@entrorove/skill 0.1.57 → 0.1.58

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.58 — 2026-10-17
+
+- 修复截图等多模态 PostToolUse 事件超过旧输入上限时被误拦：完整读取并严格校验最多 32 MiB 的 UTF-8 JSON 对象，超限或无效事件返回固定安全诊断；保留原授权、待回执调用及 O 证据，私有状态文件仍限 1,000,000 字节。
+- Fixed multimodal PostToolUse events such as screenshots being rejected by the old input limit. Read and strictly validate the complete UTF-8 JSON object up to 32 MiB, returning fixed safe diagnostics for oversized or invalid events while preserving original authority, pending calls and O evidence. Private state files retain their 1,000,000-byte limit.
+
 ## 0.1.57 — 2026-10-17
 
 - 云端关闭时以原本地 IDE 执行与实际测试完成本地验收，补齐签名步骤续跑、最终验收、钩子与队列恢复；保留原范围、审批和 S/M 证据，明确未做独立验证。修复原规划字段诊断与沙箱模式恢复。

package/IDE-EXECUTION.md

@@ -1,5 +1,7 @@
 Install or update the managed copy with `npx @entrorove/skill install`. In Codex, use `npx @entrorove/skill install --host codex` to configure Codex only; this leaves Claude Code hook settings and skill copies alone. The installer keeps one global managed entrorove skill, replaces its older pristine version, removes only pristine duplicate installations for the selected host, and preserves hand-edited files. An older package cannot overwrite a newer managed version.
 
+Host hook events, including multimodal `PostToolUse` screenshot results, accept at most 32 MiB (33,554,432 UTF-8 bytes). The complete bounded event is decoded once and follows the original session, tool-call and signature checks; image results do not grant permissions or erase a pending call. Oversized events return `ENTROROVE_IDE_INPUT_TOO_LARGE`; invalid UTF-8 or JSON objects return `ENTROROVE_IDE_INPUT_INVALID_JSON`. These fixed diagnostics do not include the event contents. Private IDE state JSON files retain their separate 1,000,000-byte limit. A hook error after a tool action does not prove the action was unexecuted: inspect the original result or status before considering another attempt.
+
 Register or sign in by email at https://entrorove.com. Enter the account key once with `npx @entrorove/skill configure` and `{"token":"..."}` on standard input. The credential persists in the current OS user's restricted local store across skill upgrades. Before asking again, use the stored credential; a missing or invalid credential must be reported explicitly. Never place the key in arguments, URLs, project files or logs. entrorove accounts and keys are independent of other services.
 
 If the IDE guard itself is the blocked step, run `entrorove unlock` directly from the affected IDE terminal. The command is offline and records a 15-minute lease bound to that IDE session; it does not call a hook, read a credential, accept the agreement, inspect the protocol or authorize project writes. The host session ID must be present in the environment or supplied as `ENTROROVE_SESSION`. Under the lease, `flow-cancel` and `flow-abandon` recover the original flow; successful `flow-abandon` releases its task binding in both the flow state and the IDE session record, even without a hook callback. Queued requests remain, and other IDE sessions stay guarded.

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute an engineering task through Entrorove, preserving its origi
 
 # entrorove · 熵巡
 
-Version: 0.1.57.
+Version: 0.1.58.
 
 Entrorove applies to the whole task once selected. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 

package/ide-hook.mjs

@@ -16,6 +16,11 @@ import { registerIdeRequirement, ideQueueContext, unclassifiedIdeRequirements,
 
 const output = (event, extra = {}) => ({ hookSpecificOutput: { hookEventName: event, ...extra } });
 const deny = reason => output('PreToolUse', { permissionDecision: 'deny', permissionDecisionReason: reason });
+export const IDE_HOOK_MAX_INPUT_BYTES = 32 * 1024 * 1024;
+const inputErrors = {
+  ENTROROVE_IDE_INPUT_TOO_LARGE: 'ENTROROVE_IDE_INPUT_TOO_LARGE：Entrorove hook 事件超过 32 MiB UTF-8 字节上限；本次事件已拒绝。',
+  ENTROROVE_IDE_INPUT_INVALID_JSON: 'ENTROROVE_IDE_INPUT_INVALID_JSON：Entrorove hook 事件不是有效的 UTF-8 JSON 对象；本次事件已拒绝。',
+};
 const publicId = value => typeof value === 'string' && /^[A-Za-z0-9_-]{1,200}$/u.test(value);
 const readTools = new Set(['wait', 'view_image', 'list_mcp_resources', 'list_mcp_resource_templates', 'read_mcp_resource', 'web_search', 'update_plan', 'request_user_input', 'request_user_input_async', 'get_goal']);
 const unlockCommand = 'entrorove unlock';
@@ -320,17 +325,29 @@ export async function runIdeHook(event, { home } = {}) {
   }, home);
 }
 let incomingEvent;
+async function readHookEvent() {
+  const chunks = []; let bytes = 0;
+  for await (const chunk of process.stdin) {
+    const buffer = Buffer.from(chunk); bytes += buffer.length;
+    if (bytes > IDE_HOOK_MAX_INPUT_BYTES) throw Object.assign(new Error('Hook event byte limit exceeded'), { code: 'ENTROROVE_IDE_INPUT_TOO_LARGE' });
+    chunks.push(buffer);
+  }
+  try {
+    const value = JSON.parse(new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(Buffer.concat(chunks, bytes)));
+    if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error();
+    return value;
+  } catch { throw Object.assign(new Error('Hook event JSON is invalid'), { code: 'ENTROROVE_IDE_INPUT_INVALID_JSON' }); }
+}
 async function main() {
-  let raw = '';
-  for await (const chunk of process.stdin) { raw += chunk; if (raw.length > 1_000_000) throw new Error('Host hook input is too large'); }
-  const event = JSON.parse(raw); incomingEvent = event.hook_event_name;
+  const event = await readHookEvent(); incomingEvent = event.hook_event_name;
   const result = await runIdeHook(event);
   process.stdout.write(`${JSON.stringify(result)}\n`);
 }
-if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) main().catch(() => {
+if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) main().catch(cause => {
   // A non-zero generic exit may fail open in the host. Always return a supported
   // explicit denial, without including arguments, prompts, credentials or paths.
-  const reason = `Entrorove 安全检查失败；本次工具调用已阻止。可复制解锁命令：${unlockCommand}`;
+  const reason = Object.hasOwn(inputErrors, cause?.code) ? inputErrors[cause.code]
+    : `Entrorove 安全检查失败；本次工具调用已阻止。可复制解锁命令：${unlockCommand}`;
   const result = incomingEvent === 'Stop' ? { decision: 'block', reason } : incomingEvent === 'PreToolUse' ? deny(reason)
     : { continue: false, stopReason: reason, systemMessage: reason };
   process.stdout.write(`${JSON.stringify(result)}\n`);

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.57",
+  "version": "0.1.58",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.57",
+  "version": "0.1.58",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"

package/release-state.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.57",
-  "digest": "9234829890ae7b6f69f54a0467751ab2434e4c77dacb5c095ba3a37fe26423e7",
+  "version": "0.1.58",
+  "digest": "503f521d785c3da28cf88eb604daa30ed9c28ab2e847cd8f4472773600fd4b3b",
   "files": {
     "connected-cli.mjs": "d5fc2542ae0aa36bf45b0f3d493fe1e7479a4a25c50c8f3730f8b0c4007a7f8f",
     "local-approved-process.mjs": "442856df788e63f38757439ba0657d1c689aaf797631a955fae3dd639e844e6d",
@@ -23,7 +23,7 @@
     "cloud-mutation-authority.mjs": "c7226e882a4f3be4d2f55728f515d5a815c0aa1f21aa5e4689314e6e6a8c66a2",
     "ide-code-mode.mjs": "f8ba4de33632ab4c6df52dab52f392414b4632c7e94b218b8065677970c075c7",
     "ide-command.mjs": "3db45dd1d12db670e594b6ced35f2d7778cb01091695b1e240179b1ea34f25ee",
-    "ide-hook.mjs": "ae097c61db71a95096f3c3b30b4c59dcab41aedbf88445390b8ad98f81e4cec0",
+    "ide-hook.mjs": "00d67d0a49e2d13d718a376090804804af8f20973f9b552c13c0d53daa375d13",
     "ide-install.mjs": "6322f76d8c0f5c864d8c61f4ee90ae029ccf4bbf1e31fbca7590b78b6c7eaa78",
     "ide-session.mjs": "6df04bca3231954e8b83f6b1b535befff16b6c62c51ca65ae3aa2559180ad7c2",
     "break-glass.mjs": "6ec9f97c5d68bb33121b2374c06b9d4c8eb3419b52d00849fec7124bc63e4582",
@@ -50,7 +50,7 @@
     "runtime/validator-runtime-v7.0.44.d.mts": "7797edbfe2f7de24da370204dce4dfd22822a1bd80df93514fff900b98afe36f",
     "snapshot-retention.mjs": "ca46aeb36b1a5a24fe7e967031a71b9a3d33f40cb715d344402cbe0dc9c425cb",
     "snapshot-cleanup-journal.mjs": "76a9684cc95b4eb076e1298d78a9dff37948b00d9607b8f546c599072d3ed331",
-    "IDE-EXECUTION.md": "cb98887cc9a905a5a69c14f8e95cdffc7801c8a2bf8c60f6b7975867e2f722e7",
+    "IDE-EXECUTION.md": "7d0aa5d1e3dc8dfd3bd0598aa7dc32c50ecd80197cf6958bf836c0b434a9ae5e",
     "REUSE-DISCIPLINE.md": "5b214cf313e7f715f52d54e28093a2d038f0f196ca64b15d1c49587b9d8eecf8",
     "reuse-discipline-release.mjs": "7f55ae10ec3396ed3bc5430a0c64f94c33c2dfbc57b32084caab92fd5fd1586f",
     "local-final-gate16.mjs": "083aec470670e6cdb7ad2ab27b7a51b53a9ec3a8b4121cb9cbfa17d9940892c2",

package/releases.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.1.58",
+    "date": "2026-10-17",
+    "zh": "修复截图等多模态 PostToolUse 事件超过旧输入上限时被误拦：完整读取并严格校验最多 32 MiB 的 UTF-8 JSON 对象，超限或无效事件返回固定安全诊断；保留原授权、待回执调用及 O 证据，私有状态文件仍限 1,000,000 字节。",
+    "en": "Fixed multimodal PostToolUse events such as screenshots being rejected by the old input limit. Read and strictly validate the complete UTF-8 JSON object up to 32 MiB, returning fixed safe diagnostics for oversized or invalid events while preserving original authority, pending calls and O evidence. Private state files retain their 1,000,000-byte limit."
+  },
   {
     "version": "0.1.57",
     "date": "2026-10-17",