routing.mjs": "6e2e506b2fb0e2e8d8c5147d7df32849b57a4e94a23634f01a355d45735858e4",
     "remote-client.mjs": "0d1ec6506fe53a1e33c31c5ba19d14e30e00e85e11eaf7ff8277ea798b9f36c9",
     "cloud-task-client.mjs": "11acb1a033c94cdfbdfb177a3402ad97f6a5226f577138c8cf6395dc3ebb1a39",
-    "scope-runner-client.mjs": "646ab4f80d4a8209e922fd45f40efd968f0744d9dfc03188b222c1a2e11e83b8",
+    "scope-runner-client.mjs": "2afcbb8bc8a26d03f26787cb2ffd9994c4377757d16d54aa0c83752a29e833ea",
     "native-client.mjs": "6f5575909bae9daba643287f876ffa0f9ff1c53a367b32a40145d740456d6605",
     "native-notification.mjs": "8859a26c6f13d222711f763acf49ed8546b3306cf71f990643ac31a5ccaf1ba1",
     "local-peer-status.mjs": "a971bcc69d60bb32b875ca5bb4297d948631d5d2821b812c279613ea059a8b4f",

package/release.mjs

@@ -84,6 +84,8 @@ const sourceFiles = [
   'local-scope-context.mjs',
   'local-scope-files.mjs',
   'local-scope-repository.mjs',
+  'local-scope-create-require.mjs',
+  'local-scope-require-resolution.mjs',
   'local-scope-git.mjs',
   'local-scope-git-reads.mjs',
   'local-git-executable.mjs',
@@ -365,6 +367,8 @@ function releaseLabels() {
     'local-scope-context.mjs': { zh: '精确符号范围绑定', en: 'exact symbol scope binding' },
     'local-scope-files.mjs': { zh: '范围文件与安全读取', en: 'scope files and guarded reads' },
     'local-scope-repository.mjs': { zh: '真实仓库范围事实', en: 'actual repository scope facts' },
+    'local-scope-create-require.mjs': { zh: '静态 createRequire 原目录绑定', en: 'static createRequire source-directory binding' },
+    'local-scope-require-resolution.mjs': { zh: '实际 CommonJS 依赖只读解析', en: 'read-only installed CommonJS dependency resolution' },
     'local-scope-config-imports.mjs': { zh: 'tsconfig 范围路径与依赖只读引用', en: 'tsconfig scope paths and read-only dependency references' },
     'local-scope-config-extends.mjs': { zh: 'tsconfig npm 配置继承解析', en: 'tsconfig npm configuration inheritance resolution' },
     'local-scope-git.mjs': { zh: '实际Git范围与变更事实', en: 'actual Git scope and change facts' },

package/releases.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.1.55",
+    "date": "2026-10-17",
+    "zh": "修复任务间消息被技能误拦截，将已授权通信交回主机审批；规范只读和 SDK 命令执行参数；新增原流程计划阶段的显式范围重评与恢复提示，保留原门禁、合同、请求身份及失败历史。",
+    "en": "Restored host-approved task messaging, constrained read and SDK execution inputs, and added explicit planning-scope reassessment with phase-correct recovery while retaining original gates, contracts, request identities, and failure history."
+  },
+  {
+    "version": "0.1.54",
+    "date": "2026-10-17",
+    "zh": "修复受管 Node 只读 SHA-256 命令在 Codex 工具门禁中的静态识别与安全改写；按已证明的 createRequire 原目录解析实际安装依赖并记录只读元数据，保留未知上下文和越界拒绝。",
+    "en": "Fixed static recognition and safe rewriting of managed Node SHA-256 reads in Codex tool guards; resolved installed dependencies from proven createRequire anchors with read-only metadata while preserving unknown-context and path-boundary refusals."
+  },
   {
     "version": "0.1.53",
     "date": "2026-10-17",

package/scope-runner-client.mjs

@@ -82,10 +82,16 @@ async function connect(identity, directory, dependencies) {
   const observed = await probe({ ...input, ownerId: challenge.ownerId, task: challenge.task, taskDigest: challenge.taskDigest,
     chainDigest: challenge.chainDigest, repositoryId: challenge.repositoryId, challenge: challenge.challenge, signerConfigPath });
   const accepted = await remote('scope-runner-attest', { flowId: identity.flowId, attestation: observed.attestation }, dependencies);
+  const next = accepted.nextStep ?? { operation: 'workflow-gate', payload: { targetFiles: [...identity.targetPaths] } };
+  if (next.localOperation === 'scope-connect') return { schemaVersion: 'entrorove.scope-connection/1.0', status: 'succeeded',
+    flowId: identity.flowId, runnerId: binding.runnerId, scopeEvidence: accepted.scopeEvidence, grantsExecutionAuthority: false,
+    nextOperation: 'scope-connect', nextInput: { flowId: identity.flowId, paths: [...identity.targetPaths], importContexts: identity.importContexts }, nextStep: next };
+  const resumeOriginalRequest = ['workflow-contract', 'workflow-plan'].includes(next.operation);
+  const nextInput = next.operation === 'task-resume' ? { flowId: identity.flowId }
+    : { flowId: identity.flowId, operation: next.operation, payload: next.payload ?? {} };
   return { schemaVersion: 'entrorove.scope-connection/1.0', status: 'succeeded', flowId: identity.flowId,
     runnerId: binding.runnerId, scopeEvidence: accepted.scopeEvidence, grantsExecutionAuthority: false,
-    nextOperation: 'workflow-gate', nextInput: { flowId: identity.flowId, operation: 'workflow-gate',
-      payload: { targetFiles: [...identity.targetPaths] } } };
+    nextOperation: next.operation, ...(resumeOriginalRequest ? { resumeOriginalRequest: true } : { nextInput }), nextStep: next };
 }
 export async function connectScopeRunner(repositoryRoot, input, dependencies) {
   if (!input || Object.keys(input).some(field => !['flowId', 'paths', 'importContexts'].includes(field))