@feng0531/dsh-code-review 0.85.4 → 0.85.6

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.85.6 — 快照正确性、任务隔离与取消修复
+
+- Git 工作区撤销暂存重命名后按 HEAD 到当前原路径的净内容比较，不再误报不存在的删除；历史提交允许非 UTF-8 消息，父对象标识仍严格验证。
+- 实例方法绑定保留与 Object 原型同名的合法方法，并拒绝同一构造行附加语句或可执行参数造成的错误唯一性。
+- 后台任务卸载等待启动持久化到终态的完整生命周期，取消后不再启动审核；报告目录按真实路径隔离，拒绝祖先 junction／符号链接别名绕过。
+- SVN 标准关键字按原生别名组收缩，固定字段保持 UTF-8 字节宽度；显式上下文末尾同时复核元数据与原始正文哈希，并累计来源预算。
+- 本地文件以只读非阻塞方式打开后验证句柄类型，避免 Linux FIFO 替换挂起；进程取消时关闭自身输出管道并等待直接子进程结束，正常输出仍完整读取，不承诺终止全部后代。
+- 注册表元数据及安装包正文网络中断使用有界重试，格式、地址、超限与完整性失败仍立即拒绝；测试临时 SVN 工作副本及时清理。
+
+## 0.85.5 — 凭据来源保护与审核边界修复
+
+- SVN 独立替换树在读取正文前检查复制来源及祖先来源，阻断从凭据路径复制到普通目标的内容；调用方扫描不再把带源码扩展名的目录当作文件读取。
+- Git 默认工作区范围合并暂存删除后重建的同路径记录，避免重复文件身份；自动上下文允许精确目录索引导入探测，但不扩大后代正文授权。
+- 暂存区审核复用已选变更作为上下文时，按相同 index 版本验证，不再误与未暂存工作区内容比较。
+- 综合证据接受同一快照、来源和版本侧连续或重叠读取的完整区间覆盖；仍拒绝有缺口、错来源或错版本的证据。
+- 超过 20 个窗口批次时保留全部可执行主窗口及此前成果，单独披露综合受限并保持未完整审核状态，不再使整轮异常退出。
+
 ## 0.85.4 — 审查正确性、失败恢复与全项目提速
 
 `v0.85.2` 因发布说明缺少导航链接、`v0.85.3` 因 Windows 临时目录短路径别名未被新增测试 mock 规范化而未通过 CI，均未发布 npm 或 GitHub Release。本版本补齐链接、规范化测试匹配路径并重新执行完整门禁，不覆盖旧冻结标签、不削弱拒绝断言。

package/RELEASE-NOTES.md

@@ -1,28 +1,22 @@
-# v0.85.4 发布说明
+# v0.85.6 发布说明
 
 使用方式见 [README](README.md)，详细变化见 [变更记录](CHANGELOG.md)，发布门禁见 [开发说明](DEVELOPMENT.md)。
 
-`v0.85.2` 因发布说明缺少导航链接、`v0.85.3` 因 Windows runner 临时目录短路径别名未被两个新增测试 mock 规范化而未通过 CI，均未发布 npm 或 GitHub Release。本版本保留旧冻结标签，补齐文档链接并修正测试路径匹配后重新执行完整门禁，不削弱原有拒绝断言。
+## 审核正确性
 
-## 审查正确性与失败恢复
+- Git 撤销暂存重命名后按实际工作区净内容比较；历史审核不再因合法非 UTF-8 提交消息失败。
+- 方法绑定不再遗漏 `toString`、`valueOf` 等合法名称；构造行附加语句、原型替换及可执行参数不再被错误认证。
+- SVN 标准关键字别名与固定字段 UTF-8 字节宽度保持原生语义；显式上下文增加原始正文哈希重验，验证读取继续累计预算。
 
-- 模型流现在支持合法的完整文本块；完整块替换对应增量而不是重复拼接，文本和推理块继续受输出预算限制。真正重复或非法的 JSON 仍会拒绝，不靠截断响应通过。
-- 后台保存队列在一次失败后仍可保存终态；成功落盘后释放已结束任务的内存，最终保存失败也会唤醒等待者并保留诊断。
-- 修复模型拒绝值为 null/undefined 时丢失报告、非法分段参数导致死循环、SVN 历史正文大小低报影响累计预算等问题。
-- 补全进程终止的 SIGKILL 回退及清理、注册表网络异常重试、Git 根路径空格保留、锚点越界重定位、具名导入尾随逗号，以及 JavaScript/C#/C++ 导航边界。
+## 隔离、取消与发布验证
 
-## 全项目审核提速
+- 后台任务卸载覆盖首次持久化到终态，避免卸载完成后才启动审核；报告目录以真实路径验证工作区隔离，阻断路径别名绕过。
+- 本地文件以只读非阻塞方式打开并验证句柄，避免 Linux FIFO 替换导致等待；取消时关闭自身捕获管道，仍等待直接子进程退出并保留终止升级机制。正常成功路径继续完整收集输出。
+- npm 元数据及安装包正文网络中断按预算重试；无效 JSON、非法工件地址、输出超限及完整性不一致仍立即失败。
+- 补齐测试临时 SVN 仓库与工作副本清理。
 
-默认独立批次并发从 3 提高到 8，可用插件配置 projectConcurrency 在 1～8 内调整。保留主审、检索、证据复核及共享调用预算；遇到提供方并发限制或 429 时请调低。
+## 验证与边界
 
-相同 12 个批次、每次模拟模型延迟 40ms 的离线对照中，旧默认 3 路约 182ms，新默认 8 路约 92ms，约快 1.98 倍；调用数、完成数和结果顺序一致。这不是实际模型吞吐承诺，不减少必需调用或承诺 token 成本下降。
+新增 43 项回归。本地完整测试：Windows 750 项中 746 通过、4 项平台限定跳过；Linux 750 项全部通过。正式发布仍须通过冻结标签同一提交的 Ubuntu/Windows × Node.js 22/24 四组 CI、隔离安装以及原始包、npm 与 GitHub Release 工件一致性门禁。最终结果以对应 CI 和发布工作流为准。
 
-本次历史审核的 778 次模型调用中，263 次为额外 JSON 重生成。完整块兼容修复可避免对应场景的无谓纠正，但尚未证明它解释历史全部格式失败；真实提供方效果需要更新后复测。
-
-## 验证与安全边界
-
-本地完整测试 685 项：684 通过、1 项 Windows 平台跳过、0 失败、0 取消；另对新增流式、持久化及导航回归进行独立验证。正式发布必须经过冻结标签提交的 Linux/Windows × Node 22/24 四组 CI，以及隔离安装和注册表工件一致性门禁。
-
-文件及祖先身份检查是路径竞态检测加固，不是原子目录相对打开；不能保证抵御恶意进程精确交换并恢复路径。严格隔离场景应在不可并发修改的独立快照中审核。
-
-本版本不自动安装、升级或重启 DSH；需更新并重新加载插件后生效。
+只读非阻塞打开不是原子防路径替换，不保证任意设备或网络文件系统无阻塞；进程取消不承诺杀死全部后代。本版不保证模型始终输出合法 JSON，也不代表补齐此前自动审核失败的文件。发布不自动安装、升级或重启 DSH；更新并重新加载插件后生效。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.85.4",
+  "version": "0.85.6",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/class-bindings.mjs

@@ -4,6 +4,13 @@
 const BS = String.fromCharCode(96);
 const NL = String.fromCharCode(10);
 
+// Only a whole declaration with inert primitive arguments is proven here. In
+// particular, never exempt a constructor-line suffix or executable argument
+// from the class/instance mutation checks below. Strings are matched as tokens,
+// not stripped as comments (a quoted `);` must not end the declaration).
+const primitiveArgument = /(?:null|true|false|-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?|"(?:[^"\\\r\n]|\\[^\r\n])*"|'(?:[^'\\\r\n]|\\[^\r\n])*')/.source;
+const constructionDeclaration = new RegExp('^\\s*(?:const|let|var)\\s+([A-Za-z_$][A-Za-z0-9_$]*)\\s*=\\s*new\\s+([A-Za-z_$][A-Za-z0-9_$]*)\\s*\\(\\s*(?:' + primitiveArgument + '(?:\\s*,\\s*' + primitiveArgument + ')*\\s*,?)?\\s*\\)\\s*;?\\s*$');
+
 const escapeDollar = name => name.replaceAll('$', '\\$');
 function boundaryPattern(name, suffix, flags = '') {
   return new RegExp('(^|[^A-Za-z0-9_$])' + escapeDollar(name) + suffix, flags);
@@ -94,11 +101,11 @@ export function instanceMethodBindings(lines, importLine, targetText) {
   const body = classBody(targets, classLine);
   if (!body) return [];
   const decls = directMethods(body);
-  const names = {};
-  for (const d of decls) names[d.name] = (names[d.name] ?? 0) + 1;
+  const names = new Map();
+  for (const d of decls) names.set(d.name, (names.get(d.name) ?? 0) + 1);
   const result = [];
   for (const d of decls) {
-    if (names[d.name] !== 1) continue;
+    if (names.get(d.name) !== 1) continue;
     if (d.name === 'constructor') continue;
     const member = d.name;
     const token = boundaryPattern(member, '(?=[^A-Za-z0-9_$]|$)', 'g');
@@ -115,7 +122,7 @@ export function instanceMethodBindings(lines, importLine, targetText) {
     if (/[=,:.*#\[\]()]|\b(?:new|function|return|yield|case|throw|typeof|void|delete|instanceof)\b/.test(seg)) continue;
     let assign = null, inst = null;
     for (let i = 0; i < lines.length; i++) {
-      const a = /^\s*(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*new\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/.exec(lines[i]);
+      const a = constructionDeclaration.exec(lines[i]);
       if (a && a[2] === local) { if (assign !== null) return []; assign = i + 1; inst = a[1]; }
     }
     if (assign === null || inst === member || inst === klass || inst === local) continue;

package/src/content.mjs

@@ -1,6 +1,7 @@
 import { assertNonSecretPath } from './secret-path.mjs';
 import path from 'node:path';
 import { lstat, realpath, open } from 'node:fs/promises';
+import { constants } from 'node:fs';
 import { createHash } from 'node:crypto';
 
 export const hash = value => createHash('sha256').update(value).digest('hex');
@@ -44,7 +45,9 @@ export async function readLocal(root, name, { maxFileBytes = 256 * 1024, signal
   if (rel.startsWith('..' + path.sep) || rel === '..' || path.isAbsolute(rel)) throw new Error('Path escapes repository');
   const opened = await lstat(filename);
   if (opened.isSymbolicLink() || !opened.isFile()) throw new Error(opened.isSymbolicLink() ? 'Symbolic links and junctions are excluded' : 'Not a regular file');
-  const handle = await open(canonical, 'r');
+  // A regular file may become a FIFO after lstat. Do not wait for a writer;
+  // validate the opened descriptor before reading. These flags never write/create.
+  const handle = await open(canonical, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0));
   try {
     const before = await handle.stat();
     if (!before.isFile() || before.dev !== expected.dev || before.ino !== expected.ino || before.dev !== opened.dev || before.ino !== opened.ino) throw new Error('File changed during capture');

package/src/coverage-followup.mjs

@@ -5,7 +5,7 @@ export function coverageFollowup(report) {
   const items = report.files.map(file => {
     if (!file || typeof file.fileId !== 'string' || !file.fileId || ids.has(file.fileId) || typeof file.path !== 'string' || !file.path || paths.has(file.path) || !['completed', 'excluded', 'blocked', 'failed', 'cancelled', 'pending'].includes(file.status)) throw new Error('Invalid coverage file');
     ids.add(file.fileId); paths.add(file.path);
-    const incompleteSynthesis=(file.stageFailures??[]).length>0||file.synthesisStatus==='failed';
+    const incompleteSynthesis=(file.stageFailures??[]).length>0||!!file.synthesisStatus&&file.synthesisStatus!=='completed';
     const incompleteVerification = report.findings.some(f => f.fileId === file.fileId && ['pending', 'incomplete'].includes(f.verification?.status));
     return { fileId: file.fileId, path: file.path, status: file.status, incompleteVerification,incompleteSynthesis,
       followup: file.status !== 'excluded' && (file.status !== 'completed' || incompleteVerification || incompleteSynthesis) };

package/src/coverage-plan.mjs

@@ -21,7 +21,7 @@ export function buildCoveragePlan(input, options) {
     if (file.eligibility !== 'reviewable') return item;
     const prepared = preparePrimaryInput(input, file, options);
     const riskPlanning = options.enableRiskPlanning === true ? options.skipSmallRiskPlans === true ? riskPlanningDecision([file]) : {required:true,reason:'unconditional'} : {required:false,reason:'disabled'};
-    return { ...item, ...prepared.metadata, riskPlanning, status: prepared.budget.fits ? 'ready' : 'input-blocked', minimumCalls: prepared.budget.fits ? ((prepared.batches?.length ?? 1) * (rounds + (riskPlanning.required ? 1 : 0)) + (prepared.synthesis?.budget.fits ? rounds : 0)) : 0 };
+    return { ...item, ...prepared.metadata, riskPlanning, status: prepared.budget.fits ? 'ready' : 'input-blocked', minimumCalls: prepared.budget.fits ? ((prepared.batches?.length ?? 1) * (rounds + (riskPlanning.required ? 1 : 0)) + (prepared.synthesis?.status === 'ready' ? rounds : 0)) : 0 };
   });
   const local = options.enableBusinessGrouping === true ? localBusinessGroups(input.files) : null;
   const groups = [...(options.grouping?.groups ?? [])];

package/src/git-history.mjs

@@ -20,9 +20,17 @@ async function resolveCommit(root, ref, options) {
   return oid;
 }
 
-function parseCommitParents(objectText) {
-  const header = objectText.split('\n\n', 1)[0];
-  const parents = header.split('\n').filter(line => line.startsWith('parent ')).map(line => line.slice(7));
+function parseCommitParents(object) {
+  // Commit messages (and identities) need not be UTF-8. Decode only the header
+  // losslessly; parent object IDs themselves must still be strictly ASCII hex.
+  const end = object.indexOf(Buffer.from('\n\n'));
+  if (end < 0) throw new Error('Invalid commit header');
+  const lines = object.subarray(0, end).toString('latin1').split('\n');
+  if (!/^tree (?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(lines[0]) ||
+      lines.some(line => line.includes('\0') || !/^(?:[a-z][a-z0-9-]* | )/.test(line))) {
+    throw new Error('Invalid commit header');
+  }
+  const parents = lines.filter(line => line.startsWith('parent ')).map(line => line.slice(7));
   if (parents.some(oid => !SHA.test(oid))) throw new Error('Invalid commit parent');
   return parents;
 }
@@ -75,7 +83,7 @@ export async function captureGitHistory(cwd, options = {}) {
   if (commit !== undefined) {
     if (baseRevision !== undefined || targetRevision !== undefined) throw new Error('Commit and range are mutually exclusive');
     target = await resolveCommit(root, commit, options);
-    const object = utf8(await gitAt(root, ['cat-file', 'commit', target], options));
+    const object = await gitAt(root, ['cat-file', 'commit', target], options);
     const parents = parseCommitParents(object);
     if (parents.length > 1) throw new Error('Merge commit requires explicit revision range');
     base = parents[0] ?? null;

package/src/git.mjs

@@ -41,7 +41,20 @@ function parseChanges(bytes) {
 
 /** Keep only the entries the requested comparison actually observes. */
 function changesInScope(changes, scope) {
-  if (scope === 'worktree') return changes;
+  // Porcelain reports a staged deletion and its untracked recreation separately.
+  // Worktree compares HEAD to the current file once, retaining the tracked entry
+  // (and its baseline/selection authority), not a second untracked identity.
+  if (scope === 'worktree') {
+    // A staged rename whose destination was removed compares HEAD's source to
+    // that source's current worktree path, not to the absent index destination.
+    // Its source remains HEAD-authorized even if porcelain calls it untracked.
+    const trackedPaths = new Set(changes.filter(change => change.rawStatus !== '??').map(change => change.path));
+    const net = changes.flatMap(change => change.rawStatus === 'RD' && change.oldPath
+      ? (trackedPaths.has(change.oldPath) ? [] : [{ path: change.oldPath, rawStatus: 'D ' }])
+      : [change]);
+    const tracked = new Set(net.filter(change => change.rawStatus !== '??').map(change => change.path));
+    return net.filter(change => change.rawStatus !== '??' || !tracked.has(change.path));
+  }
   if (scope === 'staged') return changes.filter(change => change.rawStatus[0] !== ' ' && change.rawStatus[0] !== '?');
   return changes.filter(change => change.rawStatus[1] !== ' ' || change.rawStatus === '??');
 }

package/src/primary-input.mjs

@@ -167,8 +167,9 @@ export function preparePrimaryInput(input, file, { instructions, scope, grouping
 
   if (batches?.length > 1) {
     synthesis = prepareWindowSynthesis(batches.map(batch => batch.payload), measure);
-    metadata.synthesisStatus = synthesis.budget.fits ? 'ready' : 'input-blocked';
-    metadata.synthesisInputBytes = synthesis.budget.bytes;
+    metadata.synthesisStatus = synthesis.status === 'ready' ? 'ready' : 'blocked';
+    if (synthesis.reason) metadata.synthesisBlockedReason = synthesis.reason;
+    if (synthesis.budget) metadata.synthesisInputBytes = synthesis.budget.bytes;
   }
 
   const budget = measure(payload);

package/src/process.mjs

@@ -19,6 +19,11 @@ export function run(command, args, { cwd, signal, timeoutMs = 0, maxBytes = 8 *
       failure ??= error;
       if (stopped) return;
       stopped = true;
+      // Descendants may retain these pipes after the direct child exits. On
+      // failure discard owned capture streams, but still join the child via close.
+      // Successful commands keep draining to EOF so no output is lost.
+      child.stdout?.destroy?.();
+      child.stderr?.destroy?.();
       child.kill();
       killer = setTimeout(() => { if (child.exitCode === null && child.signalCode === null) child.kill('SIGKILL'); }, 1000);
       killer.unref?.();

package/src/review-jobs.mjs

@@ -11,17 +11,68 @@ export function createReviewJobs({directory}={}){
  const identity=exec=>{const a=exec?.agent,s=a?.session;if(!s||!a.options?.provider||!a.options?.model||!s.header?.cwd)throw new Error('Review job requires session identity');const id=s.header.id??s.id;if(typeof id!=='string'||!id)throw new Error('Durable session id required');return {sessionId:id,cwd:s.header.cwd,provider:a.options.provider,model:a.options.model,reasoningEffort:a.options.reasoningEffort??null};};
  const same=(a,b)=>JSON.stringify(a)===JSON.stringify(b);
  const pageCheckpoint=(c,offset,limit)=>({...c,...(c.files?{files:c.files.slice(offset,offset+limit),totalFiles:c.files.length}:{}),...(c.findings?{findings:c.findings.slice(offset,offset+limit),totalFindings:c.findings.length}: {})});
- const filename=id=>{if(typeof id!=='string'||!/^[a-f0-9-]{36}$/.test(id))throw new Error('Invalid review job id');return path.join(directory,id+'.json');};
- async function safeDirectory(){await mkdir(directory,{recursive:true,mode:0o700});const stat=await lstat(directory),resolved=await realpath(directory);if(stat.isSymbolicLink()||!stat.isDirectory()||(canonicalDirectory!==undefined&&resolved!==canonicalDirectory))throw new Error('Unsafe report directory');canonicalDirectory??=resolved;}
- async function save(job){await safeDirectory();const tmp=path.join(directory,job.id+'.'+randomUUID()+'.tmp');await writeFile(tmp,JSON.stringify(job.record),{mode:0o600,flag:'wx'});await rename(tmp,filename(job.id));changed(job.id);}
- async function owned(id,exec){const who=identity(exec),job=jobs.get(id);if(job){if(!same(who,job.record.owner))throw new Error('Foreign review job');return job.record;}await safeDirectory();const name=filename(id),stat=await lstat(name);if(stat.isSymbolicLink()||!stat.isFile())throw new Error('Unsafe report file');const r=JSON.parse(await readFile(name,'utf8'));if(!same(who,r.owner))throw new Error('Foreign review job');if(['queued','running'].includes(r.status)){r.status='interrupted';r.notice='Host restarted or plugin disposed. Saved checkpoints are available; resending requires a fresh preview and approval.';}return r;}
+ const filename=id=>{if(typeof id!=='string'||!/^[a-f0-9-]{36}$/.test(id))throw new Error('Invalid review job id');return path.join(canonicalDirectory??directory,id+'.json');};
+ // Resolve existing ancestors before appending a not-yet-created suffix. Lexical
+ // paths alone do not identify a workspace reached through a junction or symlink.
+ async function projectedRealpath(name){
+  let current=path.resolve(name);const suffix=[];
+  for(;;){
+   try{return path.join(await realpath(current),...suffix);}
+   catch(error){
+    if(error.code!=='ENOENT')throw error;
+    // A dangling link is not an ordinary missing directory.
+    try{if((await lstat(current)).isSymbolicLink())throw new Error('Unsafe report directory');}catch(statError){if(statError.code!=='ENOENT')throw statError;}
+    const parent=path.dirname(current);if(parent===current)throw error;
+    suffix.unshift(path.basename(current));current=parent;
+   }
+  }
+ }
+ async function checkDirectory(who){
+  const [workspace,resolved]=await Promise.all([projectedRealpath(who.cwd),projectedRealpath(directory)]);
+  const relative=path.relative(workspace,resolved);
+  if(relative===''||(!relative.startsWith('..'+path.sep)&&relative!=='..'&&!path.isAbsolute(relative)))throw new Error('Report store must be outside reviewed workspace');
+  if(canonicalDirectory!==undefined&&resolved!==canonicalDirectory)throw new Error('Unsafe report directory');
+  return resolved;
+ }
+ async function safeDirectory(who){
+  const expected=await checkDirectory(who); // Do not even create directories inside the workspace.
+  // Use the resolved destination, not a mutable ancestor junction, for creation.
+  await mkdir(expected,{recursive:true,mode:0o700});
+  const stat=await lstat(directory),resolved=await checkDirectory(who);
+  if(stat.isSymbolicLink()||!stat.isDirectory()||resolved!==expected)throw new Error('Unsafe report directory');
+  canonicalDirectory??=resolved;
+ }
+ async function save(job){await safeDirectory(job.record.owner);const tmp=path.join(canonicalDirectory,job.id+'.'+randomUUID()+'.tmp');await writeFile(tmp,JSON.stringify(job.record),{mode:0o600,flag:'wx'});await safeDirectory(job.record.owner);await rename(tmp,filename(job.id));changed(job.id);}
+ async function owned(id,exec){const who=identity(exec),job=jobs.get(id);if(job){if(!same(who,job.record.owner))throw new Error('Foreign review job');return job.record;}await safeDirectory(who);const name=filename(id),stat=await lstat(name);if(stat.isSymbolicLink()||!stat.isFile())throw new Error('Unsafe report file');const r=JSON.parse(await readFile(name,'utf8'));if(!same(who,r.owner))throw new Error('Foreign review job');if(['queued','running'].includes(r.status)){r.status='interrupted';r.notice='Host restarted or plugin disposed. Saved checkpoints are available; resending requires a fresh preview and approval.';}return r;}
  return {
-  async start(exec,work){if(disposed)throw new Error('Review job service disposed');exec.signal?.throwIfAborted();const who=identity(exec);const relative=path.relative(path.resolve(who.cwd),directory);if(relative===''||(!relative.startsWith('..'+path.sep)&&relative!=='..'&&!path.isAbsolute(relative)))throw new Error('Report store must be outside reviewed workspace');if([...jobs.values()].some(j=>j.record.owner.sessionId===who.sessionId&&['queued','running'].includes(j.record.status)))throw new Error('Session review job already active');const id=randomUUID(),controller=new AbortController(),job={id,controller,record:{jobId:id,owner:who,status:'queued',stage:'queued',checkpoints:[],createdAt:new Date().toISOString()},pending:Promise.resolve()};jobs.set(id,job);try{await save(job);}catch(error){jobs.delete(id);throw error;}
-   // Keep the serialization tail usable after failure, but return the original
-   // rejecting operation so checkpoint callers still observe durability failures.
+  async start(exec,work){
+   if(disposed)throw new Error('Review job service disposed');
+   exec.signal?.throwIfAborted();const who=identity(exec);
+   if([...jobs.values()].some(j=>j.record.owner.sessionId===who.sessionId&&['queued','running'].includes(j.record.status)))throw new Error('Session review job already active');
+   const id=randomUUID(),controller=new AbortController(),job={id,controller,record:{jobId:id,owner:who,status:'queued',stage:'queued',checkpoints:[],createdAt:new Date().toISOString()},pending:Promise.resolve()};
+   // Register the entire lifetime before the first await: dispose must also join
+   // startup persistence. The start RPC observes startup errors; done never rejects.
+   const startup=Promise.resolve().then(()=>save(job));
    const enqueue=fn=>{const operation=job.pending.then(fn);job.pending=operation.catch(()=>{});return operation;};
-   // Own cancellation explicitly. The short start RPC ending is NOT task cancellation.
-   job.done=(async()=>{await Promise.resolve();try{job.record.status='running';await enqueue(()=>save(job));const result=await work({signal:controller.signal,checkpoint:async value=>enqueue(async()=>{job.record.stage=value.stage??'reviewing';job.record.checkpoints.push(structuredClone(value));await save(job);})});job.record.result=result;job.record.status=controller.signal.aborted?'cancelled':'completed';}catch(error){job.record.status=controller.signal.aborted?'cancelled':'failed';job.record.error=error?.message??String(error);}finally{job.record.finishedAt=new Date().toISOString();try{await enqueue(()=>save(job));jobs.delete(id);}catch(error){job.record.status='failed';job.record.persistenceError=error?.message??String(error);}finally{changed(id);}}})();return {jobId:id,status:'queued',nextAction:'Call code_review_wait until terminal status; do not finish the user request at start.',notice:'Background job accepted. Poll status; start is not a completed review. Explicit cancel or plugin disposal stops it.'};
+   job.done=startup.then(async()=>{
+    try{
+     controller.signal.throwIfAborted();
+     job.record.status='running';await enqueue(()=>save(job));
+     controller.signal.throwIfAborted();
+     const result=await work({signal:controller.signal,checkpoint:async value=>enqueue(async()=>{job.record.stage=value.stage??'reviewing';job.record.checkpoints.push(structuredClone(value));await save(job);})});
+     job.record.result=result;job.record.status=controller.signal.aborted?'cancelled':'completed';
+    }catch(error){job.record.status=controller.signal.aborted?'cancelled':'failed';job.record.error=error?.message??String(error);}
+    finally{
+     job.record.finishedAt=new Date().toISOString();
+     try{await enqueue(()=>save(job));jobs.delete(id);}
+     catch(error){job.record.status='failed';job.record.persistenceError=error?.message??String(error);}
+     finally{changed(id);}
+    }
+   },()=>{jobs.delete(id);changed(id);});
+   jobs.set(id,job);
+   // Own cancellation explicitly. The short start RPC ending is NOT cancellation.
+   await startup;
+   return {jobId:id,status:'queued',nextAction:'Call code_review_wait until terminal status; do not finish the user request at start.',notice:'Background job accepted. Poll status; start is not a completed review. Explicit cancel or plugin disposal stops it.'};
   },
   async status(id,exec,page){const r=structuredClone(await owned(id,exec));r.recovery=recoveryCoverage(r);r.progress=jobProgress(r);r.waitRevision=r.checkpoints.length;r.nextAction=['queued','running'].includes(r.status)?'Call code_review_wait; do not end the user review request while task runs.':r.result?.previewId?'Show preview and request user confirmation before execute.':'Collect final report and unfinished scope, then provide one final answer.';if(!page)return r;const {offset=0,limit=20,checkpointIndex}=page;if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(limit)||limit<1||limit>100)throw new Error('Invalid result page');if(checkpointIndex!==undefined){if(!Number.isSafeInteger(checkpointIndex)||checkpointIndex<0||checkpointIndex>=r.checkpoints.length)throw new Error('Invalid checkpoint index');return {jobId:r.jobId,status:r.status,checkpointIndex,checkpoint:pageCheckpoint(r.checkpoints[checkpointIndex],offset,limit),page:{offset,limit}};}const result=r.result;const report=result?.report;return {...r,result:undefined,recovery:{...r.recovery,unfinishedStages:r.recovery.unfinishedStages.slice(offset,offset+limit),files:r.recovery.files.slice(offset,offset+limit),windows:r.recovery.windows.slice(offset,offset+limit),suggestedPaths:r.recovery.suggestedPaths.slice(offset,offset+limit),totalObservedFiles:r.recovery.files.length},checkpoints:r.checkpoints.slice(offset,offset+limit).map(c=>pageCheckpoint(c,0,limit)),checkpointPage:{offset,limit,total:r.checkpoints.length},...(result?{resultSummary:report?{status:report.status,coverage:report.coverage,model:report.model,snapshotId:report.snapshotId}:({...result,files:result.files?.slice(offset,offset+limit),filePage:result.files?{offset,limit,total:result.files.length}:undefined}),resultPage:report?{files:report.files?.slice(offset,offset+limit),findings:report.findings?.slice(offset,offset+limit),totalFiles:report.files?.length,totalFindings:report.findings?.length}:undefined}: {})};},
   async wait(id,exec,{after,timeoutMs=25000,signal}={}){const r=await owned(id,exec);if(!Number.isSafeInteger(timeoutMs)||timeoutMs<1||timeoutMs>60000)throw new Error('Invalid wait duration');if(after!==undefined&&(!Number.isSafeInteger(after)||after<0))throw new Error('Invalid wait revision');const revision=r.checkpoints.length;if(!['queued','running'].includes(r.status)||(after!==undefined&&after!==revision))return {changed:true};signal?.throwIfAborted();await new Promise((resolve,reject)=>{let timer;const cleanup=()=>{clearTimeout(timer);signal?.removeEventListener('abort',abort);const waiting=listeners.get(id);waiting?.delete(done);if(waiting?.size===0)listeners.delete(id);};const done=()=>{cleanup();resolve();},abort=()=>{cleanup();reject(signal.reason);};if(!listeners.has(id))listeners.set(id,new Set());listeners.get(id).add(done);signal?.addEventListener('abort',abort,{once:true});timer=setTimeout(done,timeoutMs);const latest=jobs.get(id)?.record;if(!latest||latest.checkpoints.length!==revision||!['queued','running'].includes(latest.status))done();if(signal?.aborted)abort();});return {changed:true};},

package/src/review.mjs

@@ -136,8 +136,8 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
     const { changes, payload } = prepared;
     Object.assign(state, prepared.metadata);
     if (state.contextMode === 'approved-retrieval') report.limitations.push({ fileId: file.id, text: '窗口初始输入仅带上下文身份目录，全文须按需读取；不声明所有上下文已核查。' });
-    if (prepared.synthesis) state.synthesisStatus = prepared.synthesis.budget.fits ? 'pending' : 'blocked';
-    if (prepared.synthesis && !prepared.synthesis.budget.fits) report.limitations.push({ fileId: file.id, text: '跨窗口综合输入超限，未发送；单窗口完成不表示交互影响已检查' });
+    if (prepared.synthesis) state.synthesisStatus = prepared.synthesis.status === 'ready' ? 'pending' : 'blocked';
+    if (prepared.synthesis?.status === 'blocked') report.limitations.push({ fileId: file.id, text: (prepared.synthesis.reason === 'batch-limit' ? '跨窗口综合批次数超过上限（20），未发送；全部主窗口仍独立审查' : '跨窗口综合输入超限，未发送') + '；单窗口完成不表示交互影响已检查' });
     if (state.sourceMode === 'change-windows') state.windowCoverage = { completed: [], pending: [...state.windowIds] };
     if(changes.precision==='envelope')report.limitations.push({fileId:file.id,text:'精确差异不可得，按保守包络分段检查；包络包含可能未变的行，不证明精确编辑或回归因果。'});
     if (changes.status === 'limited') report.limitations.push({ fileId: file.id, text: '精确变更分析受限：' + changes.reason + '；仍按完整两侧内容审查' });
@@ -192,7 +192,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           }
         }
         const batches = [...(prepared.batches ?? [{ payload, windowIds: state.windowIds ?? [] }])];
-        if (prepared.synthesis?.budget.fits) batches.push({ payload: prepared.synthesis.payload, windowIds: [], synthesis: true });
+        if (prepared.synthesis?.status === 'ready') batches.push({ payload: prepared.synthesis.payload, windowIds: [], synthesis: true });
         const matchingInteractionPlans = interactionPlans.filter(p => input.files.filter(f => p.group.fileIds.includes(f.id)).at(-1)?.id === file.id);
         for (const interactionPlan of matchingInteractionPlans.filter(p => p.prepared.status === 'ready')) batches.push({ payload: interactionPlan.prepared.payload, windowIds: [], interaction: interactionPlan.group });
         const scheduled = Array.from({length:rounds},(_,i)=>batches.map(b=>({...b,round:i+1}))).flat();

package/src/snapshot.mjs

@@ -147,7 +147,13 @@ export async function captureSnapshot(cwd, options = {}) {
 
   // Re-capture verifies both selected sides while collecting explicit context.
   if ((await capture(cwd, indexOptions)).id !== snapshot.id) throw new Error('Snapshot changed while collecting context');
-  for (const item of context) if ((await readLocal(snapshot.root, item.path, indexOptions)).hash !== item.hash) throw new Error('Context changed during capture');
+  for (const item of context) {
+    // Overlapping staged context reuses the approved index side, not local bytes.
+    // The same-side re-capture above verifies its content and index identity,
+    // including when the working file differs or no longer exists.
+    if (type === 'git' && snapshot.changeScope === 'staged' && snapshot.files.some(file => file.path === item.path)) continue;
+    if ((await readLocal(snapshot.root, item.path, indexOptions)).hash !== item.hash) throw new Error('Context changed during capture');
+  }
   if (index && (await (type === 'git' ? gitContextIndex : svnContextIndex)(snapshot.root, indexOptions)).fingerprint !== index.fingerprint) throw new Error('Tracked context index changed during capture');
   const verifiedRules = await captureProjectRules(snapshot.root, rulePaths, { signal: options.signal, files: snapshot.files });
   if (JSON.stringify(verifiedRules) !== JSON.stringify(rules)) throw new Error('Rules changed during capture');

package/src/svn-caller-index.mjs

@@ -7,4 +7,11 @@ import {lstat} from 'node:fs/promises';
 import path from 'node:path';
 const canonical=v=>Array.isArray(v)?v.map(canonical):v&&typeof v==='object'?Object.fromEntries(Object.keys(v).sort().map(k=>[k,canonical(v[k])])):v;
 // Offline scoped status only, never svn list or repository-wide enumeration.
-export async function svnCallerIndex(root,scopes,options={}){const approved=validateCallerScopes(scopes),entries=[],chunks=[];let bytes=0;const seen=new Set();for(const scope of approved){const ancestors=await svnCallerAncestors(root,scope,options);chunks.push(ancestors.fingerprint);let cursor=root;for(const part of scope.split('/')){cursor=path.join(cursor,part);const s=await lstat(cursor);if(s.isSymbolicLink()||!s.isDirectory())throw new Error('SVN caller scope requires real directories');}const raw=await checked('svn',['--non-interactive','status','--xml','--verbose','--ignore-externals','--',scope+'@'],{...options,cwd:root,maxBytes:64*1024});bytes+=raw.length;if(bytes>64*1024)throw new Error('SVN caller index byte limit exceeded');const found=(xml(raw).status?.target??[]).flatMap(t=>t.entry??[]);for(const e of found){const name=relativePath(e['@_path'].replaceAll('\\','/'));if(name!==scope&&!name.startsWith(scope+'/'))throw new Error('SVN caller index escaped scope');if(seen.has(name))throw new Error('Duplicate SVN caller index path');seen.add(name);if(seen.size>256)throw new Error('SVN caller index path limit exceeded');entries.push({...e,'@_path':name});}if(!found.some(e=>e['@_path'].replaceAll('\\','/')===scope))throw new Error('SVN caller scope missing from status');chunks.push(scope);}entries.sort((a,b)=>a['@_path']<b['@_path']?-1:1);const unsafe=s=>!s||s['@_item']!=='normal'||!['none','normal'].includes(s['@_props'])||['@_switched','@_copied','@_file-external','@_tree-conflicted'].some(k=>s[k]==='true');for(const scope of approved){const e=entries.find(e=>e['@_path']===scope);if(unsafe(e?.['wc-status']))throw new Error('Unsafe SVN caller directory state');}return {scopes:approved,paths:entries.filter(e=>!approved.includes(e['@_path'])&&!unsafe(e['wc-status'])).map(e=>e['@_path']),entries,records:entries.length,bytes,fingerprint:hash(JSON.stringify(canonical({scopes:chunks,entries})))};}
+// Status XML has no node kind: bind local kinds and omit directories from body candidates.
+// Links and other unsafe non-directory nodes still reach the strict source validator.
+export async function svnCallerIndex(root,scopes,options={}){const approved=validateCallerScopes(scopes),entries=[],chunks=[];let bytes=0;const seen=new Set();for(const scope of approved){const ancestors=await svnCallerAncestors(root,scope,options);chunks.push(ancestors.fingerprint);let cursor=root;for(const part of scope.split('/')){cursor=path.join(cursor,part);const s=await lstat(cursor);if(s.isSymbolicLink()||!s.isDirectory())throw new Error('SVN caller scope requires real directories');}
+ const raw=await checked('svn',['--non-interactive','status','--xml','--verbose','--ignore-externals','--',scope+'@'],{...options,cwd:root,maxBytes:64*1024});bytes+=raw.length;if(bytes>64*1024)throw new Error('SVN caller index byte limit exceeded');const found=(xml(raw).status?.target??[]).flatMap(t=>t.entry??[]);
+ for(const e of found){const name=relativePath(e['@_path'].replaceAll('\\','/'));if(name!==scope&&!name.startsWith(scope+'/'))throw new Error('SVN caller index escaped scope');if(seen.has(name))throw new Error('Duplicate SVN caller index path');seen.add(name);if(seen.size>256)throw new Error('SVN caller index path limit exceeded');entries.push({...e,'@_path':name});}if(!found.some(e=>e['@_path'].replaceAll('\\','/')===scope))throw new Error('SVN caller scope missing from status');chunks.push(scope);}
+ entries.sort((a,b)=>a['@_path']<b['@_path']?-1:1);const unsafe=s=>!s||s['@_item']!=='normal'||!['none','normal'].includes(s['@_props'])||['@_switched','@_copied','@_file-external','@_tree-conflicted'].some(k=>s[k]==='true');for(const scope of approved){const e=entries.find(e=>e['@_path']===scope);if(unsafe(e?.['wc-status']))throw new Error('Unsafe SVN caller directory state');}
+ const nodes=[];for(const e of entries.filter(e=>!approved.includes(e['@_path'])&&!unsafe(e['wc-status']))){options.signal?.throwIfAborted();const stat=await lstat(path.join(root,e['@_path']));nodes.push({path:e['@_path'],kind:stat.isDirectory()?'dir':stat.isSymbolicLink()?'link':stat.isFile()?'file':'other'});}
+ return {scopes:approved,paths:nodes.filter(n=>n.kind!=='dir').map(n=>n.path),entries,records:entries.length,bytes,fingerprint:hash(JSON.stringify(canonical({scopes:chunks,entries,nodes})))};}

package/src/svn-explicit-context.mjs

@@ -20,6 +20,18 @@ export async function captureSvnExplicitContext(root,names,options={}){
   }
   context.push({path:name,...content,...(keywordMapping?{keywordMapping}:{}),...(node.eolStyle?{eolMapping:svnEolMapping(content.text,node.eolStyle)}:{})});identities.push({path:name,fingerprint:node.fingerprint,revision:node.revision});
  }
- const verify=async()=>{for(const node of identities)if((await svnCallerNode(root,node.path,bounded)).fingerprint!==node.fingerprint)throw new Error('SVN explicit context identity changed during capture');signal.throwIfAborted();};
+ // SVN metadata can remain identical while raw keyword values change: status
+ // compares contracted text, but the original expanded body is our evidence.
+ let verifiedBytes=bytes; // sourceBytes below remains the initial capture cost.
+ const verify=async()=>{
+  for(let i=0;i<identities.length;i++){
+   const node=identities[i];
+   if((await svnCallerNode(root,node.path,bounded)).fingerprint!==node.fingerprint)throw new Error('SVN explicit context identity changed during capture');
+   const current=await readLocal(root,node.path,bounded);bounded.svnNavigationBudget?.charge(current.bytes);verifiedBytes+=current.bytes;
+   if(verifiedBytes>1024*1024)throw new Error('SVN explicit context source byte limit exceeded');
+   if(current.hash!==context[i].hash)throw new Error('SVN explicit context content changed during capture');
+  }
+  signal.throwIfAborted();
+ };
  return {context,verify,options:bounded,sourceBytes:bytes,identities};
 }

package/src/svn-keyword-mapping.mjs

@@ -1,7 +1,12 @@
 import { hash } from './content.mjs';
 import { keywordConfigurationTokens } from './svn-keyword-config.mjs';
 
-const STANDARD = new Set(['Date', 'LastChangedDate', 'Revision', 'Rev', 'LastChangedRevision', 'Author', 'LastChangedBy', 'HeadURL', 'URL', 'Id', 'Header']);
+// Each standard property spelling enables its complete native SVN alias group.
+const STANDARD_GROUPS = [
+  ['Date', 'LastChangedDate'], ['Revision', 'Rev', 'LastChangedRevision'],
+  ['Author', 'LastChangedBy'], ['HeadURL', 'URL'], ['Id'], ['Header'],
+];
+const STANDARD = new Map(STANDARD_GROUPS.flatMap(group => group.map(name => [name, group])));
 const CUSTOM_DEFINITION = /^([A-Za-z][A-Za-z0-9]*)=(.+)$/;
 const ALLOWED_FORMAT_FLAGS = 'radDuRPb_HI%';
 const ALLOWED_LITERAL = /[A-Za-z0-9_.:/ ()-]/;
@@ -23,11 +28,12 @@ function parseCustomFormat(format) {
 // never reimplemented here; raw source remains the only evidence.
 export function svnKeywordConfiguration(configuration) {
   if (typeof configuration !== 'string' || Buffer.byteLength(configuration) > 4096) throw new Error('Invalid SVN keyword configuration');
-  const enabled = new Set(), custom = [];
+  const enabled = new Set(), configured = new Set(), custom = [];
   for (const token of keywordConfigurationTokens(configuration)) {
     if (STANDARD.has(token)) {
-      if (enabled.has(token)) throw new Error('Duplicate SVN keyword configuration');
-      enabled.add(token);
+      if (configured.has(token)) throw new Error('Duplicate SVN keyword configuration');
+      configured.add(token);
+      for (const alias of STANDARD.get(token)) enabled.add(alias);
       continue;
     }
     const match = CUSTOM_DEFINITION.exec(token);
@@ -47,11 +53,11 @@ export function svnKeywordMapping(text, configuration) {
     if (!enabled.has(name)) return literal;
     if (separator === '::') {
       // SVN reserves the complete field width, including the initial space and
-      // final space (or # truncation marker); shrink values without changing width.
+      // final space (or # truncation marker); retain UTF-8 byte width, not UTF-16 length.
       if (value.length < 2 || value[0] !== ' ' || ![' ', '#'].includes(value.at(-1))) throw new Error('Ambiguous SVN fixed-width keyword expansion');
       fixedWidth++;
       if (/[^ ]/.test(value)) replacements++;
-      return '$' + name + '::' + ' '.repeat(value.length) + '$';
+      return '$' + name + '::' + ' '.repeat(Buffer.byteLength(value, 'utf8')) + '$';
     }
     if (!/^ .+ $/.test(value)) throw new Error('Ambiguous SVN keyword expansion');
     replacements++;

package/src/svn-replacement-tree.mjs

@@ -6,11 +6,19 @@ import {readReplacementSource} from './svn-replacement-source.mjs';
 import {svnWorkingIdentity} from './svn-working-identity.mjs';
 import {hash,decode,relativePath,readLocal} from './content.mjs';
 import {isSecretPath} from './secret-path.mjs';
+import {canonicalSvnUrl} from './svn-url.mjs';
 import {svnKeywordMapping} from './svn-keyword-mapping.mjs';
 import {svnEolMapping} from './svn-eol-mapping.mjs';
 import {svnSpecialData} from './svn-special.mjs';
 import {readWorkingSvnSpecial} from './svn-working-special.mjs';
 
+// Copy provenance is not permission to capture credential bytes at a safe target name.
+function assertCopySource(source,suffix=''){
+ if(source===null||source===undefined)return;
+ const url=canonicalSvnUrl(source),name=decodeURIComponent(new URL(url).pathname);
+ if(isSecretPath(name)||isSecretPath(name+(suffix?'/'+suffix:'')))throw new Error('Credential replacement copy source excluded');
+}
+
 // Fixed repository tree versus explicitly selected working replacement tree.
 // Every descendant is a separate source/coverage unit, never an implicit approval.
 export async function captureReplacementTree(root,rootInfo,name,options={}){
@@ -26,13 +34,14 @@ export async function captureReplacementTree(root,rootInfo,name,options={}){
  const ancestors=async p=>{
   const parts=p.split('/').slice(0,-1),names=['.',...parts.map((_,i)=>parts.slice(0,i+1).join('/'))],records=[];
   for(const name of names){
-   if(!verifying&&ancestorReceipts.has(name)){records.push(ancestorReceipts.get(name));continue;}
+   if(!verifying&&ancestorReceipts.has(name)){const record=ancestorReceipts.get(name);assertCopySource(record.copyFromUrl,name==='.'?p:p.slice(name.length+1));records.push(record);continue;}
    const stat=await lstat(name==='.'?root:path.join(root,name));if(stat.isSymbolicLink()||!stat.isDirectory())throw new Error('Replacement ancestor is not a real directory');
    const node=xml(await run(['info','--xml','--',name+'@'])).info?.entry?.[0],identity=svnWorkingIdentity(node,rootInfo,name);
    const entries=xml(await run(['status','--xml','--verbose','--ignore-externals','--depth','empty','--',name+'@'])).status?.target?.flatMap(t=>t.entry??[])??[],s=entries[0]?.['wc-status'];
    if(entries.length!==1||!s||!['normal','modified','added','replaced'].includes(s['@_item'])||s['@_props']==='conflicted'||['@_switched','@_file-external','@_tree-conflicted'].some(k=>s[k]==='true'))throw new Error('Unsafe replacement ancestor state');
+   assertCopySource(identity.source.copyFromUrl,name==='.'?p:p.slice(name.length+1));
    const properties=await props(name);if(Object.hasOwn(properties,'svn:externals')||Object.hasOwn(properties,'svn:special'))throw new Error('Unsafe replacement ancestor properties');
-   const record={path:name,fingerprint:hash(JSON.stringify([identity.fingerprint,properties]))};
+   const record={path:name,copyFromUrl:identity.source.copyFromUrl,fingerprint:hash(JSON.stringify([identity.fingerprint,properties]))};
    if(verifying){if(ancestorReceipts.get(name)?.fingerprint!==record.fingerprint)throw new Error('Replacement ancestor changed during capture');}else ancestorReceipts.set(name,record);records.push(record);
   }return records;
  };
@@ -40,6 +49,7 @@ export async function captureReplacementTree(root,rootInfo,name,options={}){
   if(['@_switched','@_file-external','@_tree-conflicted'].some(k=>s[k]==='true')||!['normal','modified','added','replaced'].includes(s['@_item'])||s['@_props']==='conflicted')throw new Error('Unsafe replacement descendant state');
   const ancestorEvidence=await ancestors(p);
   const node=xml(await run(['info','--xml','--',p+'@'])).info?.entry?.[0],identity=svnWorkingIdentity(node,rootInfo,p);if(!['file','dir'].includes(node['@_kind']))throw new Error('Unsupported replacement descendant kind');
+  assertCopySource(identity.source.copyFromUrl);
   if(node['@_kind']==='dir'&&identity.source.depth!=='infinity')throw new Error('Sparse replacement target cannot prove descendant inventory');
   const properties=await props(p);if(Object.hasOwn(properties,'svn:externals'))throw new Error('Replacement externals require independent scope');
   const content=node['@_kind']==='dir'?decode(Buffer.alloc(0)):Object.hasOwn(properties,'svn:special')?(await readWorkingSvnSpecial(root,p,properties,options)).content:await readLocal(root,p,options);

package/src/synthesis-evidence.mjs

@@ -1,15 +1,31 @@
 // Audit only successful reads from this synthesis generation, never prior batches/searches.
 export function validateSynthesisReads(findings, changes, reads, catalog, fileId, snapshotId) {
  const sources = new Map(catalog.map(s => [s.id, s]));
+ const intervals = new Map();
+ for (const read of reads) {
+  const source = sources.get(read.sourceId);
+  if (read.kind !== 'read' || read.snapshotId !== snapshotId || source?.fileId !== fileId || !['old', 'new'].includes(source.side)) continue;
+  if (!Number.isSafeInteger(read.start) || read.start < 1 || !Number.isSafeInteger(read.count) || read.count < 1 || !Number.isSafeInteger(read.start + read.count)) continue;
+  const ranges = intervals.get(read.sourceId) ?? [];
+  ranges.push({ start: read.start, end: read.start + read.count });
+  intervals.set(read.sourceId, ranges);
+ }
+ // Never join different source identities, even when their file and side match.
+ for (const [id, ranges] of intervals) {
+  const merged = [];
+  for (const range of ranges.sort((a, b) => a.start - b.start)) {
+   const last = merged.at(-1);
+   if (last && range.start <= last.end) last.end = Math.max(last.end, range.end);
+   else merged.push({ ...range });
+  }
+  intervals.set(id, merged);
+ }
  for (const finding of findings) {
   for (const id of finding.attribution.editIds) {
    const edit = changes.edits.find(e => e.id === id);
    const covered = ['old', 'new'].some(side => {
     const range = edit?.[side];
-    return range?.count > 0 && reads.some(r => {
-     const source = sources.get(r.sourceId);
-     return r.kind === 'read' && r.snapshotId === snapshotId && source?.fileId === fileId && source.side === side && r.start <= range.start && r.start + r.count >= range.start + range.count;
-    });
+    return range?.count > 0 && [...intervals].some(([sourceId, ranges]) => sources.get(sourceId).side === side && ranges.some(r => r.start <= range.start && r.end >= range.start + range.count));
    });
    if (!covered) throw new Error('Synthesis referenced edit was not read in this generation');
   }

package/src/tracked-context.mjs

@@ -16,7 +16,10 @@ export async function gitContextIndex(root, options = {}) {
  let bytes;
  if(options.probePaths !== undefined){
   if(!Array.isArray(options.probePaths)||options.probePaths.length>512||new Set(options.probePaths).size!==options.probePaths.length)throw new Error('Invalid Git context probes');
-  const chunks=[];let totalBytes=0;for(const name of [...options.probePaths].sort()){relativePath(name);const chunk=await checked('git',['--no-optional-locks','--literal-pathspecs','-c','core.fsmonitor=false','-c','core.untrackedCache=false','ls-files','--stage','-z','--',name],{...options,cwd:root,maxBytes:64*1024});const records=new TextDecoder('utf-8',{fatal:true}).decode(chunk).split('\0').filter(Boolean);for(const record of records)if(record.slice(record.indexOf('\t')+1)!==name)throw new Error('Git context probe expanded beyond literal path');totalBytes+=chunk.length;if(totalBytes>1024*1024)throw new Error('Tracked context index limit exceeded');chunks.push(chunk);}
+  // A literal pathspec alone still recursively matches a directory. Exclude
+  // its literal trailing-slash subtree before output, so directory probes are
+  // exact misses without enumerating or authorizing unrequested descendants.
+  const chunks=[];let totalBytes=0;for(const name of [...options.probePaths].sort()){relativePath(name);const chunk=await checked('git',['--no-optional-locks','-c','core.fsmonitor=false','-c','core.untrackedCache=false','ls-files','--stage','-z','--',':(top,literal)'+name,':(top,literal,exclude)'+name+'/'],{...options,cwd:root,maxBytes:64*1024});const records=new TextDecoder('utf-8',{fatal:true}).decode(chunk).split('\0').filter(Boolean);for(const record of records)if(record.slice(record.indexOf('\t')+1)!==name)throw new Error('Git context probe expanded beyond literal path');totalBytes+=chunk.length;if(totalBytes>1024*1024)throw new Error('Tracked context index limit exceeded');chunks.push(chunk);}
   bytes=Buffer.concat(chunks);if(bytes.length>1024*1024)throw new Error('Tracked context index limit exceeded');
  }else bytes = await checked('git', ['--no-optional-locks','-c','core.fsmonitor=false','-c','core.untrackedCache=false','ls-files','--stage','-z'], {...options,cwd:root,maxBytes:1024*1024});
  const records = new TextDecoder('utf-8',{fatal:true}).decode(bytes).split('\0').filter(Boolean);

package/src/window-synthesis.mjs

@@ -1,6 +1,8 @@
 // Pure approved-data preparation, no reads or sends. No source text is silently clipped.
 export function prepareWindowSynthesis(batchPayloads, measure) {
-  if (!Array.isArray(batchPayloads) || batchPayloads.length < 2 || batchPayloads.length > 20) throw new Error('Invalid synthesis batches');
+  if (!Array.isArray(batchPayloads) || batchPayloads.length < 2) throw new Error('Invalid synthesis batches');
+  // A synthesis scheduling limit must not discard any independently reviewable batch.
+  if (batchPayloads.length > 20) return { status: 'blocked', reason: 'batch-limit', batchCount: batchPayloads.length };
   const batches = batchPayloads.map(payload => JSON.parse(payload));
   const base = batches[0];
   const windows = batches.flatMap(batch => batch.windows);
@@ -8,5 +10,5 @@ export function prepareWindowSynthesis(batchPayloads, measure) {
   const windowIndex = windows.map(w => ({ id: w.id, editIds: w.editIds, old: { start: w.old.start, count: w.old.count }, new: { start: w.new.start, count: w.new.count } }));
   const payload = JSON.stringify({ ...base, windows: undefined, windowIndex, sourceMode: 'window-synthesis', windowNotice: '本请求综合检查所有窗口的共同影响，不重报单窗口问题；windowIndex仅为原始定位目录，不含源码，必须在批准catalog中读取相关旧新片段，不能仅凭目录认定缺陷。输出仍仅主file的发现，归因至少关联两个不同窗口的编辑；证据不足明确限制。' });
   const budget = measure(payload);
-  return { payload, windows, windowIds: windows.map(w => w.id), budget };
+  return { status: budget.fits ? 'ready' : 'blocked', ...(budget.fits ? {} : { reason: 'input-budget' }), payload, windows, windowIds: windows.map(w => w.id), budget };
 }