@entrorove/skill 0.1.54 → 0.1.56

package/CAPABILITY-MAP.md

@@ -6,7 +6,7 @@
 | --- | --- | --- |
 | 成员受限编辑 | `mutation-connect <repositoryRoot>`、`local mutation-delegate-prepare` | 原任务、冻结修改声明及租约绑定；观察、编辑、独立验证三把密钥分离。运行时依赖保持未知且只读，只允许现存文件的受限修改；不授予通用执行、合并或交付权限 |
 | 连续编辑结算 | `mutation-settle <repositoryRoot>`、`local mutation-consumption-attest`、服务端 `mutation-pass-settle` | 实际写后 M 回执与 fresh S 后验共同确认原 pass；下一轮使用 `previousPassId`，不伪造架构验证事件 |
-| 沙箱关闭后的本地测试 | `workflow-observe-step <repositoryRoot>`、`member-observation-admit/report/status` | 仅运行原冻结命令，对照已结算源文件和保护依赖；结果独立保存为 local / pending-independent，不升格为 V 验证或交付 |
+| 沙箱关闭后的本地测试 | `workflow-observe-step <repositoryRoot>`、`member-observation-admit/report/status` | 仅运行原冻结命令；写入步骤对照已结算源文件，只读步骤对照原 W 计划的签名源文件且无需 M 结算。结果独立保存为 local / pending-independent，不升格为 V 验证或交付 |
 | 续跑入口 | 原 `execution-claim`、原 flow 恢复 | 成员受限范围返回原字段的 `localAction`，客户端串联真实快照、签名、云端通行证及本地安装；网络结果不明时恢复原请求 |
 | 同一阻断停止 | IDE `Stop` 回调 | 真实重复阻断可等待；状态查询及检查点不能重置阻断，宿主重复 Stop 不再生成无限续跑。原 flow、需求队列与恢复数据保留 |
 

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.56 — 2026-10-17
+
+- 补齐原工作流显式只读步骤及无写入结算的本地观察，复核真实受检仓库字节与权限；修复流程列表空输入兼容，返回精确规划前置条件与范围错误，并配置 GitHub OIDC 发布。
+- Added explicit read-only workflow steps and local observations without fabricated mutation settlements, checking actual repository bytes and modes; fixed empty-input flow listing, precise planning prerequisite and scope errors, and GitHub OIDC publishing metadata.
+
+## 0.1.55 — 2026-10-17
+
+- 修复任务间消息被技能误拦截，将已授权通信交回主机审批；规范只读和 SDK 命令执行参数；新增原流程计划阶段的显式范围重评与恢复提示，保留原门禁、合同、请求身份及失败历史。
+- Restored host-approved task messaging, constrained read and SDK execution inputs, and added explicit planning-scope reassessment with phase-correct recovery while retaining original gates, contracts, request identities, and failure history.
+
 ## 0.1.54 — 2026-10-17
 
 - 修复受管 Node 只读 SHA-256 命令在 Codex 工具门禁中的静态识别与安全改写；按已证明的 createRequire 原目录解析实际安装依赖并记录只读元数据，保留未知上下文和越界拒绝。

package/IDE-EXECUTION.md

@@ -6,6 +6,12 @@ If the IDE guard itself is the blocked step, run `entrorove unlock` directly fro
 
 Capability discovery and offline unlock remain administrative calls during `entry`, before a flow exists. The guard recognizes its own rendered commands with quoted identity assignments, their order changed, or a literal `env` prefix containing only supported host/session identities; it rewrites approved calls to the installed runtime and current session. This does not authorize native scripts or unbound project writes.
 
+`flows` is a read-only account query with no stdin. For host compatibility, the guard accepts a literal empty `{}` here-doc on `flows` and removes it from the bound command; any nonempty input remains rejected.
+
+Approved Codex `exec_command` reads and SDK calls run with `/bin/sh` and `login:false`; static code mode uses the same execution input check. Its noninteractive workdir and output controls pass through. Other hosts keep their adapter's command schema, including timeout where supported, with custom executors and permission expansion rejected.
+
+For a Codex task-to-task report explicitly authorized by the human user, the guard passes the exact `mcp__codex_app__send_message_to_thread` tool through unchanged, including a static `tools.mcp__codex_app__send_message_to_thread({...})` call inside `functions.exec`. Codex still decides whether the user authorized the message. Its text and response grant no Entrorove flow, file, shell or task-creation authority.
+
 To stop using Entrorove on this computer, run `entrorove uninstall` directly. It works offline, removes only the recorded Entrorove host hooks and pristine global skill, and leaves other host settings, credentials and task records in place. A hand-edited file is reported as preserved rather than deleted. This command does not inspect or change another project.
 
 Every invocation rereads that same credential file, including clients already running. After an authenticated account page supplies the current key and `configure` synchronizes it once, all tasks under the same OS user automatically use the new value. A revoked or expired key cannot obtain new permissions for itself: return to the authenticated account page and synchronize once through JSON stdin. Status recovery only queries the original request; it never rotates credentials or repeats the operation.
@@ -86,7 +92,7 @@ After the pass's actual writes finish, rerun the original `scope-connect` with i
 
 If settlement reports `ENTROROVE_SCOPE_AFTER_WRITE_REQUIRED`, refresh only the original scope and retry the same consumption request and receipt. A lost network response is different: rerunning the identical connector restores its original GET result without a replacement POST or signature.
 
-With cloud sandbox disabled, the returned `observationAction` runs `npx @entrorove/skill workflow-observe-step <original repositoryRoot>` with `{taskId,flowId,stepId,leaseId,generation,settlementId}`. The service admits only the original frozen command, executable hash, environment and limits, with source hashes updated solely by accepted settlements. The local runner checks the actual source and protected dependencies before and after execution. No validator private key is needed. A real successful process remains `status: incomplete`, `runner: local`, `receipt: null`, `independentValidation: pending`; its result is stored separately and read with `member-observation-status`. It cannot advance formal verified dependencies or task delivery. Reentry preserves a completed process result; an unknown process outcome never authorizes an automatic second launch.
+With cloud sandbox disabled, the returned `observationAction` runs `npx @entrorove/skill workflow-observe-step <original repositoryRoot>`. A mutable step uses `{taskId,flowId,stepId,leaseId,generation,settlementId}` and the service updates source hashes only through accepted M settlements. An explicitly frozen read-only step uses `{taskId,flowId,stepId,leaseId,generation}`; its signed admission declares `sourceKind: original-read-only-plan` and contains no settlement ID or digest. Both paths require the original frozen command, executable hash, environment, limits and current signed source manifest. The local runner checks the actual source and protected dependencies before and after execution, including repository bytes and modes. No validator private key is needed. A real successful process remains `status: incomplete`, `runner: local`, `receipt: null`, `independentValidation: pending`; its result is stored separately and read with `member-observation-status`. It cannot advance formal verified dependencies or task delivery. Reentry preserves a completed process result; an unknown process outcome never authorizes an automatic second launch.
 
 This command runs with the host OS user's permissions, not inside an OS sandbox. Its repository checks do not prove that external files, networks or databases were unchanged: `executionIsolation` remains `host-permissions`, and `externalEffects` remains `unverified`. The independent supervisor enforces the admitted start deadline and command timeout and reclaims its own process group if the CLI disappears. Only the original approved command can be launched; these observations grant no general shell or project-write permission.
 

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute an engineering task through Entrorove, preserving its origi
 
 # entrorove · 熵巡
 
-Version: 0.1.54.
+Version: 0.1.56.
 
 Entrorove applies to the whole task once selected. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 
@@ -19,8 +19,8 @@ Entrorove applies to the whole task once selected. Reading this document or call
    With cloud sandbox disabled, the IDE performs its own planning and continues the original API flow. Do not require a cloud model call or create a sandbox task to perform local work.
    When the model produces a task contract, preserve its `workType`, `risk`, `difficulty`, `crossModule`, `parallel`, `unclear`, `architectureContract`, optional `baselineRef`, and optional `interaction` as returned. Valid work types are `implementation`, `documentation`, `calculation`, `merge`, `review`, `decision`, and `diagnosis`. A `merge` requires a concrete `baselineRef` identifying the branch, tag, commit, or review baseline; keep that baseline unchanged through independent verification. A `decision` requires `interaction`, including a risk description for medium or high risk. Do not fill missing required fields by guessing.
 4. After real cloud acceptance, immediately display **云端任务 <taskNumber> · 已进入**. Preserve `taskNumber` verbatim: it is the homepage sandbox tab number. Keep its UUID `taskId` separately. Run the returned `cloud-watch`, show each real public event and its cursor, and continue the original accepted flow from status. A command log alone is insufficient. No accepted cloud task means no cloud ID or model-execution claim.
-5. For an accepted `flowId`, execute the returned `nextStep` with its required payload. Discover the schema before constructing input. An empty payload is valid only when that operation's schema allows it. Reconnect and refresh only the original flow. A changed snapshot is a binding failure to investigate; do not invent a fresh successful baseline, rebuild a flow to evade it, or erase the old failure. If the terminal flow truly owns a stale task slot, use the explicit `flow-abandon` lifecycle operation described below before routing the original task again.
-6. All governed mutations use the original authority: `local guarded-write`, `local guarded-delete`, `local guarded-move`, or the original frozen approved runner plan. Native patches, scripts, terminal writes, database mutations and unknown MCP operations must not substitute for the controlled entry. **A failed gate or unknown outcome must never be replaced with another executor or reported as local success.** Query the original request read-only, repair the cause, and obtain the original flow's valid authority before proceeding.
+5. For an accepted `flowId`, execute the returned `nextStep` with its required payload. Discover the schema before constructing input. An empty payload is valid only when that operation's schema allows it. Reconnect and refresh only the original flow. A changed snapshot is a binding failure to investigate; do not invent a fresh successful baseline, rebuild a flow to evade it, or erase the old failure. If a fresh scope proof returns `ENTROROVE_SCOPE_PLANNING_REASSESSMENT_REQUIRED` before plan freeze, follow its explicit `workflow-scope-reassess` recovery and retry the original complete request; a local reassessment or snapshot refresh alone does not renew the accepted gate. If the terminal flow truly owns a stale task slot, use the explicit `flow-abandon` lifecycle operation described below before routing the original task again.
+6. All governed mutations use the original authority: `local guarded-write`, `local guarded-delete`, `local guarded-move`, or the original frozen approved runner plan. Native patches, scripts, terminal writes, database mutations and unknown MCP operations must not substitute for the controlled entry. User-authorized task messages use the host's message tool and remain subject to host approval; sending a report does not change the flow or grant execution authority. **A failed gate or unknown outcome must never be replaced with another executor or reported as local success.** Query the original request read-only, repair the cause, and obtain the original flow's valid authority before proceeding.
    For a restricted member scope, follow a returned `localAction` before submitting execution evidence. `mutation-connect` obtains only the original task's limited editing pass; it keeps unresolved loader files and project configuration read only. After actual writes, refresh the original scope and run `mutation-settle`. Use the returned `previousPassId` for further edits. With sandbox disabled, `workflow-observe-step` runs the original approved command and preserves its real local result without a validator private key; independent verification remains pending. See [IDE-EXECUTION.md](IDE-EXECUTION.md#restricted-member-editing).
 7. Read [REUSE-DISCIPLINE.md](REUSE-DISCIPLINE.md) when modifying an existing system. The comparison baseline is the existing implementation in that same repository. It never means another project, another account, or copying external systems.
 8. Read [DELIVERY-BOUNDARIES.md](DELIVERY-BOUNDARIES.md) before claiming a delivered stage or showing consumption. A delivered stage requires a clean boundary and uses `delivered-stage-N`. Blocked or unknown work can wait with recovery data intact; it is not a delivered stage. Display consumption only with a measured baseline.

package/ide-code-mode.mjs

@@ -1,12 +1,21 @@
 import { createRequire } from 'node:module';
-import { literalCommand, sdkCommand, readCommand, runtimeHashRead } from './ide-command.mjs';
+import { literalCommand, sdkCommand, readCommand, runtimeHashRead, prepareIdeShellInput } from './ide-command.mjs';
+
+export const hostTaskMessageTool = 'mcp__codex_app__send_message_to_thread';
+export function hostTaskMessageInput(value) {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    && typeof value.threadId === 'string' && value.threadId.trim().length > 0
+    && typeof value.prompt === 'string' && value.prompt.trim().length > 0
+    && Object.entries(value).every(([key, item]) =>
+      ['threadId', 'prompt', 'hostId', 'model', 'thinking'].includes(key) && typeof item === 'string');
+}
 
 export function prepareIdeCodeMode(code, runtime) {
   if (typeof code !== 'string' || code.length > 1_000_000) return { allowed: false };
   const ts = createRequire(runtime.cli)('typescript');
   const source = ts.createSourceFile('host-call.js', code, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
   if (source.parseDiagnostics.length) return { allowed: false };
-  let allowed = true; const replacements = [];
+  let allowed = true, unsafeShellInput = false; const replacements = [];
   const literal = node => {
     if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;
     if (ts.isNumericLiteral(node)) return Number(node.text);
@@ -21,7 +30,8 @@ export function prepareIdeCodeMode(code, runtime) {
     throw new Error('Dynamic tool arguments');
   };
   const visit = node => {
-    if (ts.isImportDeclaration(node) || ts.isNewExpression(node) || ts.isElementAccessExpression(node) || ts.isFunctionExpression(node)) allowed = false;
+    if (ts.isImportDeclaration(node) || ts.isNewExpression(node) || ts.isElementAccessExpression(node)
+      || ts.isFunctionExpression(node) || ts.isTaggedTemplateExpression(node)) allowed = false;
     if (ts.isCallExpression(node)) {
       const name = node.expression.getText(source);
       if (name === 'tools.exec_command') {
@@ -42,6 +52,16 @@ export function prepareIdeCodeMode(code, runtime) {
               replacements.push({ start: argument.getStart(source), end: argument.getEnd(), text: JSON.stringify(fixed) });
             }
           } else if (!(readCommand(command) || sdkCommand(command, runtime))) allowed = false;
+          else {
+            const fixed = node.arguments.length === 1 && !node.questionDotToken
+              && prepareIdeShellInput('exec_command', args, args.cmd);
+            if (!fixed) { allowed = false; unsafeShellInput = true; }
+            else replacements.push({ start: argument.getStart(source), end: argument.getEnd(), text: JSON.stringify(fixed) });
+          }
+        } catch { allowed = false; }
+      } else if (name === `tools.${hostTaskMessageTool}`) {
+        try {
+          if (node.questionDotToken || node.arguments.length !== 1 || !hostTaskMessageInput(literal(node.arguments[0]))) allowed = false;
         } catch { allowed = false; }
       } else if (name === 'tools.update_goal' || name === 'tools.get_goal') {
         try {
@@ -55,7 +75,7 @@ export function prepareIdeCodeMode(code, runtime) {
     ts.forEachChild(node, visit);
   };
   visit(source);
-  if (!allowed) return { allowed: false };
+  if (!allowed) return { allowed: false, ...(unsafeShellInput ? { reason: 'shell-input' } : {}) };
   let prepared = code;
   for (const item of replacements.sort((a, b) => b.start - a.start)) {
     prepared = `${prepared.slice(0, item.start)}${item.text}${prepared.slice(item.end)}`;

package/ide-command.mjs

@@ -79,7 +79,9 @@ export function sdkCommand(parsed, runtime) {
   if (['unlock', 'uninstall'].includes(args[0]) && args.length === 1 && !parsed.input) return { args };
   if (simple.has(args[0]) && args.length === 1 && parsed.input) return { args, input: parsed.input };
   if (['status', 'feedback'].includes(args[0]) && /^[a-f0-9]{64}$/u.test(args[1] ?? '') && [2,3].includes(args.length)) return { args };
-  if (['flows', 'install', 'billing'].includes(args[0]) && args.length === 1 && !parsed.input) return { args };
+  if (args[0] === 'flows' && args.length === 1 && (!parsed.input || typeof parsed.input === 'object'
+    && !Array.isArray(parsed.input) && Object.keys(parsed.input).length === 0)) return { args };
+  if (['install', 'billing'].includes(args[0]) && args.length === 1 && !parsed.input) return { args };
   if (args[0] === 'install' && args.length === 3 && args[1] === '--host' && args[2] === 'codex' && !parsed.input) return { args };
   if (args[0] === 'recurring' && ['list', 'claim'].includes(args[1] ?? '') && args.length === 2 && !parsed.input) return { args };
   if (args[0] === 'recurring' && ['finish', 'runs'].includes(args[1] ?? '') && args.length === 3 && (!parsed.input || args[1] === 'finish')) return { args, ...(parsed.input ? { input: parsed.input } : {}) };
@@ -113,6 +115,33 @@ export function readCommand(parsed) {
   return false;
 }
 
+const safeShellKeys = {
+  exec_command: new Set(['cmd', 'command', 'workdir', 'max_output_tokens', 'yield_time_ms', 'tty', 'shell', 'login']),
+  Bash: new Set(['command', 'cmd', 'workdir', 'timeout', 'description', 'max_output_chars', 'max_output_tokens', 'yield_time_ms', 'tty']),
+  shell_command: new Set(['command', 'cmd', 'workdir', 'timeout', 'description', 'max_output_chars', 'max_output_tokens', 'yield_time_ms', 'tty']),
+};
+
+export function prepareIdeShellInput(toolName, input, normalizedCommand, mirrorCommand = false) {
+  const keys = safeShellKeys[toolName];
+  if (!keys || !input || typeof input !== 'object' || Array.isArray(input)
+    || typeof normalizedCommand !== 'string' || !Reflect.ownKeys(input).every(key => keys.has(key))) return null;
+  const primary = toolName === 'exec_command' ? 'cmd' : 'command';
+  if (typeof input[primary] !== 'string' || input.cmd !== undefined && input.command !== undefined
+    && input.cmd !== input.command || input.tty !== undefined && input.tty !== false
+    || input.workdir !== undefined && typeof input.workdir !== 'string'
+    || input.description !== undefined && typeof input.description !== 'string'
+    || input.timeout !== undefined && (!Number.isSafeInteger(input.timeout) || input.timeout <= 0)
+    || ['max_output_chars', 'max_output_tokens'].some(key => input[key] !== undefined
+      && (!Number.isSafeInteger(input[key]) || input[key] <= 0))
+    || input.yield_time_ms !== undefined && (!Number.isSafeInteger(input.yield_time_ms) || input.yield_time_ms < 0)
+    || input.shell !== undefined && input.shell !== '/bin/sh'
+    || input.login !== undefined && input.login !== false) return null;
+  const { cmd: _cmd, command: _command, ...options } = input;
+  return { ...options, [primary]: normalizedCommand,
+    ...(toolName === 'exec_command' && mirrorCommand ? { command: normalizedCommand } : {}),
+    ...(toolName === 'exec_command' ? { shell: '/bin/sh', login: false } : {}) };
+}
+
 const runtimeHashTool = process.platform === 'darwin'
   ? { name: 'shasum', executable: '/usr/bin/shasum', flags: ['-a', '256'] }
   : process.platform === 'linux'

package/ide-hook.mjs

@@ -5,8 +5,8 @@ import { ideSession, ideRuntime, bindIdeAccount, ideContext, ideDigest, readBrea
   ideBlockIdentity, repeatedIdeBlock, observeIdeToolOutcome } from './ide-session.mjs';
 import { isStageTerminal, stageOf } from './local-stage-boundary.mjs';
 import { literalCommand, sdkCommand, readCommand, renderSdkCommand, installerCommand,
-  runtimeHashCommand, runtimeHashRead } from './ide-command.mjs';
-import { prepareIdeCodeMode } from './ide-code-mode.mjs';
+  runtimeHashCommand, runtimeHashRead, prepareIdeShellInput } from './ide-command.mjs';
+import { hostTaskMessageInput, hostTaskMessageTool, prepareIdeCodeMode } from './ide-code-mode.mjs';
 import { pathToFileURL } from 'node:url';
 import path from 'node:path';
 import { parseIdeResults, consumeIdeResults } from './ide-results.mjs';
@@ -42,7 +42,7 @@ function blockedReason(state, event, reason, detail = {}) {
   state.blockStreak = repeated ? (state.blockStreak ?? 0) + 1 : 1;
   state.lastBlockKey = key;
   state.lastBlockIdentity = ideBlockIdentity(state);
-  const mechanism = detail.mechanism ?? `机制：${state.stateFile ?? '会话状态文件'} 当前 phase=${state.phase}${state.pendingCall ? `，pendingCall=${state.pendingCall.toolUseId}` : ''}；该阶段只放行 Entrorove 管理调用，业务与写操作需先建立原 flow 并取得 nextStep。`;
+  const mechanism = detail.mechanism ?? `机制：${state.stateFile ?? '会话状态文件'} 当前 phase=${state.phase}${state.pendingCall ? `，pendingCall=${state.pendingCall.toolUseId}` : ''}；该阶段只放行 Entrorove 管理调用及主机明确授权的任务间报告，业务与写操作需先建立原 flow 并取得 nextStep。`;
   const repeat = repeated && state.blockStreak >= 2 ? `同一阻断已出现 ${state.blockStreak} 次，禁止再次检查：说明机制、给出绕过方案并执行绕过。` : '';
   const recovery = detail.recovery ?? `绕过方案（离线、无网络、无协议、不经 hook，终端直接运行）：\n${unlockCommand}\n执行后重试原管理调用；项目写入仍需原任务授权。`;
   return `${reason} ${mechanism} ${repeat}\n${recovery}`;
@@ -68,6 +68,12 @@ function denyRuntimeHash(state, event, runtime) {
     recovery: `恢复：用固定只读命令重新取得该 Node 文件的哈希：\n${safe ?? '当前平台没有受支持的固定哈希命令；请使用受管安装所绑定的 Node 路径。'}${safe ? `\n代码模式请传静态 tools.exec_command({cmd:${JSON.stringify(safe)},shell:'/bin/sh',login:false})。` : ''}\n本次在 hook 本地预检中拒绝，未发起协议请求，因此没有 requestId。`,
   });
 }
+function denyUnsafeShellInput(state, event) {
+  return denyBlocked(state, event, 'ENTROROVE_IDE_EXEC_INPUT_DENIED：只读或 SDK 命令含不安全的执行参数。', {
+    mechanism: '机制：仅接受静态命令及只读的 workdir、输出上限和超时参数；自定义 shell、登录模式、环境变量、交互终端或权限扩张均不属于受管调用。',
+    recovery: '恢复：移除执行器和权限扩张参数。exec_command 将固定为 /bin/sh 且 login=false；本次在 hook 本地预检中拒绝，未发起协议请求。',
+  });
+}
 function lifecycleResult(value, depth = 0) {
   if (!value || typeof value !== 'object' || depth > 4) return null;
   if (value.operation === 'flow-cancel' || value.operation === 'flow-abandon') return value;
@@ -130,12 +136,11 @@ async function beforeTool(event, state, home) {
   const isShell = ['Bash', 'exec_command', 'shell_command'].includes(event.tool_name);
   const installer = isShell && installerCommand(parsed);
   if (installer) {
-    if (state.active) {
-      state.readCalls ??= {};
-      state.readCalls[event.tool_use_id] = { toolUseId: event.tool_use_id, command: 'install' };
-    }
-    return output('PreToolUse', { permissionDecision: 'allow', updatedInput: { ...event.tool_input, command: installer,
-      ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: installer } : {}) } });
+    const safeInput = prepareIdeShellInput(event.tool_name, event.tool_input, installer, true);
+    if (!safeInput) return denyUnsafeShellInput(state, event);
+    if (state.active) { state.readCalls ??= {};
+      state.readCalls[event.tool_use_id] = { toolUseId: event.tool_use_id, command: 'install' }; }
+    return output('PreToolUse', { permissionDecision: 'allow', updatedInput: safeInput });
   }
   const namedSdk = parsed?.words.some(word => word === 'entrorove' || /^@entrorove\/skill(?:@[^ ]+)?$/u.test(word)
     || /(?:@entrorove\/skill|entrorove-skill)\/cli\.mjs$/u.test(word));
@@ -143,20 +148,20 @@ async function beforeTool(event, state, home) {
   const runtime = isShell && parsed ? await ideRuntime(home) : null;
   const call = runtime && sdkCommand(parsed, runtime);
   if (call) {
+    if (!prepareIdeShellInput(event.tool_name, event.tool_input, command, true)) return denyUnsafeShellInput(state, event);
     if (call.args[0] === 'uninstall') {
       state.active = false; state.phase = 'user-exited';
-      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: { ...event.tool_input,
-        command: renderSdkCommand(call, runtime, state.sessionId),
-        ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: renderSdkCommand(call, runtime, state.sessionId) } : {}) } });
+      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: prepareIdeShellInput(event.tool_name,
+        event.tool_input, renderSdkCommand(call, runtime, state.sessionId), true) });
     }
     state.active = true;
     if (call.args[0] !== 'configure' && call.args[0] !== 'unlock') await bindIdeAccount(state, home);
-    if (state.phase === 'setup' && !unlocked && !isManagementCall(call)) return denyBlocked(state, event, 'Entrorove：自举阶段只放行 Entrorove 管理调用（建 flow、改目标、scope-connect、capabilities、status、queue 等）；业务与写操作需先建立原 flow。');
+    if (state.phase === 'setup' && !unlocked && !isManagementCall(call)) return denyBlocked(state, event, 'Entrorove：自举阶段只放行 Entrorove 管理调用及主机明确授权的任务间报告；业务与写操作需先建立原 flow。');
     if (call.args[0] === 'unlock') {
       resetBlockStreak(state);
       const rewritten = renderSdkCommand(call, runtime, state.sessionId);
-      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: { ...event.tool_input, command: rewritten,
-        ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: rewritten } : {}) }, additionalContext: `${ideContext(state)}离线管理解锁已放行。` });
+      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: prepareIdeShellInput(event.tool_name,
+        event.tool_input, rewritten, true), additionalContext: `${ideContext(state)}离线管理解锁已放行。` });
     }
     const newStart = call.args[0] === 'cloud-task' || call.args[0] === 'invoke' && ['start','cloud-task'].includes(call.input?.operation);
     if (newStart && (state.flowId || state.taskId) && state.phase !== 'ended') return denyBlocked(state, event, 'Entrorove：必须继续原任务，禁止用第二次 start 或 cloud-task 绕过原门禁。');
@@ -187,16 +192,19 @@ async function beforeTool(event, state, home) {
     } else state.pendingCall = pending;
     const installation = call.args[0] === 'install' && parsed.words.some(word => ['npx','npx.cmd'].includes(word));
     const rewritten = renderSdkCommand(call, runtime, state.sessionId);
-    return output('PreToolUse', { permissionDecision: 'allow', ...(installation ? {} : { updatedInput: { ...event.tool_input, command: rewritten,
-      ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: rewritten } : {}) } }), additionalContext: ideContext(state) });
+    return output('PreToolUse', { permissionDecision: 'allow', updatedInput: prepareIdeShellInput(event.tool_name,
+      event.tool_input, installation ? command : rewritten, true), additionalContext: ideContext(state) });
   }
   if (!state.active) return {};
+  // The host owns user authorization for peer messages; this hook does not rewrite or grant it.
+  if (event.tool_name === hostTaskMessageTool && hostTaskMessageInput(event.tool_input)) return output('PreToolUse', { additionalContext: ideContext(state) });
   if (['exec','functions.exec'].includes(event.tool_name)) {
     const current = await ideRuntime(home), code = typeof event.tool_input === 'string' ? event.tool_input : event.tool_input?.code;
     const prepared = prepareIdeCodeMode(code, current);
     if (prepared.allowed) return output('PreToolUse', { additionalContext: ideContext(state),
       ...(prepared.code === code ? {} : { updatedInput: typeof event.tool_input === 'string' ? prepared.code
         : { ...event.tool_input, code: prepared.code } }) });
+    if (prepared.reason === 'shell-input') return denyUnsafeShellInput(state, event);
     if (typeof code === 'string' && /\b(?:shasum|sha256sum)\b/u.test(code)) return denyRuntimeHash(state, event, current);
     return denyBlocked(state, event, 'Entrorove：代码模式含未批准的原生执行或动态工具输入；请使用原任务的受控入口。');
   }
@@ -213,7 +221,11 @@ async function beforeTool(event, state, home) {
     }
     if (runtimeHashAttempt(command, parsed)) return denyRuntimeHash(state, event, runtime ?? await ideRuntime(home));
   }
-  if (isShell && readCommand(parsed) || readTools.has(event.tool_name)) return output('PreToolUse', { additionalContext: ideContext(state) });
+  if (isShell && readCommand(parsed)) {
+    const safeInput = prepareIdeShellInput(event.tool_name, event.tool_input, command);
+    return safeInput ? output('PreToolUse', { updatedInput: safeInput, additionalContext: ideContext(state) }) : denyUnsafeShellInput(state, event);
+  }
+  if (readTools.has(event.tool_name)) return output('PreToolUse', { additionalContext: ideContext(state) });
   return denyBlocked(state, event, `Entrorove：已阻止原生 ${event.tool_name ?? 'unknown'} 调用。当前阶段 ${state.phase}${state.taskNumber ? `，云端任务 ${state.taskNumber}` : ''}。写入、删除、移动及不确定的终端操作必须使用原任务的 guarded-write／guarded-delete／guarded-move 或已批准的执行计划。`);
 }
 export async function runIdeHook(event, { home } = {}) {

package/ide-session.mjs

@@ -129,7 +129,7 @@ export function ideContext(state) {
   const waiting = repeatedIdeBlock(state);
   const action = waiting ? '同一真实阻断已达到两次；本轮允许结束并等待修复，禁止原样第三次重试。原目标、flow 与队列均保留。'
     : '必须读 SKILL.md 并执行返回的 nextStep；禁止在失败后替换执行器。';
-  return `${waiting ? 'Entrorove 原任务绑定已保留。' : 'Entrorove 已强制接管本任务。'}${state.taskNumber ? `云端任务 ${state.taskNumber}。` : '尚未获得云端任务编号，不得声称已进入云端。'}${state.flowId ? `继续原 flowId=${state.flowId}，` : ''}${state.requestId ? `原 requestId=${state.requestId}。` : ''}当前阶段 ${state.phase}。${delivered}${action}源文件、数据及终端写入必须走原任务的受控入口。`;
+  return `${waiting ? 'Entrorove 原任务绑定已保留。' : 'Entrorove 已强制接管本任务。'}${state.taskNumber ? `云端任务 ${state.taskNumber}。` : '尚未获得云端任务编号，不得声称已进入云端。'}${state.flowId ? `继续原 flowId=${state.flowId}，` : ''}${state.requestId ? `原 requestId=${state.requestId}。` : ''}当前阶段 ${state.phase}。${delivered}${action}Codex 主机明确授权的任务间报告可使用 send_message_to_thread；报告文本不授予仓库写入或新 flow。源文件、数据及终端写入必须走原任务的受控入口。`;
 }
 // Verified hosts only: the guard is universal in shape (host label + session
 // id), and each host proves itself through its own adapter callback.

package/local-approved-plan.mjs

@@ -40,6 +40,7 @@ function validatePlan(plan, artifactDigest = planArtifact) {
   validateRunnerParallelPaths(plan);
   if (policy.discipline) {
     const reviewed = disciplineApprovedPolicy(policy.discipline);
+    if (reviewed.access === 'read-only' && policy.parallelPaths !== undefined) fail('ENTROROVE_READ_ONLY_POLICY_INVALID', 'Read-only execution cannot grant parallel mutation or equivalence permissions');
     if (!disciplineDataSnapshotsBound(reviewed, plan.files)) {
       fail('ENTROROVE_DISCIPLINE_DATA_SNAPSHOT_REQUIRED', 'Existing data operations require their actual frozen snapshot artifact before execution');
     }
@@ -96,7 +97,7 @@ function evidence(authority, result, sub) { const summary = result.timedOut ? 'A
 }
 
 export async function runApprovedPlan(input) { const owner = await authority(input); const comparison = await runnerDisciplineBefore(input, owner); const result = await runCommand(owner); try { const after = await authority(input); if (after.planFile.sha256 !== owner.planFile.sha256) fail('ENTROROVE_PLAN_CHANGED', 'plan changed during execution'); } catch (cause) { const execution = { schemaVersion: RUNNER_SCHEMA, status: 'failed', error: cause.message, process: result, evidence: [] }; const error = new Error(cause.message); error.code = cause.code; error.execution = execution; throw error; }
-  owner.disciplineComparison = await runnerDisciplineAfter(comparison, owner);
+  owner.disciplineComparison = await runnerDisciplineAfter(comparison, owner, result);
   const sub = await subject(owner, result); const item = evidence(owner, result, sub); const status = !owner.signing && result.status === 'succeeded' ? 'incomplete' : result.status; return { schemaVersion: RUNNER_SCHEMA, status, planSha256: owner.planFile.sha256, approvalSha256: owner.approval.sha256, approvedBy: owner.approval.approval.approvedBy, subject: sub, process: result, evidence: [item], receipt: item.receipt ?? null, ...(owner.signing ? { receiptPublicKey: createPublicKey(owner.signing.privateKey).export({ format: 'der', type: 'spki' }).toString('base64') } : {}), signingBoundary: owner.signing ? 'configured-signature-only' : 'local-evidence-only' };
 }
 
@@ -125,7 +126,7 @@ export async function runApprovedPlanObject(input) {
     const error = new Error(cause.message); error.code = cause.code;
     error.execution = { schemaVersion: RUNNER_SCHEMA, status: 'failed', error: cause.message, process: result, evidence: [], effects: 'unknown' }; throw error;
   }
-  owner.disciplineComparison = await runnerDisciplineAfter(comparison, owner);
+  owner.disciplineComparison = await runnerDisciplineAfter(comparison, owner, result);
   const sub = await subject(owner, result); const item = evidence(owner, result, sub);
   return { schemaVersion: RUNNER_SCHEMA, status: !owner.signing && result.status === 'succeeded' ? 'incomplete' : result.status,
     planSha256: owner.planFile.sha256, approvalSha256: owner.approval.sha256, approvedBy: owner.approval.approval.approvedBy,

package/local-discipline-contracts.mjs

@@ -12,11 +12,15 @@ export const DISCIPLINE_WRITE_SCHEMA = object({ targetPath: relativePath,
 }, ['targetPath', 'kind', 'reason', 'requirementRefs']);
 const approval = object({ interactionId: identifier, interactionDigest: shaSchema, auditId: identifier,
   proposalDigest: shaSchema }, ['interactionId', 'interactionDigest', 'auditId', 'proposalDigest']);
-export const DISCIPLINE_POLICY_SCHEMA = object({ schemaVersion: { const: 'entrorove.discipline-policy/1.0' },
+const mutablePolicy = object({ schemaVersion: { const: 'entrorove.discipline-policy/1.0' },
   requirementIds: refs, writes: array(DISCIPLINE_WRITE_SCHEMA, 1), approval,
   dataOperations: array(object({ operation: { enum: ['delete', 'migrate', 'rebuild'] }, target: text,
     reason: text, requirementRefs: refs, snapshotArtifactDigest: shaSchema }, ['operation', 'target', 'reason', 'requirementRefs', 'snapshotArtifactDigest'])),
 }, ['schemaVersion', 'requirementIds', 'writes']);
+const readOnlyPolicy = object({ schemaVersion: { const: 'entrorove.discipline-policy/1.0' },
+  access: { const: 'read-only' }, requirementIds: refs, writes: { type: 'array', maxItems: 0 },
+}, ['schemaVersion', 'access', 'requirementIds', 'writes']);
+export const DISCIPLINE_POLICY_SCHEMA = { oneOf: [mutablePolicy, readOnlyPolicy] };
 export const DISCIPLINE_DECLARATION_SCHEMA = object({ ...DISCIPLINE_WRITE_SCHEMA.properties,
   usageReviewDigest: shaSchema }, DISCIPLINE_WRITE_SCHEMA.required);
 const validate = new Ajv({ allErrors: true, strict: true }).compile(DISCIPLINE_POLICY_SCHEMA);

package/local-runner-discipline.mjs

@@ -6,9 +6,9 @@ import path from 'node:path';
 export async function runnerDisciplineBefore(input, authority) {
   if (!authority.plan.policy.discipline) return null;
   const original = await disciplineRepositoryObservation(input, authority.root);
-  return { input, original: original.comparison };
+  return { input, original: original.comparison, readOnly: authority.plan.policy.discipline.access === 'read-only' };
 }
-export async function runnerDisciplineAfter(before, authority) {
+export async function runnerDisciplineAfter(before, authority, processResult) {
   if (!before) return null;
   const after = (await disciplineRepositoryObservation(before.input, authority.root)).comparison;
   const changed = disciplineRepositoryDifferences(before.original, after);
@@ -23,5 +23,10 @@ export async function runnerDisciplineAfter(before, authority) {
   catch (error) {
     if (error.code !== 'ENTROROVE_STATE_EXISTS' || canonical(await readMutationJson14(file)) !== canonical(record)) throw error;
   }
+  if (before.readOnly && changed.length) {
+    throw Object.assign(new Error('Explicit read-only execution changed repository bytes or permissions; no successful receipt is issued'),
+      { code: 'ENTROROVE_READ_ONLY_EXECUTION_DRIFT', execution: { schemaVersion: 'entrorove.validator-local-runner/1.0',
+        status: 'failed', process: processResult, evidence: [], effects: 'unknown', comparison: report } });
+  }
   return { ...report, reportDigest };
 }

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.54",
+  "version": "0.1.56",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.54",
+  "version": "0.1.56",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -275,5 +275,10 @@
     "tree-sitter-wasms": "0.1.13",
     "@vue/compiler-sfc": "3.5.43",
     "svelte": "5.57.1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/88208555/entrorove.git",
+    "directory": "packages/entrorove-skill"
   }
 }

package/release-state.json

@@ -1,18 +1,18 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.54",
-  "digest": "36f6f70b3b71f839d5e616e729c998e58232c94f8a3977216820f8fef6b470bf",
+  "version": "0.1.56",
+  "digest": "217c46f009d2c8513e5697b663e07e8fabe3b647728ce7c07bf20c49037c991e",
   "files": {
     "connected-cli.mjs": "260c0fc99586c24bd4d0351a14e0744849a612ebe6f1bd7951e4fce200daf920",
     "local-approved-process.mjs": "442856df788e63f38757439ba0657d1c689aaf797631a955fae3dd639e844e6d",
     "local-approved-supervisor.mjs": "87142a4c13d27c8265cc1fd7fc9088988da9bbb02134164e1a7c5417da926ac7",
     "local-mutation-consumption.mjs": "cd8650b9be894639ceb35af88d23c8002b4acff27afad2e64174eb21a9424cfb",
     "workflow-observation-client.mjs": "5e67bc32a8625de9523498f694655c378ae34af59c4aa2f0e07efcd72347dbc0",
-    "workflow-observation-connection.mjs": "9235e9247b11e1d51628c1784eb1cb1e8e4b79d25ff791883722592dcf8583c0",
+    "workflow-observation-connection.mjs": "daf5f707dd93397e3581dc761131ef380026110b07f58fa9a2c9e738e68fa492",
     "workflow-observation-remote.mjs": "1e5a8b9c2b9b095242ad28a1d5ebce5944efdae74383fb20d6676b93b240c5a7",
     "workflow-observation-runner.mjs": "3eb8280ec7abffcb30398e3f4e5f7d0ec3df4385fa720f188ed83757b87cd977",
     "workflow-observation-state.mjs": "a525046df9b3de75b10d2bf35c2b6d7719f12a647e4aee1f1e85dbdbfb167321",
-    "workflow-observation-wire.mjs": "846d0b48b7799bfca227e30faea025a5a919896538f963ce886cbdb4c75c0253",
+    "workflow-observation-wire.mjs": "9bff48377d240c2fd33ee82de6adcd97376b239d32d2552cfa1ce4f7e5e3562e",
     "local-preserved-mutation-protection.mjs": "95041d4f75253a153c7fd85573ba0457513ffe47a6a6bd00c4f59379b81ce580",
     "local-preserved-mutation-signer.mjs": "2b0771cbdd18ba00267aa441b7892cd04feab9f8543ae5e2703430b1e580747f",
     "local-preserved-mutation-state.mjs": "1ff7939d668e39ec641a7cf46a4ce3014c63f3898207cc874f21170376479671",
@@ -20,11 +20,11 @@
     "local-delegated-modify-analysis.mjs": "f87148ddb023b79e241ca97db582991da8d0e1a51b26b1d9bc2799a76efd7297",
     "mutation-client.mjs": "8d27b267dc660510aa1406c44d4005e44b972a1260f90657de4fa0e75b7b6c3e",
     "cloud-mutation-authority.mjs": "c7226e882a4f3be4d2f55728f515d5a815c0aa1f21aa5e4689314e6e6a8c66a2",
-    "ide-code-mode.mjs": "ca667a00d9f2be82e46f3d7720c6a2bfae437c2a3f26b935075554f989ac2d73",
-    "ide-command.mjs": "5a4aeae387122682caa4dd6383f43cefccbe93d3fa891cec427103e3fcfe9542",
-    "ide-hook.mjs": "190cfa0cd391e60bfe9056a53c2d8c8d0b956089912935c870f99041a11b473e",
+    "ide-code-mode.mjs": "f8ba4de33632ab4c6df52dab52f392414b4632c7e94b218b8065677970c075c7",
+    "ide-command.mjs": "3db45dd1d12db670e594b6ced35f2d7778cb01091695b1e240179b1ea34f25ee",
+    "ide-hook.mjs": "68ca1f5805a49b78182f2508bdd5fac390080e9b2c2ba3645a9aaea69f9d4d0f",
     "ide-install.mjs": "10247efadcfeef5da001022d12080bd0f789e67fdf7862bcc65db73dda3bbe57",
-    "ide-session.mjs": "453b9510ab825c2927a4fae8250ee8a8eb5ac10b23cf024af84a7c5916ba53dd",
+    "ide-session.mjs": "6df04bca3231954e8b83f6b1b535befff16b6c62c51ca65ae3aa2559180ad7c2",
     "break-glass.mjs": "6ec9f97c5d68bb33121b2374c06b9d4c8eb3419b52d00849fec7124bc63e4582",
     "ide-results.mjs": "7ed5caf8e77cf42ae6d62cc1ed42b1639bca6069d809b90a399bec5192fb903e",
     "ide-queue.mjs": "806e716c775fd0079417027b135977c8516f47dddb0bc5ca19e32a355dab0e9e",
@@ -33,14 +33,14 @@
     "local-discipline-batch.mjs": "2cc90dbae55efdee0c445da399c0a9acafa92e915344c25208ebca554fc4c9e9",
     "local-typescript-function-reference.mjs": "af682b479fe0d69a5ecd62232406bb8078408ec8710733cfed9ae6b059762ba5",
     "local-scope-import-expressions.mjs": "20f1e065582c68d2334e0dfaa130a559ff19886a57f9038dc569f65993bb06c8",
-    "local-discipline-contracts.mjs": "6cf8a3d132fdb9074eb1441600afe7aa199df33e88a71a660d9db534c14f19e4",
+    "local-discipline-contracts.mjs": "ab0c11dcc4a6ffd3cb79b53862c19308eaf0d159deee7f9958266852d977363e",
     "local-discipline-contracts.d.mts": "defc684c78dc88afa1c54340ab4a01ae36db7aa11257cbe1f5cd323f608c78c4",
     "local-discipline-gate.mjs": "e3851157bf1d8bc86eb44212a88acd20acfc2d1152e7d87af6dc2a37afffcd6f",
     "local-discipline-native.mjs": "8b99b5ce951cab3c1426428ad807650c61c0ffb2c346d747b73b99057b382049",
     "local-discipline-operations.mjs": "9fcb7b8889b7718d42e1d37936485d8198d5017d405e0cdbbabdbbd12fcc9d48",
     "local-discipline-repository.mjs": "b6392e02ecae333dfdc8df41f203fd69bed035d88b15b16d112ab1897b3c297c",
     "local-discipline-snapshot.mjs": "8fd35b2cfbece8f64579f144f589a66dec9b6022d50fe931c4c1f886cb83134d",
-    "local-runner-discipline.mjs": "86f451de2f1e12a24f5596a29828891c1eba13cd4714ed0c18a77d66cecef934",
+    "local-runner-discipline.mjs": "8d4ada838f81d54963adbb7e433f1ca80ae1934ea126f90c59a49d29742979c4",
     "local-integrity.d.mts": "21357f306234bd841c0d3d90bf2d09f7663f63746f897b9f38190428ae8198b3",
     "local-equivalence-runner.mjs": "df2f406c693c4da7bb30542ec7b4d46a9336f56e9fdd263196c0f3a73d2f6e91",
     "validator-runtime-build.mjs": "da20bd19eb088d79d62e33969b4c075dc2199761b395e40060227f8f86b9519a",
@@ -48,7 +48,7 @@
     "runtime/validator-runtime-v7.0.44.d.mts": "7797edbfe2f7de24da370204dce4dfd22822a1bd80df93514fff900b98afe36f",
     "snapshot-retention.mjs": "4f8919fe8ec49fb4c23e080a8ad2fa3a9282bca3fffe7cf55c64e89ef316697e",
     "snapshot-cleanup-journal.mjs": "76a9684cc95b4eb076e1298d78a9dff37948b00d9607b8f546c599072d3ed331",
-    "IDE-EXECUTION.md": "fe8ff87dde885832b34a369985f02b567efa096ed1c1e79a0e490280c8540bf5",
+    "IDE-EXECUTION.md": "7e312d8069b0f03deba896b26abfa6beab74ba08835aa58c47633f5c8eeb7d35",
     "REUSE-DISCIPLINE.md": "5b214cf313e7f715f52d54e28093a2d038f0f196ca64b15d1c49587b9d8eecf8",
     "reuse-discipline-release.mjs": "2935898d1aa807fb982a78d7ab5cb1abe05e3c8fc945dc0909da8098872aa1ac",
     "local-final-gate16.mjs": "083aec470670e6cdb7ad2ab27b7a51b53a9ec3a8b4121cb9cbfa17d9940892c2",
@@ -96,11 +96,11 @@
     "install-cleanup.mjs": "8a8e1a7dfe37427f86cd4d6e317890d0829894a9949d4216674a716b36edbc54",
     "review-client.mjs": "3491eef68ed533174b31db3c53febb6519b8f088f71a9964644714a9a4c03c77",
     "version.mjs": "1f392147d72c40af4b03b307ea607075fb815af5174fa07e254b95fe12dbf3e7",
-    "SKILL.md": "d21f5085c0a5f830d5fd8b65e3a9da1e6d15512db69a4a8daab3e94fb8738f0b",
-    "CAPABILITY-MAP.md": "69b2c49b111d651969dea7430f4df7950d8fdf2f0f151d8386fa04968b872ac0",
+    "SKILL.md": "684438bcdfefef590e51e4ce02be0a244a26d142a24599258bf3ae24c86bbfa1",
+    "CAPABILITY-MAP.md": "9058ee785768b470f26641032dfdaca638e08473d3508ad36deb63f375b84afe",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
     "DELIVERY-BOUNDARIES.md": "9b9db50ed1bcce9e77ff6527b6bb7eaf12f3b913162ea9cb7fe90db06b393a4f",
-    "package.json": "e910dc5cf0db61b1fcb9feffa21a8f8d3c2a244b7d858e8af72202f5b91d403b",
+    "package.json": "19e30a6adde349d335e9a0b4559799a5af6a1b7df7094344dafd411f6ed7f22f",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
     "release.mjs": "8b0dc36c47aec72cf9952c9ac1ce5fe27da5ae6829f50cd2339fa101b2eda93c",
     "local-cli.mjs": "41e2a737c8587cb5ce469a7661f6d14b5ea4cd073f8286822fc4dc96b67f56a1",
@@ -123,7 +123,7 @@
     "local-chain-plan.mjs": "e45a9170f569c80f7e5532bbc109dbae3c24b696815316e503cb3779135be648",
     "local-chain-release-labels.mjs": "7ce5350d1062d5236f57f10e7e81713c1101463d5e7f252604ef0c2a30840bfe",
     "local-chain-results.mjs": "0455f72cad574cfef87c2c6c0928d6432bba7e5dbaff521a2b62a9575299ca10",
-    "local-approved-plan.mjs": "26731b534f4c276c6235cb73bf6950943061947967a93f477f4bcd64acde72a6",
+    "local-approved-plan.mjs": "c2c88ab4085ff35a1811fe43e9a28699cfc9387eda54bfeafae3e7dd9e8cdb19",
     "local-budget-renewal.mjs": "6b436358066fe33b2f6d871fc90d8e7c551edd6255efd73c0d255d0fd35d5ef8",
     "local-probe.mjs": "9b948db1de1e34c7605c4c454cd4aced66d2b57d2cf4471adbb80bcc76dee635",
     "local-budget-grants.mjs": "c5f6542f5d2c3bfe07f3ca5b5bc849bf05d886b06014f720322d530510775d3d",
@@ -176,7 +176,7 @@
     "local-task-routing.mjs": "6e2e506b2fb0e2e8d8c5147d7df32849b57a4e94a23634f01a355d45735858e4",
     "remote-client.mjs": "0d1ec6506fe53a1e33c31c5ba19d14e30e00e85e11eaf7ff8277ea798b9f36c9",
     "cloud-task-client.mjs": "11acb1a033c94cdfbdfb177a3402ad97f6a5226f577138c8cf6395dc3ebb1a39",
-    "scope-runner-client.mjs": "646ab4f80d4a8209e922fd45f40efd968f0744d9dfc03188b222c1a2e11e83b8",
+    "scope-runner-client.mjs": "2afcbb8bc8a26d03f26787cb2ffd9994c4377757d16d54aa0c83752a29e833ea",
     "native-client.mjs": "6f5575909bae9daba643287f876ffa0f9ff1c53a367b32a40145d740456d6605",
     "native-notification.mjs": "8859a26c6f13d222711f763acf49ed8546b3306cf71f990643ac31a5ccaf1ba1",
     "local-peer-status.mjs": "a971bcc69d60bb32b875ca5bb4297d948631d5d2821b812c279613ea059a8b4f",
@@ -201,7 +201,7 @@
     "local-task-handoff-read-authority.mjs": "7d2991cfac4562039232566d25441aa98106ce27bc9b7bcf6df4ff28d738e167",
     "local-task-handoff-write-archive.mjs": "3668f39d8ab5664ed717994cf1b4bcc7ea23e146a0e06291f851d30337faeb77",
     "local-task-handoff-write-receipts.mjs": "e1321127bd6fcad7840e185639f81ae68a8722a0ee4264a7b504a02b27887647",
-    "workflow-local-runner.mjs": "9fa899a11da2b6b7a436bf9b561641856adcbc5f8b914f6ba89a64dae224900d",
+    "workflow-local-runner.mjs": "c74ccd425fd7d4882388338e27f3b25e85c39c1a6cb7935435393844ec13c001",
     "workflow-local-contracts.mjs": "bc52a461727b34c72daa058e1aa77d58206eafad14a93a347537f9969ae51184",
     "workflow-local-client.mjs": "45c954f694d96bf0ea87ee2dc6902a6763dac2cb1df713b6a5e749632054e9af",
     "workflow-local-request.mjs": "4e24c543ce386292a87dc9cd41f90d23375f12079cacffc515c8cd01fd571780",

package/releases.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.1.56",
+    "date": "2026-10-17",
+    "zh": "补齐原工作流显式只读步骤及无写入结算的本地观察，复核真实受检仓库字节与权限；修复流程列表空输入兼容，返回精确规划前置条件与范围错误，并配置 GitHub OIDC 发布。",
+    "en": "Added explicit read-only workflow steps and local observations without fabricated mutation settlements, checking actual repository bytes and modes; fixed empty-input flow listing, precise planning prerequisite and scope errors, and GitHub OIDC publishing metadata."
+  },
+  {
+    "version": "0.1.55",
+    "date": "2026-10-17",
+    "zh": "修复任务间消息被技能误拦截，将已授权通信交回主机审批；规范只读和 SDK 命令执行参数；新增原流程计划阶段的显式范围重评与恢复提示，保留原门禁、合同、请求身份及失败历史。",
+    "en": "Restored host-approved task messaging, constrained read and SDK execution inputs, and added explicit planning-scope reassessment with phase-correct recovery while retaining original gates, contracts, request identities, and failure history."
+  },
   {
     "version": "0.1.54",
     "date": "2026-10-17",

package/scope-runner-client.mjs

@@ -82,10 +82,16 @@ async function connect(identity, directory, dependencies) {
   const observed = await probe({ ...input, ownerId: challenge.ownerId, task: challenge.task, taskDigest: challenge.taskDigest,
     chainDigest: challenge.chainDigest, repositoryId: challenge.repositoryId, challenge: challenge.challenge, signerConfigPath });
   const accepted = await remote('scope-runner-attest', { flowId: identity.flowId, attestation: observed.attestation }, dependencies);
+  const next = accepted.nextStep ?? { operation: 'workflow-gate', payload: { targetFiles: [...identity.targetPaths] } };
+  if (next.localOperation === 'scope-connect') return { schemaVersion: 'entrorove.scope-connection/1.0', status: 'succeeded',
+    flowId: identity.flowId, runnerId: binding.runnerId, scopeEvidence: accepted.scopeEvidence, grantsExecutionAuthority: false,
+    nextOperation: 'scope-connect', nextInput: { flowId: identity.flowId, paths: [...identity.targetPaths], importContexts: identity.importContexts }, nextStep: next };
+  const resumeOriginalRequest = ['workflow-contract', 'workflow-plan'].includes(next.operation);
+  const nextInput = next.operation === 'task-resume' ? { flowId: identity.flowId }
+    : { flowId: identity.flowId, operation: next.operation, payload: next.payload ?? {} };
   return { schemaVersion: 'entrorove.scope-connection/1.0', status: 'succeeded', flowId: identity.flowId,
     runnerId: binding.runnerId, scopeEvidence: accepted.scopeEvidence, grantsExecutionAuthority: false,
-    nextOperation: 'workflow-gate', nextInput: { flowId: identity.flowId, operation: 'workflow-gate',
-      payload: { targetFiles: [...identity.targetPaths] } } };
+    nextOperation: next.operation, ...(resumeOriginalRequest ? { resumeOriginalRequest: true } : { nextInput }), nextStep: next };
 }
 export async function connectScopeRunner(repositoryRoot, input, dependencies) {
   if (!input || Object.keys(input).some(field => !['flowId', 'paths', 'importContexts'].includes(field))

package/workflow-local-runner.mjs

@@ -286,7 +286,7 @@ async function prepare(input, create = true) {
   const root = await realDirectory(input.repositoryRoot, 'ENTROROVE_ROOT_INVALID');
   const home = await realDirectory(input.home ?? os.homedir(), 'ENTROROVE_HOME_INVALID');
   const directory = await privateHierarchy(home, ['.entrorove', 'workflow-local', sha(root).slice(0, 32), plan.flowId, step.stepId], create);
-  return { root, plan, lease, step, file: path.join(directory, 'state.json') };
+  return { root, home, plan, lease, step, file: path.join(directory, 'state.json') };
 }
 
 export async function observeWorkflowLocalStep(rawInput) {
@@ -323,7 +323,7 @@ export async function runWorkflowLocalStep(rawInput) {
     });
     const signer = await loadSigner(authority.root, input.signerConfigPath, authority.plan.runnerKeyId);
     if (typeof approvedRunner.runApprovedPlanObject !== 'function') fail('ENTROROVE_WORKFLOW_RUNNER_UNAVAILABLE', 'approved object plan runner is unavailable');
-    execution = await approvedRunner.runApprovedPlanObject({ repositoryRoot: authority.root, executionPlan: authority.step.executionPlan,
+    execution = await approvedRunner.runApprovedPlanObject({ repositoryRoot: authority.root, home: authority.home, flowId: authority.plan.flowId, executionPlan: authority.step.executionPlan,
       approvalPath: input.approvalPath, signerConfigPath: input.signerConfigPath, executionDeadlineAt: authority.lease.expiresAt });
     return await finalize(authority, signedResult(authority, execution, signer));
   } catch (error) {

package/workflow-observation-connection.mjs

@@ -7,7 +7,8 @@ import { runWorkflowObservation } from './workflow-observation-runner.mjs';
 import { observationRemote, authorizeObservation } from './workflow-observation-remote.mjs';
 
 async function connect(input, state, location, dependencies) {
-  const original = Object.fromEntries(['taskId', 'flowId', 'stepId', 'leaseId', 'generation', 'settlementId'].map(key => [key, input[key]]));
+  const fields = ['taskId', 'flowId', 'stepId', 'leaseId', 'generation', ...(Object.hasOwn(input, 'settlementId') ? ['settlementId'] : [])];
+  const original = Object.fromEntries(fields.map(key => [key, input[key]]));
   const admitted = state.admitted ?? await observationRemote('admitted', 'member-observation-admit', original, state, location, dependencies);
   const admission = observationAdmission(admitted.admission, input, { allowExpired: Boolean(state.result) });
   await authorizeObservation(admission, dependencies, !state.result);

package/workflow-observation-wire.mjs

@@ -3,14 +3,16 @@ import { canonical, sha256 } from './local-integrity.mjs';
 import { mutationId14, mutationPaths14 } from './local-mutation-files.mjs';
 
 export const observationFail = message => { throw Object.assign(new Error(message), { code: 'ENTROROVE_LOCAL_OBSERVATION' }); };
-export const observationIdentityFields = ['taskId', 'flowId', 'stepId', 'leaseId', 'generation', 'settlementId'];
+export const observationReadOnlyIdentityFields = ['taskId', 'flowId', 'stepId', 'leaseId', 'generation'];
+export const observationIdentityFields = [...observationReadOnlyIdentityFields, 'settlementId'];
 export function observationExact(value, fields) {
   if (!value || typeof value !== 'object' || Array.isArray(value)
     || canonical(Object.keys(value).sort()) !== canonical([...fields].sort())) observationFail('Local observation fields are invalid');
 }
 export function observationInput(input) {
-  observationExact(input, observationIdentityFields);
-  for (const field of observationIdentityFields.filter(field => field !== 'generation')) mutationId14(input[field], field);
+  const fields = Object.hasOwn(input ?? {}, 'settlementId') ? observationIdentityFields : observationReadOnlyIdentityFields;
+  observationExact(input, fields);
+  for (const field of fields.filter(field => field !== 'generation')) mutationId14(input[field], field);
   if (!Number.isSafeInteger(input.generation) || input.generation < 1) observationFail('Local observation generation is invalid');
   return input;
 }
@@ -50,18 +52,23 @@ function signature(value) {
   } catch { observationFail('Local observation requires its original pinned public cloud admission signature'); }
 }
 export function observationAdmission(value, input, { allowExpired = false } = {}) {
-  observationExact(value, [...observationIdentityFields, 'schemaVersion', 'purpose', 'observationId', 'ownerId', 'taskDigest',
-    'chainDigest', 'epoch', 'planId', 'planDigest', 'executionPlanSha256', 'repositoryDigest', 'settlementDigest', 'command',
+  const readOnly = !Object.hasOwn(input, 'settlementId');
+  const fields = readOnly ? observationReadOnlyIdentityFields : observationIdentityFields;
+  observationExact(value, [...fields, 'schemaVersion', 'purpose', 'observationId', 'ownerId', 'taskDigest',
+    'chainDigest', 'epoch', 'planId', 'planDigest', 'executionPlanSha256', 'repositoryDigest',
+    ...(readOnly ? ['sourceKind'] : ['settlementDigest']), 'command',
     'sourceManifest', 'protectedFiles', 'issuedAt', 'expiresAt', 'authorityReceipt']);
   signature(value);
   const start = Date.parse(value.issuedAt), end = Date.parse(value.expiresAt);
   if (value.schemaVersion !== 'entrorove.local-observation-admission/1.0' || value.purpose !== 'observe-approved-command'
-    || value.epoch !== 0 || observationIdentityFields.some(field => value[field] !== input[field])
+    || value.epoch !== 0 || fields.some(field => value[field] !== input[field])
+    || readOnly && value.sourceKind !== 'original-read-only-plan'
     || value.repositoryDigest !== sha256(input.repositoryRoot).slice(0, 32) || !Number.isFinite(start) || !Number.isFinite(end)
     || start > Date.now() || end <= start || end - start > 600_000 || !allowExpired && end <= Date.now()
     || !/^[a-f0-9-]{36}$/.test(value.ownerId)
-    || ['taskDigest', 'chainDigest', 'planDigest', 'executionPlanSha256', 'settlementDigest'].some(field => !/^[a-f0-9]{64}$/.test(value[field]))) {
-    observationFail('Local observation admission is expired or lost its original task, repository or settlement');
+    || ['taskDigest', 'chainDigest', 'planDigest', 'executionPlanSha256', ...(readOnly ? [] : ['settlementDigest'])]
+      .some(field => !/^[a-f0-9]{64}$/.test(value[field]))) {
+    observationFail('Local observation admission is expired or lost its original task, repository or source binding');
   }
   mutationId14(value.observationId, 'observationId'); mutationId14(value.planId, 'planId');
   command(value.command); files(value.sourceManifest, true); files(value.protectedFiles, false);