Four version bumps today, sharing one storyline: the continued migration of cleave's engine into filefacts, and a crackdown on memory and CPU — especially when processing archives. Member-heavy archives used to be the pipeline's worst case; now they're just another input.
cleave v2.0.0-rc.4 carries most of the resource work. A memory-aware admission gate serializes large archives while small files keep filling the pool, using live available-memory readings. Archive members are analyzed in bounded byte-windows instead of held fully resident, and trait regexes moved to a bounded LRU cache — the old design leaked every compiled engine, ~7.7 GB RSS on member-heavy archives. word:/substr: matching now runs on SIMD literal searchers with no regex engine at all. Correctness too: the AST query cache no longer nondeterministically drops findings during parallel archive analysis, and UTF-16 scripts are normalized to UTF-8 before text matching. Release notes.
filefacts v0.9.0 — the engine itself — gets its biggest release since the extraction: jemalloc tuned to release freed pages immediately (peak RSS −~60%), JSON streamed to stdout instead of built in memory, tree-sitter queries compiled once and cached. New coverage includes Clojure and Windows Batch ASTs, AppleScript, and BEAM bytecode, plus a batch of new obfuscation metrics — operator density, XOR loops, identity functions — feeding the model pipeline. Release notes.
litmus v2.0.0-rc.4 rethinks severity: levels are now false positives per 100M benign files (default L50), replacing the old 1–9 scale. ONNX is the only model format now, and validate fails bundles with feature-layout drift instead of silently scoring zeros. The worker picks up the same archive discipline as cleave — large archives run one at a time instead of co-residing and exhausting RAM — and a new heartbeat API reports liveness and queue depth even while busy. Release notes.
stng v1.5.2 follows the same flavor: raw extraction classifies runs in bounded 64K batches, UTF-16 decode streams directly from bytes, and --json streams to stdout. Two false-positive classes die too — pure-letter .NET identifiers mistaken for XOR keys, and 0::c-style noise counted as IPv6. Release notes.
The release candidates are still candidates. Pin if you need stability; otherwise:
brew upgrade atomdrift/tap/cleave atomdrift/tap/litmus atomdrift/tap/stng