ctxloom-pro 1.0.17 → 1.0.19

package/README.md

@@ -70,19 +70,39 @@ Set `CTXLOOM_LICENSE_KEY` in your CI secrets. The key is validated on every run
 
 ### Manual MCP Configuration
 
+This is what `ctxloom setup` writes for you. Match it by hand if you prefer:
+
 ```jsonc
-// ~/.claude/claude_desktop_config.json  (or equivalent)
+// Claude Code:    ~/.claude.json
+// Cursor:         ~/.cursor/mcp.json
+// Codex CLI:      ~/.codex/mcp.json
+// Kimi:           ~/.kimi/mcp.json
+// Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json
 {
   "mcpServers": {
     "ctxloom": {
-      "command": "npx",
-      "args": ["-y", "ctxloom"]
+      "command": "ctxloom",
+      "args": []
     }
   }
 }
 ```
 
-> If installed globally: `"command": "ctxloom"` with `"args": []`.
+The MCP server inherits cwd from the host. Claude Code, Cursor, Codex, and Kimi all spawn it with the open project as cwd, so the right project is indexed automatically — no `CTXLOOM_ROOT` needed.
+
+For hosts without a project concept (Claude Desktop, CI), set the root explicitly:
+
+```jsonc
+{
+  "mcpServers": {
+    "ctxloom": {
+      "command": "ctxloom",
+      "args": [],
+      "env": { "CTXLOOM_ROOT": "/path/to/project" }
+    }
+  }
+}
+```
 >
 > Pricing: **Pro** €9.90/mo or €99/yr (1 machine) · **Team** €19.90/mo or €199/yr (3 machines) · [ctxloom.com/pricing](https://ctxloom.com/pricing)
 
@@ -355,7 +375,7 @@ The tool reads `.ctxloom/rules.yml` and the live dependency graph on every call
 
 ---
 
-## Tools — 32 total
+## Tools — 33 total
 
 ### Search & Context
 
@@ -388,6 +408,7 @@ The tool reads `.ctxloom/rules.yml` and the live dependency graph on every call
 | `ctx_get_call_graph` | Bidirectional call graph traversal with configurable depth |
 | `ctx_get_definition` | Symbol definition lookup via AST index |
 | `ctx_execution_flow` | DFS call graph traversal from entry point with cycle detection |
+| `ctx_get_affected_flows` | Which flows are affected by changed files? Traces back to root callers, then forward — auto-detects from `git diff HEAD~1` |
 | `ctx_refactor_preview` | Read-only symbol rename diff preview — see every change before applying |
 | `ctx_apply_refactor` | Write symbol renames to disk atomically (supports dry_run) |
 
@@ -487,10 +508,10 @@ ctxloom --help                   Show help
 | Ruby | ✅ Relative paths | ✅ | ✅ |
 | Kotlin | ✅ Package imports | ✅ | ✅ |
 | Swift | ✅ Module imports | ✅ | ✅ |
-| PHP | ✅ PSR-4 + require_once | ✅ | ❌ |
-| Dart | ✅ Relative imports | ✅ | ❌ |
-| Vue SFC | ✅ Script block | ✅ | ❌ |
-| Jupyter Notebook | ✅ Python cell imports | ✅ | ❌ |
+| PHP | ✅ PSR-4 + require_once | ✅ | ✅ |
+| Dart | ✅ Relative imports | ✅ | ✅ |
+| Vue SFC | ✅ Script block | ✅ | ✅ |
+| Jupyter Notebook | ✅ Python cell imports | ✅ | ✅ |
 
 ---
 
@@ -501,7 +522,7 @@ ctxloom --help                   Show help
 │                      MCP Interface                       │
 │                   (Stdio transport)                      │
 ├──────────────────────────────────────────────────────────┤
-│                    32 Tools (ToolRegistry)                │
+│                    33 Tools (ToolRegistry)                │
 │  Search · Graph Intelligence · Navigation · Review       │
 ├──────────────────────────────────────────────────────────┤
 │                    Context Engine                         │
@@ -543,18 +564,18 @@ See [`benchmarks/README.md`](benchmarks/README.md) for methodology and how to re
 
 ## Token reduction benchmarks
 
-Measured on real open-source repos with realistic review scenarios (skeletonization applies to JS/TS files; Python and Rust show graph indexing metrics only):
+Full-source skeletonization on real open-source frameworks — every TS/JS file (skipping tests, `.d.ts`, build output, minified vendor bundles).
 
-| Repository | Language | Files | Raw tokens | Skeleton tokens | Reduction |
-|---|---|---|---|---|---|
-| expressjs/express | JavaScript | 141 | ~4,646 | ~390 | **92%** |
-| sindresorhus/got | TypeScript | 71 | ~10,807 | ~742 | **93%** |
-| pallets/flask | Python | 83 | n/a | n/a | n/a |
-| SergioBenitez/Rocket | Rust | 495 | ~1,281 | ~90 | **93%** |
-| fastify/fastify | JavaScript | 258 | ~2,136 | ~202 | **91%** |
-| **Average (JS/TS/RS)** | | | | | **92%** |
+| Repository | Files | Raw tokens | Skeleton tokens | Reduction |
+|---|---:|---:|---:|---:|
+| vercel/next.js | 2,742 | ~12.2M | ~584k | **95%** |
+| honojs/hono | 200 | ~185k | ~30k | **84%** |
+| vitejs/vite | 1,032 | ~459k | ~105k | **77%** |
+| withastro/astro | 875 | ~805k | ~191k | **76%** |
+| nestjs/nest | 1,305 | ~409k | ~177k | **57%** |
+| **Weighted average · 6,154 files** | | **~14.1M** | **~1.1M** | **92%** |
 
-Token counts use the standard 4 chars/token approximation. Results saved in [`benchmarks/public-repos-results.json`](benchmarks/public-repos-results.json). Run `npm run bench:repos` to reproduce.
+Token counts use the standard 4 chars/token approximation. Per-repo range (57–95%) reflects file-shape sensitivity: codebases with lots of tiny re-export shims compress less than ones with meatier source. Results saved in [`benchmarks/large-repos-results.json`](benchmarks/large-repos-results.json). Run `npm run bench:repos` to reproduce.
 
 ---
 

package/apps/dashboard/dist/server/index.js

@@ -455,6 +455,27 @@ var ASTParser = class {
   kotlinLang = null;
   swiftLang = null;
   phpLang = null;
+  /**
+   * Per-language parser cache. Each TreeSitter.Parser is a
+   * WASM-allocated object; instantiating one per file (the previous
+   * behaviour) leaked memory faster than V8 could reclaim it — OOM
+   * at ~1100 files even with --max-old-space-size=8192. Reusing one
+   * parser per language for the lifetime of the ASTParser instance
+   * is exactly what the tree-sitter docs recommend.
+   *
+   * Map key is the resolved Language; the same Language object is
+   * cached per-language above (tsLang, pyLang, …) so the WeakMap is
+   * stable across calls.
+   */
+  parserCache = /* @__PURE__ */ new WeakMap();
+  getParser(language) {
+    let parser = this.parserCache.get(language);
+    if (parser) return parser;
+    parser = new TreeSitter.Parser();
+    parser.setLanguage(language);
+    this.parserCache.set(language, parser);
+    return parser;
+  }
   dartLang = null;
   grammarLoader = new GrammarLoader();
   async init() {
@@ -611,12 +632,15 @@ var ASTParser = class {
     if (ext === ".php") return this.parsePhp(filePath);
     if (ext === ".dart") return this.parseDart(filePath);
     if (ext === ".vue") return this.parseVue(filePath);
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
-    return this.extractTSNodes(tree.rootNode, filePath, source.split("\n"));
+    try {
+      return this.extractTSNodes(tree.rootNode, filePath, source.split("\n"));
+    } finally {
+      tree.delete();
+    }
   }
   extractTSNodes(rootNode, _filePath, lines) {
     const nodes = [];
@@ -793,21 +817,27 @@ var ASTParser = class {
     if (!match?.[1]?.trim()) return [];
     const scriptContent = match[1];
     if (!this.tsLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const tree = parser.parse(scriptContent);
     if (!tree) return [];
-    return this.extractTSNodes(tree.rootNode, filePath, scriptContent.split("\n"));
+    try {
+      return this.extractTSNodes(tree.rootNode, filePath, scriptContent.split("\n"));
+    } finally {
+      tree.delete();
+    }
   }
   async parsePython(filePath) {
     if (!this.pyLang) await this.loadPython();
     if (!this.pyLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.pyLang);
+    const parser = this.getParser(this.pyLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
-    return this.extractPythonNodes(tree.rootNode, filePath, source);
+    try {
+      return this.extractPythonNodes(tree.rootNode, filePath, source);
+    } finally {
+      tree.delete();
+    }
   }
   async parseNotebook(filePath) {
     if (!this.pyLang) await this.loadPython();
@@ -816,11 +846,14 @@ var ASTParser = class {
       const raw = fs2.readFileSync(filePath, "utf-8");
       const pythonSource = extractNotebookPythonSource(raw);
       if (!pythonSource.trim()) return [];
-      const parser = new TreeSitter.Parser();
-      parser.setLanguage(this.pyLang);
+      const parser = this.getParser(this.pyLang);
       const tree = parser.parse(pythonSource);
       if (!tree) return [];
-      return this.extractPythonNodes(tree.rootNode, filePath, pythonSource);
+      try {
+        return this.extractPythonNodes(tree.rootNode, filePath, pythonSource);
+      } finally {
+        tree.delete();
+      }
     } catch {
       return [];
     }
@@ -903,8 +936,7 @@ var ASTParser = class {
   async parseGo(filePath) {
     if (!this.goLang) await this.loadGo();
     if (!this.goLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.goLang);
+    const parser = this.getParser(this.goLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -984,14 +1016,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseRust(filePath) {
     if (!this.rustLang) await this.loadRust();
     if (!this.rustLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.rustLang);
+    const parser = this.getParser(this.rustLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1093,14 +1128,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseJava(filePath) {
     if (!this.javaLang) await this.loadJava();
     if (!this.javaLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.javaLang);
+    const parser = this.getParser(this.javaLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1193,14 +1231,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseCSharp(filePath) {
     if (!this.csLang) await this.loadCSharp();
     if (!this.csLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.csLang);
+    const parser = this.getParser(this.csLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1271,14 +1312,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseRuby(filePath) {
     if (!this.rubyLang) await this.loadRuby();
     if (!this.rubyLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.rubyLang);
+    const parser = this.getParser(this.rubyLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1334,14 +1378,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseKotlin(filePath) {
     if (!this.kotlinLang) await this.loadKotlin();
     if (!this.kotlinLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.kotlinLang);
+    const parser = this.getParser(this.kotlinLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1394,14 +1441,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseSwift(filePath) {
     if (!this.swiftLang) await this.loadSwift();
     if (!this.swiftLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.swiftLang);
+    const parser = this.getParser(this.swiftLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1466,14 +1516,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parsePhp(filePath) {
     if (!this.phpLang) await this.loadPhp();
     if (!this.phpLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.phpLang);
+    const parser = this.getParser(this.phpLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1545,14 +1598,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseDart(filePath) {
     if (!this.dartLang) await this.loadDart();
     if (!this.dartLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.dartLang);
+    const parser = this.getParser(this.dartLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1607,16 +1663,19 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   /**
    * Find all call sites of a symbol in a file.
    */
   async findCallSites(filePath, symbolName) {
     if (!this.tsLang) throw new Error("ASTParser not initialized. Call init() first.");
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1641,8 +1700,12 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return results;
+    try {
+      walk(tree.rootNode);
+      return results;
+    } finally {
+      tree.delete();
+    }
   }
   /**
    * Extract all call edges in a TypeScript/TSX file.
@@ -1651,8 +1714,7 @@ var ASTParser = class {
    */
   async parseAllCallEdges(filePath) {
     if (!this.tsLang) throw new Error("ASTParser not initialized. Call init() first.");
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1683,8 +1745,12 @@ var ASTParser = class {
         if (child) walk(child, newStack);
       }
     };
-    walk(tree.rootNode, []);
-    return results;
+    try {
+      walk(tree.rootNode, []);
+      return results;
+    } finally {
+      tree.delete();
+    }
   }
 };
 
@@ -3771,27 +3837,68 @@ var Skeletonizer = class {
   }
   /**
    * Produce a plain-text skeleton of the file.
+   *
+   * Three layers of pathological-input defense — without them, a single
+   * minified bundled file (e.g. Next.js ships entire compiled vendor
+   * packages as 466KB-on-16-lines `.cjs` files) explodes into hundreds
+   * of MB of output. The `import` and `interface` cases call
+   * `readLines(node.startLine, node.endLine)`; on minified one-line
+   * source where every node spans the whole file, that returns the
+   * entire file each time, and many such nodes repeat the duplication.
+   * Observed: 466KB → 211MB (452× expansion) on @vercel/blob's compiled
+   * bundle in next.js. Defenses, in order of cheapest:
+   *
+   *   1. `MAX_INPUT_BYTES` — skip files larger than 256KB. AI context
+   *      tools shouldn't be skeletonizing pre-built vendor bundles
+   *      anyway; they're not human-authored source.
+   *   2. Average-line-length heuristic — if mean line >1KB, treat as
+   *      minified and skip. Catches the .cjs/.min.js pattern that
+   *      slips under the 256KB ceiling.
+   *   3. `MAX_OUTPUT_BYTES` running cap — belt-and-suspenders against
+   *      anything the first two miss. Stop appending and return what
+   *      we have rather than OOM.
+   *
+   * Skipped files return a single comment so callers can distinguish
+   * "deliberately skipped" from "skeletonized to empty".
    */
   async skeletonize(filePath) {
+    const fileSource = fs13.readFileSync(filePath, "utf-8");
+    const fileLines = fileSource.split("\n");
+    const MAX_INPUT_BYTES = 256 * 1024;
+    if (fileSource.length > MAX_INPUT_BYTES) {
+      return `// Source: ${filePath}
+// (skipped: ${fileSource.length} bytes exceeds ${MAX_INPUT_BYTES} byte limit; likely a bundled vendor file)`;
+    }
+    const meanLineBytes = fileSource.length / Math.max(fileLines.length, 1);
+    if (meanLineBytes > 1024) {
+      return `// Source: ${filePath}
+// (skipped: appears minified \u2014 ${fileLines.length} lines for ${fileSource.length} bytes)`;
+    }
     const nodes = await this.parser.parse(filePath);
-    const fileLines = fs13.readFileSync(filePath, "utf-8").split("\n");
     const lines = [`// Source: ${filePath}`];
+    const MAX_OUTPUT_BYTES = 1024 * 1024;
+    let outputBytes = lines[0].length;
     for (const node of nodes) {
+      if (outputBytes > MAX_OUTPUT_BYTES) {
+        lines.push(`// (output truncated at ${MAX_OUTPUT_BYTES} bytes)`);
+        break;
+      }
+      let chunk = "";
       switch (node.type) {
         case "import":
-          lines.push(this.readLines(fileLines, node.startLine, node.endLine));
+          chunk = this.readLines(fileLines, node.startLine, node.endLine);
           break;
         case "interface":
-          lines.push(this.readLines(fileLines, node.startLine, node.endLine));
+          chunk = this.readLines(fileLines, node.startLine, node.endLine);
           break;
         case "function":
-          lines.push(`${node.signature};`);
+          chunk = `${node.signature};`;
           break;
         case "arrow_function":
-          lines.push(`${node.signature};`);
+          chunk = `${node.signature};`;
           break;
         case "export_default":
-          lines.push(`${node.signature};`);
+          chunk = `${node.signature};`;
           break;
         case "class": {
           const methodLines = (node.methodRanges ?? []).map((mr) => {
@@ -3801,12 +3908,16 @@ var Skeletonizer = class {
           if (methodLines.length === 0 && node.methods) {
             node.methods.forEach((m) => methodLines.push(`  ${m}(...): unknown;`));
           }
-          lines.push(`class ${node.name} {
+          chunk = `class ${node.name} {
 ${methodLines.join("\n")}
-}`);
+}`;
           break;
         }
       }
+      if (chunk) {
+        lines.push(chunk);
+        outputBytes += chunk.length + 1;
+      }
     }
     return lines.join("\n");
   }
@@ -11460,9 +11571,9 @@ async function startDashboard(options) {
     }
   }));
   const clientDist = path37.join(__dirname2, "../dashboard/client");
-  app.use(express.static(clientDist));
+  app.use(express.static(clientDist, { dotfiles: "allow" }));
   app.get(/.*/, (_req, res) => {
-    res.sendFile(path37.join(clientDist, "index.html"));
+    res.sendFile(path37.join(clientDist, "index.html"), { dotfiles: "allow" });
   });
   app.listen(port, () => {
     const url = `http://localhost:${port}`;

package/dist/{chunk-7D275UON.js → chunk-EHFVPRTN.js}

@@ -303,6 +303,27 @@ var ASTParser = class {
   kotlinLang = null;
   swiftLang = null;
   phpLang = null;
+  /**
+   * Per-language parser cache. Each TreeSitter.Parser is a
+   * WASM-allocated object; instantiating one per file (the previous
+   * behaviour) leaked memory faster than V8 could reclaim it — OOM
+   * at ~1100 files even with --max-old-space-size=8192. Reusing one
+   * parser per language for the lifetime of the ASTParser instance
+   * is exactly what the tree-sitter docs recommend.
+   *
+   * Map key is the resolved Language; the same Language object is
+   * cached per-language above (tsLang, pyLang, …) so the WeakMap is
+   * stable across calls.
+   */
+  parserCache = /* @__PURE__ */ new WeakMap();
+  getParser(language) {
+    let parser = this.parserCache.get(language);
+    if (parser) return parser;
+    parser = new TreeSitter.Parser();
+    parser.setLanguage(language);
+    this.parserCache.set(language, parser);
+    return parser;
+  }
   dartLang = null;
   grammarLoader = new GrammarLoader();
   async init() {
@@ -459,12 +480,15 @@ var ASTParser = class {
     if (ext === ".php") return this.parsePhp(filePath);
     if (ext === ".dart") return this.parseDart(filePath);
     if (ext === ".vue") return this.parseVue(filePath);
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
-    return this.extractTSNodes(tree.rootNode, filePath, source.split("\n"));
+    try {
+      return this.extractTSNodes(tree.rootNode, filePath, source.split("\n"));
+    } finally {
+      tree.delete();
+    }
   }
   extractTSNodes(rootNode, _filePath, lines) {
     const nodes = [];
@@ -641,21 +665,27 @@ var ASTParser = class {
     if (!match?.[1]?.trim()) return [];
     const scriptContent = match[1];
     if (!this.tsLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const tree = parser.parse(scriptContent);
     if (!tree) return [];
-    return this.extractTSNodes(tree.rootNode, filePath, scriptContent.split("\n"));
+    try {
+      return this.extractTSNodes(tree.rootNode, filePath, scriptContent.split("\n"));
+    } finally {
+      tree.delete();
+    }
   }
   async parsePython(filePath) {
     if (!this.pyLang) await this.loadPython();
     if (!this.pyLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.pyLang);
+    const parser = this.getParser(this.pyLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
-    return this.extractPythonNodes(tree.rootNode, filePath, source);
+    try {
+      return this.extractPythonNodes(tree.rootNode, filePath, source);
+    } finally {
+      tree.delete();
+    }
   }
   async parseNotebook(filePath) {
     if (!this.pyLang) await this.loadPython();
@@ -664,11 +694,14 @@ var ASTParser = class {
       const raw = fs2.readFileSync(filePath, "utf-8");
       const pythonSource = extractNotebookPythonSource(raw);
       if (!pythonSource.trim()) return [];
-      const parser = new TreeSitter.Parser();
-      parser.setLanguage(this.pyLang);
+      const parser = this.getParser(this.pyLang);
       const tree = parser.parse(pythonSource);
       if (!tree) return [];
-      return this.extractPythonNodes(tree.rootNode, filePath, pythonSource);
+      try {
+        return this.extractPythonNodes(tree.rootNode, filePath, pythonSource);
+      } finally {
+        tree.delete();
+      }
     } catch {
       return [];
     }
@@ -751,8 +784,7 @@ var ASTParser = class {
   async parseGo(filePath) {
     if (!this.goLang) await this.loadGo();
     if (!this.goLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.goLang);
+    const parser = this.getParser(this.goLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -832,14 +864,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseRust(filePath) {
     if (!this.rustLang) await this.loadRust();
     if (!this.rustLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.rustLang);
+    const parser = this.getParser(this.rustLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -941,14 +976,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseJava(filePath) {
     if (!this.javaLang) await this.loadJava();
     if (!this.javaLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.javaLang);
+    const parser = this.getParser(this.javaLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1041,14 +1079,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseCSharp(filePath) {
     if (!this.csLang) await this.loadCSharp();
     if (!this.csLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.csLang);
+    const parser = this.getParser(this.csLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1119,14 +1160,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseRuby(filePath) {
     if (!this.rubyLang) await this.loadRuby();
     if (!this.rubyLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.rubyLang);
+    const parser = this.getParser(this.rubyLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1182,14 +1226,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseKotlin(filePath) {
     if (!this.kotlinLang) await this.loadKotlin();
     if (!this.kotlinLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.kotlinLang);
+    const parser = this.getParser(this.kotlinLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1242,14 +1289,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseSwift(filePath) {
     if (!this.swiftLang) await this.loadSwift();
     if (!this.swiftLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.swiftLang);
+    const parser = this.getParser(this.swiftLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1314,14 +1364,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parsePhp(filePath) {
     if (!this.phpLang) await this.loadPhp();
     if (!this.phpLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.phpLang);
+    const parser = this.getParser(this.phpLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1393,14 +1446,17 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   async parseDart(filePath) {
     if (!this.dartLang) await this.loadDart();
     if (!this.dartLang) return [];
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.dartLang);
+    const parser = this.getParser(this.dartLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1455,16 +1511,19 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return nodes;
+    try {
+      walk(tree.rootNode);
+      return nodes;
+    } finally {
+      tree.delete();
+    }
   }
   /**
    * Find all call sites of a symbol in a file.
    */
   async findCallSites(filePath, symbolName) {
     if (!this.tsLang) throw new Error("ASTParser not initialized. Call init() first.");
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1489,8 +1548,12 @@ var ASTParser = class {
         if (child) walk(child);
       }
     };
-    walk(tree.rootNode);
-    return results;
+    try {
+      walk(tree.rootNode);
+      return results;
+    } finally {
+      tree.delete();
+    }
   }
   /**
    * Extract all call edges in a TypeScript/TSX file.
@@ -1499,8 +1562,7 @@ var ASTParser = class {
    */
   async parseAllCallEdges(filePath) {
     if (!this.tsLang) throw new Error("ASTParser not initialized. Call init() first.");
-    const parser = new TreeSitter.Parser();
-    parser.setLanguage(this.tsLang);
+    const parser = this.getParser(this.tsLang);
     const source = fs2.readFileSync(filePath, "utf-8");
     const tree = parser.parse(source);
     if (!tree) return [];
@@ -1531,8 +1593,12 @@ var ASTParser = class {
         if (child) walk(child, newStack);
       }
     };
-    walk(tree.rootNode, []);
-    return results;
+    try {
+      walk(tree.rootNode, []);
+      return results;
+    } finally {
+      tree.delete();
+    }
   }
 };
 
@@ -4051,27 +4117,68 @@ var Skeletonizer = class {
   }
   /**
    * Produce a plain-text skeleton of the file.
+   *
+   * Three layers of pathological-input defense — without them, a single
+   * minified bundled file (e.g. Next.js ships entire compiled vendor
+   * packages as 466KB-on-16-lines `.cjs` files) explodes into hundreds
+   * of MB of output. The `import` and `interface` cases call
+   * `readLines(node.startLine, node.endLine)`; on minified one-line
+   * source where every node spans the whole file, that returns the
+   * entire file each time, and many such nodes repeat the duplication.
+   * Observed: 466KB → 211MB (452× expansion) on @vercel/blob's compiled
+   * bundle in next.js. Defenses, in order of cheapest:
+   *
+   *   1. `MAX_INPUT_BYTES` — skip files larger than 256KB. AI context
+   *      tools shouldn't be skeletonizing pre-built vendor bundles
+   *      anyway; they're not human-authored source.
+   *   2. Average-line-length heuristic — if mean line >1KB, treat as
+   *      minified and skip. Catches the .cjs/.min.js pattern that
+   *      slips under the 256KB ceiling.
+   *   3. `MAX_OUTPUT_BYTES` running cap — belt-and-suspenders against
+   *      anything the first two miss. Stop appending and return what
+   *      we have rather than OOM.
+   *
+   * Skipped files return a single comment so callers can distinguish
+   * "deliberately skipped" from "skeletonized to empty".
    */
   async skeletonize(filePath) {
+    const fileSource = fs12.readFileSync(filePath, "utf-8");
+    const fileLines = fileSource.split("\n");
+    const MAX_INPUT_BYTES = 256 * 1024;
+    if (fileSource.length > MAX_INPUT_BYTES) {
+      return `// Source: ${filePath}
+// (skipped: ${fileSource.length} bytes exceeds ${MAX_INPUT_BYTES} byte limit; likely a bundled vendor file)`;
+    }
+    const meanLineBytes = fileSource.length / Math.max(fileLines.length, 1);
+    if (meanLineBytes > 1024) {
+      return `// Source: ${filePath}
+// (skipped: appears minified \u2014 ${fileLines.length} lines for ${fileSource.length} bytes)`;
+    }
     const nodes = await this.parser.parse(filePath);
-    const fileLines = fs12.readFileSync(filePath, "utf-8").split("\n");
     const lines = [`// Source: ${filePath}`];
+    const MAX_OUTPUT_BYTES = 1024 * 1024;
+    let outputBytes = lines[0].length;
     for (const node of nodes) {
+      if (outputBytes > MAX_OUTPUT_BYTES) {
+        lines.push(`// (output truncated at ${MAX_OUTPUT_BYTES} bytes)`);
+        break;
+      }
+      let chunk = "";
       switch (node.type) {
         case "import":
-          lines.push(this.readLines(fileLines, node.startLine, node.endLine));
+          chunk = this.readLines(fileLines, node.startLine, node.endLine);
           break;
         case "interface":
-          lines.push(this.readLines(fileLines, node.startLine, node.endLine));
+          chunk = this.readLines(fileLines, node.startLine, node.endLine);
           break;
         case "function":
-          lines.push(`${node.signature};`);
+          chunk = `${node.signature};`;
           break;
         case "arrow_function":
-          lines.push(`${node.signature};`);
+          chunk = `${node.signature};`;
           break;
         case "export_default":
-          lines.push(`${node.signature};`);
+          chunk = `${node.signature};`;
           break;
         case "class": {
           const methodLines = (node.methodRanges ?? []).map((mr) => {
@@ -4081,12 +4188,16 @@ var Skeletonizer = class {
           if (methodLines.length === 0 && node.methods) {
             node.methods.forEach((m) => methodLines.push(`  ${m}(...): unknown;`));
           }
-          lines.push(`class ${node.name} {
+          chunk = `class ${node.name} {
 ${methodLines.join("\n")}
-}`);
+}`;
           break;
         }
       }
+      if (chunk) {
+        lines.push(chunk);
+        outputBytes += chunk.length + 1;
+      }
     }
     return lines.join("\n");
   }
@@ -8420,4 +8531,4 @@ export {
   track,
   captureError
 };
-//# sourceMappingURL=chunk-7D275UON.js.map
+//# sourceMappingURL=chunk-EHFVPRTN.js.map

package/dist/index.js

@@ -34,7 +34,7 @@ import {
   startTrial,
   track,
   writeCODEOWNERS
-} from "./chunk-7D275UON.js";
+} from "./chunk-EHFVPRTN.js";
 import {
   VectorStore
 } from "./chunk-NEHYSE2Y.js";
@@ -512,7 +512,7 @@ try {
 } catch {
 }
 var args = process.argv.slice(2);
-var ctxloomVersion = "1.0.17".length > 0 ? "1.0.17" : "dev";
+var ctxloomVersion = "1.0.19".length > 0 ? "1.0.19" : "dev";
 if (args.includes("--version") || args.includes("-v")) {
   process.stdout.write(`ctxloom ${ctxloomVersion}
 `);
@@ -585,7 +585,7 @@ async function checkLicense() {
   if (command !== void 0 && LICENSE_GATE_BYPASS_COMMANDS.has(command)) return;
   const ciKey = process.env["CTXLOOM_LICENSE_KEY"];
   if (ciKey) {
-    const { ApiClient } = await import("./src-WB7EQTRV.js");
+    const { ApiClient } = await import("./src-IHPQZOZE.js");
     const client = new ApiClient(process.env["CTXLOOM_API_BASE"]);
     try {
       const result = await client.validate(ciKey, "ci-ephemeral");
@@ -1112,7 +1112,7 @@ Suggested reviewers for ${files.length} file(s):`);
         process.stderr.write("[ctxloom] --limit must be a non-negative integer (0 for unlimited)\n");
         process.exit(2);
       }
-      const { loadRulesConfig, RulesChecker, formatText, formatJson, RulesConfigError } = await import("./src-WB7EQTRV.js");
+      const { loadRulesConfig, RulesChecker, formatText, formatJson, RulesConfigError } = await import("./src-IHPQZOZE.js");
       let config;
       try {
         config = await loadRulesConfig(root);
@@ -1136,7 +1136,7 @@ Suggested reviewers for ${files.length} file(s):`);
       }
       let graph;
       if (useSnapshot) {
-        const { DependencyGraph: DG } = await import("./src-WB7EQTRV.js");
+        const { DependencyGraph: DG } = await import("./src-IHPQZOZE.js");
         graph = new DG();
         const loaded = await graph.loadSnapshotOnly(root);
         if (!loaded) {
@@ -1145,7 +1145,7 @@ Suggested reviewers for ${files.length} file(s):`);
         }
       } else {
         process.stderr.write("[ctxloom] Building dependency graph...\n");
-        const { ASTParser: ASTParser2, DependencyGraph: DependencyGraph2 } = await import("./src-WB7EQTRV.js");
+        const { ASTParser: ASTParser2, DependencyGraph: DependencyGraph2 } = await import("./src-IHPQZOZE.js");
         let parser;
         try {
           parser = new ASTParser2();

package/dist/{src-WB7EQTRV.js → src-IHPQZOZE.js}

@@ -69,7 +69,7 @@ import {
   startTrial,
   track,
   writeCODEOWNERS
-} from "./chunk-7D275UON.js";
+} from "./chunk-EHFVPRTN.js";
 import {
   VectorStore
 } from "./chunk-NEHYSE2Y.js";
@@ -160,4 +160,4 @@ export {
   track,
   writeCODEOWNERS
 };
-//# sourceMappingURL=src-WB7EQTRV.js.map
+//# sourceMappingURL=src-IHPQZOZE.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ctxloom-pro",
-  "version": "1.0.17",
+  "version": "1.0.19",
   "description": "ctxloom — The Universal Code Context Engine. A local-first MCP server providing intelligent code context via hybrid Vector + AST + Graph search with Skeletonization (92% token reduction).",
   "type": "module",
   "main": "dist/index.js",