@feng0531/dsh-code-review 0.85.1 → 0.85.5

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.85.5 — 凭据来源保护与审核边界修复
+
+- SVN 独立替换树在读取正文前检查复制来源及祖先来源，阻断从凭据路径复制到普通目标的内容；调用方扫描不再把带源码扩展名的目录当作文件读取。
+- Git 默认工作区范围合并暂存删除后重建的同路径记录，避免重复文件身份；自动上下文允许精确目录索引导入探测，但不扩大后代正文授权。
+- 暂存区审核复用已选变更作为上下文时，按相同 index 版本验证，不再误与未暂存工作区内容比较。
+- 综合证据接受同一快照、来源和版本侧连续或重叠读取的完整区间覆盖；仍拒绝有缺口、错来源或错版本的证据。
+- 超过 20 个窗口批次时保留全部可执行主窗口及此前成果，单独披露综合受限并保持未完整审核状态，不再使整轮异常退出。
+
+## 0.85.4 — 审查正确性、失败恢复与全项目提速
+
+`v0.85.2` 因发布说明缺少导航链接、`v0.85.3` 因 Windows 临时目录短路径别名未被新增测试 mock 规范化而未通过 CI，均未发布 npm 或 GitHub Release。本版本补齐链接、规范化测试匹配路径并重新执行完整门禁，不覆盖旧冻结标签、不削弱拒绝断言。
+
+- 本地文件打开改为规范路径，核对最初检查、打开前检查和文件句柄的设备号/inode，并复核祖先身份；SVN special 读取后复核祖先身份。这是竞态检测加固，不是原子目录相对打开，不能保证抵御恶意进程精确交换并恢复路径；高对抗场景应使用隔离、不可并发修改的快照。
+- Git 仓库根只去掉结尾换行，不再 `trim()` 掉路径首尾空格。进程在 SIGTERM 后仍不退出时补发 SIGKILL，超时和取消不再永久等待。
+- 超界行锚点不再误判为精确匹配，仍允许按原有证据规则重定位；具名导入允许单个尾随逗号但拒绝空绑定；注册表元数据及工件网络异常按原次数重试。
+- 模型流兼容完整文本块：终态块替换对应增量而非重复拼接，完整块也计入输出预算；模型拒绝值为 null/undefined 时保留已有文件结果。
+- 实例方法提示拒绝构造器名称遮蔽和原型替换；C# 竞争类型按正文而不只按文件名阻止错误唯一性；C++ include 支持关键字后无空白的合法引用。
+- 后台持久化队列失败不再阻断终态保存；成功落盘后释放已结束任务的内存，失败时保留诊断并唤醒等待者。分段参数拒绝非正整数，SVN 历史调用方预算不再信任低报的正文大小。
+- 全项目默认并发从 3 提到允许上限 8。批内主审、检索和复核仍串行，模型调用次数不减少；提供方限流时把 `projectConcurrency` 调低。
+
 ## 0.85.1 — 模型失败诊断与定向纠正
 
 - 修复宿主 error 终态详情读取位置，保留实际 `finish.reason.failure` 中的已知错误码、HTTP 状态和有效重试间隔，便于区分服务失败类别；不新增对鉴权、额度或取消的盲目重试。

package/DEVELOPMENT.md

@@ -20,9 +20,17 @@
 
 ## 全项目并发与离线速度对照
 
-插件配置 `projectConcurrency` 默认为 3，范围 1～8；1 为串行回退。仅独立批准批次并行，各批仍有独立检索来源和账本，所有调用与 JSON 纠正共享原执行计数。该上限按单次执行生效，不是全宿主 RPM/TPM 限流器；提供方不支持并发或遇到 429 时应调低。取消/致命检查点错误必须等待全部在途模型清理后释放会话锁，后台 checkpoint 继续使用原串行持久化队列。
+插件配置 `projectConcurrency` 默认为 8，范围 1～8；1 为串行回退。仅独立批准批次并行，各批仍有独立检索来源和账本，所有调用与 JSON 纠正共享原执行计数。该上限按单次执行生效，不是全宿主 RPM/TPM 限流器；提供方不支持并发或遇到 429 时应调低。取消/致命检查点错误必须等待全部在途模型清理后释放会话锁，后台 checkpoint 继续使用原串行持久化队列。
 
-运行 `node scripts/review-speed-benchmark.mjs` 比较相同 12 个 mock 批次在串行与 3 路并发下的耗时；脚本模拟每次模型调用 40ms 延迟，不访问网络、不证明真实模型速度或质量。核对工作量、调用数、完成数和输出顺序一致，不把降低覆盖作为加速。
+运行 `node scripts/review-speed-benchmark.mjs` 比较相同 12 个 mock 批次在串行、旧默认 3 路与新默认 8 路并发下的耗时；脚本模拟每次模型调用 40ms 延迟，不访问网络、不证明真实模型速度或质量。核对工作量、调用数、完成数和输出顺序一致，不把降低覆盖作为加速。
+
+### 当前工作树捕获的安全边界
+
+本地捕获校验符号链接、规范路径、文件句柄身份及祖先目录身份。Node 的跨平台公开 API 没有原子 beneath/no-symlink 目录相对打开机制，因此这些前后检查只能检测已观察到的替换，不能证明抵御并发恶意进程交换后恢复路径的攻击。需要严格隔离时，应先在不允许并发修改的独立快照中审核；不要把 inode 检查描述为彻底修复 TOCTOU。
+
+### 本次全库审核的实测瓶颈
+
+407 个文件、34 个批次、3 路并发的历史任务耗时 40 分 37.208 秒，调用模型 778 次，其中 263 次为额外 JSON 重生成（33.8%），另有 9 条阶段响应纠正事件；共 19 个文件失败。471 条 protocol-correction 检查点包含不同纠正阶段和完成事件，不能当成 471 次额外调用。上述数据不提供逐调用耗时，不能据此声称磁盘 I/O 或某一提供方适配层占用了确定比例。新默认并发与完整块兼容修复尚需真实提供方复测，离线模拟只验证调度开销、调用量和结果顺序。
 
 ## 模型响应失败与诊断
 

package/README.md

@@ -256,7 +256,7 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 
 清单上限10000节点，单次选择最多1000节点/16MiB，12节点一批，单文件256KiB；超限明确拒绝，缩小选择后必须重新预览。单次采集共享8MiB元数据内存保护，不按命令条数、插件秒表或模型调用次数中断；耗时受宿主/模型提供方限制，用户可随时取消。SVN为本地已观察清单，稀疏/外部/链接及不支持属性显示限制；不证明仓库远端完整覆盖。
 
-全项目审查默认最多 **3 个独立批次并行**，每批内主审、检索、复核仍按依赖顺序执行；预览和报告的 `execution.batchConcurrency` 显示实际配置。插件配置 `projectConcurrency` 可设为 1～8，设 1 回退串行；遇到模型提供方并发限制或 429，应降低并发。该设置不是 preview 参数，不扩大来源或共享模型调用预算，也不减少模型调用量或承诺 token 成本下降。仅一个批次时不会获得批间加速；实际提速受提供方吞吐、批次均衡及检查点写入影响。
+全项目审查默认最多 **8 个独立批次并行**，每批内主审、检索、复核仍按依赖顺序执行；预览和报告的 `execution.batchConcurrency` 显示实际配置。插件配置 `projectConcurrency` 可设为 1～8，设 1 回退串行；遇到模型提供方并发限制或 429，应降低并发。该设置不是 preview 参数，不扩大来源或共享模型调用预算，也不减少模型调用量或承诺 token 成本下降。仅一个批次时不会获得批间加速；实际提速受提供方吞吐、批次均衡及检查点写入影响。
 
 对外只交付一份统一最终报告，给出总数、completed、excluded、blocked、pending、去重后的发现及未完成综合阶段；内部批次快照仅供证据追溯，不需要用户拼接报告。completed只表示所选捕获文件已处理，不代表代码正确；排除与阻断从不算完成。代码或清单变化会拒绝旧预览，运行后无法复核则标记outdated。
 

package/RELEASE-NOTES.md

@@ -1,19 +1,21 @@
-# v0.85.1 发布说明
+# v0.85.5 发布说明
 
-## 更可定位的模型失败
+使用方式见 [README](README.md)，详细变化见 [变更记录](CHANGELOG.md)，发布门禁见 [开发说明](DEVELOPMENT.md)。
 
-修复宿主服务错误详情读取位置：从实际的 `finish.reason.failure` 取得已知错误码、HTTP 状态及有效重试间隔，不再因读取错字段而只留下 `Model did not complete: error`。提供方没有返回的细节仍不可推断；本版不新增自动网络重试。
+## 安全修复
 
-## 针对语法问题的有界纠正
+SVN 独立替换树现在在读取正文前检查复制来源及复制祖先来源，阻断把凭据文件复制到普通目标后绕过来源过滤的路径。限定调用方扫描也会区分目录与普通文件，带 `.js` 等源码扩展名的目录不再令预览整体失败。
 
-正常 stop 后的非法 JSON 现在记录固定语法分类、可用的正文行列位置和 SHA-256 响应指纹，并根据最近一次分类给出定向重新生成提示。偏移使用 JSON 正文的 UTF-16 单位，支持 CR、LF、CRLF；运行时未提供位置时明确不填，不虚构错误位置。
+## 审核正确性与可用性
 
-仍最多重新生成两次，继续共享原调用预算和取消信号；不回放错误响应，不正则修补 JSON，不删除发现来换取格式通过，最终结果仍必须通过阶段 schema 与证据校验。进度回调拿到独立诊断副本，不能改变下一次纠正提示；异常访问器或 Proxy 不替换原始提供方异常。
+- Git 默认工作区审核合并暂存删除后重建的同路径记录，保持文件身份唯一。
+- 自动上下文的目录索引导入不再被误判为越界；仍只读取精确选中的候选正文，不授权目录下任意文件。
+- 已选暂存变更同时作为显式上下文时，复用 index 内容并按同侧版本验证，不把尚未暂存的正文混入变更侧。
+- 长编辑分次读取后，综合校验按同一快照、来源及版本侧计算连续覆盖；跨来源、有缺口或错误版本的读取仍不能作为有效证据。
+- 文件分成超过 20 个窗口批次时，主窗口继续审核并保留已有成果；综合受限单独披露，整体仍为部分完成，不再以异常丢失整轮报告。
 
-## 安全与验证边界
+## 验证与边界
 
-新增诊断不保存模型响应片段、原生解析异常原文或提供方原始 message；未知错误码与请求 ID 仅保存哈希。已有直接抛出的异常仍保持身份，不把诊断扩展描述为全局日志脱敏。
+本版为六项已复现问题添加回归测试，并执行完整本地测试及隔离安装验证；正式发布须通过同一冻结标签提交的 Ubuntu/Windows × Node.js 22/24 四组 CI、安装包验证和 npm 实际工件一致性门禁。具体执行结果以该标签 CI 和发布工作流为准。
 
-已增加语法定位、定向纠正、真实宿主终态字段、脱敏、预算、取消及回调隔离回归，并由真实宿主 ToolRuntime 配合受控离线模型验证。当前宿主没有公开原生 JSON mode／response schema 能力，本版本不通过虚构参数绕过该限制；不保证模型永不出错，也没有把离线测试说成真实服务失败率已经下降。
-
-用法见 [README](README.md)，诊断字段与验证方式见 [DEVELOPMENT](DEVELOPMENT.md)。发布不自动安装、升级或重启 DSH；需要用户更新并重新加载插件。
+本版本不保证模型始终输出合法 JSON，不扩大源码读取权限，不自动安装、升级或重启 DSH；更新并重新加载插件后生效。

package/index.mjs

@@ -1,5 +1,6 @@
 import { registerBackgroundReview } from './src/background-review.mjs';
 import { createReviewService } from './src/service.mjs';
+import { DEFAULT_PROJECT_CONCURRENCY } from './src/project-execution.mjs';
 import { reviewToolOutput } from './src/tool-view.mjs';
 
 export const name = 'dsh-code-review';
@@ -13,7 +14,7 @@ const EXECUTE_PARAMETERS = { type: 'object', additionalProperties: false, proper
 export function apply(ctx, config = {}) {
   // This entry runs only when the host invokes the registered tool.
   // Host tool policy owns permission; do not request a second approval here.
-  const service = createReviewService(ctx.llm, { allowModelSending: true, enableRiskPlanning: true, enableBusinessGrouping: true, enableAnchorCorrection: true, projectConcurrency: config.projectConcurrency ?? 3, authorize: async () => true });
+  const service = createReviewService(ctx.llm, { allowModelSending: true, enableRiskPlanning: true, enableBusinessGrouping: true, enableAnchorCorrection: true, projectConcurrency: config.projectConcurrency ?? DEFAULT_PROJECT_CONCURRENCY, authorize: async () => true });
   ctx.tools.register({
     name: 'code_review_preview', description: PREVIEW_DESCRIPTION, parameters: PREVIEW_PARAMETERS, output: reviewToolOutput,
     async execute(args, exec) { const preview = await service.preview(args, exec); return { json: JSON.stringify(preview), markdown: '' }; },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.85.1",
+  "version": "0.85.5",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/anchor-correction.mjs

@@ -5,7 +5,7 @@ export function correctAnchor(raw, file, changes, {signal}={}) {
  if(!raw||raw.fileId!==file.id||a?.kind!=='line'||!['old','new'].includes(a.side)||!Number.isSafeInteger(a.start)||!Number.isSafeInteger(a.end)||a.start<1||a.end<a.start||typeof a.snippet!=='string'||!a.snippet.trim()||a.snippet.length>8000)return result('not-applicable','invalid-anchor');
  const text=(a.side==='old'?file.left:file.right)?.text;if(typeof text!=='string'||Buffer.byteLength(text)>256*1024)return result('not-applicable','source-limit');
  const source=text.replaceAll('\r\n','\n').split('\n'),snippet=a.snippet.replaceAll('\r\n','\n').split('\n');
- if(source.slice(a.start-1,a.end).join('\n')===snippet.join('\n'))return result('unchanged','already-exact');
+ if(a.end<=source.length&&source.slice(a.start-1,a.end).join('\n')===snippet.join('\n'))return result('unchanged','already-exact');
  const currentSource = file.reviewMode === 'project' && a.side === 'new';
  if(file.reviewMode === 'project' && !currentSource)return result('rejected','project-requires-new-side');
  if(!currentSource&&(changes?.status!=='changed'||changes.precision!=='exact'||!Array.isArray(raw.attribution?.editIds)||!raw.attribution.editIds.length))return result('rejected','missing-exact-edit');

package/src/class-bindings.mjs

@@ -121,6 +121,9 @@ export function instanceMethodBindings(lines, importLine, targetText) {
     if (assign === null || inst === member || inst === klass || inst === local) continue;
     const newCount = [...caller.matchAll(new RegExp('(^|[^A-Za-z0-9_$])new\\s+' + escapeDollar(local) + '\\s*\\(', 'g'))].length;
     if (newCount !== 1) continue;
+    // Without lexical scope resolution only the import and construction may name the class.
+    const localToken = boundaryPattern(local, '(?=[^A-Za-z0-9_$]|$)', 'g');
+    if (lines.some((line,i) => i + 1 !== importLine && i + 1 !== assign && [...line.matchAll(localToken)].length)) continue;
     const instToken = boundaryPattern(inst, '(?=[^A-Za-z0-9_$]|$)', 'g');
     const instLines = [];
     for (let i = 0; i < lines.length; i++) {

package/src/content.mjs

@@ -16,6 +16,7 @@ export function decode(bytes) {
   if (/[\x00-\x08\x0e-\x1f]/.test(text)) throw new Error('Binary content');
   return { text, hash: hash(bytes), encoding, bytes: bytes.length };
 }
+
 export async function readLocal(root, name, { maxFileBytes = 256 * 1024, signal } = {}) {
   relativePath(name);
   assertNonSecretPath(name);
@@ -24,19 +25,29 @@ export async function readLocal(root, name, { maxFileBytes = 256 * 1024, signal
   const canonicalRoot = await realpath(root);
   const filename = path.resolve(canonicalRoot, ...name.split('/'));
   let cursor = canonicalRoot;
+  const ancestors = [];
+  let expected;
   for (const part of name.split('/')) {
     cursor = path.join(cursor, part);
     const stat = await lstat(cursor);
     if (stat.isSymbolicLink()) throw new Error('Symbolic links and junctions are excluded');
-    if (cursor === filename && !stat.isFile()) throw new Error('Not a regular file');
+    if (cursor === filename) {
+      if (!stat.isFile()) throw new Error('Not a regular file');
+      expected = stat;
+    } else {
+      if (!stat.isDirectory()) throw new Error('Not a directory');
+      ancestors.push({ path: cursor, stat });
+    }
   }
   const canonical = await realpath(filename);
   const rel = path.relative(canonicalRoot, canonical);
   if (rel.startsWith('..' + path.sep) || rel === '..' || path.isAbsolute(rel)) throw new Error('Path escapes repository');
-  const handle = await open(filename, 'r');
+  const opened = await lstat(filename);
+  if (opened.isSymbolicLink() || !opened.isFile()) throw new Error(opened.isSymbolicLink() ? 'Symbolic links and junctions are excluded' : 'Not a regular file');
+  const handle = await open(canonical, 'r');
   try {
     const before = await handle.stat();
-    if (!before.isFile()) throw new Error('Not a regular file');
+    if (!before.isFile() || before.dev !== expected.dev || before.ino !== expected.ino || before.dev !== opened.dev || before.ino !== opened.ino) throw new Error('File changed during capture');
     if (before.size > maxFileBytes) throw new Error('File size limit exceeded');
     const buffer = Buffer.alloc(maxFileBytes + 1);
     let length = 0;
@@ -47,8 +58,12 @@ export async function readLocal(root, name, { maxFileBytes = 256 * 1024, signal
       length += bytesRead;
     }
     if (length > maxFileBytes) throw new Error('File size limit exceeded');
+    for (const ancestor of ancestors) {
+      const now = await lstat(ancestor.path);
+      if (now.isSymbolicLink() || !now.isDirectory() || now.dev !== ancestor.stat.dev || now.ino !== ancestor.stat.ino || now.ctimeMs !== ancestor.stat.ctimeMs) throw new Error('Ancestor changed during capture');
+    }
     const after = await handle.stat();
-    if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || canonical !== await realpath(filename)) throw new Error('File changed during capture');
+    if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || before.ino !== after.ino || canonical !== await realpath(filename)) throw new Error('File changed during capture');
     return decode(buffer.subarray(0, length));
   } finally { await handle.close(); }
 }

package/src/coverage-followup.mjs

@@ -5,7 +5,7 @@ export function coverageFollowup(report) {
   const items = report.files.map(file => {
     if (!file || typeof file.fileId !== 'string' || !file.fileId || ids.has(file.fileId) || typeof file.path !== 'string' || !file.path || paths.has(file.path) || !['completed', 'excluded', 'blocked', 'failed', 'cancelled', 'pending'].includes(file.status)) throw new Error('Invalid coverage file');
     ids.add(file.fileId); paths.add(file.path);
-    const incompleteSynthesis=(file.stageFailures??[]).length>0||file.synthesisStatus==='failed';
+    const incompleteSynthesis=(file.stageFailures??[]).length>0||!!file.synthesisStatus&&file.synthesisStatus!=='completed';
     const incompleteVerification = report.findings.some(f => f.fileId === file.fileId && ['pending', 'incomplete'].includes(f.verification?.status));
     return { fileId: file.fileId, path: file.path, status: file.status, incompleteVerification,incompleteSynthesis,
       followup: file.status !== 'excluded' && (file.status !== 'completed' || incompleteVerification || incompleteSynthesis) };

package/src/coverage-plan.mjs

@@ -21,7 +21,7 @@ export function buildCoveragePlan(input, options) {
     if (file.eligibility !== 'reviewable') return item;
     const prepared = preparePrimaryInput(input, file, options);
     const riskPlanning = options.enableRiskPlanning === true ? options.skipSmallRiskPlans === true ? riskPlanningDecision([file]) : {required:true,reason:'unconditional'} : {required:false,reason:'disabled'};
-    return { ...item, ...prepared.metadata, riskPlanning, status: prepared.budget.fits ? 'ready' : 'input-blocked', minimumCalls: prepared.budget.fits ? ((prepared.batches?.length ?? 1) * (rounds + (riskPlanning.required ? 1 : 0)) + (prepared.synthesis?.budget.fits ? rounds : 0)) : 0 };
+    return { ...item, ...prepared.metadata, riskPlanning, status: prepared.budget.fits ? 'ready' : 'input-blocked', minimumCalls: prepared.budget.fits ? ((prepared.batches?.length ?? 1) * (rounds + (riskPlanning.required ? 1 : 0)) + (prepared.synthesis?.status === 'ready' ? rounds : 0)) : 0 };
   });
   const local = options.enableBusinessGrouping === true ? localBusinessGroups(input.files) : null;
   const groups = [...(options.grouping?.groups ?? [])];

package/src/cpp-relations.mjs

@@ -22,7 +22,7 @@ export function inferCppRelations(files) {
    // Conditional/macro includes are not resolved without a build configuration.
    if (lines.some(line => /^\s*#\s*(?:if|ifdef|ifndef|elif|else|endif|define|undef)\b/.test(line))) continue;
    for (let i=0;i<lines.length;i++) {
-    const match = /^\s*#\s*include\s+"([^"\\]+)"\s*(?:\/\/.*)?$/.exec(lines[i]);
+    const match = /^\s*#\s*include\s*"([^"\\]+)"\s*(?:\/\/.*)?$/.exec(lines[i]);
     if (!match || match[1].startsWith('/') || match[1].includes(':')) continue;
     const targetPath = path.posix.normalize(path.posix.join(path.posix.dirname(file.path),match[1]));
     if (targetPath.startsWith('../') || targetPath === '..') continue;

package/src/csharp-context.mjs

@@ -20,7 +20,11 @@ export function inferCsharpContext(input, primary) {
    if (lines.some((line,j) => j !== i && token.test(line))) continue;
    // Unsupported declarations still compete; filtering them out must not create uniqueness.
    const competitors = contexts.filter(c => typeof c.text !== 'string' || token.test(c.text));
-   if (competitors.length !== 1 || input.files.some(f => f !== primary && f.path.endsWith('.cs') && f.path.split('/').at(-1) === type + '.cs')) continue;
+   if (competitors.length !== 1 || input.files.some(f => {
+    if(f === primary || !f.path.endsWith('.cs'))return false;
+    const text=(side === 'old' ? f.left : f.right)?.text;
+    return f.path.split('/').at(-1) === type + '.cs' || typeof text !== 'string' || token.test(text);
+   })) continue;
    const candidates = competitors.filter(c => safe(c.text) && namespaceOf(c.text) === ns && !/\busing\b|\bpartial\b|\bvirtual\b|\boverride\b|\binterface\b/.test(c.text));
    const declarations = [];
    for (const context of candidates) {

package/src/dsh-model.mjs

@@ -37,6 +37,9 @@ export function createDshModel(llm, route, {
     signal?.throwIfAborted();
     let output = '';
     let size = 0;
+    // Completed blocks are authoritative snapshots, not additional text deltas.
+    // Track them by index so block-only streams work without counting snapshots twice.
+    const blocks = new Map();
     let finished = false;
     let finishKind = 'missing';
     const diagnostic = () => ({
@@ -59,10 +62,25 @@ export function createDshModel(llm, route, {
         signal?.throwIfAborted();
         if (finished) throw failure('Model emitted data after finish', 'MODEL_PROTOCOL_ERROR');
         if (isToolCall(chunk)) throw failure('Review model attempted a tool call', 'MODEL_PROTOCOL_ERROR');
-        if (chunk.type === 'text-delta' || chunk.type === 'reasoning-delta') {
-          size += Buffer.byteLength(chunk.text);
+        const delta = chunk.type === 'text-delta' || chunk.type === 'reasoning-delta';
+        const completed = chunk.type === 'block-end' &&
+          (chunk.block.type === 'text' || chunk.block.type === 'reasoning');
+        if (delta || completed) {
+          const type = completed ? chunk.block.type : chunk.type === 'text-delta' ? 'text' : 'reasoning';
+          // Unindexed delta-only streams remain supported for older callers.
+          const key = chunk.index ?? type;
+          const previous = blocks.get(key);
+          if (previous && previous.type !== type) throw failure('Model changed block type', 'MODEL_PROTOCOL_ERROR');
+          // Like the host BlockAssembler, first close wins; never append stragglers.
+          if (previous?.closed) continue;
+          const text = completed ? chunk.block.text : (previous?.text ?? '') + chunk.text;
+          const bytes = Buffer.byteLength(text);
+          // A shorter final snapshot must not refund previously consumed output budget.
+          const chargedBytes = Math.max(previous?.chargedBytes ?? 0, bytes);
+          size += chargedBytes - (previous?.chargedBytes ?? 0);
           if (size > maxOutputBytes) throw failure('Model output limit exceeded', 'MODEL_OUTPUT_LIMIT');
-          if (chunk.type === 'text-delta') output += chunk.text;
+          blocks.set(key, { type, text, chargedBytes, closed: completed });
+          output = [...blocks.values()].filter(block => block.type === 'text').map(block => block.text).join('');
         }
         if (chunk.type === 'finish') {
           finishKind = chunk.reason.kind;

package/src/git-history.mjs

@@ -68,7 +68,7 @@ export async function captureGitHistory(cwd, options = {}) {
   if (!Number.isSafeInteger(maxFiles) || maxFiles < 1 || maxFiles > 200 || !Number.isSafeInteger(maxFileBytes) || maxFileBytes < 1 || maxFileBytes > 256 * 1024 || !Number.isSafeInteger(maxSnapshotBytes) || maxSnapshotBytes < 1 || maxSnapshotBytes > 4 * 1024 * 1024) throw new Error('Invalid historical capture limits');
   if (selectedPaths !== undefined && (!Array.isArray(selectedPaths) || selectedPaths.some(p => relativePath(p) !== p))) throw new Error('Invalid selected paths');
 
-  const root = await realpath(utf8(await gitAt(cwd, ['rev-parse', '--show-toplevel'], options)).trim());
+  const root = await realpath(utf8(await gitAt(cwd, ['rev-parse', '--show-toplevel'], options)).replace(/\r?\n$/, ''));
 
   // Resolve the two endpoints: commit compares against its sole parent; range uses explicit endpoints.
   let base, target;

package/src/git.mjs

@@ -10,7 +10,7 @@ const git = (cwd, args, options) => checked('git', [...flags, ...args], { ...opt
 const text = bytes => new TextDecoder('utf-8', { fatal: true }).decode(bytes);
 
 async function resolveRoot(cwd, options) {
-  const top = text(await git(cwd, ['rev-parse', '--show-toplevel'], options)).trim();
+  const top = text(await git(cwd, ['rev-parse', '--show-toplevel'], options)).replace(/\r?\n$/, '');
   return realpath(top);
 }
 
@@ -41,7 +41,13 @@ function parseChanges(bytes) {
 
 /** Keep only the entries the requested comparison actually observes. */
 function changesInScope(changes, scope) {
-  if (scope === 'worktree') return changes;
+  // Porcelain reports a staged deletion and its untracked recreation separately.
+  // Worktree compares HEAD to the current file once, retaining the tracked entry
+  // (and its baseline/selection authority), not a second untracked identity.
+  if (scope === 'worktree') {
+    const tracked = new Set(changes.filter(change => change.rawStatus !== '??').map(change => change.path));
+    return changes.filter(change => change.rawStatus !== '??' || !tracked.has(change.path));
+  }
   if (scope === 'staged') return changes.filter(change => change.rawStatus[0] !== ' ' && change.rawStatus[0] !== '?');
   return changes.filter(change => change.rawStatus[1] !== ' ' || change.rawStatus === '??');
 }

package/src/import-call-sites.mjs

@@ -17,7 +17,10 @@ export function importedCallSites(lines, importLine, callIndex = indexStandalone
   const identifier = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
   if (identifier.test(match[1])) names.push(match[1]);
   else if (match[1].startsWith('{') && match[1].endsWith('}')) {
-    for (const part of match[1].slice(1, -1).split(',')) {
+    const parts = match[1].slice(1, -1).split(',');
+    // A single trailing comma is valid; leading or interior holes are not.
+    if (!parts.at(-1).trim()) parts.pop();
+    for (const part of parts) {
       const binding = /^\s*([A-Za-z_$][A-Za-z0-9_$]*)(?:\s+as\s+([A-Za-z_$][A-Za-z0-9_$]*))?\s*$/.exec(part);
       if (!binding) return [];
       names.push(binding[2] ?? binding[1]);

package/src/primary-input.mjs

@@ -167,8 +167,9 @@ export function preparePrimaryInput(input, file, { instructions, scope, grouping
 
   if (batches?.length > 1) {
     synthesis = prepareWindowSynthesis(batches.map(batch => batch.payload), measure);
-    metadata.synthesisStatus = synthesis.budget.fits ? 'ready' : 'input-blocked';
-    metadata.synthesisInputBytes = synthesis.budget.bytes;
+    metadata.synthesisStatus = synthesis.status === 'ready' ? 'ready' : 'blocked';
+    if (synthesis.reason) metadata.synthesisBlockedReason = synthesis.reason;
+    if (synthesis.budget) metadata.synthesisInputBytes = synthesis.budget.bytes;
   }
 
   const budget = measure(payload);

package/src/process.mjs

@@ -14,13 +14,21 @@ export function run(command, args, { cwd, signal, timeoutMs = 0, maxBytes = 8 *
       env: childEnv,
     });
     const stdout = [], stderr = [];
-    let bytes = 0, failure;
-    const stop = error => { failure ??= error; child.kill(); };
+    let bytes = 0, failure, killer, stopped = false;
+    const stop = error => {
+      failure ??= error;
+      if (stopped) return;
+      stopped = true;
+      child.kill();
+      killer = setTimeout(() => { if (child.exitCode === null && child.signalCode === null) child.kill('SIGKILL'); }, 1000);
+      killer.unref?.();
+    };
     const abort = () => stop(signal.reason ?? new Error('Cancelled'));
     signal?.addEventListener('abort', abort, { once: true });
     if (signal?.aborted) abort();
     const timer = timeoutMs>0?setTimeout(() => stop(new Error('Command timeout')), timeoutMs):undefined;
     const capture = chunks => data => {
+      if (stopped) return;
       bytes += data.length;
       if (bytes > maxBytes) stop(new Error('Command output limit exceeded'));
       else chunks.push(data);
@@ -30,6 +38,7 @@ export function run(command, args, { cwd, signal, timeoutMs = 0, maxBytes = 8 *
     child.on('error', error => { failure ??= error; });
     child.on('close', code => {
       clearTimeout(timer);
+      clearTimeout(killer);
       signal?.removeEventListener('abort', abort);
       if (failure) reject(failure);
       else resolve({ code, stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr) });

package/src/project-execution.mjs

@@ -1,6 +1,6 @@
 import { reviewSnapshot } from './review.mjs';
 
-export const DEFAULT_PROJECT_CONCURRENCY = 3;
+export const DEFAULT_PROJECT_CONCURRENCY = 8;
 export function projectConcurrency(value = DEFAULT_PROJECT_CONCURRENCY) {
   if (!Number.isSafeInteger(value) || value < 1 || value > 8) throw new Error('Project concurrency must be an integer from 1 to 8');
   return value;

package/src/project-review-service.mjs

@@ -5,7 +5,7 @@ import { hash } from './content.mjs';
 import { resolveWorkspaceRepository } from './workspace-repository.mjs';
 import { detectVcs } from './snapshot.mjs';
 import { projectInventory, captureProjectBatch } from './project-snapshot.mjs';
-import { reviewProjectBatches, projectConcurrency as validateProjectConcurrency } from './project-execution.mjs';
+import { reviewProjectBatches, projectConcurrency as validateProjectConcurrency, DEFAULT_PROJECT_CONCURRENCY } from './project-execution.mjs';
 import { createDshModel } from './dsh-model.mjs';
 
 const PREVIEW_NOTICE_SUFFIX = ' Full current source audit, not regression-only diff. Shared session execution budget: no internal elapsed-time or model-call cutoff, 16MiB capture memory protection. Blocked/excluded/pending files are not reviewed successfully. No untracked/ignored/external bodies; no complete semantic call graph. Independent approved batches run with bounded concurrency; per-batch evidence and global model-call budgets remain enforced. Show scope and model before confirmed execute.';
@@ -66,7 +66,7 @@ async function captureProject(cwd, args, signal) {
   return { ...result, id: hash(JSON.stringify(result)) };
 }
 
-export function createProjectReviewService(llm, { allowModelSending = false, authorize = async () => false, now = Date.now, ttlMs = 300000, maxPreviews = 8, projectMaxCalls = Number.MAX_SAFE_INTEGER, projectConcurrency = 3 } = {}) {
+export function createProjectReviewService(llm, { allowModelSending = false, authorize = async () => false, now = Date.now, ttlMs = 300000, maxPreviews = 8, projectMaxCalls = Number.MAX_SAFE_INTEGER, projectConcurrency = DEFAULT_PROJECT_CONCURRENCY } = {}) {
   for (const n of [ttlMs, maxPreviews]) if (!Number.isSafeInteger(n) || n < 1) throw new Error('Invalid project preview limit');
   if (!Number.isSafeInteger(projectMaxCalls) || projectMaxCalls < 1) throw new Error('Invalid project model call limit');
 

package/src/project-snapshot.mjs

@@ -13,7 +13,7 @@ const INVENTORY_NOTICE = 'Tracked current working files only, including unchange
 
 async function inventoryGit(root, options) {
   const args = ['--no-optional-locks', '-c', 'core.fsmonitor=false', '-c', 'core.untrackedCache=false'];
-  const actual = text(await checked('git', [...args, 'rev-parse', '--show-toplevel'], { ...options, cwd: root })).trim();
+  const actual = text(await checked('git', [...args, 'rev-parse', '--show-toplevel'], { ...options, cwd: root })).replace(/\r?\n$/, '');
   if (await realpath(actual) !== root) throw new Error('Full project requires explicit repository root');
   const index = await checked('git', [...args, 'ls-files', '--stage', '-z'], { ...options, cwd: root, maxBytes: 2 * 1024 * 1024 });
   const records = [];

package/src/review-jobs.mjs

@@ -16,12 +16,15 @@ export function createReviewJobs({directory}={}){
  async function save(job){await safeDirectory();const tmp=path.join(directory,job.id+'.'+randomUUID()+'.tmp');await writeFile(tmp,JSON.stringify(job.record),{mode:0o600,flag:'wx'});await rename(tmp,filename(job.id));changed(job.id);}
  async function owned(id,exec){const who=identity(exec),job=jobs.get(id);if(job){if(!same(who,job.record.owner))throw new Error('Foreign review job');return job.record;}await safeDirectory();const name=filename(id),stat=await lstat(name);if(stat.isSymbolicLink()||!stat.isFile())throw new Error('Unsafe report file');const r=JSON.parse(await readFile(name,'utf8'));if(!same(who,r.owner))throw new Error('Foreign review job');if(['queued','running'].includes(r.status)){r.status='interrupted';r.notice='Host restarted or plugin disposed. Saved checkpoints are available; resending requires a fresh preview and approval.';}return r;}
  return {
-  async start(exec,work){if(disposed)throw new Error('Review job service disposed');exec.signal?.throwIfAborted();const who=identity(exec);const relative=path.relative(path.resolve(who.cwd),directory);if(relative===''||(!relative.startsWith('..'+path.sep)&&relative!=='..'&&!path.isAbsolute(relative)))throw new Error('Report store must be outside reviewed workspace');if([...jobs.values()].some(j=>j.record.owner.sessionId===who.sessionId&&['queued','running'].includes(j.record.status)))throw new Error('Session review job already active');const id=randomUUID(),controller=new AbortController(),job={id,controller,record:{jobId:id,owner:who,status:'queued',stage:'queued',checkpoints:[],createdAt:new Date().toISOString()},pending:Promise.resolve()};jobs.set(id,job);try{await save(job);}catch(error){jobs.delete(id);throw error;}const enqueue=fn=>{job.pending=job.pending.then(fn);return job.pending;};
+  async start(exec,work){if(disposed)throw new Error('Review job service disposed');exec.signal?.throwIfAborted();const who=identity(exec);const relative=path.relative(path.resolve(who.cwd),directory);if(relative===''||(!relative.startsWith('..'+path.sep)&&relative!=='..'&&!path.isAbsolute(relative)))throw new Error('Report store must be outside reviewed workspace');if([...jobs.values()].some(j=>j.record.owner.sessionId===who.sessionId&&['queued','running'].includes(j.record.status)))throw new Error('Session review job already active');const id=randomUUID(),controller=new AbortController(),job={id,controller,record:{jobId:id,owner:who,status:'queued',stage:'queued',checkpoints:[],createdAt:new Date().toISOString()},pending:Promise.resolve()};jobs.set(id,job);try{await save(job);}catch(error){jobs.delete(id);throw error;}
+   // Keep the serialization tail usable after failure, but return the original
+   // rejecting operation so checkpoint callers still observe durability failures.
+   const enqueue=fn=>{const operation=job.pending.then(fn);job.pending=operation.catch(()=>{});return operation;};
    // Own cancellation explicitly. The short start RPC ending is NOT task cancellation.
-   job.done=(async()=>{await Promise.resolve();try{job.record.status='running';await enqueue(()=>save(job));const result=await work({signal:controller.signal,checkpoint:async value=>enqueue(async()=>{job.record.stage=value.stage??'reviewing';job.record.checkpoints.push(structuredClone(value));await save(job);})});job.record.result=result;job.record.status=controller.signal.aborted?'cancelled':'completed';}catch(error){job.record.status=controller.signal.aborted?'cancelled':'failed';job.record.error=error?.message??String(error);}finally{job.record.finishedAt=new Date().toISOString();try{await enqueue(()=>save(job));}catch(error){job.record.status='failed';job.record.persistenceError=error.message;}}})();return {jobId:id,status:'queued',nextAction:'Call code_review_wait until terminal status; do not finish the user request at start.',notice:'Background job accepted. Poll status; start is not a completed review. Explicit cancel or plugin disposal stops it.'};
+   job.done=(async()=>{await Promise.resolve();try{job.record.status='running';await enqueue(()=>save(job));const result=await work({signal:controller.signal,checkpoint:async value=>enqueue(async()=>{job.record.stage=value.stage??'reviewing';job.record.checkpoints.push(structuredClone(value));await save(job);})});job.record.result=result;job.record.status=controller.signal.aborted?'cancelled':'completed';}catch(error){job.record.status=controller.signal.aborted?'cancelled':'failed';job.record.error=error?.message??String(error);}finally{job.record.finishedAt=new Date().toISOString();try{await enqueue(()=>save(job));jobs.delete(id);}catch(error){job.record.status='failed';job.record.persistenceError=error?.message??String(error);}finally{changed(id);}}})();return {jobId:id,status:'queued',nextAction:'Call code_review_wait until terminal status; do not finish the user request at start.',notice:'Background job accepted. Poll status; start is not a completed review. Explicit cancel or plugin disposal stops it.'};
   },
   async status(id,exec,page){const r=structuredClone(await owned(id,exec));r.recovery=recoveryCoverage(r);r.progress=jobProgress(r);r.waitRevision=r.checkpoints.length;r.nextAction=['queued','running'].includes(r.status)?'Call code_review_wait; do not end the user review request while task runs.':r.result?.previewId?'Show preview and request user confirmation before execute.':'Collect final report and unfinished scope, then provide one final answer.';if(!page)return r;const {offset=0,limit=20,checkpointIndex}=page;if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(limit)||limit<1||limit>100)throw new Error('Invalid result page');if(checkpointIndex!==undefined){if(!Number.isSafeInteger(checkpointIndex)||checkpointIndex<0||checkpointIndex>=r.checkpoints.length)throw new Error('Invalid checkpoint index');return {jobId:r.jobId,status:r.status,checkpointIndex,checkpoint:pageCheckpoint(r.checkpoints[checkpointIndex],offset,limit),page:{offset,limit}};}const result=r.result;const report=result?.report;return {...r,result:undefined,recovery:{...r.recovery,unfinishedStages:r.recovery.unfinishedStages.slice(offset,offset+limit),files:r.recovery.files.slice(offset,offset+limit),windows:r.recovery.windows.slice(offset,offset+limit),suggestedPaths:r.recovery.suggestedPaths.slice(offset,offset+limit),totalObservedFiles:r.recovery.files.length},checkpoints:r.checkpoints.slice(offset,offset+limit).map(c=>pageCheckpoint(c,0,limit)),checkpointPage:{offset,limit,total:r.checkpoints.length},...(result?{resultSummary:report?{status:report.status,coverage:report.coverage,model:report.model,snapshotId:report.snapshotId}:({...result,files:result.files?.slice(offset,offset+limit),filePage:result.files?{offset,limit,total:result.files.length}:undefined}),resultPage:report?{files:report.files?.slice(offset,offset+limit),findings:report.findings?.slice(offset,offset+limit),totalFiles:report.files?.length,totalFindings:report.findings?.length}:undefined}: {})};},
-  async wait(id,exec,{after,timeoutMs=25000,signal}={}){const r=await owned(id,exec);if(!Number.isSafeInteger(timeoutMs)||timeoutMs<1||timeoutMs>60000)throw new Error('Invalid wait duration');if(after!==undefined&&(!Number.isSafeInteger(after)||after<0))throw new Error('Invalid wait revision');const revision=r.checkpoints.length;if(!['queued','running'].includes(r.status)||(after!==undefined&&after!==revision))return {changed:true};signal?.throwIfAborted();await new Promise((resolve,reject)=>{let timer;const cleanup=()=>{clearTimeout(timer);signal?.removeEventListener('abort',abort);listeners.get(id)?.delete(done);};const done=()=>{cleanup();resolve();},abort=()=>{cleanup();reject(signal.reason);};if(!listeners.has(id))listeners.set(id,new Set());listeners.get(id).add(done);signal?.addEventListener('abort',abort,{once:true});timer=setTimeout(done,timeoutMs);const latest=jobs.get(id)?.record;if(latest&&(latest.checkpoints.length!==revision||!['queued','running'].includes(latest.status)))done();if(signal?.aborted)abort();});return {changed:true};},
+  async wait(id,exec,{after,timeoutMs=25000,signal}={}){const r=await owned(id,exec);if(!Number.isSafeInteger(timeoutMs)||timeoutMs<1||timeoutMs>60000)throw new Error('Invalid wait duration');if(after!==undefined&&(!Number.isSafeInteger(after)||after<0))throw new Error('Invalid wait revision');const revision=r.checkpoints.length;if(!['queued','running'].includes(r.status)||(after!==undefined&&after!==revision))return {changed:true};signal?.throwIfAborted();await new Promise((resolve,reject)=>{let timer;const cleanup=()=>{clearTimeout(timer);signal?.removeEventListener('abort',abort);const waiting=listeners.get(id);waiting?.delete(done);if(waiting?.size===0)listeners.delete(id);};const done=()=>{cleanup();resolve();},abort=()=>{cleanup();reject(signal.reason);};if(!listeners.has(id))listeners.set(id,new Set());listeners.get(id).add(done);signal?.addEventListener('abort',abort,{once:true});timer=setTimeout(done,timeoutMs);const latest=jobs.get(id)?.record;if(!latest||latest.checkpoints.length!==revision||!['queued','running'].includes(latest.status))done();if(signal?.aborted)abort();});return {changed:true};},
   async cancel(id,exec){await owned(id,exec);const j=jobs.get(id);if(j)j.controller.abort(new Error('User cancelled review job'));return {jobId:id,cancelRequested:!!j};},
   async dispose(){disposed=true;for(const j of jobs.values())j.controller.abort(new Error('Review plugin disposed'));await Promise.all([...jobs.values()].map(j=>j.done));}
  };

package/src/review.mjs

@@ -136,8 +136,8 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
     const { changes, payload } = prepared;
     Object.assign(state, prepared.metadata);
     if (state.contextMode === 'approved-retrieval') report.limitations.push({ fileId: file.id, text: '窗口初始输入仅带上下文身份目录，全文须按需读取；不声明所有上下文已核查。' });
-    if (prepared.synthesis) state.synthesisStatus = prepared.synthesis.budget.fits ? 'pending' : 'blocked';
-    if (prepared.synthesis && !prepared.synthesis.budget.fits) report.limitations.push({ fileId: file.id, text: '跨窗口综合输入超限，未发送；单窗口完成不表示交互影响已检查' });
+    if (prepared.synthesis) state.synthesisStatus = prepared.synthesis.status === 'ready' ? 'pending' : 'blocked';
+    if (prepared.synthesis?.status === 'blocked') report.limitations.push({ fileId: file.id, text: (prepared.synthesis.reason === 'batch-limit' ? '跨窗口综合批次数超过上限（20），未发送；全部主窗口仍独立审查' : '跨窗口综合输入超限，未发送') + '；单窗口完成不表示交互影响已检查' });
     if (state.sourceMode === 'change-windows') state.windowCoverage = { completed: [], pending: [...state.windowIds] };
     if(changes.precision==='envelope')report.limitations.push({fileId:file.id,text:'精确差异不可得，按保守包络分段检查；包络包含可能未变的行，不证明精确编辑或回归因果。'});
     if (changes.status === 'limited') report.limitations.push({ fileId: file.id, text: '精确变更分析受限：' + changes.reason + '；仍按完整两侧内容审查' });
@@ -192,7 +192,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           }
         }
         const batches = [...(prepared.batches ?? [{ payload, windowIds: state.windowIds ?? [] }])];
-        if (prepared.synthesis?.budget.fits) batches.push({ payload: prepared.synthesis.payload, windowIds: [], synthesis: true });
+        if (prepared.synthesis?.status === 'ready') batches.push({ payload: prepared.synthesis.payload, windowIds: [], synthesis: true });
         const matchingInteractionPlans = interactionPlans.filter(p => input.files.filter(f => p.group.fileIds.includes(f.id)).at(-1)?.id === file.id);
         for (const interactionPlan of matchingInteractionPlans.filter(p => p.prepared.status === 'ready')) batches.push({ payload: interactionPlan.prepared.payload, windowIds: [], interaction: interactionPlan.group });
         const scheduled = Array.from({length:rounds},(_,i)=>batches.map(b=>({...b,round:i+1}))).flat();
@@ -326,9 +326,9 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
     } catch (error) {
       state.status = signal?.aborted ? 'cancelled' : error?.code === 'PROJECT_MODEL_CALL_LIMIT' ? 'pending' : 'failed';
       state.reason = error?.message ?? String(error);
-      if(error.attempts)state.protocolAttempts=error.attempts;
-      if(error.responseAttempts)state.responseAttempts=error.responseAttempts;
-      if(error.diagnostic)state.protocolDiagnostic=error.diagnostic;
+      if(error?.attempts)state.protocolAttempts=error.attempts;
+      if(error?.responseAttempts)state.responseAttempts=error.responseAttempts;
+      if(error?.diagnostic)state.protocolDiagnostic=error.diagnostic;
       for(const pass of state.reviewPasses??[])if(pass.status==='running')pass.status=signal?.aborted?'cancelled':'failed';
       state.failureCode = signal?.aborted ? 'CANCELLED' : ['MODEL_INVALID_JSON','MODEL_INCOMPLETE_OUTPUT','MODEL_TIMEOUT','MODEL_INVALID_READ_REQUEST','MODEL_OUTPUT_LIMIT','MODEL_PROTOCOL_ERROR','MODEL_INVALID_REVIEW_RESPONSE','MODEL_INVALID_FINDING_IDENTITY','MODEL_INVALID_FINDING_SEVERITY','MODEL_MISSING_FINDING_FIELD','MODEL_INVALID_ANCHOR','MODEL_ANCHOR_MISMATCH','READER_CALL_BUDGET_EXCEEDED','READER_OUTPUT_BUDGET_EXCEEDED','RETRIEVAL_ROUND_BUDGET_EXCEEDED','RETRIEVAL_FINAL_RESPONSE_REQUIRED','PROJECT_MODEL_CALL_LIMIT'].includes(error?.code) ? error.code : 'REVIEW_EXECUTION_FAILED';
     }

package/src/snapshot.mjs

@@ -147,7 +147,13 @@ export async function captureSnapshot(cwd, options = {}) {
 
   // Re-capture verifies both selected sides while collecting explicit context.
   if ((await capture(cwd, indexOptions)).id !== snapshot.id) throw new Error('Snapshot changed while collecting context');
-  for (const item of context) if ((await readLocal(snapshot.root, item.path, indexOptions)).hash !== item.hash) throw new Error('Context changed during capture');
+  for (const item of context) {
+    // Overlapping staged context reuses the approved index side, not local bytes.
+    // The same-side re-capture above verifies its content and index identity,
+    // including when the working file differs or no longer exists.
+    if (type === 'git' && snapshot.changeScope === 'staged' && snapshot.files.some(file => file.path === item.path)) continue;
+    if ((await readLocal(snapshot.root, item.path, indexOptions)).hash !== item.hash) throw new Error('Context changed during capture');
+  }
   if (index && (await (type === 'git' ? gitContextIndex : svnContextIndex)(snapshot.root, indexOptions)).fingerprint !== index.fingerprint) throw new Error('Tracked context index changed during capture');
   const verifiedRules = await captureProjectRules(snapshot.root, rulePaths, { signal: options.signal, files: snapshot.files });
   if (JSON.stringify(verifiedRules) !== JSON.stringify(rules)) throw new Error('Rules changed during capture');

package/src/source-segments.mjs

@@ -1,5 +1,6 @@
 // Linear segmentation of approved text. Coordinates remain original one-based lines.
 export function sourceSegments(windows,{maxBytes=12000,maxLines=100}={}){
+ if(!Number.isSafeInteger(maxBytes)||maxBytes<1||!Number.isSafeInteger(maxLines)||maxLines<1)throw new Error('Invalid source segment limits');
  const out=[];for(const w of windows){if(w.old.count<=maxLines&&w.new.count<=maxLines&&Buffer.byteLength(w.old.text)<=maxBytes&&Buffer.byteLength(w.new.text)<=maxBytes){out.push(w);continue;}const sides={old:w.old.text.match(/[^\n]*\n|[^\n]+$/g)??[],new:w.new.text.match(/[^\n]*\n|[^\n]+$/g)??[]},pos={old:0,new:0};let i=0;
   while(pos.old<sides.old.length||pos.new<sides.new.length){const item={id:w.id+'-s'+(++i),editIds:[...w.editIds]};for(const side of ['old','new']){const start=pos[side],parts=[];let bytes=0;while(pos[side]<sides[side].length&&parts.length<maxLines){const line=sides[side][pos[side]],n=Buffer.byteLength(line);if(parts.length&&bytes+n>maxBytes)break;parts.push(line);bytes+=n;pos[side]++;if(bytes>=maxBytes)break;}item[side]={start:w[side].start+start,count:parts.length,text:parts.join('')};}out.push(item);}
   if(!i)out.push(w);

package/src/svn-caller-index.mjs

@@ -7,4 +7,11 @@ import {lstat} from 'node:fs/promises';
 import path from 'node:path';
 const canonical=v=>Array.isArray(v)?v.map(canonical):v&&typeof v==='object'?Object.fromEntries(Object.keys(v).sort().map(k=>[k,canonical(v[k])])):v;
 // Offline scoped status only, never svn list or repository-wide enumeration.
-export async function svnCallerIndex(root,scopes,options={}){const approved=validateCallerScopes(scopes),entries=[],chunks=[];let bytes=0;const seen=new Set();for(const scope of approved){const ancestors=await svnCallerAncestors(root,scope,options);chunks.push(ancestors.fingerprint);let cursor=root;for(const part of scope.split('/')){cursor=path.join(cursor,part);const s=await lstat(cursor);if(s.isSymbolicLink()||!s.isDirectory())throw new Error('SVN caller scope requires real directories');}const raw=await checked('svn',['--non-interactive','status','--xml','--verbose','--ignore-externals','--',scope+'@'],{...options,cwd:root,maxBytes:64*1024});bytes+=raw.length;if(bytes>64*1024)throw new Error('SVN caller index byte limit exceeded');const found=(xml(raw).status?.target??[]).flatMap(t=>t.entry??[]);for(const e of found){const name=relativePath(e['@_path'].replaceAll('\\','/'));if(name!==scope&&!name.startsWith(scope+'/'))throw new Error('SVN caller index escaped scope');if(seen.has(name))throw new Error('Duplicate SVN caller index path');seen.add(name);if(seen.size>256)throw new Error('SVN caller index path limit exceeded');entries.push({...e,'@_path':name});}if(!found.some(e=>e['@_path'].replaceAll('\\','/')===scope))throw new Error('SVN caller scope missing from status');chunks.push(scope);}entries.sort((a,b)=>a['@_path']<b['@_path']?-1:1);const unsafe=s=>!s||s['@_item']!=='normal'||!['none','normal'].includes(s['@_props'])||['@_switched','@_copied','@_file-external','@_tree-conflicted'].some(k=>s[k]==='true');for(const scope of approved){const e=entries.find(e=>e['@_path']===scope);if(unsafe(e?.['wc-status']))throw new Error('Unsafe SVN caller directory state');}return {scopes:approved,paths:entries.filter(e=>!approved.includes(e['@_path'])&&!unsafe(e['wc-status'])).map(e=>e['@_path']),entries,records:entries.length,bytes,fingerprint:hash(JSON.stringify(canonical({scopes:chunks,entries})))};}
+// Status XML has no node kind: bind local kinds and omit directories from body candidates.
+// Links and other unsafe non-directory nodes still reach the strict source validator.
+export async function svnCallerIndex(root,scopes,options={}){const approved=validateCallerScopes(scopes),entries=[],chunks=[];let bytes=0;const seen=new Set();for(const scope of approved){const ancestors=await svnCallerAncestors(root,scope,options);chunks.push(ancestors.fingerprint);let cursor=root;for(const part of scope.split('/')){cursor=path.join(cursor,part);const s=await lstat(cursor);if(s.isSymbolicLink()||!s.isDirectory())throw new Error('SVN caller scope requires real directories');}
+ const raw=await checked('svn',['--non-interactive','status','--xml','--verbose','--ignore-externals','--',scope+'@'],{...options,cwd:root,maxBytes:64*1024});bytes+=raw.length;if(bytes>64*1024)throw new Error('SVN caller index byte limit exceeded');const found=(xml(raw).status?.target??[]).flatMap(t=>t.entry??[]);
+ for(const e of found){const name=relativePath(e['@_path'].replaceAll('\\','/'));if(name!==scope&&!name.startsWith(scope+'/'))throw new Error('SVN caller index escaped scope');if(seen.has(name))throw new Error('Duplicate SVN caller index path');seen.add(name);if(seen.size>256)throw new Error('SVN caller index path limit exceeded');entries.push({...e,'@_path':name});}if(!found.some(e=>e['@_path'].replaceAll('\\','/')===scope))throw new Error('SVN caller scope missing from status');chunks.push(scope);}
+ entries.sort((a,b)=>a['@_path']<b['@_path']?-1:1);const unsafe=s=>!s||s['@_item']!=='normal'||!['none','normal'].includes(s['@_props'])||['@_switched','@_copied','@_file-external','@_tree-conflicted'].some(k=>s[k]==='true');for(const scope of approved){const e=entries.find(e=>e['@_path']===scope);if(unsafe(e?.['wc-status']))throw new Error('Unsafe SVN caller directory state');}
+ const nodes=[];for(const e of entries.filter(e=>!approved.includes(e['@_path'])&&!unsafe(e['wc-status']))){options.signal?.throwIfAborted();const stat=await lstat(path.join(root,e['@_path']));nodes.push({path:e['@_path'],kind:stat.isDirectory()?'dir':stat.isSymbolicLink()?'link':stat.isFile()?'file':'other'});}
+ return {scopes:approved,paths:nodes.filter(n=>n.kind!=='dir').map(n=>n.path),entries,records:entries.length,bytes,fingerprint:hash(JSON.stringify(canonical({scopes:chunks,entries,nodes})))};}

package/src/svn-history-callers.mjs

@@ -24,7 +24,8 @@ export async function svnHistoryCallers(files,history,scopes,context,{index,look
    if(typeof value?.content?.text!=='string'||value.kind!=='file'||value.source?.operativeRevision!==revision)throw new Error('Invalid fixed SVN caller body');
    const bodyBytes=value.content.bytes??Buffer.byteLength(value.content.text);
    if(!Number.isSafeInteger(bodyBytes)||bodyBytes<0||bodyBytes>256*1024||Buffer.byteLength(value.content.text)>256*1024)throw new Error('Invalid fixed SVN caller size');
-   scanBytes+=bodyBytes;
+   // Raw encoding bytes may differ from UTF-8; never charge less than the text retained.
+   scanBytes+=Math.max(bodyBytes,Buffer.byteLength(value.content.text));
    if(scanBytes>1024*1024)throw new Error('SVN historical caller scan source limit exceeded');
    const source={path:name,...value.content,svnSource:value.source,side,revision};sources.push(source);scanned.push(source);
   }

package/src/svn-replacement-tree.mjs

@@ -6,11 +6,19 @@ import {readReplacementSource} from './svn-replacement-source.mjs';
 import {svnWorkingIdentity} from './svn-working-identity.mjs';
 import {hash,decode,relativePath,readLocal} from './content.mjs';
 import {isSecretPath} from './secret-path.mjs';
+import {canonicalSvnUrl} from './svn-url.mjs';
 import {svnKeywordMapping} from './svn-keyword-mapping.mjs';
 import {svnEolMapping} from './svn-eol-mapping.mjs';
 import {svnSpecialData} from './svn-special.mjs';
 import {readWorkingSvnSpecial} from './svn-working-special.mjs';
 
+// Copy provenance is not permission to capture credential bytes at a safe target name.
+function assertCopySource(source,suffix=''){
+ if(source===null||source===undefined)return;
+ const url=canonicalSvnUrl(source),name=decodeURIComponent(new URL(url).pathname);
+ if(isSecretPath(name)||isSecretPath(name+(suffix?'/'+suffix:'')))throw new Error('Credential replacement copy source excluded');
+}
+
 // Fixed repository tree versus explicitly selected working replacement tree.
 // Every descendant is a separate source/coverage unit, never an implicit approval.
 export async function captureReplacementTree(root,rootInfo,name,options={}){
@@ -26,13 +34,14 @@ export async function captureReplacementTree(root,rootInfo,name,options={}){
  const ancestors=async p=>{
   const parts=p.split('/').slice(0,-1),names=['.',...parts.map((_,i)=>parts.slice(0,i+1).join('/'))],records=[];
   for(const name of names){
-   if(!verifying&&ancestorReceipts.has(name)){records.push(ancestorReceipts.get(name));continue;}
+   if(!verifying&&ancestorReceipts.has(name)){const record=ancestorReceipts.get(name);assertCopySource(record.copyFromUrl,name==='.'?p:p.slice(name.length+1));records.push(record);continue;}
    const stat=await lstat(name==='.'?root:path.join(root,name));if(stat.isSymbolicLink()||!stat.isDirectory())throw new Error('Replacement ancestor is not a real directory');
    const node=xml(await run(['info','--xml','--',name+'@'])).info?.entry?.[0],identity=svnWorkingIdentity(node,rootInfo,name);
    const entries=xml(await run(['status','--xml','--verbose','--ignore-externals','--depth','empty','--',name+'@'])).status?.target?.flatMap(t=>t.entry??[])??[],s=entries[0]?.['wc-status'];
    if(entries.length!==1||!s||!['normal','modified','added','replaced'].includes(s['@_item'])||s['@_props']==='conflicted'||['@_switched','@_file-external','@_tree-conflicted'].some(k=>s[k]==='true'))throw new Error('Unsafe replacement ancestor state');
+   assertCopySource(identity.source.copyFromUrl,name==='.'?p:p.slice(name.length+1));
    const properties=await props(name);if(Object.hasOwn(properties,'svn:externals')||Object.hasOwn(properties,'svn:special'))throw new Error('Unsafe replacement ancestor properties');
-   const record={path:name,fingerprint:hash(JSON.stringify([identity.fingerprint,properties]))};
+   const record={path:name,copyFromUrl:identity.source.copyFromUrl,fingerprint:hash(JSON.stringify([identity.fingerprint,properties]))};
    if(verifying){if(ancestorReceipts.get(name)?.fingerprint!==record.fingerprint)throw new Error('Replacement ancestor changed during capture');}else ancestorReceipts.set(name,record);records.push(record);
   }return records;
  };
@@ -40,6 +49,7 @@ export async function captureReplacementTree(root,rootInfo,name,options={}){
   if(['@_switched','@_file-external','@_tree-conflicted'].some(k=>s[k]==='true')||!['normal','modified','added','replaced'].includes(s['@_item'])||s['@_props']==='conflicted')throw new Error('Unsafe replacement descendant state');
   const ancestorEvidence=await ancestors(p);
   const node=xml(await run(['info','--xml','--',p+'@'])).info?.entry?.[0],identity=svnWorkingIdentity(node,rootInfo,p);if(!['file','dir'].includes(node['@_kind']))throw new Error('Unsupported replacement descendant kind');
+  assertCopySource(identity.source.copyFromUrl);
   if(node['@_kind']==='dir'&&identity.source.depth!=='infinity')throw new Error('Sparse replacement target cannot prove descendant inventory');
   const properties=await props(p);if(Object.hasOwn(properties,'svn:externals'))throw new Error('Replacement externals require independent scope');
   const content=node['@_kind']==='dir'?decode(Buffer.alloc(0)):Object.hasOwn(properties,'svn:special')?(await readWorkingSvnSpecial(root,p,properties,options)).content:await readLocal(root,p,options);

package/src/svn-working-special.mjs

@@ -8,13 +8,15 @@ import {svnSpecialData} from './svn-special.mjs';
 export async function readWorkingSvnSpecial(root,name,properties,options={}){
  relativePath(name);assertNonSecretPath(name);options.signal?.throwIfAborted();
  const canonical=await realpath(root);let cursor=canonical;const parts=name.split('/');
- for(const part of parts.slice(0,-1)){cursor=path.join(cursor,part);const stat=await lstat(cursor);if(stat.isSymbolicLink()||!stat.isDirectory())throw new Error('SVN special ancestor must be a real directory');}
+ const ancestors=[];
+ for(const part of parts.slice(0,-1)){cursor=path.join(cursor,part);const stat=await lstat(cursor);if(stat.isSymbolicLink()||!stat.isDirectory())throw new Error('SVN special ancestor must be a real directory');ancestors.push({path:cursor,dev:stat.dev,ino:stat.ino,ctimeMs:stat.ctimeMs});}
  const filename=path.join(cursor,parts.at(-1)),before=await lstat(filename);let content;
  if(before.isSymbolicLink()){
   const target=await readlink(filename,{encoding:'buffer'});if(target.length>16384)throw new Error('SVN link target byte limit exceeded');
   const bytes=Buffer.concat([Buffer.from('link '),target]);if(bytes.length>(options.maxFileBytes??256*1024))throw new Error('SVN special file size limit exceeded');
   content=decode(bytes);const after=await lstat(filename);const again=await readlink(filename,{encoding:'buffer'});
-  if(!after.isSymbolicLink()||before.ino!==after.ino||before.mtimeMs!==after.mtimeMs||before.ctimeMs!==after.ctimeMs||!again.equals(target))throw new Error('SVN link changed during capture');
+  for(const ancestor of ancestors){const now=await lstat(ancestor.path);if(now.isSymbolicLink()||!now.isDirectory()||now.dev!==ancestor.dev||now.ino!==ancestor.ino||now.ctimeMs!==ancestor.ctimeMs)throw new Error('SVN special ancestor changed during capture');}
+  if(!after.isSymbolicLink()||before.ino!==after.ino||before.dev!==after.dev||before.mtimeMs!==after.mtimeMs||before.ctimeMs!==after.ctimeMs||!again.equals(target))throw new Error('SVN link changed during capture');
  }else{
   if(!before.isFile())throw new Error('SVN special working node is neither link nor regular link record');
   content=await readLocal(canonical,name,options);

package/src/synthesis-evidence.mjs

@@ -1,15 +1,31 @@
 // Audit only successful reads from this synthesis generation, never prior batches/searches.
 export function validateSynthesisReads(findings, changes, reads, catalog, fileId, snapshotId) {
  const sources = new Map(catalog.map(s => [s.id, s]));
+ const intervals = new Map();
+ for (const read of reads) {
+  const source = sources.get(read.sourceId);
+  if (read.kind !== 'read' || read.snapshotId !== snapshotId || source?.fileId !== fileId || !['old', 'new'].includes(source.side)) continue;
+  if (!Number.isSafeInteger(read.start) || read.start < 1 || !Number.isSafeInteger(read.count) || read.count < 1 || !Number.isSafeInteger(read.start + read.count)) continue;
+  const ranges = intervals.get(read.sourceId) ?? [];
+  ranges.push({ start: read.start, end: read.start + read.count });
+  intervals.set(read.sourceId, ranges);
+ }
+ // Never join different source identities, even when their file and side match.
+ for (const [id, ranges] of intervals) {
+  const merged = [];
+  for (const range of ranges.sort((a, b) => a.start - b.start)) {
+   const last = merged.at(-1);
+   if (last && range.start <= last.end) last.end = Math.max(last.end, range.end);
+   else merged.push({ ...range });
+  }
+  intervals.set(id, merged);
+ }
  for (const finding of findings) {
   for (const id of finding.attribution.editIds) {
    const edit = changes.edits.find(e => e.id === id);
    const covered = ['old', 'new'].some(side => {
     const range = edit?.[side];
-    return range?.count > 0 && reads.some(r => {
-     const source = sources.get(r.sourceId);
-     return r.kind === 'read' && r.snapshotId === snapshotId && source?.fileId === fileId && source.side === side && r.start <= range.start && r.start + r.count >= range.start + range.count;
-    });
+    return range?.count > 0 && [...intervals].some(([sourceId, ranges]) => sources.get(sourceId).side === side && ranges.some(r => r.start <= range.start && r.end >= range.start + range.count));
    });
    if (!covered) throw new Error('Synthesis referenced edit was not read in this generation');
   }

package/src/tracked-context.mjs

@@ -16,7 +16,10 @@ export async function gitContextIndex(root, options = {}) {
  let bytes;
  if(options.probePaths !== undefined){
   if(!Array.isArray(options.probePaths)||options.probePaths.length>512||new Set(options.probePaths).size!==options.probePaths.length)throw new Error('Invalid Git context probes');
-  const chunks=[];let totalBytes=0;for(const name of [...options.probePaths].sort()){relativePath(name);const chunk=await checked('git',['--no-optional-locks','--literal-pathspecs','-c','core.fsmonitor=false','-c','core.untrackedCache=false','ls-files','--stage','-z','--',name],{...options,cwd:root,maxBytes:64*1024});const records=new TextDecoder('utf-8',{fatal:true}).decode(chunk).split('\0').filter(Boolean);for(const record of records)if(record.slice(record.indexOf('\t')+1)!==name)throw new Error('Git context probe expanded beyond literal path');totalBytes+=chunk.length;if(totalBytes>1024*1024)throw new Error('Tracked context index limit exceeded');chunks.push(chunk);}
+  // A literal pathspec alone still recursively matches a directory. Exclude
+  // its literal trailing-slash subtree before output, so directory probes are
+  // exact misses without enumerating or authorizing unrequested descendants.
+  const chunks=[];let totalBytes=0;for(const name of [...options.probePaths].sort()){relativePath(name);const chunk=await checked('git',['--no-optional-locks','-c','core.fsmonitor=false','-c','core.untrackedCache=false','ls-files','--stage','-z','--',':(top,literal)'+name,':(top,literal,exclude)'+name+'/'],{...options,cwd:root,maxBytes:64*1024});const records=new TextDecoder('utf-8',{fatal:true}).decode(chunk).split('\0').filter(Boolean);for(const record of records)if(record.slice(record.indexOf('\t')+1)!==name)throw new Error('Git context probe expanded beyond literal path');totalBytes+=chunk.length;if(totalBytes>1024*1024)throw new Error('Tracked context index limit exceeded');chunks.push(chunk);}
   bytes=Buffer.concat(chunks);if(bytes.length>1024*1024)throw new Error('Tracked context index limit exceeded');
  }else bytes = await checked('git', ['--no-optional-locks','-c','core.fsmonitor=false','-c','core.untrackedCache=false','ls-files','--stage','-z'], {...options,cwd:root,maxBytes:1024*1024});
  const records = new TextDecoder('utf-8',{fatal:true}).decode(bytes).split('\0').filter(Boolean);

package/src/window-synthesis.mjs

@@ -1,6 +1,8 @@
 // Pure approved-data preparation, no reads or sends. No source text is silently clipped.
 export function prepareWindowSynthesis(batchPayloads, measure) {
-  if (!Array.isArray(batchPayloads) || batchPayloads.length < 2 || batchPayloads.length > 20) throw new Error('Invalid synthesis batches');
+  if (!Array.isArray(batchPayloads) || batchPayloads.length < 2) throw new Error('Invalid synthesis batches');
+  // A synthesis scheduling limit must not discard any independently reviewable batch.
+  if (batchPayloads.length > 20) return { status: 'blocked', reason: 'batch-limit', batchCount: batchPayloads.length };
   const batches = batchPayloads.map(payload => JSON.parse(payload));
   const base = batches[0];
   const windows = batches.flatMap(batch => batch.windows);
@@ -8,5 +10,5 @@ export function prepareWindowSynthesis(batchPayloads, measure) {
   const windowIndex = windows.map(w => ({ id: w.id, editIds: w.editIds, old: { start: w.old.start, count: w.old.count }, new: { start: w.new.start, count: w.new.count } }));
   const payload = JSON.stringify({ ...base, windows: undefined, windowIndex, sourceMode: 'window-synthesis', windowNotice: '本请求综合检查所有窗口的共同影响，不重报单窗口问题；windowIndex仅为原始定位目录，不含源码，必须在批准catalog中读取相关旧新片段，不能仅凭目录认定缺陷。输出仍仅主file的发现，归因至少关联两个不同窗口的编辑；证据不足明确限制。' });
   const budget = measure(payload);
-  return { payload, windows, windowIds: windows.map(w => w.id), budget };
+  return { status: budget.fits ? 'ready' : 'blocked', ...(budget.fits ? {} : { reason: 'input-budget' }), payload, windows, windowIds: windows.map(w => w.id), budget };
 }