@feng0531/dsh-code-review 0.81.1 → 0.82.1

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.82.0 — 后台审查、持久进度与大文件回退
+
+长任务先返回ID，查询/取消/分页取回已保存结果；重启后保留记录但不恢复旧授权。大hunk分段与粗粒度包络精度披露；JSON明确纠正并计数。预览显示运行版本位置，按工作区诊断。
+
 ## 0.81.1 — 取消默认内部超时和计数配额
 
 修复外层延长仍被采集/导航30秒、模型120秒等内部截止终止的问题。默认不限制采集命令数或总模型调用数，遵循用户/宿主取消。保留来源、内存与模型输入保护，不声称解除宿主/提供方限制。

package/README.md

@@ -204,6 +204,21 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 
 `repositoryPath` 相对于会话工作目录，必须指向一个实际仓库根目录；其余文件路径再相对于该仓库。每个仓库分别预览和执行，不使用绝对路径、`..` 或链接目录。
 
+## 长任务：后台预览、审查与取回结果
+
+全项目或慢仓库建议使用后台工具，不让一次外层调用等待整个项目。仍先预览，再由你确认外发；启动返回jobId不等于审核完成。
+
+1. 调用code_review_start，phase设为preview，previewArgs填原预览参数（例如reviewMode=project）。
+2. 用code_review_status和jobId查询；完成后读取resultSummary中的预览范围、模型和previewId。
+3. 展示预览，确认后调用code_review_start，phase设为execute，传previewId与confirmed=true。
+4. 查询审查任务；offset/limit分页取回检查点、文件状态和发现；单个检查点内的大清单用checkpointIndex指定其零基索引，再用offset/limit取回内部全部条目。可调用code_review_cancel取消。
+
+报告保存在宿主profile的data/dsh-code-review/jobs目录；没有profile环境时使用用户主目录.dsh下的数据目录，不写入业务仓库。内容可能含源码片段，应按源码敏感级别保护。本次启动调用结束不自动取消后台任务；明确取消、停用插件或宿主退出会停止它。
+
+重启后可按原jobId读回保存记录，原运行标记interrupted，不自动继续外发。recovery给出已观察文件/窗口与未完成路径；它不是完整分母或新授权，补审必须重新预览确认。新预览的runtime包含实际加载版本和模块位置，排查不同工作区时分别核对，不根据另一台机器推断。
+
+大文件超出单次输入时按原行号分段。精确差异算不出时使用明确标注的包络，可能包含未变行，不声称精确归因。模型JSON错误会请求一次明确纠正，记录额外调用；不会给错误输出补括号、猜字段或当成无缺陷。
+
 ## 多个会话同时审查
 
 可以同时打开多个DSH Agent会话：会话A审项目A，会话B审项目B，也可以分别审查同一项目。各会话的预览、执行锁、模型路由、取消和预算独立；A正在执行不会让B收到全局busy。一个会话内部仍串行，不能拿另一个会话的previewId执行。宿主停用插件会结束全部服务，单次取消只影响当前请求。

package/RELEASE-NOTES.md

@@ -1,17 +1,21 @@
-# v0.81.1 发布说明
+# v0.82.1 发布说明
 
-## 修复预览被内部秒表中断
+v0.82.0冻结标签的Windows CI因临时目录规范路径别名误拒绝失败，未发布；改为固定规范目录身份并继续拒绝链接，原标签不移动。
 
-移除Git/SVN预览、上下文/依赖/调用方导航、mergeinfo、项目模式的默认内部时间截止。单条命令不再默认30秒被终止，模型审查不再默认120秒被取消。延长宿主外层预算后，不会再被这些插件秒表提前截断。
+## 后台长任务与保存结果
 
-同时移除采集命令次数和审查总模型调用次数的默认硬配额；只统计，不按固定条数终止。内部API显式指定timeoutMs/maxCalls时仍可设置限制，默认timeoutMs=0。
+新增code_review_start/status/cancel：后台预览或已确认执行先返回任务ID，逐文件、逐窗口保存进度，结果分页取回。避免一次外层600秒中断后没有已完成成果。任务按会话/目录/模型/推理强度归属校验；宿主profile保存原始结果，不修改被审仓库。
 
-用户/宿主取消、停用插件、只读权限、预览确认、来源复核全部保留。等待长任务时可以取消；宿主或模型提供方自己的超时不由本插件解除。
+停用插件/宿主退出会中断任务，已落盘检查点可读回。不会自动跨重启继续外发或恢复旧批准；补审需新预览与确认。任务completed仅表示函数返回，必须看实际report.status及覆盖。
 
-## 仍保留的资源保护
+## 大文件与模型协议
 
-本次不是无限内存或无限单次模型输入：单文件、内存快照、清单大小、模型输入字节、检索轮次和来源范围保护仍存在，超限明确报告，不静默截断后声称通过。具体数值见 [README](README.md)。这些限制与本次的时间截止分开，不宣称已取消所有限制。
+过大hunk按原行号分段，精确差异受限时退回保守包络并披露精度，不能用其证明精确编辑或回归因果。去掉默认20批调度上限，不用批次数代替完成条件。仍有单次模型输入/内存保护，超长单行无法容纳时明确未完成。
 
-## 验证与事实边界
+JSON格式错误时明确请求一次新响应，不修改或伪造旧响应；额外调用计数并披露纠正。仍不能解析或字段错误时保留失败，不冒充无缺陷。
 
-真实31秒子进程在不覆盖timeoutMs的情况下正常结束；固定计时器注入检查证明采集不创建内部计时器，显式超时和用户取消仍能终止子进程。没有取得用户C3_Framework隔离副本路径，未声称该样本已经成功预览或生成审查报告。正式交付前需完成统一回归、宿主、隔离安装和四矩阵。
+## 诊断与安全
+
+预览返回实际加载版本、模块位置及耗时，后台显示阶段。不同工作区单独诊断，不用一台机器结果外推。独立项目工厂补充TTL/预览数校验。用户取消、只读、来源哈希与批准绑定保持。报告含证据片段，应按源码保护并由用户管理保存目录。
+
+用法见 [README](README.md)。本版本没有自动安装/重启宿主，也未声称反馈中的各私有工作区已验收恢复。

package/index.mjs

@@ -1,3 +1,4 @@
+import {registerBackgroundReview} from './src/background-review.mjs';
 import { createReviewService } from './src/service.mjs';
 export const name = 'dsh-code-review';
 export const inject = ['tools', 'llm'];
@@ -22,5 +23,6 @@ export function apply(ctx, config = {}) {
     output,
     async execute(args, exec) { const result = await service.execute(args, exec); return { json: JSON.stringify(result.report), markdown: result.markdown }; },
   });
+  registerBackgroundReview(ctx,service);
   ctx.on('dispose', () => service.dispose());
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.81.1",
+  "version": "0.82.1",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/attribution.mjs

@@ -12,5 +12,5 @@ export function validateAttribution(value, file, changes = changeMap(file.left.t
   if (value.editIds.some(id => typeof id !== 'string' || !ids.has(id)) || value.properties.some(name => typeof name !== 'string' || !properties.has(name))) throw new Error('Unknown change reference');
   if (new Set(value.editIds).size !== value.editIds.length || new Set(value.properties).size !== value.properties.length) throw new Error('Duplicate change reference');
   if (!value.editIds.length && !value.properties.length) throw new Error('Attribution requires a change reference');
-  return { status: 'references-validated', causality: 'unverified', editIds: [...value.editIds], properties: [...value.properties], beforeBehavior: value.beforeBehavior, afterBehavior: value.afterBehavior, reason: value.reason };
+  return { status: 'references-validated', causality: 'unverified', ...(changes.precision==='envelope'?{precision:'envelope',notice:'References are broad region coordinates, not exact edit evidence.'}:{}), editIds: [...value.editIds], properties: [...value.properties], beforeBehavior: value.beforeBehavior, afterBehavior: value.afterBehavior, reason: value.reason };
 }

package/src/background-review.mjs

@@ -0,0 +1,14 @@
+import path from 'node:path';
+import os from 'node:os';
+import {createReviewJobs} from './review-jobs.mjs';
+
+export function registerBackgroundReview(ctx,service,{directory}={}){
+ const root=directory??path.join(process.env.DSH_PROFILE_DIR??path.join(os.homedir(),'.dsh'),'data','dsh-code-review','jobs');
+ const jobs=createReviewJobs({directory:root});
+ const output={schema:{type:'object',additionalProperties:false,properties:{json:{type:'string'},markdown:{type:'string'}},required:['json','markdown']},render:(_a,v)=>[{type:'text',text:v.markdown||v.json}]};
+ const respond=value=>({json:JSON.stringify(value),markdown:''});
+ ctx.tools.register({name:'code_review_start',description:'Start a durable background preview or confirmed review. Returns a job ID immediately. Preview phase never sends source. For execute supply the approved previewId and confirmed=true. Use code_review_status to collect progress/results; code_review_cancel to stop. Does not automatically resume after host restart or grant new source approval.',parameters:{type:'object',additionalProperties:false,properties:{phase:{type:'string',enum:['preview','execute']},previewArgs:{type:'object',description:'Same parameters as code_review_preview; do not include execute fields.'},previewId:{type:'string'},confirmed:{type:'boolean'}},required:['phase']},output,async execute(args,exec){if(!args||Object.keys(args).some(k=>!['phase','previewArgs','previewId','confirmed'].includes(k))||!['preview','execute'].includes(args.phase))throw new Error('Invalid background phase');if(args.phase==='execute'&&(args.confirmed!==true||typeof args.previewId!=='string'||args.previewArgs!==undefined))throw new Error('Confirmed preview required');if(args.phase==='preview'&&(args.previewId!==undefined||args.confirmed!==undefined))throw new Error('Preview cannot confirm execution');return respond(await jobs.start(exec,async({signal,checkpoint})=>{const original=exec.agent,sessionId=original.session.header.id??original.session.id,detached={...exec,agent:original,signal,reviewCheckpoint:async value=>{const active=exec.agent;if(active!==original||(active.session.header.id??active.session.id)!==sessionId){throw new Error('Background Agent/session changed');}await checkpoint(value);}};await checkpoint({stage:args.phase==='preview'?'capturing-preview':'revalidating-approved-source'});return args.phase==='preview'?service.preview(args.previewArgs??{},detached):service.execute({previewId:args.previewId,confirmed:true},detached);}));}});
+ ctx.tools.register({name:'code_review_status',description:'Read a background review task owned by this session, directory and model. Returns saved progress or final preview/report. completed task means the tool returned; inspect nested report coverage/status. Interrupted tasks retain checkpoints but require new preview and approval to resend.',parameters:{type:'object',additionalProperties:false,properties:{jobId:{type:'string'},offset:{type:'integer',minimum:0},checkpointIndex:{type:'integer',minimum:0,description:'Read one checkpoint nested files/findings page; offset/limit apply within it.'},limit:{type:'integer',minimum:1,maximum:100}},required:['jobId']},output,async execute(args,exec){return respond(await jobs.status(args.jobId,exec,{offset:args.offset??0,limit:args.limit??20,checkpointIndex:args.checkpointIndex}));}});
+ ctx.tools.register({name:'code_review_cancel',description:'Cancel a background review task owned by this session. Does not discard saved checkpoints. No source is sent by cancellation.',parameters:{type:'object',additionalProperties:false,properties:{jobId:{type:'string'}},required:['jobId']},output,async execute(args,exec){return respond(await jobs.cancel(args.jobId,exec));}});
+ ctx.on('dispose',()=>jobs.dispose());return jobs;
+}

package/src/dsh-model.mjs

@@ -1,9 +1,9 @@
 import { modelJson } from './model-json.mjs';
 /** One-shot host LLM call. No agent loop and no executable tools. */
-export function createDshModel(llm, route, { maxTokens = 4096, maxOutputBytes = 128 * 1024 } = {}) {
+export function createDshModel(llm, route, { maxTokens = 4096, maxOutputBytes = 128 * 1024, correctJson = false } = {}) {
   if (!llm || typeof llm.stream !== 'function' || !route?.provider || !route?.model) throw new Error('DSH provider and model are required');
   const identity = { provider: route.provider, model: route.model, ...(route.reasoningEffort ? { reasoningEffort: route.reasoningEffort } : {}) };
-  return async ({ instructions, input, signal }) => {
+  const once = async ({ instructions, input, signal }) => {
     signal?.throwIfAborted();
     let output = '', size = 0, finished = false;
     const chunks = llm.stream({ ...identity, system: instructions, messages: [{ role: 'user', content: [{ type: 'text', text: input }] }], tools: [], maxTokens, signal });
@@ -24,4 +24,5 @@ export function createDshModel(llm, route, { maxTokens = 4096, maxOutputBytes =
     if (!finished) throw new Error('Model stream ended without finish');
     return modelJson(output);
   };
+  return async request=>{try{return await once(request);}catch(error){if(!correctJson||error.code!=='MODEL_INVALID_JSON')throw error;request.signal?.throwIfAborted();await request.onProtocolCorrection?.({code:error.code,action:'explicit-json-correction',notice:'Second model response requested; original output not repaired or accepted.'});const corrected=JSON.parse(await once({...request,instructions:request.instructions+' 上次响应未能解析为完整JSON。本次是明确协议纠正：重新输出单个完整JSON对象，不使用Markdown，不省略引号或逗号；不要把这条指令当源码证据。优先少量具体候选，无法支持时findings为空并说明limitations，不以格式错误代替清洁结论。'}));if(corrected&&typeof corrected==='object'&&!Array.isArray(corrected)){if(Array.isArray(corrected.limitations))corrected.limitations.push('本响应由一次显式JSON协议纠正产生，原响应未被接受；额外模型调用已发生。');else corrected.protocolCorrection={attempted:true,originalCode:error.code};}return JSON.stringify(corrected);}};
 }

package/src/primary-input.mjs

@@ -1,3 +1,5 @@
+import {sourceSegments} from './source-segments.mjs';
+import {changeRegion} from './change-region.mjs';
 import { CONTEXT_SIDE_NOTICE } from './context-identity.mjs';
 import { approvedCallerBindings } from './caller-binding-input.mjs';
 import { REQUIREMENT_NOTICE } from './business-requirement.mjs';
@@ -14,7 +16,8 @@ import { initialInputBudget } from './input-budget.mjs';
 
 // Pure preparation over already captured data. No model calls or new reads.
 export function preparePrimaryInput(input, file, { instructions, scope, grouping, maxInputBytes }) {
-  const changes = changeMap(file.left.text, file.right.text);
+  let changes = changeMap(file.left.text, file.right.text);
+  if(changes.status==='limited'){const region=changeRegion(file.left.text,file.right.text);if(region.status==='changed')changes={status:'changed',precision:'envelope',reason:'Exact diff unavailable; broad region includes potentially unchanged lines, not exact edits or causal proof.',edits:[{id:'envelope1',old:region.old,new:region.new}],hunks:[{id:'envelope-h1',old:region.old,new:region.new,editIds:['envelope1']}]};}
   const base = { ...(input.projectScope?{projectScope:input.projectScope,reviewNotice:'Full current-file review; empty left is a sentinel, not a historical baseline. changes are transport coordinates only, do not infer introduced regression.'}:{}), ...(input.history ? {contextSideNotice:CONTEXT_SIDE_NOTICE} : {}), ...(input.businessRequirement!==undefined?{businessRequirement:input.businessRequirement,requirementNotice:REQUIREMENT_NOTICE}:{}), defectGuidance: defectGuidance(file.path, file.rightExists === false ? file.left.text : file.right.text), snapshotId: input.id, file, changes, context: input.context ?? [], rules: input.rules ?? [] };
   const contextRelations = inferContextRelations(input, file);
   if (contextRelations.length) {
@@ -70,7 +73,8 @@ export function preparePrimaryInput(input, file, { instructions, scope, grouping
     }
   }
   if (!measure(payload).fits && scope) {
-    const windows = changeWindows(file, changes);
+    const exactWindows=changeWindows(file,changes);
+    const windows=exactWindows?sourceSegments(exactWindows):null;
     if (windows) {
       const compactFile = { ...file, left: { ...file.left, text: undefined }, right: { ...file.right, text: undefined } };
       const contextCatalog = scope.catalog().filter(source => ['context', 'context-old'].includes(source.side));
@@ -80,7 +84,7 @@ export function preparePrimaryInput(input, file, { instructions, scope, grouping
         windowBase.cppCallSites = base.cppCallSites.map(({line,expression,side})=>({line,expression,side}));
         windowBase.cppCallNotice = '最多40条旧/新侧零参语法导航；统一confidence=syntax-only-unresolved，可能为宏/重载/动态分派，无绑定、可达性或顺序保证，不是证据或完整覆盖。原文仍须按批准catalog读取。';
       }
-      const compact = JSON.stringify({ ...windowBase, context: [], contextCatalog, contextMode: 'approved-retrieval', contextNotice: '上下文全文仍在同一批准快照，仅目录进入窗口初始输入；必须按sourceId和版本侧read原文，不把目录视为证据或完整覆盖。', file: compactFile, windows, sourceMode: 'change-windows', windowNotice: '仅提供全部精确hunk窗口，start/count为原始源码行号，不得重编号。完整源码未随初始输入发送，可在catalog批准范围内检索；缺少上下文时说明限制。' });
+      const compact = JSON.stringify({ ...windowBase, context: [], contextCatalog, contextMode: 'approved-retrieval', contextNotice: '上下文全文仍在同一批准快照，仅目录进入窗口初始输入；必须按sourceId和版本侧read原文，不把目录视为证据或完整覆盖。', file: compactFile, windows, sourceMode: 'change-windows', windowNotice: '窗口可能为精确hunk的分段或粗粒度包络，精度以changes.precision为准；片段两侧不保证行对齐，不以片段证明精确编辑或回归因果。start/count为原始源码行号，不得重编号。完整源码未随初始输入发送，可在catalog批准范围内检索；缺少上下文时说明限制。' });
       if (!measure(compact).fits) {
         const envelope = JSON.parse(compact);
         const plan = planWindowBatches(windows, subset => JSON.stringify({ ...envelope, windows: subset, windowNotice: '本批仅审查windows包含的编辑，其他hunk另批；行号为原始行号，跨片段上下文不足说明限制。' }), measure);

package/src/project-review-service.mjs

@@ -8,6 +8,7 @@ import {reviewSnapshot,markdownReport} from './review.mjs';
 import {createDshModel} from './dsh-model.mjs';
 const owner=exec=>{const a=exec?.agent;if(!a?.session?.header?.cwd||!a.options?.provider||!a.options?.model)throw new Error('Active Agent with cwd and model required');return {agent:a,cwd:a.session.header.cwd,route:{provider:a.options.provider,model:a.options.model,...(a.options.reasoningEffort?{reasoningEffort:a.options.reasoningEffort}:{})}};};
 export function createProjectReviewService(llm,{allowModelSending=false,authorize=async()=>false,now=Date.now,ttlMs=300000,maxPreviews=8,projectMaxCalls=Number.MAX_SAFE_INTEGER}={}){
+ for(const n of [ttlMs,maxPreviews])if(!Number.isSafeInteger(n)||n<1)throw new Error('Invalid project preview limit');
  if(!Number.isSafeInteger(projectMaxCalls)||projectMaxCalls<1)throw new Error('Invalid project model call limit');
  const previews=new Map(),lifetime=new AbortController();let busy=false;
  async function capture(cwd,args,signal){
@@ -25,8 +26,9 @@ export function createProjectReviewService(llm,{allowModelSending=false,authoriz
  return {owns:id=>previews.has(id),
   async preview(args,exec){if(busy)throw new Error('Review service busy');if(!args||typeof args!=='object')throw new Error('Project preview parameters required');if(Object.keys(args).some(k=>!['reviewMode','repositoryPath','selectedPaths'].includes(k))||args.reviewMode!=='project')throw new Error('Project mode supports only reviewMode/repositoryPath/selectedPaths; change/history context parameters are not project parameters');const current=owner(exec);busy=true;try{const s=await capture(current.cwd,args,signalFor(exec));for(const [id,p]of previews)if(p.expires<=now())previews.delete(id);while(previews.size>=maxPreviews)previews.delete(previews.keys().next().value);const previewId=randomUUID();previews.set(previewId,{...current,args:structuredClone(args),snapshotId:s.id,expires:now()+ttlMs});return {previewId,snapshotId:s.id,reviewMode:'project',repositoryRoot:s.root,vcs:s.vcs,model:current.route,modelSendingEnabled:allowModelSending,totalTrackedNodes:s.totalTrackedNodes,selectedFiles:s.selectedFiles,selectionComplete:s.selectionComplete,inventoryComplete:s.inventoryComplete,batches:s.batches.length,files:s.batches.flatMap(b=>b.files.map(f=>({path:f.path,eligibility:f.eligibility,reason:f.reason}))),notice:s.notice+' Full current source audit, not regression-only diff. Shared session execution budget: no internal elapsed-time or model-call cutoff, 16MiB capture memory protection. Blocked/excluded/pending files are not reviewed successfully. No untracked/ignored/external bodies; no complete semantic call graph. Show scope and model before confirmed execute.'};}finally{busy=false;}},
   async execute(args,exec){if(busy)throw new Error('Review service busy');if(!allowModelSending)throw new Error('Model sending disabled');if(args.confirmed!==true||typeof args.previewId!=='string'||Object.keys(args).some(k=>!['previewId','confirmed'].includes(k)))throw new Error('Confirmed preview required');const p=previews.get(args.previewId),current=owner(exec);if(!p||p.expires<=now()||p.agent!==current.agent||p.cwd!==current.cwd||JSON.stringify(p.route)!==JSON.stringify(current.route))throw new Error('Preview missing expired or owner/model/directory changed');previews.delete(args.previewId);busy=true;const signal=signalFor(exec);try{const s=await capture(current.cwd,p.args,signal);if(s.id!==p.snapshotId)throw new Error('Project changed since preview');if(await authorize({snapshot:s,route:p.route,exec})!==true)throw new Error('Model sending denied');if(owner(exec).cwd!==p.cwd||JSON.stringify(owner(exec).route)!==JSON.stringify(p.route))throw new Error('Agent changed during approval');signal.throwIfAborted();
-   let calls=0;const adapter=createDshModel(llm,p.route),model=request=>{if(calls>=projectMaxCalls)throw new Error('Shared project model call limit exceeded');calls++;return adapter(request);};const results=[];
-   for(const b of s.batches){if(signal.aborted||calls>=projectMaxCalls){results.push({snapshotId:b.id,status:'partial',files:b.files.map(f=>({fileId:f.id,path:f.path,status:f.eligibility==='reviewable'?'pending':f.eligibility,reason:'Session project budget exhausted or cancelled'})),findings:[],limitations:[]});continue;}results.push(await reviewSnapshot(b,model,{signal,maxCalls:projectMaxCalls-calls,enableRetrieval:true,enableVerification:true}));}
+   await exec.reviewCheckpoint?.({stage:'approved-manifest',snapshotId:s.id,files:s.batches.flatMap(b=>b.files.map(f=>({fileId:f.id,path:f.path,status:f.eligibility==='reviewable'?'pending':f.eligibility})))});
+   let calls=0;const adapter=createDshModel(llm,p.route,{correctJson:true}),model=request=>{if(calls>=projectMaxCalls)throw new Error('Shared project model call limit exceeded');calls++;return adapter({...request,onProtocolCorrection:async info=>{if(calls>=projectMaxCalls)throw new Error('Shared project model call limit exceeded');calls++;await request.onProtocolCorrection?.(info);}});};const results=[];
+   for(const b of s.batches){if(signal.aborted||calls>=projectMaxCalls){results.push({snapshotId:b.id,status:'partial',files:b.files.map(f=>({fileId:f.id,path:f.path,status:f.eligibility==='reviewable'?'pending':f.eligibility,reason:'Session project budget exhausted or cancelled'})),findings:[],limitations:[]});continue;}results.push(await reviewSnapshot(b,model,{signal,maxCalls:projectMaxCalls-calls,enableRetrieval:true,enableVerification:true,onProgress:exec.reviewCheckpoint}));}
    const files=results.flatMap(r=>r.files.map(f=>({...f,batchSnapshotId:r.snapshotId}))),coverage={total:s.selectedFiles,completed:files.filter(f=>f.status==='completed').length,excluded:files.filter(f=>f.status==='excluded').length,blocked:files.filter(f=>f.status==='blocked').length,pending:files.filter(f=>!['completed','excluded','blocked'].includes(f.status)).length};const findings=results.flatMap(r=>r.findings.map(f=>({...f,batchSnapshotId:r.snapshotId})));const report={schemaVersion:1,mode:'project',snapshotId:s.id,status:signal.aborted?'cancelled':coverage.total===0||coverage.completed===0?'partial':results.every(r=>r.status==='completed')&&files.every(f=>['completed','excluded'].includes(f.status))?'completed':'partial',repositoryRoot:s.root,vcs:s.vcs,model:p.route,modelCalls:calls,maxModelCalls:projectMaxCalls,totalTrackedNodes:s.totalTrackedNodes,selectionComplete:s.selectionComplete,inventoryComplete:s.inventoryComplete,coverage,files,findings,batches:results,notice:s.notice+' Coverage counts processing of selected tracked files only, not proof of correctness. Excluded and blocked are never completed. No cross-batch whole-program semantic coverage is claimed.'};
    try{report.outdated=(await capture(current.cwd,p.args,signal)).id!==s.id;}catch{report.outdated=true;}
    const lines=['# 全项目代码审查报告','','状态：'+report.status,'已完成：'+coverage.completed+'/'+coverage.total,'排除：'+coverage.excluded+'；阻断：'+coverage.blocked+'；未完成：'+coverage.pending,'',report.notice];for(let i=0;i<results.length;i++)lines.push('', '## 批次 '+(i+1),markdownReport({...results[i],coverage:results[i].coverage??{},interactions:results[i].interactions??[]}));if(report.outdated)lines.push('注意：项目已变化或无法复核，报告仅对应原批准快照。');return {report,markdown:lines.join(String.fromCharCode(10))};

package/src/recovery-coverage.mjs

@@ -0,0 +1,2 @@
+// Saved evidence is a ledger, not renewed source authority or automatic resume.
+export function recoveryCoverage(record){const states=new Map(),windows=new Map();for(const c of record.checkpoints??[]){if(c.stage==='approved-manifest')for(const f of c.files??[])states.set(f.path,{path:f.path,status:f.status,snapshotId:c.snapshotId});if(c.stage==='file-started')states.set(c.path,{path:c.path,status:c.status==='excluded'?'excluded':'pending',snapshotId:c.snapshotId});if(c.stage==='file-complete'&&c.file)states.set(c.file.path,{path:c.file.path,status:c.file.status,snapshotId:c.snapshotId});if(c.stage==='batch-complete')for(const f of c.files??[])states.set(f.path,{path:f.path,status:f.status,snapshotId:c.snapshotId});if(c.stage==='window-complete')windows.set(c.path,{path:c.path,snapshotId:c.snapshotId,...c.windowCoverage});}const final=record.result?.report;if(final?.files)for(const f of final.files)states.set(f.path,{path:f.path,status:f.status,snapshotId:f.batchSnapshotId??final.snapshotId});const files=[...states.values()];return {manifestSaved:(record.checkpoints??[]).some(c=>c.stage==='approved-manifest'),files,windows:[...windows.values()],suggestedPaths:files.filter(f=>!['completed','excluded'].includes(f.status)).map(f=>f.path),notice:'Saved approved manifest (when present) plus checkpoints; before that, only observed scope, not a complete denominator. Completed windows are not a completed file. New source sends require fresh preview and confirmation; no approval is restored from this ledger.'};}

package/src/review-jobs.mjs

@@ -0,0 +1,26 @@
+import {recoveryCoverage} from './recovery-coverage.mjs';
+import {randomUUID} from 'node:crypto';
+import {mkdir,writeFile,rename,readFile,lstat,realpath} from 'node:fs/promises';
+import path from 'node:path';
+
+// Report storage is host-owned, never inside a reviewed working copy.
+export function createReviewJobs({directory}={}){
+ if(typeof directory!=='string'||!path.isAbsolute(directory))throw new Error('Absolute host report directory required');
+ const jobs=new Map();let disposed=false,canonicalDirectory;
+ const identity=exec=>{const a=exec?.agent,s=a?.session;if(!s||!a.options?.provider||!a.options?.model||!s.header?.cwd)throw new Error('Review job requires session identity');const id=s.header.id??s.id;if(typeof id!=='string'||!id)throw new Error('Durable session id required');return {sessionId:id,cwd:s.header.cwd,provider:a.options.provider,model:a.options.model,reasoningEffort:a.options.reasoningEffort??null};};
+ const same=(a,b)=>JSON.stringify(a)===JSON.stringify(b);
+ const pageCheckpoint=(c,offset,limit)=>({...c,...(c.files?{files:c.files.slice(offset,offset+limit),totalFiles:c.files.length}:{}),...(c.findings?{findings:c.findings.slice(offset,offset+limit),totalFindings:c.findings.length}: {})});
+ const filename=id=>{if(typeof id!=='string'||!/^[a-f0-9-]{36}$/.test(id))throw new Error('Invalid review job id');return path.join(directory,id+'.json');};
+ async function safeDirectory(){await mkdir(directory,{recursive:true,mode:0o700});const stat=await lstat(directory),resolved=await realpath(directory);if(stat.isSymbolicLink()||!stat.isDirectory()||(canonicalDirectory!==undefined&&resolved!==canonicalDirectory))throw new Error('Unsafe report directory');canonicalDirectory??=resolved;}
+ async function save(job){await safeDirectory();const tmp=path.join(directory,job.id+'.'+randomUUID()+'.tmp');await writeFile(tmp,JSON.stringify(job.record),{mode:0o600,flag:'wx'});await rename(tmp,filename(job.id));}
+ async function owned(id,exec){const who=identity(exec),job=jobs.get(id);if(job){if(!same(who,job.record.owner))throw new Error('Foreign review job');return job.record;}await safeDirectory();const name=filename(id),stat=await lstat(name);if(stat.isSymbolicLink()||!stat.isFile())throw new Error('Unsafe report file');const r=JSON.parse(await readFile(name,'utf8'));if(!same(who,r.owner))throw new Error('Foreign review job');if(['queued','running'].includes(r.status)){r.status='interrupted';r.notice='Host restarted or plugin disposed. Saved checkpoints are available; resending requires a fresh preview and approval.';}return r;}
+ return {
+  async start(exec,work){if(disposed)throw new Error('Review job service disposed');exec.signal?.throwIfAborted();const who=identity(exec);const relative=path.relative(path.resolve(who.cwd),directory);if(relative===''||(!relative.startsWith('..'+path.sep)&&relative!=='..'&&!path.isAbsolute(relative)))throw new Error('Report store must be outside reviewed workspace');if([...jobs.values()].some(j=>j.record.owner.sessionId===who.sessionId&&['queued','running'].includes(j.record.status)))throw new Error('Session review job already active');const id=randomUUID(),controller=new AbortController(),job={id,controller,record:{jobId:id,owner:who,status:'queued',stage:'queued',checkpoints:[],createdAt:new Date().toISOString()},pending:Promise.resolve()};jobs.set(id,job);try{await save(job);}catch(error){jobs.delete(id);throw error;}const enqueue=fn=>{job.pending=job.pending.then(fn);return job.pending;};
+   // Own cancellation explicitly. The short start RPC ending is NOT task cancellation.
+   job.done=(async()=>{await Promise.resolve();try{job.record.status='running';await enqueue(()=>save(job));const result=await work({signal:controller.signal,checkpoint:async value=>enqueue(async()=>{job.record.stage=value.stage??'reviewing';job.record.checkpoints.push(structuredClone(value));await save(job);})});job.record.result=result;job.record.status=controller.signal.aborted?'cancelled':'completed';}catch(error){job.record.status=controller.signal.aborted?'cancelled':'failed';job.record.error=error?.message??String(error);}finally{job.record.finishedAt=new Date().toISOString();try{await enqueue(()=>save(job));}catch(error){job.record.status='failed';job.record.persistenceError=error.message;}}})();return {jobId:id,status:'queued',notice:'Background job accepted. Poll status; start is not a completed review. Explicit cancel or plugin disposal stops it.'};
+  },
+  async status(id,exec,page){const r=structuredClone(await owned(id,exec));r.recovery=recoveryCoverage(r);if(!page)return r;const {offset=0,limit=20,checkpointIndex}=page;if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(limit)||limit<1||limit>100)throw new Error('Invalid result page');if(checkpointIndex!==undefined){if(!Number.isSafeInteger(checkpointIndex)||checkpointIndex<0||checkpointIndex>=r.checkpoints.length)throw new Error('Invalid checkpoint index');return {jobId:r.jobId,status:r.status,checkpointIndex,checkpoint:pageCheckpoint(r.checkpoints[checkpointIndex],offset,limit),page:{offset,limit}};}const result=r.result;const report=result?.report;return {...r,result:undefined,recovery:{...r.recovery,files:r.recovery.files.slice(offset,offset+limit),windows:r.recovery.windows.slice(offset,offset+limit),suggestedPaths:r.recovery.suggestedPaths.slice(offset,offset+limit),totalObservedFiles:r.recovery.files.length},checkpoints:r.checkpoints.slice(offset,offset+limit).map(c=>pageCheckpoint(c,0,limit)),checkpointPage:{offset,limit,total:r.checkpoints.length},...(result?{resultSummary:report?{status:report.status,coverage:report.coverage,model:report.model,snapshotId:report.snapshotId}:({...result,files:result.files?.slice(offset,offset+limit),filePage:result.files?{offset,limit,total:result.files.length}:undefined}),resultPage:report?{files:report.files?.slice(offset,offset+limit),findings:report.findings?.slice(offset,offset+limit),totalFiles:report.files?.length,totalFindings:report.findings?.length}:undefined}: {})};},
+  async cancel(id,exec){await owned(id,exec);const j=jobs.get(id);if(j)j.controller.abort(new Error('User cancelled review job'));return {jobId:id,cancelRequested:!!j};},
+  async dispose(){disposed=true;for(const j of jobs.values())j.controller.abort(new Error('Review plugin disposed'));await Promise.all([...jobs.values()].map(j=>j.done));}
+ };
+}

package/src/review.mjs

@@ -119,8 +119,10 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   const interactionPlans = scope && report.grouping ? report.grouping.groups.filter(g => g.fileIds.length > 1).map(group => ({ group, prepared: prepareInteractionInput(input, group, payload => initialInputBudget({ instructions, input: payload }, scope, maxInputBytes)) })) : [];
   for (const plan of interactionPlans.filter(p => p.prepared.status !== 'not-applicable')) report.interactions.push({ groupId: plan.group.id, fileIds: plan.prepared.fileIds, status: plan.prepared.status === 'ready' ? 'pending' : 'blocked', reason: plan.prepared.reason, lifecycle: 'shares-last-primary-timeout' });
   for (const file of input.files) {
+    if(report.files.length)await options.onProgress?.({stage:'file-complete',snapshotId:input.id,file:report.files.at(-1),findings:report.findings.filter(f=>f.fileId===report.files.at(-1).fileId)});
     const state = { fileId: file.id, path: file.path, status: file.eligibility === 'reviewable' ? 'pending' : file.eligibility, reason: file.reason, ...(file.blockCode ? {blockCode:file.blockCode} : {}) };
     report.files.push(state);
+    await options.onProgress?.({stage:'file-started',snapshotId:input.id,fileId:file.id,path:file.path,status:state.status});
     if (state.status !== 'pending') continue;
     if (signal?.aborted) { state.status = 'cancelled'; state.reason = '用户取消'; continue; }
     if (report.modelCalls >= maxCalls) { state.reason = '模型调用预算耗尽'; continue; }
@@ -131,6 +133,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
     if (prepared.synthesis) state.synthesisStatus = prepared.synthesis.budget.fits ? 'pending' : 'blocked';
     if (prepared.synthesis && !prepared.synthesis.budget.fits) report.limitations.push({ fileId: file.id, text: '跨窗口综合输入超限，未发送；单窗口完成不表示交互影响已检查' });
     if (state.sourceMode === 'change-windows') state.windowCoverage = { completed: [], pending: [...state.windowIds] };
+    if(changes.precision==='envelope')report.limitations.push({fileId:file.id,text:'精确差异不可得，按保守包络分段检查；包络包含可能未变的行，不证明精确编辑或回归因果。'});
     if (changes.status === 'limited') report.limitations.push({ fileId: file.id, text: '精确变更分析受限：' + changes.reason + '；仍按完整两侧内容审查' });
     if (state.groupFallback) report.limitations.push({ fileId: file.id, text: '关联组上下文超过输入预算，回退单文件审查' });
     if (state.initialInputBytes > maxInputBytes) { state.status = 'blocked'; state.reason = '输入超过预算，未截断或提交模型'; continue; }
@@ -139,14 +142,15 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         if (report.modelCalls >= maxCalls) throw new Error('Model call budget exceeded');
         report.modelCalls++;
       };
+      const trackedModel=request=>model({...request,onProtocolCorrection:async info=>{beforeCall();await request.onProtocolCorrection?.(info);await options.onProgress?.({stage:'protocol-correction',fileId:file.id,path:file.path,...info});}});
       const executor = scope
-        ? request => retrievalLoop(model, request, scope, { maxInputBytes, beforeCall, onRetrieved: records => {
+        ? request => retrievalLoop(trackedModel, request, scope, { maxInputBytes, beforeCall, onRetrieved: records => {
           (state.retrievalAudit ??= []).push(...records);
         }, onTruncated: () => {
           if (!state.retrievalTruncated) report.limitations.push({ fileId: file.id, text: '检索结果达到数量上限，部分匹配未提供给模型' });
           state.retrievalTruncated = true;
         } })
-        : request => { beforeCall(); return model(request); };
+        : request => { beforeCall(); return trackedModel(request); };
       await invoke(async enclosingRequest => {
         if (options.enableBusinessGrouping === true && !report.businessGrouping && prepareBusinessGroups(input.files)) {
           report.businessGrouping = { status: 'pending' };
@@ -241,7 +245,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         if (options.enableVerification === true && generated.findings.length) {
           for (const finding of generated.findings) finding.verification = { status: 'pending', causality: 'unverified' };
           try {
-            const verdicts = await verificationLoop(model, request, generated.findings, scope, {
+            const verdicts = await verificationLoop(trackedModel, request, generated.findings, scope, {
               maxInputBytes, beforeCall,
               onRetrieved: records => { (state.retrievalAudit ??= []).push(...records); },
               onTruncated: () => { report.limitations.push({ fileId: file.id, text: '复核检索结果达到数量上限' }); },
@@ -267,6 +271,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           state.windowCoverage.pending = state.windowCoverage.pending.filter(id => !batch.windowIds.includes(id));
         }
         if(rounds>1)state.reviewPasses[batchIndex].status='completed';
+        await options.onProgress?.({stage:'window-complete',snapshotId:input.id,fileId:file.id,path:file.path,windowIds:batch.windowIds,round:batch.round,findings:generated.findings,windowCoverage:state.windowCoverage});
         }
       }, { instructions, input: payload }, timeoutMs, signal);
       if (signal?.aborted) throw signal.reason;
@@ -280,6 +285,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
       state.failureCode = signal?.aborted ? 'CANCELLED' : ['MODEL_INVALID_JSON','MODEL_TIMEOUT','MODEL_INVALID_READ_REQUEST'].includes(error?.code) ? error.code : 'REVIEW_EXECUTION_FAILED';
     }
   }
+  await options.onProgress?.({stage:'batch-complete',snapshotId:input.id,files:report.files,findings:report.findings,limitations:report.limitations});
   for (const interaction of report.interactions) if (interaction.status !== 'completed') report.limitations.push({ text: '跨文件综合未完成：' + interaction.groupId + ' (' + interaction.status + ')' });
   if (report.grouping?.links.some(l => l.split)) report.limitations.push({ text: '跨组关系未综合覆盖；关联分组不代表全部跨文件交互覆盖' });
   const reviewableCount = input.files.filter(f => f.eligibility === 'reviewable').length;

package/src/runtime-identity.mjs

@@ -0,0 +1,4 @@
+import {readFileSync} from 'node:fs';
+import {fileURLToPath} from 'node:url';
+const manifestUrl=new URL('../package.json',import.meta.url);
+export const REVIEW_RUNTIME=Object.freeze({version:JSON.parse(readFileSync(manifestUrl,'utf8')).version,modulePath:fileURLToPath(new URL('../index.mjs',import.meta.url)),defaultInternalDeadline:false});

package/src/service.mjs

@@ -1,3 +1,4 @@
+import {REVIEW_RUNTIME} from './runtime-identity.mjs';
 import {createProjectReviewService} from './project-review-service.mjs';
 import {svnDiagnostic} from './svn-diagnostics.mjs';
 import { reviewRounds as validateReviewRounds } from './review-rounds.mjs';
@@ -74,7 +75,8 @@ function createSessionReviewService(llm, { capture = captureSnapshot, now = Date
         if (await authorize({ snapshot, route: preview.route, exec }) !== true) throw new Error('Model sending approval denied or unavailable');
         exec.signal?.throwIfAborted();
         if (owner(exec).cwd !== current.cwd || JSON.stringify(owner(exec).route) !== JSON.stringify(preview.route)) throw new Error('Agent changed during approval');
-        const report = await reviewSnapshot(snapshot, createDshModel(llm, preview.route), { signal: exec.signal, enableRetrieval: true, enableGrouping: true, enableVerification: true, enableRiskPlanning, skipSmallRiskPlans, reviewRounds:preview.rounds, enableBusinessGrouping, enableAnchorCorrection });
+        await exec.reviewCheckpoint?.({stage:'approved-manifest',snapshotId:snapshot.id,files:snapshot.files.map(f=>({fileId:f.id,path:f.path,status:f.eligibility==='reviewable'?'pending':f.eligibility}))});
+        const report = await reviewSnapshot(snapshot, createDshModel(llm, preview.route,{correctJson:true}), { signal: exec.signal, enableRetrieval: true, enableGrouping: true, enableVerification: true, enableRiskPlanning, skipSmallRiskPlans, reviewRounds:preview.rounds, enableBusinessGrouping, enableAnchorCorrection, onProgress:exec.reviewCheckpoint });
         report.model = preview.route;
         const latest = await resolveWorkspaceRepository(current.cwd, preview.options.repositoryPath).then(target => target === preview.target ? capture(target, { ...preview.options, signal: exec.signal }) : null).catch(() => null);
         report.outdated = !latest || latest.id !== snapshot.id || owner(exec).cwd !== current.cwd;
@@ -88,5 +90,5 @@ function createSessionReviewService(llm, { capture = captureSnapshot, now = Date
 export function createReviewService(llm,options={}){
  const sessions=new Map();let disposed=false;
  const get=exec=>{if(disposed)throw new Error('Review service disposed');const agent=exec?.agent,key=agent?.session??agent;if(!key||typeof key!=='object')throw new Error('Active Agent required');if(!sessions.has(key)){const changes=createSessionReviewService(llm,options),project=createProjectReviewService(llm,options);let locked=false;const call=async(kind,args,exec)=>{if(locked)throw new Error('Review service busy');locked=true;try{return await (kind==='preview'?(args?.reviewMode==='project'?project.preview(args,exec):changes.preview(args?.reviewMode==='changes'?Object.fromEntries(Object.entries(args).filter(([key])=>key!=='reviewMode')):args,exec)):(project.owns(args?.previewId)?project.execute(args,exec):changes.execute(args,exec)));}finally{locked=false;}};sessions.set(key,{preview:(a,e)=>call('preview',a,e),execute:(a,e)=>call('execute',a,e),dispose(){changes.dispose();project.dispose();}});}return sessions.get(key);};
- return {preview:async(args,exec)=>get(exec).preview(args,exec),execute:async(args,exec)=>get(exec).execute(args,exec),dispose(){disposed=true;for(const service of sessions.values())service.dispose();sessions.clear();}};
+ return {preview:async(args,exec)=>{const started=Date.now();await exec?.reviewCheckpoint?.({stage:'preview-started',runtime:REVIEW_RUNTIME});const result=await get(exec).preview(args,exec);return {...result,runtime:REVIEW_RUNTIME,elapsedMs:Date.now()-started};},execute:async(args,exec)=>get(exec).execute(args,exec),dispose(){disposed=true;for(const service of sessions.values())service.dispose();sessions.clear();}};
 }

package/src/source-segments.mjs

@@ -0,0 +1,7 @@
+// Linear segmentation of approved text. Coordinates remain original one-based lines.
+export function sourceSegments(windows,{maxBytes=12000,maxLines=100}={}){
+ const out=[];for(const w of windows){if(w.old.count<=maxLines&&w.new.count<=maxLines&&Buffer.byteLength(w.old.text)<=maxBytes&&Buffer.byteLength(w.new.text)<=maxBytes){out.push(w);continue;}const sides={old:w.old.text.match(/[^\n]*\n|[^\n]+$/g)??[],new:w.new.text.match(/[^\n]*\n|[^\n]+$/g)??[]},pos={old:0,new:0};let i=0;
+  while(pos.old<sides.old.length||pos.new<sides.new.length){const item={id:w.id+'-s'+(++i),editIds:[...w.editIds]};for(const side of ['old','new']){const start=pos[side],parts=[];let bytes=0;while(pos[side]<sides[side].length&&parts.length<maxLines){const line=sides[side][pos[side]],n=Buffer.byteLength(line);if(parts.length&&bytes+n>maxBytes)break;parts.push(line);bytes+=n;pos[side]++;if(bytes>=maxBytes)break;}item[side]={start:w[side].start+start,count:parts.length,text:parts.join('')};}out.push(item);}
+  if(!i)out.push(w);
+ }return out;
+}

package/src/window-batches.mjs

@@ -1,6 +1,6 @@
 // Bounded pure planner. Every window is either in one batch or explicitly blocked.
-export function planWindowBatches(windows, serialize, measure, { maxBatches = 20 } = {}) {
-  if (!Array.isArray(windows) || windows.length > 200 || typeof serialize !== 'function' || typeof measure !== 'function' || !Number.isSafeInteger(maxBatches) || maxBatches < 1 || maxBatches > 20) throw new Error('Invalid window batch plan');
+export function planWindowBatches(windows, serialize, measure, { maxBatches = Number.MAX_SAFE_INTEGER } = {}) {
+  if (!Array.isArray(windows) || windows.length > 100000 || typeof serialize !== 'function' || typeof measure !== 'function' || !Number.isSafeInteger(maxBatches) || maxBatches < 1) throw new Error('Invalid window batch plan');
   const ids = new Set();
   for (const window of windows) {
     if (!window || typeof window.id !== 'string' || !window.id || ids.has(window.id)) throw new Error('Invalid window identity');

package/src/window-synthesis.mjs

@@ -4,7 +4,7 @@ export function prepareWindowSynthesis(batchPayloads, measure) {
   const batches = batchPayloads.map(payload => JSON.parse(payload));
   const base = batches[0];
   const windows = batches.flatMap(batch => batch.windows);
-  if (batches.some(batch => batch.snapshotId !== base.snapshotId || batch.file.id !== base.file.id || batch.sourceMode !== 'change-windows') || windows.length > 200 || new Set(windows.map(w => w.id)).size !== windows.length) throw new Error('Inconsistent synthesis windows');
+  if (batches.some(batch => batch.snapshotId !== base.snapshotId || batch.file.id !== base.file.id || batch.sourceMode !== 'change-windows') || windows.length > 100000 || new Set(windows.map(w => w.id)).size !== windows.length) throw new Error('Inconsistent synthesis windows');
   const windowIndex = windows.map(w => ({ id: w.id, editIds: w.editIds, old: { start: w.old.start, count: w.old.count }, new: { start: w.new.start, count: w.new.count } }));
   const payload = JSON.stringify({ ...base, windows: undefined, windowIndex, sourceMode: 'window-synthesis', windowNotice: '本请求综合检查所有窗口的共同影响，不重报单窗口问题；windowIndex仅为原始定位目录，不含源码，必须在批准catalog中读取相关旧新片段，不能仅凭目录认定缺陷。输出仍仅主file的发现，归因至少关联两个不同窗口的编辑；证据不足明确限制。' });
   const budget = measure(payload);