@feng0531/dsh-code-review 0.85.5 → 0.85.7

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.85.7 — 大仓库项目选择预览修复
+
+- Git 项目模式显式选择文件时只查询所选精确索引，不再因未选文件导致全仓索引输出或节点数超限；空选择不枚举索引，目录及通配符不展开。
+- 初次捕获、执行前及末尾复核使用同一局部范围，保留所选索引/正文变动拒绝、冲突及链接限制；未选索引变化不再使局部快照失效。
+- 局部预览与报告明确显示清单不完整、全仓总数未知及所选清单数，不冒充全项目覆盖。未指定选择和 SVN 清单上限保持不变。
+- 这是当前源码项目预览修复，不新增历史重命名配对，也不将项目审核当作重构前后功能等价证明。
+
+## 0.85.6 — 快照正确性、任务隔离与取消修复
+
+- Git 工作区撤销暂存重命名后按 HEAD 到当前原路径的净内容比较，不再误报不存在的删除；历史提交允许非 UTF-8 消息，父对象标识仍严格验证。
+- 实例方法绑定保留与 Object 原型同名的合法方法，并拒绝同一构造行附加语句或可执行参数造成的错误唯一性。
+- 后台任务卸载等待启动持久化到终态的完整生命周期，取消后不再启动审核；报告目录按真实路径隔离，拒绝祖先 junction／符号链接别名绕过。
+- SVN 标准关键字按原生别名组收缩，固定字段保持 UTF-8 字节宽度；显式上下文末尾同时复核元数据与原始正文哈希，并累计来源预算。
+- 本地文件以只读非阻塞方式打开后验证句柄类型，避免 Linux FIFO 替换挂起；进程取消时关闭自身输出管道并等待直接子进程结束，正常输出仍完整读取，不承诺终止全部后代。
+- 注册表元数据及安装包正文网络中断使用有界重试，格式、地址、超限与完整性失败仍立即拒绝；测试临时 SVN 工作副本及时清理。
+
 ## 0.85.5 — 凭据来源保护与审核边界修复
 
 - SVN 独立替换树在读取正文前检查复制来源及祖先来源，阻断从凭据路径复制到普通目标的内容；调用方扫描不再把带源码扩展名的目录当作文件读取。

package/DEVELOPMENT.md

@@ -16,7 +16,7 @@
 
 服务按DSH session对象隔离缓存和锁，同一会话changes/project两种模式共用互斥锁；不同会话可并行，模型调用与取消由各请求生命周期约束。Git工作区默认比较HEAD到工作区；changeScope=staged/unstaged分别只比较HEAD→index和index→工作区，执行前复核对应内容。宿主dispose终止全部会话服务。全项目是跟踪文件的当前源码分批，不是多仓库汇总或跨批次语义分析。
 
-项目捕获最多10000清单节点、1000选择节点、16MiB，不设默认总模型调用次数或执行秒表，初次捕获/复核均遵循宿主与用户取消。SVN项目模式拒绝不支持节点属性，不隐式继承固定历史审查的网络权限。
+项目捕获完整清单最多 10000 节点、1000 选择节点、16 MiB。Git 显式选择以精确字面路径查询所选索引，单次查询最多 64 KiB、总计 2 MiB，不受未选索引数量影响；初次、执行前及末尾复核使用相同范围。局部清单不宣称全仓完整性或总数，只绑定所选索引和正文，未选索引变动不使其失效。公开工具的显式列表仍最多 200 项。不设默认总模型调用次数或执行秒表，初次捕获/复核均遵循宿主与用户取消。SVN 仍枚举本地完整已观察清单，项目模式拒绝不支持节点属性，不隐式继承固定历史审查的网络权限。
 
 ## 全项目并发与离线速度对照
 

package/README.md

@@ -254,11 +254,11 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 
 项目模式只接受reviewMode、repositoryPath和可选selectedPaths，不与历史revision、autoContext、规则或调用方参数混用。默认全部跟踪节点；不读取未跟踪/忽略文件、子模块、外部仓库及链接目标。目录只作清单记录，源码按批次审查；跨批次不宣称完整调用图或全程序语义分析。
 
-清单上限10000节点，单次选择最多1000节点/16MiB，12节点一批，单文件256KiB；超限明确拒绝，缩小选择后必须重新预览。单次采集共享8MiB元数据内存保护，不按命令条数、插件秒表或模型调用次数中断；耗时受宿主/模型提供方限制，用户可随时取消。SVN为本地已观察清单，稀疏/外部/链接及不支持属性显示限制；不证明仓库远端完整覆盖。
+未指定选择时，清单上限 10000 节点，Git 索引输出上限 2 MiB。Git 显式 `selectedPaths` 只查询所选精确文件，不先枚举全仓，因此大仓库可用小范围预览；空数组不枚举索引，目录与通配符不会展开。此时 `inventoryScope:"selected"`、`inventoryComplete:false`、`selectionComplete:false`，`totalTrackedNodes:null` 表示全仓总数未知，`inventoryNodes` 仅为所选清单数；只绑定所选索引及正文，未选文件的变化不使该局部快照失效。单次选择运行时最多 1000 节点（公开工具参数显式列表最多 200 项）/16 MiB，12 节点一批，单文件 256 KiB；超限必须重新预览。SVN 仍枚举本地已观察清单，显式选择不绕过清单上限，稀疏/外部/链接及不支持属性显示限制，不证明远端完整覆盖。SVN 单次采集共享 8 MiB 元数据保护；Git 所选索引单次查询最多 64 KiB、合计 2 MiB。不按命令条数、插件秒表或模型调用次数中断；耗时受宿主/模型提供方限制，用户可随时取消。
 
 全项目审查默认最多 **8 个独立批次并行**，每批内主审、检索、复核仍按依赖顺序执行；预览和报告的 `execution.batchConcurrency` 显示实际配置。插件配置 `projectConcurrency` 可设为 1～8，设 1 回退串行；遇到模型提供方并发限制或 429，应降低并发。该设置不是 preview 参数，不扩大来源或共享模型调用预算，也不减少模型调用量或承诺 token 成本下降。仅一个批次时不会获得批间加速；实际提速受提供方吞吐、批次均衡及检查点写入影响。
 
-对外只交付一份统一最终报告，给出总数、completed、excluded、blocked、pending、去重后的发现及未完成综合阶段；内部批次快照仅供证据追溯，不需要用户拼接报告。completed只表示所选捕获文件已处理，不代表代码正确；排除与阻断从不算完成。代码或清单变化会拒绝旧预览，运行后无法复核则标记outdated。
+对外只交付一份统一最终报告，给出总数、completed、excluded、blocked、pending、去重后的发现及未完成综合阶段；内部批次快照仅供证据追溯，不需要用户拼接报告。completed只表示所选捕获文件已处理，不代表代码正确；排除与阻断从不算完成。所绑定的代码或清单变化会拒绝旧预览，运行后无法复核则标记outdated。
 
 ## 工具调用流程（给需要精确指定参数的人）
 

package/RELEASE-NOTES.md

@@ -1,21 +1,15 @@
-# v0.85.5 发布说明
+# v0.85.7 发布说明
 
 使用方式见 [README](README.md)，详细变化见 [变更记录](CHANGELOG.md)，发布门禁见 [开发说明](DEVELOPMENT.md)。
 
-## 安全修复
+## 大仓库也能按文件预览
 
-SVN 独立替换树现在在读取正文前检查复制来源及复制祖先来源，阻断把凭据文件复制到普通目标后绕过来源过滤的路径。限定调用方扫描也会区分目录与普通文件，带 `.js` 等源码扩展名的目录不再令预览整体失败。
-
-## 审核正确性与可用性
-
-- Git 默认工作区审核合并暂存删除后重建的同路径记录，保持文件身份唯一。
-- 自动上下文的目录索引导入不再被误判为越界；仍只读取精确选中的候选正文，不授权目录下任意文件。
-- 已选暂存变更同时作为显式上下文时，复用 index 内容并按同侧版本验证，不把尚未暂存的正文混入变更侧。
-- 长编辑分次读取后，综合校验按同一快照、来源及版本侧计算连续覆盖；跨来源、有缺口或错误版本的读取仍不能作为有效证据。
-- 文件分成超过 20 个窗口批次时，主窗口继续审核并保留已有成果；综合受限单独披露，整体仍为部分完成，不再以异常丢失整轮报告。
+- 修复 Git 项目模式只选少量文件，仍因全仓索引超过 2 MiB 或 10000 节点而预览失败的问题。显式 `selectedPaths` 现在只查询所选精确索引；空选择不枚举索引，目录和通配符不展开。
+- 初次捕获、执行前及末尾复核保持相同选择范围；所选索引或正文变化仍使快照失效，冲突、链接、子模块及凭据路径保护不放宽。未选索引变化不影响局部快照。
+- 预览、批次和报告标明局部清单范围；全仓总数为未知值，不把所选数量或局部完成当成全仓覆盖。
 
 ## 验证与边界
 
-本版为六项已复现问题添加回归测试，并执行完整本地测试及隔离安装验证；正式发布须通过同一冻结标签提交的 Ubuntu/Windows × Node.js 22/24 四组 CI、安装包验证和 npm 实际工件一致性门禁。具体执行结果以该标签 CI 和发布工作流为准。
+新增 15 项大索引、精确路径、空选择、失效快照和范围披露回归。本地 Windows 完整测试 765 项：761 通过、4 项平台限定跳过、0 失败；隔离安装入口及本地化导出验证通过。正式发布须通过冻结标签同一提交的 Ubuntu/Windows × Node.js 22/24 四组 CI、隔离安装以及原始包、npm 与 GitHub Release 工件一致性门禁；最终结果以对应 CI 和发布工作流为准。
 
-本版本不保证模型始终输出合法 JSON，不扩大源码读取权限，不自动安装、升级或重启 DSH；更新并重新加载插件后生效。
+未指定选择的完整索引捕获及 SVN 项目清单仍保留原上限；历史变更范围仍最多 200 个变更路径。本版不新增跨路径旧／新实现配对，不将当前源码项目审核替代重构前后功能对照，也不以空发现证明功能等价。发布不自动安装、升级或重启 DSH；更新并重新加载插件后生效。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.85.5",
+  "version": "0.85.7",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/class-bindings.mjs

@@ -4,6 +4,13 @@
 const BS = String.fromCharCode(96);
 const NL = String.fromCharCode(10);
 
+// Only a whole declaration with inert primitive arguments is proven here. In
+// particular, never exempt a constructor-line suffix or executable argument
+// from the class/instance mutation checks below. Strings are matched as tokens,
+// not stripped as comments (a quoted `);` must not end the declaration).
+const primitiveArgument = /(?:null|true|false|-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?|"(?:[^"\\\r\n]|\\[^\r\n])*"|'(?:[^'\\\r\n]|\\[^\r\n])*')/.source;
+const constructionDeclaration = new RegExp('^\\s*(?:const|let|var)\\s+([A-Za-z_$][A-Za-z0-9_$]*)\\s*=\\s*new\\s+([A-Za-z_$][A-Za-z0-9_$]*)\\s*\\(\\s*(?:' + primitiveArgument + '(?:\\s*,\\s*' + primitiveArgument + ')*\\s*,?)?\\s*\\)\\s*;?\\s*$');
+
 const escapeDollar = name => name.replaceAll('$', '\\$');
 function boundaryPattern(name, suffix, flags = '') {
   return new RegExp('(^|[^A-Za-z0-9_$])' + escapeDollar(name) + suffix, flags);
@@ -94,11 +101,11 @@ export function instanceMethodBindings(lines, importLine, targetText) {
   const body = classBody(targets, classLine);
   if (!body) return [];
   const decls = directMethods(body);
-  const names = {};
-  for (const d of decls) names[d.name] = (names[d.name] ?? 0) + 1;
+  const names = new Map();
+  for (const d of decls) names.set(d.name, (names.get(d.name) ?? 0) + 1);
   const result = [];
   for (const d of decls) {
-    if (names[d.name] !== 1) continue;
+    if (names.get(d.name) !== 1) continue;
     if (d.name === 'constructor') continue;
     const member = d.name;
     const token = boundaryPattern(member, '(?=[^A-Za-z0-9_$]|$)', 'g');
@@ -115,7 +122,7 @@ export function instanceMethodBindings(lines, importLine, targetText) {
     if (/[=,:.*#\[\]()]|\b(?:new|function|return|yield|case|throw|typeof|void|delete|instanceof)\b/.test(seg)) continue;
     let assign = null, inst = null;
     for (let i = 0; i < lines.length; i++) {
-      const a = /^\s*(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*new\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/.exec(lines[i]);
+      const a = constructionDeclaration.exec(lines[i]);
       if (a && a[2] === local) { if (assign !== null) return []; assign = i + 1; inst = a[1]; }
     }
     if (assign === null || inst === member || inst === klass || inst === local) continue;

package/src/content.mjs

@@ -1,6 +1,7 @@
 import { assertNonSecretPath } from './secret-path.mjs';
 import path from 'node:path';
 import { lstat, realpath, open } from 'node:fs/promises';
+import { constants } from 'node:fs';
 import { createHash } from 'node:crypto';
 
 export const hash = value => createHash('sha256').update(value).digest('hex');
@@ -44,7 +45,9 @@ export async function readLocal(root, name, { maxFileBytes = 256 * 1024, signal
   if (rel.startsWith('..' + path.sep) || rel === '..' || path.isAbsolute(rel)) throw new Error('Path escapes repository');
   const opened = await lstat(filename);
   if (opened.isSymbolicLink() || !opened.isFile()) throw new Error(opened.isSymbolicLink() ? 'Symbolic links and junctions are excluded' : 'Not a regular file');
-  const handle = await open(canonical, 'r');
+  // A regular file may become a FIFO after lstat. Do not wait for a writer;
+  // validate the opened descriptor before reading. These flags never write/create.
+  const handle = await open(canonical, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0));
   try {
     const before = await handle.stat();
     if (!before.isFile() || before.dev !== expected.dev || before.ino !== expected.ino || before.dev !== opened.dev || before.ino !== opened.ino) throw new Error('File changed during capture');

package/src/git-history.mjs

@@ -20,9 +20,17 @@ async function resolveCommit(root, ref, options) {
   return oid;
 }
 
-function parseCommitParents(objectText) {
-  const header = objectText.split('\n\n', 1)[0];
-  const parents = header.split('\n').filter(line => line.startsWith('parent ')).map(line => line.slice(7));
+function parseCommitParents(object) {
+  // Commit messages (and identities) need not be UTF-8. Decode only the header
+  // losslessly; parent object IDs themselves must still be strictly ASCII hex.
+  const end = object.indexOf(Buffer.from('\n\n'));
+  if (end < 0) throw new Error('Invalid commit header');
+  const lines = object.subarray(0, end).toString('latin1').split('\n');
+  if (!/^tree (?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(lines[0]) ||
+      lines.some(line => line.includes('\0') || !/^(?:[a-z][a-z0-9-]* | )/.test(line))) {
+    throw new Error('Invalid commit header');
+  }
+  const parents = lines.filter(line => line.startsWith('parent ')).map(line => line.slice(7));
   if (parents.some(oid => !SHA.test(oid))) throw new Error('Invalid commit parent');
   return parents;
 }
@@ -75,7 +83,7 @@ export async function captureGitHistory(cwd, options = {}) {
   if (commit !== undefined) {
     if (baseRevision !== undefined || targetRevision !== undefined) throw new Error('Commit and range are mutually exclusive');
     target = await resolveCommit(root, commit, options);
-    const object = utf8(await gitAt(root, ['cat-file', 'commit', target], options));
+    const object = await gitAt(root, ['cat-file', 'commit', target], options);
     const parents = parseCommitParents(object);
     if (parents.length > 1) throw new Error('Merge commit requires explicit revision range');
     base = parents[0] ?? null;

package/src/git.mjs

@@ -45,8 +45,15 @@ function changesInScope(changes, scope) {
   // Worktree compares HEAD to the current file once, retaining the tracked entry
   // (and its baseline/selection authority), not a second untracked identity.
   if (scope === 'worktree') {
-    const tracked = new Set(changes.filter(change => change.rawStatus !== '??').map(change => change.path));
-    return changes.filter(change => change.rawStatus !== '??' || !tracked.has(change.path));
+    // A staged rename whose destination was removed compares HEAD's source to
+    // that source's current worktree path, not to the absent index destination.
+    // Its source remains HEAD-authorized even if porcelain calls it untracked.
+    const trackedPaths = new Set(changes.filter(change => change.rawStatus !== '??').map(change => change.path));
+    const net = changes.flatMap(change => change.rawStatus === 'RD' && change.oldPath
+      ? (trackedPaths.has(change.oldPath) ? [] : [{ path: change.oldPath, rawStatus: 'D ' }])
+      : [change]);
+    const tracked = new Set(net.filter(change => change.rawStatus !== '??').map(change => change.path));
+    return net.filter(change => change.rawStatus !== '??' || !tracked.has(change.path));
   }
   if (scope === 'staged') return changes.filter(change => change.rawStatus[0] !== ' ' && change.rawStatus[0] !== '?');
   return changes.filter(change => change.rawStatus[1] !== ' ' || change.rawStatus === '??');

package/src/process.mjs

@@ -19,6 +19,11 @@ export function run(command, args, { cwd, signal, timeoutMs = 0, maxBytes = 8 *
       failure ??= error;
       if (stopped) return;
       stopped = true;
+      // Descendants may retain these pipes after the direct child exits. On
+      // failure discard owned capture streams, but still join the child via close.
+      // Successful commands keep draining to EOF so no output is lost.
+      child.stdout?.destroy?.();
+      child.stderr?.destroy?.();
       child.kill();
       killer = setTimeout(() => { if (child.exitCode === null && child.signalCode === null) child.kill('SIGKILL'); }, 1000);
       killer.unref?.();

package/src/project-review-service.mjs

@@ -31,7 +31,7 @@ function makeCaptureBudget(signal) {
 
 async function captureProject(cwd, args, signal) {
   const captureBudget = makeCaptureBudget(signal);
-  const captureOptions = { signal, svnCaptureBudget: captureBudget };
+  const captureOptions = { signal, svnCaptureBudget: captureBudget, selectedPaths: args.selectedPaths };
   const root = await realpath(await resolveWorkspaceRepository(cwd, args.repositoryPath));
   const vcs = await detectVcs(root);
   const inventory = await projectInventory(root, vcs, captureOptions);
@@ -59,9 +59,10 @@ async function captureProject(cwd, args, signal) {
   }
 
   const result = {
-    root, vcs, inventoryId: inventory.id, inventoryComplete: inventory.vcs === 'git',
-    totalTrackedNodes: inventory.records.length, selectedFiles: paths.length,
-    selectionComplete: paths.length === inventory.records.length, notice: inventory.notice, batches,
+    root, vcs, inventoryId: inventory.id, inventoryComplete: inventory.inventoryComplete,
+    inventoryScope: inventory.inventoryScope, inventoryNodes: inventory.records.length,
+    totalTrackedNodes: inventory.totalTrackedNodes, selectedFiles: paths.length,
+    selectionComplete: inventory.inventoryScope !== 'selected' && paths.length === inventory.records.length, notice: inventory.notice, batches,
   };
   return { ...result, id: hash(JSON.stringify(result)) };
 }
@@ -96,7 +97,7 @@ export function createProjectReviewService(llm, { allowModelSending = false, aut
           previewId, snapshotId: s.id, reviewMode: 'project', repositoryRoot: s.root, vcs: s.vcs,
           model: current.route, modelSendingEnabled: allowModelSending,
           totalTrackedNodes: s.totalTrackedNodes, selectedFiles: s.selectedFiles, selectionComplete: s.selectionComplete,
-          inventoryComplete: s.inventoryComplete, batches: s.batches.length,
+          inventoryComplete: s.inventoryComplete, inventoryScope: s.inventoryScope, inventoryNodes: s.inventoryNodes, batches: s.batches.length,
           execution: { batchConcurrency: projectConcurrency },
           files: s.batches.flatMap(b => b.files.map(f => ({ path: f.path, eligibility: f.eligibility, reason: f.reason }))),
           notice: s.notice + PREVIEW_NOTICE_SUFFIX,
@@ -160,7 +161,7 @@ export function createProjectReviewService(llm, { allowModelSending = false, aut
             : results.every(r => r.status === 'completed') && files.every(f => ['completed', 'excluded'].includes(f.status)) ? 'completed'
             : 'partial',
           repositoryRoot: s.root, vcs: s.vcs, model: p.route, modelCalls: calls, maxModelCalls: projectMaxCalls,
-          totalTrackedNodes: s.totalTrackedNodes, selectionComplete: s.selectionComplete, inventoryComplete: s.inventoryComplete,
+          totalTrackedNodes: s.totalTrackedNodes, selectionComplete: s.selectionComplete, inventoryComplete: s.inventoryComplete, inventoryScope: s.inventoryScope, inventoryNodes: s.inventoryNodes,
           coverage, files, findings, batches: results,
           execution: { batchConcurrency: projectConcurrency },
           notice: s.notice + REPORT_NOTICE_SUFFIX,

package/src/project-snapshot.mjs

@@ -15,7 +15,29 @@ async function inventoryGit(root, options) {
   const args = ['--no-optional-locks', '-c', 'core.fsmonitor=false', '-c', 'core.untrackedCache=false'];
   const actual = text(await checked('git', [...args, 'rev-parse', '--show-toplevel'], { ...options, cwd: root })).replace(/\r?\n$/, '');
   if (await realpath(actual) !== root) throw new Error('Full project requires explicit repository root');
-  const index = await checked('git', [...args, 'ls-files', '--stage', '-z'], { ...options, cwd: root, maxBytes: 2 * 1024 * 1024 });
+  const selected = options.selectedPaths;
+  let index;
+  if (selected === undefined) {
+    index = await checked('git', [...args, 'ls-files', '--stage', '-z'], { ...options, cwd: root, maxBytes: 2 * 1024 * 1024 });
+  } else {
+    const chunks = [];
+    let bytes = 0;
+    for (const name of [...selected].sort()) {
+      // Literal pathspecs still recurse. Exclude descendants, not the node:
+      // a trailing-slash literal exclusion would also hide an exact gitlink.
+      const escaped = Array.from(name, c => '*?[]'.includes(c) ? String.fromCharCode(92) + c : c).join('');
+      const chunk = await checked('git', [...args, 'ls-files', '--stage', '-z', '--',
+        ':(top,literal)' + name, ':(top,glob,exclude)' + escaped + '/**'],
+      { ...options, cwd: root, maxBytes: 64 * 1024 });
+      for (const row of text(chunk).split(String.fromCharCode(0)).filter(Boolean)) {
+        if (row.slice(row.indexOf(String.fromCharCode(9)) + 1) !== name) throw new Error('Git project selection expanded beyond literal path');
+      }
+      bytes += chunk.length;
+      if (bytes > 2 * 1024 * 1024) throw new Error('Selected project inventory exceeds shared 2MiB limit');
+      chunks.push(chunk);
+    }
+    index = Buffer.concat(chunks);
+  }
   const records = [];
   for (const row of text(index).split(String.fromCharCode(0)).filter(Boolean)) {
     const m = /^(\d{6}) ([a-f0-9]+) ([0-3])\t([\s\S]+)$/.exec(row);
@@ -47,6 +69,11 @@ async function inventorySvn(root, options) {
 }
 
 export async function projectInventory(cwd, vcs, options = {}) {
+  const selected = options.selectedPaths;
+  if (selected !== undefined) {
+    if (!Array.isArray(selected) || selected.length > 1000 || new Set(selected).size !== selected.length) throw new Error('Invalid tracked project selection');
+    selected.forEach(relativePath);
+  }
   const root = await realpath(cwd);
   const source = vcs === 'git' ? await inventoryGit(root, options)
     : vcs === 'svn' ? await inventorySvn(root, options)
@@ -58,7 +85,14 @@ export async function projectInventory(cwd, vcs, options = {}) {
   const grouped = new Map();
   for (const r of records) { if (grouped.has(r.path)) { grouped.get(r.path).duplicate = true; } else grouped.set(r.path, r); }
   records = [...grouped.values()];
-  const inventory = { root, vcs, records, identity: source.identity, notice: INVENTORY_NOTICE };
+  const scoped = vcs === 'git' && selected !== undefined;
+  const inventory = {
+    root, vcs, records, identity: source.identity,
+    inventoryScope: scoped ? 'selected' : 'repository',
+    inventoryComplete: vcs === 'git' && !scoped,
+    totalTrackedNodes: scoped ? null : records.length,
+    notice: INVENTORY_NOTICE + (scoped ? ' Explicit Git selection only: repository total is unknown; unrelated index entries are not enumerated or bound to this snapshot.' : ''),
+  };
   return { ...inventory, id: hash(JSON.stringify(canonical(inventory))) };
 }
 
@@ -100,7 +134,7 @@ export async function captureProjectBatch(inventory, paths, options = {}) {
       delete file.left; delete file.right;
     }
   }
-  const scope = { mode: 'project', inventoryId: inventory.id, totalTrackedNodes: inventory.records.length, batchPaths: paths, untrackedIncluded: false, inventoryComplete: inventory.vcs === 'git', scopeCompleteness: inventory.vcs === 'svn' ? 'observed-working-copy-only' : 'tracked-index-only', notice: inventory.notice };
+  const scope = { mode: 'project', inventoryId: inventory.id, inventoryScope: inventory.inventoryScope, inventoryNodes: inventory.records.length, totalTrackedNodes: inventory.totalTrackedNodes, batchPaths: paths, untrackedIncluded: false, inventoryComplete: inventory.inventoryComplete, scopeCompleteness: inventory.vcs === 'svn' ? 'observed-working-copy-only' : inventory.inventoryScope === 'selected' ? 'selected-index-only' : 'tracked-index-only', notice: inventory.notice };
   const snapshot = { schemaVersion: 1, vcs: inventory.vcs, root: inventory.root, files, context: [], projectScope: scope };
   return { ...snapshot, id: hash(JSON.stringify(snapshot)) };
 }

package/src/review-jobs.mjs

@@ -11,17 +11,68 @@ export function createReviewJobs({directory}={}){
  const identity=exec=>{const a=exec?.agent,s=a?.session;if(!s||!a.options?.provider||!a.options?.model||!s.header?.cwd)throw new Error('Review job requires session identity');const id=s.header.id??s.id;if(typeof id!=='string'||!id)throw new Error('Durable session id required');return {sessionId:id,cwd:s.header.cwd,provider:a.options.provider,model:a.options.model,reasoningEffort:a.options.reasoningEffort??null};};
  const same=(a,b)=>JSON.stringify(a)===JSON.stringify(b);
  const pageCheckpoint=(c,offset,limit)=>({...c,...(c.files?{files:c.files.slice(offset,offset+limit),totalFiles:c.files.length}:{}),...(c.findings?{findings:c.findings.slice(offset,offset+limit),totalFindings:c.findings.length}: {})});
- const filename=id=>{if(typeof id!=='string'||!/^[a-f0-9-]{36}$/.test(id))throw new Error('Invalid review job id');return path.join(directory,id+'.json');};
- async function safeDirectory(){await mkdir(directory,{recursive:true,mode:0o700});const stat=await lstat(directory),resolved=await realpath(directory);if(stat.isSymbolicLink()||!stat.isDirectory()||(canonicalDirectory!==undefined&&resolved!==canonicalDirectory))throw new Error('Unsafe report directory');canonicalDirectory??=resolved;}
- async function save(job){await safeDirectory();const tmp=path.join(directory,job.id+'.'+randomUUID()+'.tmp');await writeFile(tmp,JSON.stringify(job.record),{mode:0o600,flag:'wx'});await rename(tmp,filename(job.id));changed(job.id);}
- async function owned(id,exec){const who=identity(exec),job=jobs.get(id);if(job){if(!same(who,job.record.owner))throw new Error('Foreign review job');return job.record;}await safeDirectory();const name=filename(id),stat=await lstat(name);if(stat.isSymbolicLink()||!stat.isFile())throw new Error('Unsafe report file');const r=JSON.parse(await readFile(name,'utf8'));if(!same(who,r.owner))throw new Error('Foreign review job');if(['queued','running'].includes(r.status)){r.status='interrupted';r.notice='Host restarted or plugin disposed. Saved checkpoints are available; resending requires a fresh preview and approval.';}return r;}
+ const filename=id=>{if(typeof id!=='string'||!/^[a-f0-9-]{36}$/.test(id))throw new Error('Invalid review job id');return path.join(canonicalDirectory??directory,id+'.json');};
+ // Resolve existing ancestors before appending a not-yet-created suffix. Lexical
+ // paths alone do not identify a workspace reached through a junction or symlink.
+ async function projectedRealpath(name){
+  let current=path.resolve(name);const suffix=[];
+  for(;;){
+   try{return path.join(await realpath(current),...suffix);}
+   catch(error){
+    if(error.code!=='ENOENT')throw error;
+    // A dangling link is not an ordinary missing directory.
+    try{if((await lstat(current)).isSymbolicLink())throw new Error('Unsafe report directory');}catch(statError){if(statError.code!=='ENOENT')throw statError;}
+    const parent=path.dirname(current);if(parent===current)throw error;
+    suffix.unshift(path.basename(current));current=parent;
+   }
+  }
+ }
+ async function checkDirectory(who){
+  const [workspace,resolved]=await Promise.all([projectedRealpath(who.cwd),projectedRealpath(directory)]);
+  const relative=path.relative(workspace,resolved);
+  if(relative===''||(!relative.startsWith('..'+path.sep)&&relative!=='..'&&!path.isAbsolute(relative)))throw new Error('Report store must be outside reviewed workspace');
+  if(canonicalDirectory!==undefined&&resolved!==canonicalDirectory)throw new Error('Unsafe report directory');
+  return resolved;
+ }
+ async function safeDirectory(who){
+  const expected=await checkDirectory(who); // Do not even create directories inside the workspace.
+  // Use the resolved destination, not a mutable ancestor junction, for creation.
+  await mkdir(expected,{recursive:true,mode:0o700});
+  const stat=await lstat(directory),resolved=await checkDirectory(who);
+  if(stat.isSymbolicLink()||!stat.isDirectory()||resolved!==expected)throw new Error('Unsafe report directory');
+  canonicalDirectory??=resolved;
+ }
+ async function save(job){await safeDirectory(job.record.owner);const tmp=path.join(canonicalDirectory,job.id+'.'+randomUUID()+'.tmp');await writeFile(tmp,JSON.stringify(job.record),{mode:0o600,flag:'wx'});await safeDirectory(job.record.owner);await rename(tmp,filename(job.id));changed(job.id);}
+ async function owned(id,exec){const who=identity(exec),job=jobs.get(id);if(job){if(!same(who,job.record.owner))throw new Error('Foreign review job');return job.record;}await safeDirectory(who);const name=filename(id),stat=await lstat(name);if(stat.isSymbolicLink()||!stat.isFile())throw new Error('Unsafe report file');const r=JSON.parse(await readFile(name,'utf8'));if(!same(who,r.owner))throw new Error('Foreign review job');if(['queued','running'].includes(r.status)){r.status='interrupted';r.notice='Host restarted or plugin disposed. Saved checkpoints are available; resending requires a fresh preview and approval.';}return r;}
  return {
-  async start(exec,work){if(disposed)throw new Error('Review job service disposed');exec.signal?.throwIfAborted();const who=identity(exec);const relative=path.relative(path.resolve(who.cwd),directory);if(relative===''||(!relative.startsWith('..'+path.sep)&&relative!=='..'&&!path.isAbsolute(relative)))throw new Error('Report store must be outside reviewed workspace');if([...jobs.values()].some(j=>j.record.owner.sessionId===who.sessionId&&['queued','running'].includes(j.record.status)))throw new Error('Session review job already active');const id=randomUUID(),controller=new AbortController(),job={id,controller,record:{jobId:id,owner:who,status:'queued',stage:'queued',checkpoints:[],createdAt:new Date().toISOString()},pending:Promise.resolve()};jobs.set(id,job);try{await save(job);}catch(error){jobs.delete(id);throw error;}
-   // Keep the serialization tail usable after failure, but return the original
-   // rejecting operation so checkpoint callers still observe durability failures.
+  async start(exec,work){
+   if(disposed)throw new Error('Review job service disposed');
+   exec.signal?.throwIfAborted();const who=identity(exec);
+   if([...jobs.values()].some(j=>j.record.owner.sessionId===who.sessionId&&['queued','running'].includes(j.record.status)))throw new Error('Session review job already active');
+   const id=randomUUID(),controller=new AbortController(),job={id,controller,record:{jobId:id,owner:who,status:'queued',stage:'queued',checkpoints:[],createdAt:new Date().toISOString()},pending:Promise.resolve()};
+   // Register the entire lifetime before the first await: dispose must also join
+   // startup persistence. The start RPC observes startup errors; done never rejects.
+   const startup=Promise.resolve().then(()=>save(job));
    const enqueue=fn=>{const operation=job.pending.then(fn);job.pending=operation.catch(()=>{});return operation;};
-   // Own cancellation explicitly. The short start RPC ending is NOT task cancellation.
-   job.done=(async()=>{await Promise.resolve();try{job.record.status='running';await enqueue(()=>save(job));const result=await work({signal:controller.signal,checkpoint:async value=>enqueue(async()=>{job.record.stage=value.stage??'reviewing';job.record.checkpoints.push(structuredClone(value));await save(job);})});job.record.result=result;job.record.status=controller.signal.aborted?'cancelled':'completed';}catch(error){job.record.status=controller.signal.aborted?'cancelled':'failed';job.record.error=error?.message??String(error);}finally{job.record.finishedAt=new Date().toISOString();try{await enqueue(()=>save(job));jobs.delete(id);}catch(error){job.record.status='failed';job.record.persistenceError=error?.message??String(error);}finally{changed(id);}}})();return {jobId:id,status:'queued',nextAction:'Call code_review_wait until terminal status; do not finish the user request at start.',notice:'Background job accepted. Poll status; start is not a completed review. Explicit cancel or plugin disposal stops it.'};
+   job.done=startup.then(async()=>{
+    try{
+     controller.signal.throwIfAborted();
+     job.record.status='running';await enqueue(()=>save(job));
+     controller.signal.throwIfAborted();
+     const result=await work({signal:controller.signal,checkpoint:async value=>enqueue(async()=>{job.record.stage=value.stage??'reviewing';job.record.checkpoints.push(structuredClone(value));await save(job);})});
+     job.record.result=result;job.record.status=controller.signal.aborted?'cancelled':'completed';
+    }catch(error){job.record.status=controller.signal.aborted?'cancelled':'failed';job.record.error=error?.message??String(error);}
+    finally{
+     job.record.finishedAt=new Date().toISOString();
+     try{await enqueue(()=>save(job));jobs.delete(id);}
+     catch(error){job.record.status='failed';job.record.persistenceError=error?.message??String(error);}
+     finally{changed(id);}
+    }
+   },()=>{jobs.delete(id);changed(id);});
+   jobs.set(id,job);
+   // Own cancellation explicitly. The short start RPC ending is NOT cancellation.
+   await startup;
+   return {jobId:id,status:'queued',nextAction:'Call code_review_wait until terminal status; do not finish the user request at start.',notice:'Background job accepted. Poll status; start is not a completed review. Explicit cancel or plugin disposal stops it.'};
   },
   async status(id,exec,page){const r=structuredClone(await owned(id,exec));r.recovery=recoveryCoverage(r);r.progress=jobProgress(r);r.waitRevision=r.checkpoints.length;r.nextAction=['queued','running'].includes(r.status)?'Call code_review_wait; do not end the user review request while task runs.':r.result?.previewId?'Show preview and request user confirmation before execute.':'Collect final report and unfinished scope, then provide one final answer.';if(!page)return r;const {offset=0,limit=20,checkpointIndex}=page;if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(limit)||limit<1||limit>100)throw new Error('Invalid result page');if(checkpointIndex!==undefined){if(!Number.isSafeInteger(checkpointIndex)||checkpointIndex<0||checkpointIndex>=r.checkpoints.length)throw new Error('Invalid checkpoint index');return {jobId:r.jobId,status:r.status,checkpointIndex,checkpoint:pageCheckpoint(r.checkpoints[checkpointIndex],offset,limit),page:{offset,limit}};}const result=r.result;const report=result?.report;return {...r,result:undefined,recovery:{...r.recovery,unfinishedStages:r.recovery.unfinishedStages.slice(offset,offset+limit),files:r.recovery.files.slice(offset,offset+limit),windows:r.recovery.windows.slice(offset,offset+limit),suggestedPaths:r.recovery.suggestedPaths.slice(offset,offset+limit),totalObservedFiles:r.recovery.files.length},checkpoints:r.checkpoints.slice(offset,offset+limit).map(c=>pageCheckpoint(c,0,limit)),checkpointPage:{offset,limit,total:r.checkpoints.length},...(result?{resultSummary:report?{status:report.status,coverage:report.coverage,model:report.model,snapshotId:report.snapshotId}:({...result,files:result.files?.slice(offset,offset+limit),filePage:result.files?{offset,limit,total:result.files.length}:undefined}),resultPage:report?{files:report.files?.slice(offset,offset+limit),findings:report.findings?.slice(offset,offset+limit),totalFiles:report.files?.length,totalFindings:report.findings?.length}:undefined}: {})};},
   async wait(id,exec,{after,timeoutMs=25000,signal}={}){const r=await owned(id,exec);if(!Number.isSafeInteger(timeoutMs)||timeoutMs<1||timeoutMs>60000)throw new Error('Invalid wait duration');if(after!==undefined&&(!Number.isSafeInteger(after)||after<0))throw new Error('Invalid wait revision');const revision=r.checkpoints.length;if(!['queued','running'].includes(r.status)||(after!==undefined&&after!==revision))return {changed:true};signal?.throwIfAborted();await new Promise((resolve,reject)=>{let timer;const cleanup=()=>{clearTimeout(timer);signal?.removeEventListener('abort',abort);const waiting=listeners.get(id);waiting?.delete(done);if(waiting?.size===0)listeners.delete(id);};const done=()=>{cleanup();resolve();},abort=()=>{cleanup();reject(signal.reason);};if(!listeners.has(id))listeners.set(id,new Set());listeners.get(id).add(done);signal?.addEventListener('abort',abort,{once:true});timer=setTimeout(done,timeoutMs);const latest=jobs.get(id)?.record;if(!latest||latest.checkpoints.length!==revision||!['queued','running'].includes(latest.status))done();if(signal?.aborted)abort();});return {changed:true};},

package/src/svn-explicit-context.mjs

@@ -20,6 +20,18 @@ export async function captureSvnExplicitContext(root,names,options={}){
   }
   context.push({path:name,...content,...(keywordMapping?{keywordMapping}:{}),...(node.eolStyle?{eolMapping:svnEolMapping(content.text,node.eolStyle)}:{})});identities.push({path:name,fingerprint:node.fingerprint,revision:node.revision});
  }
- const verify=async()=>{for(const node of identities)if((await svnCallerNode(root,node.path,bounded)).fingerprint!==node.fingerprint)throw new Error('SVN explicit context identity changed during capture');signal.throwIfAborted();};
+ // SVN metadata can remain identical while raw keyword values change: status
+ // compares contracted text, but the original expanded body is our evidence.
+ let verifiedBytes=bytes; // sourceBytes below remains the initial capture cost.
+ const verify=async()=>{
+  for(let i=0;i<identities.length;i++){
+   const node=identities[i];
+   if((await svnCallerNode(root,node.path,bounded)).fingerprint!==node.fingerprint)throw new Error('SVN explicit context identity changed during capture');
+   const current=await readLocal(root,node.path,bounded);bounded.svnNavigationBudget?.charge(current.bytes);verifiedBytes+=current.bytes;
+   if(verifiedBytes>1024*1024)throw new Error('SVN explicit context source byte limit exceeded');
+   if(current.hash!==context[i].hash)throw new Error('SVN explicit context content changed during capture');
+  }
+  signal.throwIfAborted();
+ };
  return {context,verify,options:bounded,sourceBytes:bytes,identities};
 }

package/src/svn-keyword-mapping.mjs

@@ -1,7 +1,12 @@
 import { hash } from './content.mjs';
 import { keywordConfigurationTokens } from './svn-keyword-config.mjs';
 
-const STANDARD = new Set(['Date', 'LastChangedDate', 'Revision', 'Rev', 'LastChangedRevision', 'Author', 'LastChangedBy', 'HeadURL', 'URL', 'Id', 'Header']);
+// Each standard property spelling enables its complete native SVN alias group.
+const STANDARD_GROUPS = [
+  ['Date', 'LastChangedDate'], ['Revision', 'Rev', 'LastChangedRevision'],
+  ['Author', 'LastChangedBy'], ['HeadURL', 'URL'], ['Id'], ['Header'],
+];
+const STANDARD = new Map(STANDARD_GROUPS.flatMap(group => group.map(name => [name, group])));
 const CUSTOM_DEFINITION = /^([A-Za-z][A-Za-z0-9]*)=(.+)$/;
 const ALLOWED_FORMAT_FLAGS = 'radDuRPb_HI%';
 const ALLOWED_LITERAL = /[A-Za-z0-9_.:/ ()-]/;
@@ -23,11 +28,12 @@ function parseCustomFormat(format) {
 // never reimplemented here; raw source remains the only evidence.
 export function svnKeywordConfiguration(configuration) {
   if (typeof configuration !== 'string' || Buffer.byteLength(configuration) > 4096) throw new Error('Invalid SVN keyword configuration');
-  const enabled = new Set(), custom = [];
+  const enabled = new Set(), configured = new Set(), custom = [];
   for (const token of keywordConfigurationTokens(configuration)) {
     if (STANDARD.has(token)) {
-      if (enabled.has(token)) throw new Error('Duplicate SVN keyword configuration');
-      enabled.add(token);
+      if (configured.has(token)) throw new Error('Duplicate SVN keyword configuration');
+      configured.add(token);
+      for (const alias of STANDARD.get(token)) enabled.add(alias);
       continue;
     }
     const match = CUSTOM_DEFINITION.exec(token);
@@ -47,11 +53,11 @@ export function svnKeywordMapping(text, configuration) {
     if (!enabled.has(name)) return literal;
     if (separator === '::') {
       // SVN reserves the complete field width, including the initial space and
-      // final space (or # truncation marker); shrink values without changing width.
+      // final space (or # truncation marker); retain UTF-8 byte width, not UTF-16 length.
       if (value.length < 2 || value[0] !== ' ' || ![' ', '#'].includes(value.at(-1))) throw new Error('Ambiguous SVN fixed-width keyword expansion');
       fixedWidth++;
       if (/[^ ]/.test(value)) replacements++;
-      return '$' + name + '::' + ' '.repeat(value.length) + '$';
+      return '$' + name + '::' + ' '.repeat(Buffer.byteLength(value, 'utf8')) + '$';
     }
     if (!/^ .+ $/.test(value)) throw new Error('Ambiguous SVN keyword expansion');
     replacements++;