@@ -49,12 +49,26 @@ pub(crate) fn observe(args: &SyntaxLintArguments, deadline: Instant) -> Value {
     }) {
         return report;
     }
-    if !((args.language == "c" && path.extension().is_some_and(|s| s == "c"))
+    // 头文件进入同语言显式观察；`.h` 在 cpp 语言下保持 C/C++ 歧义拒绝，不猜语言。
+    if !((args.language == "c" && path.extension().is_some_and(|s| s == "c" || s == "h"))
         || (args.language == "cpp"
-            && path
-                .extension()
-                .and_then(|s| s.to_str())
-                .is_some_and(|s| matches!(s, "cpp" | "cc" | "cxx" | "C" | "CPP" | "cp" | "c++"))))
+            && path.extension().and_then(|s| s.to_str()).is_some_and(|s| {
+                matches!(
+                    s,
+                    "cpp"
+                        | "cc"
+                        | "cxx"
+                        | "C"
+                        | "CPP"
+                        | "cp"
+                        | "c++"
+                        | "hpp"
+                        | "hh"
+                        | "hxx"
+                        | "H"
+                        | "h++"
+                )
+            })))
     {
         return report;
     }
 
@@ -249,6 +249,12 @@ fn observe_captured(
     }) {
         return feedback("eslint_source_kind_not_supported");
     }
+    // TS 方言按包根绑定 tsconfig.json 输入身份；缺失不阻塞，非普通文件不可信。
+    // 该输入只用于冻结本轮观察，不证明项目 parser 实际读取或适用该文件。
+    let tsconfig = match typescript_project_config(cwd, &source) {
+        Ok(value) => value.filter(|path| path != config && path != entry && path != node),
+        Err(reason) => return feedback(reason),
+    };
     // 临时区仅承载本轮原生报告；工作台另存脱敏观察，不声称保留完整原生证据。
     let id = format!(
         "eslint-{}-{}",
@@ -261,12 +267,16 @@ fn observe_captured(
         return feedback("eslint_private_workspace_unavailable");
     };
     let mut hashes = BTreeMap::new();
-    for (path, limit) in [
+    let mut inputs = vec![
         (node, 128 * 1024 * 1024),
         (entry, 16 * 1024 * 1024),
         (config, 1024 * 1024),
         (&source, 16 * 1024 * 1024),
-    ] {
+    ];
+    if let Some(tsconfig) = &tsconfig {
+        inputs.push((tsconfig, 1024 * 1024));
+    }
+    for (path, limit) in inputs {
         if Instant::now() >= deadline {
             return feedback("request_deadline_exceeded");
         }
@@ -333,6 +343,103 @@ pub(crate) fn feedback(reason: &str) -> Value {
         "eslint_config_untrusted"=>"项目本地 ESLint 已发现，但配置是链接、特殊文件或不可读；恢复原配置后原生复检",
         "eslint_scope_requires_explicit_file"=>"当前入口需显式单文件；项目目录与完整源集调度尚未接通，不将目录标为已检查",
         "request_cancelled"|"request_deadline_exceeded"=>"重新安排原工具检查预算；中断不要求修改源码",
+        "eslint_parser_or_configuration_diagnostic"=>"原生 ESLint 报告含解析级致命诊断；先核对项目 parser 是否覆盖该文件方言（如 typescript-eslint 与 tsconfig），复现同一文件的解析错误后再修复源码或恢复适用 parser，并用同一入口与配置复检；不能据此关闭其它文件的检查",
+        "eslint_unattributed_diagnostic"=>"报告存在无法归属规则的诊断，常见于文件被原配置 ignores/files 排除；核对原配置覆盖与本轮范围后用同一入口复检；被排除文件不能记为已检查",
+        "eslint_version_mismatch"=>"本地 ESLint 包声明版本与原生入口实际输出不一致；核对 node_modules 内包身份与版本后用受控 Node 复检，不修改源码",
+        "eslint_report_invalid"|"eslint_report_read_failed"|"eslint_execution_evidence_failed"=>"本轮原生报告缺失或不可解析；先核对原配置能否加载（配置无效时原生进程可能不产出报告），重跑同一命令并保留证据，不把无报告当作干净或源码违规",
+        "eslint_tsconfig_untrusted"=>"TypeScript 方言检查需绑定包内 tsconfig.json，当前它是链接或特殊文件；恢复普通文件后用同一入口和配置复检，不修改源码",
         _=>"核对原配置、parser/插件与本轮规则；按原生发现修复后用同一入口和配置复检，抑制及未知覆盖需核查，任务不能自行关闭",
     }})
 }
+/// TS 方言源码在包根的 tsconfig.json 输入；缺失返回 None 不阻塞，
+/// 链接/特殊文件/不可判定返回不可信原因，观察保持未完成。
+fn typescript_project_config(
+    cwd: &Path,
+    source: &Path,
+) -> Result<Option<std::path::PathBuf>, &'static str> {
+    if !source
+        .extension()
+        .and_then(|extension| extension.to_str())
+        .is_some_and(|extension| matches!(extension, "ts" | "tsx" | "mts" | "cts"))
+    {
+        return Ok(None);
+    }
+    let path = cwd.join("tsconfig.json");
+    match std::fs::symlink_metadata(&path) {
+        Ok(metadata) if metadata.is_file() => Ok(Some(path)),
+        Ok(_) => Err("eslint_tsconfig_untrusted"),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(None),
+        Err(_) => Err("eslint_tsconfig_untrusted"),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::typescript_project_config;
+    use std::{fs, os::unix::fs::symlink, path::PathBuf};
+
+    #[test]
+    fn tsconfig_binding_routes_only_typescript_dialects_and_regular_files() {
+        let root = std::env::temp_dir()
+            .canonicalize()
+            .unwrap()
+            .join(format!("cg-tsconfig-route-{}", std::process::id()));
+        fs::create_dir(&root).unwrap();
+        let (js, mjs, ts, tsx, mts, cts) = (
+            root.join("app.js"),
+            root.join("app.mjs"),
+            root.join("app.ts"),
+            root.join("app.tsx"),
+            root.join("app.mts"),
+            root.join("app.cts"),
+        );
+        for path in [&js, &mjs, &ts, &tsx, &mts, &cts] {
+            fs::write(path, "x").unwrap();
+        }
+        // 无 tsconfig：JS/TS 方言都不阻塞。
+        for path in [&js, &mjs, &ts, &tsx] {
+            assert_eq!(typescript_project_config(&root, path), Ok(None));
+        }
+        fs::write(root.join("tsconfig.json"), "{}").unwrap();
+        // JS 方言不绑定；TS 方言按包根绑定。
+        assert_eq!(typescript_project_config(&root, &js), Ok(None));
+        assert_eq!(typescript_project_config(&root, &mjs), Ok(None));
+        let expected = Ok(Some(root.join("tsconfig.json")));
+        assert_eq!(typescript_project_config(&root, &ts), expected);
+        assert_eq!(typescript_project_config(&root, &tsx), expected);
+        assert_eq!(typescript_project_config(&root, &mts), expected);
+        assert_eq!(typescript_project_config(&root, &cts), expected);
+        // 链接/目录不可信：不执行原生也不宣称绑定成功。
+        fs::remove_file(root.join("tsconfig.json")).unwrap();
+        fs::write(root.join("tsconfig.real.json"), "{}").unwrap();
+        symlink(root.join("tsconfig.real.json"), root.join("tsconfig.json")).unwrap();
+        assert_eq!(
+            typescript_project_config(&root, &ts),
+            Err("eslint_tsconfig_untrusted")
+        );
+        fs::remove_file(root.join("tsconfig.json")).unwrap();
+        fs::create_dir(root.join("tsconfig.json")).unwrap();
+        assert_eq!(
+            typescript_project_config(&root, &ts),
+            Err("eslint_tsconfig_untrusted")
+        );
+        fs::remove_dir_all(&root).unwrap();
+    }
+
+    #[test]
+    fn tsconfig_binding_allows_foreign_package_root_without_input() {
+        let root = std::env::temp_dir()
+            .canonicalize()
+            .unwrap()
+            .join(format!("cg-tsconfig-foreign-{}", std::process::id()));
+        fs::create_dir(&root).unwrap();
+        let source = root.join("app.ts");
+        fs::write(&source, "x").unwrap();
+        // 包根无 tsconfig 时 TS 方言检查保持可执行，不虚构输入。
+        assert_eq!(
+            typescript_project_config(&PathBuf::from("/definitely/not/here"), &source),
+            Ok(None)
+        );
+        fs::remove_dir_all(&root).unwrap();
+    }
+}
@@ -196,6 +196,7 @@ pub(crate) fn valid_reason(reason: &str) -> bool {
             | "eslint_version_evidence_failed"
             | "eslint_version_execution_incomplete"
             | "eslint_version_mismatch"
+            | "eslint_tsconfig_untrusted"
             | "eslint_execution_evidence_failed"
             | "eslint_report_read_failed"
             | "eslint_native_execution_incomplete"
@@ -355,6 +356,9 @@ pub(crate) fn guidance(root: &Path, fact: &Value) -> Value {
         Some("eslint_config_selection_unresolved" | "eslint_config_untrusted") => {
             "项目本地 ESLint 已发现；核对原项目实际选中的 flat config、文件类型与来源，恢复配置后原生复检，不修改无依据源码"
         }
+        Some("eslint_tsconfig_untrusted") => {
+            "TypeScript 方言检查需绑定包内 tsconfig.json，当前它是链接或特殊文件；恢复普通文件后用同一入口和配置复检，不修改无依据源码"
+        }
         Some("eslint_local_entry_untrusted" | "eslint_local_dependency_path_untrusted") => {
             "项目本地 ESLint 路径不可信；核对链接、文件类型和来源后原生复检，不重复安装或修改无依据源码"
         }
 
@@ -41,6 +41,24 @@ pub fn run_eslint_probe(req: &EslintProbeRequest, cancelled: &AtomicBool) -> Esl
         (&req.command.config, 1024 * 1024),
     ];
     inputs.extend(req.command.sources.iter().map(|p| (p, 16 * 1024 * 1024)));
+    // 与请求构造方镜像：TS 方言且包根存在 tsconfig.json 时冻结为输入身份。
+    // 任何存在形态都纳入核对，中途换成链接或新建都能被识别为输入变化而非静默放行。
+    let mut tsconfig_input: Option<PathBuf> = None;
+    if req.command.sources.iter().any(|p| {
+        p.extension()
+            .and_then(|extension| extension.to_str())
+            .is_some_and(|extension| matches!(extension, "ts" | "tsx" | "mts" | "cts"))
+    }) {
+        let tsconfig = req.cwd.join("tsconfig.json");
+        if std::fs::symlink_metadata(&tsconfig).is_ok()
+            && !inputs.iter().any(|(path, _)| **path == tsconfig)
+        {
+            tsconfig_input = Some(tsconfig);
+        }
+    }
+    if let Some(tsconfig) = &tsconfig_input {
+        inputs.push((tsconfig, 1024 * 1024));
+    }
     if req.expected_sha256.len()
         != inputs
             .iter()
 
@@ -62,7 +62,11 @@ pub fn run(args: &[String]) -> ExitCode {
     let deadline = started + Duration::from_millis(arguments.timeout_ms);
     let root = match arguments.root.canonicalize() {
         Ok(path) if path.is_dir() => path,
-        _ => return emit(empty_feedback(), arguments.json),
+        _ => {
+            let mut feedback = empty_feedback();
+            mark_request_cancellation(&mut feedback);
+            return emit(feedback, arguments.json);
+        }
     };
     let cancelled = AtomicBool::new(false);
     let selection = crate::go_tool_selection::GoToolSelection::discover(arguments.tool);
@@ -77,9 +81,21 @@ pub fn run(args: &[String]) -> ExitCode {
             arguments.json,
         );
     }
+    // 持久化身份保持可导入的 incomplete/3；公开反馈按取消契约标 130。
+    mark_request_cancellation(&mut feedback);
     emit(feedback, arguments.json)
 }
 
+/// 请求取消只改公开反馈的退出语义；不撤销已观察的原生结果或发现。
+pub(crate) fn mark_request_cancellation(feedback: &mut Value) {
+    if feedback["reason"] == "request_cancelled"
+        || codeguard_runtime::sigint_cancellation_requested()
+    {
+        feedback["command_status"] = json!("cancelled");
+        feedback["exit_code"] = json!(130);
+    }
+}
+
 /// 与 `check all` 共用同一受控 Go 观察，不赋予策略或门禁权威。
 pub(crate) fn observe_for_check(
     root: &Path,
@@ -910,9 +926,13 @@ fn parse_go_version(stdout: &[u8]) -> Option<&str> {
 }
 
 fn emit(feedback: Value, json_format: bool) -> ExitCode {
+    let exit = feedback["exit_code"].as_u64().unwrap_or(3) as u8;
     if json_format {
         println!("{feedback}");
     } else {
+        if feedback["command_status"] == "cancelled" {
+            println!("Go 检查已取消（退出 130）；保留已观察结果，不签发任何通过结论");
+        }
         println!(
             "Go vet：{}",
             feedback["native_status"].as_str().unwrap_or("incomplete")
@@ -941,5 +961,5 @@ fn emit(feedback: Value, json_format: bool) -> ExitCode {
             feedback["reason"].as_str().unwrap_or("unknown")
         );
     }
-    ExitCode::from(3)
+    ExitCode::from(exit)
 }
@@ -10,6 +10,25 @@ pub(crate) fn run(
     deadline: Instant,
     json_output: bool,
 ) -> ExitCode {
+    // 取消后不得继续启动 WASM 候选初检；保留取消语义并按契约返回 130。
+    if native["reason"] == "request_cancelled" || codeguard_runtime::sigint_cancellation_requested()
+    {
+        let report = json!({"schema_version":"0.7.0","report_type":"go_lint_fallback_feedback","operation":"lint","language":"go",
+            "command_status":"cancelled","exit_code":130,"authority":"local_unverified","coverage_proven":false,"delivery_decision":"not_evaluated",
+            "tool_selection":selection,"native_report":native,
+            "syntax_candidates":{"status":"not_run","reason":"request_cancelled","execution_phase":"after_native","authority":"candidate_unqualified","delivery_decision":"incomplete",
+                "source_file_count":0,"skipped_count":0,"unrouted_count":0,"native_preferred_count":0,"observations":[],
+                "next_action":"请求已取消；不缓存也不签发 clean，需要时重新执行原检查"},
+            "syntax_tasks":{"status":"not_attempted"},
+            "preliminary_result":"incomplete","native_tool_requirement":"required",
+            "next_actions":["request_cancelled_rerun_after_review"]});
+        if json_output {
+            println!("{report}");
+        } else {
+            println!("Go 检查已取消（退出 130）；候选初检未运行，不签发任何通过结论");
+        }
+        return ExitCode::from(130);
+    }
     let syntax = observe(root, deadline);
     let tasks = crate::syntax_confirmation::persist(root, &syntax, deadline);
     let result = preliminary_result(&syntax);
@@ -18,11 +37,14 @@ pub(crate) fn run(
     } else {
         "required"
     };
-    let report = json!({"schema_version":"0.7.0","report_type":"go_lint_fallback_feedback","operation":"lint","language":"go",
+    let mut report = json!({"schema_version":"0.7.0","report_type":"go_lint_fallback_feedback","operation":"lint","language":"go",
         "command_status":"incomplete","exit_code":3,"authority":"local_unverified","coverage_proven":false,"delivery_decision":"not_evaluated",
         "tool_selection":selection,"native_report":native,"syntax_candidates":syntax,"syntax_tasks":tasks,
         "preliminary_result":result,"native_tool_requirement":requirement,
         "next_actions":if requirement == "required" {json!(["prepare_project_native_go_then_confirm_candidates","preserve_source_until_native_confirmation"])}else {json!(["recommend_project_native_go_for_complete_lint","retain_unfinished_project_obligations"])}});
+    // 候选初检期间的取消同样保留取消语义；已取得的候选观察不撤回也不升级为通过。
+    crate::go_lint_command::mark_request_cancellation(&mut report);
+    let exit = report["exit_code"].as_u64().unwrap_or(3) as u8;
     if json_output {
         println!("{report}");
     } else {
@@ -57,7 +79,7 @@ pub(crate) fn run(
             report["syntax_tasks"]["status"]
         );
     }
-    ExitCode::from(3)
+    ExitCode::from(exit)
 }
 
 #[cfg(feature = "wasm-precheck")]