release: 2.7.0 (#36)

Releases the doctor fix from #35. core, cli and agentfile move to 2.7.0;
@agentfile/ui stays on its own beta track and the extension stays at 0.1.0.

Minor rather than patch: doctor's output changes for every user, and a stock
~/.claude will show findings that were previously hidden.

Author: dennishavermans

.pre-commit-hooks.yaml

@@ -12,13 +12,13 @@
 # or a .claude/ directory per package, and agentfile discovers all of them.
 #
 # The version is pinned to the tag that carries this file, so a consumer who
-# pins `rev: v2.6.0` gets 2.5.0 and not whatever `latest` becomes tomorrow.
+# pins `rev: v2.7.0` gets 2.5.0 and not whatever `latest` becomes tomorrow.
 # Bumping it is part of cutting a release.
 
 - id: agentfile
   name: agentfile
   description: Structural and resolution checks on the agent configuration this repository already has.
-  entry: npx --yes @agentfile/cli@2.6.0 check
+  entry: npx --yes @agentfile/cli@2.7.0 check
   language: system
   pass_filenames: false
   files: >-
@@ -39,7 +39,7 @@
 - id: agentfile-audit
   name: agentfile audit
   description: Security analysis of permission rules, hooks and MCP servers.
-  entry: npx --yes @agentfile/cli@2.6.0 audit
+  entry: npx --yes @agentfile/cli@2.7.0 audit
   args: [--strict]
   language: system
   pass_filenames: false

CHANGELOG.md

@@ -9,6 +9,46 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [2.7.0] — 2026-09-09
+
+`doctor` tells the truth about what it found.
+
+### Fixed
+
+- `doctor` ran a hand-picked subset of the analysis, so on a repository with a
+  broken skill reference and two wildcard permission rules it printed
+  "No problems found" while `check`, `lint` and `audit` reported four findings
+  between them. It is the command the README leads with and the one the
+  empty-state message recommends, and the affirmative all-clear also
+  contradicted this project's rule that a clean result says no pattern matched,
+  never that the configuration is safe. It now runs every implemented layer.
+- Suppressions and configured severity now apply to `doctor`. Going through
+  `runValidation` rather than calling analyses directly means an
+  `agentfile-disable` directive and a configured severity are honoured here as
+  they already were everywhere else. They were not before.
+
+### Changed
+
+- `doctor` is the full analysis and the narrower verbs are subsets of it:
+  `check` for the fast structural pass, `lint` for quality, `audit` for
+  security alone. This is the shape the comparable tools settled on. Biome,
+  which this repository already uses, gives its security rules a default
+  severity of error and runs them inside the default `biome check`, keeping
+  `lint` and `format` beside it. The `audit` verb elsewhere means dependency
+  CVE scanning, a different data source, and the `doctor` verb elsewhere means
+  environment health.
+- A stock `~/.claude` will now show findings that were previously hidden,
+  including unpinned MCP server packages in third-party plugins the user did
+  not write. Those servers do load and they are unpinned, so the findings are
+  accurate.
+
+### Note
+
+The layer split was justified by a pre-commit time budget. Measured on
+`~/.claude`, 2107 files, `check` and `audit` both run in 0.14s, because the
+filesystem walk dominates.
+
+
 ## [2.6.0] — 2026-09-09
 
 agentfile ships as a pre-commit hook. The repository has advertised

README.md

@@ -409,7 +409,7 @@ For the repositories that already run [pre-commit](https://pre-commit.com):
 ```yaml
 repos:
   - repo: https://github.com/dennishavermans/agentfile
-    rev: v2.6.0
+    rev: v2.7.0
     hooks:
       - id: agentfile
       - id: agentfile-audit

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentfile/agentfile",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "description": "Find what is wrong with the AI agent configuration your repository already has",
   "type": "module",
   "bin": {
@@ -42,7 +42,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@agentfile/cli": "^2.6.0"
+    "@agentfile/cli": "^2.7.0"
   },
   "devDependencies": {
     "@types/node": "^22.19.0",

packages/agentfile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentfile/cli",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "description": "Find what is wrong with the AI agent configuration your repository already has — doctor, check, lint, audit, adopt, compile, eval",
   "type": "module",
   "main": "./dist/bin.js",
@@ -45,7 +45,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@agentfile/core": "^2.6.0",
+    "@agentfile/core": "^2.7.0",
     "chalk": "^6.0.0",
     "commander": "^14.0.3",
     "enquirer": "^2.4.1"

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentfile/core",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "description": "Read, analyse and compile AI agent configuration — discovery, a normalized IR, a resolver, diagnostics, and static security analysis",
   "type": "module",
   "main": "./dist/index.js",