@feng0531/dsh-code-review 0.81.0 → 0.81.1

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.81.1 — 取消默认内部超时和计数配额
+
+修复外层延长仍被采集/导航30秒、模型120秒等内部截止终止的问题。默认不限制采集命令数或总模型调用数，遵循用户/宿主取消。保留来源、内存与模型输入保护，不声称解除宿主/提供方限制。
+
 ## 0.81.0 — 多会话独立审查与全项目当前源码
 
 不同会话不再被全局busy阻塞，预览/锁/取消/模型/预算独立。新增reviewMode=project，跟踪当前源码分批检查并保持准确覆盖；不是差异审查，不把空旧侧当历史基线。项目模式有明确总量和共享调用限制，未完成不冒充成功。

package/DEVELOPMENT.md

@@ -16,19 +16,19 @@
 
 服务按DSH session对象隔离缓存和锁，同一会话changes/project两种模式共用互斥锁；不同会话可并行，模型调用与取消由各请求生命周期约束。宿主dispose终止全部会话服务。全项目是跟踪文件的当前源码分批，不是多仓库汇总或跨批次语义分析。
 
-项目捕获最多10000清单节点、1000选择节点、16MiB，总模型调用100、执行10分钟；初次捕获/末尾检查及执行重新捕获均有显式截止。SVN项目模式拒绝不支持节点属性，不隐式继承固定历史审查的网络权限。
+项目捕获最多10000清单节点、1000选择节点、16MiB，不设默认总模型调用次数或执行秒表，初次捕获/复核均遵循宿主与用户取消。SVN项目模式拒绝不支持节点属性，不隐式继承固定历史审查的网络权限。
 
 ## 审查预算
 
 除 README 中的文件和输入上限外：
 
-- 每个主文件的模型与检索阶段共享默认 120 秒；关联综合沿用相关主文件的生命周期，不因切换阶段重新计时。
+- 采集、导航、命令及模型审查默认不设插件内部秒表；内部API调用者仍可显式指定timeoutMs（0表示无内部截止）。用户/宿主取消仍传播并等待清理。
 - 每阶段最多三轮检索；全局最多 50 次读取请求，返回内容累计 256 KiB，单次最多 64 KiB，读取最多 200 行。
-- Git 工作区依赖链最多三层、512 个精确路径查询、20 个候选、手动入口与自动依赖共享 1 MiB 正文；文件读取与最终复核共享 30 秒。
-- SVN工作副本全采集共享512条命令、1MiB元数据和30秒截止，含初始/重复采集、导航、属性和末尾验证；cat输出另受16MiB总硬上限约束。历史采集也有独立的512命令、1MiB元数据、30秒及正文上限。
-- SVN 依赖链最多三层，以精确本地路径和安全正常节点捕获；512 路径、20 候选和上下文。工作副本显式上下文、自动依赖、调用方扫描（含非命中）及关键字BASE核验共享1 MiB来源账本与30秒含核验截止，不能切换阶段重新获得额度；切换、外部与不支持属性节点拒绝。
-- Git 历史依赖链同样最多三层，两侧共享 512 个路径、20 个候选和上下文、1 MiB 正文及 30 秒；只读取固定对象。
-- 引用方发现最多四个不重叠的非根目录；128 个候选正文共 1 MiB，目录索引最多 256 条／64 KiB，竞争路径最多 512 个。发现与复核共享 30 秒。
+- Git 工作区依赖链最多三层、512 个精确路径查询、20 个候选、手动入口与自动依赖共享 1 MiB 正文；文件读取与最终复核共享宿主/用户取消信号。
+- SVN工作副本全采集记录命令次数、共享1MiB元数据内存保护，不设默认命令次数或时间截止，含初始/重复采集、导航、属性和末尾验证；cat输出另受16MiB总硬上限约束。历史采集也有独立的元数据与正文内存保护，不以命令次数或时间中断。
+- SVN 依赖链最多三层，以精确本地路径和安全正常节点捕获；512 路径、20 候选和上下文。工作副本显式上下文、自动依赖、调用方扫描（含非命中）及关键字BASE核验共享1 MiB来源内存账本与宿主/用户取消信号，不能切换阶段重新获得额度；切换、外部与不支持属性节点拒绝。
+- Git 历史依赖链同样最多三层，两侧共享 512 个路径、20 个候选和上下文、1 MiB 正文内存保护和取消信号；只读取固定对象。
+- 引用方发现最多四个不重叠的非根目录；128 个候选正文共 1 MiB，目录索引最多 256 条／64 KiB，竞争路径最多 512 个。发现与复核共享宿主/用户取消信号。
 
 达到上限必须阻断或说明未完成，不能静默扩大范围、丢弃证据或重新计时。
 

package/README.md

@@ -225,7 +225,7 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 
 项目模式只接受reviewMode、repositoryPath和可选selectedPaths，不与历史revision、autoContext、规则或调用方参数混用。默认全部跟踪节点；不读取未跟踪/忽略文件、子模块、外部仓库及链接目标。目录只作清单记录，源码按批次审查；跨批次不宣称完整调用图或全程序语义分析。
 
-清单上限10000节点，单次选择最多1000节点/16MiB，12节点一批，单文件256KiB；超限明确拒绝，缩小选择后必须重新预览。单次采集全部批次共享4096条命令与8MiB元数据、120秒采集截止（执行阶段受10分钟总截止限制）；全部批次共享本会话100次模型调用和10分钟执行时间，耗尽保留pending/partial，不重新给下一批额度。SVN为本地已观察清单，稀疏/外部/链接及不支持属性显示限制；不证明仓库远端完整覆盖。
+清单上限10000节点，单次选择最多1000节点/16MiB，12节点一批，单文件256KiB；超限明确拒绝，缩小选择后必须重新预览。单次采集共享8MiB元数据内存保护，不按命令条数、插件秒表或模型调用次数中断；耗时受宿主/模型提供方限制，用户可随时取消。SVN为本地已观察清单，稀疏/外部/链接及不支持属性显示限制；不证明仓库远端完整覆盖。
 
 报告分别给出总数、completed、excluded、blocked、pending和每批快照。completed只表示所选捕获文件已处理，不代表代码正确；排除与阻断从不算完成。代码或清单变化会拒绝旧预览，运行后无法复核则标记outdated。
 
@@ -285,7 +285,7 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 | 全部快照 | 4 MiB |
 | 额外上下文 | 手动与自动来源共 20 个文件 |
 | 单次模型输入 | 约 96 KiB |
-| 一次审查的模型调用 | 所有阶段共享 100 次 |
+| 内部时间／总调用次数 | 不设默认截止；遵循宿主与用户取消 |
 
 大变更可按保留原行号的差异窗口分批分析；无法容纳的部分会明确标为未完成。建议先按功能或模块选择一小批文件。详细读取和时间预算见 [开发与发布指南](DEVELOPMENT.md)。
 

package/RELEASE-NOTES.md

@@ -1,17 +1,17 @@
-# v0.81.0 发布说明
+# v0.81.1 发布说明
 
-## 多个会话可以同时审查项目
+## 修复预览被内部秒表中断
 
-不同DSH会话的执行锁、预览、模型路由和预算独立。同一项目或不同项目均可同时审查；取消一个请求不影响另一个会话。同一会话仍串行，跨会话previewId不能使用。不是“一次自动汇总多个仓库”的功能。
+移除Git/SVN预览、上下文/依赖/调用方导航、mergeinfo、项目模式的默认内部时间截止。单条命令不再默认30秒被终止，模型审查不再默认120秒被取消。延长宿主外层预算后，不会再被这些插件秒表提前截断。
 
-## 审查整个项目当前代码
+同时移除采集命令次数和审查总模型调用次数的默认硬配额；只统计，不按固定条数终止。内部API显式指定timeoutMs/maxCalls时仍可设置限制，默认timeoutMs=0。
 
-预览时传入 `{"reviewMode":"project"}`，读取当前仓库跟踪文件，包含未改动文件；默认changes模式保持原变更审查。先查看完整选择清单与排除原因，再确认执行。
+用户/宿主取消、停用插件、只读权限、预览确认、来源复核全部保留。等待长任务时可以取消；宿主或模型提供方自己的超时不由本插件解除。
 
-- 当前源码缺陷检查不要求问题由最近提交引入；空旧侧仅为传输占位，不是空历史版本。
-- 分批保留来源哈希，全部批次共享本会话100次模型调用和10分钟。清单最多10000节点，单次选择最多1000节点/16MiB，超限明确拒绝；单文件上限256KiB。
-- 报告区分完成、排除、阻断及未完成路径；没有完成的批次保留pending/partial，来源变化拒绝旧预览。
-- 不包含未跟踪/忽略/子模块/外部内容或链接目标；SVN是本地已观察范围，不证明远端完整清单。跨批次不提供全程序语义调用图。
-- 项目模式仅支持reviewMode、repositoryPath、selectedPaths，不与历史、规则或自动上下文参数混用。不支持的SVN状态和属性明确阻断。
+## 仍保留的资源保护
 
-完整使用方式见 [README](README.md)。本版不会升级或重启当前DSH，不修改业务仓库。
+本次不是无限内存或无限单次模型输入：单文件、内存快照、清单大小、模型输入字节、检索轮次和来源范围保护仍存在，超限明确报告，不静默截断后声称通过。具体数值见 [README](README.md)。这些限制与本次的时间截止分开，不宣称已取消所有限制。
+
+## 验证与事实边界
+
+真实31秒子进程在不覆盖timeoutMs的情况下正常结束；固定计时器注入检查证明采集不创建内部计时器，显式超时和用户取消仍能终止子进程。没有取得用户C3_Framework隔离副本路径，未声称该样本已经成功预览或生成审查报告。正式交付前需完成统一回归、宿主、隔离安装和四矩阵。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.81.0",
+  "version": "0.81.1",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/caller-capture.mjs

@@ -1,3 +1,4 @@
+import {captureSignal} from './capture-signal.mjs';
 import {gitCallerIndex} from './caller-index.mjs';
 import {gitCallerProbes} from './caller-probes.mjs';
 import {callerCandidates} from './caller-candidates.mjs';
@@ -6,8 +7,7 @@ import {isSecretPath} from './secret-path.mjs';
 
 // Called only by preview capture, never by a model retrieval request.
 export async function captureCallers(root, files, scopes, options={}) {
- const deadline=AbortSignal.timeout(30000);
- const signal=options.signal?AbortSignal.any([options.signal,deadline]):deadline;
+ const signal=captureSignal(options.signal);
  const bounded={...options,signal,maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024)};
  const index=await gitCallerIndex(root,scopes,bounded);
  const changed=new Set(files.flatMap(f=>[f.path,...(f.oldPath?[f.oldPath]:[])]));

package/src/capture-signal.mjs

@@ -0,0 +1,2 @@
+// Capture follows the host/user cancellation lifetime. No plugin stopwatch.
+export function captureSignal(signal){return signal??new AbortController().signal;}

package/src/dependency-chain.mjs

@@ -1,9 +1,10 @@
+import {captureSignal} from './capture-signal.mjs';
 import {contextCandidates} from './context-candidates.mjs';
 import {gitContextIndex} from './tracked-context.mjs';
 import {readLocal} from './content.mjs';
 // Fixed-depth literal navigation, not symbol binding. Never enumerate the repository.
 export async function captureDependencyChain(root,files,options={}){
- const signal=AbortSignal.any([AbortSignal.timeout(30000),...(options.signal?[options.signal]:[])]);
+ const signal=captureSignal(options.signal);
  const scoped={...options,maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024),signal},probes=new Set(),visited=new Set(files.map(f=>f.path)),context=[],candidates=[];
  const reserved=new Set([...(options.contextPaths??[]),...(options.rulePaths??[])]),limit=Math.min(options.maxContextFiles??20,20);
  let frontier=[...files],index,bytes=0,truncated=false,depth=0;

package/src/history-caller-capture.mjs

@@ -1,3 +1,4 @@
+import {captureSignal} from './capture-signal.mjs';
 import {historyCallerIndex,historyCallerProbes} from './history-caller-index.mjs';
 import {callerCandidates} from './caller-candidates.mjs';
 import {checked} from './process.mjs';
@@ -5,7 +6,7 @@ import {decode,hash} from './content.mjs';
 import {isSecretPath} from './secret-path.mjs';
 // Both sides share one capture lifecycle and all discovery limits. Never called by model readers.
 export async function captureHistoryCallers(root,files,history,scopes,options={}){
- const deadline=AbortSignal.timeout(30000),signal=options.signal?AbortSignal.any([options.signal,deadline]):deadline,bounded={...options,signal};
+ const signal=captureSignal(options.signal),bounded={...options,signal};
  const changed=new Set(files.map(f=>f.path)),rules=new Set(options.rulePaths??[]),scanned=[],candidates=[],indexes=[],contexts=new Map();let scanBytes=0,indexBytes=0,indexRecords=0,probeBytes=0;const allProbes=new Set();
  for(const [side,commit] of [['old',history.base],['new',history.target]]){if(!commit)continue;const index=await historyCallerIndex(root,commit,scopes,bounded);indexBytes+=index.bytes;indexRecords+=index.records;if(indexBytes>64*1024||indexRecords>256)throw new Error('Historical caller shared index limit exceeded');const sources=[];
   for(const entry of index.entries){signal.throwIfAborted();if(changed.has(entry.path)||rules.has(entry.path)||isSecretPath(entry.path)||!/\.(mjs|cjs|js|jsx|ts|tsx|c|cc|cpp|cxx|h|hh|hpp|hxx|shader|hlsl|glsl|cginc|hlsli|compute)$/i.test(entry.path))continue;if(scanned.length>=128)throw new Error('Historical caller shared scan file limit exceeded');const content=decode(await checked('git',['--no-optional-locks','cat-file','blob',entry.oid],{...bounded,cwd:root,maxBytes:Math.min(options.maxFileBytes??256*1024,256*1024)}));scanBytes+=content.bytes;if(scanBytes>1024*1024)throw new Error('Historical caller shared scan byte limit exceeded');const source={path:entry.path,...content,blobOid:entry.oid,revision:commit,side};scanned.push(source);sources.push(source);}

package/src/history-dependency-chain.mjs

@@ -1,10 +1,11 @@
+import {captureSignal} from './capture-signal.mjs';
 import {contextCandidates} from './context-candidates.mjs';
 import {checked} from './process.mjs';
 import {decode,hash,relativePath} from './content.mjs';
 import {assertNonSecretPath} from './secret-path.mjs';
 // Immutable object reads only. Both version sides share every navigation budget.
 export async function captureHistoryDependencyChain(root,files,history,context,options={}){
- const signal=AbortSignal.any([AbortSignal.timeout(30000),...(options.signal?[options.signal]:[])]);
+ const signal=captureSignal(options.signal);
  const bounded={...options,cwd:root,signal},probes=new Set(),visited={old:new Set(files.map(f=>f.path)),new:new Set(files.map(f=>f.path))};
  const maps={old:new Map(),new:new Map()},candidates=new Map(),reserved=new Set([...(options.rulePaths??[]),...(options.oldContextPaths??[]),...(options.contextPaths??[])]);let bytes=0,truncated=false;
  const regular=e=>e?.type==='blob'&&['100644','100755'].includes(e.mode);

package/src/process.mjs

@@ -1,10 +1,10 @@
 import { spawn } from 'node:child_process';
 
 /** Run only adapter-owned commands. No shell, prompts, or unbounded capture. */
-export function run(command, args, { cwd, signal, timeoutMs = 30_000, maxBytes = 8 * 1024 * 1024, env = {} } = {}) {
+export function run(command, args, { cwd, signal, timeoutMs = 0, maxBytes = 8 * 1024 * 1024, env = {} } = {}) {
   return new Promise((resolve, reject) => {
     signal?.throwIfAborted();
-    for (const value of [timeoutMs, maxBytes]) if (!Number.isSafeInteger(value) || value < 1) throw new Error('Invalid command limit');
+    if(!Number.isSafeInteger(timeoutMs)||timeoutMs<0||!Number.isSafeInteger(maxBytes)||maxBytes<1)throw new Error('Invalid command limit');
     const childEnv = { ...process.env, ...env };
     for (const key of Object.keys(childEnv)) if (/^GIT_/i.test(key)) delete childEnv[key];
     Object.assign(childEnv, { GIT_TERMINAL_PROMPT: '0', GIT_OPTIONAL_LOCKS: '0', GIT_NO_REPLACE_OBJECTS: '1', GIT_NO_LAZY_FETCH: '1' });
@@ -19,7 +19,7 @@ export function run(command, args, { cwd, signal, timeoutMs = 30_000, maxBytes =
     const abort = () => stop(signal.reason ?? new Error('Cancelled'));
     signal?.addEventListener('abort', abort, { once: true });
     if (signal?.aborted) abort();
-    const timer = setTimeout(() => stop(new Error('Command timeout')), timeoutMs);
+    const timer = timeoutMs>0?setTimeout(() => stop(new Error('Command timeout')), timeoutMs):undefined;
     const capture = chunks => data => {
       bytes += data.length;
       if (bytes > maxBytes) stop(new Error('Command output limit exceeded'));

package/src/project-review-service.mjs

@@ -7,11 +7,11 @@ import {projectInventory,captureProjectBatch} from './project-snapshot.mjs';
 import {reviewSnapshot,markdownReport} from './review.mjs';
 import {createDshModel} from './dsh-model.mjs';
 const owner=exec=>{const a=exec?.agent;if(!a?.session?.header?.cwd||!a.options?.provider||!a.options?.model)throw new Error('Active Agent with cwd and model required');return {agent:a,cwd:a.session.header.cwd,route:{provider:a.options.provider,model:a.options.model,...(a.options.reasoningEffort?{reasoningEffort:a.options.reasoningEffort}:{})}};};
-export function createProjectReviewService(llm,{allowModelSending=false,authorize=async()=>false,now=Date.now,ttlMs=300000,maxPreviews=8,projectMaxCalls=100}={}){
- if(!Number.isSafeInteger(projectMaxCalls)||projectMaxCalls<1||projectMaxCalls>100)throw new Error('Invalid project model call limit');
+export function createProjectReviewService(llm,{allowModelSending=false,authorize=async()=>false,now=Date.now,ttlMs=300000,maxPreviews=8,projectMaxCalls=Number.MAX_SAFE_INTEGER}={}){
+ if(!Number.isSafeInteger(projectMaxCalls)||projectMaxCalls<1)throw new Error('Invalid project model call limit');
  const previews=new Map(),lifetime=new AbortController();let busy=false;
  async function capture(cwd,args,signal){
-  let commands=0,metadataBytes=0;const captureBudget={signal,reserve(){signal.throwIfAborted();if(++commands>4096)throw Object.assign(new Error('Project shared command budget exceeded'),{code:'PROJECT_CAPTURE_BUDGET'});},charge(size){metadataBytes+=size;if(metadataBytes>8*1024*1024)throw Object.assign(new Error('Project shared metadata budget exceeded'),{code:'PROJECT_CAPTURE_BUDGET'});}};
+  let commands=0,metadataBytes=0;const captureBudget={signal,reserve(){signal.throwIfAborted();commands++;},charge(size){metadataBytes+=size;if(metadataBytes>8*1024*1024)throw Object.assign(new Error('Project shared metadata budget exceeded'),{code:'PROJECT_CAPTURE_BUDGET'});}};
   const captureOptions={signal,svnCaptureBudget:captureBudget};
   const root=await realpath(await resolveWorkspaceRepository(cwd,args.repositoryPath)),vcs=await detectVcs(root),inventory=await projectInventory(root,vcs,captureOptions);
   let paths=inventory.records.map(r=>r.path);if(args.selectedPaths!==undefined){if(!Array.isArray(args.selectedPaths)||args.selectedPaths.length>1000||new Set(args.selectedPaths).size!==args.selectedPaths.length||args.selectedPaths.some(p=>!paths.includes(p)))throw new Error('Invalid tracked project selection');paths=paths.filter(p=>args.selectedPaths.includes(p));}
@@ -21,10 +21,10 @@ export function createProjectReviewService(llm,{allowModelSending=false,authoriz
   for(const b of batches)if((await captureProjectBatch(verified,b.files.map(f=>f.path),captureOptions)).id!==b.id)throw new Error('Project source changed during capture');
   const result={root,vcs,inventoryId:inventory.id,inventoryComplete:inventory.vcs==='git',totalTrackedNodes:inventory.records.length,selectedFiles:paths.length,selectionComplete:paths.length===inventory.records.length,notice:inventory.notice,batches};return {...result,id:hash(JSON.stringify(result))};
  }
- const signalFor=(exec,ms)=>AbortSignal.any([lifetime.signal,AbortSignal.timeout(ms),...(exec.signal?[exec.signal]:[])]);
+ const signalFor=exec=>AbortSignal.any([lifetime.signal,...(exec.signal?[exec.signal]:[])]);
  return {owns:id=>previews.has(id),
-  async preview(args,exec){if(busy)throw new Error('Review service busy');if(!args||typeof args!=='object')throw new Error('Project preview parameters required');if(Object.keys(args).some(k=>!['reviewMode','repositoryPath','selectedPaths'].includes(k))||args.reviewMode!=='project')throw new Error('Project mode supports only reviewMode/repositoryPath/selectedPaths; change/history context parameters are not project parameters');const current=owner(exec);busy=true;try{const s=await capture(current.cwd,args,signalFor(exec,120000));for(const [id,p]of previews)if(p.expires<=now())previews.delete(id);while(previews.size>=maxPreviews)previews.delete(previews.keys().next().value);const previewId=randomUUID();previews.set(previewId,{...current,args:structuredClone(args),snapshotId:s.id,expires:now()+ttlMs});return {previewId,snapshotId:s.id,reviewMode:'project',repositoryRoot:s.root,vcs:s.vcs,model:current.route,modelSendingEnabled:allowModelSending,totalTrackedNodes:s.totalTrackedNodes,selectedFiles:s.selectedFiles,selectionComplete:s.selectionComplete,inventoryComplete:s.inventoryComplete,batches:s.batches.length,files:s.batches.flatMap(b=>b.files.map(f=>({path:f.path,eligibility:f.eligibility,reason:f.reason}))),notice:s.notice+' Full current source audit, not regression-only diff. Shared session execution budget: '+projectMaxCalls+' model calls, 10 minutes, 16MiB capture. Blocked/excluded/pending files are not reviewed successfully. No untracked/ignored/external bodies; no complete semantic call graph. Show scope and model before confirmed execute.'};}finally{busy=false;}},
-  async execute(args,exec){if(busy)throw new Error('Review service busy');if(!allowModelSending)throw new Error('Model sending disabled');if(args.confirmed!==true||typeof args.previewId!=='string'||Object.keys(args).some(k=>!['previewId','confirmed'].includes(k)))throw new Error('Confirmed preview required');const p=previews.get(args.previewId),current=owner(exec);if(!p||p.expires<=now()||p.agent!==current.agent||p.cwd!==current.cwd||JSON.stringify(p.route)!==JSON.stringify(current.route))throw new Error('Preview missing expired or owner/model/directory changed');previews.delete(args.previewId);busy=true;const signal=signalFor(exec,600000);try{const s=await capture(current.cwd,p.args,signal);if(s.id!==p.snapshotId)throw new Error('Project changed since preview');if(await authorize({snapshot:s,route:p.route,exec})!==true)throw new Error('Model sending denied');if(owner(exec).cwd!==p.cwd||JSON.stringify(owner(exec).route)!==JSON.stringify(p.route))throw new Error('Agent changed during approval');signal.throwIfAborted();
+  async preview(args,exec){if(busy)throw new Error('Review service busy');if(!args||typeof args!=='object')throw new Error('Project preview parameters required');if(Object.keys(args).some(k=>!['reviewMode','repositoryPath','selectedPaths'].includes(k))||args.reviewMode!=='project')throw new Error('Project mode supports only reviewMode/repositoryPath/selectedPaths; change/history context parameters are not project parameters');const current=owner(exec);busy=true;try{const s=await capture(current.cwd,args,signalFor(exec));for(const [id,p]of previews)if(p.expires<=now())previews.delete(id);while(previews.size>=maxPreviews)previews.delete(previews.keys().next().value);const previewId=randomUUID();previews.set(previewId,{...current,args:structuredClone(args),snapshotId:s.id,expires:now()+ttlMs});return {previewId,snapshotId:s.id,reviewMode:'project',repositoryRoot:s.root,vcs:s.vcs,model:current.route,modelSendingEnabled:allowModelSending,totalTrackedNodes:s.totalTrackedNodes,selectedFiles:s.selectedFiles,selectionComplete:s.selectionComplete,inventoryComplete:s.inventoryComplete,batches:s.batches.length,files:s.batches.flatMap(b=>b.files.map(f=>({path:f.path,eligibility:f.eligibility,reason:f.reason}))),notice:s.notice+' Full current source audit, not regression-only diff. Shared session execution budget: no internal elapsed-time or model-call cutoff, 16MiB capture memory protection. Blocked/excluded/pending files are not reviewed successfully. No untracked/ignored/external bodies; no complete semantic call graph. Show scope and model before confirmed execute.'};}finally{busy=false;}},
+  async execute(args,exec){if(busy)throw new Error('Review service busy');if(!allowModelSending)throw new Error('Model sending disabled');if(args.confirmed!==true||typeof args.previewId!=='string'||Object.keys(args).some(k=>!['previewId','confirmed'].includes(k)))throw new Error('Confirmed preview required');const p=previews.get(args.previewId),current=owner(exec);if(!p||p.expires<=now()||p.agent!==current.agent||p.cwd!==current.cwd||JSON.stringify(p.route)!==JSON.stringify(current.route))throw new Error('Preview missing expired or owner/model/directory changed');previews.delete(args.previewId);busy=true;const signal=signalFor(exec);try{const s=await capture(current.cwd,p.args,signal);if(s.id!==p.snapshotId)throw new Error('Project changed since preview');if(await authorize({snapshot:s,route:p.route,exec})!==true)throw new Error('Model sending denied');if(owner(exec).cwd!==p.cwd||JSON.stringify(owner(exec).route)!==JSON.stringify(p.route))throw new Error('Agent changed during approval');signal.throwIfAborted();
    let calls=0;const adapter=createDshModel(llm,p.route),model=request=>{if(calls>=projectMaxCalls)throw new Error('Shared project model call limit exceeded');calls++;return adapter(request);};const results=[];
    for(const b of s.batches){if(signal.aborted||calls>=projectMaxCalls){results.push({snapshotId:b.id,status:'partial',files:b.files.map(f=>({fileId:f.id,path:f.path,status:f.eligibility==='reviewable'?'pending':f.eligibility,reason:'Session project budget exhausted or cancelled'})),findings:[],limitations:[]});continue;}results.push(await reviewSnapshot(b,model,{signal,maxCalls:projectMaxCalls-calls,enableRetrieval:true,enableVerification:true}));}
    const files=results.flatMap(r=>r.files.map(f=>({...f,batchSnapshotId:r.snapshotId}))),coverage={total:s.selectedFiles,completed:files.filter(f=>f.status==='completed').length,excluded:files.filter(f=>f.status==='excluded').length,blocked:files.filter(f=>f.status==='blocked').length,pending:files.filter(f=>!['completed','excluded','blocked'].includes(f.status)).length};const findings=results.flatMap(r=>r.findings.map(f=>({...f,batchSnapshotId:r.snapshotId})));const report={schemaVersion:1,mode:'project',snapshotId:s.id,status:signal.aborted?'cancelled':coverage.total===0||coverage.completed===0?'partial':results.every(r=>r.status==='completed')&&files.every(f=>['completed','excluded'].includes(f.status))?'completed':'partial',repositoryRoot:s.root,vcs:s.vcs,model:p.route,modelCalls:calls,maxModelCalls:projectMaxCalls,totalTrackedNodes:s.totalTrackedNodes,selectionComplete:s.selectionComplete,inventoryComplete:s.inventoryComplete,coverage,files,findings,batches:results,notice:s.notice+' Coverage counts processing of selected tracked files only, not proof of correctness. Excluded and blocked are never completed. No cross-batch whole-program semantic coverage is claimed.'};

package/src/review.mjs

@@ -64,7 +64,7 @@ async function invoke(model, request, timeoutMs, parentSignal) {
   const abort = () => controller.abort(parentSignal.reason);
   parentSignal?.addEventListener('abort', abort, { once: true });
   if (parentSignal?.aborted) abort();
-  const timer = setTimeout(() => controller.abort(Object.assign(new Error('Model timeout'), { code: 'MODEL_TIMEOUT' })), timeoutMs);
+  const timer = timeoutMs>0?setTimeout(() => controller.abort(Object.assign(new Error('Model timeout'), { code: 'MODEL_TIMEOUT' })), timeoutMs):undefined;
   try {
     controller.signal.throwIfAborted();
     // Executors must honor cancellation; never release ownership before cleanup settles.
@@ -79,9 +79,10 @@ async function invoke(model, request, timeoutMs, parentSignal) {
 
 export async function reviewSnapshot(snapshot, model, options = {}) {
   const rounds = reviewRounds(options.reviewRounds);
-  const { signal, maxInputBytes = 96 * 1024, maxCalls = 100, timeoutMs = 120_000 } = options;
+  const { signal, maxInputBytes = 96 * 1024, maxCalls = Number.MAX_SAFE_INTEGER, timeoutMs = 0 } = options;
   if (typeof model !== 'function') throw new Error('A model executor is required');
-  for (const n of [maxInputBytes, maxCalls, timeoutMs]) if (!Number.isSafeInteger(n) || n < 1) throw new Error('Invalid review limit');
+  for(const n of [maxInputBytes,maxCalls])if(!Number.isSafeInteger(n)||n<1)throw new Error('Invalid review limit');
+  if(!Number.isSafeInteger(timeoutMs)||timeoutMs<0)throw new Error('Invalid review limit');
   // Clone once: callers cannot change the input while a model call is pending.
   const input = structuredClone(snapshot);
   const instructions=input.projectScope?PROJECT_REVIEW_INSTRUCTIONS:REVIEW_INSTRUCTIONS;

package/src/service.mjs

@@ -51,7 +51,7 @@ function createSessionReviewService(llm, { capture = captureSnapshot, now = Date
         while (previews.size >= maxPreviews) previews.delete(previews.keys().next().value);
         const previewId = randomUUID();
         previews.set(previewId, { ...current, target, options, rounds, snapshotId: snapshot.id, expires: now() + ttlMs });
-        return { ...(options.businessRequirement!==undefined?{businessRequirement:{text:options.businessRequirement,hash:hash(options.businessRequirement),bytes:Buffer.byteLength(options.businessRequirement)}}:{}), previewId, plan, snapshotId: snapshot.id, repositoryRoot: snapshot.root, vcs: snapshot.vcs,...(snapshot.workingScope?{workingScope:snapshot.workingScope}:{}), ...(snapshot.history ? { history: snapshot.history } : {}), ...(snapshot.mergeSources ? {mergeSources:snapshot.mergeSources} : {}),...(snapshot.effectiveMergeSources?{effectiveMergeSources:snapshot.effectiveMergeSources}:{}), model: current.route, modelSendingEnabled: allowModelSending, files: snapshot.files.map(f => ({ path: f.path,...(f.workingSource?{workingSource:f.workingSource}:{}),...(f.replacementSource?{replacementSource:f.replacementSource,contentNotice:f.contentNotice}:{}), eligibility: f.eligibility, reason: f.reason,...(f.specialData?{specialData:f.specialData,contentNotice:f.contentNotice}:{}), ...(f.eolMapping?{eolMapping:f.eolMapping,textNotice:f.textNotice}:{}), ...(f.keywordMapping?{keywordMapping:f.keywordMapping,textNotice:f.textNotice}:{}), ...(f.rawStatus==='replaced'&&(snapshot.history?.vcs==='svn'||f.replacementSource)?{oldKind:f.oldKind,newKind:f.newKind,nodeNotice:f.nodeNotice}:{}), ...(f.blockCode ? {blockCode:f.blockCode,...(svnDiagnostic(f.blockCode)?{diagnostic:svnDiagnostic(f.blockCode)}:{})} : {}), ...(f.copySource ? {copySource:f.copySource,copyNotice:f.copyNotice} : {}) })), contextPaths: snapshot.context.map(c => c.path), ...(snapshot.context.some(c=>c.keywordMapping)?{contextKeywordMappings:snapshot.context.filter(c=>c.keywordMapping).map(c=>({path:c.path,keywordMapping:c.keywordMapping}))}:{}), ...(snapshot.context.some(c=>c.eolMapping)?{contextEolMappings:snapshot.context.filter(c=>c.eolMapping).map(c=>({path:c.path,eolMapping:c.eolMapping}))}:{}), ...(snapshot.history?.vcs==='svn'?{contextSources:snapshot.context.map(c=>({path:c.path,...(c.svnSource?{new:c.svnSource}:{}),...(c.oldSvnSource?{old:c.oldSvnSource}:{})}))}:{}), ...(options.oldContextPaths !== undefined ? {oldContextPaths:options.oldContextPaths,oldContextSources:snapshot.context.filter(c=>c.oldOnly).map(c=>({path:c.path,side:'context-old',revision:c.oldRevision,...(c.oldSvnSource?{svnSource:c.oldSvnSource}:{blobOid:c.oldBlobOid}),hash:c.oldHash}))} : {}), ...(snapshot.callerDiscovery ? {callerDiscovery:snapshot.callerDiscovery} : {}), ...(snapshot.autoContext ? { autoContext: snapshot.autoContext } : {}), rules: (snapshot.rules ?? []).map(({ path, hash }) => ({ path, hash })), notice: (snapshot.history?.vcs==='svn'&&options.autoContext===true?'SVN历史autoContext为精确依赖定位读取固定版本父目录有界清单，包含同目录非匹配名字元数据；仅匹配捕获正文发送模型，不扫描全仓，不用工作树替代历史版本。':'') + (options.oldContextPaths !== undefined ? 'oldContextPaths仅为baseline旧侧正文，无目标侧替代；选中变更复用原old身份，旧侧不能证明新侧行为。' : '') + (snapshot.callerDiscovery ? 'callerScopePaths已授权预览读取限定目录内tracked候选正文，包括不匹配文件；非匹配正文不发送模型，匹配捕获上下文会发送。仅字面引用导航，不是函数调用或完整调用覆盖。' : '') + (enableRiskPlanning ? '执行按plan阈值决定风险假设规划，小变更可跳过独立规划但仍主审并复核；计划不是证据，所有阶段共享原预算。' : '') + '执行会向上述模型提供方发送可审查文件两侧内容、预览列出的显式/自动上下文、所选项目规则全文及预览业务需求文本。模型可在该快照范围内多轮只读检索，不读取范围外文件；候选生成后会进行证据与反证复核，两阶段各最多3轮检索，共享每文件120秒和总模型调用100次预算；复核不能证明缺陷成立。plan.reviewRounds为独立审查工作量，非模型reasoning effort；后续轮不带首轮风险计划，所有轮共享原超时与预算。plan仅预检初始输入，ready不代表已审查；minimumCalls不含后续检索/复核/动态业务综合；多文件可先进行业务分组，分组失败保留原组并记录限制，动态综合数执行前未知，实际预算可能不足。请先向用户展示范围，获得确认后执行。' };
+        return { ...(options.businessRequirement!==undefined?{businessRequirement:{text:options.businessRequirement,hash:hash(options.businessRequirement),bytes:Buffer.byteLength(options.businessRequirement)}}:{}), previewId, plan, snapshotId: snapshot.id, repositoryRoot: snapshot.root, vcs: snapshot.vcs,...(snapshot.workingScope?{workingScope:snapshot.workingScope}:{}), ...(snapshot.history ? { history: snapshot.history } : {}), ...(snapshot.mergeSources ? {mergeSources:snapshot.mergeSources} : {}),...(snapshot.effectiveMergeSources?{effectiveMergeSources:snapshot.effectiveMergeSources}:{}), model: current.route, modelSendingEnabled: allowModelSending, files: snapshot.files.map(f => ({ path: f.path,...(f.workingSource?{workingSource:f.workingSource}:{}),...(f.replacementSource?{replacementSource:f.replacementSource,contentNotice:f.contentNotice}:{}), eligibility: f.eligibility, reason: f.reason,...(f.specialData?{specialData:f.specialData,contentNotice:f.contentNotice}:{}), ...(f.eolMapping?{eolMapping:f.eolMapping,textNotice:f.textNotice}:{}), ...(f.keywordMapping?{keywordMapping:f.keywordMapping,textNotice:f.textNotice}:{}), ...(f.rawStatus==='replaced'&&(snapshot.history?.vcs==='svn'||f.replacementSource)?{oldKind:f.oldKind,newKind:f.newKind,nodeNotice:f.nodeNotice}:{}), ...(f.blockCode ? {blockCode:f.blockCode,...(svnDiagnostic(f.blockCode)?{diagnostic:svnDiagnostic(f.blockCode)}:{})} : {}), ...(f.copySource ? {copySource:f.copySource,copyNotice:f.copyNotice} : {}) })), contextPaths: snapshot.context.map(c => c.path), ...(snapshot.context.some(c=>c.keywordMapping)?{contextKeywordMappings:snapshot.context.filter(c=>c.keywordMapping).map(c=>({path:c.path,keywordMapping:c.keywordMapping}))}:{}), ...(snapshot.context.some(c=>c.eolMapping)?{contextEolMappings:snapshot.context.filter(c=>c.eolMapping).map(c=>({path:c.path,eolMapping:c.eolMapping}))}:{}), ...(snapshot.history?.vcs==='svn'?{contextSources:snapshot.context.map(c=>({path:c.path,...(c.svnSource?{new:c.svnSource}:{}),...(c.oldSvnSource?{old:c.oldSvnSource}:{})}))}:{}), ...(options.oldContextPaths !== undefined ? {oldContextPaths:options.oldContextPaths,oldContextSources:snapshot.context.filter(c=>c.oldOnly).map(c=>({path:c.path,side:'context-old',revision:c.oldRevision,...(c.oldSvnSource?{svnSource:c.oldSvnSource}:{blobOid:c.oldBlobOid}),hash:c.oldHash}))} : {}), ...(snapshot.callerDiscovery ? {callerDiscovery:snapshot.callerDiscovery} : {}), ...(snapshot.autoContext ? { autoContext: snapshot.autoContext } : {}), rules: (snapshot.rules ?? []).map(({ path, hash }) => ({ path, hash })), notice: (snapshot.history?.vcs==='svn'&&options.autoContext===true?'SVN历史autoContext为精确依赖定位读取固定版本父目录有界清单，包含同目录非匹配名字元数据；仅匹配捕获正文发送模型，不扫描全仓，不用工作树替代历史版本。':'') + (options.oldContextPaths !== undefined ? 'oldContextPaths仅为baseline旧侧正文，无目标侧替代；选中变更复用原old身份，旧侧不能证明新侧行为。' : '') + (snapshot.callerDiscovery ? 'callerScopePaths已授权预览读取限定目录内tracked候选正文，包括不匹配文件；非匹配正文不发送模型，匹配捕获上下文会发送。仅字面引用导航，不是函数调用或完整调用覆盖。' : '') + (enableRiskPlanning ? '执行按plan阈值决定风险假设规划，小变更可跳过独立规划但仍主审并复核；计划不是证据，所有阶段共享原预算。' : '') + '执行会向上述模型提供方发送可审查文件两侧内容、预览列出的显式/自动上下文、所选项目规则全文及预览业务需求文本。模型可在该快照范围内多轮只读检索，不读取范围外文件；候选生成后会进行证据与反证复核，两阶段各最多3轮检索，不设插件内部默认时间或总模型调用次数截止，遵循宿主/用户取消；输入字节和检索轮次保护仍保留；复核不能证明缺陷成立。plan.reviewRounds为独立审查工作量，非模型reasoning effort；后续轮不带首轮风险计划，所有轮共享原超时与预算。plan仅预检初始输入，ready不代表已审查；minimumCalls不含后续检索/复核/动态业务综合；多文件可先进行业务分组，分组失败保留原组并记录限制，动态综合数执行前未知，实际预算可能不足。请先向用户展示范围，获得确认后执行。' };
       } finally { busy = false; }
     },
     async execute(args, exec) {

package/src/svn-caller-capture.mjs

@@ -1,3 +1,4 @@
+import {captureSignal} from './capture-signal.mjs';
 import {svnCallerIndex} from './svn-caller-index.mjs';
 import {svnCallerNode,svnCallerProbes} from './svn-caller-node.mjs';
 
@@ -9,8 +10,7 @@ import {createSvnNavigationBudget} from './svn-navigation-budget.mjs';
 
 // Called only by preview capture, never by a model retrieval request.
 export async function captureSvnCallers(root, files, scopes, options={}) {
- const deadline=AbortSignal.timeout(30000);
- const signal=options.signal?AbortSignal.any([options.signal,deadline]):deadline;
+ const signal=captureSignal(options.signal);
  const bounded={...options,signal,svnNavigationBudget:options.svnNavigationBudget??createSvnNavigationBudget(signal),maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024)};
  const index=await svnCallerIndex(root,scopes,bounded);
  const changed=new Set(files.flatMap(f=>[f.path,...(f.oldPath?[f.oldPath]:[])]));

package/src/svn-capture-budget.mjs

@@ -1,6 +1,7 @@
+import {captureSignal} from './capture-signal.mjs';
 // Shared across initial capture, navigation, mergeinfo and final verification.
 export function createSvnCaptureBudget(signal){
- const deadline=AbortSignal.any([AbortSignal.timeout(30000),...(signal?[signal]:[])]);let commands=0,metadataBytes=0,bodyBytes=0;
+ const deadline=captureSignal(signal);let commands=0,metadataBytes=0,bodyBytes=0;
  const error=message=>Object.assign(new Error(message),{code:'SVN_CAPTURE_BUDGET'});
- return Object.freeze({signal:deadline,reserve(){deadline.throwIfAborted();if(++commands>512)throw error('SVN capture shared command budget exceeded');},charge(size,body=false){deadline.throwIfAborted();if(!Number.isSafeInteger(size)||size<0)throw error('Invalid SVN capture byte charge');if(body){bodyBytes+=size;if(bodyBytes>16*1024*1024)throw error('SVN capture shared verification body budget exceeded');}else{metadataBytes+=size;if(metadataBytes>1024*1024)throw error('SVN capture shared metadata budget exceeded');}},usage(){return {commands,metadataBytes,bodyBytes};}});
+ return Object.freeze({signal:deadline,reserve(){deadline.throwIfAborted();commands++;},charge(size,body=false){deadline.throwIfAborted();if(!Number.isSafeInteger(size)||size<0)throw error('Invalid SVN capture byte charge');if(body){bodyBytes+=size;if(bodyBytes>16*1024*1024)throw error('SVN capture shared verification body budget exceeded');}else{metadataBytes+=size;if(metadataBytes>1024*1024)throw error('SVN capture shared metadata budget exceeded');}},usage(){return {commands,metadataBytes,bodyBytes};}});
 }

package/src/svn-dependency-chain.mjs

@@ -1,3 +1,4 @@
+import {captureSignal} from './capture-signal.mjs';
 import {contextCandidates} from './context-candidates.mjs';
 import {svnCallerNode,svnCallerProbes} from './svn-caller-node.mjs';
 import {captureSvnExplicitContext} from './svn-explicit-context.mjs';
@@ -5,7 +6,7 @@ import {createSvnNavigationBudget} from './svn-navigation-budget.mjs';
 
 // Exact local path probes only. Every body requires safe offline SVN node identity.
 export async function captureSvnDependencyChain(root,files,options={}){
- const signal=AbortSignal.any([AbortSignal.timeout(30000),...(options.signal?[options.signal]:[])]),bounded={...options,signal,svnNavigationBudget:options.svnNavigationBudget??createSvnNavigationBudget(signal),maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024)};
+ const signal=captureSignal(options.signal),bounded={...options,signal,svnNavigationBudget:options.svnNavigationBudget??createSvnNavigationBudget(signal),maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024)};
  const visited=new Set(files.map(f=>f.path)),reserved=new Set([...(options.contextPaths??[]),...(options.rulePaths??[])]),probes=new Set(),context=[],candidates=[],nodes=[];let frontier=[...files],bytes=0,truncated=false,index;
  const limit=Math.min(options.maxContextFiles??20,20);if(new Set(options.contextPaths??[]).size>limit)throw new Error('Context file limit exceeded');
  const capture=async name=>{const value=await captureSvnExplicitContext(root,[name],bounded);bytes+=value.sourceBytes;if(bytes>1024*1024)throw new Error('SVN dependency source byte limit exceeded');return {item:value.context[0],node:value.identities[0]};};

package/src/svn-explicit-context.mjs

@@ -1,10 +1,11 @@
+import {captureSignal} from './capture-signal.mjs';
 import {svnCallerNode} from './svn-caller-node.mjs';
 import {readLocal,decode} from './content.mjs';
 import {checked} from './process.mjs';
 import {svnKeywordMapping} from './svn-keyword-mapping.mjs';
 import {svnEolMapping} from './svn-eol-mapping.mjs';
 export async function captureSvnExplicitContext(root,names,options={}){
- const signal=AbortSignal.any([AbortSignal.timeout(30000),...(options.signal?[options.signal]:[])]),bounded={...options,allowExplicitKeywords:true,signal,maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024)};
+ const signal=captureSignal(options.signal),bounded={...options,allowExplicitKeywords:true,signal,maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024)};
  if(!Array.isArray(names)||names.length>20||new Set(names).size!==names.length)throw new Error('Invalid SVN explicit context selection');
  const context=[],identities=[];let bytes=0;
  for(const name of names){

package/src/svn-history.mjs

@@ -1,3 +1,4 @@
+import {captureSignal} from './capture-signal.mjs';
 import {sameSvnUrl,canonicalSvnUrl} from './svn-url.mjs';
 import {svnHistoryEndpoints} from './svn-history-endpoints.mjs';
 import {realpath} from 'node:fs/promises';
@@ -62,11 +63,11 @@ export async function captureSvnHistory(cwd,options={}) {
   for(const [value,cap]of [[maxFiles,200],[maxFileBytes,256*1024],[maxSnapshotBytes,4*1024*1024]])if(!Number.isSafeInteger(value)||value<1||value>cap)throw new Error('Invalid SVN history limit');
   if(selectedPaths!==undefined && (!Array.isArray(selectedPaths)||selectedPaths.length>200||new Set(selectedPaths).size!==selectedPaths.length))throw new Error('Invalid SVN history selection');
   for(const name of selectedPaths??[])if(name!=='.')relativePath(name);
-  const signal=AbortSignal.any([AbortSignal.timeout(30000),...(options.signal?[options.signal]:[])]);
+  const signal=captureSignal(options.signal);
   let commands=0,metadataBytes=0,sourceBytes=0;
   const budgetError = message => Object.assign(new Error(message), {code:'SVN_HISTORY_BUDGET'});
   const run=async(args,body=false)=>{
-    signal.throwIfAborted();if(++commands>512 || metadataBytes>1024*1024 || sourceBytes>maxSnapshotBytes)throw budgetError('SVN historical shared budget exceeded');
+    signal.throwIfAborted();commands++;if(metadataBytes>1024*1024 || sourceBytes>maxSnapshotBytes)throw budgetError('SVN historical shared budget exceeded');
     const bytes=await checked('svn',['--non-interactive',...args],{cwd,signal,maxBytes:body?maxFileBytes:1024*1024});
     if(body){sourceBytes+=bytes.length;if(sourceBytes>maxSnapshotBytes)throw budgetError('SVN historical source budget exceeded');}
     else{metadataBytes+=bytes.length;if(metadataBytes>1024*1024)throw budgetError('SVN historical metadata budget exceeded');}

package/src/svn-navigation-budget.mjs

@@ -1,5 +1,6 @@
+import {captureSignal} from './capture-signal.mjs';
 // One source ledger/deadline per working-copy navigation capture, never per stage.
 export function createSvnNavigationBudget(signal){
- const sharedSignal=AbortSignal.any([AbortSignal.timeout(30000),...(signal?[signal]:[])]);let bytes=0;
+ const sharedSignal=captureSignal(signal);let bytes=0;
  return Object.freeze({signal:sharedSignal,charge(size){sharedSignal.throwIfAborted();if(!Number.isSafeInteger(size)||size<0)throw new Error('Invalid SVN navigation source size');bytes+=size;if(bytes>1024*1024)throw Object.assign(new Error('SVN shared navigation source byte limit exceeded'),{code:'SVN_NAVIGATION_BUDGET'});},usage(){return bytes;}});
 }

package/src/svn-working-mergeinfo.mjs

@@ -1,3 +1,4 @@
+import {captureSignal} from './capture-signal.mjs';
 import {checked} from './process.mjs';
 import {xml} from './svn.mjs';
 import {hash} from './content.mjs';
@@ -5,8 +6,8 @@ import {svnWorkingIdentity} from './svn-working-identity.mjs';
 import {captureEffectiveMergeinfo} from './svn-effective-mergeinfo.mjs';
 
 export async function workingEffectiveMergeinfo(root,rootInfo,files,options={}){
- const signal=AbortSignal.any([AbortSignal.timeout(30000),...(options.signal?[options.signal]:[])]);let commands=0,bytes=0;const cache=new Map();
- const run=async args=>{signal.throwIfAborted();if(++commands>512)throw new Error('SVN working mergeinfo command budget exceeded');const data=await checked('svn',['--non-interactive',...args],{...options,cwd:root,signal,maxBytes:256*1024});bytes+=data.length;if(bytes>1024*1024)throw new Error('SVN working mergeinfo metadata budget exceeded');return xml(data);};
+ const signal=captureSignal(options.signal);let commands=0,bytes=0;const cache=new Map();
+ const run=async args=>{signal.throwIfAborted();commands++;const data=await checked('svn',['--non-interactive',...args],{...options,cwd:root,signal,maxBytes:256*1024});bytes+=data.length;if(bytes>1024*1024)throw new Error('SVN working mergeinfo metadata budget exceeded');return xml(data);};
  const read=async(name,side,revision)=>{
   const key=JSON.stringify([name,side]);if(cache.has(key)){const value=cache.get(key);if(side==='old'&&value.source.revision!==revision)throw new Error('Mixed BASE revisions cannot prove effective mergeinfo');return value;}
   const node=(await run(['info','--xml','--',name+'@'])).info?.entry?.[0];const identity=svnWorkingIdentity(node,rootInfo,name);