svn-agent-mcp 1.1.0 → 1.1.3

package/CHANGELOG.md

@@ -2,6 +2,97 @@
 
 All notable changes to the SVN MCP are recorded here.
 
+## [Unreleased]
+
+## [1.1.3] - 2026-07-20
+
+### Security
+
+- Replaced the SlikSVN payload and its outdated OpenSSL 3.0.16 DLLs with the July 2026
+  redistributable VisualSVN Apache Subversion 1.14.5 command-line package.
+- Added complete upstream license and Subversion notice files for the bundled Windows runtime.
+- Redacted secret-like URL values from parsed fields in standard and full MCP responses.
+- Rejected repository policy files larger than 64 KiB and non-regular policy paths before reading
+  or parsing them.
+- Made `.git`, `.hg`, `.svn`, and `.ssh` directory contents immutable never-commit paths.
+- Bounded XML entity expansion in all SVN XML parsers and continued to reject external entities.
+- Pinned GitHub Actions to immutable commit hashes.
+
+### Fixed
+
+- Treated literal `@` characters safely according to each SVN subcommand's operand semantics,
+  including VisualSVN's distinct move and copy destination parsing.
+- Refused symbolic links and Windows directory junctions in recursive import/add scans so SVN
+  cannot follow them into unscanned external content.
+- Made batched EOL property writes skip already-correct paths while updating the remaining paths.
+- Allowed `eol_fix_verified` dry runs in read-only mode because they do not modify the working copy.
+- Redacted identity-like URL query values including usernames, email addresses, and client IDs.
+- Reported unknown future SVN status values explicitly instead of synthesizing a potentially
+  misleading known status code.
+- Required self-check package-root discovery to match the `svn-agent-mcp` package name.
+- Replaced inline benchmark commit messages with temporary `-F` message files.
+- Derived the MCP server version from `package.json` so release version bumps cannot leave the
+  running server on stale metadata.
+- Prevented compact self-check from reporting an incomplete runtime layout as available.
+- Removed the per-file fallback process fan-out when a batched EOL property query returns partial
+  XML alongside SVN's expected missing-property exit code.
+- Failed EOL checks on genuine property-query errors or malformed XML rather than treating them as
+  paths without an EOL property.
+- Built `dist/` automatically before npm packing and made the packed-install smoke test launch the
+  installed `svn-agent-mcp` command shim.
+
+### Performance
+
+- Ran independent startup tool probes concurrently.
+
+## [1.1.2] - 2026-07-20
+
+### Fixed
+
+- Prevented repository policy allow rules from overriding private-key, `.env*`, and `.npmrc`
+  never-commit guards.
+- Bounded individual streamed diff lines and per-file summaries, with explicit truncation signals.
+- Mapped buffered SVN output overflow to a scoped diagnostic instead of a generic failure.
+- Added consistent `--` operand separators to SVN commands as defense in depth.
+- Added finite public limits for path arrays, path strings, repository locations, messages, and cursors.
+- Accepted npm 12 and newer without an engine warning while keeping npm 11.16.0 as the minimum.
+- Required `externalDestAck:true` before exporting outside a working copy.
+- Checked mixed revisions at the working-copy root during precommit and commit flows.
+- Based EOL repair proof on complete per-file summaries and applied never-commit guards to EOL props.
+- Skipped `.svn` administrative directories during recursive add/import guard scans.
+
+### Documentation
+
+- Documented import/export filesystem reach, immutable credential guards, and output-size limits.
+
+## [1.1.1] - 2026-07-20
+
+### Added
+
+- Added macOS and Linux support through native SVN and dos2unix tools resolved from `PATH`, while
+  retaining the bundled Windows toolchain.
+- Added Windows, macOS, and Linux CI coverage.
+- Added an isolated packed-npm installation smoke test on every CI platform.
+- Added an MCP protocol handshake and tool-health check to the packed-install smoke test.
+- Added a disposable-repository MCP client smoke test covering guarded read and write workflows.
+- Standardized development and CI on Node.js 24.18.0 LTS with npm 11.16.0.
+- Added strict, version-pinned npm install-script approvals so new dependency lifecycle scripts fail
+  CI until reviewed.
+
+### Fixed
+
+- Fixed `svn_self_check` for global and local npm installations, where the valid runtime lives in
+  root `bin/` and `dist/` without a generated `current` junction or `releases/` directory.
+- Kept unprepared source checkouts invalid while reporting the active runtime layout explicitly.
+- Removed Windows-only `.exe` assumptions from explicit SVN and EOL tool overrides.
+- Updated compatible dependencies within the Node 24 LTS line and corrected the release label in
+  the bundled binary checksum manifest.
+- Protected export, import, and generic property operands from being parsed as SVN options.
+- Redacted credentials and sensitive query values from compact mutation receipts.
+- Returned working-copy-relative paths in compact diff summaries.
+- Normalized compact relative paths to forward slashes across operating systems.
+- Hardened self-check against running/package version drift and incomplete runtime payloads.
+
 ## [1.1.0] - 2026-07-20
 
 ### Added

package/README.md

@@ -1,35 +1,50 @@
-# svn-agent MCP
-
-Strict SVN Model Context Protocol server for agent-safe status, diff, EOL diagnosis, precommit checks, and guarded SVN mutations.
-
-The implementation contract lives in `docs/SPEC.md`. The current release is `1.1.0`; each clone can prepare a self-contained local runtime bundle under `releases/v1.1.0`.
-
-Requirements: Windows, Node.js 20 or newer, Git, and access to the public npm registry. The bundled
-SlikSVN and dos2unix runtime payload is Windows-only.
-
-## Quick Start
-
-```powershell
-git clone https://github.com/shrishailrana-maker/svn-agent-mcp-v1.git
-cd svn-agent-mcp-v1
-npm install
-npm run prepare:local
-npm test
-```
-
+# svn-agent MCP
+
+Strict SVN Model Context Protocol server for agent-safe status, diff, EOL diagnosis, precommit checks, and guarded SVN mutations.
+
+The implementation contract lives in `docs/SPEC.md`. The current source release is `1.1.3`; each source clone can prepare a local runtime under `releases/v1.1.3`, while npm installations run directly from package-root `dist/`.
+
+Requirements: Node.js 24.18.0 or newer within the Node 24 LTS line, npm 11.16.0 or newer, Git, and access to the public npm registry. Windows uses the
+bundled VisualSVN Apache Subversion command-line package and dos2unix payload. On macOS and Linux, `svn`, `svnversion`, `svnadmin`,
+`dos2unix`, and `unix2dos` must be available on `PATH`.
+
+## Quick Start
+
+```shell
+git clone https://github.com/shrishailrana-maker/svn-agent-mcp-v1.git
+cd svn-agent-mcp-v1
+npm install
+npm run prepare:local
+npm test
+```
+
+## Agent-Managed Global Install
+
+Give this prompt to Codex, Claude, or another local coding agent:
+
+```text
+Install or update the SVN MCP globally with: npm install -g svn-agent-mcp@latest
+Verify the package with: npm list -g svn-agent-mcp --depth=0
+Resolve the executable with the platform command lookup: where.exe svn-agent-mcp on Windows, or command -v svn-agent-mcp on macOS/Linux.
+On macOS/Linux, verify that svn, svnversion, svnadmin, dos2unix, and unix2dos are available on PATH. If any are missing, install Subversion and dos2unix with the host package manager.
+Ensure the MCP client entry is named "svn" and uses command "svn-agent-mcp", never a source checkout, junction, current pointer, or dist path. Do not add --readonly.
+Preserve existing SVN_AGENT_* environment overrides without printing sensitive values, then restart the MCP client.
+After restarting, run svn_self_check and report the installed version, executable path, runtime layout, and MCP health. The expected latest release is 1.1.3; report the installed version instead of relying on a remembered version.
+```
+
 ## Agent Setup From GitHub
 
 Tell an agent:
 
 ```text
-Get the SVN MCP from https://github.com/shrishailrana-maker/svn-agent-mcp-v1, clone it to C:\MCP\svn-agent-mcp-v1, run npm install, run npm run prepare:local, then configure the MCP command as node C:\MCP\svn-agent-mcp-v1\current\dist\index.js.
+Get the SVN MCP from https://github.com/shrishailrana-maker/svn-agent-mcp-v1, clone it to a stable absolute path, run npm install, run npm run prepare:local, then configure the MCP command as node <absolute-clone-path>/current/dist/index.js. Use the host platform's native path syntax.
 ```
 
 The setup commands are:
 
-```powershell
-git clone https://github.com/shrishailrana-maker/svn-agent-mcp-v1.git C:\MCP\svn-agent-mcp-v1
-cd C:\MCP\svn-agent-mcp-v1
+```shell
+git clone https://github.com/shrishailrana-maker/svn-agent-mcp-v1.git
+cd svn-agent-mcp-v1
 npm install
 npm run prepare:local
 ```
@@ -37,7 +52,7 @@ npm run prepare:local
 Then configure the MCP client to run:
 
 ```text
-node C:\MCP\svn-agent-mcp-v1\current\dist\index.js
+node <absolute-clone-path>/current/dist/index.js
 ```
 
 ### Claude Desktop Config Example
@@ -49,7 +64,7 @@ Add this under `mcpServers`:
   "mcpServers": {
     "svn": {
       "command": "node",
-      "args": ["C:\\MCP\\svn-agent-mcp-v1\\current\\dist\\index.js"]
+      "args": ["<absolute-clone-path>/current/dist/index.js"]
     }
   }
 }
@@ -60,28 +75,33 @@ Add this under `mcpServers`:
 ```toml
 [mcp_servers.svn]
 command = "node"
-args = ["C:\\MCP\\svn-agent-mcp-v1\\current\\dist\\index.js"]
+args = ["<absolute-clone-path>/current/dist/index.js"]
 startup_timeout_sec = 120
 ```
 
 Restart the MCP client after changing the config.
-
-## Start The MCP
-
-For development from this working copy:
-
-```powershell
-cd <path-to-svn-agent-mcp-v1>
-npm install
-npm run prepare:local
-node .\current\dist\index.js
-```
-
-The source tree includes `bin/` with the full SlikSVN `bin` payload plus the full dos2unix `bin` payload. Releases copy that folder to `current/bin`, so normal Windows clients do not need to locate or install `svn`, `svnversion`, `svnadmin`, `dos2unix`, `unix2dos`, or their required DLLs. See `THIRD_PARTY_NOTICES.md` and `THIRD_PARTY_CHECKSUMS.txt` for bundled binary notices and SHA256 hashes.
-
+
+## Start The MCP
+
+For development from this working copy:
+
+```shell
+cd <path-to-svn-agent-mcp-v1>
+npm install
+npm run prepare:local
+node ./current/dist/index.js
+```
+
+The source tree includes `bin/` with the Windows VisualSVN Apache Subversion and dos2unix payload. Releases copy that
+folder to `current/bin`, so Windows clients do not need separate tool installations. On macOS and
+Linux, the server ignores those `.exe` files and resolves the native tools from `PATH`. See
+`THIRD_PARTY_NOTICES.md`, `THIRD_PARTY_CHECKSUMS.txt`, and `third_party_licenses/` for bundled
+binary notices, hashes, and complete license texts.
+
 ## Plug-And-Play Client Config
 
-Register the MCP once globally. Do not set `cwd` and do not set environment variables:
+After `npm install -g svn-agent-mcp@latest`, register the MCP once. Do not set `cwd` or add
+environment variables unless an existing installation already needs an explicit override:
 
 Generic client example:
 
@@ -89,18 +109,18 @@ Generic client example:
 {
   "mcpServers": {
     "svn": {
-      "command": "node",
-      "args": ["C:\\MCP\\svn-agent-mcp-v1\\current\\dist\\index.js"]
+      "command": "svn-agent-mcp"
     }
   }
 }
 ```
 
 The MCP is not tied to one SVN checkout. If a tool call supplies absolute paths and omits `cwd`, the server finds the nearest SVN working copy for those paths. Relative paths require explicit per-call `cwd`.
-
-Client registration is static: configure the MCP once, and working-copy discovery happens per tool call. The server does not rewrite client configuration at runtime.
-
-Environment variables are not required for normal use. `SVN_MCP_RESPONSE_MODE` selects `compact`
+
+Client registration is static: configure the MCP once, and working-copy discovery happens per tool call. The server does not rewrite client configuration at runtime.
+
+Environment variables are not required when the toolchain is bundled or available on `PATH`.
+`SVN_MCP_RESPONSE_MODE` selects `compact`
 (default), `standard`, or `full` responses. Compact mode returns bounded structured results and
 short text receipts; use `responseMode: "full"` on a call when bounded raw SVN diagnostics are needed.
 Errors retain bounded stdout/stderr diagnostics in every mode. Other development/test escape
@@ -110,46 +130,53 @@ hatches are `SVN_AGENT_BIN_DIR`, `SVN_AGENT_SVN_PATH`, `SVN_AGENT_DOS2UNIX_DIR`,
 High-volume reads are bounded by default. Log messages and changed paths are capped and opt-in
 where appropriate. Diff collection defaults to 200 lines, compact excerpts are capped at 3,000
 characters, and large file/property/status/EOL collections expose explicit continuation cursors.
+Buffered SVN commands fail with a scoped diagnostic above 20 MB. Streamed diff lines are capped at
+1 MiB each, and per-file diff summaries are capped at 20,000 entries; either truncation is reported.
+Public path arrays accept at most 500 entries, and individual filesystem paths are capped at 4,096
+characters.
 Compact mode changes response size only; path containment, mutation guards, EOL checks,
 mixed-revision checks, and commit verification run unchanged.
-
-## Commands
-
-| Command | Description |
-| --- | --- |
-| `npm run dev` | Run the TypeScript entry point during development |
-| `npm run typecheck` | Check TypeScript without emitting build output |
-| `npm run build` | Compile `src/` into `dist/` |
+
+## Commands
+
+| Command | Description |
+| --- | --- |
+| `npm run dev` | Run the TypeScript entry point during development |
+| `npm run check:runtime` | Verify the supported Node 24 LTS and minimum npm version |
+| `npm run typecheck` | Check TypeScript without emitting build output |
+| `npm run build` | Compile `src/` into `dist/` |
 | `npm test` | Run the Jest test suite |
+| `npm run test:package` | Pack, install, and self-check the real npm artifact in isolation |
 | `npm run benchmark:responses` | Compare compact MCP, full MCP, and equivalent raw SVN output sizes |
-| `npm run prepare:local` | Build and prepare the local `current` runtime |
-| `npm run release:prepare` | Copy `dist/` and `bin/` into `releases/v<version>` and repoint `current` |
-| `npm run clean` | Remove root `dist/` with the Node clean script |
-
-## Operator Diagnostics
-
-Use `svn_self_check` to verify the MCP package, `current` release pointer, bundled binaries, and release scripts. Use `svn_diagnose` on a working-copy path when SVN itself is acting strange; it checks local status, remote status, HEAD info, latest log reachability, and returns actionable notes for authentication, network, lock, and working-copy database failures.
-
-For SVN property work, use `svn_propget` and guarded `svn_propset` instead of raw `svn propget`/`svn propset`. `svn_propset_eol_style` remains the safer shortcut for `svn:eol-style` normalization.
-
-## Changelog
-
-Release history is maintained in `CHANGELOG.md`.
-
-## Layout
-
-| Path | Purpose |
-| --- | --- |
-| `src/` | MCP server implementation |
-| `src/parse/` | SVN XML/text parsers |
-| `src/tools/` | MCP tool families |
-| `tests/` | Unit and temp-repository integration tests |
-| `.svn-mcp-policy.json` | Repo-local guard exceptions for this MCP's intentional runtime payloads |
-| `bin/` | Versioned Windows SVN and EOL converter runtime binaries |
-| `THIRD_PARTY_NOTICES.md` | Notices for bundled binary payloads |
-| `docs/` | Spec, local rules, and decisions |
-| `releases/` | Generated versioned runtime release payloads, ignored by Git |
-
+| `npm run prepare:local` | Build and prepare the local `current` runtime |
+| `npm run release:prepare` | Copy `dist/` and `bin/` into `releases/v<version>` and repoint `current` |
+| `npm run clean` | Remove root `dist/` with the Node clean script |
+
+## Operator Diagnostics
+
+Use `svn_self_check` to verify the MCP package, runtime layout, resolved native or bundled tools, and release scripts. Use `svn_diagnose` on a working-copy path when SVN itself is acting strange; it checks local status, remote status, HEAD info, latest log reachability, and returns actionable notes for authentication, network, lock, and working-copy database failures.
+
+For SVN property work, use `svn_propget` and guarded `svn_propset` instead of raw `svn propget`/`svn propset`. `svn_propset_eol_style` remains the safer shortcut for `svn:eol-style` normalization.
+
+## Changelog
+
+Release history is maintained in `CHANGELOG.md`.
+
+## Layout
+
+| Path | Purpose |
+| --- | --- |
+| `src/` | MCP server implementation |
+| `src/parse/` | SVN XML/text parsers |
+| `src/tools/` | MCP tool families |
+| `tests/` | Unit and temp-repository integration tests |
+| `.svn-mcp-policy.json` | Repo-local guard exceptions for this MCP's intentional runtime payloads |
+| `bin/` | Versioned Windows SVN and EOL converter runtime binaries |
+| `third_party_licenses/` | License and notice texts shipped with the bundled runtime |
+| `THIRD_PARTY_NOTICES.md` | Notices for bundled binary payloads |
+| `docs/` | Spec, local rules, and decisions |
+| `releases/` | Generated versioned runtime release payloads, ignored by Git |
+
 ## Usage Model
 
 Register one global MCP server and use explicit paths or per-call `cwd` values when working across SVN checkouts. The server does not assume a product name, project name, or fixed working copy.

package/SECURITY.md

@@ -18,4 +18,25 @@ Useful reports include:
 - Reproduction steps or proof of concept
 - Whether the issue affects read-only, mutating, or release-packaging behavior
 
-Please do not publish exploit details until a fix or mitigation is available.
+Please do not publish exploit details until a fix or mitigation is available.
+
+## Security Boundaries
+
+- Repository policy `allow` rules may override generated-output guards for intentional runtime
+  payloads. They cannot permit credential-like files such as private keys, `.env*`, `.npmrc`,
+  `.ssh` content, or VCS administration directories.
+- `svn_export` may write to an explicit destination outside a working copy only when the caller sets
+  `externalDestAck:true`, and `svn_import` may read an explicit source outside one. Both are refused
+  in read-only mode; import scans its source for never-commit paths and refuses symbolic links or
+  directory junctions before invoking SVN.
+- Buffered SVN output is limited to 20 MB. Streamed diff lines are limited to 1 MiB, and diff file
+  summaries are limited to 20,000 entries. Truncation and over-limit failures are reported rather
+  than silently discarded.
+- Response redaction covers credential-bearing URLs and common secret query parameters, but it is
+  not a substitute for keeping credentials out of versioned file content and commit messages.
+- SVN and conversion processes inherit the host environment so native credential caches, proxy
+  settings, home directories, and configured SSH transports continue to work. Treat MCP process
+  environment variables as trusted operator configuration and do not place secrets in debug logs.
+- The bundled Windows Subversion runtime is the redistributable VisualSVN command-line package.
+  Its source archive hash, individual file hashes, and upstream license texts are retained in the
+  repository. The package does not ship separate OpenSSL runtime DLLs.

package/THIRD_PARTY_CHECKSUMS.txt

@@ -1,52 +1,81 @@
 # SHA256 checksums for bundled third-party binaries
 #
-# Generated from the files under bin/ for release v1.0.0.
+# Generated from the files under bin/ for release v1.1.3.
 
+213cdeffc15c734e42565c90512491113652de9e52694ae335131d0e24f91df7  bin/api-ms-win-core-console-l1-1-0.dll
+45a155e9b60f068fbc3ea8dd73552905afeae49270bea6bbccb4aad0aa696f2d  bin/api-ms-win-core-console-l1-2-0.dll
+05baccf67fc6360068a9836a1a5ebf0e62697e92990665a6b73ce6c8a4a1b633  bin/api-ms-win-core-datetime-l1-1-0.dll
+1c2705257c272c7736ef10b81d65f28fc76b4d34412b8db72f5a23b530d847e8  bin/api-ms-win-core-debug-l1-1-0.dll
+8b3669326bb61770fb013e4d9a9e1722a1c6e4699be4eb61a620bdb64871cb78  bin/api-ms-win-core-errorhandling-l1-1-0.dll
+6ff3ebd6589cc824e00a9fc548cfcaf8221e046a07f9fb822900d288b9010a2d  bin/api-ms-win-core-file-l1-1-0.dll
+62a4810420d997c7fdd9e86a42917a44b78fb367a9d3c0a204e44b3ff05de6d4  bin/api-ms-win-core-file-l1-2-0.dll
+6572965fd3909af60310db1e00c8820b2deef4864612e757d3babab896f59ed7  bin/api-ms-win-core-file-l2-1-0.dll
+cd5c2a10518023d9238f526af78d2fda8265cd10db0edd97be29049ed7aa331c  bin/api-ms-win-core-handle-l1-1-0.dll
+ff80c5e44535b1b623a0320df677a6c6dd106f8a5e14cfee49cd3c9d47589646  bin/api-ms-win-core-heap-l1-1-0.dll
+4c1e732b43efec26d8cc467a5ffc13f062b3e3111cf369a8c94253711c77c330  bin/api-ms-win-core-interlocked-l1-1-0.dll
+bbdffc7563c7e4eabce9fc8ff8a3160c7e4d75d5bd50786cc6621e131f668d40  bin/api-ms-win-core-libraryloader-l1-1-0.dll
+3dd2e16b6f135cdd45bce4065f6493540ebbaf2f7f1553085a2442ea2cf80a10  bin/api-ms-win-core-localization-l1-2-0.dll
+031b58e1621211ed8f41aed863e5e4c05c271d5fdf8abd51aa8e9d5eb3536511  bin/api-ms-win-core-memory-l1-1-0.dll
+1920e3afa821558badeaba7bda9b8fe4ed5a5e7bdbb9f85b31d92fc0452030f4  bin/api-ms-win-core-namedpipe-l1-1-0.dll
+5009391754032b93bc3f950b5e17d4ed7bfd37941170f97f65c596d9ecdf8e75  bin/api-ms-win-core-processenvironment-l1-1-0.dll
+d7716ba9db032b306be6b48e93b379b4e0a9e763a12671441422507236abecb5  bin/api-ms-win-core-processthreads-l1-1-0.dll
+3a5d176b1f2c97bca7d4e7a52590b84b726796191ae892d38ad757fd595f414d  bin/api-ms-win-core-processthreads-l1-1-1.dll
+49e587c970471a29bc49b8ace18510b4bd2b1a561484314cddddd10fbf5334da  bin/api-ms-win-core-profile-l1-1-0.dll
+0d365a06fad099cfa98dc2ddf0ca16dabbc5319b99c29b49be25f3c9809da2d9  bin/api-ms-win-core-rtlsupport-l1-1-0.dll
+3c48d059b21126a3755e676758df54b6779c975d13cfd10990a3c29ccfd95571  bin/api-ms-win-core-string-l1-1-0.dll
+c8925ee61e3135aca8b56498c0304bf0db981930d1e3d36ccae2f84791c86908  bin/api-ms-win-core-synch-l1-1-0.dll
+42367b6b7285bddc185c0badefe49e883646f574b1d7d832c226f2d1ce489c5b  bin/api-ms-win-core-synch-l1-2-0.dll
+77b5019d54aa05ad70d0c1bec4a7ea5f3ba499b493c03ea198b27ceb8509d1af  bin/api-ms-win-core-sysinfo-l1-1-0.dll
+4f77abb5c5014769f907a194fd2e43b3c977df1fb87f8c98dd15a7b950d1e092  bin/api-ms-win-core-timezone-l1-1-0.dll
+8c2d5915b436c2848cefac33ae47e5ba1e96eba0310b9836f069bb5c767a7d42  bin/api-ms-win-core-util-l1-1-0.dll
+8594d0eda4e4367bc3473032552c5d0f9931c283e6c4cb8d7c1e7d9f61e13506  bin/api-ms-win-core-xstate-l2-1-0.dll
+687be4f560dc3fb96bcda9332617a2d4b1d587411dd1c31ad088146ac0b24a76  bin/api-ms-win-crt-conio-l1-1-0.dll
+347ceeb26c97124fb49add1e773e24883e84bf9e23204291066855cd0baea173  bin/api-ms-win-crt-convert-l1-1-0.dll
+cf601a7b883bb4fb87c28b4a1d9f823d2454b298cdbcb4da4f508db8bd1278ba  bin/api-ms-win-crt-environment-l1-1-0.dll
+6cc23b34f63ba8861742c207f0020f7b89530d6cdd8469c567246a5879d62b82  bin/api-ms-win-crt-filesystem-l1-1-0.dll
+a3f13fa93131a17e05ad0c4253c34b4db30d15eae2b43c9d7ec56fdc6709d371  bin/api-ms-win-crt-heap-l1-1-0.dll
+4615ec9effc0c27fc0cfd23ad9d87534cbe745998b7d318ae84ece5ea1338551  bin/api-ms-win-crt-locale-l1-1-0.dll
+190a2cc8c8e47fcd4d07b4e260e247fb3b5fb4661aa50f7b05158cd062d80762  bin/api-ms-win-crt-math-l1-1-0.dll
+b05a5303c9c1059216787e878884b96474480ae5505dc60be97095f8cdf876d5  bin/api-ms-win-crt-multibyte-l1-1-0.dll
+e5799a718cfa39b0b6ccdc88f3732cd5dd13c5e4a64de6cff4ed4eba20de3371  bin/api-ms-win-crt-private-l1-1-0.dll
+194f04516084785a9650eac58777ae7acebd90d5fabc3e21cebdf705cc0d34b6  bin/api-ms-win-crt-process-l1-1-0.dll
+078d2551f53ca55715f5c6a045de1260ce331b97fd6d047f8455e06d97ef88dc  bin/api-ms-win-crt-runtime-l1-1-0.dll
+e6bab87156c9e7ae14ce36a754eb6891891a22ddfff584b706538152017fbb0f  bin/api-ms-win-crt-stdio-l1-1-0.dll
+d343529d2a49cbb89d644deafce573b873ab45e0bf57e2d906b2f2a964d7bd9a  bin/api-ms-win-crt-string-l1-1-0.dll
+704ad27cab084be488b5757395ad5129e28f57a7c6680976af0f096b3d536e66  bin/api-ms-win-crt-time-l1-1-0.dll
+340ced80fbcfca804925ff680da1929f68b95959fd7e4d0c9f67322bb5fe2155  bin/api-ms-win-crt-utility-l1-1-0.dll
+63e8fa14f386b8249503e689aa8e7c701138f2f4bc4d4d29ca128f8f10934545  bin/concrt140.dll
 95bbe265f53f94d60a99bd5660bcdd97de96045cddf508ae43482f91bfdb4755  bin/dos2unix.exe
-0f369ba0c0807a79216ad641a63c16b8f3d5ed1248d9db5a2447082f4cd984cd  bin/engines/capi.dll
-9139acb63399e18ab72fca074a622e8ace829fee8db8682bb4bca7b34e8b380a  bin/libsvnjavahl-1.dll
+e8a31e25669d6b538c0b2263c46baeb201ac322f0fba4bf3ebb045bc239f174a  bin/libapr-1.dll
+6ad15f040b98db34e7ba2545ea70329c13a07509a425d8b1205f26cdf034c3de  bin/libaprutil-1.dll
+ffe53b1fd0316d0f7cb2fd08a13d9d7d0bc135aba1dabc00872091960fda5aca  bin/libsvn_client-1.dll
+9e3cbe1fd9c3eebe0c1161bb5754e9eb8a13e95b5b4ed5293d6d5905d4f92b7c  bin/libsvn_delta-1.dll
+51bb3aacbc1f9ceffa7bf51c6ce97137328fe1e9dd1fd3dc660392375f7a6757  bin/libsvn_diff-1.dll
+383d816c941086065e7514217ef02191778974987b8124f885e6dc46625d9a19  bin/libsvn_fs_fs-1.dll
+bcc347a52726e139d3cfec484503dd178859ad3d6d47771dda3dbbc61766ebfc  bin/libsvn_fs_util-1.dll
+532e85d89591475f1c90c0b0092291a980d0df890321f0f7275f511636eeb8d5  bin/libsvn_fs_x-1.dll
+97b924fe3a2aff8198b8ce23379bd4a5708a2de3ce1f37a7aa33ef9b95bbd30e  bin/libsvn_fs-1.dll
+79be0d047f75dbf39925d25c381c24473fd4d4cd36f43faeb5d1d0b42b269284  bin/libsvn_ra-1.dll
+0b74a283195f66ff0d03c94a91187eb228286c8f94d936138a7748d39536b7d3  bin/libsvn_repos-1.dll
+8c0ebcd5f569f1ae74067dfa4a275312ab768112c762a354f89c01b4e268ab52  bin/libsvn_subr-1.dll
+7aaaf26d79ba17201051e93ba93bd6a4db1ea4135ea20d683f49e8066a7e1b53  bin/libsvn_wc-1.dll
 95bbe265f53f94d60a99bd5660bcdd97de96045cddf508ae43482f91bfdb4755  bin/mac2unix.exe
-b129bfd13bd5670df96bf0397d177efa9ad5b9fa91621c97c90004812414becb  bin/SlikSvn-DB44-20-x64.dll
-9cbfed910b3fb430eb4b61291789bde267f4d3092a2208802c2767a3aac63949  bin/SlikSvn-libapr-1.dll
-2bd71134611e9272da9c1ff6092b2165985bd532d76bcc4ad505eb3c8b0951c3  bin/SlikSvn-libaprutil-1.dll
-716e5f8c8d8137c011d00a1f6523889c196818397bc52eea14aa78e422eea1c3  bin/SlikSvn-libcrypto-3-x64.dll
-0c4157d7baeba7f86f77fc328e8a691532e6a4ec36a36da51b2373e67653624c  bin/SlikSvn-libintl.dll
-6e4dbf1efbb79809b251b7c52969c884d610a9543ccd1f16781e7e58480ab510  bin/SlikSvn-libsasl21.dll
-ab5efd7d65de64dcc6c4e2e95132b4121f172db9732896f3504579682884420a  bin/SlikSvn-libssl-3-x64.dll
-858250c5c29c55c65e07cccd9967352af0bc7c309b7395aee6c7f2a6e50d9de4  bin/SlikSvn-libsvn_client-1.dll
-975effba24809ad1f147177185b0c9c63a40b1061470f4f7f834e55503a323fe  bin/SlikSvn-libsvn_delta-1.dll
-c54cedfb3f1eadd6041f33c4c3cfba02db6159eccfc78a5ce050a7fb16f37a8b  bin/SlikSvn-libsvn_diff-1.dll
-372ebba0d4d5accb10740a7fe9663e3c8665dc5259dbbc9728004996c0ebfb68  bin/SlikSvn-libsvn_fs_base-1.dll
-5d8c506a7eb80cb213b7ecd3561ca95fb76744fb58909fa89495978ccda84a90  bin/SlikSvn-libsvn_fs_fs-1.dll
-9d4d5a58c9bbc5e69e9fe01a2d8178d4bc4c9028175fce2686c869866705bae7  bin/SlikSvn-libsvn_fs_util-1.dll
-48b75956165dbe942490cede7892dab6bb52670acee9027f44d4a899031668e9  bin/SlikSvn-libsvn_fs_x-1.dll
-e634ee8a101ba346fb247a6372a991686a687061b87c09624d3992efec17ef77  bin/SlikSvn-libsvn_fs-1.dll
-a9ffe2294a096e67b3d0d2efc4863620ad22fe85f531259105ca5c2a733af8da  bin/SlikSvn-libsvn_ra-1.dll
-58a5785830ded90a25dc5adb31762ac7517024e508849b7d8aa8b3e99fb2e02a  bin/SlikSvn-libsvn_repos-1.dll
-8110c65db3b6aedcd7493a20d0c738a1c3bfb53f14c184d06629228606a253b3  bin/SlikSvn-libsvn_subr-1.dll
-2e06518de783feb649b58bc9c133f06ee44da36881e0d875f371ef4c800461ff  bin/SlikSvn-libsvn_wc-1.dll
-f38a7ca7b76928629041a384fddc0848adfa5afb8df1bb98b38a4202561790df  bin/svn-populate-node-origins-index.exe
-916151f9bb570efe36000cfab907c6737f83e7c82b915044b48b2d616dbe437a  bin/svn.exe
-4a3505693ebc84aaa873c13b78cdea450abf83ec6d4912987c043b925e43756b  bin/svnadmin.exe
-26c66fd3f576c158102df4039a67c9e7f07e6e2ff47a1a107a28a23efe943082  bin/svnauthz-validate.exe
-385ed3e415755e2fb8e4950ced1f9e14d5970057b97e4bbcde15f3e11153c5b5  bin/svnauthz.exe
-d3aecf83ec9fd28c05de7fcedd0570fda2ee7cce33fd0f060ee86cf2933f69db  bin/svnbench.exe
-c3142577dae6ee2fbb97a9bc0f0cc550574dc61960c5222d7a0567cd95a01fc8  bin/svndumpfilter.exe
-1f23f8cb3b6b601edf1af6ad20923aa1ce3ee0b653e50083f250d2ce289eb663  bin/svnfsfs.exe
-cbf19f684a206816bc7b51e01764b946ffcb4df6e54904c1dea8ff59b487faed  bin/svnlook.exe
-ee7564335c8400393e894d8eab697dcd85c53e96ac4cf4e14a2e85c2e1aa997e  bin/svnmucc.exe
-0500e301dbc811a230fa95a0680241595ebedb302f6c456adb03d6945c060244  bin/svnrdump.exe
-19a6eefde4c0aa6634e17dc591f4b5d4e9e051831268a65fc78538e8455fc1e5  bin/svnserve.exe
-414cd24d79f4b6a9c045e951af4376d9bc17d473efbf690daefa8977d58299db  bin/svnsync.exe
-1a17ddd90872494fafb37118c7e8a5bcd49d8198f763590c46ec2a7b73143c25  bin/svnversion.exe
-50d513a4e954b157b773f3419ef736c41529e782c3dc5bf2894d3be905b25183  bin/System64/concrt140.dll
-2c03cf78553689ca0523a3ef7c3161939b8f4a2fe246d9e90efa9cfef95c59a7  bin/System64/msvcp140_1.dll
-b583a041271b247c61676396640e7e455388fda580d13a35c1cca592ee4c8080  bin/System64/msvcp140_2.dll
-5d547fd143b5d399f9fe69fe759543e69a140e3a999aae3cde361e7912a0e5e4  bin/System64/msvcp140_atomic_wait.dll
-e763bd3f595d7869190b799cdb23eff7951c6ed224492c40ff9d7b2f7f843050  bin/System64/msvcp140_codecvt_ids.dll
-256492fbbcf3dc63987318f83e5f49eaacdbb6a9a5be54e403f0ddb437582881  bin/System64/msvcp140.dll
-64cc19775dd40aee09ca8b35326a113892b0f251d3e7ea03b0ca7e3045464e60  bin/System64/vccorlib140.dll
-0d719fbe25194e3faa037bd736e07ec9184ab68e521ebbd72c2b13aed89b47a9  bin/System64/vcruntime140_1.dll
-c51c64dfb7c445ecf0001f69c27e13299ddcfba0780efa72b866a7487b7491c7  bin/System64/vcruntime140.dll
+581876dda93a6c91d231149a4c1ae59946a44ea03f61d864fcd2ecda1b0b7fd8  bin/msvcp140_1.dll
+1c95f7db69e732b995122b12502387867c8c13dd9574f8b0e5a12d10c2da4930  bin/msvcp140_2.dll
+f8a381e45f6f3dcab092b5e256c8304906b3c523dc721bcc126dd899167e0ba6  bin/msvcp140_codecvt_ids.dll
+faaa4870bf745444022f409bd494095b7b3796637cf9994ad9faf7a43f393b88  bin/msvcp140.dll
+514bbd1a03109aba979b9ecb7fad46a43e3f29da6741adb827d36cabf0690b6d  bin/svn.exe
+553f415884b3868b0054d9050bd47892762e25f2b78a4570d61ae7f139b05308  bin/svnadmin.exe
+7b35859f7e653a02c3e11a0ee126d7c27c4380ad4467301554f00677a0d85587  bin/svnbench.exe
+59791853f1151233ad774ef1814bffaefbe5b72fe0dfb52360869bd28daac541  bin/svndumpfilter.exe
+646ef34bdabd0c54bb178a1a1afe4eaf98b7630201f35ddb6e5e101c8d41112c  bin/svnfsfs.exe
+966f4d55f12b3a883473e51887b34d29af732ab34a4e464900d9cb82072bac6f  bin/svnlook.exe
+0ccb25d53a8a9fd8dfa6b9e167feae5e362d85fb9a0e037e42288b5cddb37d54  bin/svnmucc.exe
+56a8c32770f6cd11ed98c3e917dee2d0ccef7b4922588f54fbd813c55b67dc8d  bin/svnrdump.exe
+1112ff169002e5fda8c2def2596807fdd4d47a6f4f40d2641e93453ed1d9cd66  bin/svnserve.exe
+9de006ddcbb5355ae50dc967ab41a89cf22d8e17aab0094cf50b22ac9e042bb2  bin/svnsync.exe
+01cc886d6ecb93d60a8acf97d681d01a01a0600c3ec8c2a4e3471c112261069f  bin/svnversion.exe
+10f8f24aa678db8e38e6917748c52bbcd219161b9a07286d6f8093ab1d0318fa  bin/ucrtbase.dll
 192e3735de62e8488a474b63087544879d8c37522a76c79fb717b250082137d6  bin/unix2dos.exe
 192e3735de62e8488a474b63087544879d8c37522a76c79fb717b250082137d6  bin/unix2mac.exe
+a088131e8eb4e2178789af49b646ab463cf9a1f48da51698448206df21db5c95  bin/vcruntime140.dll

package/THIRD_PARTY_NOTICES.md

@@ -1,46 +1,39 @@
-# Third-Party Notices
-
-This project includes a bundled Windows runtime payload in `bin/` so MCP clients can run without
-end-user SVN or EOL-converter installation. The project source is licensed under Apache-2.0; the
-bundled third-party binaries remain under their upstream licenses.
-
-## SlikSVN / Apache Subversion
-
-- Files: `bin/svn*.exe`, `bin/svnauthz*.exe`, `bin/SlikSvn-*.dll`, `bin/libsvn*.dll`,
-  `bin/engines/**`, `bin/System64/**`
-- Bundled version observed by `bin/svn.exe --version --quiet`: `1.14.5-SlikSvn`
-- Upstream: https://sliksvn.com/ and https://subversion.apache.org/
-- License: Apache License, Version 2.0
-
-SlikSVN packages Apache Subversion command-line tools for Windows. Apache Subversion is an Apache
-Software Foundation project licensed under Apache-2.0. Keep upstream license and notice obligations
-in mind when redistributing the binary payload.
-
-### OpenSSL runtime DLLs included by SlikSVN
-
-- Files: `bin/SlikSvn-libssl-3-x64.dll`, `bin/SlikSvn-libcrypto-3-x64.dll`,
-  `bin/engines/capi.dll`
-- Observed DLL product version: `3.0.16`
-- Upstream: https://openssl-library.org/
-- License: Apache License, Version 2.0
-
-### Microsoft Visual C++ runtime support files included by SlikSVN
-
-- Files: `bin/System64/*.dll`
-- These files are copied unmodified from the SlikSVN Windows installer payload.
-- Microsoft redistributable runtime license terms apply to these files.
-
-## dos2unix / unix2dos
-
-- Files: `bin/dos2unix.exe`, `bin/unix2dos.exe`, `bin/mac2unix.exe`, `bin/unix2mac.exe`,
-  as shipped by the upstream Windows 64-bit package
-- Bundled version observed by `bin/dos2unix.exe --version`: `7.5.6`
-- Upstream: https://dos2unix.sourceforge.io/ and https://waterlander.net/dos2unix/
-- License: FreeBSD-style license, GPL-compatible
-
-dos2unix is maintained by Erwin Waterlander. The upstream project publishes its distribution
-license as `COPYING.txt`; consult the upstream source distribution for the complete text.
-
-## Binary checksums
-
-SHA256 checksums for the bundled files are recorded in `THIRD_PARTY_CHECKSUMS.txt`.
+# Third-Party Notices
+
+This project includes a bundled Windows runtime payload in `bin/` so MCP clients can run without
+end-user SVN or EOL-converter installation. The project source is licensed under Apache-2.0; the
+bundled third-party binaries remain under their upstream licenses.
+
+## VisualSVN Apache Subversion Command-Line Package
+
+- Files: `bin/svn*.exe`, `bin/libsvn*.dll`, `bin/libapr*.dll`, Microsoft runtime support DLLs,
+  and related dependencies from the upstream archive
+- Bundled SVN version: `1.14.5` (`r1922182`), compiled June 26, 2026
+- Distribution build: `Apache-Subversion-1.14.5-4.zip`, published July 6, 2026
+- Executable architecture: Windows x86
+- Distribution archive SHA256: `1801DC76910BF196948EAF4B4A9A8E0178E39DA6A5339C11413B5E6DCB32E39D`
+- Distributor: https://www.visualsvn.com/downloads/
+- Upstream: https://subversion.apache.org/
+- License: Apache License, Version 2.0, with separately licensed subcomponents
+
+VisualSVN describes this command-line-only package as redistributable. The archive's complete APR,
+APR Util, OpenSSL, Subversion, and Zlib license files are reproduced under
+`third_party_licenses/apache-subversion-windows/`. The Apache Subversion 1.14.5 `NOTICE` file is
+included there as well. The package contains no separate OpenSSL runtime DLLs.
+
+Microsoft Visual C++ runtime support files in `bin/` are copied unmodified from the VisualSVN
+archive. Microsoft redistributable runtime license terms apply to those files.
+
+## dos2unix / unix2dos
+
+- Files: `bin/dos2unix.exe`, `bin/unix2dos.exe`, `bin/mac2unix.exe`, and `bin/unix2mac.exe`
+- Bundled version: `7.5.6` (May 28, 2026)
+- Upstream: https://dos2unix.sourceforge.io/ and https://waterlander.net/dos2unix/
+- License: FreeBSD-style license, GPL-compatible
+
+dos2unix is maintained by Erwin Waterlander. Its complete distribution license is reproduced at
+`third_party_licenses/dos2unix/COPYING.txt`.
+
+## Binary Checksums
+
+SHA256 checksums for every bundled file are recorded in `THIRD_PARTY_CHECKSUMS.txt`.