fix(docs-hygiene): hyphen-exclude Form 1; allow inline comments on manifest declarations by kyle-sexton · Pull Request #1435 · melodic-software/claude-code-plugins

kyle-sexton · 2026-07-26T00:52:56Z

Follow-up to #1386. Two P1 findings were raised on that PR after it had already merged, so they never reached main.

Form 1 rewrote unrelated slash commands

\b treats a hyphen as a word boundary, so \B/<old>\b prevented /confirm matching in /confirmation but not in /confirm-changes. Renaming context matched the unrelated /context-guard.

Form 1 is rated Certain and sits on container mode's Certain allowlist, so this went through the default auto-apply path and renamed another command. Slash-command and container names are kebab-case, so it fires constantly rather than rarely.

Now uses the consumed ([^\w-]|$) terminator — the shape Forms 13 and 15 already use for the same reason.

Verified against this tree: the nine /docs-hygiene:<skill> namespaced invocations still match, a colon being a valid terminator, while /context-guard, /contextual and path/context do not.

Manifest declarations could not carry an inline comment

name: <old> # package name and name = "<old>" # package name are ordinary self-documenting manifests, and the end-anchored declaration alternatives rejected the whole line — while filesystem evidence still selected container mode, so the registration went unmatched and was suppressed as residue while apply mode reported completion.

The whitespace rule differs between the two deliberately:

YAML requires whitespace before #. YAML starts a comment only after whitespace, so name: <old>#x is the single scalar <old>#x and must not match.
TOML allows optional whitespace, its value being quoted, so the closing quote already ends the string unambiguously.
JSON is excluded entirely, having no comment syntax.

All six positive shapes and both negatives verified.

Reconciliation

The Phase 6 reconciliation grep on Form 1's boundary found it restated in four more places — triage.md's Certain criteria, audit-modes.md's Orphans sweep, apply.md's word-boundary-trap gotcha, and audit.md's consume-the-delimiter form list — all corrected here.

Two eval cases added (45, 46). docs-hygiene 0.9.0 → 0.9.1.

Gates

node scripts/validate-plugin-contracts.mjs — 43 setup skills, 2122 files
claude plugin validate .
markdownlint-cli2 — 0 errors over 36 files
scripts/check-changelog-parity.sh --check-bump origin/main
evals.json parses, 46 cases, no duplicate ids

feat(docs-hygiene): add container-position pattern forms to rename-references #1386 — the PR these findings were raised on; it merged before they landed, so neither fix reached main
docs-hygiene(rename-references): pattern library misses command-argument and document-title forms (6 stale refs survived 3 sweeps in #1276) #1283 — the original pattern-library gap feat(docs-hygiene): add container-position pattern forms to rename-references #1386 closed
docs-hygiene(rename-references): Form 14 is case-sensitive, so a title-cased heading falls through to a LESS safe classification #1394 — a separate, deliberately deferred Form 14 gap, untouched here

🤖 Generated with Claude Code

https://claude.ai/code/session_01ATCcexm8GPTaNntu2yrGMk

…clarations Two P1 findings raised on #1386 after it was already merged. Same review round, so they never reached main. Form 1 rewrote unrelated slash commands. `\b` treats a hyphen as a word boundary, so `\B/<old>\b` prevented `/confirm` matching in `/confirmation` but NOT in `/confirm-changes` -- renaming `context` matched the unrelated `/context-guard`. Form 1 is Certain and sits on container mode's Certain allowlist, so that went through the default auto-apply path and renamed another command. Slash-command and container names are kebab-case, so this fires constantly rather than rarely. Now uses the consumed `([^\w-]|$)` terminator, the shape Forms 13 and 15 already use for the same reason. Verified against this tree that namespaced invocations are unaffected -- a colon is a valid terminator, so the nine `/docs-hygiene:<skill>` references still match -- while `/context-guard`, `/contextual` and `path/context` do not. Form 1 joins the other consume-the-delimiter forms in the survey's rescan-cursor rule, and its consumed character is not part of the reference. Manifest declarations could not carry an inline comment. `name: <old> # package name` and `name = "<old>" # package name` are ordinary self-documenting manifests, and the end-anchored alternatives rejected the whole line -- while filesystem evidence still selected container mode, so the registration went unmatched and was suppressed as residue while apply mode reported completion. The whitespace rule differs between the two on purpose. YAML starts a comment only when `#` follows whitespace, so `name: <old>#x` is the single scalar `<old>#x` and must NOT match; the YAML alternative therefore requires `(\s+#.*)?`. TOML's value is quoted, so the closing quote already ends the string unambiguously and `\s*(#.*)?` is safe. JSON is excluded entirely, having no comment syntax. All six positive shapes and both negatives verified. Phase 6 reconciliation grep on Form 1's boundary found it restated in four more places -- triage.md's Certain criteria, audit-modes.md's Orphans sweep, apply.md's word-boundary-trap gotcha, and audit.md's consume-the-delimiter form list -- all corrected here. Gates: validate-plugin-contracts (43 setup skills, 2122 files), claude plugin validate, markdownlint-cli2 0 errors over 36 files, changelog parity --check-bump, evals parse at 46 cases with no duplicate ids. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ATCcexm8GPTaNntu2yrGMk

claude · 2026-07-26T00:53:16Z

Claude encountered an error after 2s —— View job

I'll analyze this and get back to you.

claude · 2026-07-26T00:53:21Z

Claude encountered an error after 2s —— View job

I'll analyze this and get back to you.

github-actions · 2026-07-26T00:53:34Z

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/30182228017
Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":2506,"total_cost_usd":0}

Re-running the job, or pushing a new commit, will retry the review.

github-actions · 2026-07-26T00:53:39Z

Warning

Automated security review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/30182228002
Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":1890,"total_cost_usd":0}

Re-running the job, or pushing a new commit, will retry the review.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a3707dcd3c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…tion by region Two findings on this PR, both consequences of the two fixes it carries. SKILL.md's slash-token gotcha still prescribed `\B/<old>\b` -- the exact expression Form 1 was corrected away from. SKILL.md is ALWAYS loaded, so a stale executable directive there outranks the corrected pattern in practice: an agent following the gotcha reintroduces the hyphenated-sibling defect while patterns.md claims it fixed. Now states the consumed terminator, why a trailing `\b` is insufficient, and that the consumed character is not part of the reference. The reconciliation grep should have caught it last round. It did run over Form 1's boundary, but its output exceeded the display budget and was truncated to a file, and the narrower follow-up greps used a hand-escaped `\B` that matched nothing. This round's grep matched the literal regex text with no escaping guess and found every site. Accepting inline comments widened the match to span text that is documentation rather than declaration -- and a comment routinely mentions the thing it documents. `name: <old> # <old> before publishing` is one declaration and one piece of prose, but the survey enumerates every `<old>` span inside a match, so it emitted two records, both attributed to Form 14. That form is Certain and exempt from the common-word demotion inside a manifest, so apply mode rewrote the comment text. Enumeration is now bounded by a per-form REFERENCE REGION rather than the whole match, with the regions tabulated in audit.md: the declaration alternatives enumerate within the VALUE only; Form 7 keeps the whole quoted field, because its multiple occurrences are all genuine references; the delimiter-anchored forms enumerate the token span they anchor, excluding the consumed delimiter. Narrowing blanket-wide would have reintroduced the wide- match bug those regions were split to fix. Gates: validate-plugin-contracts (43 setup skills, 2122 files), claude plugin validate, markdownlint-cli2 0 errors over 36 files, changelog parity --check-bump, evals parse at 48 cases with no duplicate ids. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ATCcexm8GPTaNntu2yrGMk

claude · 2026-07-26T01:03:12Z

Claude encountered an error after 3s —— View job

I'll analyze this and get back to you.

claude · 2026-07-26T01:03:20Z

Claude encountered an error after 2s —— View job

I'll analyze this and get back to you.

chatgpt-codex-connector Bot reviewed Jul 26, 2026

View reviewed changes

Comment thread plugins/docs-hygiene/skills/rename-references/context/patterns.md

Comment thread plugins/docs-hygiene/skills/rename-references/context/patterns.md

kyle-sexton mentioned this pull request Jul 26, 2026

Lane telemetry: babysit-loop #1214

Closed

kyle-sexton mentioned this pull request Jul 26, 2026

Lane telemetry: work-loop #1248

Closed

kyle-sexton merged commit fcce5f9 into main Jul 26, 2026
27 checks passed

kyle-sexton deleted the fix/1386-followup-form1-hyphen-and-inline-comments branch July 26, 2026 01:08

Navigation Menu

Uh oh!

fix(docs-hygiene): hyphen-exclude Form 1; allow inline comments on manifest declarations - #1435

fix(docs-hygiene): hyphen-exclude Form 1; allow inline comments on manifest declarations#1435
kyle-sexton merged 2 commits into
mainfrom
fix/1386-followup-form1-hyphen-and-inline-comments

kyle-sexton commented Jul 26, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jul 26, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jul 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 26, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

claude Bot commented Jul 26, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jul 26, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

kyle-sexton commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Form 1 rewrote unrelated slash commands

Manifest declarations could not carry an inline comment

Reconciliation

Gates

Related

Uh oh!

claude Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

claude Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

kyle-sexton commented Jul 26, 2026 •

edited

Loading

claude Bot commented Jul 26, 2026 •

edited

Loading

claude Bot commented Jul 26, 2026 •

edited

Loading

github-actions Bot commented Jul 26, 2026 •

edited

Loading

github-actions Bot commented Jul 26, 2026 •

edited

Loading

claude Bot commented Jul 26, 2026 •

edited

Loading

claude Bot commented Jul 26, 2026 •

edited

Loading