@entrorove/skill 0.1.61 → 0.1.64

package/CAPABILITY-MAP.md

@@ -1,12 +1,16 @@
 # 能力对账图（WP-02 / AC-20）
 
+中英文退出治理声明：`entrorove exit` 或当前会话的实际用户明确退出原文，只结束本轮治理，保留源码、原清单顺序、审批及全部失败记录；不取消或完成剩余业务，不从翻译问题、引用、截图、条件句或报错推断退出。英文示例：`From now on, do not use the skill to execute the remaining tasks.`
+
+直接 SDK 会话缺少 IDE 记录时，`exit` 仅为当前已支持主机/会话和实际目录保存 inactive/user-exited 标记，不创建 flow、任务、审批或回执。已有原目录绑定及历史保留；损坏、不匹配或不安全的记录仍明确拒绝覆盖。
+
 ## 2026-10-17 增量：受限本地编辑与停止恢复
 
 | 能力 | 正常公开入口 | 验证与边界 |
 | --- | --- | --- |
 | 成员受限编辑 | `mutation-connect <repositoryRoot>`、`local mutation-delegate-prepare` | 原任务、冻结修改声明及租约绑定；观察、编辑、独立验证三把密钥分离。运行时依赖保持未知且只读，只允许现存文件的受限修改；不授予通用执行、合并或交付权限 |
-| 连续编辑结算 | `mutation-settle <repositoryRoot>`、`local mutation-consumption-attest`、服务端 `mutation-pass-settle` | 实际写后 M 回执与 fresh S 后验共同确认原 pass；下一轮使用 `previousPassId`，不伪造架构验证事件 |
-| 沙箱关闭后的本地验收 | `workflow-observe-step <repositoryRoot>`、`member-observation-admit/report/status`、`workflow-verdict` | 服务器签名 member-local 计划中，原冻结命令和测试真实通过后签发独立保存的 localAcceptance，续跑原步骤并完成本地验收；原 O 无 V 回执，明确未进行独立验证。原范围、审批、S/M 分离及未知依赖保护保留 |
+| 连续编辑结算 | `mutation-settle <repositoryRoot>`、`local mutation-consumption-attest`、服务端 `mutation-pass-settle` | 实际写后 M 回执与 fresh S 后验确认原 pass；原成功审计/账本全链且自然过期后，可独立记录完成检查之后、完整结构验证的非目标 Finder 元数据变化，仅结算原写入，不改原基线或赋写权；零写入仍须全仓一致，单次关闭后沿原 `previousPassId` 申请新权限；不计完成或放行测试 |
+| 沙箱关闭后的本地验收 | `workflow-observe-step <repositoryRoot>`、`member-observation-admit/report/status`、`workflow-verdict` | 服务器签名 member-local 计划中，原冻结命令和测试真实通过后签发独立保存的 localAcceptance；已 ACK 的下游正常失败可由原 producer 追加受限返工，实际新 M 与原测试通过后追加复验记录，只对实际源码清单受影响的后续已验收阶段追加只读复验。嵌套 producer 的结算观察保留已确认上游修复摘要；原失败与精确 ACK 可报告已知拒绝，保留 pending 审计且不推断无效果或授予重发权。旧计划/租约/通过/失败保留；原 O 无 V 回执，明确未进行独立验证。原范围、审批、S/M 分离及未知依赖保护保留 |
 | 续跑入口 | 原 `execution-claim`、原 flow 恢复 | 成员受限范围返回原字段的 `localAction`，客户端串联真实快照、签名、云端通行证及本地安装；网络结果不明时恢复原请求 |
 | 同一阻断停止 | IDE `Stop` 回调 | 真实重复阻断可等待；状态查询及检查点不能重置阻断，宿主重复 Stop 不再生成无限续跑。原 flow、需求队列与恢复数据保留 |
 
@@ -44,6 +48,7 @@
 | 旧版保证 | 当前入口与行为 |
 | --- | --- |
 | 每个任务选择云端／本地，原生确认不可用时仍须展示问题 | `cloud-task` 返回 Confirm Protocol 和 `chatFallback`；确认才提交，退出保留原任务并采用本地方案 |
+| 云端图片输入与 DeepSeek V4.1 | `cloud-task` / 原 `start` 云端回调的 `images`；`deepseek-flash` | 显式附件经真实字节校验后作为用户图像块传入；原目标与有序图片摘要绑定，按账号隔离；图片不授予执行权限，未验证模型通道明确拒绝 |
 | 实际进度必须进入 IDE | `cloud-watch` 订阅本人任务 SSE，输出独立 IDE 事件；调用方必须把公开消息和摘要展示到对话进度 |
 | 执行提示与推广可见 | `智能执行中，请勿关闭！` 与服务端选中的真实推广独立输出；保留推广 HTTPS 链接，按事件 ID 去重 |
 | 断线恢复原任务 | `cloud-watch` 带原 `taskId/afterId` 只读续接；`status` 与 `feedback` 查询原请求，不重发业务 POST |

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.1.64 — 2026-10-19
+
+- 统一交付原合同连续执行与失败恢复修复：受限完整响应、原请求结算恢复、过期挑战与未用授权处理、已批准依赖与二进制核验、系统元数据观察；新增图片输入并适配 DeepSeek V4.1 Flash，完善中英文明确退出及无 IDE 记录的离线退出。保留范围、签名、预算及失败和未知记录；缺少进程终局证据的观察仍拒绝重跑。
+- Deliver original-contract continuation and recovery fixes for bounded complete responses, original-request settlement, expired challenges and unused grants, approved dependencies, verified binary inputs and system metadata observations. Add image inputs for DeepSeek V4.1 Flash and bilingual explicit offline exit, including sessions without an IDE record. Preserve scope, signatures, budgets, failures and unknown outcomes; observations without terminal process evidence still cannot rerun.
+
+## 0.1.63 — 2026-10-18
+
+- 修复精确大范围补正的组合回执保存；原 M 授权支持真实二进制字节，保留源代码分析、原路径及结算校验。范围风险提高必须另经原账号明确重评。
+- Retain combined receipts for exact large scope amendments and write actual binary bytes through the original M authority, preserving source analysis, paths and settlement checks. Higher scope risk requires explicit original-owner reassessment.
+
+## 0.1.62 — 2026-10-18
+
+- 补齐本地新项目的受控创建与原生产步骤内迭代：原账号审批精确不存在路径和生产节点，S 与独立 M 签名校验真实基线，保留源文件只读保护、合同预算及失败历史。支持 PHP、JSON、原生模板、WXML、WXSS，通过实际创建、结算、测试和最终本地验收；钩子仍可关闭。
+- Support governed creation and iteration of new local project files within their original producer and accepted plan. Bind exact absent paths and producers to owner approval, actual S and separate M evidence, protected sources, contract budgets and immutable failures. Cover PHP, JSON, native templates, WXML and WXSS through real writes, settlement, tests and final local acceptance while keeping hooks optional.
+
 ## 0.1.61 — 2026-10-18
 
 - 钩子改为可选：默认安装关闭钩子，IDE 可直接调用 SDK；只有明确选用技能的原会话与仓库启用拦截，普通查询、旧激活状态及无法归属的事件不再接管其他任务。保留账号、写入范围、签名和真实本地验收校验。

package/IDE-EXECUTION.md

@@ -19,7 +19,9 @@ Approved Codex `exec_command` reads and SDK calls run with `/bin/sh` and `login:
 
 For a Codex task-to-task report explicitly authorized by the human user, the guard passes the exact `mcp__codex_app__send_message_to_thread` tool through unchanged, including a static `tools.mcp__codex_app__send_message_to_thread({...})` call inside `functions.exec`. Codex still decides whether the user authorized the message. Its text and response grant no Entrorove flow, file, shell or task-creation authority.
 
-To stop governance only in the current IDE session after an explicit user decision, run `entrorove exit`. It needs no network, credential, agreement or hook callback and preserves original evidence and queues. Other sessions remain unchanged. `flow-cancel` and `flow-abandon` settle a flow; they do not express a decision to stop using the skill.
+To stop governance only in the current IDE session after an explicit user decision, run `entrorove exit`. It needs no network, credential, agreement or hook callback and preserves original evidence and queues. Direct SDK use may have no IDE session record: in that case exit creates only an inactive `user-exited` marker for the actual supported host/session and current physical directory, without creating a flow, task, approval or receipt. An existing record keeps its original repository and history; invalid or unsafe records are rejected rather than replaced. Other sessions remain unchanged. `flow-cancel` and `flow-abandon` settle a flow; they do not express a decision to stop using the skill.
+
+Direct stop decisions and their exit acknowledgements support Chinese and English; keep the name `Entrorove` unchanged in both languages. One English decision is `From now on, do not use the skill to execute the remaining tasks.` A complete English declaration is: `The user has explicitly decided: report the errors to the skill maintainers and stop using the skill for the remaining tasks from now on. End only the current Entrorove governance session; preserve the source code, the original task-list order, approvals, and all failure records. This does not mean that the remaining business tasks are cancelled or completed.` The equivalent Chinese declaration is: `用户明确决定：错误问题发送给技能修改人员，从现在开始不使用技能来执行剩余任务。仅结束本轮Entrorove治理；保留源码、原清单顺序、审批和全部失败记录，不代表剩余业务任务取消或完成。` These decisions are acted on only as actual user prompts in the affected session. A translation/adaptation question, quotation, screenshot, hypothetical condition or failure report is not an exit decision. Exit records no business completion, acceptance, cancellation or implicit approval and does not send a report to anyone.
 
 To stop using Entrorove on this computer, run `entrorove uninstall` directly. It works offline, removes only the recorded Entrorove host hooks and pristine global skill, and leaves other host settings, credentials and task records in place. A hand-edited file is reported as preserved rather than deleted. This command does not inspect or change another project.
 
@@ -35,6 +37,13 @@ For a new engineering task, run `npx --yes --prefer-online @entrorove/skill@late
 
 For an explicit cloud planning request without an existing start, `cloud-task` accepts `{"goal":"<actual goal>","ideTaskId":"<current IDE task ID, when available>"}` on stdin and returns the same choice. Do not start both routes for one task.
 
+Images attached to a cloud planning task use `images: [{"path":"<explicit absolute image path>","detail":"original"}]` or `images: [{"url":"data:image/png;base64,<canonical bytes>","detail":"auto"}]`. For ordinary `invoke` task entry, keep `images` at the envelope's top level, outside the immutable `input.task`; the original cloud-choice callback carries them forward. Render the returned choice before sending. File paths are read only after `use`, and a local choice retains the attachment references without reading or uploading them. Never scan for images, copy a local path into a remote URL, omit attachments silently, or describe a text-only classification as image analysis.
+
+Entrorove currently verifies this image channel for **DeepSeek V4.1 Flash (1017)**, API ID `deepseek-flash`. The pricing page's `(1)` is a footnote, not an API suffix. Older DeepSeek choices are removed; existing legacy selections upgrade while preserving their encrypted key and enabled state. Unverified model image channels fail explicitly before a provider request. Entrorove's own bounds are four images, 2 MiB each, 8 MiB total, and 8192 pixels per side; actual JPEG/PNG/GIF/WebP headers, dimensions, inline MIME, canonical base64 and byte limits are checked before dispatch. The provider decodes the actual content. Use only explicit user attachments.
+
+The authenticated API accepts inline data URLs, never remote URLs or server file paths. It sends text and `image_url` blocks together in the user message. Original goal and ordered image hashes, media types, sizes and detail modes bind the title and completion. Public task reads contain only that image manifest; image bytes remain in the single in-memory classification attempt, not the database, events or usage records. Provider-reported prompt usage includes images; no estimated image tokens are reported as actual usage. A failed or unknown attempt retains its original recovery rules and must not be resubmitted just to resend images.
+
+
 With `sandboxChoice: "use"` (or the protocol callback's `answer: "use"`), immediately display the returned acceptance message, for example **云端任务 08921 · 已进入**. Use the returned `taskNumber` verbatim: it matches the homepage sandbox tab and notification. Retain the UUID `taskId` separately for API queries; never display the IDE chat ID or invent a number instead. Then run the returned `nextAction`, `cloud-watch`. It subscribes to that account's authoritative SSE stream, returns newline-delimited `entrorove.ide-event/1.0` events, then one `entrorove.cloud-watch/1.0` result. **Mirror each new event's public `message` and optional `detail` into visible IDE progress/commentary.** Deduplicate by task ID and event ID, including the acceptance message repeated in the stream or final result. The same rule applies to normal invocation `ideMessages` and notice events. A JSON field or collapsed command log does not satisfy this display requirement. Show `智能执行中，请勿关闭！` and the selected promotion on separate lines; preserve the promotion's actual HTTPS link. Use only the server's selected promotion; do not insert a local test advertisement.
 
 Display the actual entering, allocation, thinking, public output and exit events as they arrive. Do not generate model reasoning, invent intermediate events or replace `reported` with verified completion. The public model summary is the planning output available to show. `云端沙箱输出完毕` means the current planning response has arrived; inspect its real task/verification status before dependent execution. Exit here closes the progress subscription and does not cancel the persisted task.
@@ -71,7 +80,7 @@ For `workType: "merge"`, include `baselineRef` with the concrete branch, tag, co
 
 The v2 capability map is recorded in [`CAPABILITY-MAP.md`](CAPABILITY-MAP.md). It maps every legacy domain and operation to its v2 equivalent, narrower semantics, or an explicitly documented uncovered area; adapters must not silently substitute an uncovered operation.
 
-For an explicit domain operation, use `npx @entrorove/skill native <domain> <operation>` with its input object on stdin. The supported domains are `aimlock`, `blueprint`, `calctool`, `swarm`, `validator`, `mergeguard`, `archguard` and `confirm-protocol`. This public adapter discovers that domain's actual server schema, validates the input, invokes the registered operation once, and verifies any required automatic feedback. Discovery, help and status observations follow the server's published feedback contract. A failed gate or unknown outcome must never be replaced with another executor or reported as local success; fix the original cause and recover the original request through its read-only status.
+For an explicit domain operation, use `npx @entrorove/skill native <domain> <operation>` with its input object on stdin. The supported domains are `aimlock`, `blueprint`, `calctool`, `swarm`, `validator`, `mergeguard`, `archguard` and `confirm-protocol`. This public adapter discovers that domain's actual server schema, validates the input, invokes the registered operation once, and verifies any required automatic feedback. Discovery, help and status observations follow the server's published feedback contract. A failed gate or unknown outcome must never be replaced with another executor or reported as local success; fix the original cause and recover the original request through its read-only status. For a scope challenge preparation whose authenticated original GET returns `request-not-found`, `scope-amend` discovers `scope-challenge-retire`. This separate lifecycle request retains the exact original envelope, account, approved proposal and receiver. Its transaction can create a current signed retirement fence only if no original admission or nonce exists. A late original POST reads that terminal fence and cannot issue a nonce. The original GET and feedback acknowledgement then preserve the retirement before a fresh approved challenge; no scope application, M settlement, write permission or business result is inferred. A lost retirement response is recovered by that retirement request's original GET without replaying either POST.
 
 Aimlock exposes `brain-plan`, `brain-check`, `brain-validate` and `brain-status`. Create a plan with the actual goal, scope `contract`, `requirements` and ordered `steps`; retain its returned `requestId` and `plan.digest`. Subsequent operations take only that original `planRequestId` (plus `paths` for `brain-check`); the server loads the authenticated account's stored plan. Never submit a reconstructed plan or another account's request. Planning validation checks scope, requirements and dependencies; it grants no mutation authority and never certifies business delivery.
 
@@ -89,26 +98,46 @@ If the original selection omitted actual components or inspection files, use the
 
 Present the returned scope-revision question and submit the original owner's actual answer through its bound `interaction-answer`. Approval is specific to that complete proposal; it does not approve a plan or perform a write. Then run `npx @entrorove/skill scope-amend <original repositoryRoot>` with `{flowId,proposalId,proposalDigest}` on stdin. It loads the **existing** S key and original repository/entry/import-context binding, obtains a W challenge, scans the real complete file set into a separate candidate snapshot and submits signed evidence. It never creates a replacement signer, answers approval itself, or overwrites the original scope history.
 
+When exact new paths imply a higher risk, the service includes `riskReview` in the immutable proposal and explicitly shows the old and proposed risk in its original-owner question. Only that actual approval raises the exact scope risk ceiling; the original task, mode, path contract and consumed file/token/line/time budgets remain unchanged. An older approval lacking this risk question cannot authorize an upgrade: follow `risk-reassessment-required` with the same complete role map in a new `workflow-scope-review` on the original flow. Keep the old approval and failed request history; never lower observed risk or repeat an unchanged rejected apply.
+
 Only a successful native gate and the original approved contracts and remaining budgets can activate the immutable scope revision. Keep the original Blueprint, plan identities, task order and failure receipts. Submit the complete corrected plan with the returned `scopeRevisionDigest` under its canonical new request identity. Exact read-only files remain read-only, even if included in the manifest or a broad write contract. An unknown request outcome is recovered with the original GET; do not replay an uncertain POST or restart the flow.
 
 After an amended task's actual guarded writes, follow its returned `scope-amend` refresh action, which adds the original stored `gatePassPath` to the same `{flowId,proposalId,proposalDigest}`. The connector preserves the real M consumption receipt and observes new S facts without another write. It appends facts under the same approved role revision, then the original `mutation-settle` and local observation can continue. Changed read-only files, a different pass or extra writes remain blocked. A proof refresh cannot change permissions or reset a consumed budget. Live `workflow-scope-status` observes the current head; an uncertain mutating request is still recovered only through its original GET.
 
+During that refresh, a static relative import whose exact target is still absent from the approved create list remains an explicit unresolved observation. Its real importing source and absent candidates stay recorded, with `complete: false`; no dependency node or execution permission is invented. The original M writes may settle under their existing contract. When a later original M actually creates that dependency, comparison may restore the earlier unknown only for an unchanged importing source and an exact consumed absent target. The real new S graph and resolved edge remain in the ledger. Unapproved missing paths, unsafe references and unknown external dependencies retain their errors.
+
+Source line statistics recognize complete checksum-verified sfnt fonts and bounded ordinary ZIP containers from their bytes. ZIP inspection verifies local and central records, stored/Deflate content lengths and CRCs in memory; it does not extract or execute entries. Encrypted, ZIP64, unsupported or damaged containers retain conservative text counts. Binary recognition never removes the outer file's bytes, hash, file count or byte-derived token accounting and never changes the approved budget.
+
 Keep snapshot before-images distinct from a frozen execution plan's expected final file hashes. Controlled writes consume the original approved authority; the runner then verifies the actual planned final bytes. Never edit a signed plan or silently substitute a newer snapshot after an unknown or failed gate. Existing changes outside that authority require explicit revalidation of the same original flow.
 
 Computed runtime imports remain explicitly unresolved with their actual source paths and hashes. A member's scope-only signer may submit these observations to enter restricted planning; the cloud returns `planningOnly: true` and `requires-complete-import-graph-before-mutation`. Do not treat this as full dependency verification, execution permission, or business completion. Obtain the limited original-task editing delegation below when eligible, or resolve and verify the dependency contract. Never set `complete` manually or replace the original signer or paths.
 
 ### Restricted member editing
 
-When the accepted plan returns a `localAction` for `mutation-connect`, run `npx @entrorove/skill mutation-connect <original repositoryRoot>` with that action's JSON `input` on stdin. The input contains the original `taskId`, `flowId`, `stepId`, `leaseId`, `generation`, scope `runnerId` and exact `paths`. Use the same local home, account and scope signer. This route requires an accepted frozen modify policy and a live original lease; it does not create a second task or invoke a generic execution authority.
+`local guarded-write` accepts exactly one of `content` (text or JSON) and `contentBase64` (canonical base64, at most 16,000,000 encoded characters). The latter writes decoded bytes for an already authorized PNG, font or archive path; it grants no additional path, create/modify role or execution authority. Decoded source files still pass the original UTF-8, imports, reuse and contract checks. Binary bytes retain their exact SHA-256 through the M write receipt, fresh S observation and settlement. Do not save base64 text as a binary file or write assets outside the original pass.
+
+When the accepted plan returns a `localAction` for `mutation-connect`, run `npx @entrorove/skill mutation-connect <original repositoryRoot>` with that action's JSON `input` on stdin. The input contains the original `taskId`, `flowId`, `stepId`, `leaseId`, `generation`, scope `runnerId` and exact `paths`. Use the same local home, account and scope signer. This route requires the matching accepted frozen write policy and a live original lease; it does not create a second task or invoke a generic execution authority.
 
 The connector discovers the public cloud verification key through the authenticated official HTTPS capability endpoint and fixes it in private local storage. An explicit operator pin must match, and a changed key or origin is rejected rather than silently replaced. Subsequent local mutation calls load this public pin offline; discovery and `unlock` do not depend on that cache.
 
-The connector creates a separate local editing key, requests the cloud's original signed snapshot challenge, copies and verifies the actual files, signs their fresh observation, obtains a limited cloud pass and installs it. The local editing key differs from both the scope observation key and the independent validator key. It is stored privately outside the repository; no manual key configuration is required. An uncertain network result returns a structured blocked result with the original request ID. Reusing the identical connector input restores its saved stage through the original status GET and keeps its existing challenge and attestation; it never replaces an uncertain mutation POST.
+The connector creates a separate local editing key, requests the cloud's original signed snapshot challenge, copies and verifies the actual files or their exact absence, signs their fresh observation, obtains a limited cloud pass and installs it. The local editing key differs from both the scope observation key and the independent validator key. It is stored privately outside the repository; no manual key configuration is required. An uncertain network result returns a structured blocked result with the original request ID. Reusing the identical connector input restores its saved stage through the original status GET and keeps its existing challenge and attestation; it never replaces an uncertain mutation POST.
 
-Use the returned `gatePassPath` with the discovered `local guarded-write` contract and preserve its exact flow, step and repository. Only existing declared modify targets are eligible. Runtime loader sources and observed project configuration stay protected by their original hashes and physical file identity. The local preflight rejects changed imports, removed definitions, public contract changes, new unknown dependencies and unsupported source formats. Unknown dependency coverage remains unknown after an eligible edit.
+Use the returned `gatePassPath` with the discovered `local guarded-write` contract and preserve its exact flow, step and repository. A `preserved-existing-modify` pass covers only existing declared modify targets. Runtime loader sources and observed project configuration stay protected by their original hashes and physical file identity. That route's local preflight rejects changed imports, removed definitions, public contract changes, new unknown dependencies and unsupported source formats. Unknown dependency coverage remains unknown after an eligible edit.
+
+New project files use a separate explicit role, including PHP, JSON, native templates, WXML and WXSS. Before freezing the plan, read `workflow-scope-status`, then submit the complete `workflow-scope-review` file map. Keep existing references as `read-only` with their real hashes. Each absent output uses `access: create`, its exact `producerNodeRef`, original `requirementRefs`, a concrete `reason`, and `sha256: SHA256("entrorove.missing-file/1.0")`. This hash represents real absence, never future contents. The original contract must already allow new files at those paths. Obtain the original owner's exact server-issued approval and run `scope-amend` with its proposal identity and original S signer. Do not create placeholders, change the original gate or start a replacement flow. Existing references or dependencies cannot be relabeled as creations. Exact output slots have a bounded role count; they do not expand existing-source read quotas, token limits or the original changed-line contract.
+
+Bind the accepted `scopeRevisionDigest` in `workflow-plan`. The producer manifest contains each output with that absent baseline and a matching `discipline.writes` entry of `kind: create`. Only its original compiled producer may write it. Descendants may include the output read-only after that producer's actual local acceptance; actual hashes come from the immutable M settlement chain. Do not put unrelated or future outputs in an earlier step's input manifest. `mutation-connect` returns a `planned-file-create` pass only after S and M prove absence; guarded creation is exclusive and cannot overwrite an existing file or follow a symlink ancestor. After creation, refresh S, settle M and run the actual frozen tests as below. A further pass may return `planned-file-modify` only for files proven created by that same original producer and accepted plan, with its current authorized lease and actual settled baseline. This permits local development of those new outputs without weakening the protected existing-file modify route. Requirement, reuse, deletion, contract, scope, signature and repository checks still apply; unresolved dependencies remain unresolved.
 
 After the pass's actual writes finish, follow its scope refresh action: an amended scope uses `scope-amend` with the original stored `gatePassPath`; an unchanged original scope uses its complete original `scope-connect` input, including `importContexts`. Run `npx @entrorove/skill mutation-settle <original repositoryRoot>` with `{taskId,flowId,stepId,gatePassPath}`. The local M signer observes the real completed consumption, and the service requires a fresh S scan captured after those writes. This settlement preserves both before and after hashes, unchanged modes, pass nonces and the original lease. It never creates an architecture verification event. Further edits use the returned `localAction`, whose `previousPassId` identifies that exact settled pass; do not resend an already consumed write.
 
+An expired issued pass with zero actual writes may use this same settlement entry only after its original ledger, every unwritten target and whole-repository bytes and modes prove unchanged. The signed receipt records `writes: []` and the exact unwritten set; pending effects before expiry, missing evidence, drift and links remain refused. Preserve prior usage-review refusals. The result closes that original pass once and returns exact remaining-path guidance; it grants no writes, new test process or completion. Obtain fresh authority through the returned original `localAction`; an expired lease uses only live same-lease continuation. Unknown closure outcomes use the original GET and ACK.
+
+An unrelated file appearing after a pass expires does not erase an already verified controlled write. General addition recovery requires every completed original write's successful post-check audit and intact execution-ledger chain, matching actual targets and protected sources, and only new single-link regular non-executable files physically born after both the pass expiry and last successful completion. No cache directory, caller flag or generated-file label grants this recovery. Other existing-file changes, missing completion evidence, unknown physical writes, protected-source drift and linked or executable additions remain blocked. The SDK preserves the snapshot, pass, write ledger and failures, and records exact new-file hashes, modes, physical identities and completion evidence in a separate M-signed `environmentObservation`, attributed `unattributed-post-write-additions`.
+
+The original expired pass can also settle its already completed writes after later Finder metadata changes. This requires the same successful completion evidence, exact targets/protected sources, and only single-link non-executable `.DS_Store` files outside those targets and protected sources. Each current file must pass bounded allocator partition, B-tree, record-type and embedded binary-property-list validation; the filename or eight-byte marker alone never suffices. Existing metadata must retain its original mode; additions must be born after completion, and every observed metadata modification/creation time must be after completion. These changes may precede the pass's expiry, but recovery itself requires natural expiry. Limits are 1 MiB per file, 8 MiB total and 512 differences. Unsupported formats, malformed bytes, deletions, links, protected metadata, ordinary existing-file changes and zero-write passes remain refused. No project file is deleted or restored and no original snapshot or ledger is edited. The separate observation retains each original comparison entry/hash and actual current hash, format result and physical identity, attributed `unattributed-post-write-finder-metadata` (or `unattributed-post-write-environment` when combined with independently eligible later additions). A historical comparison hash has no retained content: the observation explicitly does not claim that old content's format was validated. Neither the claimed author nor Finder process is authenticated.
+
+Every environment observation keeps `grantsWriteAuthority`, `claimsRepositoryUnchanged` and `claimsAuthorizedEnvironmentChange` false; `environmentObservationAcknowledgedByServer` is also false. It is not included in the server settlement acknowledgement. The remote request settles only the original actual authorized writes; subsequent writes/tests still require fresh original S/M authority. Keep these observations visible in recovery and delivery records. Normal guarded writes and whole-repository discipline checks continue to detect all metadata drift.
+
 If settlement reports `ENTROROVE_SCOPE_AFTER_WRITE_REQUIRED`, refresh only the original scope and retry the same consumption request and receipt. A lost network response is different: rerunning the identical connector restores its original GET result without a replacement POST or signature.
 
 With cloud sandbox disabled, the returned `observationAction` runs `npx @entrorove/skill workflow-observe-step <original repositoryRoot>`. A mutable step uses `{taskId,flowId,stepId,leaseId,generation,settlementId}` and the service updates source hashes only through accepted M settlements. An explicitly frozen read-only step uses `{taskId,flowId,stepId,leaseId,generation}`; its signed admission declares `sourceKind: original-read-only-plan` and contains no settlement ID or digest. Both paths require the original frozen command, executable hash, environment, limits and current signed source manifest. The local runner checks actual source and protected dependencies before and after execution, including repository bytes and modes. No validator private key is needed. The raw observation stays `status: incomplete`, `runner: local`, `receipt: null`, `independentValidation: pending`; local acceptance is represented separately below. Reentry preserves a completed process result; an unknown process outcome never authorizes an automatic second launch.
@@ -119,6 +148,8 @@ For an enrolled member with the account's cloud sandbox disabled, `workflow-plan
 
 Use each returned original `localAction` and `observationAction`. Only an actual successful original process, passing checks and unchanged protected repository can receive a server-signed `localAcceptance`. The wrapper reports `local-accepted` and `independentValidation: not-performed`, while its raw observation remains intact. The CLI and IDE hook verify that signature and the original request, lease and result binding. Local dependencies carry `localDependencies`; formal `verifiedDependencies` remain empty. A failed process, changed bytes, forged signature or unknown outcome cannot advance the next step.
 
+After an acknowledged downstream process exits normally with failure and all repository protection checks pass, `task-resume` may offer `producerRepairActions` for an actually accepted original ancestor. Select only the real correction paths from that producer's `eligiblePaths` in its returned `payloadTemplate`, then use the original `continue/execution-claim` with `producerRepair`. The service rechecks fresh signed S, the frozen plan, original producer roles, successful prior acceptance, failed descendant ACK and unresolved effects. It appends a bounded grant on that producer's unchanged lease and generation. Follow the returned original M action, settle the actual correction and run the unchanged producer command. Its new successful result appends acceptance; old plans, leases, acceptances and failures remain intact. An expired grant can renew only through its exact returned predecessor. Only previously accepted downstream stages whose actual source manifest was changed by that ancestor repair require bounded test-only revalidation. Their returned observation input includes the signed `dependencyRepairDigest`; it cannot grant writes or replace a cached old failure. Flow status exposes signed producer repair references for client preflight while the original downstream flow step stays unchanged. Unknown requests use their original GET and ACK.
+
 After all original steps and requirement checkpoints have passed, invoke the returned `workflow-verdict`. A signed `entrorove.member-local-workflow-acceptance/1.0` completes local acceptance of that same task. Display “本地执行与测试已验收；未进行独立验证”. Formal V, Blueprint independent criteria, Swarm, merge and handoff reject local plans. Do not generate a validator key, claim independent verification, alter failed history or create a replacement flow.
 
 The installed hook verifies the original signed local result before continuing or ending the task. Final acceptance and acknowledged truthful feedback permit restoring its queued parent and cleaning superseded snapshots for this flow, preserving original, final and referenced rollback copies. Cloud resource expiry can clean that resource while a valid original local plan continues; explicit cancellation and already terminal workflows retain their original termination.
@@ -127,10 +158,12 @@ For `ENTROROVE_PLAN_VALIDATION_REQUIRED`, correct only the identified proposal f
 
 This command runs with the host OS user's permissions, not inside an OS sandbox. Its repository checks do not prove that external files, networks or databases were unchanged: `executionIsolation` remains `host-permissions`, and `externalEffects` remains `unverified`. The independent supervisor enforces the admitted start deadline and command timeout and reclaims its own process group if the CLI disappears. Only the original approved command can be launched; these observations grant no general shell or project-write permission.
 
-For a lost `mutation-settle` response, rerun that exact command and input to restore its original HTTP request. For observation network recovery, rerun the identical `workflow-observe-step` input or invoke `member-observation-status` with `{observationId}` through the normal `invoke` entry; both preserve the original process identity. A feedback acknowledgement confirms receipt of a result, not independent verification of that result. Exact host approval means the existing guard callback for the tool call, not another request for human business approval.
+For a lost `mutation-settle` response, rerun that exact command and input to restore its original HTTP request. For observation network recovery, rerun the identical `workflow-observe-step` input or invoke `member-observation-status` with `{observationId}` through the normal `invoke` entry; both preserve the original process identity. A terminal failed result with its exact acknowledged receipt is reported as `ENTROROVE_LOCAL_OBSERVATION_REJECTED`; its pending binding, result and receipt remain in the original journal. This confirms failure without inferring no effects or authorizing another POST or process. Repair the cause and follow fresh original `task-resume` guidance. When an original producer also depends on repaired ancestors, settlement observation guidance retains their exact accepted `dependencyRepairDigest`; never supply that digest manually. A feedback acknowledgement confirms receipt of a result, not independent verification of that result. Exact host approval means the existing guard callback for the tool call, not another request for human business approval.
 
 An editing pass does not certify test execution, independent validation, merge or delivery. Keep those existing verification requirements and distinguish an actual edited file from a verified business result. A missing independent runner is an explicit prerequisite; never substitute the editing key for that runner or describe a local edit as completed delivery.
 
+An expired unissued member M challenge can recover only through the original `mutation-connect` input. The SDK first recovers any original pending issue with authenticated GET and real feedback acknowledgement. The server requires the exact expired signed challenge, closed acknowledged requests, no issued or unsettled pass, the same original producer and predecessor settlement, and fresh unchanged scope/identity checks. It appends a new signed challenge bound to that expired predecessor. The SDK archives the old challenge, snapshot, attestation and failures before making a new snapshot. Issued passes and unknown requests cannot use this refresh. A lost refresh response permits only its original GET; never edit the journal or repeat an uncertain POST.
+
 For a decision, include `input.task.interaction` with `type` (`confirm`, `choice`, `multi` or `input`), a `question`, `options` (two or more with unique `id` and `label`, or an empty array for input), and a `callback` containing its `operation` and `payload`. Medium- and high-risk decisions also need a `riskDescription`. The decision waits for an explicit answer; it never chooses a default on timeout.
 
 Use `npx @entrorove/skill status <requestId>` after a connection loss. It performs a read-only GET lookup and never resends a POST. Use `npx @entrorove/skill flows` to list recoverable flow steps. `npx @entrorove/skill usage [flowId]` reads measured consumption grouped per host and model and, with an original flow, its delivered stages; it never displays an invented quota or a predicted duration. `npx @entrorove/skill billing` exports measured cost per account, host, model and task with that task's delivery stages. A declared host adapter may report the host's own remaining quota through the same module that describes its guard; when it cannot, the answer stays explicitly `unknown` and only this skill's measured ledger is used. `GET /api/skill/flows/:id/status` reports `delivery` with delivered, total and remaining stages. Independent plans count independently verified steps; member-local plans count only signed local acceptances of original business steps and explicitly report that basis. A v2 flow keeps its original `flowId`; local acceptance does not change formal step status to `verified`.

package/REUSE-DISCIPLINE.md

@@ -8,7 +8,7 @@ Snapshot scans stream whole-repository integrity hashes and bound semantic work
 - D-2: A rewrite must cite a concrete existing defect at file:line. “Clearer”, “more maintainable” and “more general” are not evidence. A necessary sensitive exception is submitted through `continue` → `workflow-discipline-review` on the original planning phase. Display the whole concrete proposal. Approval must be the original account's stored Confirm Protocol answer and audit, never a caller's `accepted:true`.
 - D-3: A parallel path requires frozen `policy.parallelPaths` and actual same-input, fieldwise equivalence evidence. Use the existing GoldenBaseline to pin baseline bytes and source hash. The approved runner reads the baseline and actual process output; the original output cannot be supplied anew by the implementation. Missing evidence yields incomplete, mismatch yields blocked with field names. Baselines come from the existing path's actual independent samples, not the new implementation's self-consistency tests.
 - D-4: `discipline-review` exposes symbols, actual references, unresolved sources, scan scope and artifact digest. States are in-use, unused and unknown. Exported/external or dynamic references remain unknown, including reflective/computed access. Unknown equals in-use for preservation. A deletion must reference the original usage review, named symbols and task requirement; known in-use deletion additionally needs the explicit approved exception. Zero static references alone never prove business removability.
-- D-5: The cloud-signed `disciplinePolicy.writes` declares modify/create/delete/move/format with reason and original requirement IDs. Deletes and moves need independent explicit approval. `guarded-delete` and `guarded-move` compare the exact original declaration and physical baseline before action. Moves record explicit source/destination/digest events. Formatting on unchanged semantic lines is refused. The rollback snapshot is limited to pass paths; `discipline-check` compares the whole repository, including ignored files, excluding only `.git` and `node_modules`. Outside-scope bytes or modes refuse verification. No self-score grants permission.
+- D-5: The cloud-signed `disciplinePolicy.writes` declares modify/create/delete/move/format with reason and original requirement IDs. Deletes and moves need independent explicit approval. `guarded-delete` and `guarded-move` compare the exact original declaration and physical baseline before action. Moves record explicit source/destination/digest events. Formatting on unchanged semantic lines is refused. The rollback snapshot is limited to pass paths; `discipline-check` compares the whole repository, including ignored files and Finder metadata, excluding only `.git` and `node_modules`. Outside-scope bytes or modes refuse verification. Expired completed-write consumption has the narrowly evidenced environment-observation recovery in IDE-EXECUTION.md; it neither changes this comparison nor grants later writes. No self-score grants permission.
 - D-6: Future abstractions require concrete named fields from current requirements. Speculative extension justifications without those fields are refused.
 
 Pause for an actual same-semantic new definition, existing data/interface semantic change, data deletion/migration/rebuild, or unsubstantiated rewrite. Submit the exact proposal and reasons through the original flow. Existing data actions must pin their actual pre-execution snapshot artifact in the frozen runner manifest. Never delete to “try” a diagnosis.

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute a task selected for Entrorove through explicit SDK operatio
 
 # entrorove · 熵巡
 
-Version: 0.1.61.
+Version: 0.1.64.
 
 Entrorove applies only to the task for which it is selected; reading these instructions, discovering capabilities or installing the package never selects or governs another task. Hooks are optional. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 
@@ -21,7 +21,7 @@ Entrorove applies only to the task for which it is selected; reading these instr
    When the model produces a task contract, preserve its `workType`, `risk`, `difficulty`, `crossModule`, `parallel`, `unclear`, `architectureContract`, optional `baselineRef`, and optional `interaction` as returned. Valid work types are `implementation`, `documentation`, `calculation`, `merge`, `review`, `decision`, and `diagnosis`. A `merge` requires a concrete `baselineRef` identifying the branch, tag, commit, or review baseline; keep that baseline unchanged through independent verification. A `decision` requires `interaction`, including a risk description for medium or high risk. Do not fill missing required fields by guessing.
 4. After real cloud acceptance, immediately display **云端任务 <taskNumber> · 已进入**. Preserve `taskNumber` verbatim: it is the homepage sandbox tab number. Keep its UUID `taskId` separately. Run the returned `cloud-watch`, show each real public event and its cursor, and continue the original accepted flow from status. A command log alone is insufficient. No accepted cloud task means no cloud ID or model-execution claim.
 5. For an accepted `flowId`, execute the returned `nextStep` with its required payload. Discover the schema before constructing input. An empty payload is valid only when that operation's schema allows it. Reconnect and refresh only the original flow. A changed snapshot is a binding failure to investigate; do not invent a fresh successful baseline, rebuild a flow to evade it, or erase the old failure. If a fresh scope proof returns `ENTROROVE_SCOPE_PLANNING_REASSESSMENT_REQUIRED` before plan freeze, follow its explicit `workflow-scope-reassess` recovery and retry the original complete request; a local reassessment or snapshot refresh alone does not renew the accepted gate. If the terminal flow truly owns a stale task slot, use the explicit `flow-abandon` lifecycle operation described below before routing the original task again.
-6. All governed mutations use the original authority: `local guarded-write`, `local guarded-delete`, `local guarded-move`, or the original frozen approved runner plan. Native patches, scripts, terminal writes, database mutations and unknown MCP operations must not substitute for the controlled entry. User-authorized task messages use the host's message tool and remain subject to host approval; sending a report does not change the flow or grant execution authority. **A failed gate or unknown outcome must never be replaced with another executor or reported as local success.** Query the original request read-only, repair the cause, and obtain the original flow's valid authority before proceeding.
+6. All governed mutations use the original authority: `local guarded-write`, `local guarded-delete`, `local guarded-move`, or the original frozen approved runner plan. Native patches, scripts, terminal writes, database mutations and unknown MCP operations must not substitute for the controlled entry. User-authorized task messages use the host's message tool and remain subject to host approval; sending a report does not change the flow or grant execution authority. **A failed gate or unknown outcome must never be replaced with another executor or reported as local success.** Query the original request read-only, repair the cause, and obtain the original flow's valid authority before proceeding. If the original scope challenge preparation is absent from authenticated status, `scope-amend` may use the discovered `scope-challenge-retire` lifecycle operation. The server validates the same approved proposal and receiver, atomically fences only an unadmitted challenge, and records a signed retirement without executing that challenge. Recover and acknowledge the original retirement result with GET before a fresh challenge attempt; retain both requests and all failures. An admitted request, issued nonce, scope application or mutation has no missing-challenge retirement path. An uncertain retirement itself permits only its original GET.
    For a member scope, follow a returned `localAction` before submitting execution evidence. `mutation-connect` obtains only the original task's limited editing pass; it keeps unresolved loader files and project configuration read only. After actual writes, refresh the original scope and run `mutation-settle`. Use the returned `previousPassId` for further edits. In a signed member-local plan, `workflow-observe-step` runs the original approved command and tests without a validator private key. A server-signed `localAcceptance` advances local dependencies; a failed test does not. Preserve the raw observation and its absent independent receipt. See [IDE-EXECUTION.md](IDE-EXECUTION.md#local-ide-acceptance).
 7. Read [REUSE-DISCIPLINE.md](REUSE-DISCIPLINE.md) when modifying an existing system. The comparison baseline is the existing implementation in that same repository. It never means another project, another account, or copying external systems.
 8. Read [DELIVERY-BOUNDARIES.md](DELIVERY-BOUNDARIES.md) before claiming a delivered stage or showing consumption. A delivered stage requires a clean boundary and uses `delivered-stage-N`. Blocked or unknown work can wait with recovery data intact; it is not a delivered stage. Display consumption only with a measured baseline.
@@ -31,6 +31,10 @@ When explicitly enabled and selected, the Codex guard preserves this binding ove
 
 After the same real blocked result occurs twice, diagnose it and use its supported recovery path. Do not send a third identical execution call. Read-only status and checkpoint acknowledgements do not count as execution progress. A blocked task may wait with its original flow, queue and recovery data intact; Stop must not force repeated automatic continuation of the same blocked turn.
 
+Chinese and English explicit stop decisions and exit acknowledgements are supported, including `From now on, do not use the skill to execute the remaining tasks.` Keep the name `Entrorove` unchanged in every language. Preserve the original source, task-list order, approvals and all failure records. Ending the current governance session neither cancels nor completes the remaining business work. See the complete bilingual declaration in [IDE-EXECUTION.md](IDE-EXECUTION.md). Questions about translating or adapting that declaration, quotations, screenshots, conditions and failure reports do not select exit.
+
+Direct SDK sessions may have no IDE record. After an actual user exit decision, `entrorove exit` records only an inactive exit marker for the current supported host/session and physical directory; it creates no flow, task, approval or receipt. Existing repository bindings and history remain, and unsafe or invalid records still reject exit explicitly.
+
 If the original flow is terminal and must release its task slot, invoke the discovered `flow-cancel` or `flow-abandon` operation with that same `flowId`. `flow-cancel` records an owner cancellation and keeps the task bound for read-only recovery. `flow-abandon` records the termination, clears acceptance and checkpoint state, unbinds the task and returns `nextStep.operation: "start"` so the original task can be routed again. These operations are available through the server and `local flow-cancel` / `local flow-abandon`; they never reopen the old flow.
 
 When a new user requirement arrives while the original task is unfinished, store its exact text in the private IDE queue. Use `queue` with `{"action":"status"}` to inspect it, then `{"action":"route","messageId":"...","mode":"queued"|"interrupt","priority":"background"|"normal"|"high"|"urgent"}`. An urgent interrupt is admitted only at a completed controlled-call checkpoint; it saves the original flow, task UUID, homepage number and request ID. After the inserted task reaches a verified end acknowledgement, the queue restores that exact parent context and its next operation. Unclassified text and unresolved calls block dependent execution, not waiting for recovery. Unknown outcomes permit only the original read-only recovery. Queue state is bounded, account/session/repository-bound and survives compaction and process restart; it cannot wake a powered-off host.

package/cli-input.mjs

@@ -0,0 +1,22 @@
+import { MODEL_IMAGE_LIMITS } from './model-images.mjs';
+
+export async function readCliInput(input, args) {
+  const maxBytes = ['cloud-task','invoke'].includes(args[0]) ? MODEL_IMAGE_LIMITS.requestBytes : 1_000_000;
+  let bytes = 0;
+  const chunks = [];
+  for await (const chunk of input) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    bytes += buffer.length;
+    if (bytes > maxBytes) throw new Error('Input is too large');
+    chunks.push(buffer);
+  }
+  let value;
+  try { value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks))); }
+  catch { throw new Error('Input must be valid JSON'); }
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('Input must be a JSON object');
+  if (bytes > 1_000_000 && args[0] === 'invoke'
+    && !(value.operation === 'cloud-task' || value.operation === 'start' && Array.isArray(value.images) && value.images.length)) {
+    throw new Error('Input is too large');
+  }
+  return value;
+}

package/cli.mjs

@@ -23,6 +23,7 @@ import { assertIdeExecution, ideGuardBinding, settleBreakGlassSession } from './
 import { writeBreakGlass } from './break-glass.mjs';
 import { exitIdeSession } from './ide-exit.mjs';
 import { installOptions } from './ide-command.mjs';
+import { readCliInput } from './cli-input.mjs';
 const markerName = '.entrorove-managed.json';
 const installFiles = ['SKILL.md', 'CAPABILITY-MAP.md', 'AGREEMENT.md', 'manifest.json', 'IDE-EXECUTION.md', 'REUSE-DISCIPLINE.md', 'DELIVERY-BOUNDARIES.md'];
 const markerSchema = 'entrorove.managed-install/1.0';
@@ -288,15 +289,8 @@ export async function uninstall({ home = os.homedir() } = {}) {
 }
 
 async function stdinJson() {
-  let raw = '';
-  for await (const chunk of process.stdin) {
-    raw += chunk;
-    if (raw.length > 1_000_000) throw new Error('Input is too large');
-  }
-  let value;
-  try { value = JSON.parse(raw); } catch { throw new Error('Input must be valid JSON'); }
-  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('Input must be a JSON object');
   const args = process.argv.slice(2);
+  const value = await readCliInput(process.stdin, args);
   if (!['configure','agreement','review'].includes(args[0])) await assertIdeExecution(args, value);
   return value;
 }

package/cloud-task-client.mjs

@@ -4,6 +4,7 @@ import { parseTransportResponse, requestTransport, trustedOrigin } from './remot
 import { displayIdeEvent, ideClientHeaders, ideTaskIdentity } from './ide-presentation.mjs';
 import { verifyAutomaticFeedback } from './automatic-feedback-client.mjs';
 import { sandboxTaskNumber } from './task-identity.mjs';
+import { prepareCloudImages } from './cloud-task-images.mjs';
 
 const CLOUD_TASK_SCHEMA = 'entrorove.cloud-task/1.0';
 const CLOUD_STATUS_SCHEMA = 'entrorove.cloud-status/1.0';
@@ -38,7 +39,11 @@ function validateInput(input) {
   if (input.task !== undefined && (!input.task || typeof input.task !== 'object' || Array.isArray(input.task) || input.task.goal !== input.goal)) {
     throw new Error('Cloud task must preserve the original task goal');
   }
+  if (input.images !== undefined && (!Array.isArray(input.images) || input.images.length > 4)) {
+    throw new Error('cloud-task images must be an array of at most four images');
+  }
   return { goal: input.goal, ...(input.ideTaskId === undefined ? {} : { ideTaskId: input.ideTaskId }),
+    ...(input.images === undefined ? {} : { images: input.images }),
     ...(input.task === undefined ? {} : { task: input.task }) };
 }
 
@@ -88,7 +93,7 @@ export async function runCloudTask(input, dependencies) {
   const ideTaskId = ideTaskIdentity(task.ideTaskId);
   if (ideTaskId) task.ideTaskId = ideTaskId;
   validateDependencies(dependencies);
-  const id = requestId(task);
+  let id = requestId(task);
   const choice = input.sandboxChoice ?? input.answer;
   await dependencies.install();
   if (!await dependencies.agreementAccepted(dependencies.home)) {
@@ -99,9 +104,12 @@ export async function runCloudTask(input, dependencies) {
   });
   if (choice === 'local') return envelope(task, 'skipped', {
     reason: 'task', executionIsolation: 'local', message: '已退出云端沙箱，采用本地方案继续当前任务。',
-    continuation: { goal: task.goal,...(task.ideTaskId ? { ideTaskId: task.ideTaskId } : {}) },
+    continuation: { goal: task.goal,...(task.ideTaskId ? { ideTaskId: task.ideTaskId } : {}),
+      ...(task.images === undefined ? {} : { images: task.images }) },
   });
 
+  if (task.images !== undefined) task.images = await prepareCloudImages(task.images);
+  id = requestId(task);
   const token = await dependencies.readCredential(dependencies.home);
   const origin = trustedOrigin(dependencies.apiOrigin());
   const metadata = { kind: 'remote', operation: 'cloud-task', requestId: id };

package/cloud-task-images.mjs

@@ -0,0 +1,39 @@
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { isAbsolute } from 'node:path';
+import { inspectModelImage, MODEL_IMAGE_LIMITS, normalizeModelImages } from './model-images.mjs';
+
+async function readImage(path) {
+  if (typeof path !== 'string' || !isAbsolute(path)) throw new Error('Image path must be an explicit absolute file path');
+  let file;
+  try {
+    file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const before = await file.stat();
+    if (!before.isFile() || before.size < 26 || before.size > MODEL_IMAGE_LIMITS.perImageBytes) throw new Error();
+    const bytes = Buffer.alloc(before.size);
+    let offset = 0;
+    while (offset < bytes.length) {
+      const result = await file.read(bytes, offset, bytes.length - offset, offset);
+      if (result.bytesRead === 0) throw new Error();
+      offset += result.bytesRead;
+    }
+    const after = await file.stat();
+    if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs) throw new Error();
+    return bytes;
+  } catch { throw new Error('Input image must be an unchanged readable regular file within the image byte limit'); }
+  finally { await file?.close(); }
+}
+
+/** Only explicitly attached paths are read, after the task's cloud choice. */
+export async function prepareCloudImages(value = []) {
+  if (!Array.isArray(value) || value.length > MODEL_IMAGE_LIMITS.count) throw new Error('At most four input images are supported');
+  const inputs = [];
+  for (const image of value) {
+    if (image && typeof image === 'object' && !Array.isArray(image) && 'path' in image) {
+      if (Object.keys(image).some(key => !['path','detail'].includes(key))) throw new Error('Image path input has unsupported fields');
+      const bytes = await readImage(image.path), { mimeType } = inspectModelImage(bytes);
+      inputs.push({ url: `data:${mimeType};base64,${bytes.toString('base64')}`, ...(image.detail === undefined ? {} : { detail: image.detail }) });
+    } else inputs.push(image);
+  }
+  return normalizeModelImages(inputs).map(({ url, detail }) => ({ url, detail }));
+}

package/ide-exit.mjs

@@ -1,26 +1,66 @@
 import os from 'node:os';
 import path from 'node:path';
-import { ideDirectory, ideDigest, ideError, ideGuardBinding, ideSession, readIdeJson, verifiedIdeGuards } from './ide-session.mjs';
+import { promises as fs } from 'node:fs';
+import { withStateLock } from './local-state-lock.mjs';
+import { ideDirectory, ideDigest, ideError, ideGuardBinding, readIdeJson, writeIdeJson, verifiedIdeGuards } from './ide-session.mjs';
 
 const exactExit = /^(?:(?:请)?(?:停止使用|退出)\s*\$?entrorove|(?:stop using|exit)\s+\$?entrorove)[.!。！]?$/iu;
 const naturalExit = /(?:^|[，,。；;！!\n])\s*(?:从现在开始|接下来|今后)?\s*(?:停止使用|不再使用|不使用)\s*(?:entrorove(?:\s*技能)?|(?:这个|该)?技能)\s*(?:(?:来)?(?:执行|处理|完成|继续)[^，,。；;！!\n]{0,40}(?:任务|工作))?[。！!]?\s*$/iu;
+const englishExit = /^(?:please[,:]?\s+)?(?:from\s+now\s+on[,:]?\s+)?(?:stop\s+using|do\s+not\s+use|no\s+longer\s+use|I\s+will\s+no\s+longer\s+use)\s+(?:\$?entrorove(?:\s+skill)?|(?:this|the)\s+skill)(?:\s+(?:for|to\s+(?:execute|perform|handle|complete|continue))\s+(?:the\s+)?(?:remaining\s+(?:tasks|work)|rest\s+of\s+the\s+(?:tasks|work)))?(?:\s+(?:from\s+now\s+on|anymore|any\s+longer))?[.!]?$/iu;
+export const IDE_EXIT_DECISIONS = Object.freeze({
+  zh: '用户明确决定：错误问题发送给技能修改人员，从现在开始不使用技能来执行剩余任务。仅结束本轮Entrorove治理；保留源码、原清单顺序、审批和全部失败记录，不代表剩余业务任务取消或完成。',
+  en: 'The user has explicitly decided: report the errors to the skill maintainers and stop using the skill for the remaining tasks from now on. End only the current Entrorove governance session; preserve the source code, the original task-list order, approvals, and all failure records. This does not mean that the remaining business tasks are cancelled or completed.',
+});
+const decisionKey = text => text.normalize('NFC').replace(/\s+/gu, '').toLowerCase();
+const decisionKeys = new Set(Object.values(IDE_EXIT_DECISIONS).map(decisionKey));
+const quotedOrConditional = /[`"'“”‘’「」『』<>?？]|如果|假如|假设|示例|截图|引用|\b(?:if|unless|whether|suppose|assuming|example|screenshot|quoted?|translate|translation)\b/iu;
 export function explicitIdeExit(prompt) {
-  if (exactExit.test(prompt)) return true;
-  return !/[`"'“”‘’「」『』<>]|如果|假如|假设|示例|截图|引用/u.test(prompt) && naturalExit.test(prompt);
+  if (typeof prompt !== 'string') return false;
+  const text = prompt.trim().replace(/\bdon['’]t\b/giu, 'do not');
+  if (quotedOrConditional.test(text)) return false;
+  return exactExit.test(text) || naturalExit.test(text) || englishExit.test(text) || decisionKeys.has(decisionKey(text));
+}
+export function ideExitNotice(prompt) {
+  return /\p{Script=Han}/u.test(prompt)
+    ? '用户明确退出本轮 Entrorove 管理；源码、原清单顺序、审批和全部失败记录均保留。剩余业务未取消或完成，未声明验收通过或评分为成功。'
+    : 'The user explicitly ended this Entrorove governance session. The source code, original task-list order, approvals, and all failure records are preserved. Remaining business work is neither cancelled nor completed, and no acceptance or success score is claimed.';
 }
 export function markIdeExited(state, source) {
   if (state.phase !== 'user-exited') state.exitPhase = state.phase;
   state.active = false; state.phase = 'user-exited';
   state.exitDecision = { source, observedAt: new Date().toISOString() };
 }
-export async function exitIdeSession({ home = os.homedir(), environment = process.env } = {}) {
+async function exitState(file, sessionId, cwd) {
+  let state;
+  try { state = await readIdeJson(file); }
+  catch { throw ideError('ENTROROVE_IDE_STORE', 'Current IDE exit state is not a readable private record'); }
+  if (state) {
+    if (state.schemaVersion !== 'entrorove.ide-session/1.0' || state.sessionId !== sessionId
+      || !path.isAbsolute(state.repositoryRoot ?? '')) throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit cannot replace an invalid existing IDE session');
+    return state;
+  }
+  try {
+    await fs.lstat(file);
+    throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit cannot replace an invalid existing IDE session');
+  } catch (cause) { if (cause.code !== 'ENOENT') throw cause; }
+  if (!path.isAbsolute(cwd ?? '')) throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit requires the current physical repository directory');
+  let repositoryRoot;
+  try { repositoryRoot = await fs.realpath(cwd); if (!(await fs.stat(repositoryRoot)).isDirectory()) throw new Error(); }
+  catch { throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit requires the current physical repository directory'); }
+  return { schemaVersion: 'entrorove.ide-session/1.0', sessionId, repositoryRoot, active: false,
+    phase: 'entry', seen: [], blockStreak: 0 };
+}
+export async function exitIdeSession({ home = os.homedir(), environment = process.env, cwd = process.cwd() } = {}) {
   const { host, sessionId } = ideGuardBinding(environment);
-  if (!Object.hasOwn(verifiedIdeGuards, host) || !sessionId) throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit requires the current verified IDE session identity');
-  const directory = await ideDirectory(home), state = await readIdeJson(path.join(directory, `session-${ideDigest(sessionId)}.json`));
-  if (!state || state.sessionId !== sessionId) throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit requires the existing current IDE session');
-  return ideSession({ session_id: sessionId, cwd: state.repositoryRoot }, current => {
+  if (!Object.hasOwn(verifiedIdeGuards, host) || !sessionId || !/^[A-Za-z0-9_-]{1,200}$/u.test(sessionId)) {
+    throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit requires the current verified IDE session identity');
+  }
+  const directory = await ideDirectory(home, true), file = path.join(directory, `session-${ideDigest(sessionId)}.json`);
+  return withStateLock(file, async () => {
+    const current = await exitState(file, sessionId, cwd);
     markIdeExited(current, 'cli');
+    await writeIdeJson(file, { ...current, observedAt: new Date().toISOString() });
     return { schemaVersion: 'entrorove.ide-exit/1.0', status: 'user-exited', sessionId,
       offline: true, network: false, hook: 'not-required', originalFlowPreserved: true, claimsCompletion: false };
-  }, home);
+  });
 }

package/ide-hook.mjs

@@ -13,7 +13,7 @@ import { parseIdeResults, consumeIdeResults } from './ide-results.mjs';
 import { verifyIdeLocalAcceptance } from './ide-local-acceptance.mjs';
 import { registerIdeRequirement, ideQueueContext, unclassifiedIdeRequirements,
   advanceIdeQueue, checkQueuedStart, unfinishedIdeQueue } from './ide-queue.mjs';
-import { explicitIdeExit, markIdeExited } from './ide-exit.mjs';
+import { explicitIdeExit, ideExitNotice, markIdeExited } from './ide-exit.mjs';
 import { appliesIdeHook, hasIdeHookSelection, selectsIdeHook, ideUserPrompt as userPrompt } from './ide-selection.mjs';
 
 const output = (event, extra = {}) => ({ hookSpecificOutput: { hookEventName: event, ...extra } });
@@ -251,7 +251,7 @@ export async function runIdeHook(event, { home } = {}) {
     if (name === 'PreToolUse') state.enforcement = 'enforced';
     if (name === 'UserPromptSubmit' && explicitIdeExit(userPrompt(event))) {
       markIdeExited(state, 'user-prompt');
-      return output(name, { additionalContext: '用户明确退出 Entrorove 管理；原任务仍保留，未验收、未评分为成功。' });
+      return output(name, { additionalContext: ideExitNotice(userPrompt(event)) });
     }
     if (selected) {
       state.active = true;

package/local-contracts.mjs

@@ -38,7 +38,10 @@ const write = { ...step, taskId: identifier, generation: integer(1), executionAt
 add('gate-verify', write, ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath']);
 add('discipline-review|discipline-check', write, ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath']);
 add('guarded-delete|guarded-move', { ...write, declaration: DISCIPLINE_DECLARATION_SCHEMA }, ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath', 'declaration']);
-add('guarded-write', { ...write, content: {}, expectedSha256: nullable(sha256), declaration: DISCIPLINE_DECLARATION_SCHEMA }, ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath', 'content']);
+add('guarded-write', { ...write, content: {}, contentBase64: { type: 'string', maxLength: 16_000_000,
+  pattern: '^[A-Za-z0-9+/]*={0,2}$' }, expectedSha256: nullable(sha256), declaration: DISCIPLINE_DECLARATION_SCHEMA }, ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath']);
+schemas['guarded-write'].oneOf = [{ required: ['content'], not: { required: ['contentBase64'] } },
+  { required: ['contentBase64'], not: { required: ['content'] } }];
 schemas['guarded-write'] = { oneOf: [schemas['guarded-write'], object({ ...step, targetPath: relativePath, content: {},
   expectedSha256: nullable(sha256), handoffId: ledgerIdentifier, epoch: integer(1, 2147483647),
   handoffPass: HANDOFF_WRITE_PASS_SCHEMA, provisionalLease: HANDOFF_PROVISIONAL_LEASE_SCHEMA },

package/local-discipline-gate.mjs

@@ -17,7 +17,8 @@ function declaredWrite(input, pass, baseline) {
     if (!planned || canonical(planned) !== canonical(supplied)) needs('Write declaration must match the original cloud-signed execution plan');
   }
   if (planned && !['modify', 'create', 'format'].includes(planned.kind)) needs('The declared physical action must use its matching guarded entry point');
-  if (planned && planned.kind !== 'format' && planned.kind !== expectedKind) needs('Declared write kind differs from the actual snapshot baseline');
+  const development = pass.writeDelegation?.purpose === 'planned-file-modify' && baseline.exists && planned?.kind === 'create';
+  if (planned && planned.kind !== 'format' && planned.kind !== expectedKind && !development) needs('Declared write kind differs from the actual snapshot baseline');
   return planned;
 }
 function requireException(intent, kind, message) {
@@ -70,12 +71,22 @@ function checkReuse(review, candidate, target, intent, parallelPaths) {
     empty: duplicates.length === 0, complete: review.scanComplete };
 }
 export async function disciplineWritePreflight(input, value, content) {
+  const candidateDigest = sha256(content);
+  // Analyze decoded source bytes through the same original source checks.
+  // Binary assets remain in the exact-byte repository and M/S integrity chain.
+  if (Buffer.isBuffer(content)) {
+    try { content = new TextDecoder('utf-8', { ignoreBOM: true,
+      fatal: /\.(?:[cm]?[jt]sx?|php|py|java|rs|vue|svelte|css)$/i.test(value.target) }).decode(content); }
+    catch { mutationFail14('ENTROROVE_CONTENT_INVALID', 'Source content must contain valid UTF-8 bytes'); }
+  }
   const { pass, target, binding, snapshot, ledger } = value;
   const review = await readDisciplineSnapshot(snapshot), baseline = snapshot.manifest.files.find(file => file.path === target);
   await assertDisciplineRepository(input, binding.root, review, ledger);
   const intent = declaredWrite(input, pass, baseline);
   const original = baseline.exists ? (await readSnapshotCopy14(input, snapshot.snapshotRoot, snapshot.manifest, target)).content.toString('utf8') : '';
-  if (pass.writeDelegation) assertDelegatedSourceModification({ path: target, before: original, after: content });
+  if (pass.writeDelegation?.purpose === 'planned-file-create') {
+    if (baseline.exists || intent?.kind !== 'create' || !pass.newFilePaths.includes(target)) needs('Planned creation cannot overwrite an existing source or replace its create role');
+  } else if (pass.writeDelegation?.purpose === 'preserved-existing-modify') assertDelegatedSourceModification({ path: target, before: original, after: content });
   const candidate = await disciplineRepositoryObservation(input, binding.root, { analyze: true, overrides: new Map([[target, content]]) });
   const removed = checkRemoved(review, candidate.analysis, target, intent, snapshot.manifest.disciplineReviewDigest, input.declaration);
   checkContracts(review, candidate.analysis, target, intent);
@@ -83,5 +94,5 @@ export async function disciplineWritePreflight(input, value, content) {
   const formatting = baseline.exists ? disciplineFormattingLines(original, content, target) : [];
   if (formatting.length) mutationFail14('ENTROROVE_DISCIPLINE_FORMAT_SCOPE', `Formatting touches lines without functional changes: ${target}:${formatting.join(',')}`);
   return { reviewDigest: snapshot.manifest.disciplineReviewDigest, declaredKind: baseline.exists ? 'modify' : 'create', removed, reuse,
-    candidateDigest: sha256(content), comparisonScope: review.comparison.scope };
+    candidateDigest, comparisonScope: review.comparison.scope };
 }