@entrorove/skill 0.1.54 → 0.1.55

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.55 — 2026-10-17
+
+- 修复任务间消息被技能误拦截，将已授权通信交回主机审批；规范只读和 SDK 命令执行参数；新增原流程计划阶段的显式范围重评与恢复提示，保留原门禁、合同、请求身份及失败历史。
+- Restored host-approved task messaging, constrained read and SDK execution inputs, and added explicit planning-scope reassessment with phase-correct recovery while retaining original gates, contracts, request identities, and failure history.
+
 ## 0.1.54 — 2026-10-17
 
 - 修复受管 Node 只读 SHA-256 命令在 Codex 工具门禁中的静态识别与安全改写；按已证明的 createRequire 原目录解析实际安装依赖并记录只读元数据，保留未知上下文和越界拒绝。

package/IDE-EXECUTION.md

@@ -6,6 +6,10 @@ If the IDE guard itself is the blocked step, run `entrorove unlock` directly fro
 
 Capability discovery and offline unlock remain administrative calls during `entry`, before a flow exists. The guard recognizes its own rendered commands with quoted identity assignments, their order changed, or a literal `env` prefix containing only supported host/session identities; it rewrites approved calls to the installed runtime and current session. This does not authorize native scripts or unbound project writes.
 
+Approved Codex `exec_command` reads and SDK calls run with `/bin/sh` and `login:false`; static code mode uses the same execution input check. Its noninteractive workdir and output controls pass through. Other hosts keep their adapter's command schema, including timeout where supported, with custom executors and permission expansion rejected.
+
+For a Codex task-to-task report explicitly authorized by the human user, the guard passes the exact `mcp__codex_app__send_message_to_thread` tool through unchanged, including a static `tools.mcp__codex_app__send_message_to_thread({...})` call inside `functions.exec`. Codex still decides whether the user authorized the message. Its text and response grant no Entrorove flow, file, shell or task-creation authority.
+
 To stop using Entrorove on this computer, run `entrorove uninstall` directly. It works offline, removes only the recorded Entrorove host hooks and pristine global skill, and leaves other host settings, credentials and task records in place. A hand-edited file is reported as preserved rather than deleted. This command does not inspect or change another project.
 
 Every invocation rereads that same credential file, including clients already running. After an authenticated account page supplies the current key and `configure` synchronizes it once, all tasks under the same OS user automatically use the new value. A revoked or expired key cannot obtain new permissions for itself: return to the authenticated account page and synchronize once through JSON stdin. Status recovery only queries the original request; it never rotates credentials or repeats the operation.

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute an engineering task through Entrorove, preserving its origi
 
 # entrorove · 熵巡
 
-Version: 0.1.54.
+Version: 0.1.55.
 
 Entrorove applies to the whole task once selected. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 
@@ -19,8 +19,8 @@ Entrorove applies to the whole task once selected. Reading this document or call
    With cloud sandbox disabled, the IDE performs its own planning and continues the original API flow. Do not require a cloud model call or create a sandbox task to perform local work.
    When the model produces a task contract, preserve its `workType`, `risk`, `difficulty`, `crossModule`, `parallel`, `unclear`, `architectureContract`, optional `baselineRef`, and optional `interaction` as returned. Valid work types are `implementation`, `documentation`, `calculation`, `merge`, `review`, `decision`, and `diagnosis`. A `merge` requires a concrete `baselineRef` identifying the branch, tag, commit, or review baseline; keep that baseline unchanged through independent verification. A `decision` requires `interaction`, including a risk description for medium or high risk. Do not fill missing required fields by guessing.
 4. After real cloud acceptance, immediately display **云端任务 <taskNumber> · 已进入**. Preserve `taskNumber` verbatim: it is the homepage sandbox tab number. Keep its UUID `taskId` separately. Run the returned `cloud-watch`, show each real public event and its cursor, and continue the original accepted flow from status. A command log alone is insufficient. No accepted cloud task means no cloud ID or model-execution claim.
-5. For an accepted `flowId`, execute the returned `nextStep` with its required payload. Discover the schema before constructing input. An empty payload is valid only when that operation's schema allows it. Reconnect and refresh only the original flow. A changed snapshot is a binding failure to investigate; do not invent a fresh successful baseline, rebuild a flow to evade it, or erase the old failure. If the terminal flow truly owns a stale task slot, use the explicit `flow-abandon` lifecycle operation described below before routing the original task again.
-6. All governed mutations use the original authority: `local guarded-write`, `local guarded-delete`, `local guarded-move`, or the original frozen approved runner plan. Native patches, scripts, terminal writes, database mutations and unknown MCP operations must not substitute for the controlled entry. **A failed gate or unknown outcome must never be replaced with another executor or reported as local success.** Query the original request read-only, repair the cause, and obtain the original flow's valid authority before proceeding.
+5. For an accepted `flowId`, execute the returned `nextStep` with its required payload. Discover the schema before constructing input. An empty payload is valid only when that operation's schema allows it. Reconnect and refresh only the original flow. A changed snapshot is a binding failure to investigate; do not invent a fresh successful baseline, rebuild a flow to evade it, or erase the old failure. If a fresh scope proof returns `ENTROROVE_SCOPE_PLANNING_REASSESSMENT_REQUIRED` before plan freeze, follow its explicit `workflow-scope-reassess` recovery and retry the original complete request; a local reassessment or snapshot refresh alone does not renew the accepted gate. If the terminal flow truly owns a stale task slot, use the explicit `flow-abandon` lifecycle operation described below before routing the original task again.
+6. All governed mutations use the original authority: `local guarded-write`, `local guarded-delete`, `local guarded-move`, or the original frozen approved runner plan. Native patches, scripts, terminal writes, database mutations and unknown MCP operations must not substitute for the controlled entry. User-authorized task messages use the host's message tool and remain subject to host approval; sending a report does not change the flow or grant execution authority. **A failed gate or unknown outcome must never be replaced with another executor or reported as local success.** Query the original request read-only, repair the cause, and obtain the original flow's valid authority before proceeding.
    For a restricted member scope, follow a returned `localAction` before submitting execution evidence. `mutation-connect` obtains only the original task's limited editing pass; it keeps unresolved loader files and project configuration read only. After actual writes, refresh the original scope and run `mutation-settle`. Use the returned `previousPassId` for further edits. With sandbox disabled, `workflow-observe-step` runs the original approved command and preserves its real local result without a validator private key; independent verification remains pending. See [IDE-EXECUTION.md](IDE-EXECUTION.md#restricted-member-editing).
 7. Read [REUSE-DISCIPLINE.md](REUSE-DISCIPLINE.md) when modifying an existing system. The comparison baseline is the existing implementation in that same repository. It never means another project, another account, or copying external systems.
 8. Read [DELIVERY-BOUNDARIES.md](DELIVERY-BOUNDARIES.md) before claiming a delivered stage or showing consumption. A delivered stage requires a clean boundary and uses `delivered-stage-N`. Blocked or unknown work can wait with recovery data intact; it is not a delivered stage. Display consumption only with a measured baseline.

package/ide-code-mode.mjs

@@ -1,12 +1,21 @@
 import { createRequire } from 'node:module';
-import { literalCommand, sdkCommand, readCommand, runtimeHashRead } from './ide-command.mjs';
+import { literalCommand, sdkCommand, readCommand, runtimeHashRead, prepareIdeShellInput } from './ide-command.mjs';
+
+export const hostTaskMessageTool = 'mcp__codex_app__send_message_to_thread';
+export function hostTaskMessageInput(value) {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    && typeof value.threadId === 'string' && value.threadId.trim().length > 0
+    && typeof value.prompt === 'string' && value.prompt.trim().length > 0
+    && Object.entries(value).every(([key, item]) =>
+      ['threadId', 'prompt', 'hostId', 'model', 'thinking'].includes(key) && typeof item === 'string');
+}
 
 export function prepareIdeCodeMode(code, runtime) {
   if (typeof code !== 'string' || code.length > 1_000_000) return { allowed: false };
   const ts = createRequire(runtime.cli)('typescript');
   const source = ts.createSourceFile('host-call.js', code, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
   if (source.parseDiagnostics.length) return { allowed: false };
-  let allowed = true; const replacements = [];
+  let allowed = true, unsafeShellInput = false; const replacements = [];
   const literal = node => {
     if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;
     if (ts.isNumericLiteral(node)) return Number(node.text);
@@ -21,7 +30,8 @@ export function prepareIdeCodeMode(code, runtime) {
     throw new Error('Dynamic tool arguments');
   };
   const visit = node => {
-    if (ts.isImportDeclaration(node) || ts.isNewExpression(node) || ts.isElementAccessExpression(node) || ts.isFunctionExpression(node)) allowed = false;
+    if (ts.isImportDeclaration(node) || ts.isNewExpression(node) || ts.isElementAccessExpression(node)
+      || ts.isFunctionExpression(node) || ts.isTaggedTemplateExpression(node)) allowed = false;
     if (ts.isCallExpression(node)) {
       const name = node.expression.getText(source);
       if (name === 'tools.exec_command') {
@@ -42,6 +52,16 @@ export function prepareIdeCodeMode(code, runtime) {
               replacements.push({ start: argument.getStart(source), end: argument.getEnd(), text: JSON.stringify(fixed) });
             }
           } else if (!(readCommand(command) || sdkCommand(command, runtime))) allowed = false;
+          else {
+            const fixed = node.arguments.length === 1 && !node.questionDotToken
+              && prepareIdeShellInput('exec_command', args, args.cmd);
+            if (!fixed) { allowed = false; unsafeShellInput = true; }
+            else replacements.push({ start: argument.getStart(source), end: argument.getEnd(), text: JSON.stringify(fixed) });
+          }
+        } catch { allowed = false; }
+      } else if (name === `tools.${hostTaskMessageTool}`) {
+        try {
+          if (node.questionDotToken || node.arguments.length !== 1 || !hostTaskMessageInput(literal(node.arguments[0]))) allowed = false;
         } catch { allowed = false; }
       } else if (name === 'tools.update_goal' || name === 'tools.get_goal') {
         try {
@@ -55,7 +75,7 @@ export function prepareIdeCodeMode(code, runtime) {
     ts.forEachChild(node, visit);
   };
   visit(source);
-  if (!allowed) return { allowed: false };
+  if (!allowed) return { allowed: false, ...(unsafeShellInput ? { reason: 'shell-input' } : {}) };
   let prepared = code;
   for (const item of replacements.sort((a, b) => b.start - a.start)) {
     prepared = `${prepared.slice(0, item.start)}${item.text}${prepared.slice(item.end)}`;

package/ide-command.mjs

@@ -113,6 +113,33 @@ export function readCommand(parsed) {
   return false;
 }
 
+const safeShellKeys = {
+  exec_command: new Set(['cmd', 'command', 'workdir', 'max_output_tokens', 'yield_time_ms', 'tty', 'shell', 'login']),
+  Bash: new Set(['command', 'cmd', 'workdir', 'timeout', 'description', 'max_output_chars', 'max_output_tokens', 'yield_time_ms', 'tty']),
+  shell_command: new Set(['command', 'cmd', 'workdir', 'timeout', 'description', 'max_output_chars', 'max_output_tokens', 'yield_time_ms', 'tty']),
+};
+
+export function prepareIdeShellInput(toolName, input, normalizedCommand, mirrorCommand = false) {
+  const keys = safeShellKeys[toolName];
+  if (!keys || !input || typeof input !== 'object' || Array.isArray(input)
+    || typeof normalizedCommand !== 'string' || !Reflect.ownKeys(input).every(key => keys.has(key))) return null;
+  const primary = toolName === 'exec_command' ? 'cmd' : 'command';
+  if (typeof input[primary] !== 'string' || input.cmd !== undefined && input.command !== undefined
+    && input.cmd !== input.command || input.tty !== undefined && input.tty !== false
+    || input.workdir !== undefined && typeof input.workdir !== 'string'
+    || input.description !== undefined && typeof input.description !== 'string'
+    || input.timeout !== undefined && (!Number.isSafeInteger(input.timeout) || input.timeout <= 0)
+    || ['max_output_chars', 'max_output_tokens'].some(key => input[key] !== undefined
+      && (!Number.isSafeInteger(input[key]) || input[key] <= 0))
+    || input.yield_time_ms !== undefined && (!Number.isSafeInteger(input.yield_time_ms) || input.yield_time_ms < 0)
+    || input.shell !== undefined && input.shell !== '/bin/sh'
+    || input.login !== undefined && input.login !== false) return null;
+  const { cmd: _cmd, command: _command, ...options } = input;
+  return { ...options, [primary]: normalizedCommand,
+    ...(toolName === 'exec_command' && mirrorCommand ? { command: normalizedCommand } : {}),
+    ...(toolName === 'exec_command' ? { shell: '/bin/sh', login: false } : {}) };
+}
+
 const runtimeHashTool = process.platform === 'darwin'
   ? { name: 'shasum', executable: '/usr/bin/shasum', flags: ['-a', '256'] }
   : process.platform === 'linux'

package/ide-hook.mjs

@@ -5,8 +5,8 @@ import { ideSession, ideRuntime, bindIdeAccount, ideContext, ideDigest, readBrea
   ideBlockIdentity, repeatedIdeBlock, observeIdeToolOutcome } from './ide-session.mjs';
 import { isStageTerminal, stageOf } from './local-stage-boundary.mjs';
 import { literalCommand, sdkCommand, readCommand, renderSdkCommand, installerCommand,
-  runtimeHashCommand, runtimeHashRead } from './ide-command.mjs';
-import { prepareIdeCodeMode } from './ide-code-mode.mjs';
+  runtimeHashCommand, runtimeHashRead, prepareIdeShellInput } from './ide-command.mjs';
+import { hostTaskMessageInput, hostTaskMessageTool, prepareIdeCodeMode } from './ide-code-mode.mjs';
 import { pathToFileURL } from 'node:url';
 import path from 'node:path';
 import { parseIdeResults, consumeIdeResults } from './ide-results.mjs';
@@ -42,7 +42,7 @@ function blockedReason(state, event, reason, detail = {}) {
   state.blockStreak = repeated ? (state.blockStreak ?? 0) + 1 : 1;
   state.lastBlockKey = key;
   state.lastBlockIdentity = ideBlockIdentity(state);
-  const mechanism = detail.mechanism ?? `机制：${state.stateFile ?? '会话状态文件'} 当前 phase=${state.phase}${state.pendingCall ? `，pendingCall=${state.pendingCall.toolUseId}` : ''}；该阶段只放行 Entrorove 管理调用，业务与写操作需先建立原 flow 并取得 nextStep。`;
+  const mechanism = detail.mechanism ?? `机制：${state.stateFile ?? '会话状态文件'} 当前 phase=${state.phase}${state.pendingCall ? `，pendingCall=${state.pendingCall.toolUseId}` : ''}；该阶段只放行 Entrorove 管理调用及主机明确授权的任务间报告，业务与写操作需先建立原 flow 并取得 nextStep。`;
   const repeat = repeated && state.blockStreak >= 2 ? `同一阻断已出现 ${state.blockStreak} 次，禁止再次检查：说明机制、给出绕过方案并执行绕过。` : '';
   const recovery = detail.recovery ?? `绕过方案（离线、无网络、无协议、不经 hook，终端直接运行）：\n${unlockCommand}\n执行后重试原管理调用；项目写入仍需原任务授权。`;
   return `${reason} ${mechanism} ${repeat}\n${recovery}`;
@@ -68,6 +68,12 @@ function denyRuntimeHash(state, event, runtime) {
     recovery: `恢复：用固定只读命令重新取得该 Node 文件的哈希：\n${safe ?? '当前平台没有受支持的固定哈希命令；请使用受管安装所绑定的 Node 路径。'}${safe ? `\n代码模式请传静态 tools.exec_command({cmd:${JSON.stringify(safe)},shell:'/bin/sh',login:false})。` : ''}\n本次在 hook 本地预检中拒绝，未发起协议请求，因此没有 requestId。`,
   });
 }
+function denyUnsafeShellInput(state, event) {
+  return denyBlocked(state, event, 'ENTROROVE_IDE_EXEC_INPUT_DENIED：只读或 SDK 命令含不安全的执行参数。', {
+    mechanism: '机制：仅接受静态命令及只读的 workdir、输出上限和超时参数；自定义 shell、登录模式、环境变量、交互终端或权限扩张均不属于受管调用。',
+    recovery: '恢复：移除执行器和权限扩张参数。exec_command 将固定为 /bin/sh 且 login=false；本次在 hook 本地预检中拒绝，未发起协议请求。',
+  });
+}
 function lifecycleResult(value, depth = 0) {
   if (!value || typeof value !== 'object' || depth > 4) return null;
   if (value.operation === 'flow-cancel' || value.operation === 'flow-abandon') return value;
@@ -130,12 +136,11 @@ async function beforeTool(event, state, home) {
   const isShell = ['Bash', 'exec_command', 'shell_command'].includes(event.tool_name);
   const installer = isShell && installerCommand(parsed);
   if (installer) {
-    if (state.active) {
-      state.readCalls ??= {};
-      state.readCalls[event.tool_use_id] = { toolUseId: event.tool_use_id, command: 'install' };
-    }
-    return output('PreToolUse', { permissionDecision: 'allow', updatedInput: { ...event.tool_input, command: installer,
-      ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: installer } : {}) } });
+    const safeInput = prepareIdeShellInput(event.tool_name, event.tool_input, installer, true);
+    if (!safeInput) return denyUnsafeShellInput(state, event);
+    if (state.active) { state.readCalls ??= {};
+      state.readCalls[event.tool_use_id] = { toolUseId: event.tool_use_id, command: 'install' }; }
+    return output('PreToolUse', { permissionDecision: 'allow', updatedInput: safeInput });
   }
   const namedSdk = parsed?.words.some(word => word === 'entrorove' || /^@entrorove\/skill(?:@[^ ]+)?$/u.test(word)
     || /(?:@entrorove\/skill|entrorove-skill)\/cli\.mjs$/u.test(word));
@@ -143,20 +148,20 @@ async function beforeTool(event, state, home) {
   const runtime = isShell && parsed ? await ideRuntime(home) : null;
   const call = runtime && sdkCommand(parsed, runtime);
   if (call) {
+    if (!prepareIdeShellInput(event.tool_name, event.tool_input, command, true)) return denyUnsafeShellInput(state, event);
     if (call.args[0] === 'uninstall') {
       state.active = false; state.phase = 'user-exited';
-      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: { ...event.tool_input,
-        command: renderSdkCommand(call, runtime, state.sessionId),
-        ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: renderSdkCommand(call, runtime, state.sessionId) } : {}) } });
+      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: prepareIdeShellInput(event.tool_name,
+        event.tool_input, renderSdkCommand(call, runtime, state.sessionId), true) });
     }
     state.active = true;
     if (call.args[0] !== 'configure' && call.args[0] !== 'unlock') await bindIdeAccount(state, home);
-    if (state.phase === 'setup' && !unlocked && !isManagementCall(call)) return denyBlocked(state, event, 'Entrorove：自举阶段只放行 Entrorove 管理调用（建 flow、改目标、scope-connect、capabilities、status、queue 等）；业务与写操作需先建立原 flow。');
+    if (state.phase === 'setup' && !unlocked && !isManagementCall(call)) return denyBlocked(state, event, 'Entrorove：自举阶段只放行 Entrorove 管理调用及主机明确授权的任务间报告；业务与写操作需先建立原 flow。');
     if (call.args[0] === 'unlock') {
       resetBlockStreak(state);
       const rewritten = renderSdkCommand(call, runtime, state.sessionId);
-      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: { ...event.tool_input, command: rewritten,
-        ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: rewritten } : {}) }, additionalContext: `${ideContext(state)}离线管理解锁已放行。` });
+      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: prepareIdeShellInput(event.tool_name,
+        event.tool_input, rewritten, true), additionalContext: `${ideContext(state)}离线管理解锁已放行。` });
     }
     const newStart = call.args[0] === 'cloud-task' || call.args[0] === 'invoke' && ['start','cloud-task'].includes(call.input?.operation);
     if (newStart && (state.flowId || state.taskId) && state.phase !== 'ended') return denyBlocked(state, event, 'Entrorove：必须继续原任务，禁止用第二次 start 或 cloud-task 绕过原门禁。');
@@ -187,16 +192,19 @@ async function beforeTool(event, state, home) {
     } else state.pendingCall = pending;
     const installation = call.args[0] === 'install' && parsed.words.some(word => ['npx','npx.cmd'].includes(word));
     const rewritten = renderSdkCommand(call, runtime, state.sessionId);
-    return output('PreToolUse', { permissionDecision: 'allow', ...(installation ? {} : { updatedInput: { ...event.tool_input, command: rewritten,
-      ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: rewritten } : {}) } }), additionalContext: ideContext(state) });
+    return output('PreToolUse', { permissionDecision: 'allow', updatedInput: prepareIdeShellInput(event.tool_name,
+      event.tool_input, installation ? command : rewritten, true), additionalContext: ideContext(state) });
   }
   if (!state.active) return {};
+  // The host owns user authorization for peer messages; this hook does not rewrite or grant it.
+  if (event.tool_name === hostTaskMessageTool && hostTaskMessageInput(event.tool_input)) return output('PreToolUse', { additionalContext: ideContext(state) });
   if (['exec','functions.exec'].includes(event.tool_name)) {
     const current = await ideRuntime(home), code = typeof event.tool_input === 'string' ? event.tool_input : event.tool_input?.code;
     const prepared = prepareIdeCodeMode(code, current);
     if (prepared.allowed) return output('PreToolUse', { additionalContext: ideContext(state),
       ...(prepared.code === code ? {} : { updatedInput: typeof event.tool_input === 'string' ? prepared.code
         : { ...event.tool_input, code: prepared.code } }) });
+    if (prepared.reason === 'shell-input') return denyUnsafeShellInput(state, event);
     if (typeof code === 'string' && /\b(?:shasum|sha256sum)\b/u.test(code)) return denyRuntimeHash(state, event, current);
     return denyBlocked(state, event, 'Entrorove：代码模式含未批准的原生执行或动态工具输入；请使用原任务的受控入口。');
   }
@@ -213,7 +221,11 @@ async function beforeTool(event, state, home) {
     }
     if (runtimeHashAttempt(command, parsed)) return denyRuntimeHash(state, event, runtime ?? await ideRuntime(home));
   }
-  if (isShell && readCommand(parsed) || readTools.has(event.tool_name)) return output('PreToolUse', { additionalContext: ideContext(state) });
+  if (isShell && readCommand(parsed)) {
+    const safeInput = prepareIdeShellInput(event.tool_name, event.tool_input, command);
+    return safeInput ? output('PreToolUse', { updatedInput: safeInput, additionalContext: ideContext(state) }) : denyUnsafeShellInput(state, event);
+  }
+  if (readTools.has(event.tool_name)) return output('PreToolUse', { additionalContext: ideContext(state) });
   return denyBlocked(state, event, `Entrorove：已阻止原生 ${event.tool_name ?? 'unknown'} 调用。当前阶段 ${state.phase}${state.taskNumber ? `，云端任务 ${state.taskNumber}` : ''}。写入、删除、移动及不确定的终端操作必须使用原任务的 guarded-write／guarded-delete／guarded-move 或已批准的执行计划。`);
 }
 export async function runIdeHook(event, { home } = {}) {

package/ide-session.mjs

@@ -129,7 +129,7 @@ export function ideContext(state) {
   const waiting = repeatedIdeBlock(state);
   const action = waiting ? '同一真实阻断已达到两次；本轮允许结束并等待修复，禁止原样第三次重试。原目标、flow 与队列均保留。'
     : '必须读 SKILL.md 并执行返回的 nextStep；禁止在失败后替换执行器。';
-  return `${waiting ? 'Entrorove 原任务绑定已保留。' : 'Entrorove 已强制接管本任务。'}${state.taskNumber ? `云端任务 ${state.taskNumber}。` : '尚未获得云端任务编号，不得声称已进入云端。'}${state.flowId ? `继续原 flowId=${state.flowId}，` : ''}${state.requestId ? `原 requestId=${state.requestId}。` : ''}当前阶段 ${state.phase}。${delivered}${action}源文件、数据及终端写入必须走原任务的受控入口。`;
+  return `${waiting ? 'Entrorove 原任务绑定已保留。' : 'Entrorove 已强制接管本任务。'}${state.taskNumber ? `云端任务 ${state.taskNumber}。` : '尚未获得云端任务编号，不得声称已进入云端。'}${state.flowId ? `继续原 flowId=${state.flowId}，` : ''}${state.requestId ? `原 requestId=${state.requestId}。` : ''}当前阶段 ${state.phase}。${delivered}${action}Codex 主机明确授权的任务间报告可使用 send_message_to_thread；报告文本不授予仓库写入或新 flow。源文件、数据及终端写入必须走原任务的受控入口。`;
 }
 // Verified hosts only: the guard is universal in shape (host label + session
 // id), and each host proves itself through its own adapter callback.

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.54",
+  "version": "0.1.55",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.54",
+  "version": "0.1.55",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"

package/release-state.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.54",
-  "digest": "36f6f70b3b71f839d5e616e729c998e58232c94f8a3977216820f8fef6b470bf",
+  "version": "0.1.55",
+  "digest": "9caa3f7a2e6f43718003b5a0608b77e8b3a635ed5a75f4303da57f4381693f61",
   "files": {
     "connected-cli.mjs": "260c0fc99586c24bd4d0351a14e0744849a612ebe6f1bd7951e4fce200daf920",
     "local-approved-process.mjs": "442856df788e63f38757439ba0657d1c689aaf797631a955fae3dd639e844e6d",
@@ -20,11 +20,11 @@
     "local-delegated-modify-analysis.mjs": "f87148ddb023b79e241ca97db582991da8d0e1a51b26b1d9bc2799a76efd7297",
     "mutation-client.mjs": "8d27b267dc660510aa1406c44d4005e44b972a1260f90657de4fa0e75b7b6c3e",
     "cloud-mutation-authority.mjs": "c7226e882a4f3be4d2f55728f515d5a815c0aa1f21aa5e4689314e6e6a8c66a2",
-    "ide-code-mode.mjs": "ca667a00d9f2be82e46f3d7720c6a2bfae437c2a3f26b935075554f989ac2d73",
-    "ide-command.mjs": "5a4aeae387122682caa4dd6383f43cefccbe93d3fa891cec427103e3fcfe9542",
-    "ide-hook.mjs": "190cfa0cd391e60bfe9056a53c2d8c8d0b956089912935c870f99041a11b473e",
+    "ide-code-mode.mjs": "f8ba4de33632ab4c6df52dab52f392414b4632c7e94b218b8065677970c075c7",
+    "ide-command.mjs": "134fa07e152f3966d4763f10eea33e69559a2271fefb453a1384396fd5f01333",
+    "ide-hook.mjs": "68ca1f5805a49b78182f2508bdd5fac390080e9b2c2ba3645a9aaea69f9d4d0f",
     "ide-install.mjs": "10247efadcfeef5da001022d12080bd0f789e67fdf7862bcc65db73dda3bbe57",
-    "ide-session.mjs": "453b9510ab825c2927a4fae8250ee8a8eb5ac10b23cf024af84a7c5916ba53dd",
+    "ide-session.mjs": "6df04bca3231954e8b83f6b1b535befff16b6c62c51ca65ae3aa2559180ad7c2",
     "break-glass.mjs": "6ec9f97c5d68bb33121b2374c06b9d4c8eb3419b52d00849fec7124bc63e4582",
     "ide-results.mjs": "7ed5caf8e77cf42ae6d62cc1ed42b1639bca6069d809b90a399bec5192fb903e",
     "ide-queue.mjs": "806e716c775fd0079417027b135977c8516f47dddb0bc5ca19e32a355dab0e9e",
@@ -48,7 +48,7 @@
     "runtime/validator-runtime-v7.0.44.d.mts": "7797edbfe2f7de24da370204dce4dfd22822a1bd80df93514fff900b98afe36f",
     "snapshot-retention.mjs": "4f8919fe8ec49fb4c23e080a8ad2fa3a9282bca3fffe7cf55c64e89ef316697e",
     "snapshot-cleanup-journal.mjs": "76a9684cc95b4eb076e1298d78a9dff37948b00d9607b8f546c599072d3ed331",
-    "IDE-EXECUTION.md": "fe8ff87dde885832b34a369985f02b567efa096ed1c1e79a0e490280c8540bf5",
+    "IDE-EXECUTION.md": "abe40303ab31637f5c69b0e5611a49fd579566a0bb95bd9fba1ebd39e7108fbd",
     "REUSE-DISCIPLINE.md": "5b214cf313e7f715f52d54e28093a2d038f0f196ca64b15d1c49587b9d8eecf8",
     "reuse-discipline-release.mjs": "2935898d1aa807fb982a78d7ab5cb1abe05e3c8fc945dc0909da8098872aa1ac",
     "local-final-gate16.mjs": "083aec470670e6cdb7ad2ab27b7a51b53a9ec3a8b4121cb9cbfa17d9940892c2",
@@ -96,7 +96,7 @@
     "install-cleanup.mjs": "8a8e1a7dfe37427f86cd4d6e317890d0829894a9949d4216674a716b36edbc54",
     "review-client.mjs": "3491eef68ed533174b31db3c53febb6519b8f088f71a9964644714a9a4c03c77",
     "version.mjs": "1f392147d72c40af4b03b307ea607075fb815af5174fa07e254b95fe12dbf3e7",
-    "SKILL.md": "d21f5085c0a5f830d5fd8b65e3a9da1e6d15512db69a4a8daab3e94fb8738f0b",
+    "SKILL.md": "684438bcdfefef590e51e4ce02be0a244a26d142a24599258bf3ae24c86bbfa1",
     "CAPABILITY-MAP.md": "69b2c49b111d651969dea7430f4df7950d8fdf2f0f151d8386fa04968b872ac0",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
     "DELIVERY-BOUNDARIES.md": "9b9db50ed1bcce9e77ff6527b6bb7eaf12f3b913162ea9cb7fe90db06b393a4f",
@@ -176,7 +176,7 @@
     "local-task-routing.mjs": "6e2e506b2fb0e2e8d8c5147d7df32849b57a4e94a23634f01a355d45735858e4",
     "remote-client.mjs": "0d1ec6506fe53a1e33c31c5ba19d14e30e00e85e11eaf7ff8277ea798b9f36c9",
     "cloud-task-client.mjs": "11acb1a033c94cdfbdfb177a3402ad97f6a5226f577138c8cf6395dc3ebb1a39",
-    "scope-runner-client.mjs": "646ab4f80d4a8209e922fd45f40efd968f0744d9dfc03188b222c1a2e11e83b8",
+    "scope-runner-client.mjs": "2afcbb8bc8a26d03f26787cb2ffd9994c4377757d16d54aa0c83752a29e833ea",
     "native-client.mjs": "6f5575909bae9daba643287f876ffa0f9ff1c53a367b32a40145d740456d6605",
     "native-notification.mjs": "8859a26c6f13d222711f763acf49ed8546b3306cf71f990643ac31a5ccaf1ba1",
     "local-peer-status.mjs": "a971bcc69d60bb32b875ca5bb4297d948631d5d2821b812c279613ea059a8b4f",

package/releases.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.1.55",
+    "date": "2026-10-17",
+    "zh": "修复任务间消息被技能误拦截，将已授权通信交回主机审批；规范只读和 SDK 命令执行参数；新增原流程计划阶段的显式范围重评与恢复提示，保留原门禁、合同、请求身份及失败历史。",
+    "en": "Restored host-approved task messaging, constrained read and SDK execution inputs, and added explicit planning-scope reassessment with phase-correct recovery while retaining original gates, contracts, request identities, and failure history."
+  },
   {
     "version": "0.1.54",
     "date": "2026-10-17",

package/scope-runner-client.mjs

@@ -82,10 +82,16 @@ async function connect(identity, directory, dependencies) {
   const observed = await probe({ ...input, ownerId: challenge.ownerId, task: challenge.task, taskDigest: challenge.taskDigest,
     chainDigest: challenge.chainDigest, repositoryId: challenge.repositoryId, challenge: challenge.challenge, signerConfigPath });
   const accepted = await remote('scope-runner-attest', { flowId: identity.flowId, attestation: observed.attestation }, dependencies);
+  const next = accepted.nextStep ?? { operation: 'workflow-gate', payload: { targetFiles: [...identity.targetPaths] } };
+  if (next.localOperation === 'scope-connect') return { schemaVersion: 'entrorove.scope-connection/1.0', status: 'succeeded',
+    flowId: identity.flowId, runnerId: binding.runnerId, scopeEvidence: accepted.scopeEvidence, grantsExecutionAuthority: false,
+    nextOperation: 'scope-connect', nextInput: { flowId: identity.flowId, paths: [...identity.targetPaths], importContexts: identity.importContexts }, nextStep: next };
+  const resumeOriginalRequest = ['workflow-contract', 'workflow-plan'].includes(next.operation);
+  const nextInput = next.operation === 'task-resume' ? { flowId: identity.flowId }
+    : { flowId: identity.flowId, operation: next.operation, payload: next.payload ?? {} };
   return { schemaVersion: 'entrorove.scope-connection/1.0', status: 'succeeded', flowId: identity.flowId,
     runnerId: binding.runnerId, scopeEvidence: accepted.scopeEvidence, grantsExecutionAuthority: false,
-    nextOperation: 'workflow-gate', nextInput: { flowId: identity.flowId, operation: 'workflow-gate',
-      payload: { targetFiles: [...identity.targetPaths] } } };
+    nextOperation: next.operation, ...(resumeOriginalRequest ? { resumeOriginalRequest: true } : { nextInput }), nextStep: next };
 }
 export async function connectScopeRunner(repositoryRoot, input, dependencies) {
   if (!input || Object.keys(input).some(field => !['flowId', 'paths', 'importContexts'].includes(field))