@entrorove/skill 0.1.48 → 0.1.49

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.49 — 2026-10-16
+
+- 修复本地签名快照扫描大量源码时的内存耗尽：优先分析当前授权目标，为源码与语法树设置内存边界，并及时释放 Vue 解析缓存。未完整分析的引用明确保持未知，全仓文件哈希与变更核验继续保留；超限目标返回具体路径和限制，原 flow、范围与队列可保留后重试。
+- Fixed memory exhaustion during local signed snapshots of large source repositories: inspect authorized targets first, bound source and syntax-tree retention, and release the Vue parser cache. Unresolved references remain explicitly unknown while whole-repository hashes and change verification are retained. Oversized targets report their exact path and limit so the original flow, scope, and queue can be preserved for retry.
+
 ## 0.1.48 — 2026-10-16
 
 - 新增标准命令 `install --host codex`，仅配置 Codex 并保留 Claude 的配置与技能副本；后续自动更新沿用已配置的宿主范围。安装命令守卫和旧版清理也按目标宿主限界。

package/REUSE-DISCIPLINE.md

@@ -2,6 +2,8 @@
 
 Apply these rules when adding to or changing an existing system. Reuse is assessed inside the current accepted repository; external projects, databases, accounts, sessions and keys are outside scope.
 
+Snapshot scans stream whole-repository integrity hashes and bound semantic work to 1 MiB per source, 8 MiB of retained source, 512 files and 200,000 syntax nodes. Original target paths and proposed files receive capacity first. A resource-limited non-target source stays in the integrity comparison and is recorded as unresolved; `scanComplete` is false and absent references cannot prove a symbol unused. A target that exceeds a bound returns `ENTROROVE_DISCIPLINE_ANALYSIS_LIMIT` with its path and the exceeded limit. These are execution memory limits, never size-based review exemptions or approval thresholds. Preserve the original flow, signer, scope and queue during recovery. Upgrade with the standard managed installer, then retry the original `scope-connect` input; do not create a replacement task or bypass the host guard with an arbitrary Node environment wrapper.
+
 - D-1: Before another business mapping or fact definition, search actual definitions and reuse them. Snapshot planning records the whole repository comparison and AST usage review in `discipline-review.json`; its digest is covered by the signed original snapshot. Typed source-entity field mappings use the existing import/alias resolver to identify the same entity, then compare field/value sets. A conflicting second mapping is refused with the existing file and line. An unresolved semantic relation remains unknown. No overlap threshold is invented.
 - D-2: A rewrite must cite a concrete existing defect at file:line. “Clearer”, “more maintainable” and “more general” are not evidence. A necessary sensitive exception is submitted through `continue` → `workflow-discipline-review` on the original planning phase. Display the whole concrete proposal. Approval must be the original account's stored Confirm Protocol answer and audit, never a caller's `accepted:true`.
 - D-3: A parallel path requires frozen `policy.parallelPaths` and actual same-input, fieldwise equivalence evidence. Use the existing GoldenBaseline to pin baseline bytes and source hash. The approved runner reads the baseline and actual process output; the original output cannot be supplied anew by the implementation. Missing evidence yields incomplete, mismatch yields blocked with field names. Baselines come from the existing path's actual independent samples, not the new implementation's self-consistency tests.

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute an engineering task through Entrorove, preserving its origi
 
 # entrorove · 熵巡
 
-Version: 0.1.48.
+Version: 0.1.49.
 
 Entrorove applies to the whole task once selected. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 

package/local-discipline-analysis.mjs

@@ -2,6 +2,21 @@ import ts from 'typescript';
 import { archguardScriptSource } from './local-archguard-ast.mjs';
 import { canonical, sha256 } from './local-integrity.mjs';
 
+export const disciplineAnalysisLimits = Object.freeze({ fileBytes: 1_048_576, sourceBytes: 8_388_608, files: 512, nodes: 200_000 });
+function analysisLimit(file, reason, limit, required) {
+  if (required.has(file.path)) throw Object.assign(new Error(`Semantic inspection of "${file.path}" exceeds ${reason} (${limit}); preserve the original flow and split its approved source inspection before retrying`),
+    { code: 'ENTROROVE_DISCIPLINE_ANALYSIS_LIMIT' });
+  return { path: file.path, reason, limit };
+}
+function syntaxNodes(source, limit) {
+  const pending = [source]; let count = 0;
+  while (pending.length) {
+    if (++count > limit) return count;
+    ts.forEachChild(pending.pop(), child => { pending.push(child); });
+  }
+  return count;
+}
+
 const location = (source, node) => ({ path: source.fileName, line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1 });
 const unwrap = node => {
   while (node && (ts.isAsExpression(node) || ts.isSatisfiesExpression(node) || ts.isParenthesizedExpression(node))) node = node.expression;
@@ -58,7 +73,7 @@ function definition(source, node) {
   while (ancestor && !ts.isSourceFile(ancestor) && !publicDefinition(ancestor)) ancestor = ancestor.parent;
   const exported = Boolean(ancestor && !ts.isSourceFile(ancestor));
   const contract = exported && (ts.isInterfaceDeclaration(node) || ts.isTypeAliasDeclaration(node) || ts.isEnumDeclaration(node) || ts.isFunctionDeclaration(node));
-  const signature = ts.isFunctionDeclaration(node) ? canonical({ parameters: node.parameters.map(item => item.getText(source)), type: node.type?.getText(source) ?? null }) : node.getText(source);
+  const signature = !contract ? null : ts.isFunctionDeclaration(node) ? canonical({ parameters: node.parameters.map(item => item.getText(source)), type: node.type?.getText(source) ?? null }) : node.getText(source);
   return { ...location(source, node), symbol, name, exported: Boolean(exported), contract: Boolean(contract),
     signatureDigest: contract ? sha256(signature) : null };
 }
@@ -110,11 +125,24 @@ function programFor(sources, edges) {
   });
   return ts.createProgram([...sources.keys()], { noLib: true, allowJs: true, checkJs: false }, host);
 }
-export function analyzeDisciplineSources(files, { edges = [], unresolved = [] } = {}) {
+export function analyzeDisciplineSources(files, { edges = [], unresolved = [], requiredPaths = [] } = {}) {
   const sources = new Map(), unsupported = [];
+  const required = new Set(requiredPaths); let bytes = 0, nodes = 0;
   for (const file of files) {
+    const size = Buffer.byteLength(file.content);
+    const reason = size > disciplineAnalysisLimits.fileBytes ? 'source-file-byte-limit'
+      : bytes + size > disciplineAnalysisLimits.sourceBytes ? 'source-total-byte-limit'
+        : sources.size >= disciplineAnalysisLimits.files ? 'source-file-count-limit' : null;
+    if (reason) { unsupported.push(analysisLimit(file, reason, reason === 'source-file-byte-limit' ? disciplineAnalysisLimits.fileBytes
+      : reason === 'source-total-byte-limit' ? disciplineAnalysisLimits.sourceBytes : disciplineAnalysisLimits.files, required)); continue; }
+    bytes += size;
     const parsed = archguardScriptSource(file);
     if (!parsed || parsed.parseDiagnostics.length) { unsupported.push({ path: file.path, reason: parsed ? 'syntax-unresolved' : 'language-unresolved' }); continue; }
+    const count = syntaxNodes(parsed, disciplineAnalysisLimits.nodes - nodes);
+    if (nodes + count > disciplineAnalysisLimits.nodes) {
+      unsupported.push(analysisLimit(file, 'syntax-node-limit', disciplineAnalysisLimits.nodes, required)); continue;
+    }
+    nodes += count;
     sources.set(file.path, parsed);
   }
   const program = programFor(sources, edges), checker = program.getTypeChecker(), definitions = [], mappings = [], references = new Map();

package/local-discipline-repository.mjs

@@ -5,7 +5,7 @@ import { canonical, sha256 } from './local-integrity.mjs';
 import { mutationRead14, mutationPath14, mutationTarget14, mutationFail14 } from './local-mutation-files.mjs';
 import { budgetBindingForRead } from './local-budget-reads.mjs';
 import { budgetStatus } from './local-budget.mjs';
-import { analyzeDisciplineSources } from './local-discipline-analysis.mjs';
+import { analyzeDisciplineSources, disciplineAnalysisLimits } from './local-discipline-analysis.mjs';
 import { importGraph, scopeCandidateImports } from './local-scope-repository.mjs';
 import { nativeDisciplineDefinitions } from './local-discipline-native.mjs';
 
@@ -19,6 +19,14 @@ function withinBudgetScope(relative, scope) {
     && !scope.forbiddenPaths?.some(forbidden => within(relative, forbidden));
 }
 const sameFile = (left, right) => ['dev', 'ino', 'size', 'mtimeMs', 'ctimeMs', 'mode'].every(key => left[key] === right[key]);
+function sourceLimit(relative, bytes, sources, used, required) {
+  const reason = bytes > disciplineAnalysisLimits.fileBytes ? 'source-file-byte-limit'
+    : used + bytes > disciplineAnalysisLimits.sourceBytes ? 'source-total-byte-limit'
+      : sources.length >= disciplineAnalysisLimits.files ? 'source-file-count-limit' : null;
+  if (reason && required.has(relative)) mutationFail14('ENTROROVE_DISCIPLINE_ANALYSIS_LIMIT',
+    `Semantic inspection of "${relative}" (${bytes} bytes) exceeds ${reason}; limits are ${disciplineAnalysisLimits.fileBytes} bytes per file, ${disciplineAnalysisLimits.sourceBytes} total bytes and ${disciplineAnalysisLimits.files} files. Preserve the original flow and split its approved inspection before retrying`);
+  return reason;
+}
 async function integrityOnlyFile(root, relative) {
   // This path returns only an integrity digest. It never exposes source bytes or
   // contributes semantic facts outside the signed source-read scope.
@@ -47,12 +55,19 @@ async function inventory(root, prefix = '') {
 }
 export async function disciplineRepositoryObservation(input, root, { analyze = false, overrides = new Map() } = {}) {
   const paths = await inventory(root), files = [], sources = [], unresolved = [];
+  const required = new Set([...(input.paths ?? []), ...(input.targetPath ? [input.targetPath] : []), ...overrides.keys()]);
+  const ordered = [...paths].sort((a, b) => Number(required.has(b)) - Number(required.has(a)) || (a < b ? -1 : a > b ? 1 : 0));
+  let sourceBytes = 0;
   const binding = await budgetBindingForRead(input), budget = binding ? await budgetStatus(binding) : null;
   const restricted = budget?.enforced ? budget.scope : null;
   if (restricted && [...overrides.keys()].some(relative => !withinBudgetScope(relative, restricted))) {
     mutationFail14('ENTROROVE_BUDGET_SCOPE', 'candidate analysis is outside the original cloud task scope');
   }
-  for (const relative of paths) {
+  for (const [relative, content] of overrides) if (analyze && !paths.includes(relative) && semanticSource(relative)) {
+    const bytes = Buffer.byteLength(content); sourceLimit(relative, bytes, sources, sourceBytes, required);
+    sources.push({ path: relative, content }); sourceBytes += bytes;
+  }
+  for (const relative of ordered) {
     const stat = await fs.lstat(path.join(root, relative));
     if (stat.isSymbolicLink()) {
       files.push({ path: relative, sha256: sha256(await fs.readlink(path.join(root, relative))), mode: stat.mode & 0o777, kind: 'symlink' });
@@ -60,24 +75,27 @@ export async function disciplineRepositoryObservation(input, root, { analyze = f
     }
     const semantic = analyze && semanticSource(relative);
     const allowed = !restricted || withinBudgetScope(relative, restricted);
-    const read = semantic && allowed ? await mutationRead14(input, root, relative) : await integrityOnlyFile(root, relative);
+    const bytes = overrides.has(relative) ? Buffer.byteLength(overrides.get(relative)) : stat.size;
+    const limited = semantic && allowed ? sourceLimit(relative, bytes, sources, sourceBytes, required) : null;
+    const read = semantic && allowed && !limited ? await mutationRead14(input, root, relative) : await integrityOnlyFile(root, relative);
     files.push({ path: relative, sha256: read.sha256, mode: read.mode, kind: 'file' });
-    if (semantic && allowed) sources.push({ path: relative, content: overrides.get(relative) ?? read.content.toString('utf8') });
+    if (semantic && allowed && !limited) { sources.push({ path: relative, content: overrides.get(relative) ?? read.content.toString('utf8') }); sourceBytes += bytes; }
+    else if (limited) unresolved.push({ path: relative, reason: limited, bytes });
     else if (semantic && !allowed) unresolved.push({ path: relative, reason: 'outside-signed-source-scope' });
   }
   if (canonical(paths) !== canonical(await inventory(root))) mutationFail14('ENTROROVE_DISCIPLINE_SCAN_CHANGED', 'Repository inventory changed while observing its original baseline');
+  files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   const comparison = { schemaVersion: 'entrorove.repository-comparison/1.0', files,
     scope: 'whole-repository-including-ignored-files', excludedDirectoryNames: [...excluded].sort() };
   if (!analyze) return { comparison };
   // The existing resolver supplies actual aliases, package exports and import edges.
   // Unsupported/dynamic references stay unknown; they are never converted to unused.
-  const roots = sources.filter(file => /\.[cm]?[jt]sx?$/i.test(file.path)).map(file => ({ path: file.path, exists: true }));
-  for (const [relative, content] of overrides) if (!paths.includes(relative) && semanticSource(relative)) sources.push({ path: relative, content });
+  const roots = sources.filter(file => paths.includes(file.path) && /\.[cm]?[jt]sx?$/i.test(file.path)).map(file => ({ path: file.path, exists: true }));
   let graph;
-  try { graph = roots.length ? await importGraph(root, roots, input) : { edges: [], dynamicSources: [], complete: true }; }
+  try { graph = roots.length ? await importGraph(root, roots, input, disciplineAnalysisLimits) : { edges: [], dynamicSources: [], complete: true }; }
   catch (error) {
     if (!['ENTROROVE_IMPORT_UNRESOLVED', 'ENTROROVE_IMPORT_INVALID', 'ENTROROVE_IMPORT_UNSUPPORTED', 'ENTROROVE_SCOPE_LIMIT', 'ENTROROVE_BUDGET_SCOPE'].includes(error.code)) throw error;
-    graph = { edges: [], dynamicSources: [], complete: false }; unresolved.push({ reason: error.code });
+    graph = { edges: [], dynamicSources: [], complete: false }; unresolved.push({ reason: error.code, message: error.message });
   }
   for (const [relative, content] of overrides) if (semanticSource(relative) && /\.[cm]?[jt]sx?$/i.test(relative)) {
     try {
@@ -89,7 +107,7 @@ export async function disciplineRepositoryObservation(input, root, { analyze = f
       unresolved.push({ path: relative, reason: error.code });
     }
   }
-  const analysis = analyzeDisciplineSources(sources, { edges: graph.edges,
+  const analysis = analyzeDisciplineSources(sources, { edges: graph.edges, requiredPaths: [...required],
     unresolved: [...unresolved, ...graph.dynamicSources.map(item => ({ path: item.path, reason: 'dynamic-import' }))] });
   analysis.definitions.push(...await nativeDisciplineDefinitions(sources));
   return { comparison, analysis, scanComplete: graph.complete && analysis.unresolved.length === 0 };

package/local-scope-repository.mjs

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { promisify } from 'node:util';
 import { builtinModules } from 'node:module';
 import ts from 'typescript';
-import { parse as parseVue } from '@vue/compiler-sfc';
+import { parse as parseVue, parseCache as vueParseCache } from '@vue/compiler-sfc';
 import { lineCount, observedScopeRisk, packageBoundary, scopeFail, scopeFiles, scopeRead, scopeTarget, stableScope } from './local-scope-files.mjs';
 import { sha256 } from './local-integrity.mjs';
 import { workspaceImport, workspaceIndex } from './local-scope-workspaces.mjs';
@@ -142,6 +142,7 @@ function scriptImports(source, filename) {
 function vueScripts(source, filename) {
   const { descriptor, errors } = parseVue(source, { filename, sourceMap: false,
     templateParseOptions: { expressionPlugins: ['typescript'] } });
+  vueParseCache.clear();
   if (errors.length) scopeFail('ENTROROVE_IMPORT_INVALID', 'component has invalid or unterminated syntax');
   if (descriptor.customBlocks.length || descriptor.template?.lang || descriptor.template?.src) {
     scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'component dependency inspection requires supported inline template syntax');
@@ -225,14 +226,22 @@ async function resolveLocalImport(root, relative, required = true) {
   if (required) scopeFail('ENTROROVE_IMPORT_UNRESOLVED', 'a local import has no resolvable source file');
   return null;
 }
-export async function importGraph(root, originals, input = { repositoryRoot: root }) {
+export async function importGraph(root, originals, input = { repositoryRoot: root }, limits = {}) {
   const pending = originals.filter(file => file.exists !== false).map(file => file.path); const visited = new Map(); const edges = []; let dynamic = false;
+  let sourceBytes = 0;
   const dynamicSources = [];
   const workspace = await workspaceIndex(root, input);
   const metadata = new Map(workspace.metadata.map(item => [item.path, item]));
   while (pending.length) {
     const relative = pending.shift(); if (visited.has(relative)) continue;
     if (visited.size >= 1000) scopeFail('ENTROROVE_SCOPE_LIMIT', 'import graph exceeds the 1000-file inspection bound');
+    if (limits.fileBytes || limits.sourceBytes) {
+      const target = await scopeTarget(root, relative, false, dependencyReference(relative));
+      if (target.stat.size > (limits.fileBytes ?? Infinity) || sourceBytes + target.stat.size > (limits.sourceBytes ?? Infinity)) {
+        scopeFail('ENTROROVE_SCOPE_LIMIT', `Import inspection of "${relative}" (${target.stat.size} bytes) exceeds its bounded semantic scan (${limits.fileBytes} bytes per file, ${limits.sourceBytes} total bytes)`);
+      }
+      sourceBytes += target.stat.size;
+    }
     const read = await scopeRead(root, relative, input); const boundary = await packageBoundary(root, relative, input);
     visited.set(relative, { path: relative, sha256: read.sha256, module: boundary.path, boundary });
     if (!sourceExtension.test(relative)) continue;

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.48",
+  "version": "0.1.49",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.48",
+  "version": "0.1.49",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"

package/release-state.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.48",
-  "digest": "6f79c0e2c12d4e8766801bf117bcf73070156ba89fb87e4b1137c9706b8f7df3",
+  "version": "0.1.49",
+  "digest": "d30e520019bb53e3293bce84f1a960ccfa65462274c961dcc659194f2ddb3c45",
   "files": {
     "ide-code-mode.mjs": "f3f53357ba09727b3b597851976a24de93287c0faca5052448277d0904bb61f7",
     "ide-command.mjs": "dcd4b48305cc4f106e5e4509e794e4b46ef02de29afa9cccbbc2774308c81ff3",
@@ -12,14 +12,14 @@
     "ide-results.mjs": "dfe0d3f773c65a9fc21056538d7005012c982ed4509bc0410d7f62813d0863fd",
     "ide-queue.mjs": "806e716c775fd0079417027b135977c8516f47dddb0bc5ca19e32a355dab0e9e",
     "local-discipline-actions.mjs": "2379c08d0f49c44068f8239db7e514d75885f4606b1b88a7a36e4ff19167caca",
-    "local-discipline-analysis.mjs": "ebea932438a53a157d5d07a5d68366496eee121a2c67cecfb4fdb2d5aa9763eb",
+    "local-discipline-analysis.mjs": "f49e67a2eb2f19f8eb7c4226d481842b38c0f19b495ad0149cbf649baae16bb9",
     "local-discipline-batch.mjs": "2cc90dbae55efdee0c445da399c0a9acafa92e915344c25208ebca554fc4c9e9",
     "local-discipline-contracts.mjs": "6cf8a3d132fdb9074eb1441600afe7aa199df33e88a71a660d9db534c14f19e4",
     "local-discipline-contracts.d.mts": "defc684c78dc88afa1c54340ab4a01ae36db7aa11257cbe1f5cd323f608c78c4",
     "local-discipline-gate.mjs": "04b1ba092d7f4342a0e77cfbeb44d9634dbce9fec0c79e6a1e4b11a662d904ac",
     "local-discipline-native.mjs": "8b99b5ce951cab3c1426428ad807650c61c0ffb2c346d747b73b99057b382049",
     "local-discipline-operations.mjs": "9fcb7b8889b7718d42e1d37936485d8198d5017d405e0cdbbabdbbd12fcc9d48",
-    "local-discipline-repository.mjs": "d818aa6137459ef200892479cc8c47fe82c884dc0e76dc7e6d45a6b41a13c6ec",
+    "local-discipline-repository.mjs": "ffd31e9b2946a9784d4ab59cee5345318d2152816ce995ed5dac11efa4096bc4",
     "local-discipline-snapshot.mjs": "8fd35b2cfbece8f64579f144f589a66dec9b6022d50fe931c4c1f886cb83134d",
     "local-runner-discipline.mjs": "86f451de2f1e12a24f5596a29828891c1eba13cd4714ed0c18a77d66cecef934",
     "local-integrity.d.mts": "21357f306234bd841c0d3d90bf2d09f7663f63746f897b9f38190428ae8198b3",
@@ -30,7 +30,7 @@
     "snapshot-retention.mjs": "4f8919fe8ec49fb4c23e080a8ad2fa3a9282bca3fffe7cf55c64e89ef316697e",
     "snapshot-cleanup-journal.mjs": "76a9684cc95b4eb076e1298d78a9dff37948b00d9607b8f546c599072d3ed331",
     "IDE-EXECUTION.md": "6c8b9abe17cc8f01aa3da2ab19ed34b2b9be3e3b38c1739fa6a7d763622c4864",
-    "REUSE-DISCIPLINE.md": "295ecd41c931b00c21d009ab65ac160f0e2ab81b4000ed498d2e8e97c2dc6c63",
+    "REUSE-DISCIPLINE.md": "5b214cf313e7f715f52d54e28093a2d038f0f196ca64b15d1c49587b9d8eecf8",
     "reuse-discipline-release.mjs": "20ded9c21bd71b8779c454f5eba4c7c0a943ef99d94117b9bbef891d2ab6e3de",
     "local-final-gate16.mjs": "083aec470670e6cdb7ad2ab27b7a51b53a9ec3a8b4121cb9cbfa17d9940892c2",
     "local-final-gate16-checks.mjs": "1dd30e9666d458d8b12ca6e4975f6f0ac8450c3ea9cbecc7401ae037f66b589a",
@@ -122,7 +122,7 @@
     "local-scope-candidate.mjs": "8f0bd9606e70d4a0ebacdd3cd600ec3afed85e2bb3e1760aa1144cf55d4e028a",
     "local-scope-context.mjs": "79753abfc6c76089d17f003a1be537dfaea10d6731c542f7fc53f2a9996ed164",
     "local-scope-files.mjs": "96c301f2a45e5fa22f0b11fb15e5e564f118e53187fc7749263c78d5ed87b056",
-    "local-scope-repository.mjs": "0c955612d2f737e8661af84c1efb6e9e7fe6bb9ec1dfadd7776c61be177261f2",
+    "local-scope-repository.mjs": "75ccc7a527b741350c9de5baff031a9606f1b423c951f41307170605d1366360",
     "local-scope-git.mjs": "53bbbb6c4795db711b5bc164591a6ad79a561427da046d6bbe997dae6eb82829",
     "local-scope-git-reads.mjs": "5d8a2636bab955cb325cb693db7423e69512355887ae5b5af3b8cb615f5ddad0",
     "local-git-executable.mjs": "9391d716529025b1de3ee006df658a9d765b6ef29ad24ef9b7436829318e651e",

package/releases.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.1.49",
+    "date": "2026-10-16",
+    "zh": "修复本地签名快照扫描大量源码时的内存耗尽：优先分析当前授权目标，为源码与语法树设置内存边界，并及时释放 Vue 解析缓存。未完整分析的引用明确保持未知，全仓文件哈希与变更核验继续保留；超限目标返回具体路径和限制，原 flow、范围与队列可保留后重试。",
+    "en": "Fixed memory exhaustion during local signed snapshots of large source repositories: inspect authorized targets first, bound source and syntax-tree retention, and release the Vue parser cache. Unresolved references remain explicitly unknown while whole-repository hashes and change verification are retained. Oversized targets report their exact path and limit so the original flow, scope, and queue can be preserved for retry."
+  },
   {
     "version": "0.1.48",
     "date": "2026-10-16",