feat(compile): report the Cursor rule/skill overlap, and script the tap bump - #114
Merged
Conversation
… Cursor TAP_TOKEN still is not set, so the homebrew job skips with a warning and the formula gets bumped by hand once per release — which meant copying a sha256 between terminals seven times over the last few releases. scripts/bump-tap.sh runs the same steps the workflow does, so the digest is computed from the tarball rather than retyped. Dry run is the default, because the tap is a separate public repo and a wrong digest there breaks `brew install` for everyone until somebody notices. It refuses a version that is not on npm yet (the formula would 404) and is a no-op when the formula already points at that version. An audit while writing it confirmed all eight hand-bumped releases (0.17.0 through 0.22.0) carry a sha256 matching their real tarball, so nothing shipped broken — but the process had no check that would have caught it if one had. Also softens the comment excluding cursor from VENDOR_NEUTRAL_ALIASES. It asserted the .cursor/rules file is "not a second copy" of the .agents/skills one; they are different mechanisms, but Cursor does read .agents/skills, so in a repo with both it is offered the same body twice, and whether it dedupes is unverified. That is now stated as unverified rather than settled — the same class of confident-but-unchecked comment that hid the copilot/gemini duplication until 0.22.0.
…ing it away Cursor reads .agents/skills/ as well as .cursor/rules/, and the rule this compiler emits — alwaysApply: false, a description, no globs — is exactly what Cursor's docs call a dynamic rule: the shape its own /migrate-to-skills command converts into a skill. Both land in Cursor's "Agent Decides" pool, and Cursor documents no dedup between them, so a repo with both paths offers one capability twice and pays each entry's description up front. Compile now reports that, with the duplicated cost measured, and names the [project].targets line that resolves it. The rule is still emitted. Agent Skills only reached general availability in Cursor 2.4, so dropping it would silently cost anyone on an older Cursor their only trigger — worse than a duplicated description. Reporting keeps the choice with the reader rather than making it for them on partial evidence. This started as a comment in the previous release claiming the rule was "not a second copy" of the skill. It is one, through a different mechanism — the same class of confident, unverified comment that hid the copilot/gemini duplication until 0.22.0. Verified against Cursor's own docs and staff posts before changing anything. Adds 7 tests. 0.23.0.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two things, both continuing the 0.22.0 thread: a confident comment nobody had tested.
Cursor rule/skill overlap
In 0.22.0 I excluded
cursorfrom the vendor-neutral dedup with this reasoning:That was an assertion, not a finding. Verified against Cursor's own docs:
.agents/skills/.alwaysApply: false,description, noglobs) is precisely what Cursor calls a dynamic rule — the shape its own/migrate-to-skillscommand converts into a skill. The documented path is replace, not add.alwaysApply: falserule's description is presented every session, so the trigger metadata is genuinely charged twice.So it is a second offer of the same capability. Compile now says so, with the cost measured:
The rule is still emitted. Agent Skills only reached GA in Cursor 2.4; dropping it would silently cost older-Cursor users their only trigger — worse than a duplicated description. A note keeps the choice with the reader rather than making it for them on partial evidence.
scripts/bump-tap.sh
TAP_TOKENis still unset, so the tap job skips and the formula is bumped by hand — which meant copying a sha256 between terminals seven times over recent releases. This runs the same steps the workflow does, so the digest comes from the tarball rather than a paste. Dry run by default (the tap is a separate public repo; a wrong digest breaksbrew installfor everyone), refuses an unpublished version, no-op when already current.While writing it I audited every hand-bumped release — 0.17.0 through 0.22.0 all carry a sha256 matching their real tarball. Nothing shipped broken, but nothing would have caught it either.
7 new tests; suite, typecheck, site
--checkand bench gate green. Ships as 0.23.0.