chore: remove stale Claude Code agents and commands - #1884
Merged
Conversation
The .claude/agents/ and .claude/commands/ definitions were added in two 2025 dumps (3901496, 1518c16) and never maintained afterwards. They have since drifted away from the codebase they describe: - codebase-analyzer and codebase-locator point at com.opensymphony.xwork2 packages and files that no longer exist; Struts 7 renamed them to org.apache.struts2 - config-validator recommends struts.ognl.allowStaticMethodAccess=false as a hardening step, but that property was removed from the framework, so setting it is a silent no-op - code-quality-checker and quality_check run mvn spotless:check, spotbugs:check and checkstyle:check; no pom declares those plugins - security-analyzer and security_scan produce security reports and advise notifying stakeholders without ever mentioning SECURITY.md or private disclosure to security@struts.apache.org - config_analyze still dispatches jakarta-migration-helper, an agent deleted in d616ea9 The thoughts-* agents and the create_plan, research_codebase and validate_plan commands drove the thoughts/ workflow, which is no longer used. thoughts/ itself is kept as a record of past decisions. The remaining .claude/skills/ cover the Struts-specific procedures and the built-in agents and commands cover the generic ones, so CLAUDE.md now points at .claude/skills/ only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018AHSrPvz8pBTsAA37q47mU
lukaszlenart
marked this pull request as ready for review
August 30, 2026 07:08
lukaszlenart
enabled auto-merge (squash)
August 30, 2026 07:08
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes the nine
.claude/agents/definitions and six.claude/commands/definitions. They were added in two 2025 dumps —39014961a(2025-09-24) and1518c1666(2025-09-29) — and never maintained afterwards, so they had drifted away from the codebase they describe.Why
Wrong package names. Struts 7 renamed
com.opensymphony.xwork2toorg.apache.struts2; there are zero.javafiles undercom/opensymphonyoutsidetarget/.codebase-analyzerstill sent agents to/core/src/main/java/com/opensymphony/xwork2/DefaultActionInvocation.java,com.opensymphony.xwork2.{Action,interceptor.Interceptor,Result}andcom.opensymphony.xwork2.ognl.OgnlUtil, plus/core/src/main/resources/default.properties(the real path iscore/src/main/resources/org/apache/struts2/default.properties).codebase-locatorcarried the samecom/opensymphony/xwork2/pointer.Advice that silently does nothing.
config-validatorrecommendedstruts.ognl.allowStaticMethodAccess=falseunder a "SECURE: Restrict OGNL evaluation" heading. That property was removed from the framework — it survives in this repo only inside OGNL attack strings in test fixtures — so setting it is a no-op that reads like a hardening step.Build commands that do not work here.
code-quality-checkerandquality_checkranmvn spotless:check,mvn spotbugs:checkandmvn checkstyle:check. No pom declares any of those plugins.mvn jacoco:checkwas also suggested, but jacoco lives only in thecoverageprofile and bindsprepare-agent/reportwith no check rules.A security workflow that skipped disclosure.
security-analyzer(237 lines) andsecurity_scangenerated security reports with CVE references and risk ratings, and instructed the agent to "notify stakeholders", without mentioningSECURITY.md,security@struts.apache.orgor private triage anywhere. Their CVE vocabulary stopped at 2014/2017/2018.A dangling reference.
config_analyzedispatchedjakarta-migration-helper, an agent deleted ind616ea9af("Clean up obsolete Claude Code configurations", #1433). That cleanup removed the agent but not its caller.An abandoned workflow. The
thoughts-*agents and thecreate_plan/research_codebase/validate_plancommands drove thethoughts/workflow, which is no longer used.thoughts/itself is kept — it documents past decisions.What replaces them
.claude/skills/keeps the six Struts-specific procedures (release, security bulletins, version notes, dependabot, triage), which are maintained and have no codebase paths to rot. The generic research, review and security passes are covered by built-in agents and commands.CLAUDE.mdnow points at.claude/skills/only.No code, build or test changes.