@feng0531/dsh-code-review 0.81.0 → 0.82.1

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.82.0 — 后台审查、持久进度与大文件回退
+
+长任务先返回ID，查询/取消/分页取回已保存结果；重启后保留记录但不恢复旧授权。大hunk分段与粗粒度包络精度披露；JSON明确纠正并计数。预览显示运行版本位置，按工作区诊断。
+
+## 0.81.1 — 取消默认内部超时和计数配额
+
+修复外层延长仍被采集/导航30秒、模型120秒等内部截止终止的问题。默认不限制采集命令数或总模型调用数，遵循用户/宿主取消。保留来源、内存与模型输入保护，不声称解除宿主/提供方限制。
+
 ## 0.81.0 — 多会话独立审查与全项目当前源码
 
 不同会话不再被全局busy阻塞，预览/锁/取消/模型/预算独立。新增reviewMode=project，跟踪当前源码分批检查并保持准确覆盖；不是差异审查，不把空旧侧当历史基线。项目模式有明确总量和共享调用限制，未完成不冒充成功。

package/DEVELOPMENT.md

@@ -16,19 +16,19 @@
 
 服务按DSH session对象隔离缓存和锁，同一会话changes/project两种模式共用互斥锁；不同会话可并行，模型调用与取消由各请求生命周期约束。宿主dispose终止全部会话服务。全项目是跟踪文件的当前源码分批，不是多仓库汇总或跨批次语义分析。
 
-项目捕获最多10000清单节点、1000选择节点、16MiB，总模型调用100、执行10分钟；初次捕获/末尾检查及执行重新捕获均有显式截止。SVN项目模式拒绝不支持节点属性，不隐式继承固定历史审查的网络权限。
+项目捕获最多10000清单节点、1000选择节点、16MiB，不设默认总模型调用次数或执行秒表，初次捕获/复核均遵循宿主与用户取消。SVN项目模式拒绝不支持节点属性，不隐式继承固定历史审查的网络权限。
 
 ## 审查预算
 
 除 README 中的文件和输入上限外：
 
-- 每个主文件的模型与检索阶段共享默认 120 秒；关联综合沿用相关主文件的生命周期，不因切换阶段重新计时。
+- 采集、导航、命令及模型审查默认不设插件内部秒表；内部API调用者仍可显式指定timeoutMs（0表示无内部截止）。用户/宿主取消仍传播并等待清理。
 - 每阶段最多三轮检索；全局最多 50 次读取请求，返回内容累计 256 KiB，单次最多 64 KiB，读取最多 200 行。
-- Git 工作区依赖链最多三层、512 个精确路径查询、20 个候选、手动入口与自动依赖共享 1 MiB 正文；文件读取与最终复核共享 30 秒。
-- SVN工作副本全采集共享512条命令、1MiB元数据和30秒截止，含初始/重复采集、导航、属性和末尾验证；cat输出另受16MiB总硬上限约束。历史采集也有独立的512命令、1MiB元数据、30秒及正文上限。
-- SVN 依赖链最多三层，以精确本地路径和安全正常节点捕获；512 路径、20 候选和上下文。工作副本显式上下文、自动依赖、调用方扫描（含非命中）及关键字BASE核验共享1 MiB来源账本与30秒含核验截止，不能切换阶段重新获得额度；切换、外部与不支持属性节点拒绝。
-- Git 历史依赖链同样最多三层，两侧共享 512 个路径、20 个候选和上下文、1 MiB 正文及 30 秒；只读取固定对象。
-- 引用方发现最多四个不重叠的非根目录；128 个候选正文共 1 MiB，目录索引最多 256 条／64 KiB，竞争路径最多 512 个。发现与复核共享 30 秒。
+- Git 工作区依赖链最多三层、512 个精确路径查询、20 个候选、手动入口与自动依赖共享 1 MiB 正文；文件读取与最终复核共享宿主/用户取消信号。
+- SVN工作副本全采集记录命令次数、共享1MiB元数据内存保护，不设默认命令次数或时间截止，含初始/重复采集、导航、属性和末尾验证；cat输出另受16MiB总硬上限约束。历史采集也有独立的元数据与正文内存保护，不以命令次数或时间中断。
+- SVN 依赖链最多三层，以精确本地路径和安全正常节点捕获；512 路径、20 候选和上下文。工作副本显式上下文、自动依赖、调用方扫描（含非命中）及关键字BASE核验共享1 MiB来源内存账本与宿主/用户取消信号，不能切换阶段重新获得额度；切换、外部与不支持属性节点拒绝。
+- Git 历史依赖链同样最多三层，两侧共享 512 个路径、20 个候选和上下文、1 MiB 正文内存保护和取消信号；只读取固定对象。
+- 引用方发现最多四个不重叠的非根目录；128 个候选正文共 1 MiB，目录索引最多 256 条／64 KiB，竞争路径最多 512 个。发现与复核共享宿主/用户取消信号。
 
 达到上限必须阻断或说明未完成，不能静默扩大范围、丢弃证据或重新计时。
 

package/README.md

@@ -204,6 +204,21 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 
 `repositoryPath` 相对于会话工作目录，必须指向一个实际仓库根目录；其余文件路径再相对于该仓库。每个仓库分别预览和执行，不使用绝对路径、`..` 或链接目录。
 
+## 长任务：后台预览、审查与取回结果
+
+全项目或慢仓库建议使用后台工具，不让一次外层调用等待整个项目。仍先预览，再由你确认外发；启动返回jobId不等于审核完成。
+
+1. 调用code_review_start，phase设为preview，previewArgs填原预览参数（例如reviewMode=project）。
+2. 用code_review_status和jobId查询；完成后读取resultSummary中的预览范围、模型和previewId。
+3. 展示预览，确认后调用code_review_start，phase设为execute，传previewId与confirmed=true。
+4. 查询审查任务；offset/limit分页取回检查点、文件状态和发现；单个检查点内的大清单用checkpointIndex指定其零基索引，再用offset/limit取回内部全部条目。可调用code_review_cancel取消。
+
+报告保存在宿主profile的data/dsh-code-review/jobs目录；没有profile环境时使用用户主目录.dsh下的数据目录，不写入业务仓库。内容可能含源码片段，应按源码敏感级别保护。本次启动调用结束不自动取消后台任务；明确取消、停用插件或宿主退出会停止它。
+
+重启后可按原jobId读回保存记录，原运行标记interrupted，不自动继续外发。recovery给出已观察文件/窗口与未完成路径；它不是完整分母或新授权，补审必须重新预览确认。新预览的runtime包含实际加载版本和模块位置，排查不同工作区时分别核对，不根据另一台机器推断。
+
+大文件超出单次输入时按原行号分段。精确差异算不出时使用明确标注的包络，可能包含未变行，不声称精确归因。模型JSON错误会请求一次明确纠正，记录额外调用；不会给错误输出补括号、猜字段或当成无缺陷。
+
 ## 多个会话同时审查
 
 可以同时打开多个DSH Agent会话：会话A审项目A，会话B审项目B，也可以分别审查同一项目。各会话的预览、执行锁、模型路由、取消和预算独立；A正在执行不会让B收到全局busy。一个会话内部仍串行，不能拿另一个会话的previewId执行。宿主停用插件会结束全部服务，单次取消只影响当前请求。
@@ -225,7 +240,7 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 
 项目模式只接受reviewMode、repositoryPath和可选selectedPaths，不与历史revision、autoContext、规则或调用方参数混用。默认全部跟踪节点；不读取未跟踪/忽略文件、子模块、外部仓库及链接目标。目录只作清单记录，源码按批次审查；跨批次不宣称完整调用图或全程序语义分析。
 
-清单上限10000节点，单次选择最多1000节点/16MiB，12节点一批，单文件256KiB；超限明确拒绝，缩小选择后必须重新预览。单次采集全部批次共享4096条命令与8MiB元数据、120秒采集截止（执行阶段受10分钟总截止限制）；全部批次共享本会话100次模型调用和10分钟执行时间，耗尽保留pending/partial，不重新给下一批额度。SVN为本地已观察清单，稀疏/外部/链接及不支持属性显示限制；不证明仓库远端完整覆盖。
+清单上限10000节点，单次选择最多1000节点/16MiB，12节点一批，单文件256KiB；超限明确拒绝，缩小选择后必须重新预览。单次采集共享8MiB元数据内存保护，不按命令条数、插件秒表或模型调用次数中断；耗时受宿主/模型提供方限制，用户可随时取消。SVN为本地已观察清单，稀疏/外部/链接及不支持属性显示限制；不证明仓库远端完整覆盖。
 
 报告分别给出总数、completed、excluded、blocked、pending和每批快照。completed只表示所选捕获文件已处理，不代表代码正确；排除与阻断从不算完成。代码或清单变化会拒绝旧预览，运行后无法复核则标记outdated。
 
@@ -285,7 +300,7 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 | 全部快照 | 4 MiB |
 | 额外上下文 | 手动与自动来源共 20 个文件 |
 | 单次模型输入 | 约 96 KiB |
-| 一次审查的模型调用 | 所有阶段共享 100 次 |
+| 内部时间／总调用次数 | 不设默认截止；遵循宿主与用户取消 |
 
 大变更可按保留原行号的差异窗口分批分析；无法容纳的部分会明确标为未完成。建议先按功能或模块选择一小批文件。详细读取和时间预算见 [开发与发布指南](DEVELOPMENT.md)。
 

package/RELEASE-NOTES.md

@@ -1,17 +1,21 @@
-# v0.81.0 发布说明
+# v0.82.1 发布说明
 
-## 多个会话可以同时审查项目
+v0.82.0冻结标签的Windows CI因临时目录规范路径别名误拒绝失败，未发布；改为固定规范目录身份并继续拒绝链接，原标签不移动。
 
-不同DSH会话的执行锁、预览、模型路由和预算独立。同一项目或不同项目均可同时审查；取消一个请求不影响另一个会话。同一会话仍串行，跨会话previewId不能使用。不是“一次自动汇总多个仓库”的功能。
+## 后台长任务与保存结果
 
-## 审查整个项目当前代码
+新增code_review_start/status/cancel：后台预览或已确认执行先返回任务ID，逐文件、逐窗口保存进度，结果分页取回。避免一次外层600秒中断后没有已完成成果。任务按会话/目录/模型/推理强度归属校验；宿主profile保存原始结果，不修改被审仓库。
 
-预览时传入 `{"reviewMode":"project"}`，读取当前仓库跟踪文件，包含未改动文件；默认changes模式保持原变更审查。先查看完整选择清单与排除原因，再确认执行。
+停用插件/宿主退出会中断任务，已落盘检查点可读回。不会自动跨重启继续外发或恢复旧批准；补审需新预览与确认。任务completed仅表示函数返回，必须看实际report.status及覆盖。
 
-- 当前源码缺陷检查不要求问题由最近提交引入；空旧侧仅为传输占位，不是空历史版本。
-- 分批保留来源哈希，全部批次共享本会话100次模型调用和10分钟。清单最多10000节点，单次选择最多1000节点/16MiB，超限明确拒绝；单文件上限256KiB。
-- 报告区分完成、排除、阻断及未完成路径；没有完成的批次保留pending/partial，来源变化拒绝旧预览。
-- 不包含未跟踪/忽略/子模块/外部内容或链接目标；SVN是本地已观察范围，不证明远端完整清单。跨批次不提供全程序语义调用图。
-- 项目模式仅支持reviewMode、repositoryPath、selectedPaths，不与历史、规则或自动上下文参数混用。不支持的SVN状态和属性明确阻断。
+## 大文件与模型协议
 
-完整使用方式见 [README](README.md)。本版不会升级或重启当前DSH，不修改业务仓库。
+过大hunk按原行号分段，精确差异受限时退回保守包络并披露精度，不能用其证明精确编辑或回归因果。去掉默认20批调度上限，不用批次数代替完成条件。仍有单次模型输入/内存保护，超长单行无法容纳时明确未完成。
+
+JSON格式错误时明确请求一次新响应，不修改或伪造旧响应；额外调用计数并披露纠正。仍不能解析或字段错误时保留失败，不冒充无缺陷。
+
+## 诊断与安全
+
+预览返回实际加载版本、模块位置及耗时，后台显示阶段。不同工作区单独诊断，不用一台机器结果外推。独立项目工厂补充TTL/预览数校验。用户取消、只读、来源哈希与批准绑定保持。报告含证据片段，应按源码保护并由用户管理保存目录。
+
+用法见 [README](README.md)。本版本没有自动安装/重启宿主，也未声称反馈中的各私有工作区已验收恢复。

package/index.mjs

@@ -1,3 +1,4 @@
+import {registerBackgroundReview} from './src/background-review.mjs';
 import { createReviewService } from './src/service.mjs';
 export const name = 'dsh-code-review';
 export const inject = ['tools', 'llm'];
@@ -22,5 +23,6 @@ export function apply(ctx, config = {}) {
     output,
     async execute(args, exec) { const result = await service.execute(args, exec); return { json: JSON.stringify(result.report), markdown: result.markdown }; },
   });
+  registerBackgroundReview(ctx,service);
   ctx.on('dispose', () => service.dispose());
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.81.0",
+  "version": "0.82.1",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/attribution.mjs

@@ -12,5 +12,5 @@ export function validateAttribution(value, file, changes = changeMap(file.left.t
   if (value.editIds.some(id => typeof id !== 'string' || !ids.has(id)) || value.properties.some(name => typeof name !== 'string' || !properties.has(name))) throw new Error('Unknown change reference');
   if (new Set(value.editIds).size !== value.editIds.length || new Set(value.properties).size !== value.properties.length) throw new Error('Duplicate change reference');
   if (!value.editIds.length && !value.properties.length) throw new Error('Attribution requires a change reference');
-  return { status: 'references-validated', causality: 'unverified', editIds: [...value.editIds], properties: [...value.properties], beforeBehavior: value.beforeBehavior, afterBehavior: value.afterBehavior, reason: value.reason };
+  return { status: 'references-validated', causality: 'unverified', ...(changes.precision==='envelope'?{precision:'envelope',notice:'References are broad region coordinates, not exact edit evidence.'}:{}), editIds: [...value.editIds], properties: [...value.properties], beforeBehavior: value.beforeBehavior, afterBehavior: value.afterBehavior, reason: value.reason };
 }

package/src/background-review.mjs

@@ -0,0 +1,14 @@
+import path from 'node:path';
+import os from 'node:os';
+import {createReviewJobs} from './review-jobs.mjs';
+
+export function registerBackgroundReview(ctx,service,{directory}={}){
+ const root=directory??path.join(process.env.DSH_PROFILE_DIR??path.join(os.homedir(),'.dsh'),'data','dsh-code-review','jobs');
+ const jobs=createReviewJobs({directory:root});
+ const output={schema:{type:'object',additionalProperties:false,properties:{json:{type:'string'},markdown:{type:'string'}},required:['json','markdown']},render:(_a,v)=>[{type:'text',text:v.markdown||v.json}]};
+ const respond=value=>({json:JSON.stringify(value),markdown:''});
+ ctx.tools.register({name:'code_review_start',description:'Start a durable background preview or confirmed review. Returns a job ID immediately. Preview phase never sends source. For execute supply the approved previewId and confirmed=true. Use code_review_status to collect progress/results; code_review_cancel to stop. Does not automatically resume after host restart or grant new source approval.',parameters:{type:'object',additionalProperties:false,properties:{phase:{type:'string',enum:['preview','execute']},previewArgs:{type:'object',description:'Same parameters as code_review_preview; do not include execute fields.'},previewId:{type:'string'},confirmed:{type:'boolean'}},required:['phase']},output,async execute(args,exec){if(!args||Object.keys(args).some(k=>!['phase','previewArgs','previewId','confirmed'].includes(k))||!['preview','execute'].includes(args.phase))throw new Error('Invalid background phase');if(args.phase==='execute'&&(args.confirmed!==true||typeof args.previewId!=='string'||args.previewArgs!==undefined))throw new Error('Confirmed preview required');if(args.phase==='preview'&&(args.previewId!==undefined||args.confirmed!==undefined))throw new Error('Preview cannot confirm execution');return respond(await jobs.start(exec,async({signal,checkpoint})=>{const original=exec.agent,sessionId=original.session.header.id??original.session.id,detached={...exec,agent:original,signal,reviewCheckpoint:async value=>{const active=exec.agent;if(active!==original||(active.session.header.id??active.session.id)!==sessionId){throw new Error('Background Agent/session changed');}await checkpoint(value);}};await checkpoint({stage:args.phase==='preview'?'capturing-preview':'revalidating-approved-source'});return args.phase==='preview'?service.preview(args.previewArgs??{},detached):service.execute({previewId:args.previewId,confirmed:true},detached);}));}});
+ ctx.tools.register({name:'code_review_status',description:'Read a background review task owned by this session, directory and model. Returns saved progress or final preview/report. completed task means the tool returned; inspect nested report coverage/status. Interrupted tasks retain checkpoints but require new preview and approval to resend.',parameters:{type:'object',additionalProperties:false,properties:{jobId:{type:'string'},offset:{type:'integer',minimum:0},checkpointIndex:{type:'integer',minimum:0,description:'Read one checkpoint nested files/findings page; offset/limit apply within it.'},limit:{type:'integer',minimum:1,maximum:100}},required:['jobId']},output,async execute(args,exec){return respond(await jobs.status(args.jobId,exec,{offset:args.offset??0,limit:args.limit??20,checkpointIndex:args.checkpointIndex}));}});
+ ctx.tools.register({name:'code_review_cancel',description:'Cancel a background review task owned by this session. Does not discard saved checkpoints. No source is sent by cancellation.',parameters:{type:'object',additionalProperties:false,properties:{jobId:{type:'string'}},required:['jobId']},output,async execute(args,exec){return respond(await jobs.cancel(args.jobId,exec));}});
+ ctx.on('dispose',()=>jobs.dispose());return jobs;
+}

package/src/caller-capture.mjs

@@ -1,3 +1,4 @@
+import {captureSignal} from './capture-signal.mjs';
 import {gitCallerIndex} from './caller-index.mjs';
 import {gitCallerProbes} from './caller-probes.mjs';
 import {callerCandidates} from './caller-candidates.mjs';
@@ -6,8 +7,7 @@ import {isSecretPath} from './secret-path.mjs';
 
 // Called only by preview capture, never by a model retrieval request.
 export async function captureCallers(root, files, scopes, options={}) {
- const deadline=AbortSignal.timeout(30000);
- const signal=options.signal?AbortSignal.any([options.signal,deadline]):deadline;
+ const signal=captureSignal(options.signal);
  const bounded={...options,signal,maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024)};
  const index=await gitCallerIndex(root,scopes,bounded);
  const changed=new Set(files.flatMap(f=>[f.path,...(f.oldPath?[f.oldPath]:[])]));

package/src/capture-signal.mjs

@@ -0,0 +1,2 @@
+// Capture follows the host/user cancellation lifetime. No plugin stopwatch.
+export function captureSignal(signal){return signal??new AbortController().signal;}

package/src/dependency-chain.mjs

@@ -1,9 +1,10 @@
+import {captureSignal} from './capture-signal.mjs';
 import {contextCandidates} from './context-candidates.mjs';
 import {gitContextIndex} from './tracked-context.mjs';
 import {readLocal} from './content.mjs';
 // Fixed-depth literal navigation, not symbol binding. Never enumerate the repository.
 export async function captureDependencyChain(root,files,options={}){
- const signal=AbortSignal.any([AbortSignal.timeout(30000),...(options.signal?[options.signal]:[])]);
+ const signal=captureSignal(options.signal);
  const scoped={...options,maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024),signal},probes=new Set(),visited=new Set(files.map(f=>f.path)),context=[],candidates=[];
  const reserved=new Set([...(options.contextPaths??[]),...(options.rulePaths??[])]),limit=Math.min(options.maxContextFiles??20,20);
  let frontier=[...files],index,bytes=0,truncated=false,depth=0;

package/src/dsh-model.mjs

@@ -1,9 +1,9 @@
 import { modelJson } from './model-json.mjs';
 /** One-shot host LLM call. No agent loop and no executable tools. */
-export function createDshModel(llm, route, { maxTokens = 4096, maxOutputBytes = 128 * 1024 } = {}) {
+export function createDshModel(llm, route, { maxTokens = 4096, maxOutputBytes = 128 * 1024, correctJson = false } = {}) {
   if (!llm || typeof llm.stream !== 'function' || !route?.provider || !route?.model) throw new Error('DSH provider and model are required');
   const identity = { provider: route.provider, model: route.model, ...(route.reasoningEffort ? { reasoningEffort: route.reasoningEffort } : {}) };
-  return async ({ instructions, input, signal }) => {
+  const once = async ({ instructions, input, signal }) => {
     signal?.throwIfAborted();
     let output = '', size = 0, finished = false;
     const chunks = llm.stream({ ...identity, system: instructions, messages: [{ role: 'user', content: [{ type: 'text', text: input }] }], tools: [], maxTokens, signal });
@@ -24,4 +24,5 @@ export function createDshModel(llm, route, { maxTokens = 4096, maxOutputBytes =
     if (!finished) throw new Error('Model stream ended without finish');
     return modelJson(output);
   };
+  return async request=>{try{return await once(request);}catch(error){if(!correctJson||error.code!=='MODEL_INVALID_JSON')throw error;request.signal?.throwIfAborted();await request.onProtocolCorrection?.({code:error.code,action:'explicit-json-correction',notice:'Second model response requested; original output not repaired or accepted.'});const corrected=JSON.parse(await once({...request,instructions:request.instructions+' 上次响应未能解析为完整JSON。本次是明确协议纠正：重新输出单个完整JSON对象，不使用Markdown，不省略引号或逗号；不要把这条指令当源码证据。优先少量具体候选，无法支持时findings为空并说明limitations，不以格式错误代替清洁结论。'}));if(corrected&&typeof corrected==='object'&&!Array.isArray(corrected)){if(Array.isArray(corrected.limitations))corrected.limitations.push('本响应由一次显式JSON协议纠正产生，原响应未被接受；额外模型调用已发生。');else corrected.protocolCorrection={attempted:true,originalCode:error.code};}return JSON.stringify(corrected);}};
 }

package/src/history-caller-capture.mjs

@@ -1,3 +1,4 @@
+import {captureSignal} from './capture-signal.mjs';
 import {historyCallerIndex,historyCallerProbes} from './history-caller-index.mjs';
 import {callerCandidates} from './caller-candidates.mjs';
 import {checked} from './process.mjs';
@@ -5,7 +6,7 @@ import {decode,hash} from './content.mjs';
 import {isSecretPath} from './secret-path.mjs';
 // Both sides share one capture lifecycle and all discovery limits. Never called by model readers.
 export async function captureHistoryCallers(root,files,history,scopes,options={}){
- const deadline=AbortSignal.timeout(30000),signal=options.signal?AbortSignal.any([options.signal,deadline]):deadline,bounded={...options,signal};
+ const signal=captureSignal(options.signal),bounded={...options,signal};
  const changed=new Set(files.map(f=>f.path)),rules=new Set(options.rulePaths??[]),scanned=[],candidates=[],indexes=[],contexts=new Map();let scanBytes=0,indexBytes=0,indexRecords=0,probeBytes=0;const allProbes=new Set();
  for(const [side,commit] of [['old',history.base],['new',history.target]]){if(!commit)continue;const index=await historyCallerIndex(root,commit,scopes,bounded);indexBytes+=index.bytes;indexRecords+=index.records;if(indexBytes>64*1024||indexRecords>256)throw new Error('Historical caller shared index limit exceeded');const sources=[];
   for(const entry of index.entries){signal.throwIfAborted();if(changed.has(entry.path)||rules.has(entry.path)||isSecretPath(entry.path)||!/\.(mjs|cjs|js|jsx|ts|tsx|c|cc|cpp|cxx|h|hh|hpp|hxx|shader|hlsl|glsl|cginc|hlsli|compute)$/i.test(entry.path))continue;if(scanned.length>=128)throw new Error('Historical caller shared scan file limit exceeded');const content=decode(await checked('git',['--no-optional-locks','cat-file','blob',entry.oid],{...bounded,cwd:root,maxBytes:Math.min(options.maxFileBytes??256*1024,256*1024)}));scanBytes+=content.bytes;if(scanBytes>1024*1024)throw new Error('Historical caller shared scan byte limit exceeded');const source={path:entry.path,...content,blobOid:entry.oid,revision:commit,side};scanned.push(source);sources.push(source);}

package/src/history-dependency-chain.mjs

@@ -1,10 +1,11 @@
+import {captureSignal} from './capture-signal.mjs';
 import {contextCandidates} from './context-candidates.mjs';
 import {checked} from './process.mjs';
 import {decode,hash,relativePath} from './content.mjs';
 import {assertNonSecretPath} from './secret-path.mjs';
 // Immutable object reads only. Both version sides share every navigation budget.
 export async function captureHistoryDependencyChain(root,files,history,context,options={}){
- const signal=AbortSignal.any([AbortSignal.timeout(30000),...(options.signal?[options.signal]:[])]);
+ const signal=captureSignal(options.signal);
  const bounded={...options,cwd:root,signal},probes=new Set(),visited={old:new Set(files.map(f=>f.path)),new:new Set(files.map(f=>f.path))};
  const maps={old:new Map(),new:new Map()},candidates=new Map(),reserved=new Set([...(options.rulePaths??[]),...(options.oldContextPaths??[]),...(options.contextPaths??[])]);let bytes=0,truncated=false;
  const regular=e=>e?.type==='blob'&&['100644','100755'].includes(e.mode);

package/src/primary-input.mjs

@@ -1,3 +1,5 @@
+import {sourceSegments} from './source-segments.mjs';
+import {changeRegion} from './change-region.mjs';
 import { CONTEXT_SIDE_NOTICE } from './context-identity.mjs';
 import { approvedCallerBindings } from './caller-binding-input.mjs';
 import { REQUIREMENT_NOTICE } from './business-requirement.mjs';
@@ -14,7 +16,8 @@ import { initialInputBudget } from './input-budget.mjs';
 
 // Pure preparation over already captured data. No model calls or new reads.
 export function preparePrimaryInput(input, file, { instructions, scope, grouping, maxInputBytes }) {
-  const changes = changeMap(file.left.text, file.right.text);
+  let changes = changeMap(file.left.text, file.right.text);
+  if(changes.status==='limited'){const region=changeRegion(file.left.text,file.right.text);if(region.status==='changed')changes={status:'changed',precision:'envelope',reason:'Exact diff unavailable; broad region includes potentially unchanged lines, not exact edits or causal proof.',edits:[{id:'envelope1',old:region.old,new:region.new}],hunks:[{id:'envelope-h1',old:region.old,new:region.new,editIds:['envelope1']}]};}
   const base = { ...(input.projectScope?{projectScope:input.projectScope,reviewNotice:'Full current-file review; empty left is a sentinel, not a historical baseline. changes are transport coordinates only, do not infer introduced regression.'}:{}), ...(input.history ? {contextSideNotice:CONTEXT_SIDE_NOTICE} : {}), ...(input.businessRequirement!==undefined?{businessRequirement:input.businessRequirement,requirementNotice:REQUIREMENT_NOTICE}:{}), defectGuidance: defectGuidance(file.path, file.rightExists === false ? file.left.text : file.right.text), snapshotId: input.id, file, changes, context: input.context ?? [], rules: input.rules ?? [] };
   const contextRelations = inferContextRelations(input, file);
   if (contextRelations.length) {
@@ -70,7 +73,8 @@ export function preparePrimaryInput(input, file, { instructions, scope, grouping
     }
   }
   if (!measure(payload).fits && scope) {
-    const windows = changeWindows(file, changes);
+    const exactWindows=changeWindows(file,changes);
+    const windows=exactWindows?sourceSegments(exactWindows):null;
     if (windows) {
       const compactFile = { ...file, left: { ...file.left, text: undefined }, right: { ...file.right, text: undefined } };
       const contextCatalog = scope.catalog().filter(source => ['context', 'context-old'].includes(source.side));
@@ -80,7 +84,7 @@ export function preparePrimaryInput(input, file, { instructions, scope, grouping
         windowBase.cppCallSites = base.cppCallSites.map(({line,expression,side})=>({line,expression,side}));
         windowBase.cppCallNotice = '最多40条旧/新侧零参语法导航；统一confidence=syntax-only-unresolved，可能为宏/重载/动态分派，无绑定、可达性或顺序保证，不是证据或完整覆盖。原文仍须按批准catalog读取。';
       }
-      const compact = JSON.stringify({ ...windowBase, context: [], contextCatalog, contextMode: 'approved-retrieval', contextNotice: '上下文全文仍在同一批准快照，仅目录进入窗口初始输入；必须按sourceId和版本侧read原文，不把目录视为证据或完整覆盖。', file: compactFile, windows, sourceMode: 'change-windows', windowNotice: '仅提供全部精确hunk窗口，start/count为原始源码行号，不得重编号。完整源码未随初始输入发送，可在catalog批准范围内检索；缺少上下文时说明限制。' });
+      const compact = JSON.stringify({ ...windowBase, context: [], contextCatalog, contextMode: 'approved-retrieval', contextNotice: '上下文全文仍在同一批准快照，仅目录进入窗口初始输入；必须按sourceId和版本侧read原文，不把目录视为证据或完整覆盖。', file: compactFile, windows, sourceMode: 'change-windows', windowNotice: '窗口可能为精确hunk的分段或粗粒度包络，精度以changes.precision为准；片段两侧不保证行对齐，不以片段证明精确编辑或回归因果。start/count为原始源码行号，不得重编号。完整源码未随初始输入发送，可在catalog批准范围内检索；缺少上下文时说明限制。' });
       if (!measure(compact).fits) {
         const envelope = JSON.parse(compact);
         const plan = planWindowBatches(windows, subset => JSON.stringify({ ...envelope, windows: subset, windowNotice: '本批仅审查windows包含的编辑，其他hunk另批；行号为原始行号，跨片段上下文不足说明限制。' }), measure);

package/src/process.mjs

@@ -1,10 +1,10 @@
 import { spawn } from 'node:child_process';
 
 /** Run only adapter-owned commands. No shell, prompts, or unbounded capture. */
-export function run(command, args, { cwd, signal, timeoutMs = 30_000, maxBytes = 8 * 1024 * 1024, env = {} } = {}) {
+export function run(command, args, { cwd, signal, timeoutMs = 0, maxBytes = 8 * 1024 * 1024, env = {} } = {}) {
   return new Promise((resolve, reject) => {
     signal?.throwIfAborted();
-    for (const value of [timeoutMs, maxBytes]) if (!Number.isSafeInteger(value) || value < 1) throw new Error('Invalid command limit');
+    if(!Number.isSafeInteger(timeoutMs)||timeoutMs<0||!Number.isSafeInteger(maxBytes)||maxBytes<1)throw new Error('Invalid command limit');
     const childEnv = { ...process.env, ...env };
     for (const key of Object.keys(childEnv)) if (/^GIT_/i.test(key)) delete childEnv[key];
     Object.assign(childEnv, { GIT_TERMINAL_PROMPT: '0', GIT_OPTIONAL_LOCKS: '0', GIT_NO_REPLACE_OBJECTS: '1', GIT_NO_LAZY_FETCH: '1' });
@@ -19,7 +19,7 @@ export function run(command, args, { cwd, signal, timeoutMs = 30_000, maxBytes =
     const abort = () => stop(signal.reason ?? new Error('Cancelled'));
     signal?.addEventListener('abort', abort, { once: true });
     if (signal?.aborted) abort();
-    const timer = setTimeout(() => stop(new Error('Command timeout')), timeoutMs);
+    const timer = timeoutMs>0?setTimeout(() => stop(new Error('Command timeout')), timeoutMs):undefined;
     const capture = chunks => data => {
       bytes += data.length;
       if (bytes > maxBytes) stop(new Error('Command output limit exceeded'));

package/src/project-review-service.mjs

@@ -7,11 +7,12 @@ import {projectInventory,captureProjectBatch} from './project-snapshot.mjs';
 import {reviewSnapshot,markdownReport} from './review.mjs';
 import {createDshModel} from './dsh-model.mjs';
 const owner=exec=>{const a=exec?.agent;if(!a?.session?.header?.cwd||!a.options?.provider||!a.options?.model)throw new Error('Active Agent with cwd and model required');return {agent:a,cwd:a.session.header.cwd,route:{provider:a.options.provider,model:a.options.model,...(a.options.reasoningEffort?{reasoningEffort:a.options.reasoningEffort}:{})}};};
-export function createProjectReviewService(llm,{allowModelSending=false,authorize=async()=>false,now=Date.now,ttlMs=300000,maxPreviews=8,projectMaxCalls=100}={}){
- if(!Number.isSafeInteger(projectMaxCalls)||projectMaxCalls<1||projectMaxCalls>100)throw new Error('Invalid project model call limit');
+export function createProjectReviewService(llm,{allowModelSending=false,authorize=async()=>false,now=Date.now,ttlMs=300000,maxPreviews=8,projectMaxCalls=Number.MAX_SAFE_INTEGER}={}){
+ for(const n of [ttlMs,maxPreviews])if(!Number.isSafeInteger(n)||n<1)throw new Error('Invalid project preview limit');
+ if(!Number.isSafeInteger(projectMaxCalls)||projectMaxCalls<1)throw new Error('Invalid project model call limit');
  const previews=new Map(),lifetime=new AbortController();let busy=false;
  async function capture(cwd,args,signal){
-  let commands=0,metadataBytes=0;const captureBudget={signal,reserve(){signal.throwIfAborted();if(++commands>4096)throw Object.assign(new Error('Project shared command budget exceeded'),{code:'PROJECT_CAPTURE_BUDGET'});},charge(size){metadataBytes+=size;if(metadataBytes>8*1024*1024)throw Object.assign(new Error('Project shared metadata budget exceeded'),{code:'PROJECT_CAPTURE_BUDGET'});}};
+  let commands=0,metadataBytes=0;const captureBudget={signal,reserve(){signal.throwIfAborted();commands++;},charge(size){metadataBytes+=size;if(metadataBytes>8*1024*1024)throw Object.assign(new Error('Project shared metadata budget exceeded'),{code:'PROJECT_CAPTURE_BUDGET'});}};
   const captureOptions={signal,svnCaptureBudget:captureBudget};
   const root=await realpath(await resolveWorkspaceRepository(cwd,args.repositoryPath)),vcs=await detectVcs(root),inventory=await projectInventory(root,vcs,captureOptions);
   let paths=inventory.records.map(r=>r.path);if(args.selectedPaths!==undefined){if(!Array.isArray(args.selectedPaths)||args.selectedPaths.length>1000||new Set(args.selectedPaths).size!==args.selectedPaths.length||args.selectedPaths.some(p=>!paths.includes(p)))throw new Error('Invalid tracked project selection');paths=paths.filter(p=>args.selectedPaths.includes(p));}
@@ -21,12 +22,13 @@ export function createProjectReviewService(llm,{allowModelSending=false,authoriz
   for(const b of batches)if((await captureProjectBatch(verified,b.files.map(f=>f.path),captureOptions)).id!==b.id)throw new Error('Project source changed during capture');
   const result={root,vcs,inventoryId:inventory.id,inventoryComplete:inventory.vcs==='git',totalTrackedNodes:inventory.records.length,selectedFiles:paths.length,selectionComplete:paths.length===inventory.records.length,notice:inventory.notice,batches};return {...result,id:hash(JSON.stringify(result))};
  }
- const signalFor=(exec,ms)=>AbortSignal.any([lifetime.signal,AbortSignal.timeout(ms),...(exec.signal?[exec.signal]:[])]);
+ const signalFor=exec=>AbortSignal.any([lifetime.signal,...(exec.signal?[exec.signal]:[])]);
  return {owns:id=>previews.has(id),
-  async preview(args,exec){if(busy)throw new Error('Review service busy');if(!args||typeof args!=='object')throw new Error('Project preview parameters required');if(Object.keys(args).some(k=>!['reviewMode','repositoryPath','selectedPaths'].includes(k))||args.reviewMode!=='project')throw new Error('Project mode supports only reviewMode/repositoryPath/selectedPaths; change/history context parameters are not project parameters');const current=owner(exec);busy=true;try{const s=await capture(current.cwd,args,signalFor(exec,120000));for(const [id,p]of previews)if(p.expires<=now())previews.delete(id);while(previews.size>=maxPreviews)previews.delete(previews.keys().next().value);const previewId=randomUUID();previews.set(previewId,{...current,args:structuredClone(args),snapshotId:s.id,expires:now()+ttlMs});return {previewId,snapshotId:s.id,reviewMode:'project',repositoryRoot:s.root,vcs:s.vcs,model:current.route,modelSendingEnabled:allowModelSending,totalTrackedNodes:s.totalTrackedNodes,selectedFiles:s.selectedFiles,selectionComplete:s.selectionComplete,inventoryComplete:s.inventoryComplete,batches:s.batches.length,files:s.batches.flatMap(b=>b.files.map(f=>({path:f.path,eligibility:f.eligibility,reason:f.reason}))),notice:s.notice+' Full current source audit, not regression-only diff. Shared session execution budget: '+projectMaxCalls+' model calls, 10 minutes, 16MiB capture. Blocked/excluded/pending files are not reviewed successfully. No untracked/ignored/external bodies; no complete semantic call graph. Show scope and model before confirmed execute.'};}finally{busy=false;}},
-  async execute(args,exec){if(busy)throw new Error('Review service busy');if(!allowModelSending)throw new Error('Model sending disabled');if(args.confirmed!==true||typeof args.previewId!=='string'||Object.keys(args).some(k=>!['previewId','confirmed'].includes(k)))throw new Error('Confirmed preview required');const p=previews.get(args.previewId),current=owner(exec);if(!p||p.expires<=now()||p.agent!==current.agent||p.cwd!==current.cwd||JSON.stringify(p.route)!==JSON.stringify(current.route))throw new Error('Preview missing expired or owner/model/directory changed');previews.delete(args.previewId);busy=true;const signal=signalFor(exec,600000);try{const s=await capture(current.cwd,p.args,signal);if(s.id!==p.snapshotId)throw new Error('Project changed since preview');if(await authorize({snapshot:s,route:p.route,exec})!==true)throw new Error('Model sending denied');if(owner(exec).cwd!==p.cwd||JSON.stringify(owner(exec).route)!==JSON.stringify(p.route))throw new Error('Agent changed during approval');signal.throwIfAborted();
-   let calls=0;const adapter=createDshModel(llm,p.route),model=request=>{if(calls>=projectMaxCalls)throw new Error('Shared project model call limit exceeded');calls++;return adapter(request);};const results=[];
-   for(const b of s.batches){if(signal.aborted||calls>=projectMaxCalls){results.push({snapshotId:b.id,status:'partial',files:b.files.map(f=>({fileId:f.id,path:f.path,status:f.eligibility==='reviewable'?'pending':f.eligibility,reason:'Session project budget exhausted or cancelled'})),findings:[],limitations:[]});continue;}results.push(await reviewSnapshot(b,model,{signal,maxCalls:projectMaxCalls-calls,enableRetrieval:true,enableVerification:true}));}
+  async preview(args,exec){if(busy)throw new Error('Review service busy');if(!args||typeof args!=='object')throw new Error('Project preview parameters required');if(Object.keys(args).some(k=>!['reviewMode','repositoryPath','selectedPaths'].includes(k))||args.reviewMode!=='project')throw new Error('Project mode supports only reviewMode/repositoryPath/selectedPaths; change/history context parameters are not project parameters');const current=owner(exec);busy=true;try{const s=await capture(current.cwd,args,signalFor(exec));for(const [id,p]of previews)if(p.expires<=now())previews.delete(id);while(previews.size>=maxPreviews)previews.delete(previews.keys().next().value);const previewId=randomUUID();previews.set(previewId,{...current,args:structuredClone(args),snapshotId:s.id,expires:now()+ttlMs});return {previewId,snapshotId:s.id,reviewMode:'project',repositoryRoot:s.root,vcs:s.vcs,model:current.route,modelSendingEnabled:allowModelSending,totalTrackedNodes:s.totalTrackedNodes,selectedFiles:s.selectedFiles,selectionComplete:s.selectionComplete,inventoryComplete:s.inventoryComplete,batches:s.batches.length,files:s.batches.flatMap(b=>b.files.map(f=>({path:f.path,eligibility:f.eligibility,reason:f.reason}))),notice:s.notice+' Full current source audit, not regression-only diff. Shared session execution budget: no internal elapsed-time or model-call cutoff, 16MiB capture memory protection. Blocked/excluded/pending files are not reviewed successfully. No untracked/ignored/external bodies; no complete semantic call graph. Show scope and model before confirmed execute.'};}finally{busy=false;}},
+  async execute(args,exec){if(busy)throw new Error('Review service busy');if(!allowModelSending)throw new Error('Model sending disabled');if(args.confirmed!==true||typeof args.previewId!=='string'||Object.keys(args).some(k=>!['previewId','confirmed'].includes(k)))throw new Error('Confirmed preview required');const p=previews.get(args.previewId),current=owner(exec);if(!p||p.expires<=now()||p.agent!==current.agent||p.cwd!==current.cwd||JSON.stringify(p.route)!==JSON.stringify(current.route))throw new Error('Preview missing expired or owner/model/directory changed');previews.delete(args.previewId);busy=true;const signal=signalFor(exec);try{const s=await capture(current.cwd,p.args,signal);if(s.id!==p.snapshotId)throw new Error('Project changed since preview');if(await authorize({snapshot:s,route:p.route,exec})!==true)throw new Error('Model sending denied');if(owner(exec).cwd!==p.cwd||JSON.stringify(owner(exec).route)!==JSON.stringify(p.route))throw new Error('Agent changed during approval');signal.throwIfAborted();
+   await exec.reviewCheckpoint?.({stage:'approved-manifest',snapshotId:s.id,files:s.batches.flatMap(b=>b.files.map(f=>({fileId:f.id,path:f.path,status:f.eligibility==='reviewable'?'pending':f.eligibility})))});
+   let calls=0;const adapter=createDshModel(llm,p.route,{correctJson:true}),model=request=>{if(calls>=projectMaxCalls)throw new Error('Shared project model call limit exceeded');calls++;return adapter({...request,onProtocolCorrection:async info=>{if(calls>=projectMaxCalls)throw new Error('Shared project model call limit exceeded');calls++;await request.onProtocolCorrection?.(info);}});};const results=[];
+   for(const b of s.batches){if(signal.aborted||calls>=projectMaxCalls){results.push({snapshotId:b.id,status:'partial',files:b.files.map(f=>({fileId:f.id,path:f.path,status:f.eligibility==='reviewable'?'pending':f.eligibility,reason:'Session project budget exhausted or cancelled'})),findings:[],limitations:[]});continue;}results.push(await reviewSnapshot(b,model,{signal,maxCalls:projectMaxCalls-calls,enableRetrieval:true,enableVerification:true,onProgress:exec.reviewCheckpoint}));}
    const files=results.flatMap(r=>r.files.map(f=>({...f,batchSnapshotId:r.snapshotId}))),coverage={total:s.selectedFiles,completed:files.filter(f=>f.status==='completed').length,excluded:files.filter(f=>f.status==='excluded').length,blocked:files.filter(f=>f.status==='blocked').length,pending:files.filter(f=>!['completed','excluded','blocked'].includes(f.status)).length};const findings=results.flatMap(r=>r.findings.map(f=>({...f,batchSnapshotId:r.snapshotId})));const report={schemaVersion:1,mode:'project',snapshotId:s.id,status:signal.aborted?'cancelled':coverage.total===0||coverage.completed===0?'partial':results.every(r=>r.status==='completed')&&files.every(f=>['completed','excluded'].includes(f.status))?'completed':'partial',repositoryRoot:s.root,vcs:s.vcs,model:p.route,modelCalls:calls,maxModelCalls:projectMaxCalls,totalTrackedNodes:s.totalTrackedNodes,selectionComplete:s.selectionComplete,inventoryComplete:s.inventoryComplete,coverage,files,findings,batches:results,notice:s.notice+' Coverage counts processing of selected tracked files only, not proof of correctness. Excluded and blocked are never completed. No cross-batch whole-program semantic coverage is claimed.'};
    try{report.outdated=(await capture(current.cwd,p.args,signal)).id!==s.id;}catch{report.outdated=true;}
    const lines=['# 全项目代码审查报告','','状态：'+report.status,'已完成：'+coverage.completed+'/'+coverage.total,'排除：'+coverage.excluded+'；阻断：'+coverage.blocked+'；未完成：'+coverage.pending,'',report.notice];for(let i=0;i<results.length;i++)lines.push('', '## 批次 '+(i+1),markdownReport({...results[i],coverage:results[i].coverage??{},interactions:results[i].interactions??[]}));if(report.outdated)lines.push('注意：项目已变化或无法复核，报告仅对应原批准快照。');return {report,markdown:lines.join(String.fromCharCode(10))};

package/src/recovery-coverage.mjs

@@ -0,0 +1,2 @@
+// Saved evidence is a ledger, not renewed source authority or automatic resume.
+export function recoveryCoverage(record){const states=new Map(),windows=new Map();for(const c of record.checkpoints??[]){if(c.stage==='approved-manifest')for(const f of c.files??[])states.set(f.path,{path:f.path,status:f.status,snapshotId:c.snapshotId});if(c.stage==='file-started')states.set(c.path,{path:c.path,status:c.status==='excluded'?'excluded':'pending',snapshotId:c.snapshotId});if(c.stage==='file-complete'&&c.file)states.set(c.file.path,{path:c.file.path,status:c.file.status,snapshotId:c.snapshotId});if(c.stage==='batch-complete')for(const f of c.files??[])states.set(f.path,{path:f.path,status:f.status,snapshotId:c.snapshotId});if(c.stage==='window-complete')windows.set(c.path,{path:c.path,snapshotId:c.snapshotId,...c.windowCoverage});}const final=record.result?.report;if(final?.files)for(const f of final.files)states.set(f.path,{path:f.path,status:f.status,snapshotId:f.batchSnapshotId??final.snapshotId});const files=[...states.values()];return {manifestSaved:(record.checkpoints??[]).some(c=>c.stage==='approved-manifest'),files,windows:[...windows.values()],suggestedPaths:files.filter(f=>!['completed','excluded'].includes(f.status)).map(f=>f.path),notice:'Saved approved manifest (when present) plus checkpoints; before that, only observed scope, not a complete denominator. Completed windows are not a completed file. New source sends require fresh preview and confirmation; no approval is restored from this ledger.'};}

package/src/review-jobs.mjs

@@ -0,0 +1,26 @@
+import {recoveryCoverage} from './recovery-coverage.mjs';
+import {randomUUID} from 'node:crypto';
+import {mkdir,writeFile,rename,readFile,lstat,realpath} from 'node:fs/promises';
+import path from 'node:path';
+
+// Report storage is host-owned, never inside a reviewed working copy.
+export function createReviewJobs({directory}={}){
+ if(typeof directory!=='string'||!path.isAbsolute(directory))throw new Error('Absolute host report directory required');
+ const jobs=new Map();let disposed=false,canonicalDirectory;
+ const identity=exec=>{const a=exec?.agent,s=a?.session;if(!s||!a.options?.provider||!a.options?.model||!s.header?.cwd)throw new Error('Review job requires session identity');const id=s.header.id??s.id;if(typeof id!=='string'||!id)throw new Error('Durable session id required');return {sessionId:id,cwd:s.header.cwd,provider:a.options.provider,model:a.options.model,reasoningEffort:a.options.reasoningEffort??null};};
+ const same=(a,b)=>JSON.stringify(a)===JSON.stringify(b);
+ const pageCheckpoint=(c,offset,limit)=>({...c,...(c.files?{files:c.files.slice(offset,offset+limit),totalFiles:c.files.length}:{}),...(c.findings?{findings:c.findings.slice(offset,offset+limit),totalFindings:c.findings.length}: {})});
+ const filename=id=>{if(typeof id!=='string'||!/^[a-f0-9-]{36}$/.test(id))throw new Error('Invalid review job id');return path.join(directory,id+'.json');};
+ async function safeDirectory(){await mkdir(directory,{recursive:true,mode:0o700});const stat=await lstat(directory),resolved=await realpath(directory);if(stat.isSymbolicLink()||!stat.isDirectory()||(canonicalDirectory!==undefined&&resolved!==canonicalDirectory))throw new Error('Unsafe report directory');canonicalDirectory??=resolved;}
+ async function save(job){await safeDirectory();const tmp=path.join(directory,job.id+'.'+randomUUID()+'.tmp');await writeFile(tmp,JSON.stringify(job.record),{mode:0o600,flag:'wx'});await rename(tmp,filename(job.id));}
+ async function owned(id,exec){const who=identity(exec),job=jobs.get(id);if(job){if(!same(who,job.record.owner))throw new Error('Foreign review job');return job.record;}await safeDirectory();const name=filename(id),stat=await lstat(name);if(stat.isSymbolicLink()||!stat.isFile())throw new Error('Unsafe report file');const r=JSON.parse(await readFile(name,'utf8'));if(!same(who,r.owner))throw new Error('Foreign review job');if(['queued','running'].includes(r.status)){r.status='interrupted';r.notice='Host restarted or plugin disposed. Saved checkpoints are available; resending requires a fresh preview and approval.';}return r;}
+ return {
+  async start(exec,work){if(disposed)throw new Error('Review job service disposed');exec.signal?.throwIfAborted();const who=identity(exec);const relative=path.relative(path.resolve(who.cwd),directory);if(relative===''||(!relative.startsWith('..'+path.sep)&&relative!=='..'&&!path.isAbsolute(relative)))throw new Error('Report store must be outside reviewed workspace');if([...jobs.values()].some(j=>j.record.owner.sessionId===who.sessionId&&['queued','running'].includes(j.record.status)))throw new Error('Session review job already active');const id=randomUUID(),controller=new AbortController(),job={id,controller,record:{jobId:id,owner:who,status:'queued',stage:'queued',checkpoints:[],createdAt:new Date().toISOString()},pending:Promise.resolve()};jobs.set(id,job);try{await save(job);}catch(error){jobs.delete(id);throw error;}const enqueue=fn=>{job.pending=job.pending.then(fn);return job.pending;};
+   // Own cancellation explicitly. The short start RPC ending is NOT task cancellation.
+   job.done=(async()=>{await Promise.resolve();try{job.record.status='running';await enqueue(()=>save(job));const result=await work({signal:controller.signal,checkpoint:async value=>enqueue(async()=>{job.record.stage=value.stage??'reviewing';job.record.checkpoints.push(structuredClone(value));await save(job);})});job.record.result=result;job.record.status=controller.signal.aborted?'cancelled':'completed';}catch(error){job.record.status=controller.signal.aborted?'cancelled':'failed';job.record.error=error?.message??String(error);}finally{job.record.finishedAt=new Date().toISOString();try{await enqueue(()=>save(job));}catch(error){job.record.status='failed';job.record.persistenceError=error.message;}}})();return {jobId:id,status:'queued',notice:'Background job accepted. Poll status; start is not a completed review. Explicit cancel or plugin disposal stops it.'};
+  },
+  async status(id,exec,page){const r=structuredClone(await owned(id,exec));r.recovery=recoveryCoverage(r);if(!page)return r;const {offset=0,limit=20,checkpointIndex}=page;if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(limit)||limit<1||limit>100)throw new Error('Invalid result page');if(checkpointIndex!==undefined){if(!Number.isSafeInteger(checkpointIndex)||checkpointIndex<0||checkpointIndex>=r.checkpoints.length)throw new Error('Invalid checkpoint index');return {jobId:r.jobId,status:r.status,checkpointIndex,checkpoint:pageCheckpoint(r.checkpoints[checkpointIndex],offset,limit),page:{offset,limit}};}const result=r.result;const report=result?.report;return {...r,result:undefined,recovery:{...r.recovery,files:r.recovery.files.slice(offset,offset+limit),windows:r.recovery.windows.slice(offset,offset+limit),suggestedPaths:r.recovery.suggestedPaths.slice(offset,offset+limit),totalObservedFiles:r.recovery.files.length},checkpoints:r.checkpoints.slice(offset,offset+limit).map(c=>pageCheckpoint(c,0,limit)),checkpointPage:{offset,limit,total:r.checkpoints.length},...(result?{resultSummary:report?{status:report.status,coverage:report.coverage,model:report.model,snapshotId:report.snapshotId}:({...result,files:result.files?.slice(offset,offset+limit),filePage:result.files?{offset,limit,total:result.files.length}:undefined}),resultPage:report?{files:report.files?.slice(offset,offset+limit),findings:report.findings?.slice(offset,offset+limit),totalFiles:report.files?.length,totalFindings:report.findings?.length}:undefined}: {})};},
+  async cancel(id,exec){await owned(id,exec);const j=jobs.get(id);if(j)j.controller.abort(new Error('User cancelled review job'));return {jobId:id,cancelRequested:!!j};},
+  async dispose(){disposed=true;for(const j of jobs.values())j.controller.abort(new Error('Review plugin disposed'));await Promise.all([...jobs.values()].map(j=>j.done));}
+ };
+}

package/src/review.mjs

@@ -64,7 +64,7 @@ async function invoke(model, request, timeoutMs, parentSignal) {
   const abort = () => controller.abort(parentSignal.reason);
   parentSignal?.addEventListener('abort', abort, { once: true });
   if (parentSignal?.aborted) abort();
-  const timer = setTimeout(() => controller.abort(Object.assign(new Error('Model timeout'), { code: 'MODEL_TIMEOUT' })), timeoutMs);
+  const timer = timeoutMs>0?setTimeout(() => controller.abort(Object.assign(new Error('Model timeout'), { code: 'MODEL_TIMEOUT' })), timeoutMs):undefined;
   try {
     controller.signal.throwIfAborted();
     // Executors must honor cancellation; never release ownership before cleanup settles.
@@ -79,9 +79,10 @@ async function invoke(model, request, timeoutMs, parentSignal) {
 
 export async function reviewSnapshot(snapshot, model, options = {}) {
   const rounds = reviewRounds(options.reviewRounds);
-  const { signal, maxInputBytes = 96 * 1024, maxCalls = 100, timeoutMs = 120_000 } = options;
+  const { signal, maxInputBytes = 96 * 1024, maxCalls = Number.MAX_SAFE_INTEGER, timeoutMs = 0 } = options;
   if (typeof model !== 'function') throw new Error('A model executor is required');
-  for (const n of [maxInputBytes, maxCalls, timeoutMs]) if (!Number.isSafeInteger(n) || n < 1) throw new Error('Invalid review limit');
+  for(const n of [maxInputBytes,maxCalls])if(!Number.isSafeInteger(n)||n<1)throw new Error('Invalid review limit');
+  if(!Number.isSafeInteger(timeoutMs)||timeoutMs<0)throw new Error('Invalid review limit');
   // Clone once: callers cannot change the input while a model call is pending.
   const input = structuredClone(snapshot);
   const instructions=input.projectScope?PROJECT_REVIEW_INSTRUCTIONS:REVIEW_INSTRUCTIONS;
@@ -118,8 +119,10 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   const interactionPlans = scope && report.grouping ? report.grouping.groups.filter(g => g.fileIds.length > 1).map(group => ({ group, prepared: prepareInteractionInput(input, group, payload => initialInputBudget({ instructions, input: payload }, scope, maxInputBytes)) })) : [];
   for (const plan of interactionPlans.filter(p => p.prepared.status !== 'not-applicable')) report.interactions.push({ groupId: plan.group.id, fileIds: plan.prepared.fileIds, status: plan.prepared.status === 'ready' ? 'pending' : 'blocked', reason: plan.prepared.reason, lifecycle: 'shares-last-primary-timeout' });
   for (const file of input.files) {
+    if(report.files.length)await options.onProgress?.({stage:'file-complete',snapshotId:input.id,file:report.files.at(-1),findings:report.findings.filter(f=>f.fileId===report.files.at(-1).fileId)});
     const state = { fileId: file.id, path: file.path, status: file.eligibility === 'reviewable' ? 'pending' : file.eligibility, reason: file.reason, ...(file.blockCode ? {blockCode:file.blockCode} : {}) };
     report.files.push(state);
+    await options.onProgress?.({stage:'file-started',snapshotId:input.id,fileId:file.id,path:file.path,status:state.status});
     if (state.status !== 'pending') continue;
     if (signal?.aborted) { state.status = 'cancelled'; state.reason = '用户取消'; continue; }
     if (report.modelCalls >= maxCalls) { state.reason = '模型调用预算耗尽'; continue; }
@@ -130,6 +133,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
     if (prepared.synthesis) state.synthesisStatus = prepared.synthesis.budget.fits ? 'pending' : 'blocked';
     if (prepared.synthesis && !prepared.synthesis.budget.fits) report.limitations.push({ fileId: file.id, text: '跨窗口综合输入超限，未发送；单窗口完成不表示交互影响已检查' });
     if (state.sourceMode === 'change-windows') state.windowCoverage = { completed: [], pending: [...state.windowIds] };
+    if(changes.precision==='envelope')report.limitations.push({fileId:file.id,text:'精确差异不可得，按保守包络分段检查；包络包含可能未变的行，不证明精确编辑或回归因果。'});
     if (changes.status === 'limited') report.limitations.push({ fileId: file.id, text: '精确变更分析受限：' + changes.reason + '；仍按完整两侧内容审查' });
     if (state.groupFallback) report.limitations.push({ fileId: file.id, text: '关联组上下文超过输入预算，回退单文件审查' });
     if (state.initialInputBytes > maxInputBytes) { state.status = 'blocked'; state.reason = '输入超过预算，未截断或提交模型'; continue; }
@@ -138,14 +142,15 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         if (report.modelCalls >= maxCalls) throw new Error('Model call budget exceeded');
         report.modelCalls++;
       };
+      const trackedModel=request=>model({...request,onProtocolCorrection:async info=>{beforeCall();await request.onProtocolCorrection?.(info);await options.onProgress?.({stage:'protocol-correction',fileId:file.id,path:file.path,...info});}});
       const executor = scope
-        ? request => retrievalLoop(model, request, scope, { maxInputBytes, beforeCall, onRetrieved: records => {
+        ? request => retrievalLoop(trackedModel, request, scope, { maxInputBytes, beforeCall, onRetrieved: records => {
           (state.retrievalAudit ??= []).push(...records);
         }, onTruncated: () => {
           if (!state.retrievalTruncated) report.limitations.push({ fileId: file.id, text: '检索结果达到数量上限，部分匹配未提供给模型' });
           state.retrievalTruncated = true;
         } })
-        : request => { beforeCall(); return model(request); };
+        : request => { beforeCall(); return trackedModel(request); };
       await invoke(async enclosingRequest => {
         if (options.enableBusinessGrouping === true && !report.businessGrouping && prepareBusinessGroups(input.files)) {
           report.businessGrouping = { status: 'pending' };
@@ -240,7 +245,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         if (options.enableVerification === true && generated.findings.length) {
           for (const finding of generated.findings) finding.verification = { status: 'pending', causality: 'unverified' };
           try {
-            const verdicts = await verificationLoop(model, request, generated.findings, scope, {
+            const verdicts = await verificationLoop(trackedModel, request, generated.findings, scope, {
               maxInputBytes, beforeCall,
               onRetrieved: records => { (state.retrievalAudit ??= []).push(...records); },
               onTruncated: () => { report.limitations.push({ fileId: file.id, text: '复核检索结果达到数量上限' }); },
@@ -266,6 +271,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           state.windowCoverage.pending = state.windowCoverage.pending.filter(id => !batch.windowIds.includes(id));
         }
         if(rounds>1)state.reviewPasses[batchIndex].status='completed';
+        await options.onProgress?.({stage:'window-complete',snapshotId:input.id,fileId:file.id,path:file.path,windowIds:batch.windowIds,round:batch.round,findings:generated.findings,windowCoverage:state.windowCoverage});
         }
       }, { instructions, input: payload }, timeoutMs, signal);
       if (signal?.aborted) throw signal.reason;
@@ -279,6 +285,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
       state.failureCode = signal?.aborted ? 'CANCELLED' : ['MODEL_INVALID_JSON','MODEL_TIMEOUT','MODEL_INVALID_READ_REQUEST'].includes(error?.code) ? error.code : 'REVIEW_EXECUTION_FAILED';
     }
   }
+  await options.onProgress?.({stage:'batch-complete',snapshotId:input.id,files:report.files,findings:report.findings,limitations:report.limitations});
   for (const interaction of report.interactions) if (interaction.status !== 'completed') report.limitations.push({ text: '跨文件综合未完成：' + interaction.groupId + ' (' + interaction.status + ')' });
   if (report.grouping?.links.some(l => l.split)) report.limitations.push({ text: '跨组关系未综合覆盖；关联分组不代表全部跨文件交互覆盖' });
   const reviewableCount = input.files.filter(f => f.eligibility === 'reviewable').length;

package/src/runtime-identity.mjs

@@ -0,0 +1,4 @@
+import {readFileSync} from 'node:fs';
+import {fileURLToPath} from 'node:url';
+const manifestUrl=new URL('../package.json',import.meta.url);
+export const REVIEW_RUNTIME=Object.freeze({version:JSON.parse(readFileSync(manifestUrl,'utf8')).version,modulePath:fileURLToPath(new URL('../index.mjs',import.meta.url)),defaultInternalDeadline:false});

package/src/service.mjs

@@ -1,3 +1,4 @@
+import {REVIEW_RUNTIME} from './runtime-identity.mjs';
 import {createProjectReviewService} from './project-review-service.mjs';
 import {svnDiagnostic} from './svn-diagnostics.mjs';
 import { reviewRounds as validateReviewRounds } from './review-rounds.mjs';
@@ -51,7 +52,7 @@ function createSessionReviewService(llm, { capture = captureSnapshot, now = Date
         while (previews.size >= maxPreviews) previews.delete(previews.keys().next().value);
         const previewId = randomUUID();
         previews.set(previewId, { ...current, target, options, rounds, snapshotId: snapshot.id, expires: now() + ttlMs });
-        return { ...(options.businessRequirement!==undefined?{businessRequirement:{text:options.businessRequirement,hash:hash(options.businessRequirement),bytes:Buffer.byteLength(options.businessRequirement)}}:{}), previewId, plan, snapshotId: snapshot.id, repositoryRoot: snapshot.root, vcs: snapshot.vcs,...(snapshot.workingScope?{workingScope:snapshot.workingScope}:{}), ...(snapshot.history ? { history: snapshot.history } : {}), ...(snapshot.mergeSources ? {mergeSources:snapshot.mergeSources} : {}),...(snapshot.effectiveMergeSources?{effectiveMergeSources:snapshot.effectiveMergeSources}:{}), model: current.route, modelSendingEnabled: allowModelSending, files: snapshot.files.map(f => ({ path: f.path,...(f.workingSource?{workingSource:f.workingSource}:{}),...(f.replacementSource?{replacementSource:f.replacementSource,contentNotice:f.contentNotice}:{}), eligibility: f.eligibility, reason: f.reason,...(f.specialData?{specialData:f.specialData,contentNotice:f.contentNotice}:{}), ...(f.eolMapping?{eolMapping:f.eolMapping,textNotice:f.textNotice}:{}), ...(f.keywordMapping?{keywordMapping:f.keywordMapping,textNotice:f.textNotice}:{}), ...(f.rawStatus==='replaced'&&(snapshot.history?.vcs==='svn'||f.replacementSource)?{oldKind:f.oldKind,newKind:f.newKind,nodeNotice:f.nodeNotice}:{}), ...(f.blockCode ? {blockCode:f.blockCode,...(svnDiagnostic(f.blockCode)?{diagnostic:svnDiagnostic(f.blockCode)}:{})} : {}), ...(f.copySource ? {copySource:f.copySource,copyNotice:f.copyNotice} : {}) })), contextPaths: snapshot.context.map(c => c.path), ...(snapshot.context.some(c=>c.keywordMapping)?{contextKeywordMappings:snapshot.context.filter(c=>c.keywordMapping).map(c=>({path:c.path,keywordMapping:c.keywordMapping}))}:{}), ...(snapshot.context.some(c=>c.eolMapping)?{contextEolMappings:snapshot.context.filter(c=>c.eolMapping).map(c=>({path:c.path,eolMapping:c.eolMapping}))}:{}), ...(snapshot.history?.vcs==='svn'?{contextSources:snapshot.context.map(c=>({path:c.path,...(c.svnSource?{new:c.svnSource}:{}),...(c.oldSvnSource?{old:c.oldSvnSource}:{})}))}:{}), ...(options.oldContextPaths !== undefined ? {oldContextPaths:options.oldContextPaths,oldContextSources:snapshot.context.filter(c=>c.oldOnly).map(c=>({path:c.path,side:'context-old',revision:c.oldRevision,...(c.oldSvnSource?{svnSource:c.oldSvnSource}:{blobOid:c.oldBlobOid}),hash:c.oldHash}))} : {}), ...(snapshot.callerDiscovery ? {callerDiscovery:snapshot.callerDiscovery} : {}), ...(snapshot.autoContext ? { autoContext: snapshot.autoContext } : {}), rules: (snapshot.rules ?? []).map(({ path, hash }) => ({ path, hash })), notice: (snapshot.history?.vcs==='svn'&&options.autoContext===true?'SVN历史autoContext为精确依赖定位读取固定版本父目录有界清单，包含同目录非匹配名字元数据；仅匹配捕获正文发送模型，不扫描全仓，不用工作树替代历史版本。':'') + (options.oldContextPaths !== undefined ? 'oldContextPaths仅为baseline旧侧正文，无目标侧替代；选中变更复用原old身份，旧侧不能证明新侧行为。' : '') + (snapshot.callerDiscovery ? 'callerScopePaths已授权预览读取限定目录内tracked候选正文，包括不匹配文件；非匹配正文不发送模型，匹配捕获上下文会发送。仅字面引用导航，不是函数调用或完整调用覆盖。' : '') + (enableRiskPlanning ? '执行按plan阈值决定风险假设规划，小变更可跳过独立规划但仍主审并复核；计划不是证据，所有阶段共享原预算。' : '') + '执行会向上述模型提供方发送可审查文件两侧内容、预览列出的显式/自动上下文、所选项目规则全文及预览业务需求文本。模型可在该快照范围内多轮只读检索，不读取范围外文件；候选生成后会进行证据与反证复核，两阶段各最多3轮检索，共享每文件120秒和总模型调用100次预算；复核不能证明缺陷成立。plan.reviewRounds为独立审查工作量，非模型reasoning effort；后续轮不带首轮风险计划，所有轮共享原超时与预算。plan仅预检初始输入，ready不代表已审查；minimumCalls不含后续检索/复核/动态业务综合；多文件可先进行业务分组，分组失败保留原组并记录限制，动态综合数执行前未知，实际预算可能不足。请先向用户展示范围，获得确认后执行。' };
+        return { ...(options.businessRequirement!==undefined?{businessRequirement:{text:options.businessRequirement,hash:hash(options.businessRequirement),bytes:Buffer.byteLength(options.businessRequirement)}}:{}), previewId, plan, snapshotId: snapshot.id, repositoryRoot: snapshot.root, vcs: snapshot.vcs,...(snapshot.workingScope?{workingScope:snapshot.workingScope}:{}), ...(snapshot.history ? { history: snapshot.history } : {}), ...(snapshot.mergeSources ? {mergeSources:snapshot.mergeSources} : {}),...(snapshot.effectiveMergeSources?{effectiveMergeSources:snapshot.effectiveMergeSources}:{}), model: current.route, modelSendingEnabled: allowModelSending, files: snapshot.files.map(f => ({ path: f.path,...(f.workingSource?{workingSource:f.workingSource}:{}),...(f.replacementSource?{replacementSource:f.replacementSource,contentNotice:f.contentNotice}:{}), eligibility: f.eligibility, reason: f.reason,...(f.specialData?{specialData:f.specialData,contentNotice:f.contentNotice}:{}), ...(f.eolMapping?{eolMapping:f.eolMapping,textNotice:f.textNotice}:{}), ...(f.keywordMapping?{keywordMapping:f.keywordMapping,textNotice:f.textNotice}:{}), ...(f.rawStatus==='replaced'&&(snapshot.history?.vcs==='svn'||f.replacementSource)?{oldKind:f.oldKind,newKind:f.newKind,nodeNotice:f.nodeNotice}:{}), ...(f.blockCode ? {blockCode:f.blockCode,...(svnDiagnostic(f.blockCode)?{diagnostic:svnDiagnostic(f.blockCode)}:{})} : {}), ...(f.copySource ? {copySource:f.copySource,copyNotice:f.copyNotice} : {}) })), contextPaths: snapshot.context.map(c => c.path), ...(snapshot.context.some(c=>c.keywordMapping)?{contextKeywordMappings:snapshot.context.filter(c=>c.keywordMapping).map(c=>({path:c.path,keywordMapping:c.keywordMapping}))}:{}), ...(snapshot.context.some(c=>c.eolMapping)?{contextEolMappings:snapshot.context.filter(c=>c.eolMapping).map(c=>({path:c.path,eolMapping:c.eolMapping}))}:{}), ...(snapshot.history?.vcs==='svn'?{contextSources:snapshot.context.map(c=>({path:c.path,...(c.svnSource?{new:c.svnSource}:{}),...(c.oldSvnSource?{old:c.oldSvnSource}:{})}))}:{}), ...(options.oldContextPaths !== undefined ? {oldContextPaths:options.oldContextPaths,oldContextSources:snapshot.context.filter(c=>c.oldOnly).map(c=>({path:c.path,side:'context-old',revision:c.oldRevision,...(c.oldSvnSource?{svnSource:c.oldSvnSource}:{blobOid:c.oldBlobOid}),hash:c.oldHash}))} : {}), ...(snapshot.callerDiscovery ? {callerDiscovery:snapshot.callerDiscovery} : {}), ...(snapshot.autoContext ? { autoContext: snapshot.autoContext } : {}), rules: (snapshot.rules ?? []).map(({ path, hash }) => ({ path, hash })), notice: (snapshot.history?.vcs==='svn'&&options.autoContext===true?'SVN历史autoContext为精确依赖定位读取固定版本父目录有界清单，包含同目录非匹配名字元数据；仅匹配捕获正文发送模型，不扫描全仓，不用工作树替代历史版本。':'') + (options.oldContextPaths !== undefined ? 'oldContextPaths仅为baseline旧侧正文，无目标侧替代；选中变更复用原old身份，旧侧不能证明新侧行为。' : '') + (snapshot.callerDiscovery ? 'callerScopePaths已授权预览读取限定目录内tracked候选正文，包括不匹配文件；非匹配正文不发送模型，匹配捕获上下文会发送。仅字面引用导航，不是函数调用或完整调用覆盖。' : '') + (enableRiskPlanning ? '执行按plan阈值决定风险假设规划，小变更可跳过独立规划但仍主审并复核；计划不是证据，所有阶段共享原预算。' : '') + '执行会向上述模型提供方发送可审查文件两侧内容、预览列出的显式/自动上下文、所选项目规则全文及预览业务需求文本。模型可在该快照范围内多轮只读检索，不读取范围外文件；候选生成后会进行证据与反证复核，两阶段各最多3轮检索，不设插件内部默认时间或总模型调用次数截止，遵循宿主/用户取消；输入字节和检索轮次保护仍保留；复核不能证明缺陷成立。plan.reviewRounds为独立审查工作量，非模型reasoning effort；后续轮不带首轮风险计划，所有轮共享原超时与预算。plan仅预检初始输入，ready不代表已审查；minimumCalls不含后续检索/复核/动态业务综合；多文件可先进行业务分组，分组失败保留原组并记录限制，动态综合数执行前未知，实际预算可能不足。请先向用户展示范围，获得确认后执行。' };
       } finally { busy = false; }
     },
     async execute(args, exec) {
@@ -74,7 +75,8 @@ function createSessionReviewService(llm, { capture = captureSnapshot, now = Date
         if (await authorize({ snapshot, route: preview.route, exec }) !== true) throw new Error('Model sending approval denied or unavailable');
         exec.signal?.throwIfAborted();
         if (owner(exec).cwd !== current.cwd || JSON.stringify(owner(exec).route) !== JSON.stringify(preview.route)) throw new Error('Agent changed during approval');
-        const report = await reviewSnapshot(snapshot, createDshModel(llm, preview.route), { signal: exec.signal, enableRetrieval: true, enableGrouping: true, enableVerification: true, enableRiskPlanning, skipSmallRiskPlans, reviewRounds:preview.rounds, enableBusinessGrouping, enableAnchorCorrection });
+        await exec.reviewCheckpoint?.({stage:'approved-manifest',snapshotId:snapshot.id,files:snapshot.files.map(f=>({fileId:f.id,path:f.path,status:f.eligibility==='reviewable'?'pending':f.eligibility}))});
+        const report = await reviewSnapshot(snapshot, createDshModel(llm, preview.route,{correctJson:true}), { signal: exec.signal, enableRetrieval: true, enableGrouping: true, enableVerification: true, enableRiskPlanning, skipSmallRiskPlans, reviewRounds:preview.rounds, enableBusinessGrouping, enableAnchorCorrection, onProgress:exec.reviewCheckpoint });
         report.model = preview.route;
         const latest = await resolveWorkspaceRepository(current.cwd, preview.options.repositoryPath).then(target => target === preview.target ? capture(target, { ...preview.options, signal: exec.signal }) : null).catch(() => null);
         report.outdated = !latest || latest.id !== snapshot.id || owner(exec).cwd !== current.cwd;
@@ -88,5 +90,5 @@ function createSessionReviewService(llm, { capture = captureSnapshot, now = Date
 export function createReviewService(llm,options={}){
  const sessions=new Map();let disposed=false;
  const get=exec=>{if(disposed)throw new Error('Review service disposed');const agent=exec?.agent,key=agent?.session??agent;if(!key||typeof key!=='object')throw new Error('Active Agent required');if(!sessions.has(key)){const changes=createSessionReviewService(llm,options),project=createProjectReviewService(llm,options);let locked=false;const call=async(kind,args,exec)=>{if(locked)throw new Error('Review service busy');locked=true;try{return await (kind==='preview'?(args?.reviewMode==='project'?project.preview(args,exec):changes.preview(args?.reviewMode==='changes'?Object.fromEntries(Object.entries(args).filter(([key])=>key!=='reviewMode')):args,exec)):(project.owns(args?.previewId)?project.execute(args,exec):changes.execute(args,exec)));}finally{locked=false;}};sessions.set(key,{preview:(a,e)=>call('preview',a,e),execute:(a,e)=>call('execute',a,e),dispose(){changes.dispose();project.dispose();}});}return sessions.get(key);};
- return {preview:async(args,exec)=>get(exec).preview(args,exec),execute:async(args,exec)=>get(exec).execute(args,exec),dispose(){disposed=true;for(const service of sessions.values())service.dispose();sessions.clear();}};
+ return {preview:async(args,exec)=>{const started=Date.now();await exec?.reviewCheckpoint?.({stage:'preview-started',runtime:REVIEW_RUNTIME});const result=await get(exec).preview(args,exec);return {...result,runtime:REVIEW_RUNTIME,elapsedMs:Date.now()-started};},execute:async(args,exec)=>get(exec).execute(args,exec),dispose(){disposed=true;for(const service of sessions.values())service.dispose();sessions.clear();}};
 }

package/src/source-segments.mjs

@@ -0,0 +1,7 @@
+// Linear segmentation of approved text. Coordinates remain original one-based lines.
+export function sourceSegments(windows,{maxBytes=12000,maxLines=100}={}){
+ const out=[];for(const w of windows){if(w.old.count<=maxLines&&w.new.count<=maxLines&&Buffer.byteLength(w.old.text)<=maxBytes&&Buffer.byteLength(w.new.text)<=maxBytes){out.push(w);continue;}const sides={old:w.old.text.match(/[^\n]*\n|[^\n]+$/g)??[],new:w.new.text.match(/[^\n]*\n|[^\n]+$/g)??[]},pos={old:0,new:0};let i=0;
+  while(pos.old<sides.old.length||pos.new<sides.new.length){const item={id:w.id+'-s'+(++i),editIds:[...w.editIds]};for(const side of ['old','new']){const start=pos[side],parts=[];let bytes=0;while(pos[side]<sides[side].length&&parts.length<maxLines){const line=sides[side][pos[side]],n=Buffer.byteLength(line);if(parts.length&&bytes+n>maxBytes)break;parts.push(line);bytes+=n;pos[side]++;if(bytes>=maxBytes)break;}item[side]={start:w[side].start+start,count:parts.length,text:parts.join('')};}out.push(item);}
+  if(!i)out.push(w);
+ }return out;
+}

package/src/svn-caller-capture.mjs

@@ -1,3 +1,4 @@
+import {captureSignal} from './capture-signal.mjs';
 import {svnCallerIndex} from './svn-caller-index.mjs';
 import {svnCallerNode,svnCallerProbes} from './svn-caller-node.mjs';
 
@@ -9,8 +10,7 @@ import {createSvnNavigationBudget} from './svn-navigation-budget.mjs';
 
 // Called only by preview capture, never by a model retrieval request.
 export async function captureSvnCallers(root, files, scopes, options={}) {
- const deadline=AbortSignal.timeout(30000);
- const signal=options.signal?AbortSignal.any([options.signal,deadline]):deadline;
+ const signal=captureSignal(options.signal);
  const bounded={...options,signal,svnNavigationBudget:options.svnNavigationBudget??createSvnNavigationBudget(signal),maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024)};
  const index=await svnCallerIndex(root,scopes,bounded);
  const changed=new Set(files.flatMap(f=>[f.path,...(f.oldPath?[f.oldPath]:[])]));

package/src/svn-capture-budget.mjs

@@ -1,6 +1,7 @@
+import {captureSignal} from './capture-signal.mjs';
 // Shared across initial capture, navigation, mergeinfo and final verification.
 export function createSvnCaptureBudget(signal){
- const deadline=AbortSignal.any([AbortSignal.timeout(30000),...(signal?[signal]:[])]);let commands=0,metadataBytes=0,bodyBytes=0;
+ const deadline=captureSignal(signal);let commands=0,metadataBytes=0,bodyBytes=0;
  const error=message=>Object.assign(new Error(message),{code:'SVN_CAPTURE_BUDGET'});
- return Object.freeze({signal:deadline,reserve(){deadline.throwIfAborted();if(++commands>512)throw error('SVN capture shared command budget exceeded');},charge(size,body=false){deadline.throwIfAborted();if(!Number.isSafeInteger(size)||size<0)throw error('Invalid SVN capture byte charge');if(body){bodyBytes+=size;if(bodyBytes>16*1024*1024)throw error('SVN capture shared verification body budget exceeded');}else{metadataBytes+=size;if(metadataBytes>1024*1024)throw error('SVN capture shared metadata budget exceeded');}},usage(){return {commands,metadataBytes,bodyBytes};}});
+ return Object.freeze({signal:deadline,reserve(){deadline.throwIfAborted();commands++;},charge(size,body=false){deadline.throwIfAborted();if(!Number.isSafeInteger(size)||size<0)throw error('Invalid SVN capture byte charge');if(body){bodyBytes+=size;if(bodyBytes>16*1024*1024)throw error('SVN capture shared verification body budget exceeded');}else{metadataBytes+=size;if(metadataBytes>1024*1024)throw error('SVN capture shared metadata budget exceeded');}},usage(){return {commands,metadataBytes,bodyBytes};}});
 }

package/src/svn-dependency-chain.mjs

@@ -1,3 +1,4 @@
+import {captureSignal} from './capture-signal.mjs';
 import {contextCandidates} from './context-candidates.mjs';
 import {svnCallerNode,svnCallerProbes} from './svn-caller-node.mjs';
 import {captureSvnExplicitContext} from './svn-explicit-context.mjs';
@@ -5,7 +6,7 @@ import {createSvnNavigationBudget} from './svn-navigation-budget.mjs';
 
 // Exact local path probes only. Every body requires safe offline SVN node identity.
 export async function captureSvnDependencyChain(root,files,options={}){
- const signal=AbortSignal.any([AbortSignal.timeout(30000),...(options.signal?[options.signal]:[])]),bounded={...options,signal,svnNavigationBudget:options.svnNavigationBudget??createSvnNavigationBudget(signal),maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024)};
+ const signal=captureSignal(options.signal),bounded={...options,signal,svnNavigationBudget:options.svnNavigationBudget??createSvnNavigationBudget(signal),maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024)};
  const visited=new Set(files.map(f=>f.path)),reserved=new Set([...(options.contextPaths??[]),...(options.rulePaths??[])]),probes=new Set(),context=[],candidates=[],nodes=[];let frontier=[...files],bytes=0,truncated=false,index;
  const limit=Math.min(options.maxContextFiles??20,20);if(new Set(options.contextPaths??[]).size>limit)throw new Error('Context file limit exceeded');
  const capture=async name=>{const value=await captureSvnExplicitContext(root,[name],bounded);bytes+=value.sourceBytes;if(bytes>1024*1024)throw new Error('SVN dependency source byte limit exceeded');return {item:value.context[0],node:value.identities[0]};};

package/src/svn-explicit-context.mjs

@@ -1,10 +1,11 @@
+import {captureSignal} from './capture-signal.mjs';
 import {svnCallerNode} from './svn-caller-node.mjs';
 import {readLocal,decode} from './content.mjs';
 import {checked} from './process.mjs';
 import {svnKeywordMapping} from './svn-keyword-mapping.mjs';
 import {svnEolMapping} from './svn-eol-mapping.mjs';
 export async function captureSvnExplicitContext(root,names,options={}){
- const signal=AbortSignal.any([AbortSignal.timeout(30000),...(options.signal?[options.signal]:[])]),bounded={...options,allowExplicitKeywords:true,signal,maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024)};
+ const signal=captureSignal(options.signal),bounded={...options,allowExplicitKeywords:true,signal,maxFileBytes:Math.min(options.maxFileBytes??256*1024,256*1024)};
  if(!Array.isArray(names)||names.length>20||new Set(names).size!==names.length)throw new Error('Invalid SVN explicit context selection');
  const context=[],identities=[];let bytes=0;
  for(const name of names){

package/src/svn-history.mjs

@@ -1,3 +1,4 @@
+import {captureSignal} from './capture-signal.mjs';
 import {sameSvnUrl,canonicalSvnUrl} from './svn-url.mjs';
 import {svnHistoryEndpoints} from './svn-history-endpoints.mjs';
 import {realpath} from 'node:fs/promises';
@@ -62,11 +63,11 @@ export async function captureSvnHistory(cwd,options={}) {
   for(const [value,cap]of [[maxFiles,200],[maxFileBytes,256*1024],[maxSnapshotBytes,4*1024*1024]])if(!Number.isSafeInteger(value)||value<1||value>cap)throw new Error('Invalid SVN history limit');
   if(selectedPaths!==undefined && (!Array.isArray(selectedPaths)||selectedPaths.length>200||new Set(selectedPaths).size!==selectedPaths.length))throw new Error('Invalid SVN history selection');
   for(const name of selectedPaths??[])if(name!=='.')relativePath(name);
-  const signal=AbortSignal.any([AbortSignal.timeout(30000),...(options.signal?[options.signal]:[])]);
+  const signal=captureSignal(options.signal);
   let commands=0,metadataBytes=0,sourceBytes=0;
   const budgetError = message => Object.assign(new Error(message), {code:'SVN_HISTORY_BUDGET'});
   const run=async(args,body=false)=>{
-    signal.throwIfAborted();if(++commands>512 || metadataBytes>1024*1024 || sourceBytes>maxSnapshotBytes)throw budgetError('SVN historical shared budget exceeded');
+    signal.throwIfAborted();commands++;if(metadataBytes>1024*1024 || sourceBytes>maxSnapshotBytes)throw budgetError('SVN historical shared budget exceeded');
     const bytes=await checked('svn',['--non-interactive',...args],{cwd,signal,maxBytes:body?maxFileBytes:1024*1024});
     if(body){sourceBytes+=bytes.length;if(sourceBytes>maxSnapshotBytes)throw budgetError('SVN historical source budget exceeded');}
     else{metadataBytes+=bytes.length;if(metadataBytes>1024*1024)throw budgetError('SVN historical metadata budget exceeded');}

package/src/svn-navigation-budget.mjs

@@ -1,5 +1,6 @@
+import {captureSignal} from './capture-signal.mjs';
 // One source ledger/deadline per working-copy navigation capture, never per stage.
 export function createSvnNavigationBudget(signal){
- const sharedSignal=AbortSignal.any([AbortSignal.timeout(30000),...(signal?[signal]:[])]);let bytes=0;
+ const sharedSignal=captureSignal(signal);let bytes=0;
  return Object.freeze({signal:sharedSignal,charge(size){sharedSignal.throwIfAborted();if(!Number.isSafeInteger(size)||size<0)throw new Error('Invalid SVN navigation source size');bytes+=size;if(bytes>1024*1024)throw Object.assign(new Error('SVN shared navigation source byte limit exceeded'),{code:'SVN_NAVIGATION_BUDGET'});},usage(){return bytes;}});
 }

package/src/svn-working-mergeinfo.mjs

@@ -1,3 +1,4 @@
+import {captureSignal} from './capture-signal.mjs';
 import {checked} from './process.mjs';
 import {xml} from './svn.mjs';
 import {hash} from './content.mjs';
@@ -5,8 +6,8 @@ import {svnWorkingIdentity} from './svn-working-identity.mjs';
 import {captureEffectiveMergeinfo} from './svn-effective-mergeinfo.mjs';
 
 export async function workingEffectiveMergeinfo(root,rootInfo,files,options={}){
- const signal=AbortSignal.any([AbortSignal.timeout(30000),...(options.signal?[options.signal]:[])]);let commands=0,bytes=0;const cache=new Map();
- const run=async args=>{signal.throwIfAborted();if(++commands>512)throw new Error('SVN working mergeinfo command budget exceeded');const data=await checked('svn',['--non-interactive',...args],{...options,cwd:root,signal,maxBytes:256*1024});bytes+=data.length;if(bytes>1024*1024)throw new Error('SVN working mergeinfo metadata budget exceeded');return xml(data);};
+ const signal=captureSignal(options.signal);let commands=0,bytes=0;const cache=new Map();
+ const run=async args=>{signal.throwIfAborted();commands++;const data=await checked('svn',['--non-interactive',...args],{...options,cwd:root,signal,maxBytes:256*1024});bytes+=data.length;if(bytes>1024*1024)throw new Error('SVN working mergeinfo metadata budget exceeded');return xml(data);};
  const read=async(name,side,revision)=>{
   const key=JSON.stringify([name,side]);if(cache.has(key)){const value=cache.get(key);if(side==='old'&&value.source.revision!==revision)throw new Error('Mixed BASE revisions cannot prove effective mergeinfo');return value;}
   const node=(await run(['info','--xml','--',name+'@'])).info?.entry?.[0];const identity=svnWorkingIdentity(node,rootInfo,name);

package/src/window-batches.mjs

@@ -1,6 +1,6 @@
 // Bounded pure planner. Every window is either in one batch or explicitly blocked.
-export function planWindowBatches(windows, serialize, measure, { maxBatches = 20 } = {}) {
-  if (!Array.isArray(windows) || windows.length > 200 || typeof serialize !== 'function' || typeof measure !== 'function' || !Number.isSafeInteger(maxBatches) || maxBatches < 1 || maxBatches > 20) throw new Error('Invalid window batch plan');
+export function planWindowBatches(windows, serialize, measure, { maxBatches = Number.MAX_SAFE_INTEGER } = {}) {
+  if (!Array.isArray(windows) || windows.length > 100000 || typeof serialize !== 'function' || typeof measure !== 'function' || !Number.isSafeInteger(maxBatches) || maxBatches < 1) throw new Error('Invalid window batch plan');
   const ids = new Set();
   for (const window of windows) {
     if (!window || typeof window.id !== 'string' || !window.id || ids.has(window.id)) throw new Error('Invalid window identity');

package/src/window-synthesis.mjs

@@ -4,7 +4,7 @@ export function prepareWindowSynthesis(batchPayloads, measure) {
   const batches = batchPayloads.map(payload => JSON.parse(payload));
   const base = batches[0];
   const windows = batches.flatMap(batch => batch.windows);
-  if (batches.some(batch => batch.snapshotId !== base.snapshotId || batch.file.id !== base.file.id || batch.sourceMode !== 'change-windows') || windows.length > 200 || new Set(windows.map(w => w.id)).size !== windows.length) throw new Error('Inconsistent synthesis windows');
+  if (batches.some(batch => batch.snapshotId !== base.snapshotId || batch.file.id !== base.file.id || batch.sourceMode !== 'change-windows') || windows.length > 100000 || new Set(windows.map(w => w.id)).size !== windows.length) throw new Error('Inconsistent synthesis windows');
   const windowIndex = windows.map(w => ({ id: w.id, editIds: w.editIds, old: { start: w.old.start, count: w.old.count }, new: { start: w.new.start, count: w.new.count } }));
   const payload = JSON.stringify({ ...base, windows: undefined, windowIndex, sourceMode: 'window-synthesis', windowNotice: '本请求综合检查所有窗口的共同影响，不重报单窗口问题；windowIndex仅为原始定位目录，不含源码，必须在批准catalog中读取相关旧新片段，不能仅凭目录认定缺陷。输出仍仅主file的发现，归因至少关联两个不同窗口的编辑；证据不足明确限制。' });
   const budget = measure(payload);