4.1.1 - a clean install, and a config that actually configures

4.1.1 — a clean install, and a config that actually configures

This one is mostly about what the tool leaves behind in your repository.

init now leaves exactly what it should

• It records the devDependency. init wrote npx @ankurhalder/codebase-snapshot …
  scripts and no dependency at all, so npm install installed nothing: every
  npm run snapshot resolved @latest out of the registry instead of a pinned copy, and the
  npm install && npm run snapshot it printed as the next step could not have installed it.
  A range you already declared — including a deliberate pin — is never overwritten.
• The config is always complete. --minimal wrote only the settings that differed from the
  defaults, so a Next.js project received export default { preset: "nextjs" } — 179 bytes
  listing none of the twenty-six settings — in the one file you open to change them. The flag is
  gone; describe no longer advertises it either.
• The footprint is snapshot.config.ts, two npm scripts, the devDependency and .gitignore.
  Nothing else: no markdown, no agent files.
• Your package.json keeps its formatting — its own indentation and line endings, so the
  diff is the change rather than the whole file.

skill --install no longer writes AGENTS.md

AGENTS.md is your project's agent contract — build commands, conventions, house rules — not a
registry for third-party skills. The install used to create it when missing (a file whose name
claims the repository documents itself, holding only this tool's text) and merge a marked
section into it when present, editing a tracked file on your behalf.

It now writes only the two registries keyed by skill name —
.claude/skills/codebase-snapshot/SKILL.md and .cursor/rules/codebase-snapshot.mdc — and
appends exactly what it creates to .gitignore, so a one-line command no longer turns into a
decision about which untracked files to commit. A file that already existed is never ignored,
and a section left behind by 4.1.0 is reported rather than rewritten. --target agents was
removed; to put the skill in your own AGENTS.md:

npx @ankurhalder/codebase-snapshot skill >> AGENTS.md

Also since 4.1.0

• Byte and line accounting. includedBytes counted the newline the closing fence swallows
  (6,290 of 6,344 files in a real repository were off by one), a CRLF checkout was over-counted
  by a byte per line, and a preview reported one line too many. Every ### FILE: block in every
  part is now compared against the manifest by an invariant test.
• A large file is no longer parsed for a summary the snapshot cannot carry: on a 1.9 MB
  source file, 1.8 s / 283 MB peak RSS became 0.5 s / 105 MB, and the omission is one grouped
  warning instead of a quiet discard.
• --format json failures write one parseable {"error":{…}} document instead of an empty
  stdout.
• Redaction stops at the path boundary: https://example.com/v1/<key> no longer becomes
  https://example.[REDACTED], and JWTs (including %2E separators) are caught.
• explain answers a file inside an ignored directory with the ancestor's record.
• init survives a .gitignore that is a directory instead of aborting after writing the
  config, and a package.json#snapshot array is a reported error.
• Discovery can be forced with --discovery walk|git|auto.

Full details: CHANGELOG.md