@feng0531/dsh-code-review 0.68.0 → 0.70.0

package/CHANGELOG.md

@@ -2,9 +2,17 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.70.0 — SVN 工作副本标准关键字原文审查
+
+标准 svn:keywords 文件支持行保持映射核验，BASE 收缩与未展开仓库正文比较，原正文/原hash不替换。预览披露映射元数据，模型仍使用原始展开源码、原行号和明确提示，不以关键字变化直接推定缺陷或行为等价。自定义、固定宽度与未闭合展开继续阻断；关键字上下文导航及换行规范化仍待实现。
+
+## 0.69.0 — SVN 固定历史限定调用方发现
+
+callerScopePaths 支持固定 SVN 历史显式目录双侧扫描与同版本字面引用导航。只有匹配侧正文进入上下文，非匹配候选正文不发送模型；命名调用行/声明只绑定同侧已批准正文。可与autoContext组合且共享采集/精确探测/来源/上下文预算，规则与old-only限制保持。报告保留字面发现不完整状态，不冒充完整调用覆盖。502 项串行回归、宿主、隔离安装和四矩阵 CI 通过；原产物/npm/Release 136,030 字节逐字节一致，双哈希、清单与冻结发布说明通过。
+
 ## 0.68.0 — SVN 固定历史三层自动依赖
 
-autoContext 在 SVN 固定历史模式沿两侧 revision 独立捕获最多三层字面 import/include 依赖；用成功的有界父目录清单证明缺失，访问/正文失败直接传播，不以 stderr 猜测不存在。目录/多扩展名保留歧义，排除变更、规则、显式旧侧限制不回流。共享原上下文/读取预算并明确三层截断；预览披露有界清单元数据读取，不扫描全仓或读取工作树。历史调用方仍待实现。
+autoContext 在 SVN 固定历史模式沿两侧 revision 独立捕获最多三层字面 import/include 依赖；用成功的有界父目录清单证明缺失，访问/正文失败直接传播，不以 stderr 猜测不存在。目录/多扩展名保留歧义，排除变更、规则、显式旧侧限制不回流。共享原上下文/读取预算并明确三层截断；预览披露有界清单元数据读取，不扫描全仓或读取工作树。历史调用方仍待实现。496 项串行回归、宿主、隔离安装和四矩阵 CI 通过；原产物/npm/Release 134,056 字节逐字节一致，双哈希、清单与冻结发布说明通过。
 
 ## 0.67.0 — SVN 工作副本显式 mergeinfo 导航
 

package/CORE-ALIGNMENT-TASKS.md

@@ -32,7 +32,9 @@
 
 ## 当前验证结论
 
-- 最近完整回归：489 项通过。
+- 最近完整回归：502 项通过。
+- v0.69.0 已发布固定 SVN 历史限定调用方与autoContext组合，扫描两侧候选、仅命中侧正文捕获，同侧声明导航，统一采集/来源/探测预算；字面发现仍明确不完整。502 项串行回归、宿主、隔离安装和四矩阵 CI 通过；原产物/npm/Release 136,030 字节逐字节一致，双哈希、清单与冻结发布说明通过。全面 SVN 目标仍未完成。
+- v0.68.0 已交付固定 SVN 历史三层 autoContext，逐侧正文/来源固定、父目录有界清单确认精确节点，不吞访问失败，不读工作树。496 项串行回归、宿主、隔离安装和四矩阵 CI 通过；原产物/npm/Release 134,056 字节逐字节一致，双哈希、清单与冻结发布说明通过。历史调用方和全面 SVN 其他缺口继续。
 - v0.67.0 已交付 SVN 工作副本 BASE/工作侧 mergeinfo 的有界显式导航、预览与报告披露，不扩大来源读取或将导航视为审查证明。489 项串行回归、宿主、隔离安装和四矩阵 CI 通过；原产物/npm/Release 130,866 字节逐字节一致，双哈希、清单与冻结发布说明通过。全面 SVN 目标仍未完成。
 - v0.66.1 已修复根目录 mergeinfo 条目在工作副本依赖/调用方候选的非法路径失败，祖先仅合并记录属性变化经双侧比较后允许且仍入指纹。488 项串行回归、宿主、隔离安装和四矩阵 CI 通过；原产物/npm/Release 130,642 字节逐字节一致，双哈希、清单与冻结发布说明通过。全面 SVN 目标仍未完成。
 - v0.66.0 已交付批准历史 mergeinfo 属性的有界来源/区间导航，不展开 revision、不读取来源，也不证明有效继承/归属/审查覆盖。485 项串行回归、宿主、隔离安装及四矩阵 CI 通过；原产物/npm/Release 129,866 字节逐字节一致，双哈希、清单与冻结发布说明通过。跨 URL 分支比较、自动历史链/调用方等仍未完成。

package/README.md

@@ -22,6 +22,8 @@ DSH 的只读代码审查插件。它比较 Git 或 SVN 中的代码变更，使
 
 > 审查 src/api.ts 和 src/client.ts 的改动。先展示审查范围和模型目的地，确认后再执行。不要修改代码。
 
+SVN 工作副本的标准 `svn:keywords` 展开可审查：BASE 收缩须与仓库未展开正文一致，预览披露逐行 identity 映射；模型与证据始终使用原始展开正文和行号，不把规范化结果当行为等价证明。自定义配置、固定宽度和未闭合展开仍拒绝，关键字上下文导航未因此放开。
+
 插件提供两个工具：
 
 1. **code_review_preview**：读取本地变更，列出审查文件、额外上下文、排除原因和模型目的地。此步骤不调用模型。
@@ -68,7 +70,7 @@ DSH 的只读代码审查插件。它比较 Git 或 SVN 中的代码变更，使
 
 commit 与 baseRevision/targetRevision 不能同时使用。oldContextPaths 只能用于 Git/SVN 固定历史审查，不适用于工作副本模式。
 
-SVN 历史模式使用独立参数，不可与 Git 参数混用。示例：`{"svnRevision":"7315","svnAllowNetwork":true}`；或 `{"svnBaseRevision":"7314","svnTargetRevision":"7315","svnAllowNetwork":true}`。只接受固定十进制 revision，不接受 HEAD、日期或相对别名。仅选择工作副本根当前仓库 URL，不支持任意远端 URL；预览会读取明确端点的仓库元数据与源码（远端需显式许可），但不发送模型。历史模式支持显式 contextPaths 与 rulePaths：上下文按目标版和已核验的旧版正文分别保存，规则只读取目标版；共享 20 上下文名额与原采集预算。oldContextPaths 可显式选择仅旧版正文，没有目标占位，选中旧变更复用原身份；不能恢复已排除/阻断/无旧侧的变更。autoContext 可沿旧/新固定 revision 独立捕获最多三层字面依赖；精确子节点通过固定版父目录 immediates 清单确认，可能读取有界同目录元数据但不读取无关正文。共享 512 精确探测、512 清单条目、20 候选/上下文名额、1MiB依赖来源及原历史命令/字节/时间预算，缺失与访问失败不混淆。历史 callerScopePaths 仍未支持，不能回退到当前工作副本。目录新增/删除按后代逐项覆盖，凭据、链接/特殊节点与超限继续拒绝。
+SVN 历史模式使用独立参数，不可与 Git 参数混用。示例：`{"svnRevision":"7315","svnAllowNetwork":true}`；或 `{"svnBaseRevision":"7314","svnTargetRevision":"7315","svnAllowNetwork":true}`。只接受固定十进制 revision，不接受 HEAD、日期或相对别名。仅选择工作副本根当前仓库 URL，不支持任意远端 URL；预览会读取明确端点的仓库元数据与源码（远端需显式许可），但不发送模型。历史模式支持显式 contextPaths 与 rulePaths：上下文按目标版和已核验的旧版正文分别保存，规则只读取目标版；共享 20 上下文名额与原采集预算。oldContextPaths 可显式选择仅旧版正文，没有目标占位，选中旧变更复用原身份；不能恢复已排除/阻断/无旧侧的变更。autoContext 可沿旧/新固定 revision 独立捕获最多三层字面依赖；精确子节点通过固定版父目录 immediates 清单确认，可能读取有界同目录元数据但不读取无关正文。共享 512 精确探测、512 清单条目、20 候选/上下文名额、1MiB依赖来源及原历史命令/字节/时间预算，缺失与访问失败不混淆。历史 callerScopePaths 支持限定目录的旧/新固定版字面引用发现：预览扫描两侧候选正文，包括非匹配文件，只有命中侧上下文发送模型；共享256索引条目、128扫描文件、1MiB导航来源和512精确探测及原采集预算，可与autoContext组合。不能回退到当前工作副本；声明导航只用同版本目标正文，不证明完整调用覆盖。目录新增/删除按后代逐项覆盖，凭据、链接/特殊节点与超限继续拒绝。
 
 自动上下文和引用方发现是保守的文本导航，不是编译器分析。动态导入、宏、重载、继承和实例方法可能无法解析；找到引用不等于证明函数实际被调用。历史调用方的命名导入线索逐侧对应相同版本声明，标明 side/revision；缺少该版本的批准正文不回退另一侧。Git 历史可沿修改前后两侧分别捕获最多三层依赖；SVN 工作副本模式可沿安全的当前节点取得最多三层依赖；固定 revision 历史模式沿旧/新侧分别最多三层依赖，不把一侧正文或工作树替代另一侧。已批准正文中的唯一命名声明和唯一 default 导出会标出位置；同名、重导出或跨侧内容不猜测。命名空间导入后的独立成员调用可导航至唯一命名声明；写入、逃逸或间接调用不推定绑定，不是实例类型分析。
 

package/RELEASE-NOTES.md

@@ -1,15 +1,14 @@
-# v0.68.0 发布说明
+# v0.70.0 发布说明
 
-## SVN 固定历史三层自动依赖
+## SVN 工作副本标准关键字原文审查
 
-固定 revision 审查支持 `autoContext:true`，沿旧/新版本独立捕获最多三层字面 import/include 依赖，不使用工作树或跨侧替代正文。
+允许具有标准 svn:keywords 展开的工作副本文件参与审查，前提是映射可验证且逐行不变。
 
-- 通过固定版本父目录的有界 immediates 清单定位精确子节点；清单成功且无名字才记缺失，访问与正文失败直接终止。
-- 父目录清单可能包含同目录其他名字元数据，不读取无关文件正文，也不扫描全仓；预览披露此行为。
-- 保留目录、多扩展名解析竞争；已排除变更、规则与显式旧侧限定不能借自动导航取得新权限。
-- 共享 512 精确探测、512 清单条目、20 候选/上下文名额、1MiB 依赖来源及历史原命令/字节/时间预算；三层截断明确记录。
-- 真实 SVN 集成覆盖不同版本链、共同依赖两侧正文、脏工作树隔离与零发送预览。
+- BASE 关键字收缩结果须与 `svn cat --ignore-keywords` 仓库正文一致。
+- 原正文、原字节哈希和行号保留，模型与缺陷证据使用原始展开源码；收缩视图仅作映射核验和元数据，不替换证据。
+- 预览披露双侧原正文/视图哈希、收缩数量和 identity 行映射；提示关键字值变化本身不等于代码缺陷。
+- 自定义配置、固定宽度和未闭合展开继续阻断，不能声称所有关键字状态已支持。
 
-历史调用方、跨 URL 分支比较、未提交替换和工作副本关键字映射等继续见 [SVN 支持矩阵](SVN-SUPPORT-MATRIX.md)，全面目标尚未完成。
+关键字上下文导航、换行规范化、未提交替换、跨 URL 分支比较和其他全面 SVN 项仍见 [支持矩阵](SVN-SUPPORT-MATRIX.md)，目标尚未完成。
 
 使用见 [README](README.md)。

package/SVN-SUPPORT-MATRIX.md

@@ -21,14 +21,14 @@
 | 普通新增/删除目录及后代 | v0.60.0 已发布：补齐默认 status 隐藏的删除后代，离线递归枚举与末尾清单复核；普通结构目录只在后代全选且可审查时开放，凭据/阻断子项导致目录覆盖不足。461 项串行回归、宿主、隔离安装与四矩阵 CI 通过；原产物/npm/Release 118,284 字节逐字节一致，双哈希/清单/冻结发布说明通过 | 第二批普通目录子批 |
 | 替换、删除再新增、文件/目录类型变化 | 普通与复制替换分别用 SVN_REPLACEMENT/SVN_COPIED_REPLACEMENT 诊断；离线探测确认前者 BASE 无 pristine，后者可能返回复制来源，禁止伪造旧侧。已新增未接入采集的 candidate-only 完整 diff 重建组件及真实离线测试：匹配完整工作侧，拒绝片段、错侧、截断与超限。diff 仍不能独立证明旧节点/编码/旧属性，因此未提交工作副本真实双侧替换仍未支持，不能把辅助组件算作支持完成。v0.64.1 已发布已提交固定历史版本的同路径 deleted/added 合并，真实目标旧/新正文与属性通过测试；481 项串行回归、宿主、隔离安装、四矩阵 CI 与原包/npm/Release 128,279 字节、双哈希/清单/发布说明通过。v0.65.0 已发布已提交固定历史文件/目录类型替换：分侧 kind/正文/属性、预览披露和目录后代覆盖；482 项串行回归、宿主、隔离安装、四矩阵 CI 与原包/npm/Release 128,792 字节、双哈希/清单/发布说明通过。未提交替换仍拒绝 | 第二批：区分 BASE 旧节点与目标节点 |
 | 缺失、文本/属性/树冲突、阻塞 | v0.60.1 已发布稳定状态诊断：SVN_MISSING_NODE/OBSTRUCTED_NODE/INCOMPLETE_NODE/TEXT_CONFLICT/PROPERTY_CONFLICT/TREE_CONFLICT 等，预览与报告透传 blockCode。463 项串行回归、宿主、隔离安装、四矩阵 CI 与原包/npm/Release 119,462 字节、双哈希/清单/发布说明通过。诊断不算真实双侧支持，仍需后续实现 | 第三批：明确状态诊断；不能合成不存在的工作侧或声称审核通过 |
-| svn:keywords、svn:eol-style | keywords 当前阻断；换行保留原文但无规范化映射 | 第三批：双侧可验证映射，保留原字节和定位 |
+| svn:keywords、svn:eol-style | 本地已接入标准关键字行保持映射，BASE收缩与cat --ignore-keywords核验、原正文及hash保留、预览披露与模型原行号证据通过；不以规范化正文代替证据或证明行为等价。自定义/固定宽度/未闭合展开仍阻断；504项串行全量回归通过，尚需宿主/隔离安装和发布核验，尚未发布。换行保留原文但无规范化映射 | 第三批：双侧可验证映射，保留原字节和定位 |
 | svn:special/链接 | 当前阻断，不跟随链接取正文 | 第三批：如支持只审链接目标数据；不沿链接读取文件 |
 | switched、externals、稀疏/混合 revision | 多数拒绝；调用方/依赖链要求祖先 normal | 第四批：明确仓库边界与独立来源，禁止隐式跨仓读取 |
 | 固定 revision 单提交 | v0.62.0 已发布 svnRevision：r-1/r 固定对象、UUID/URL/peg/operative revision 逐侧绑定，正文不读工作树；远端显式 svnAllowNetwork。472 项串行回归、宿主、隔离安装、四矩阵 CI 及原包/npm/Release 125,486 字节、双哈希/清单/发布说明通过。历史上下文/规则/调用方尚未支持 | 第五批：新增明确 SVN 参数与冻结身份 |
 | 固定 revision 区间 | v0.62.0 已发布 svnBaseRevision/svnTargetRevision，固定树端点 summary+逐侧 cat/proplist，目录后代与属性纳入预算，不建临时工作树；同上述完整发布验证。分支间不同 URL 和历史上下文尚未支持 | 第五批：固定树端点与逐路径差异 |
 | 分支复制、分支间比较、合并来源 | v0.66.0 已发布批准历史 mergeinfo 属性的来源路径/区间导航，保留非继承标记、有界不展开 revision、不读取分支源码；invalid/limited 明确且不裁剪。485 项串行回归、宿主、隔离安装、四矩阵 CI 与原包/npm/Release 129,866 字节、双哈希/清单/发布说明通过；v0.67.0 已发布工作副本 BASE/工作侧属性的同一有界导航及预览/报告披露；489 项串行回归、宿主、隔离安装、四矩阵 CI 与原包/npm/Release 130,866 字节、双哈希/清单/发布说明通过。有效继承 mergeinfo、跨 URL 比较、源码归属/合并提交覆盖仍未支持 | 第六批：URL/peg/operative revision 与 mergeinfo 导航披露 |
 | 当前三层依赖与限定目录调用方 | v0.66.1 已发布根目录仅 mergeinfo 变化下的自动依赖/限定调用方修复：根目录不作源码候选，祖先双侧属性仅 mergeinfo 差异可通过且入指纹；其他属性/unsafe 状态仍拒绝。488 项串行回归、宿主、隔离安装、四矩阵 CI 与原包/npm/Release 130,642 字节、双哈希/清单/发布说明通过。其他祖先/混合状态继续待验证 | 第四批补祖先/混合状态组合 |
-| 历史两侧上下文与调用方 | v0.63.0 已发布显式 contextPaths 固定双侧来源及目标 rulePaths，UUID/URL/peg/operative revision/原字节与正文 hash 验证，禁止脏工作树与排除项回流。477 项串行回归、宿主、隔离安装、四矩阵 CI 与原包/npm/Release 127,355 字节、双哈希/清单/发布说明通过。v0.64.0 已发布 oldContextPaths 旧侧独有正文、SVN 来源专用校验、预览披露与选中删除身份复用；479 项串行回归、宿主、隔离安装、四矩阵 CI 与原包/npm/Release 127,879 字节、双哈希/清单/发布说明通过；本地开发了注入固定版本 lookup/read 能力的三层历史依赖导航核心，逐侧共享512探测/20候选/1MiB来源与上下文名额；排除项、旧侧限定和规则隔离测试通过。本地已接入固定父目录有界清单 lookup，清单成功证明缺失、访问失败直接传播，真实旧/新版本链和脏工作树隔离专项通过，待 v0.68.0 最终回归发布；历史调用方仍未实现 | 第六批：逐侧固定版本，不能回退至工作副本 |
+| 历史两侧上下文与调用方 | v0.63.0 已发布显式 contextPaths 固定双侧来源及目标 rulePaths，UUID/URL/peg/operative revision/原字节与正文 hash 验证，禁止脏工作树与排除项回流。477 项串行回归、宿主、隔离安装、四矩阵 CI 与原包/npm/Release 127,355 字节、双哈希/清单/发布说明通过。v0.64.0 已发布 oldContextPaths 旧侧独有正文、SVN 来源专用校验、预览披露与选中删除身份复用；479 项串行回归、宿主、隔离安装、四矩阵 CI 与原包/npm/Release 127,879 字节、双哈希/清单/发布说明通过；本地开发了注入固定版本 lookup/read 能力的三层历史依赖导航核心，逐侧共享512探测/20候选/1MiB来源与上下文名额；排除项、旧侧限定和规则隔离测试通过。v0.68.0 已发布三层逐侧历史 autoContext，固定父目录有界清单 lookup，清单成功证明缺失、访问失败直接传播，真实旧/新版本链和脏工作树隔离通过。496 项串行回归、宿主、隔离安装、四矩阵 CI 与原包/npm/Release 134,056 字节、双哈希/清单/发布说明通过；本地新增逐侧固定 revision 调用方核心能力接口：共享256索引/128扫描/1MiB正文/512侧探测，命中侧才捕获正文，规则/变更排除与old-only限制保留，同侧命名调用声明导航测试通过；本地已接入固定 SVN 显式目录递归清单/同侧正文、统一30秒/512命令/元数据/正文预算，caller 与依赖共享精确探测及来源上限，真实集成专项13项通过；v0.69.0 已发布历史限定调用方和autoContext组合；502项串行全量回归、组合模型输入隔离、宿主/隔离安装、四矩阵 CI 通过。原包/npm/Release 136,030 字节、双哈希/清单/发布说明通过；字面发现仍不证明完整调用覆盖 | 第六批：逐侧固定版本，不能回退至工作副本 |
 | 真正 r7314→r7315 样本 | 用户未提供隔离副本路径；本地类似复现不是该样本验收 | 获得路径后只读生成预览，不自动发送模型 |
 
 ## 每批发布门禁

package/index.mjs

@@ -12,7 +12,7 @@ export function apply(ctx, config = {}) {
   };
   ctx.tools.register({
     name: 'code_review_preview', description: 'Preview Git/SVN working-copy or Git commit/range review scope and model destination without sending source to a model. repositoryPath selects an explicit child repository relative to session workspace; file paths are repository-relative. Preview each repository separately. Show the preview before execution.',
-    parameters: { type: 'object', additionalProperties: false, properties: { svnRevision: { type: 'string', description: 'SVN fixed numeric revision reviewed against revision minus one. Requires SVN working-copy root; no HEAD/date aliases.' }, svnBaseRevision: { type: 'string', description: 'SVN fixed numeric old endpoint; requires svnTargetRevision, mutually exclusive with svnRevision and Git revision parameters.' }, svnTargetRevision: { type: 'string', description: 'SVN fixed numeric new endpoint, greater than old endpoint. Fixed repository objects, not working-copy text. Supports explicitly selected target context with verified baseline provenance and target rules; explicit old-only context is also supported with fixed SVN provenance; autoContext follows at most three independent fixed-side dependency layers with bounded parent listings and shared capture budgets; historical callers remain unsupported.' }, svnAllowNetwork: { type: 'boolean', description: 'Explicit opt-in to read the working-copy repository URL at fixed SVN revisions during preview/execute; preview sends no source to a model. Required for non-file repository URLs; default denies remote access. Does not allow checkout/update/merge or arbitrary URLs.' }, reviewRounds: { type: 'integer', minimum: 1, maximum: 3, description: 'Explicit independent review passes, default 1. Preview discloses extra sends; later passes omit the first risk plan. Shares existing timeout, call and retrieval budgets, not provider reasoning effort. Bound to this preview; execute cannot override.' }, oldContextPaths: { type: 'array', maxItems: 20, items: { type: 'string' }, description: 'Explicit Git/SVN historical baseline-only context paths. Git uses fixed blobs; SVN uses UUID/URL/peg/operative revision/hash. Shares 20 context slots. No target text is inferred; selected old changes reuse original identity, excluded changes cannot reenter. Unsupported on working reviews.' }, callerScopePaths: { type: 'array', minItems: 1, maxItems: 4, items: { type: 'string' }, description: 'Explicit non-root repository-relative directories for bounded tracked literal reverse import/include discovery. Git/SVN working review or Git fixed commit/range review. SVN uses offline normal nodes, rejects unsafe ancestor states and special/keyword properties. Historical sides share scan budgets and use object blobs only. Preview reads candidate bodies, including nonmatches; only captured matching context is sent. Navigation only, not complete caller coverage.' }, businessRequirement: { type: 'string', maxLength: 16384, description: 'Optional business constraint text up to 16KiB UTF8; untrusted data, not evidence or permission. Bound to preview and sent in review phases.' }, commit: { type: 'string', description: 'Git commit versus sole parent; root empty, merge requires range.' }, baseRevision: { type: 'string', description: 'Git old endpoint; requires targetRevision, mutually exclusive with commit.' }, targetRevision: { type: 'string', description: 'Git new endpoint, exact tree endpoints not merge-base. Explicit context uses target tree with available baseline provenance; oldContextPaths is baseline-only. Historical caller discovery scans fixed sides; explicit rules use target-tree blobs.' }, repositoryPath: { type: 'string', description: 'Workspace-relative explicit child Git/SVN repository root, forward slashes; omit for current repository.' }, selectedPaths: { type: 'array', items: { type: 'string' }, maxItems: 200 }, autoContext: { type: 'boolean', description: 'Opt in to tracked literal import/include context shown in preview. Working Git follows changed and explicitly selected context sources at most 3 dependency layers under shared 512 exact probes, 20 candidates/context slots, 1MiB source and 30s verification budget. Git history follows at most 3 baseline/target dependency layers with shared limits, object reads only; SVN follows at most 3 safe offline current-side layers with exact path probes and node/ancestor identity verification, sharing limits; no SVN historical review. Not semantic binding or complete definitions.' }, contextPaths: { type: 'array', items: { type: 'string' }, maxItems: 20 }, rulePaths: { type: 'array', items: { type: 'string' }, maxItems: 4 } } },
+    parameters: { type: 'object', additionalProperties: false, properties: { svnRevision: { type: 'string', description: 'SVN fixed numeric revision reviewed against revision minus one. Requires SVN working-copy root; no HEAD/date aliases.' }, svnBaseRevision: { type: 'string', description: 'SVN fixed numeric old endpoint; requires svnTargetRevision, mutually exclusive with svnRevision and Git revision parameters.' }, svnTargetRevision: { type: 'string', description: 'SVN fixed numeric new endpoint, greater than old endpoint. Fixed repository objects, not working-copy text. Supports explicitly selected target context with verified baseline provenance and target rules; explicit old-only context is also supported with fixed SVN provenance; autoContext follows at most three independent fixed-side dependency layers with bounded parent listings and shared capture budgets; callerScopePaths supports bounded fixed-side SVN historical literal discovery; only matched sides captured, never complete caller coverage.' }, svnAllowNetwork: { type: 'boolean', description: 'Explicit opt-in to read the working-copy repository URL at fixed SVN revisions during preview/execute; preview sends no source to a model. Required for non-file repository URLs; default denies remote access. Does not allow checkout/update/merge or arbitrary URLs.' }, reviewRounds: { type: 'integer', minimum: 1, maximum: 3, description: 'Explicit independent review passes, default 1. Preview discloses extra sends; later passes omit the first risk plan. Shares existing timeout, call and retrieval budgets, not provider reasoning effort. Bound to this preview; execute cannot override.' }, oldContextPaths: { type: 'array', maxItems: 20, items: { type: 'string' }, description: 'Explicit Git/SVN historical baseline-only context paths. Git uses fixed blobs; SVN uses UUID/URL/peg/operative revision/hash. Shares 20 context slots. No target text is inferred; selected old changes reuse original identity, excluded changes cannot reenter. Unsupported on working reviews.' }, callerScopePaths: { type: 'array', minItems: 1, maxItems: 4, items: { type: 'string' }, description: 'Explicit non-root repository-relative directories for bounded tracked literal reverse import/include discovery. Git/SVN working review or fixed Git/SVN historical review. SVN uses offline normal nodes, rejects unsafe ancestor states and special/keyword properties. Historical sides share scan budgets and use object blobs only. Preview reads candidate bodies, including nonmatches; only captured matching context is sent. Navigation only, not complete caller coverage.' }, businessRequirement: { type: 'string', maxLength: 16384, description: 'Optional business constraint text up to 16KiB UTF8; untrusted data, not evidence or permission. Bound to preview and sent in review phases.' }, commit: { type: 'string', description: 'Git commit versus sole parent; root empty, merge requires range.' }, baseRevision: { type: 'string', description: 'Git old endpoint; requires targetRevision, mutually exclusive with commit.' }, targetRevision: { type: 'string', description: 'Git new endpoint, exact tree endpoints not merge-base. Explicit context uses target tree with available baseline provenance; oldContextPaths is baseline-only. Historical caller discovery scans fixed sides; explicit rules use target-tree blobs.' }, repositoryPath: { type: 'string', description: 'Workspace-relative explicit child Git/SVN repository root, forward slashes; omit for current repository.' }, selectedPaths: { type: 'array', items: { type: 'string' }, maxItems: 200 }, autoContext: { type: 'boolean', description: 'Opt in to tracked literal import/include context shown in preview. Working Git follows changed and explicitly selected context sources at most 3 dependency layers under shared 512 exact probes, 20 candidates/context slots, 1MiB source and 30s verification budget. Git history follows at most 3 baseline/target dependency layers with shared limits, object reads only; SVN follows at most 3 safe offline current-side layers with exact path probes and node/ancestor identity verification, sharing limits; no SVN historical review. Not semantic binding or complete definitions.' }, contextPaths: { type: 'array', items: { type: 'string' }, maxItems: 20 }, rulePaths: { type: 'array', items: { type: 'string' }, maxItems: 4 } } },
     output,
     async execute(args, exec) { const preview = await service.preview(args, exec); return { json: JSON.stringify(preview), markdown: '' }; },
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.68.0",
+  "version": "0.70.0",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/service.mjs

@@ -49,7 +49,7 @@ export function createReviewService(llm, { capture = captureSnapshot, now = Date
         while (previews.size >= maxPreviews) previews.delete(previews.keys().next().value);
         const previewId = randomUUID();
         previews.set(previewId, { ...current, target, options, rounds, snapshotId: snapshot.id, expires: now() + ttlMs });
-        return { ...(options.businessRequirement!==undefined?{businessRequirement:{text:options.businessRequirement,hash:hash(options.businessRequirement),bytes:Buffer.byteLength(options.businessRequirement)}}:{}), previewId, plan, snapshotId: snapshot.id, repositoryRoot: snapshot.root, vcs: snapshot.vcs, ...(snapshot.history ? { history: snapshot.history } : {}), ...(snapshot.mergeSources ? {mergeSources:snapshot.mergeSources} : {}), model: current.route, modelSendingEnabled: allowModelSending, files: snapshot.files.map(f => ({ path: f.path, eligibility: f.eligibility, reason: f.reason, ...(f.rawStatus==='replaced'&&snapshot.history?.vcs==='svn'?{oldKind:f.oldKind,newKind:f.newKind,nodeNotice:f.nodeNotice}:{}), ...(f.blockCode ? {blockCode:f.blockCode} : {}), ...(f.copySource ? {copySource:f.copySource,copyNotice:f.copyNotice} : {}) })), contextPaths: snapshot.context.map(c => c.path), ...(options.oldContextPaths !== undefined ? {oldContextPaths:options.oldContextPaths,oldContextSources:snapshot.context.filter(c=>c.oldOnly).map(c=>({path:c.path,side:'context-old',revision:c.oldRevision,...(c.oldSvnSource?{svnSource:c.oldSvnSource}:{blobOid:c.oldBlobOid}),hash:c.oldHash}))} : {}), ...(snapshot.callerDiscovery ? {callerDiscovery:snapshot.callerDiscovery} : {}), ...(snapshot.autoContext ? { autoContext: snapshot.autoContext } : {}), rules: (snapshot.rules ?? []).map(({ path, hash }) => ({ path, hash })), notice: (snapshot.history?.vcs==='svn'&&options.autoContext===true?'SVN历史autoContext为精确依赖定位读取固定版本父目录有界清单，包含同目录非匹配名字元数据；仅匹配捕获正文发送模型，不扫描全仓，不用工作树替代历史版本。':'') + (options.oldContextPaths !== undefined ? 'oldContextPaths仅为baseline旧侧正文，无目标侧替代；选中变更复用原old身份，旧侧不能证明新侧行为。' : '') + (snapshot.callerDiscovery ? 'callerScopePaths已授权预览读取限定目录内tracked候选正文，包括不匹配文件；非匹配正文不发送模型，匹配捕获上下文会发送。仅字面引用导航，不是函数调用或完整调用覆盖。' : '') + (enableRiskPlanning ? '执行按plan阈值决定风险假设规划，小变更可跳过独立规划但仍主审并复核；计划不是证据，所有阶段共享原预算。' : '') + '执行会向上述模型提供方发送可审查文件两侧内容、预览列出的显式/自动上下文、所选项目规则全文及预览业务需求文本。模型可在该快照范围内多轮只读检索，不读取范围外文件；候选生成后会进行证据与反证复核，两阶段各最多3轮检索，共享每文件120秒和总模型调用100次预算；复核不能证明缺陷成立。plan.reviewRounds为独立审查工作量，非模型reasoning effort；后续轮不带首轮风险计划，所有轮共享原超时与预算。plan仅预检初始输入，ready不代表已审查；minimumCalls不含后续检索/复核/动态业务综合；多文件可先进行业务分组，分组失败保留原组并记录限制，动态综合数执行前未知，实际预算可能不足。请先向用户展示范围，获得确认后执行。' };
+        return { ...(options.businessRequirement!==undefined?{businessRequirement:{text:options.businessRequirement,hash:hash(options.businessRequirement),bytes:Buffer.byteLength(options.businessRequirement)}}:{}), previewId, plan, snapshotId: snapshot.id, repositoryRoot: snapshot.root, vcs: snapshot.vcs, ...(snapshot.history ? { history: snapshot.history } : {}), ...(snapshot.mergeSources ? {mergeSources:snapshot.mergeSources} : {}), model: current.route, modelSendingEnabled: allowModelSending, files: snapshot.files.map(f => ({ path: f.path, eligibility: f.eligibility, reason: f.reason, ...(f.keywordMapping?{keywordMapping:f.keywordMapping,textNotice:f.textNotice}:{}), ...(f.rawStatus==='replaced'&&snapshot.history?.vcs==='svn'?{oldKind:f.oldKind,newKind:f.newKind,nodeNotice:f.nodeNotice}:{}), ...(f.blockCode ? {blockCode:f.blockCode} : {}), ...(f.copySource ? {copySource:f.copySource,copyNotice:f.copyNotice} : {}) })), contextPaths: snapshot.context.map(c => c.path), ...(options.oldContextPaths !== undefined ? {oldContextPaths:options.oldContextPaths,oldContextSources:snapshot.context.filter(c=>c.oldOnly).map(c=>({path:c.path,side:'context-old',revision:c.oldRevision,...(c.oldSvnSource?{svnSource:c.oldSvnSource}:{blobOid:c.oldBlobOid}),hash:c.oldHash}))} : {}), ...(snapshot.callerDiscovery ? {callerDiscovery:snapshot.callerDiscovery} : {}), ...(snapshot.autoContext ? { autoContext: snapshot.autoContext } : {}), rules: (snapshot.rules ?? []).map(({ path, hash }) => ({ path, hash })), notice: (snapshot.history?.vcs==='svn'&&options.autoContext===true?'SVN历史autoContext为精确依赖定位读取固定版本父目录有界清单，包含同目录非匹配名字元数据；仅匹配捕获正文发送模型，不扫描全仓，不用工作树替代历史版本。':'') + (options.oldContextPaths !== undefined ? 'oldContextPaths仅为baseline旧侧正文，无目标侧替代；选中变更复用原old身份，旧侧不能证明新侧行为。' : '') + (snapshot.callerDiscovery ? 'callerScopePaths已授权预览读取限定目录内tracked候选正文，包括不匹配文件；非匹配正文不发送模型，匹配捕获上下文会发送。仅字面引用导航，不是函数调用或完整调用覆盖。' : '') + (enableRiskPlanning ? '执行按plan阈值决定风险假设规划，小变更可跳过独立规划但仍主审并复核；计划不是证据，所有阶段共享原预算。' : '') + '执行会向上述模型提供方发送可审查文件两侧内容、预览列出的显式/自动上下文、所选项目规则全文及预览业务需求文本。模型可在该快照范围内多轮只读检索，不读取范围外文件；候选生成后会进行证据与反证复核，两阶段各最多3轮检索，共享每文件120秒和总模型调用100次预算；复核不能证明缺陷成立。plan.reviewRounds为独立审查工作量，非模型reasoning effort；后续轮不带首轮风险计划，所有轮共享原超时与预算。plan仅预检初始输入，ready不代表已审查；minimumCalls不含后续检索/复核/动态业务综合；多文件可先进行业务分组，分组失败保留原组并记录限制，动态综合数执行前未知，实际预算可能不足。请先向用户展示范围，获得确认后执行。' };
       } finally { busy = false; }
     },
     async execute(args, exec) {

package/src/svn-history-callers.mjs

@@ -0,0 +1,60 @@
+import {validateCallerScopes} from './caller-index.mjs';
+import {callerCandidates} from './caller-candidates.mjs';
+import {relativePath,hash} from './content.mjs';
+import {isSecretPath} from './secret-path.mjs';
+
+// Fixed revision capabilities only. All failures propagate; no worktree fallback.
+export async function svnHistoryCallers(files,history,scopes,context,{index,lookup,read,signal,maxContextFiles=20,rulePaths=[]}={}) {
+ const approved=validateCallerScopes(scopes);
+ if(!Array.isArray(files)||files.length>200||!Array.isArray(context)||context.length>maxContextFiles||!Number.isSafeInteger(maxContextFiles)||maxContextFiles<1||maxContextFiles>20||![index,lookup,read].every(fn=>typeof fn==='function')||!Array.isArray(rulePaths)||!history||!['base','target'].every(k=>typeof history[k]==='string'&&/^(0|[1-9][0-9]*)$/.test(history[k])&&Number.isSafeInteger(Number(history[k]))))throw new Error('Invalid SVN historical caller capability or budget');
+ const changed=new Set(files.map(f=>f.path)),rules=new Set(rulePaths),candidates=[],scanned=[],allProbes=new Set();
+ let records=0,scanBytes=0;
+ for(const [side,revision]of [['old',history.base],['new',history.target]]){
+  signal?.throwIfAborted();const entries=await index(approved,revision);
+  if(!Array.isArray(entries))throw new Error('Invalid SVN historical caller index');
+  const seen=new Set(),sources=[];
+  for(const entry of entries){
+   if(++records>256)throw new Error('SVN historical caller index limit exceeded');
+   const name=relativePath(entry?.path);
+   if(!approved.some(scope=>name.startsWith(scope+'/'))||seen.has(name)||!['file','dir'].includes(entry.kind))throw new Error('Unsafe SVN historical caller index');
+   seen.add(name);
+   if(entry.kind!=='file'||changed.has(name)||rules.has(name)||isSecretPath(name)||!/\.(mjs|cjs|js|jsx|ts|tsx|c|cc|cpp|cxx|h|hh|hpp|hxx|shader|hlsl|glsl|cginc|hlsli|compute)$/i.test(name))continue;
+   if(scanned.length>=128)throw new Error('SVN historical caller scan count exceeded');
+   const value=await read(name,revision);signal?.throwIfAborted();
+   if(typeof value?.content?.text!=='string'||value.kind!=='file'||value.source?.operativeRevision!==revision)throw new Error('Invalid fixed SVN caller body');
+   const bodyBytes=value.content.bytes??Buffer.byteLength(value.content.text);
+   if(!Number.isSafeInteger(bodyBytes)||bodyBytes<0||bodyBytes>256*1024||Buffer.byteLength(value.content.text)>256*1024)throw new Error('Invalid fixed SVN caller size');
+   scanBytes+=bodyBytes;
+   if(scanBytes>1024*1024)throw new Error('SVN historical caller scan source limit exceeded');
+   const source={path:name,...value.content,svnSource:value.source,side,revision};sources.push(source);scanned.push(source);
+  }
+  const targets=files.map(file=>{
+   const kind=side==='old'?file.oldKind:file.newKind,body=side==='old'?file.left:file.right;
+   return {...file,right:kind==='file'?body:undefined,rightExists:kind==='file'&&typeof body?.text==='string'};
+  });
+  const requested=callerCandidates(targets,sources,[]).probePaths,present=[];
+  for(const name of requested){
+   signal?.throwIfAborted();allProbes.add(JSON.stringify([revision,name]));if(allProbes.size>512)throw new Error('SVN historical caller probe limit exceeded');
+   const node=await lookup(name,revision);
+   if(node!==null&&(!node||!['file','dir'].includes(node.kind)))throw new Error('Invalid fixed SVN caller probe');
+   if(node)present.push(name); // Directories remain resolution competitors.
+  }
+  const plan=callerCandidates(targets,sources,present);
+  for(const candidate of plan.candidates){
+   const receipt={...candidate,side,revision,status:'pending'};candidates.push(receipt);
+   const source=sources.find(value=>value.path===candidate.fromPath);
+   let item=context.find(value=>value.path===source.path);
+   if(item?.oldOnly&&side==='new'){receipt.status='blocked';receipt.reason='Explicit old-only context cannot approve target caller';continue;}
+   if(!item&&context.length>=maxContextFiles){receipt.status='blocked';receipt.reason='Context file limit exceeded';continue;}
+   const existing=side==='old'?item?.oldText:item?.text;
+   if(existing!==undefined&&existing!==source.text)throw new Error('Fixed SVN caller context content mismatch');
+   if(!item){item={path:source.path};context.push(item);}
+   if(side==='new')Object.assign(item,{text:source.text,hash:source.hash,bytes:source.bytes,encoding:source.encoding,revision,svnSource:source.svnSource});
+   else Object.assign(item,{oldText:source.text,oldHash:hash(source.text),oldRevision:revision,oldSvnSource:source.svnSource});
+   receipt.status='captured';
+  }
+ }
+ // Only matched sides are retained. A new-side match never approves an old body.
+ for(const item of context)if(item.text===undefined&&item.oldText!==undefined)item.oldOnly=true;
+ return {scopes:approved,scanned:scanned.map(({path,hash,bytes,revision,side,svnSource})=>({path,hash,bytes,revision,side,svnSource})),scannedBytes:scanBytes,records,probeCount:allProbes.size,candidates,capturedPaths:[...new Set(candidates.filter(c=>c.status==='captured').map(c=>c.fromPath))].sort(),incomplete:true,notice:'Fixed-side literal references in explicit scopes only; nonmatches scanned but not captured. Not function calls, semantic binding or complete caller coverage.'};
+}

package/src/svn-history.mjs

@@ -7,6 +7,8 @@ import {captureProjectRules} from './project-rules.mjs';
 import {snapshotMergeSources} from './svn-mergeinfo.mjs';
 import {fixedSvnLookup} from './svn-history-lookup.mjs';
 import {svnHistoryDependencies} from './svn-history-dependencies.mjs';
+import {svnHistoryCallers} from './svn-history-callers.mjs';
+import {validateCallerScopes} from './caller-index.mjs';
 
 const revision = value => {
   if (typeof value !== 'string' || !/^(0|[1-9][0-9]*)$/.test(value) || !Number.isSafeInteger(Number(value))) throw new Error('SVN revision must be a fixed nonnegative decimal string');
@@ -45,7 +47,7 @@ export function mergeSvnHistoryRecord(previous, item) {
 export async function captureSvnHistory(cwd,options={}) {
   const range=svnHistoryRange(options);
   if (options.svnAllowNetwork!==undefined && typeof options.svnAllowNetwork!=='boolean') throw new Error('Invalid SVN network opt-in');
-  if (options.callerScopePaths!==undefined) throw new Error('SVN historical callers are not supported yet');
+  if (options.callerScopePaths!==undefined) validateCallerScopes(options.callerScopePaths);
   const contextPaths=options.contextPaths??[],oldContextPaths=options.oldContextPaths??[],rulePaths=options.rulePaths??[],maxContextFiles=options.maxContextFiles??20;
   if(!Number.isSafeInteger(maxContextFiles)||maxContextFiles<1||maxContextFiles>20||!Array.isArray(contextPaths)||contextPaths.length>maxContextFiles||new Set(contextPaths).size!==contextPaths.length||!Array.isArray(rulePaths)||rulePaths.length>4||new Set(rulePaths).size!==rulePaths.length||rulePaths.some(name=>contextPaths.includes(name)))throw new Error('Invalid SVN historical context or rule selection');
   if(!Array.isArray(oldContextPaths)||oldContextPaths.length>20||new Set(oldContextPaths).size!==oldContextPaths.length||contextPaths.length+oldContextPaths.length>maxContextFiles||oldContextPaths.some(name=>contextPaths.includes(name)||rulePaths.includes(name)))throw new Error('Invalid SVN old context selection');
@@ -169,8 +171,8 @@ export async function captureSvnHistory(cwd,options={}) {
   const rules=await captureProjectRules(root,rulePaths,{signal,files,read:async(_root,name)=>{
     const value=await targetContent(name);if(value.content.bytes>16*1024)throw new Error('Rule file size limit exceeded');return value.content;
   }});
-  let autoContext;
-  if(options.autoContext===true){
+  let autoContext,callerDiscovery;
+  if(options.autoContext===true||options.callerScopePaths!==undefined){
     const probes=fixedSvnLookup({signal,list:async(name,rev)=>{
       const directory=await identity(name,rev);if(directory['@_kind']!=='dir')throw new Error('Historical lookup parent is not directory');
       const data=xml(await run(['list','--xml','--depth','immediates','-r',rev,'--',at(name,rev)]));
@@ -179,14 +181,52 @@ export async function captureSvnHistory(cwd,options={}) {
       if(one.length!==1||!one[0]||one[0]['@_path']!==at(name,rev).slice(0,-rev.length-1))throw new Error('Historical directory listing identity mismatch');
       return (one[0].entry??[]).map(entry=>({name:entry.name,kind:entry['@_kind']}));
     }});
-    autoContext=await svnHistoryDependencies(files,range,context,{lookup:probes.lookup,read:readSource,signal,maxContextFiles,rulePaths});
-    autoContext.directoryEntries=probes.usage().entries;
+    const exactProbes=new Map();
+    const lookup=async(name,rev)=>{
+      const key=JSON.stringify([rev,name]);
+      if(!exactProbes.has(key)){
+        if(exactProbes.size>=512)throw new Error('SVN historical shared navigation probe limit exceeded');
+        exactProbes.set(key,await probes.lookup(name,rev));
+      }
+      return exactProbes.get(key);
+    };
+    let navigationBytes=context.reduce((sum,item)=>sum+Buffer.byteLength(item.text??'')+Buffer.byteLength(item.oldText??''),0);
+    const navigationRead=async(name,rev)=>{
+      const value=await readSource(name,rev);navigationBytes+=value.content.bytes;
+      if(navigationBytes>1024*1024)throw new Error('SVN historical shared navigation source limit exceeded');
+      return value;
+    };
+    if(navigationBytes>1024*1024)throw new Error('SVN historical shared navigation source limit exceeded');
+    if(options.callerScopePaths!==undefined){
+      let indexRecords=0;
+      const index=async(scopes,rev)=>{
+        const entries=[];
+        for(const scope of scopes){
+          const node=await lookup(scope,rev);if(!node)continue;if(node.kind!=='dir')throw new Error('Historical caller scope is not directory');
+          await identity(scope,rev);
+          const data=xml(await run(['list','--xml','--depth','infinity','-r',rev,'--',at(scope,rev)]));
+          const lists=data.lists?.list,one=Array.isArray(lists)?lists:[lists];
+          if(one.length!==1||!one[0]||one[0]['@_path']!==at(scope,rev).slice(0,-rev.length-1))throw new Error('Historical caller listing identity mismatch');
+          for(const entry of one[0].entry??[]){
+            if(++indexRecords>256)throw new Error('Historical caller shared index limit exceeded');
+            const name=relativePath(entry.name);entries.push({path:scope+'/'+name,kind:entry['@_kind']});
+          }
+        }
+        return entries;
+      };
+      callerDiscovery=await svnHistoryCallers(files,range,options.callerScopePaths,context,{index,lookup,read:navigationRead,signal,maxContextFiles,rulePaths});
+    }
+    if(options.autoContext===true){
+      autoContext=await svnHistoryDependencies(files,range,context,{lookup,read:navigationRead,signal,maxContextFiles,rulePaths});
+      autoContext.directoryEntries=probes.usage().entries;
+    }
+    if(callerDiscovery)callerDiscovery.navigationSourceBytes=navigationBytes;
   }
   // Read the same fixed summary and repository identity again; never use HEAD.
   const after=await run(['diff','--summarize','--xml','--notice-ancestry','-r',range.base+':'+range.target,'--',at('.',range.target)]);
   if(!isDeepSummary(summary,after))throw new Error('SVN historical summary changed during capture');
   await identity('.',range.base);await identity('.',range.target);
-  const snapshot={schemaVersion:1,vcs:'svn',root,repositoryUuid:local.repository.uuid,context,...(rules.length?{rules}:{}),...(autoContext?{autoContext}:{}),history:{...range,vcs:'svn',url,repositoryUuid:local.repository.uuid,pegRevision:range.target,networkAccess,...(mergeSources.length?{mergeSources}:{}),semantics:'fixed revision tree endpoints; no merge attribution or working text'},files};
+  const snapshot={schemaVersion:1,vcs:'svn',root,repositoryUuid:local.repository.uuid,context,...(rules.length?{rules}:{}),...(autoContext?{autoContext}:{}),...(callerDiscovery?{callerDiscovery}:{}),history:{...range,vcs:'svn',url,repositoryUuid:local.repository.uuid,pegRevision:range.target,networkAccess,...(mergeSources.length?{mergeSources}:{}),semantics:'fixed revision tree endpoints; no merge attribution or working text'},files};
   const serialized=JSON.stringify(snapshot);if(Buffer.byteLength(serialized)>maxSnapshotBytes)throw new Error('SVN historical snapshot limit exceeded');
   return {...snapshot,id:hash(serialized)};
 }

package/src/svn-keyword-mapping.mjs

@@ -0,0 +1,22 @@
+import {hash} from './content.mjs';
+const standard=new Set(['Date','LastChangedDate','Revision','Rev','LastChangedRevision','Author','LastChangedBy','HeadURL','URL','Id','Header']);
+
+// A line-preserving view only. Raw source remains authoritative for evidence.
+export function svnKeywordMapping(text,configuration){
+ if(typeof text!=='string'||typeof configuration!=='string'||Buffer.byteLength(text)>256*1024||Buffer.byteLength(configuration)>4096)throw new Error('Invalid SVN keyword mapping input');
+ const enabled=new Set(configuration.trim().split(/\s+/).filter(Boolean));
+ if([...enabled].some(name=>!standard.has(name)))throw new Error('Unsupported SVN custom keyword configuration');
+ let replacements=0;
+ const normalized=text.replace(/\$([A-Za-z][A-Za-z0-9]*)(:{1,2})([^\r\n$]*)\$/g,(literal,name,separator,value)=>{
+  if(!enabled.has(name))return literal;
+  if(separator!==':'||!/^ .+ $/.test(value))throw new Error('Unsupported SVN fixed-width or ambiguous keyword expansion');
+  replacements++;return '$'+name+'$';
+ });
+ // Reject enabled malformed expansions, rather than silently offering a partial mapping.
+ for(const name of enabled){
+  const escaped=name.replace(/[.*+?^${}()|[\]\\]/g,'\\$&');
+  if(new RegExp('\\$'+escaped+':').test(normalized))throw new Error('Incomplete SVN keyword expansion mapping');
+ }
+ if(text.split('\n').length!==normalized.split('\n').length)throw new Error('SVN keyword mapping changed line identity');
+ return {text:normalized,rawTextHash:hash(text),textHash:hash(normalized),replacements,lineMapping:'identity',status:'candidate-only',notice:'Line-preserving standard keyword view, not evidence of equivalent program behavior; raw source remains required. Capture must independently verify BASE contraction and keep raw evidence.'};
+}

package/src/svn.mjs

@@ -1,6 +1,7 @@
 import { isSecretPath } from './secret-path.mjs';
 import { svnStateIssue } from './svn-state.mjs';
 import { snapshotMergeSources } from './svn-mergeinfo.mjs';
+import { svnKeywordMapping } from './svn-keyword-mapping.mjs';
 import { realpath, lstat } from 'node:fs/promises';
 import path from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
@@ -108,7 +109,8 @@ export async function captureSvn(cwd, options = {}) {
       const leftProps = hasBase ? await properties(root, name, true, options) : {};
       const rightProps = status === 'deleted' || status === 'unversioned' ? {} : await properties(root, name, false, options);
       if ('svn:special' in leftProps || 'svn:special' in rightProps) throw new Error('SVN special nodes are excluded');
-      if (leftProps['svn:keywords'] || rightProps['svn:keywords']) throw new Error('SVN keyword expansion requires a verified text mapping; currently blocked');
+      const keywordText=!!(leftProps['svn:keywords']||rightProps['svn:keywords']);
+      if(keywordText&&kind!=='file')throw new Error('SVN keyword mapping requires regular file');
       item.textNotice = 'Text preserves SVN cat output and working bytes. CRLF/LF differences alone are not code defects.';
       for (const key of [...new Set([...Object.keys(leftProps), ...Object.keys(rightProps)])].sort()) {
         if (leftProps[key] !== rightProps[key]) item.properties.push({ name: key, old: leftProps[key] ?? null, new: rightProps[key] ?? null });
@@ -126,6 +128,16 @@ export async function captureSvn(cwd, options = {}) {
       } else {
         item.left = decode(hasBase ? await svn(root, ['cat', '-r', 'BASE', '--', target(name)], { ...options, maxBytes: maxFileBytes }) : Buffer.alloc(0));
         item.right = status === 'deleted' ? decode(Buffer.alloc(0)) : await readLocal(root, name, options);
+        if(keywordText){
+          const old=svnKeywordMapping(item.left.text,leftProps['svn:keywords']??''),current=svnKeywordMapping(item.right.text,rightProps['svn:keywords']??'');
+          if(hasBase){
+            const repository=decode(await svn(root,['cat','--ignore-keywords','-r','BASE','--',target(name)],{...options,maxBytes:maxFileBytes}));
+            if(old.text!==repository.text)throw new Error('SVN BASE keyword mapping differs from repository text');
+          }
+          const summary=({text,...metadata})=>({...metadata,status:'verified-line-view'});
+          item.keywordMapping={old:summary(old),new:summary(current)};
+          item.textNotice+=' Standard keyword mapping verified line identity; raw expanded source remains the only evidence. Keyword value changes alone are not code defects; normalization does not prove runtime equivalence.';
+        }
       }
     } catch (error) {
       signal?.throwIfAborted(); item.eligibility = 'blocked'; item.reason = error.message;