release: 2.1.1 - #23
Merged
Merged
Conversation
The capture ran through `[@user](https://…)` link syntax into the URL, picked up a `/`, and passed the looks-like-a-path gate. Biome's CLAUDE.md credits twenty-two maintainers that way, and every one was an AGF004 error. No real import target contains a `]`, so the capture stops there now.
Measured on Claude Code 2.1.238: a chain of imports loads sub/leaf.md from sub/mid.md while an identically named file at the repository root stays unloaded. Resolution is file-relative, and root-relative is not a fallback. The old resolver used the directory the file governs, which for .github/CLAUDE.md is the root — so n8n's `@../AGENTS.md`, a real 18KB file one directory up, escaped the repository and was reported missing. The same measurement cuts the other way: an import that only resolves against the root is genuinely broken and is now reported. One that escapes the repository is never reported, because a bounded scan cannot prove absence.
…ms do The 2.1.0 lenient parser went to one of five call sites. trigger.dev's drizzle skill — an unquoted description carrying `conventions: ` — loads in Claude Code and echoes its description back verbatim, while agentfile reported a parse error and a missing description. Measured per surface: a command with `description: uses: colons, badly: everywhere` is listed with exactly that description, and a .claude/rules file with the same shape still loads its body. An unclosed fence is still an error in either reading.
Measured on Claude Code 2.1.238: a skill named n8n:create-pr in a create-pr/ directory loads and is invoked as create-pr; a skill in a directory named My_Weird.Skill loads and is invoked as exactly that; a SKILL.md with no frontmatter at all is listed with its first heading standing in for the description and resolves when invoked by name. The directory is the identity. So AGF101's grammar and directory-mismatch findings drop to warning, a name that breaks both is one finding rather than two, and AGF102's default drops to warning: missing metadata degrades discovery, it does not break the skill. n8n's 22 namespaced skills were 44 errors; they are 22 warnings.
AGF505 flagged the ZERO WIDTH JOINER inside PostHog's 🧑💻 — the codepoint that makes two pictographs one glyph. A well-formed emoji ZWJ sequence is exempt now; a joiner that joins nothing is still a finding. The same finding pointed at lines 306 and 311 when the characters sat on 317 and 322: skill and subagent text starts after the frontmatter, and the scanner numbered it from 1. Both now carry bodyLine through the IR, the same anchor instructions already had.
Each regression case names the repository it came from and the behaviour measured on Claude Code 2.1.238, and each keeps a mutation guard: the unclosed fence still errors, the bare joiner still fires, the root-relative import that never loads is now a true positive.
A patch by docs/stability.md: no new codes, no meaning changes — severity defaults and heuristic reach are documented as not stable. Ten popular repositories produced 69 error-severity findings on 2.1.0; all 69 were wrong, in six ways, and each fix in this release carries its measurement. Internal ranges move with the version, as they did last time.
The fixture's frontmatter stopped being an error when the readers went lenient — correctly, since the programs load it. The self-test now plants a broken import instead: CLAUDE.md promising a file that does not exist stays an error on every measured path, so the gate has something real to gate on.
biome 2.5.11, semver ^7.8.5, react-query ^5.102.8, plugin-react ^6.1.1, lucide-react ^1.35.0, zod ^4.5.2 (core and ui), open ^11.0.2, diff ^9.0.0, checkout@v7 and setup-node@v7 in the action and its self-test. The two red checks on the open and diff PRs were not those dependencies: 2.1.0 reached npm at 13:38:02 and their runs started at 13:38:09, the first runs to resolve latest after the fixture's planted defect stopped being an error. The corrected fixture in this branch is the fix. Closes #16. Closes #17. Closes #18. Closes #19. Closes #20. Closes #21.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Six false-positive fixes, found by running 2.1.0 in full over ten popular repositories (trigger.dev, biome, pydantic-ai, deno, prisma, n8n, PostHog, chain33, CMB2, DevoxxGenieIDEAPlugin) and measuring every error it produced against Claude Code 2.1.238.
Before: 69 findings at error severity across the ten. All 69 were wrong.
After: zero errors; the run's one true finding (the U+2060 in trigger.dev's Cursor rules) still stands, now at the correct line number.
.github/CLAUDE.md->@../AGENTS.mdexists; measured chain-import testn8n:create-prloads ascreate-pr;My_Weird.Skillloads as itselfVersion
A patch by docs/stability.md: no new codes, no meaning changes; severity defaults and heuristic reach are documented as not stable. The optional
bodyLineIR field is additive.Testing
Also carries
The six open dependabot bumps (#16 #17 #18 #19 #20 #21), applied to the release branch so 2.1.1 ships with them. The failing checks on #20/#21 were the action self-test meeting npm latest=2.1.0 nine seconds after publish, not the dependencies; the corrected fixture in this PR is the fix.
Closes #16. Closes #17. Closes #18. Closes #19. Closes #20. Closes #21.