svn-agent-mcp 1.2.2 → 1.4.0

package/CHANGELOG.md

@@ -4,6 +4,163 @@ All notable changes to the SVN MCP are recorded here.
 
 ## [Unreleased]
 
+## [1.4.0] - 2026-08-02
+
+### Added
+
+- Added GitHub bug-report and feature-request templates with SVN MCP-specific environment,
+  reproduction, safety, and sanitization fields.
+- Added `receipt` and `structured-only` response modes. Receipt mode defines bounded minimal
+  contracts for status, snapshot, precommit, update, and commit.
+- Added validated field projection for high-use tools. Allowed fields are published once in the
+  generated API contract rather than repeated in every live tool schema.
+- Added explicit `humanText:true` opt-in for clients that need a short text content block.
+- Added server-level `full`, `docs`, and `review` tool profiles through
+  `SVN_MCP_TOOL_PROFILE`; the focused profiles advertise only 8 or 11 tools and return a typed
+  refusal when a client calls a hidden tool.
+- Added canonical `svn_path_change` with an explicit `move`, `rename`, or `copy` action.
+- Added repository-driven `normalizeEol` handling to `svn_add`; configured text files are
+  transactionally normalized and verified before scheduling, while binary and policy-excluded
+  byte-exact files are reported as skipped.
+- Added bounded multi-file `eol_fix_verified` input with aggregate counts, per-file failures, and
+  normalized-content SHA256 proof.
+- Added actionable numeric-limit validation and a CI response/schema budget gate.
+- Added process-local snapshot tokens for status/snapshot `NO_CHANGE` polling, with bounded TTL,
+  query and working-copy binding, tamper rejection, and replacement tokens after a change.
+- Added bounded process-local diff evidence. Continuation calls reuse an opaque operation ID so
+  later pages are stable even when the working copy changes between requests.
+- Added bounded log message filtering, per-revision changed-path summaries, update overlap/top-folder
+  summaries, and diff `counts`/`hunk-headings` modes with complete total and omitted-hunk metadata.
+- Added `eolCheckComplete` and an EOL-policy identity to compact precommit receipts.
+- Added independent 100-item conflict pages for status, snapshot, and update so complete conflict
+  evidence remains reachable without allowing one receipt to grow without bound.
+- Added `expandDescendants:true` to precommit and commit. Explicit directories can now expand to a
+  fully guarded, visible changed-descendant scope while node-only behavior remains opt-in.
+- Added `svn_commit operation:"prepare"`, which performs a pinned explicit-path update with conflict
+  postponement, optional remote-HEAD guarding, unexpected-path refusal, and a final precommit
+  receipt without committing. A hidden `svn_prepare_commit` route preserves explicit compatibility
+  without adding an advertised schema.
+- Added durable UUID operation receipts for update, commit/prepare, EOL repair, and conflict
+  resolution. Identical retries replay compact results across MCP restarts; concurrent, mismatched,
+  corrupt, and ambiguous stale operations fail closed instead of repeating a mutation. Abandoned
+  receipt locks are reclaimed after a bounded interval while active lock contention returns a typed
+  failure.
+- Added explicit-file pre-edit baselines through `svn_snapshot captureBaseline:true`. A later
+  `svn_update baselineToken` reports local edits, remote touches, postponed conflicts, and
+  same-path collisions without requiring a full update transcript.
+- Added READY precommit tokens bound to exact status, base revisions, content and SVN property hashes, repository
+  policy, diff identity, scope, and remote revision. `svn_commit precommitToken` refuses if any
+  bound evidence changed after verification.
+- Added `svn_commit operation:"safe"` as one durable guarded workflow: pinned scoped update,
+  collision refusal, verified EOL repair when needed, precommit binding, commit, pinned final
+  update, and a clean scoped snapshot. Bounded stage detail is paged later through
+  `operation:"detail"` instead of inflating the normal receipt.
+- Safe mode omits only scheduled-added operands from its pinned update while still checking the
+  expected repository HEAD and retaining those files in the exact precommit and commit scope.
+
+### Changed
+
+- GitHub Issues is now the canonical public tracker. The 31 completed historical SVNMCP tasks were
+  migrated as closed issues with 33 distinct notes, condensed completion evidence, and four
+  relations, without private tracker metadata.
+- Reworked setup documentation around the globally installed npm command and added generic,
+  platform-neutral install and source-development prompts.
+- Prepared releases now carry their own package manifest, and API-contract generation always uses
+  the full canonical tool profile regardless of the caller's environment.
+- Buffered and streamed child processes now share bounded UTF-8 byte accounting, sticky
+  truncation, cancellation, timeout escalation, and process-tree termination.
+- Compact diff shaping bounds per-file previews before redaction and serialization. Streamed diff
+  callbacks have independent line/byte work budgets and report when aggregate totals are lower
+  bounds.
+- Workflow and commit hashes now use cancellable asynchronous streams, and test runs use isolated
+  operation-receipt stores instead of the live user store.
+- Workflow hashing now uses a bounded worker pool plus a configurable aggregate-byte ceiling;
+  receipt-lock retries yield to the MCP event loop instead of blocking every request.
+- Large verified EOL repairs now use streaming sniff/hash verification and disk-backed backups.
+  Rollback refuses to overwrite a file changed by another writer after normalization.
+- Structured content is now authoritative by default; successful and failed calls omit duplicate
+  `content.text` unless explicitly requested.
+- Compact, receipt, and standard responses use working-copy-relative paths; absolute paths and
+  raw commands remain full-diagnostic output only.
+- Compact guard refusals now return a typed guard code, one actionable detail, and an affected-path
+  count without echoing the complete submitted path list.
+- High-volume advanced inputs are validated centrally and published once in `MCP_API.json` instead
+  of being repeated across live tool schemas. This preserves schema-token budgets while keeping
+  snapshot, evidence, log-filter, and update-overlap controls available to known callers.
+- Diff aggregate file, hunk, addition, removal, binary, and property counts remain complete after
+  detailed per-file summaries reach their 20,000-entry cap; terminal evidence truncation is explicit.
+- Runner line/output truncation now propagates into stored diff evidence, and nonzero/past-end update
+  pages retain total, offset, and bounded top-folder context.
+- Check-style responses report pass counts and failures by default; passing details require
+  `includePassing:true` and remain paginated.
+- The full profile now advertises 25 canonical tools. Legacy `svn_move`, `svn_rename`,
+  `svn_copy`, and `svn_resolved` routes remain callable for existing clients but are omitted from
+  tool discovery to reduce schema context.
+- `svn_blame` now ignores EOL-only churn by default, matching the existing `svn_diff` default;
+  both tools expose `showEolChanges:true` for diagnostics, and pure EOL diffs return `eolOnly:true`.
+- Commit-message format validation now blocks before `svn commit` and returns a typed failed rule
+  plus a bounded suggested message.
+- Successful commit receipts now separate exact committed paths from post-commit residue and add
+  bounded revision, remote-head, mixed-state, EOL-availability, and content-hash evidence.
+- Baseline, precommit, collision, and safe-commit controls are published once as advanced inputs;
+  the full profile remains at 25 advertised tools and compact safe-commit receipts stay
+  structured-only by default.
+
+### Fixed
+
+- Fixed prepared `current/dist/index.js` launches that could fail module/package resolution while
+  self-check still reported the layout healthy.
+- Fixed delete commit and safe-commit receipts so removed targets no longer cause false residue or
+  final-verification failures.
+- Fixed multi-path repository logs, exact numeric/whitespace property values, revision diffs for
+  literal `@` paths, observed update-HEAD receipts, added-parent guard rechecks, and lock-status
+  parsing.
+- Bounded evidence metadata, operation-receipt reads, workflow hashing, and diff evidence summaries;
+  snapshot tokens now use one canonical state across compact and receipt modes.
+- Durable stale commit outcomes now fail closed instead of inferring success from matching message
+  text, and operation-lock cleanup refuses to break locks owned by live processes.
+- Fixed receipt-store contention and abandoned breaker recovery, prepared-pointer validation by
+  physical path, cross-mode status snapshot tokens, independent stdout/stderr overflow handling,
+  and explicit buffered-output truncation receipts.
+- Enforced absolute `cwd` values and refused credential-bearing repository URLs at both schema and
+  runtime boundaries.
+- Bounded compact log serialization to 24 KiB, rejected unsafe numeric cursors, removed anonymous
+  tree-conflict placeholders, and required `riskAck:true` for destructive revert execution.
+- Applied never-commit guards to verified EOL repair and commit-message validation to `svn_import`.
+- Fixed receipt continuation so a supplied cursor advances to the next changed-path page instead of
+  repeating page one.
+- Removed remaining absolute working-copy paths from non-full warnings, detailed self-check output,
+  standard diagnostics, and batch EOL failure receipts.
+- Embedded a Windows UTF-8 active-code-page manifest in the bundled VisualSVN `svn.exe`, preserving
+  Greek, accented, CJK, and spaced path arguments without a shell or machine-wide locale change.
+- Added a post-large-diff client call to prove oversized SVN output cannot corrupt the next MCP
+  JSON-RPC frame.
+- Prepare mode now checks root, directory, never-commit, and expansion scope before updating;
+  node-only directory preparation uses `--depth empty`, and expanded precommit risk signals are
+  calculated from the expanded files.
+- Compact and receipt prepare failures retain up to 25 unexpected paths plus explicit total and
+  truncation metadata; ordinary non-expanded calls no longer emit empty expansion fields.
+
+## [1.3.0] - 2026-07-31
+
+### Added
+
+- Added exact revision pinning and an optional `expectedRemoteHead` guard to `svn_update`, with
+  resulting revision/range metadata, bounded changed-path receipts, and the existing explicit-scope
+  and conflict-postpone safety.
+- Added opt-in `requireUniformRevision:true` release gating to `svn_precommit`; ordinary precommit
+  calls remain backward compatible and continue to report mixed revisions without blocking.
+
+### Fixed
+
+- Preserved successful SVN warnings and recovered exact existing paths beneath ignored directories
+  as ignored entries with their covering ancestor instead of returning an empty status for
+  VisualSVN/Subversion `W155010`.
+- Made multi-entry `svn_log` envelopes unambiguous with `revision:null`, `revision_range`, and
+  `entry_count`, while retaining per-entry changed paths and single-revision behavior.
+- Marked the prepared-release `current` pointer as inapplicable for direct npm-package layouts;
+  healthy npm self-checks now return `current_matches_package:null` without reducing health.
+
 ## [1.2.2] - 2026-07-28
 
 ### Fixed

package/README.md

@@ -2,30 +2,43 @@
 
 Strict SVN Model Context Protocol server for agent-safe status, diff, EOL diagnosis, precommit checks, and guarded SVN mutations.
 
-The implementation contract lives in `docs/SPEC.md`. The current source release is `1.2.2`; each source clone can prepare a local runtime under `releases/v1.2.2`, while npm installations run directly from package-root `dist/`.
+The implementation contract lives in `docs/SPEC.md`. The current source release is `1.4.0`; each source clone can prepare a local runtime under `releases/v1.4.0`, while npm installations run directly from package-root `dist/`.
 
 Requirements: Node.js 24.18.0 or newer within the Node 24 LTS line, npm 11.16.0 or newer, Git, and access to the public npm registry. Windows uses the
 bundled VisualSVN Apache Subversion command-line package and dos2unix payload. On macOS and Linux, `svn`, `svnversion`, `svnadmin`,
 `dos2unix`, and `unix2dos` must be available on `PATH`.
 
-## Quick Start
+## Install From npm
 
 ```shell
-git clone https://github.com/shrishailrana-maker/svn-agent-mcp-v1.git
-cd svn-agent-mcp-v1
-npm install
-npm run prepare:local
-npm test
+npm install -g svn-agent-mcp@latest
+npm list -g svn-agent-mcp --depth=0
 ```
 
-## Agent-Managed Global Install
+Register one MCP server named `svn` and let the client resolve the globally installed command from
+`PATH`:
+
+```json
+{
+  "mcpServers": {
+    "svn": {
+      "command": "svn-agent-mcp"
+    }
+  }
+}
+```
 
-Give this prompt to Codex, Claude, or another local coding agent:
+Restart the MCP client after changing its configuration, then run `svn_self_check` once to verify
+the installed version and runtime health.
+
+## Generic Agent Install Prompt
+
+Give this prompt to any local coding agent:
 
 ```text
 Install or update the SVN MCP globally with: npm install -g svn-agent-mcp@latest
 Verify the package with: npm list -g svn-agent-mcp --depth=0
-Resolve the executable with the platform command lookup: where.exe svn-agent-mcp on Windows, or command -v svn-agent-mcp on macOS/Linux.
+Resolve the executable with the host shell's command lookup: Get-Command svn-agent-mcp in PowerShell, where.exe svn-agent-mcp in Windows Command Prompt, or command -v svn-agent-mcp on POSIX shells. Do not use a lookup command from another platform.
 On macOS/Linux, verify that svn, svnversion, svnadmin, dos2unix, and unix2dos are available on PATH. If any are missing, install Subversion and dos2unix with the host package manager.
 Ensure the MCP client entry is named "svn". Use command "svn-agent-mcp" when the client can launch it without a visible window; never use a source checkout, junction, or current pointer. Do not add --readonly.
 On Windows, enable the client's hidden/no-window process option. If the npm command shim still opens a console, resolve the global module root with `npm root -g`, then use command "node" with args `["<global-module-root>\\svn-agent-mcp\\dist\\index.js"]`; the server cannot choose its parent process creation flags.
@@ -34,12 +47,13 @@ Query the registry version with: npm view svn-agent-mcp version
 After restarting, run svn_self_check and compare its installed version with the registry version. Report the installed version, executable path, runtime layout, and MCP health instead of relying on a remembered version.
 ```
 
-## Agent Setup From GitHub
+## Source Setup From GitHub
 
-Tell an agent:
+Use a source checkout for development and contribution work, not as the normal global MCP runtime.
+Generic source-setup prompt:
 
 ```text
-Get the SVN MCP from https://github.com/shrishailrana-maker/svn-agent-mcp-v1, clone it to a stable absolute path, run npm install, run npm run prepare:local, then configure the MCP command as node <absolute-clone-path>/current/dist/index.js. Use the host platform's native path syntax.
+Clone https://github.com/shrishailrana-maker/svn-agent-mcp-v1 into a stable development directory. Run npm ci --strict-allow-scripts, npm run prepare:local, and npm test. Use the globally installed svn-agent-mcp command for normal MCP client registration; use node <absolute-clone-path>/current/dist/index.js only when explicitly testing that checkout.
 ```
 
 The setup commands are:
@@ -47,8 +61,9 @@ The setup commands are:
 ```shell
 git clone https://github.com/shrishailrana-maker/svn-agent-mcp-v1.git
 cd svn-agent-mcp-v1
-npm install
+npm ci --strict-allow-scripts
 npm run prepare:local
+npm test
 ```
 
 Then configure the MCP client to run:
@@ -57,7 +72,7 @@ Then configure the MCP client to run:
 node <absolute-clone-path>/current/dist/index.js
 ```
 
-### Claude Desktop Config Example
+### JSON Client Config Example
 
 Add this under `mcpServers`:
 
@@ -72,7 +87,7 @@ Add this under `mcpServers`:
 }
 ```
 
-### Codex Config Example
+### TOML Client Config Example
 
 ```toml
 [mcp_servers.svn]
@@ -121,21 +136,46 @@ Generic client example:
 }
 ```
 
-The MCP is not tied to one SVN checkout. If a tool call supplies absolute paths and omits `cwd`, the server finds the nearest SVN working copy for those paths. Relative paths require explicit per-call `cwd`.
+The MCP is not tied to one SVN checkout. If a tool call supplies absolute paths and omits `cwd`, the server finds the nearest SVN working copy for those paths. Relative paths require an explicit, absolute per-call `cwd`. Repository URL inputs must not embed usernames or passwords; use the native SVN credential cache.
 
 Client registration is static: configure the MCP once, and working-copy discovery happens per tool call. The server does not rewrite client configuration at runtime.
 
+## Issues And Feature Requests
+
+Use [GitHub Issues](https://github.com/shrishailrana-maker/svn-agent-mcp-v1/issues) for public bugs,
+feature requests, and planned work. Search existing issues before filing a new one and use the
+provided templates. Include the package version, operating system, Node.js version, installation
+method, and a minimal sanitized reproduction when relevant. Remove credentials, private repository
+URLs, usernames, and local absolute paths from public reports.
+
+The completed historical project backlog was migrated as issues
+[#1](https://github.com/shrishailrana-maker/svn-agent-mcp-v1/issues/1) through
+[#31](https://github.com/shrishailrana-maker/svn-agent-mcp-v1/issues/31). Report security
+vulnerabilities through the private process in `SECURITY.md`, not a public issue.
+
 Environment variables are not required when the toolchain is bundled or available on `PATH`.
-`SVN_MCP_RESPONSE_MODE` selects `compact`
-(default), `standard`, or `full` responses. Compact mode returns bounded structured results and
-short text receipts; use `responseMode: "full"` on a call when bounded raw SVN diagnostics are needed.
-Errors retain bounded stdout/stderr diagnostics in every mode. Other development/test escape
-hatches are `SVN_AGENT_BIN_DIR`, `SVN_AGENT_SVN_PATH`, `SVN_AGENT_DOS2UNIX_DIR`,
-`SVN_AGENT_TIMEOUT_MS`, and `SVN_AGENT_MAX_DIFF_LINES`.
+`SVN_MCP_TOOL_PROFILE` controls the advertised schema surface: `full` (default) exposes 25
+canonical tools, `docs` exposes the 8-tool edit/commit workflow, and `review` adds bounded diff,
+cat, and blame for 11 tools total. Focused profiles reduce tool-definition context without changing
+any guard. A call to a hidden tool returns a typed `TOOL_PROFILE` refusal; use `full` when the
+workflow needs another operation.
+`SVN_MCP_RESPONSE_MODE` selects `compact` (default), `receipt`, `structured-only`, `standard`, or
+`full` responses. `structuredContent` is authoritative and `content` is empty by default; pass
+`humanText:true` when a client needs a short text receipt. `structured-only` makes that intent
+explicit. `receipt` is the smallest stable contract for status, snapshot, precommit, update, and
+commit. Use `responseMode:"full"` only when bounded raw SVN diagnostics and machine paths are
+needed.
+Non-guard failures retain bounded path-sanitized stdout/stderr diagnostics outside full mode;
+compact guard refusals return only a typed guard code, one-line reason, and affected-path count.
+Other development/test escape hatches are `SVN_AGENT_BIN_DIR`, `SVN_AGENT_SVN_PATH`, `SVN_AGENT_DOS2UNIX_DIR`,
+`SVN_AGENT_TIMEOUT_MS`, `SVN_AGENT_MAX_DIFF_LINES`, `SVN_MCP_HASH_CONCURRENCY`, and
+`SVN_MCP_MAX_HASH_BYTES`. Hashing defaults to four concurrent files and a 1 GiB aggregate explicit
+scope; narrow the path scope before raising either bound.
 
 High-volume reads are bounded by default. Log messages and changed paths are capped and opt-in
 where appropriate. Diff collection defaults to 200 lines, compact excerpts are capped at 3,000
-characters, and compact diff results retain transport headroom below a 32 KiB JSON-RPC record.
+characters, compact logs are capped at 24 KiB, and compact diff results retain transport headroom
+below a 32 KiB JSON-RPC record.
 `maxChars` and `maxFiles` are upper requests: the response may return less with independent
 `nextCursor` and `nextFileCursor` values. Large file/property/status/EOL collections expose
 explicit continuation cursors.
@@ -146,12 +186,102 @@ characters.
 Compact mode changes response size only; path containment, mutation guards, EOL checks,
 mixed-revision checks, and commit verification run unchanged.
 
+Use `svn_diff diffMode:"counts"` for totals only or `"hunk-headings"` for one meaningful line per
+file plus omitted-hunk counts. A returned `operationId` binds later cursor pages to the same bounded
+process-local evidence, so continuation does not rerun SVN against a changing working copy. Evidence
+expires after 10 minutes and is limited to 2 MiB per operation, 32 operations, and 16 MiB total.
+`svn_log messageContains` performs a bounded server-side scan; `changedPathsSummary:true` returns
+per-revision action counts and top-level directories without listing every path. Large updates can
+use `maxItems`, `taskPaths`, and `targetOverlapOnly` to keep unrelated paths out of the receipt while
+making complete conflict evidence available through bounded `conflictCursor` pages.
+Runner-level line/output truncation is carried into the operation evidence, so a final retained page
+cannot be mistaken for the complete source diff.
+
+Normal responses use working-copy-relative paths. High-use tools accept a validated `fields`
+array; the allowed names are published once under `globalResponseControls.fieldProjections` in
+`docs/MCP_API.json` so the live MCP does not repeat those lists in every tool schema. Invalid
+fields are rejected before any SVN process starts. Focused `docs` and `review` profiles advertise
+only `compact`, `receipt`, and `structured-only`; known callers may still explicitly request
+standard/full diagnostics, but switching to the full profile is clearer for diagnostic work.
+
+High-volume controls are likewise published once under
+`globalResponseControls.advancedInputs` in `docs/MCP_API.json`, rather than repeated in every live
+tool schema. They include `afterCursor` for status/snapshot polling, diff `file`/`operationId`,
+bounded log filtering and summaries, and update paging/overlap controls. Snapshot tokens are opaque,
+working-copy and query bound, process-local, and expire after 15 minutes. Repeating the same status
+or snapshot with `afterCursor` returns a minimal `NO_CHANGE` receipt; changed or safety-relevant
+state returns the current bounded result and a replacement token.
+For multi-client editing, `svn_snapshot captureBaseline:true` on explicit files returns a separate
+pre-edit baseline token. Pass it to `svn_update baselineToken` to receive path-level local-edit,
+remote-touch, conflict, and same-path-collision evidence. Directory baselines are refused because
+directory metadata cannot prove which descendant changed.
+Conflict lists use independent pages of at most 100 paths; `conflictCount`, `conflictsTruncated`, and
+`nextConflictCursor` make omitted pages explicit without inflating every status or update response.
+
 `svn_commit` refuses existing directory targets by default because its deliberate `--depth empty`
 behavior commits only the directory node and excludes changed descendants. Prefer explicit file
-paths. Set `allowDirectoryTargets:true` only when intentionally committing directory properties
-or another directory-node-only change; remaining descendants are reported as post-commit residue.
-`svn_precommit` accepts the same `allowDirectoryTargets` and `allowRoot` acknowledgements so its
-readiness verdict matches those target-scope guards.
+paths. Set `expandDescendants:true` to expand a named directory to its currently changed descendants,
+guard every result, and return the exact expanded scope. Set `allowDirectoryTargets:true` only when
+intentionally committing a directory property or another directory-node-only change.
+`svn_precommit` accepts the same scope controls so its readiness verdict matches the later commit.
+A READY precommit also returns a short-lived `precommitToken` bound to exact path status, base
+revisions, content hashes, repository policy, diff identity, and observed remote revision. Passing
+that token to `svn_commit` makes the commit refuse if the verified state changed in between.
+
+Release workflows can pin `svn_update` with an exact `revision`; it still requires explicit paths
+or `updateAll:true` and always postpones conflicts. Add `expectedRemoteHead` with a numeric revision
+to refuse if repository HEAD moved since the caller's probe. Use
+`svn_precommit requireUniformRevision:true` when a release handoff must not proceed from a
+mixed-revision working copy. The default remains backward compatible and reports mixed revisions
+without blocking ordinary precommit work.
+
+`svn_commit operation:"prepare"` performs a pinned update of explicit intended paths with conflicts
+postponed, checks an optional expected remote HEAD, refuses any path touched outside that scope, and
+then runs the normal guarded precommit checks. It never commits. Its compact receipt reports the
+resulting revision, conflicts, updated paths, and exact final commit scope. Keeping preparation as
+a mode of the existing commit workflow avoids loading another tool schema.
+
+`svn_commit operation:"safe"` performs the guarded sequence in one durable call: pinned scoped
+update, baseline collision refusal, automatic verified EOL repair when precommit requests it,
+precommit binding, commit, pinned update to the committed revision, and a final clean scoped
+snapshot. It requires an explicit numeric `revision`, `expectedRemoteHead`, pre-edit
+`baselineToken` when an earlier edit-session baseline is available, valid commit message, explicit
+paths, and UUID `operationId`. Without a token it captures the current explicit-file state before
+update, keeping the common workflow to one call. Its normal response is a compact receipt. Use
+`operation:"detail"` with the returned `detailOperationId` and cursor to
+page bounded stage evidence only when an audit needs it. This adds no advertised tool schema; the
+full profile remains at 25 tools.
+
+Scheduled-added files are not valid `svn update` operands, so safe mode omits only those files from
+the pinned update while still verifying the expected repository HEAD. They remain in the exact
+precommit and commit scope.
+
+Mutation retries can include a UUID `operationId` on `svn_update`, `svn_commit` (including prepare
+and safe mode),
+`eol_fix_verified`, and `svn_resolve`. The server binds that ID to normalized inputs and stores a
+bounded receipt outside the working copy. An identical retry replays the prior result after a client
+timeout or MCP restart; a concurrent or changed request with the same ID is refused. The receipt is
+local to one machine, not a distributed lock between machines. `SVN_MCP_OPERATION_DIR` can relocate
+the store when an operator needs a different profile-data location.
+The resolved store path is refused when it sits inside any SVN working copy. Terminal receipts and
+orphan lock/temp files are pruned within fixed count, byte, age, and record-size limits; retained
+unfinished or unreadable records are never deleted to make room, so new operations fail closed when
+those records exhaust capacity.
+
+Repositories can make EOL handling automatic for new files:
+
+```json
+{
+  "normalizeEol": "crlf",
+  "eolExclude": ["**/*.patch", "**/*.diff"]
+}
+```
+
+With this in `.svn-mcp-policy.json`, `svn_add` normalizes and verifies new text files in the same
+call, skips binaries and excluded byte-exact fixtures, and refuses before scheduling if verification
+fails. `eol_fix_verified` also accepts a bounded explicit `paths` batch for tracked-file repairs.
+`svn_diff` and `svn_blame` ignore EOL-only churn by default; use `showEolChanges:true` only for EOL
+diagnostics.
 
 ## Commands
 
@@ -166,6 +296,7 @@ readiness verdict matches those target-scope guards.
 | `npm test` | Run the Jest test suite |
 | `npm run test:package` | Pack, install, and self-check the real npm artifact in isolation |
 | `npm run benchmark:responses` | Compare compact MCP, full MCP, and equivalent raw SVN output sizes |
+| `npm run check:response-budgets` | Fail when representative compact responses or schemas exceed token budgets |
 | `npm run prepare:local` | Build and prepare the local `current` runtime |
 | `npm run release:prepare` | Copy `dist/` and `bin/` into `releases/v<version>` and repoint `current` |
 | `npm run clean` | Remove root `dist/` with the Node clean script |
@@ -174,7 +305,7 @@ readiness verdict matches those target-scope guards.
 
 Use `svn_self_check` to verify the MCP package, runtime layout, resolved native or bundled tools, and release scripts. Use `svn_diagnose` on a working-copy path when SVN itself is acting strange; it checks local status, remote status, HEAD info, latest log reachability, and returns actionable notes for authentication, network, lock, and working-copy database failures.
 
-Use `svn_snapshot` for a one-call status and revision summary. `svn_log` and `svn_diff` accept exact or ranged revision selectors, while bounded `svn_cat` and `svn_blame` calls support historical file inspection without raw SVN output. Mutations include dry-run-first `svn_delete` and canonical `svn_resolve`; the older `svn_resolved` name remains as a deprecated compatibility alias.
+Use `svn_snapshot` for a one-call status and revision summary. Exact ignored descendants are reported with their covering ignored ancestor instead of disappearing behind SVN's `W155010` warning. `svn_log` and `svn_diff` accept exact or ranged revision selectors; multi-entry log envelopes report an explicit revision range and entry count. Bounded `svn_cat` and `svn_blame` calls support historical file inspection without raw SVN output. Mutations include dry-run-first `svn_delete`, canonical `svn_resolve`, and `svn_path_change` with an explicit `move`, `rename`, or `copy` action. Legacy direct calls to `svn_resolved`, `svn_move`, `svn_rename`, and `svn_copy` remain callable in the full profile for compatibility but are no longer advertised.
 
 For SVN property work, use `svn_propget` and guarded `svn_propset` instead of raw `svn propget`/`svn propset`. `svn_propset_eol_style` remains the safer shortcut for `svn:eol-style` normalization.
 

package/SECURITY.md

@@ -30,8 +30,12 @@ Please do not publish exploit details until a fix or mitigation is available.
   in read-only mode; import scans its source for never-commit paths and refuses symbolic links or
   directory junctions before invoking SVN.
 - Buffered SVN output is limited to 20 MB. Streamed diff lines are limited to 1 MiB, and diff file
-  summaries are limited to 20,000 entries. Truncation and over-limit failures are reported rather
-  than silently discarded.
+  summaries are limited to 20,000 entries. Streamed parser callbacks and per-file previews have
+  separate work/size limits. Truncation, incomplete aggregate totals, and over-limit failures are
+  reported rather than silently discarded.
+- Child-process timeouts and MCP cancellation terminate the process tree, escalate when needed, and
+  wait for process closure before returning a receipt. Output byte limits count UTF-8 bytes rather
+  than JavaScript string units.
 - Compact diff results enforce a separate serialized-size budget and return continuation cursors
   for omitted excerpts and file summaries. Stdio clients must still buffer the byte stream through
   its newline-delimited JSON-RPC record boundary instead of parsing arbitrary read chunks.
@@ -39,6 +43,36 @@ Please do not publish exploit details until a fix or mitigation is available.
   not a substitute for keeping credentials out of versioned file content and commit messages.
 - Commit/import messages and generic property values are passed through mode-0600 temporary files
   outside the working copy and removed in `finally`, rather than embedded in displayed commands.
+- Optional mutation operation receipts are stored outside working copies with atomic replacement,
+  restricted file modes, bounded record sizes, and no raw successful stdout/stderr. IDs are bound to
+  normalized inputs; unreadable, mismatched, concurrent, or ambiguous stale receipts fail closed.
+  The physical store path is refused inside an SVN working copy. Terminal and stale orphan files
+  are pruned within fixed limits; retained unfinished or unreadable records cause a capacity refusal
+  rather than deletion. Live lock owners are preserved, abandoned breaker files are recoverable,
+  and lock acquisition waits asynchronously for a bounded five seconds without blocking unrelated
+  MCP requests. The receipt store is local to one host and must not be treated as a cross-machine lock.
+- Working-copy `cwd` inputs must be absolute. Repository URL inputs containing user information are
+  refused; authentication remains the responsibility of the native SVN credential cache or trusted
+  operator configuration.
+- Baseline, precommit, and safe-operation detail tokens are process-local, expire, and are bound to
+  a working copy plus exact explicit paths. Baselines accept files only. Precommit tokens include
+  file content hashes, canonical SVN property hashes, status, base revisions, repository policy, diff identity, and observed
+  remote revision; commit rechecks them without weakening any ordinary guard. Detailed workflow
+  stages stay in bounded memory and are not persisted with durable mutation receipts.
+- Workflow content hashes use cancellable streams, a bounded worker pool, and a default 1 GiB
+  aggregate explicit-scope ceiling. `SVN_MCP_HASH_CONCURRENCY` and `SVN_MCP_MAX_HASH_BYTES` may
+  tune those limits without weakening path containment.
+- Verified EOL repair applies never-commit guards before mutation. Large opted-in files use
+  streaming verification and disk-backed backups; rollback will not overwrite a file whose content
+  changed after normalization.
+- Precommit evidence is revalidated immediately before invoking `svn commit`. This narrows the
+  local check/use interval but cannot freeze files against an unrelated external editor; use one
+  writer per working copy and do not share a writable checkout across processes or machines.
+- `svn_commit operation:"safe"` requires an exact revision, expected remote revision, valid commit
+  message, explicit files, and durable operation ID. It accepts a stronger pre-edit baseline or
+  captures the current scoped state internally before update. It stops before
+  commit on same-path overlap or postponed conflict, and an interrupted ambiguous operation fails
+  closed rather than repeating a mutation.
 - SVN and conversion processes inherit the host environment so native credential caches, proxy
   settings, home directories, and configured SSH transports continue to work. Treat MCP process
   environment variables as trusted operator configuration and do not place secrets in debug logs.

package/THIRD_PARTY_CHECKSUMS.txt

@@ -1,6 +1,6 @@
 # SHA256 checksums for bundled third-party binaries
 #
-# Generated from the files under bin/ for release v1.2.0.
+# Generated from the files under bin/ for the current public distribution.
 
 213cdeffc15c734e42565c90512491113652de9e52694ae335131d0e24f91df7  bin/api-ms-win-core-console-l1-1-0.dll
 45a155e9b60f068fbc3ea8dd73552905afeae49270bea6bbccb4aad0aa696f2d  bin/api-ms-win-core-console-l1-2-0.dll
@@ -64,7 +64,7 @@ bcc347a52726e139d3cfec484503dd178859ad3d6d47771dda3dbbc61766ebfc  bin/libsvn_fs_
 1c95f7db69e732b995122b12502387867c8c13dd9574f8b0e5a12d10c2da4930  bin/msvcp140_2.dll
 f8a381e45f6f3dcab092b5e256c8304906b3c523dc721bcc126dd899167e0ba6  bin/msvcp140_codecvt_ids.dll
 faaa4870bf745444022f409bd494095b7b3796637cf9994ad9faf7a43f393b88  bin/msvcp140.dll
-514bbd1a03109aba979b9ecb7fad46a43e3f29da6741adb827d36cabf0690b6d  bin/svn.exe
+626bbab5b6b823944ac07996e6ab6c79166a9b3cc59a554bc980300707856a38  bin/svn.exe
 553f415884b3868b0054d9050bd47892762e25f2b78a4570d61ae7f139b05308  bin/svnadmin.exe
 7b35859f7e653a02c3e11a0ee126d7c27c4380ad4467301554f00677a0d85587  bin/svnbench.exe
 59791853f1151233ad774ef1814bffaefbe5b72fe0dfb52360869bd28daac541  bin/svndumpfilter.exe

package/THIRD_PARTY_NOTICES.md

@@ -21,6 +21,10 @@ APR Util, OpenSSL, Subversion, and Zlib license files are reproduced under
 `third_party_licenses/apache-subversion-windows/`. The Apache Subversion 1.14.5 `NOTICE` file is
 included there as well. The package contains no separate OpenSSL runtime DLLs.
 
+This project modifies the embedded application manifest in `bin/svn.exe` to request the Windows
+UTF-8 active code page. The executable code and all other bundled files remain from the named
+VisualSVN archive. The source manifest and reproducible maintenance script are under `scripts/`.
+
 Microsoft Visual C++ runtime support files in `bin/` are copied unmodified from the VisualSVN
 archive. Microsoft redistributable runtime license terms apply to those files.
 

package/dist/commitScope.d.ts

@@ -0,0 +1,21 @@
+import type { ToolEnvelope } from "./types.js";
+export type CommitScopeResult = {
+    ok: true;
+    paths: string[];
+    expanded: boolean;
+    expandedPaths: string[];
+} | {
+    ok: false;
+    note: string;
+    envelope?: ToolEnvelope;
+    expanded: boolean;
+    expandedPaths: string[];
+};
+export declare function resolveCommitScope(input: {
+    cwd: string;
+    wcRoot: string;
+    paths: string[];
+    expandDescendants?: boolean;
+    allowDirectoryTargets?: boolean;
+}): Promise<CommitScopeResult>;
+//# sourceMappingURL=commitScope.d.ts.map

package/dist/commitScope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commitScope.d.ts","sourceRoot":"","sources":["../src/commitScope.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAK/C,MAAM,MAAM,iBAAiB,GACzB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AAEN,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkE7B"}

package/dist/commitScope.js

@@ -0,0 +1,79 @@
+import fs from "node:fs";
+import path from "node:path";
+import { findExistingDirectoryTarget, isCommittableStatus, isInsideOrEqual, pathIdentityKey, repoRelativePath, resolveTargetsInsideWc } from "./guards.js";
+import { scopedStatusMap } from "./tools/readonly.js";
+const MAX_EXPANDED_COMMIT_PATHS = 500;
+export async function resolveCommitScope(input) {
+    const directoryTarget = findExistingDirectoryTarget(input.paths);
+    if (!directoryTarget.ok) {
+        return { ok: false, note: directoryTarget.note, expanded: false, expandedPaths: [] };
+    }
+    if (!directoryTarget.target) {
+        return { ok: true, paths: input.paths, expanded: false, expandedPaths: [] };
+    }
+    if (!input.expandDescendants) {
+        if (!input.allowDirectoryTargets) {
+            return {
+                ok: false,
+                note: `directory commit target requires allowDirectoryTargets:true because --depth empty excludes descendants: ${repoRelativePath(directoryTarget.target, input.wcRoot)}`,
+                expanded: false,
+                expandedPaths: []
+            };
+        }
+        return { ok: true, paths: input.paths, expanded: false, expandedPaths: [] };
+    }
+    const directoryKeys = new Set(input.paths.filter(isExistingDirectory).map((candidate) => pathIdentityKey(candidate)));
+    const explicitFileKeys = new Set(input.paths
+        .filter((candidate) => !directoryKeys.has(pathIdentityKey(candidate)))
+        .map((candidate) => pathIdentityKey(candidate)));
+    const status = await scopedStatusMap(input.cwd, input.wcRoot, input.paths);
+    if (!status.envelope.ok) {
+        return {
+            ok: false,
+            note: status.envelope.note || "unable to expand directory commit targets",
+            envelope: status.envelope,
+            expanded: true,
+            expandedPaths: []
+        };
+    }
+    const candidates = [];
+    for (const changed of status.envelope.changed_paths) {
+        if (!isCommittableStatus(changed.status))
+            continue;
+        const candidate = path.resolve(input.cwd, changed.path);
+        const key = pathIdentityKey(candidate);
+        if (explicitFileKeys.has(key) || [...directoryKeys].some((directory) => isInsideOrEqual(candidate, directory))) {
+            if (!candidates.some((existing) => pathIdentityKey(existing) === key)) {
+                candidates.push(candidate);
+            }
+        }
+    }
+    candidates.sort((left, right) => repoRelativePath(left, input.wcRoot).localeCompare(repoRelativePath(right, input.wcRoot)));
+    if (candidates.length > MAX_EXPANDED_COMMIT_PATHS) {
+        return {
+            ok: false,
+            note: `expanded commit scope contains ${candidates.length} paths; narrow the directory scope to at most ${MAX_EXPANDED_COMMIT_PATHS}`,
+            expanded: true,
+            expandedPaths: candidates.slice(0, MAX_EXPANDED_COMMIT_PATHS).map((candidate) => repoRelativePath(candidate, input.wcRoot))
+        };
+    }
+    const contained = resolveTargetsInsideWc(input.cwd, input.wcRoot, candidates);
+    if (!contained.ok) {
+        return { ok: false, note: contained.note, expanded: true, expandedPaths: [] };
+    }
+    return {
+        ok: true,
+        paths: contained.paths,
+        expanded: true,
+        expandedPaths: contained.paths.map((candidate) => repoRelativePath(candidate, input.wcRoot))
+    };
+}
+function isExistingDirectory(candidate) {
+    try {
+        return fs.statSync(candidate).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=commitScope.js.map