perf(core): cache static registry model lookups and eliminate snapshot traversal allocations

.github/AGENTS.md

@@ -22,5 +22,5 @@ change requires explicit security review under `MAINTAINERS.md`.
 
 - Inspect the complete workflow diff, including event triggers, permissions, conditions, interpolation, and shell behavior.
 - Run the local commands represented by changed workflow steps where possible.
-- Run `bun run prepush` for CI, release, dependency, packaging, or cross-platform workflow changes.
+- Follow the root validation policy: run the suite by default; if a full run is too costly, run at least focused regression tests and document the reason and remaining coverage. Required CI checks still apply before merge.
 - Do not claim the workflow itself passed until GitHub Actions reports success for the exact commit.

.github/CODEOWNERS

@@ -14,6 +14,7 @@
 /bunfig.toml @lidge-jun @Ingwannu
 /scripts/release.ts @lidge-jun @Ingwannu
 /scripts/release-notes.ts @lidge-jun @Ingwannu
+/scripts/release-version-sources.ts @lidge-jun @Ingwannu
 /scripts/prepare-package.ts @lidge-jun @Ingwannu
 /package.json @lidge-jun @Ingwannu
 /bun.lock @lidge-jun @Ingwannu

.github/ISSUE_TEMPLATE/documentation.yml

@@ -28,7 +28,7 @@ body:
     attributes:
       label: Documentation location
       description: Public documentation URL or repository path.
-      placeholder: "https://opencodex.me/providers/ or docs/providers.md"
+      placeholder: "https://opencodex.me/guides/providers/ or docs-site/src/content/docs/guides/providers.md"
     validations:
       required: true
 

.github/scripts/enforce-pr-target.test.cjs

@@ -284,7 +284,12 @@ describe("enforce-pr-target workflow", () => {
     assert.match(workflow, /stackedBase/);
     assert.match(workflow, /github\.rest\.pulls\.list/);
     assert.match(workflow, /treating as stacked/);
-    assert.match(workflow, /other\.base\?\.repo\?\.owner/);
+    assert.match(workflow, /other\.head\?\.repo\?\.owner/);
+    assert.doesNotMatch(
+      workflow,
+      /other\.head\?\.repo\?\.(?:owner\?\.login|name)\s*\?\?/,
+      "stacked-base detection must fail closed when an open PR head repo is unavailable",
+    );
     const qualityCall = workflow.match(
       /collectPrQualityFailures\(\{([\s\S]*?)\}\);/,
     );

.github/scripts/issue-translation.cjs

@@ -810,9 +810,14 @@ function sanitizeTranslationBody(raw, maxChars = 60000) {
     // read as mention boundaries. Requiring a dotted domain keeps
     // "end!@octocat"-style mentions defused. \u0001 cannot appear in the
     // input (control chars were stripped above), so it is a safe sentinel.
+    // The lookbehind anchors on the @ itself rather than greedily matching
+    // the local part first: the previous local-part-first pattern rescanned
+    // long non-email tokens once per start position, which is quadratic on
+    // model-generated bodies with tens of thousands of consecutive
+    // local-part characters and no @ at all.
     .replace(
-      /[A-Za-z0-9.!#$%&'*+\/=?^_`{|}~-]+@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+/g,
-      (email) => email.replace("@", "\u0001"),
+      /(?<=[A-Za-z0-9.!#$%&'*+\/=?^_`{|}~-])@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+/g,
+      (emailTail) => emailTail.replace("@", "\u0001"),
     )
     // Defuse pings at Markdown/punctuation boundaries — a colon is a boundary
     // too — but not emails, npm: scopes, or other mid-token at-signs.

.github/scripts/issue-translation.test.cjs

@@ -1195,6 +1195,14 @@ describe("bot-owned control state", () => {
     assert.match(out, /path\/@\u200bhandle/);
   });
 
+  it("handles long non-email tokens in bounded time", () => {
+    const input = "a".repeat(60_000);
+    const startedAt = process.hrtime.bigint();
+    assert.equal(sanitizeTranslationBody(input), input);
+    const elapsedMs = Number(process.hrtime.bigint() - startedAt) / 1_000_000;
+    assert.ok(elapsedMs < 1_000, `sanitization took ${elapsedMs.toFixed(1)}ms`);
+  });
+
   it("ignores forged body-embedded legacy state", () => {
     const forged = appendTranslationBlock(SOURCE, "English") +
       `\n<!-- opencodex-issue-inline-translator-state:${JSON.stringify({