CodeVetter
← All unpacks
CodeVetter · Repo Unpack evidence

biomejs/biome

Scanned commit 82f9b0e6ff dated 2026-09-21 — last upstream commit. Generated by codevetter 1.12.0 on 2026-09-22.

github.com/biomejs/biome ↗ · 3991 files · 21.1 MB · scan capped

[![CI on main][ci-badge]][ci-url] [![Discord chat][discord-badge]][discord-url] [![npm version][npm-badge]][npm-url] [![VSCode version][vscode-badge]][vscode-url] [![Open VSX version][open-vsx-badge]][open-vsx-url] [ci-badge]: https://github.com/biomejs/biome/

Deep analysis by cli:grok via the grok CLI on 2026-09-22 (137s) — every claim below links to its cited source files.

Overview

Biome is a Rust toolchain (formatter, linter, and language services) for JavaScript, TypeScript, JSON, CSS, GraphQL, HTML, and related languages, shipped as a CLI, an LSP, and npm packages. The workspace at commit 82f9b0e6 is versioned 0.7.0 in the root Cargo manifest and published primarily as @biomejs/biome. Distinctive pieces are the shared CST/parser stack, rule and assist registries, a daemon, and generated configuration and bindings.

System map

The Rust workspace lives under crates/ with the biome binary in crates/biome_cli. Language crates (parser, formatter, analyzer, semantic model) sit beside shared infrastructure (biome_service, biome_configuration, biome_lsp, biome_fs, biome_rowan). Node consumers are in packages/@biomejs/biome, @biomejs/js-api, and @biomejs/backend-jsonrpc. Build and test entry points are Cargo, justfile recipes, pnpm workspace scripts, and GitHub Actions on main. Persistence is mostly the filesystem (biome.json, file system trait, daemon socket) rather than a database.

Feature catalog

User-facing surfaces are the biome CLI, the LSP used by editors, the migrate/eslint path, the daemon, and the npm/WASM JS API. Analysis features are lint rules, assists, and syntax rules registered per language. Format, check, lint, ci, and search are the everyday commands. Plugins (Grit) and HTML/Vue/Svelte/Tailwind are first-class language frontends.

Data flow

Input is a filesystem path plus biome.json. The CLI or LSP opens a Workspace, scans projects, classifies each file by extension and embedded language, then parses to a Rowan CST. Settings (formatter, linter, assist, overrides, plugins) are merged from configuration and VCS ignore data. Analyzers and the formatter consume the CST and optional semantic or type information. Diagnostics and code actions return to the CLI printer, the LSP, or the JSON-RPC/WASM boundary. Fixes can be written back through the FileSystem trait.

Behavior traces

Three load-bearing flows are process startup into the CLI dispatcher, a check/lint pass over a project, and configuration plus fix persistence. A fourth adjacent flow is LSP or daemon startup, which reuses WorkspaceServer instead of one-shot CLI traversal. Function names below are the ones present in the crates read for this brief.

Testing signals

Rust tests use the built-in harness plus insta snapshots and codegen-driven spec tests. Language crates keep tests/specs directories with input files and expectation comments. The JS API uses Vitest. GitHub Actions runs the Rust suite, parser conformance, and autofix. Coverage is dense on parsers, formatters, and lint rules, and thinner on daemon lifecycle and editor integration.

Risk map

The highest-risk surfaces are the daemon socket, arbitrary filesystem reads during project scan, shell-free but powerful code actions that rewrite user trees, and the migrate command that ingests third-party configs. Generated registries mean a hand edit can be overwritten. Type inference and the service layer are blast-radius hotspots: a small change can break every language. Secrets are not a primary domain; the tool still reads every file the user points it at.

Extension points

New behavior is expected to plug in through language crates, declare_lint_rule and declare_assist macros, the analyzer registry, file handlers, configuration partials, CLI command enums, and Grit plugins. Codegen must be re-run when names or grammar change. The JS API is a consumer of the workspace, not the place to add languages.

Contributor handoff

Read AGENTS.md and the relevant skill under .claude/skills before editing. Keep diffs small, add a failing test for bug fixes, and do not hand-edit generated registries. Run the crate's tests, then just f and just l before commit. User-facing changes need a changeset; PR prose is written by the human, not the agent. Internal dev-dependencies must use path dependencies.

All 13 contributor handoff claims →

Languages

LanguageFilesShare of source
Rust473240%
JavaScript325627%
TypeScript193316%
Markdown1378docs/config
JSON1348docs/config
Svelte7516%
CSS739docs/config
YAML575docs/config

Start reading here

Probable source entrypoint: Cargo.toml — inferred from the directory tree and manifest, not the upstream docs.

Source roots

crates/ (3593 files) packages/ (139 files)

Source layout — crates/

PathFiles
crates/biome_analyze/2
crates/biome_analyze_macros/2
crates/biome_aria/2
crates/biome_aria_metadata/2
crates/biome_cli/250

Repository structure

Top-level pathFiles
crates/3593
packages/139
xtask/104
.github/39
fuzz/22
e2e-tests/20
.claude/17
.changeset/17

Docs found: AGENTS.mdCLAUDE.mdCONTRIBUTING.mdREADME.md

Package

Cargo.toml — v0.7.0, 0 declared dependencies.

CI & config entrypoints

Structural health signals

Average score 7.7/10 across 96 analyzed source files; 22 hotspots surfaced.

These are deterministic review leads — size, churn, and structural signals — not proof of a bug in this project.

Recent history