ctxloom-pro 1.0.17 → 1.0.18

package/apps/dashboard/dist/server/index.js

@@ -455,6 +455,27 @@ var ASTParser = class {
   kotlinLang = null;
   swiftLang = null;
   phpLang = null;
+  /**
+   * Per-language parser cache. Each TreeSitter.Parser is a
+   * WASM-allocated object; instantiating one per file (the previous
+   * behaviour) leaked memory faster than V8 could reclaim it — OOM
+   * at ~1100 files even with --max-old-space-size=8192. Reusing one
+   * parser per language for the lifetime of the ASTParser instance
+   * is exactly what the tree-sitter docs recommend.
+   *
+   * Map key is the resolved Language; the same Language object is
+   * cached per-language above (tsLang, pyLang, …) so the WeakMap is
+   * stable across calls.
+   */
+  parserCache = /* @__PURE__ */ new WeakMap();
+  getParser(language) {
+    let parser = this.parserCache.get(language);
+    if (parser) return parser;
+    parser = new TreeSitter.Parser();
+    parser.setLanguage(language);
+    this.parserCache.set(language, parser);
+    return parser;
+  }
   dartLang = null;
   grammarLoader = new GrammarLoader();
   async init() {
@@ -611,12 +632,15 @@ var ASTParser = class {
     if (ext === ".php") return this.parsePhp(filePath);
     if (ext === ".dart") return this.parseDart(filePath);
     if (ext === ".vue") return this.parseVue(filePath);
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
-    return this.extractTSNodes(tree.rootNode, filePath, source.split("\n"));
+    try {
+      return this.extractTSNodes(tree.rootNode, filePath, source.split("\n"));
+    } finally {
+      tree.delete();
+    }
   }
   extractTSNodes(rootNode, _filePath, lines) {
     const nodes = [];
@@ -793,21 +817,27 @@ var ASTParser = class {
     if (!match?.[1]?.trim()) return [];
     const scriptContent = match[1];
     if (!this.tsLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const tree = parser.parse(scriptContent);
     if (!tree) return [];
-    return this.extractTSNodes(tree.rootNode, filePath, scriptContent.split("\n"));
+    try {
+      return this.extractTSNodes(tree.rootNode, filePath, scriptContent.split("\n"));
+    } finally {
+      tree.delete();
+    }
   }
   async parsePython(filePath) {
     if (!this.pyLang) await this.loadPython();
     if (!this.pyLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.pyLang);
+    const parser = this.getParser(this.pyLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
-    return this.extractPythonNodes(tree.rootNode, filePath, source);
+    try {
+      return this.extractPythonNodes(tree.rootNode, filePath, source);
+    } finally {
+      tree.delete();
+    }
   }
   async parseNotebook(filePath) {
     if (!this.pyLang) await this.loadPython();
@@ -816,11 +846,14 @@ var ASTParser = class {
       const raw = fs2.readFileSync(filePath, "utf-8");
       const pythonSource = extractNotebookPythonSource(raw);
       if (!pythonSource.trim()) return [];
-      const parser = new TreeSitter.Parser();
-      parser.setLanguage(this.pyLang);
+      const parser = this.getParser(this.pyLang);
       const tree = parser.parse(pythonSource);
       if (!tree) return [];
-      return this.extractPythonNodes(tree.rootNode, filePath, pythonSource);
+      try {
+        return this.extractPythonNodes(tree.rootNode, filePath, pythonSource);
+      } finally {
+        tree.delete();
+      }
     } catch {
       return [];
     }
@@ -903,8 +936,7 @@ var ASTParser = class {
   async parseGo(filePath) {
     if (!this.goLang) await this.loadGo();
     if (!this.goLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.goLang);
+    const parser = this.getParser(this.goLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -984,14 +1016,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseRust(filePath) {
     if (!this.rustLang) await this.loadRust();
     if (!this.rustLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.rustLang);
+    const parser = this.getParser(this.rustLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1093,14 +1128,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseJava(filePath) {
     if (!this.javaLang) await this.loadJava();
     if (!this.javaLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.javaLang);
+    const parser = this.getParser(this.javaLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1193,14 +1231,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseCSharp(filePath) {
     if (!this.csLang) await this.loadCSharp();
     if (!this.csLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.csLang);
+    const parser = this.getParser(this.csLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1271,14 +1312,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseRuby(filePath) {
     if (!this.rubyLang) await this.loadRuby();
     if (!this.rubyLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.rubyLang);
+    const parser = this.getParser(this.rubyLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1334,14 +1378,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseKotlin(filePath) {
     if (!this.kotlinLang) await this.loadKotlin();
     if (!this.kotlinLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.kotlinLang);
+    const parser = this.getParser(this.kotlinLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1394,14 +1441,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseSwift(filePath) {
     if (!this.swiftLang) await this.loadSwift();
     if (!this.swiftLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.swiftLang);
+    const parser = this.getParser(this.swiftLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1466,14 +1516,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parsePhp(filePath) {
     if (!this.phpLang) await this.loadPhp();
     if (!this.phpLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.phpLang);
+    const parser = this.getParser(this.phpLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1545,14 +1598,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseDart(filePath) {
     if (!this.dartLang) await this.loadDart();
     if (!this.dartLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.dartLang);
+    const parser = this.getParser(this.dartLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1607,16 +1663,19 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   /**
    * Find all call sites of a symbol in a file.
    */
   async findCallSites(filePath, symbolName) {
     if (!this.tsLang) throw new Error("ASTParser not initialized. Call init() first.");
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1641,8 +1700,12 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return results;
+    try {
+      walk(tree.rootNode);
+      return results;
+    } finally {
+      tree.delete();
+    }
   }
   /**
    * Extract all call edges in a TypeScript/TSX file.
@@ -1651,8 +1714,7 @@ var ASTParser = class {
    */
   async parseAllCallEdges(filePath) {
     if (!this.tsLang) throw new Error("ASTParser not initialized. Call init() first.");
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1683,8 +1745,12 @@ var ASTParser = class {
         if (child) walk(child, newStack);
       }
     };
-    walk(tree.rootNode, []);
-    return results;
+    try {
+      walk(tree.rootNode, []);
+      return results;
+    } finally {
+      tree.delete();
+    }
   }
 };
 
@@ -3771,27 +3837,68 @@ var Skeletonizer = class {
   }
   /**
    * Produce a plain-text skeleton of the file.
+   *
+   * Three layers of pathological-input defense — without them, a single
+   * minified bundled file (e.g. Next.js ships entire compiled vendor
+   * packages as 466KB-on-16-lines `.cjs` files) explodes into hundreds
+   * of MB of output. The `import` and `interface` cases call
+   * `readLines(node.startLine, node.endLine)`; on minified one-line
+   * source where every node spans the whole file, that returns the
+   * entire file each time, and many such nodes repeat the duplication.
+   * Observed: 466KB → 211MB (452× expansion) on @vercel/blob's compiled
+   * bundle in next.js. Defenses, in order of cheapest:
+   *
+   *   1. `MAX_INPUT_BYTES` — skip files larger than 256KB. AI context
+   *      tools shouldn't be skeletonizing pre-built vendor bundles
+   *      anyway; they're not human-authored source.
+   *   2. Average-line-length heuristic — if mean line >1KB, treat as
+   *      minified and skip. Catches the .cjs/.min.js pattern that
+   *      slips under the 256KB ceiling.
+   *   3. `MAX_OUTPUT_BYTES` running cap — belt-and-suspenders against
+   *      anything the first two miss. Stop appending and return what
+   *      we have rather than OOM.
+   *
+   * Skipped files return a single comment so callers can distinguish
+   * "deliberately skipped" from "skeletonized to empty".
    */
   async skeletonize(filePath) {
+    const fileSource = fs13.readFileSync(filePath, "utf-8");
+    const fileLines = fileSource.split("\n");
+    const MAX_INPUT_BYTES = 256 * 1024;
+    if (fileSource.length > MAX_INPUT_BYTES) {
+      return `// Source: ${filePath}
+// (skipped: ${fileSource.length} bytes exceeds ${MAX_INPUT_BYTES} byte limit; likely a bundled vendor file)`;
+    }
+    const meanLineBytes = fileSource.length / Math.max(fileLines.length, 1);
+    if (meanLineBytes > 1024) {
+      return `// Source: ${filePath}
+// (skipped: appears minified \u2014 ${fileLines.length} lines for ${fileSource.length} bytes)`;
+    }
     const nodes = await this.parser.parse(filePath);
-    const fileLines = fs13.readFileSync(filePath, "utf-8").split("\n");
     const lines = [`// Source: ${filePath}`];
+    const MAX_OUTPUT_BYTES = 1024 * 1024;
+    let outputBytes = lines[0].length;
     for (const node of nodes) {
+      if (outputBytes > MAX_OUTPUT_BYTES) {
+        lines.push(`// (output truncated at ${MAX_OUTPUT_BYTES} bytes)`);
+        break;
+      }
+      let chunk = "";
       switch (node.type) {
         case "import":
-          lines.push(this.readLines(fileLines, node.startLine, node.endLine));
+          chunk = this.readLines(fileLines, node.startLine, node.endLine);
           break;
         case "interface":
-          lines.push(this.readLines(fileLines, node.startLine, node.endLine));
+          chunk = this.readLines(fileLines, node.startLine, node.endLine);
           break;
         case "function":
-          lines.push(`${node.signature};`);
+          chunk = `${node.signature};`;
           break;
         case "arrow_function":
-          lines.push(`${node.signature};`);
+          chunk = `${node.signature};`;
           break;
         case "export_default":
-          lines.push(`${node.signature};`);
+          chunk = `${node.signature};`;
           break;
         case "class": {
           const methodLines = (node.methodRanges ?? []).map((mr) => {
@@ -3801,12 +3908,16 @@ var Skeletonizer = class {
           if (methodLines.length === 0 && node.methods) {
             node.methods.forEach((m) => methodLines.push(`  ${m}(...): unknown;`));
           }
-          lines.push(`class ${node.name} {
+          chunk = `class ${node.name} {
 ${methodLines.join("\n")}
-}`);
+}`;
           break;
         }
       }
+      if (chunk) {
+        lines.push(chunk);
+        outputBytes += chunk.length + 1;
+      }
     }
     return lines.join("\n");
   }

package/dist/{chunk-7D275UON.js → chunk-EHFVPRTN.js}

@@ -303,6 +303,27 @@ var ASTParser = class {
   kotlinLang = null;
   swiftLang = null;
   phpLang = null;
+  /**
+   * Per-language parser cache. Each TreeSitter.Parser is a
+   * WASM-allocated object; instantiating one per file (the previous
+   * behaviour) leaked memory faster than V8 could reclaim it — OOM
+   * at ~1100 files even with --max-old-space-size=8192. Reusing one
+   * parser per language for the lifetime of the ASTParser instance
+   * is exactly what the tree-sitter docs recommend.
+   *
+   * Map key is the resolved Language; the same Language object is
+   * cached per-language above (tsLang, pyLang, …) so the WeakMap is
+   * stable across calls.
+   */
+  parserCache = /* @__PURE__ */ new WeakMap();
+  getParser(language) {
+    let parser = this.parserCache.get(language);
+    if (parser) return parser;
+    parser = new TreeSitter.Parser();
+    parser.setLanguage(language);
+    this.parserCache.set(language, parser);
+    return parser;
+  }
   dartLang = null;
   grammarLoader = new GrammarLoader();
   async init() {
@@ -459,12 +480,15 @@ var ASTParser = class {
     if (ext === ".php") return this.parsePhp(filePath);
     if (ext === ".dart") return this.parseDart(filePath);
     if (ext === ".vue") return this.parseVue(filePath);
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
-    return this.extractTSNodes(tree.rootNode, filePath, source.split("\n"));
+    try {
+      return this.extractTSNodes(tree.rootNode, filePath, source.split("\n"));
+    } finally {
+      tree.delete();
+    }
   }
   extractTSNodes(rootNode, _filePath, lines) {
     const nodes = [];
@@ -641,21 +665,27 @@ var ASTParser = class {
     if (!match?.[1]?.trim()) return [];
     const scriptContent = match[1];
     if (!this.tsLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const tree = parser.parse(scriptContent);
     if (!tree) return [];
-    return this.extractTSNodes(tree.rootNode, filePath, scriptContent.split("\n"));
+    try {
+      return this.extractTSNodes(tree.rootNode, filePath, scriptContent.split("\n"));
+    } finally {
+      tree.delete();
+    }
   }
   async parsePython(filePath) {
     if (!this.pyLang) await this.loadPython();
     if (!this.pyLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.pyLang);
+    const parser = this.getParser(this.pyLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
-    return this.extractPythonNodes(tree.rootNode, filePath, source);
+    try {
+      return this.extractPythonNodes(tree.rootNode, filePath, source);
+    } finally {
+      tree.delete();
+    }
   }
   async parseNotebook(filePath) {
     if (!this.pyLang) await this.loadPython();
@@ -664,11 +694,14 @@ var ASTParser = class {
       const raw = fs2.readFileSync(filePath, "utf-8");
       const pythonSource = extractNotebookPythonSource(raw);
       if (!pythonSource.trim()) return [];
-      const parser = new TreeSitter.Parser();
-      parser.setLanguage(this.pyLang);
+      const parser = this.getParser(this.pyLang);
       const tree = parser.parse(pythonSource);
       if (!tree) return [];
-      return this.extractPythonNodes(tree.rootNode, filePath, pythonSource);
+      try {
+        return this.extractPythonNodes(tree.rootNode, filePath, pythonSource);
+      } finally {
+        tree.delete();
+      }
     } catch {
       return [];
     }
@@ -751,8 +784,7 @@ var ASTParser = class {
   async parseGo(filePath) {
     if (!this.goLang) await this.loadGo();
     if (!this.goLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.goLang);
+    const parser = this.getParser(this.goLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -832,14 +864,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseRust(filePath) {
     if (!this.rustLang) await this.loadRust();
     if (!this.rustLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.rustLang);
+    const parser = this.getParser(this.rustLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -941,14 +976,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseJava(filePath) {
     if (!this.javaLang) await this.loadJava();
     if (!this.javaLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.javaLang);
+    const parser = this.getParser(this.javaLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1041,14 +1079,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseCSharp(filePath) {
     if (!this.csLang) await this.loadCSharp();
     if (!this.csLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.csLang);
+    const parser = this.getParser(this.csLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1119,14 +1160,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseRuby(filePath) {
     if (!this.rubyLang) await this.loadRuby();
     if (!this.rubyLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.rubyLang);
+    const parser = this.getParser(this.rubyLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1182,14 +1226,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseKotlin(filePath) {
     if (!this.kotlinLang) await this.loadKotlin();
     if (!this.kotlinLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.kotlinLang);
+    const parser = this.getParser(this.kotlinLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1242,14 +1289,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseSwift(filePath) {
     if (!this.swiftLang) await this.loadSwift();
     if (!this.swiftLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.swiftLang);
+    const parser = this.getParser(this.swiftLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1314,14 +1364,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parsePhp(filePath) {
     if (!this.phpLang) await this.loadPhp();
     if (!this.phpLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.phpLang);
+    const parser = this.getParser(this.phpLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1393,14 +1446,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseDart(filePath) {
     if (!this.dartLang) await this.loadDart();
     if (!this.dartLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.dartLang);
+    const parser = this.getParser(this.dartLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1455,16 +1511,19 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   /**
    * Find all call sites of a symbol in a file.
    */
   async findCallSites(filePath, symbolName) {
     if (!this.tsLang) throw new Error("ASTParser not initialized. Call init() first.");
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1489,8 +1548,12 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return results;
+    try {
+      walk(tree.rootNode);
+      return results;
+    } finally {
+      tree.delete();
+    }
   }
   /**
    * Extract all call edges in a TypeScript/TSX file.
@@ -1499,8 +1562,7 @@ var ASTParser = class {
    */
   async parseAllCallEdges(filePath) {
     if (!this.tsLang) throw new Error("ASTParser not initialized. Call init() first.");
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1531,8 +1593,12 @@ var ASTParser = class {
         if (child) walk(child, newStack);
       }
     };
-    walk(tree.rootNode, []);
-    return results;
+    try {
+      walk(tree.rootNode, []);
+      return results;
+    } finally {
+      tree.delete();
+    }
   }
 };
 
@@ -4051,27 +4117,68 @@ var Skeletonizer = class {
   }
   /**
    * Produce a plain-text skeleton of the file.
+   *
+   * Three layers of pathological-input defense — without them, a single
+   * minified bundled file (e.g. Next.js ships entire compiled vendor
+   * packages as 466KB-on-16-lines `.cjs` files) explodes into hundreds
+   * of MB of output. The `import` and `interface` cases call
+   * `readLines(node.startLine, node.endLine)`; on minified one-line
+   * source where every node spans the whole file, that returns the
+   * entire file each time, and many such nodes repeat the duplication.
+   * Observed: 466KB → 211MB (452× expansion) on @vercel/blob's compiled
+   * bundle in next.js. Defenses, in order of cheapest:
+   *
+   *   1. `MAX_INPUT_BYTES` — skip files larger than 256KB. AI context
+   *      tools shouldn't be skeletonizing pre-built vendor bundles
+   *      anyway; they're not human-authored source.
+   *   2. Average-line-length heuristic — if mean line >1KB, treat as
+   *      minified and skip. Catches the .cjs/.min.js pattern that
+   *      slips under the 256KB ceiling.
+   *   3. `MAX_OUTPUT_BYTES` running cap — belt-and-suspenders against
+   *      anything the first two miss. Stop appending and return what
+   *      we have rather than OOM.
+   *
+   * Skipped files return a single comment so callers can distinguish
+   * "deliberately skipped" from "skeletonized to empty".
    */
   async skeletonize(filePath) {
+    const fileSource = fs12.readFileSync(filePath, "utf-8");
+    const fileLines = fileSource.split("\n");
+    const MAX_INPUT_BYTES = 256 * 1024;
+    if (fileSource.length > MAX_INPUT_BYTES) {
+      return `// Source: ${filePath}
+// (skipped: ${fileSource.length} bytes exceeds ${MAX_INPUT_BYTES} byte limit; likely a bundled vendor file)`;
+    }
+    const meanLineBytes = fileSource.length / Math.max(fileLines.length, 1);
+    if (meanLineBytes > 1024) {
+      return `// Source: ${filePath}
+// (skipped: appears minified \u2014 ${fileLines.length} lines for ${fileSource.length} bytes)`;
+    }
     const nodes = await this.parser.parse(filePath);
-    const fileLines = fs12.readFileSync(filePath, "utf-8").split("\n");
     const lines = [`// Source: ${filePath}`];
+    const MAX_OUTPUT_BYTES = 1024 * 1024;
+    let outputBytes = lines[0].length;
     for (const node of nodes) {
+      if (outputBytes > MAX_OUTPUT_BYTES) {
+        lines.push(`// (output truncated at ${MAX_OUTPUT_BYTES} bytes)`);
+        break;
+      }
+      let chunk = "";
       switch (node.type) {
         case "import":
-          lines.push(this.readLines(fileLines, node.startLine, node.endLine));
+          chunk = this.readLines(fileLines, node.startLine, node.endLine);
           break;
         case "interface":
-          lines.push(this.readLines(fileLines, node.startLine, node.endLine));
+          chunk = this.readLines(fileLines, node.startLine, node.endLine);
           break;
         case "function":
-          lines.push(`${node.signature};`);
+          chunk = `${node.signature};`;
           break;
         case "arrow_function":
-          lines.push(`${node.signature};`);
+          chunk = `${node.signature};`;
           break;
         case "export_default":
-          lines.push(`${node.signature};`);
+          chunk = `${node.signature};`;
           break;
         case "class": {
           const methodLines = (node.methodRanges ?? []).map((mr) => {
@@ -4081,12 +4188,16 @@ var Skeletonizer = class {
           if (methodLines.length === 0 && node.methods) {
             node.methods.forEach((m) => methodLines.push(`  ${m}(...): unknown;`));
           }
-          lines.push(`class ${node.name} {
+          chunk = `class ${node.name} {
 ${methodLines.join("\n")}
-}`);
+}`;
           break;
         }
       }
+      if (chunk) {
+        lines.push(chunk);
+        outputBytes += chunk.length + 1;
+      }
     }
     return lines.join("\n");
   }
@@ -8420,4 +8531,4 @@ export {
   track,
   captureError
 };
-//# sourceMappingURL=chunk-7D275UON.js.map
+//# sourceMappingURL=chunk-EHFVPRTN.js.map

package/dist/index.js

@@ -34,7 +34,7 @@ import {
   startTrial,
   track,
   writeCODEOWNERS
-} from "./chunk-7D275UON.js";
+} from "./chunk-EHFVPRTN.js";
 import {
   VectorStore
 } from "./chunk-NEHYSE2Y.js";
@@ -512,7 +512,7 @@ try {
 } catch {
 }
 var args = process.argv.slice(2);
-var ctxloomVersion = "1.0.17".length > 0 ? "1.0.17" : "dev";
+var ctxloomVersion = "1.0.18".length > 0 ? "1.0.18" : "dev";
 if (args.includes("--version") || args.includes("-v")) {
   process.stdout.write(`ctxloom ${ctxloomVersion}
 `);
@@ -585,7 +585,7 @@ async function checkLicense() {
   if (command !== void 0 && LICENSE_GATE_BYPASS_COMMANDS.has(command)) return;
   const ciKey = process.env["CTXLOOM_LICENSE_KEY"];
   if (ciKey) {
-    const { ApiClient } = await import("./src-WB7EQTRV.js");
+    const { ApiClient } = await import("./src-IHPQZOZE.js");
     const client = new ApiClient(process.env["CTXLOOM_API_BASE"]);
     try {
       const result = await client.validate(ciKey, "ci-ephemeral");
@@ -1112,7 +1112,7 @@ Suggested reviewers for ${files.length} file(s):`);
         process.stderr.write("[ctxloom] --limit must be a non-negative integer (0 for unlimited)\n");
         process.exit(2);
       }
-      const { loadRulesConfig, RulesChecker, formatText, formatJson, RulesConfigError } = await import("./src-WB7EQTRV.js");
+      const { loadRulesConfig, RulesChecker, formatText, formatJson, RulesConfigError } = await import("./src-IHPQZOZE.js");
       let config;
       try {
         config = await loadRulesConfig(root);
@@ -1136,7 +1136,7 @@ Suggested reviewers for ${files.length} file(s):`);
       }
       let graph;
       if (useSnapshot) {
-        const { DependencyGraph: DG } = await import("./src-WB7EQTRV.js");
+        const { DependencyGraph: DG } = await import("./src-IHPQZOZE.js");
         graph = new DG();
         const loaded = await graph.loadSnapshotOnly(root);
         if (!loaded) {
@@ -1145,7 +1145,7 @@ Suggested reviewers for ${files.length} file(s):`);
         }
       } else {
         process.stderr.write("[ctxloom] Building dependency graph...\n");
-        const { ASTParser: ASTParser2, DependencyGraph: DependencyGraph2 } = await import("./src-WB7EQTRV.js");
+        const { ASTParser: ASTParser2, DependencyGraph: DependencyGraph2 } = await import("./src-IHPQZOZE.js");
         let parser;
         try {
           parser = new ASTParser2();

package/dist/{src-WB7EQTRV.js → src-IHPQZOZE.js}

@@ -69,7 +69,7 @@ import {
   startTrial,
   track,
   writeCODEOWNERS
-} from "./chunk-7D275UON.js";
+} from "./chunk-EHFVPRTN.js";
 import {
   VectorStore
 } from "./chunk-NEHYSE2Y.js";
@@ -160,4 +160,4 @@ export {
   track,
   writeCODEOWNERS
 };
-//# sourceMappingURL=src-WB7EQTRV.js.map
+//# sourceMappingURL=src-IHPQZOZE.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ctxloom-pro",
-  "version": "1.0.17",
+  "version": "1.0.18",
   "description": "ctxloom — The Universal Code Context Engine. A local-first MCP server providing intelligent code context via hybrid Vector + AST + Graph search with Skeletonization (92% token reduction).",
   "type": "module",
   "main": "dist/index.js",