Update agent-sh/agnix action to v0.58.0

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
agent-sh/agnix	action	minor	v0.36.2 → v0.58.0

---

Release Notes

agent-sh/agnix

v0.58.0

Compare Source

Migration

• Remove retired IDs REF-004, OC-DEP-004, CC-MEM-005, CC-MEM-006, CC-MEM-008, AGM-006, and MCP-005 from disabled_rules, severity overrides, and explicit rule lists. Generic-instruction advice remains under PE-005; unrelated retirements have no replacement.
• Quoted-boolean repairs now require --fix-unsafe. Review the proposed values first: enabling previously ignored settings can change behavior or security policy. Plain --fix leaves these strings unchanged.

Removed

• Retire REF-004: Claude Code supports non-Markdown imports, including @package.json.
• Retire OC-DEP-004: a file named CONTEXT.md is not invalid in an explicit OpenCode instructions list.
• Retire duplicate memory advice CC-MEM-005, CC-MEM-006, and CC-MEM-008 in favor of the PE rules. Retire AGM-006: nested AGENTS.md files are supported instruction hierarchies.
• Retire MCP-005: client consent recommendations do not require invented requiresApproval or confirmation fields in MCP tool definitions.
• Remove prose-rewriting autofixes from CC-MEM-007 and PE-003, the permission-mode rewrite from CC-AG-012, and the invalid tools-to-permission key-only migration from OC-DEP-002.

Added

• Kiro capability permissions YAML validation (KR-PM-001 through KR-PM-004), including optional match / exclude string arrays and the real user/workspace policy paths.
• KR-HK-014 provides safe canonical trigger spelling fixes for supported V3 aliases and advisory legacy CLI hook migration hints. Manual is accepted without claiming CLI invocation support.
• Kiro CLI V3 support: standalone .kiro/hooks/*.json documents validate under
  new rules KR-HK-011 (document version must be v1), KR-HK-012 (documented
  PascalCase triggers, camelCase 2.x aliases accepted, required
  name/trigger/action) and KR-HK-013 (action.type command/agent
  with a non-empty payload; seconds-based timeout with a sanity ceiling).
• KR-AG-015 warns when a Kiro agent profile keeps CLI 2.x trust fields
  (allowedTools, toolsSettings) without a permissions block: CLI V3
  skips such profiles until /upgrade-agent converts them.
• Kiro agent profiles accept the V3 fields excludedTools and includePowers,
  and the V3 permission capabilities power and sandbox_network.
• CC-SET-033 flags a non-boolean idleCompaction in Claude Code settings
  (key added in v2.1.290, documented by the v2.1.299 release notes).

Fixed

• Index Kiro V3 hook edit spans once per document, preserving duplicate decoded-key guards and avoiding quadratic alias validation and diagnostic-location scans.
• Missing or empty MCP tool descriptions no longer produce MCP-002 errors. Descriptions are optional in the MCP schema; MCP-004 provides informational advice instead.
• Add opt-in unsafe migrations for CC-SET-016 permission tool names, COP-027 infer, and KR-HK-011 version strings 1 / 1.0; add unsafe OC-DEP-005 cleanup only after manually copying TUI settings. Keep OC-DEP-001 safe and OC-DEP-002 without a key-only fix.
• CDX-005 accepts zero and removes the invented 65536-byte ceiling on project_doc_max_bytes; negative and non-integer values remain invalid.
• CDX-CFG-001 follows the current Codex approval-policy schema, including granular objects.
• Add opt-in unsafe quoted-boolean fixes for Claude settings, hook once, output-style keep-coding-instructions, and MCP alwaysLoad. Converting ignored strings can activate security-sensitive behavior, so plain --fix leaves them untouched. Other wrong types remain manual corrections.
• Restore VS Code lint and native integration checks: configure ESLint, use the
  compiled test entry point, isolate the test profile, and check explicit settings.
• Accept the Codex rust-v0.162.0 config keys: the [tui] options (mouse_scroll_speed,
  keymap, agents_overview_grouping and the rest of the current schema) and the new
  root keys (goals, cloud, browser_use, computer_use and others).
• Accept the Codex rust-v0.163.0 config keys: root
  include_environment_context_time, js_repl_node_module_dirs,
  js_repl_node_path and the 67 new [features] flags.
• Accept numeric autoCompactWindow on Claude Code subagent frontmatter (v2.1.296).
  A non-number is a CC-AG-007 parse error. No range rule: the published
  AgentDefinition type is number, and the 100000-1000000 window is documented
  for settings and /autocompact, not this field.

Changed

• Make CC-MEM-007, PE-001/002/003, XP-001, CC-PL-003, and MCP-004 informational advice rather than warnings or errors. Keep CC-AG-012 as a permission-safety warning without rewriting a valid mode.
• Update rustls to 0.23.46, quinn-proto to 0.11.18, and refresh editor and website dependency locks.
• Update VS Code development tooling to Mocha 12 and VSCE 4; package and publish on Node 22.
• Bump uuid to 1.27.0 and tokio to 1.53.2. Lockfile only.
• Review Claude Code 2.1.295 and Cursor 3.24.9; no new validation constraints.
• Review Claude Code v2.1.296 and Cursor 3.24.12. The gateway
  managed.policies[].code key lives in gateway.yaml, which agnix does not
  validate. Refresh the reviewed Claude Code hooks, memory, plugins, skills,
  and subagents spec hashes. Hook event names, skill frontmatter fields, plugin
  manifest keys, and the four-hop memory import limit are unchanged.
• Review Claude Code v2.1.299, Codex CLI rust-v0.163.0, Cursor 3.24.18 and
  Gemini CLI v0.64.0; refresh the drifted Cline and Cursor spec hashes.
• Review Kiro CLI 2.30.0 through 2.31.1 (V3 rollout) and add V3 validation.
• Review Cline v4.1.24; rule symlink loading and skill discovery change runtime behavior, with no new validation constraints.

v0.57.0

Compare Source

Fixed

• Run workspace checks once over all requested directories and attribute version
  pinning diagnostics to the configuration actually loaded.
• Require suppression comments and add --ignore-inline-suppressions and
  ignore_inline_suppressions for CI validation.
• Honor skill resource exclusions and skip dependency directories in CC-SK-021.
• Validate local agent name and frontmatter skip conditions, and allow plugin
  agents to load under their filename when frontmatter is absent or malformed.

Added

• CC-PL-017 warns on unknown plugin manifest keys.

Changed

• Correct the Claude API upload warning to 30 MB, with no local Claude Code cap.
• Warn for missing skill references, redundant tool exclusions and plugin naming.
• Retire CC-SK-009, CC-SK-012 and CC-HK-004; migration metadata describes why.
• Accept Codex 0.161 Daybreak settings and review Kiro CLI 2.28 hook matchers.
• Review Claude Code 2.1.294, Cline 4.1.23 and Amp many-many-pucks;
  no new validation constraints.

Security

• Update website dependencies and pin patched Tinypool, selector-parser and
  SockJS UUID versions. Upstream braces and sprintf-js advisories remain open.

Changed

• Refresh reviewed releases: Claude Code 2.1.292, Codex CLI 0.160.1,
  OpenCode 1.18.35, Cursor 3.23.23 and Gemini CLI 0.63.0. Refresh the
  reviewed Claude Code specification baselines.

v0.56.6

Compare Source

Changed

• Rewrite the agent-facing text for current models: AGENTS.md, the /agnix
  command, the agnix-agent agent and both agnix skills. Rules are stated once
  with their reasons; the "follow the flow exactly, no deviations" rails are
  gone; the revuto-review merge rule now says not to wait when revuto is
  capped. Rule IDs, count phrases, tier lines and config keys are unchanged.

Fixed

• Preserve the workspace root for nested directory and watch scans so command
  and skill wrappers can import files from the project root without REF-001.
  Workspace-relative exclusions still apply, and scans stay limited to the
  requested paths (#​1629).
• /agnix reported zero issues when the agent's AGNIX_RESULT block was
  missing; it now shows the raw output. The result block now carries the
  diagnostics the report table needs.
• agnix-agent loaded the skill with the Skill tool. The skill shares its name
  with the /agnix command, so that call can load the command and spawn the
  agent again. The agent now runs the CLI itself.
• The plugin skill defaulted --target to claude-code, while the command and
  the CLI default to generic. The skill now uses the CLI default, and the
  command, agent and skills accept kiro.

v0.56.5

Compare Source

Fixed

• Retire CC-SK-011 and its unsafe auto-fix. Inline user permission can invoke a
  skill with both invocation flags; preserve the automatic-invocation guard.

Changed

• Refresh reviewed Claude Code, Cursor cloud environment, and GitHub Copilot
  specification baselines after documentation clarifications.

v0.56.4

Compare Source

Fixed

• Use event-specific command timeout advice, skip unenforced async timeouts,
  and handle the separate SessionEnd settings budget.
• Preserve matcher alternatives, match-all values, JavaScript regex paths and
  explicit older SessionEnd versions. Accept current tools and hook handlers,
  and free-form Claude skill metadata without weakening generic metadata checks.
• Clarify the permission inheritance version boundary and track modern MCP
  per-request metadata as an uncovered validation surface.

Changed

• Advance the reviewed Claude Code release baseline to 2.1.289.
• Align hook fix metadata with the edits actually emitted by the validator.

v0.56.3

Compare Source

Fixed

• CC-HK-008 checks executed scripts instead of script-like arguments, including
  shell chains and interpreter exec form.
• XML checks skip HTML comments, backslash escapes and wrapped code spans while
  preserving real tag locations, fixes and platform guard comments.
• Accept current Claude Code hook matchers, subagent experimental settings and
  HTTPS MCP bundles. Warn about ignored agent once fields. Treat plugin semver
  as optional dependency advice and align fix metadata with emitted edits.

Changed

• Use line tables for dev/test debug information. Keep Cargo as the local test
  default after comparing it with nextest.
• Keep native Cargo tests in CI and releases after comparing nextest. Owner PRs
  run lint and merge contracts; external contributions and daily runs keep the
  full suite, including doc tests.
• Refresh six reviewed specification baselines and clarify legacy MCP checks.

v0.56.2

Compare Source

Changed

• Update the Tiyuvta README link and copy for company model deployment and fine-tuning services.
• Advance Claude Code to v2.1.288, Codex CLI to rust-v0.160.0, Cline to
  v4.1.22, Cursor to 3.23.12, OpenCode to v1.18.34, and Kiro CLI to
  2.27.0 after reviewing current vendor documentation and releases.
• Update CodeQL action components together to v4.38.2 and group future updates.
• Update rust-i18n to 4.2.4 with a documented foldhash duplicate exception.

Fixed

• KIRO-009 accepts line selectors in file references and checks folder references
  against directory targets.

v0.56.1

Compare Source

Fixed

• XP-001 no longer reports Claude-specific features found inside fenced code
  blocks. Command examples such as dig @192.168.40.4 in a bash fence were
  read as @file imports and reported as errors.
• XP-001 now skips every code form the other Markdown extractors skip: tilde
  fences, fences nested inside a longer fence, indented code blocks and inline
  code spans. It shares the fence scanner with extract_imports instead of
  toggling on triple-backtick lines.

Security

• Patch brace-expansion (5.0.12, 2.1.7) and fast-uri (3.1.8) in the website
  and VS Code lockfiles for GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7,
  GHSA-q2hr-2g5m-vwhr and GHSA-hrr3-gc8f-f4qj. Lock-only, no manifest change.

v0.56.0

Compare Source

Changed

• Advance Amp to plaid-mode, Claude Code to v2.1.285, Codex CLI to
  rust-v0.159.1, Cursor to 3.22.12, Gemini CLI to v0.62.0, and OpenCode
  to v1.18.33 after reviewing their primary releases. Claude Code adds the
  managed-only allowedProviders policy, validated by CC-SET-032; the other
  changes are outside agnix's configuration schemas.
• Consolidate repository instructions in AGENTS.md. Update instruction checks,
  rule bookkeeping and contributor guidance while retaining CLAUDE.md validation
  for user projects and fixtures.
• Add quick and full local preflight commands and reuse the full checks in the
  pre-push hook. Report per-check timing and fail on missing prerequisites.
• Cancel superseded CI and Security PR runs while preserving their main and
  scheduled runs.
• Remove the redundant release build before CodeQL's Rust extraction while
  retaining the security query suite and dependency checks.

v0.55.0

Compare Source

Added

• CC-SK-022 flags local Claude Code skill names reserved for synced skills, which
  would otherwise make the skill silently fail to load.

Fixed

• CC-AG-019 now accepts the documented omitClaudeMd subagent field and
  validates its boolean type through the agent schema.
• Cline rules under .cline/rules/ now receive the same content and
  frontmatter checks as Markdown rules under .clinerules/.
• CC-HK-002 now rejects Claude Code agent hooks on PermissionRequest while
  continuing to allow prompt hooks on that event.
• AMP-004 accepts the documented amp.runner.autoUpdate.enabled,
  amp.remoteThreadCreation.enabled, and amp.updates.mode settings keys.
• The MCP server uses rmcp's current ServerConfig name, keeping warning-denied
  builds clean after the rmcp 3.4 update.

Changed

• Update the Homebrew tap through a reviewed PR during releases instead of
  writing the formula directly to its default branch.
• Advance Amp to less-noise, Claude Code to v2.1.283, Cline to
  v4.1.21, Codex CLI to rust-v0.157.1, Cursor to 3.22.7, Gemini CLI to
  v0.61.0, Kiro CLI to 2.24.0, and OpenCode to v1.18.32 after reviewing
  their live releases. The OpenCode and Gemini releases do not change a
  validated configuration format.
• Refresh the CodeQL action components together at v4.38.1, taiki-e/install-action
  at v2.87.18, and anthropics/claude-code-action at v1.0.231.
• Refresh nine spec source hashes after reviewing current Claude Code, Cline,
  Cursor, and MCP documentation. The Cline rules layout and Claude hook
  behavior changes are handled above.
• Add Claude Code 2.1.277+ AGENTS.md fallback and combined-instruction support
  to the tracked compatibility surface. Existing AGM and XP rules already
  validate the documented file, imports, hierarchy, and size constraints.
• Advance Claude Code to v2.1.278, Codex CLI to rust-v0.155.1, and Cursor
  to 3.21.16; refresh the five changed Claude documentation hashes after
  reviewing the current vendor sources. The other release changes affect
  runtime classifier and reasoning-summary defaults outside validated schemas.
• Consolidate the current Rust patch updates, CodeQL v4.38.0 pins,
  actions/setup-java v6.0.1, and anthropics/claude-code-action v1.0.226.
• Advance Amp to one-runner-is-now-enough, Claude Code to v2.1.276, Cline
  to v4.1.19, Codex CLI to rust-v0.155.0, Cursor to 3.21.9, and Kiro CLI
  to 2.22.0 after reviewing their primary release notes. Only Amp changed a
  validated configuration contract; the other releases cover runtime, UI,
  security, model, and session behavior outside the current schemas.

v0.54.0

Compare Source

Added

• CUR-017 validates the matcher field on Cursor hook entries as a regex
  string, now that the hooks documentation types it as one.

Changed

• CUR-010 requires version in .cursor/hooks.json and checks that it is a
  positive integer, matching the hooks documentation's per-file options table.
• Refresh the Cursor rules, hooks, and cloud-agent setup specification hashes
  after review. CUR-006 now cites the help-center migration guide, where the
  .cursorrules deprecation notice moved.
• Advance Claude Code to v2.1.273, Cursor to 3.20.21, Gemini CLI to
  v0.60.0, and OpenCode to v1.18.31 after reviewing their primary release
  notes. The changes are runtime, security, session-restoration, provider, and
  cloud-agent updates outside agnix's validated configuration schemas.
• Update rustls to 0.23.45 to address RUSTSEC-2026-0285, which allowed
  selected TLS 1.3 handshake messages at the wrong encryption level.

Fixed

• CUR-016 no longer rejects the published environment schema's
  egressAllowlist, egressMode, chromeExecutablePath, enable_testing,
  image, and build.dockerfileContents fields, and validates their types.

v0.53.0

Compare Source

Added

• CC-SET-031 validates top-level and per-model maxEffortLevel caps added in
  Claude Code 2.1.267.

Changed

• Accept the eight configuration keys added in Codex CLI 0.154.0, including
  features.worktrees, features.unified_exec_tty, and the new TUI preferences.
• Advance current Amp, Claude Code, Codex CLI, Cursor, Gemini CLI, Kiro CLI,
  and OpenCode release baselines after reviewing their primary release notes.
  Refresh Cursor's hooks specification hash; its documented event and field
  contracts remain covered by CUR-010 through CUR-019.
• Advance the Claude Code release baseline to v2.1.263 and refresh the
  current hooks, memory, plugins, skills, and subagent documentation hashes.
  The patch release contains reliability fixes only, and the documented
  configuration contracts remain covered by existing rules.

v0.52.2

Compare Source

Added

• CC-SET-030 detects local-command entries that Claude Code skips in
  managedMcpServers.

Changed

• Refresh current Claude Code, Codex CLI, OpenCode, Kiro, Cline, Cursor, Amp,
  Cursor/Copilot spec, and Copilot inventory baselines.
• Accept Codex CLI 0.153 configuration keys and synchronize CodeQL v4.37.9
  action pins.

Fixed

• XML-001 now ignores fenced code blocks indented under ordered list items.

Changed

• Claude Code 2.1.261 and ecosystem baseline refresh. Add CC-SET-030
  for local-command entries that Claude Code silently skips in
  managedMcpServers; accept Codex CLI 0.153's tui.auto_recap,
  tui.disable_paste_burst, and experimental context-management keys; and
  refresh Amp, Cline, Cursor, Kiro, OpenCode, and changed specification hashes.
• Maintenance dependencies. Keep CodeQL init/analyze together on v4.37.9
  and refresh the VS Code and docs-site npm lockfiles.
• Claude Code and Codex patch baselines. Advance Claude Code to v2.1.258
  and Codex CLI to rust-v0.152.1. Their primary notes contain only a macOS
  launch repair, remote-session message replay repair, and Guardian Node REPL
  policy fix; neither patch changes a configuration schema agnix validates.
• OpenCode release baseline. Advance OpenCode to v1.18.26; its primary
  release notes contain model-provider, replay, timing, patch metadata, Azure
  sign-in, and desktop bug fixes, with no change to a configuration surface
  agnix validates.
• Tool and specification baselines. Advance Amp to fable-5.1, Claude
  Code to v2.1.257, Codex CLI to rust-v0.152.0, Cursor to 3.18.25, and
  Gemini CLI to v0.58.0 after reviewing their current primary release notes
  and validated configuration surfaces. Refresh the Claude hooks, plugins,
  skills, and subagent documentation hashes after confirming the documented
  event, manifest, frontmatter, and matcher contracts remain covered by the
  existing rules. Claude's new clock and read-boundary preferences are not
  correctness constraints agnix currently validates; Codex's package-style MCP
  names, per-tool output limits, app-server timeout, and opt-in planning flag
  are accepted by the current lenient nested configuration handling. The Amp,
  Cursor, and Gemini markers do not change a schema agnix validates.
• Maintenance dependencies. Update uuid to 1.26.0, synchronize both
  CodeQL steps on 4.37.8, and refresh the pinned setup-java, install-action,
  and Claude Code action revisions.
• Tool release baselines. Advance Amp through amp-on-ios-and-macos, Claude
  Code to v2.1.251, Codex CLI to rust-v0.151.0, Cursor to 3.18.9, OpenCode
  to v1.18.25, and Kiro CLI to 2.20.0 after reviewing their current upstream
  notes and validated configuration surfaces. Claude Code added the
  PreModelSwitch and PostModelSwitch hook events, now accepted by the
  existing CC-HK-001 rule; the other releases do not change a schema agnix
  validates. The
  Codex research inventory now also records its shared MCP rule family and
  accepted .yml, .mcp.json, [mcp_servers.*], and managed-environment
  requirements.toml surfaces, with parity regression assertions.

Fixed

• Floating v0 tag pushes no longer trigger the release pipeline. The
  release workflow matched every v* tag, so the manually pushed floating
  action tag ran the entire pipeline with version "0": the semver verification
  guards stopped crates.io, npm, PyPI, and VS Code, but a junk GitHub release
  was created, a junk Zed update PR was opened, and a version-"0" plugin update
  reached the JetBrains marketplace (all three cleaned up the same day; the
  marketplace update was deleted via the vendor API). The trigger now matches
  only semver-shaped tags (v[0-9]*.[0-9]*.[0-9]*), which the automated
  floating-tag move never produces - and that move uses GITHUB_TOKEN, whose
  events do not start workflows anyway.

Fixed

• uses: agent-sh/agnix@v0 did not resolve. The README, configuration
  guide, and marketplace snippet all instruct agent-sh/agnix@v0, but no v0
  tag or branch has ever existed - every user who copied the documented GitHub
  Action snippet got "unable to resolve action". The repo's own CI never
  noticed because it exercises the action as uses: ./. The floating tag now
  exists (pointing at v0.52.1) and the release workflow force-moves it to each
  new release commit, so the documented ref tracks the latest release the way
  major-version action tags are expected to.

Fixed

• Homebrew tap was 34 releases behind. brew install agnix built v0.18.0
  from source because nothing told the tap about new releases: the tap's
  update-formula.yml listens for a release-published dispatch that the main
  repository never sent. The tap has been dispatched to v0.52.1 manually, the
  vestigial in-repo Formula/agnix.rb copy is synced to match, and release.yml now
  dispatches the tap directly from a new homebrew job. A separate
  release: published workflow could never have worked here: the release is
  published with the default GITHUB_TOKEN, and events created by
  GITHUB_TOKEN do not start workflow runs - which is exactly how the drift
  stayed invisible. The job reuses the existing cross-repo COMMITTER_TOKEN
  (already pushing to other repos in the zed and version-docs jobs), so no new
  secret is needed; the dispatch shape was verified live against the tap's
  update-formula.yml. Manual fallback stays
  gh workflow run update-formula.yml --repo agent-sh/homebrew-agnix -f tag=<tag>.

Changed

• CLAUDE.md/AGENTS.md no longer pin a stale version. The "Current State"
  section claimed v0.37.3 fifteen releases later; nothing in the bookkeeping
  sync touches that line, so it now points at GitHub releases instead of
  hardcoding a number that drifts.

v0.52.1

Compare Source

Fixed

• pre-commit hooks skipped nearly every file agnix validates
  (#​1444,
  #​1445). The files: pattern
  in .pre-commit-hooks.yaml was ^(...)$-anchored with root-level entries, so
  SKILL\.md matched only a repository-root SKILL.md - a skill at its normal
  .claude/skills/<name>/SKILL.md location, a nested AGENTS.md, a plugin
  manifest, or a scoped Copilot instruction file never reached agnix, and the
  hook reported Passed with nothing validated. The pattern now covers
  every tool-scoped path shape file_types/detection.rs recognizes: the
  filename-based entries (SKILL.md, the CLAUDE.md/AGENTS.md variants,
  GEMINI.md, plugin.json, mcp.json, *.mcp.json, mcp-*.json,
  opencode.json{,c}, gemini-extension.json, the .cursorrules,
  .clinerules, .roorules/.roomodes/.rooignore, and .windsurfrules
  legacy files) match at any depth via a shared (?:.*/)? prefix, and the
  .claude, .github, .cursor, .codex, .gemini, .amp, .agents,
  .roo, .windsurf, and .kiro directory surfaces are enumerated -
  including .cursor/rules/**/*.md so CUR-020 can flag plain-markdown rules
  Cursor silently ignores. Also covers plugin
  hooks/hooks.json at any root, bare agents/ directories (which detection
  validates as agent configs, agents/README.md included), .kiro/settings.json,
  and the undotted codex/requirements.toml system surface - while deliberately
  not matching .codex/requirements.toml, which Codex does not read. Verified
  against the 149 concrete paths in detection.rs's own tests; the only
  remaining exclusions are deliberate: detection's loose fallback arms outside a
  tool directory (a bare settings.json, hooks.json, environment.json,
  POWER.md, or requirements.toml anywhere), uppercase directory spellings,
  and generic markdown. Verified end to end: a repo with a nested skill, a
  package-level AGENTS.md, GEMINI.md, and a scoped instruction file - all
  invisible to the old pattern - now produces their diagnostics through the
  hook.

v0.52.0

Compare Source

Changed

• pre-commit hooks install agnix themselves
  (#​1439). The three hooks in
  .pre-commit-hooks.yaml move from language: system to language: python,
  so pre-commit and prek create a virtualenv and pull the agnix wheel that
  matches the pinned rev instead of requiring a manual cargo install on
  PATH. This is what the new PyPI distribution makes possible. A root
  pyproject.toml exists solely for that install: pre-commit clones the repo
  and pip install .s it, so the clone has to be pip-installable, and this shim
  declares the matching agnix==<version> as its only dependency.
  scripts/sync-versions.sh moves the shim's version and its pin together, so a
  hook pinned at rev: vX.Y.Z always runs agnix X.Y.Z. Platforms without a
  wheel can still pin language: system in their own config, which the
  configuration guide now documents.

Added

• CC-SET-028: invalid feedbackDrafts setting
  (#​1435). Claude Code v2.1.247
  added the SendFeedback tool and the feedbackDrafts setting that governs it.
  The setting is a string enum - notify, quiet, or off - so the natural
  guess of a boolean silently leaves the default notify in place. Flags any
  value outside the documented enum.
• CC-SET-029: invalid spinnerTipsOverride shape
  (#​1435). v2.1.247 extended the
  key with tip objects (id, text, cooldownSessions, priority), tipsFile,
  and label. Claude Code drops an invalid tip with a debug warning instead of
  rejecting the file, so a malformed tip is simply never shown. Validates the
  object's fields, each tip entry, the documented id/text limits, the
  0-1000 and -10-10 numeric ranges, the 40-character label cap, and
  that tipsFile is absolute or ~/-rooted.
• CC-PL-016: plugin name not kebab-case. The plugin reference documents
  name as a kebab-case identifier with no spaces, and v2.1.247 hardened
  marketplace handling to reject names containing control or invisible
  characters. Those fail kebab-case by construction, so this catches them before
  a plugin reaches a marketplace.

Fixed

• SendFeedback and ListAgents reported as unknown tools
  (#​1435). KNOWN_AGENT_TOOLS
  had not been refreshed since 2026-07-31, so CC-AG-009/010 flagged two
  documented built-in tools - ListAgents from Claude Code v2.1.224 and
  SendFeedback from v2.1.238 - as invalid names in an agent's tools or
  disallowedTools list. Diffed the whole list against the live tools reference,
  and these were the only two missing.

Changed

• Tool baselines refreshed (closes
  #​1435,
  #​1436,
  #​1437). Claude Code
  v2.1.246 to v2.1.247, Cline v4.1.15 to v4.1.16, and Codex CLI
  rust-v0.149.1 to rust-v0.150.0. Cline's release moves hook workspace
  resolution from shared global state to the VS Code window, which changes
  runtime behaviour rather than any validated file contract. Codex adds an
  Interrupt hook event; CDX-PL-013 validates hook shape without an event-name
  allowlist, so nothing false-positives, and the missing allowlist is recorded in
  RESEARCH-TRACKING along with the uncovered spinnerVerbs setting.

Fixed

• Tool-release triage produced no summaries. Two separate faults, both of
  which the watcher degrades silently to "post the raw changelog": the
  GLM_API_KEY secret had expired, and scripts/glm-extract.js ran with an
  output budget too small for a thinking model. Reasoning tokens are drawn from
  the same max_tokens budget as the answer, so at 4096 the model intermittently
  spent the entire budget reasoning and returned finish_reason: "length" with
  empty content (reproduced at 1 failure in 3 runs, 4095 of 4096 tokens on
  reasoning). MAX_TOKENS is now 32768, roughly six times the 1.9k-5.2k
  reasoning observed on real triage prompts, and thinking stays enabled because
  it measurably improves the "does this touch a validated config surface?"
  judgement. The default model is now named glm-5.3 explicitly rather than
  relying on the endpoint's glm-5 alias, so an alias move cannot change triage
  behaviour silently. The empty-content error now also reports finish_reason,
  reasoning size, and usage instead of just "empty content", and
  scripts/glm-extract.test.js - which no workflow ran - is now part of CI.

v0.51.0

Compare Source

Added

• PyPI distribution. pip install agnix and uvx agnix . now work. The
  wheels in pypi/ bundle the release binary for each supported target
  (manylinux and musllinux x86_64, manylinux aarch64, macOS Apple silicon,
  Windows x86_64), so there is no Rust toolchain to install and nothing is
  downloaded after install. python -m agnix and a small Python API
  (agnix.run, agnix.lint, agnix.version) mirror the Node wrapper.
  pypi/build_wheels.py repacks the archives the release already built and
  verified against their .sha256 sidecars, deriving each manylinux tag from
  the binary's own glibc symbol references rather than a hardcoded floor.
• JetBrains plugin: WSL execution mode
  (#​1346). IntelliJ on Windows
  can now run agnix-lsp from inside a WSL distribution for projects that live
  in WSL, without Remote Development. The plugin launches an argument-safe
  wsl.exe --distribution <name> --exec <path> command, maps document and
  workspace URIs at the LSP boundary, validates configuration, and skips the
  host-local binary installer. Native launches remain unchanged.

Changed

• Tool and spec baselines refreshed (closes
  #​1426,
  #​1427,
  #​1428,
  #​1429). Advanced Claude Code
  from v2.1.245 to v2.1.246, Cursor from 3.17.19 to 3.17.21, and amp from
  friendly-urls-for-sharing-orbs to setup-without-a-commit, and re-baselined
  the eight drifted spec sources (Claude Code hooks/skills/plugins-reference;
  Cursor rules/hooks/subagents/mcp and the environment schema). Reviewing all
  eight against the rules they back found no contract change that agnix asserts
  incorrectly: Claude Code's 31 known hook events still cover every event the
  hooks reference documents, the skill frontmatter allowlist still covers all 20
  documented fields, the plugin path-bearing keys remain a superset of the
  documented table, Cursor's hook events (including the still-supported
  beforeShellExecution / beforeMCPExecution) and per-script options are
  unchanged, subagent frontmatter and model-parameter syntax still validate, the
  environment schema's property set still matches ALLOWED_ROOT_FIELDS, and
  neither MCP nor hook entries reject unknown fields, so newly documented keys
  cannot produce false positives. Coverage gaps the review surfaced (upstream's
  new wildcard-permission warning, unvalidated keybindings.json, Cursor's
  now-required MCP type and STDIO-only envFile) are recorded in
  RESEARCH-TRACKING. amp's release stores pre-clone and pre-setup scripts in
  server-side project settings rather than any validated file. Cline
  (v4.1.16) and Codex (rust-v0.150.0) published after those issues were
  opened and are deliberately left at their previous baselines so the watcher
  files their own triage issues.
• Tool release baselines. Advanced Claude Code from v2.1.243 to
  v2.1.245 and OpenCode from v1.18.22 to v1.18.23 after reviewing their
  live release notes. Claude Code's change is a Linux glibc 2.44 startup-crash
  fix; OpenCode's changes fix Cloudflare AI Gateway routing, Anthropic model
  slugs, parent-session headers, and immutable-OIDC GitHub auth. None changes
  an agnix-validated configuration contract. Advanced Gemini CLI from v0.56.0
  to v0.57.0; its changes affect OAuth redirects, IDE and Git worktree state,
  runtime retry and cancellation behavior, agent enablement, and command help,
  without changing an agnix-validated configuration contract.

Fixed

• Stale rule count in the npm long description. npm/README.md advertised
  405 rules against a canonical 451, and no automation covered it, so the number
  had drifted for several releases and was copied into the new PyPI README.
  Corrected, and both wrapper READMEs are now in sync-rule-bookkeeping.js's
  COUNT_FILES so CI fails on the next drift.

v0.50.0

Compare Source

Added

• Claude Code 2.1.242 settings validation. Add CC-SET-025 for the
  user-or-managed modelPicker scope and documented option shape,
  CC-SET-026 for the promptCacheTtl enum, and CC-SET-027 for the
  subagentPromptCacheTtl enum.

Changed

• Tool release baselines. Advance Claude Code to v2.1.243, Codex CLI to
  rust-v0.149.1, Cursor to 3.17.19, and OpenCode to v1.18.22. Accept
  Codex's new compaction_image_budget feature flag; the remaining release
  changes outside the three Claude settings above do not alter a validated
  configuration contract.
• Tool release baselines. Advance Cline to v4.1.15 and Amp to
  friendly-urls-for-sharing-orbs after reviewing the intervening live release
  notes. The changes affect runtime MCP approval behavior, model metadata,
  telemetry, and shared-orb URLs, not an agnix-validated configuration contract.
• Maintenance refresh. Advance Claude Code to v2.1.241, Cline to
  v4.1.13, OpenCode to v1.18.21, and Amp to explain-usage after reviewing
  the live releases against agnix's validated configuration surfaces. Refresh
  all CodeQL action pins to v4.37.7; these pins move together to avoid the
  action's mixed-version configuration failure.
• Claude Code specification baselines. Refresh the reviewed hooks, memory,
  plugins, skills, and subagent documentation hashes. The current documented
  hook lifecycle and configuration surfaces are already represented by the
  existing schemas and rule families, so no validator rule changes are needed.
• Cursor environment MCP policy. Update CUR-016 for the published
  disableAllMcpServers and mcpServerAllowlist fields, including HTTP and
  stdio server identities, optional tool allowlists, and closed-field checks.
• Tool release baselines. Advance Claude Code to v2.1.238, Codex CLI to
  rust-v0.149.0, Cursor to 3.17.8, Kiro CLI to 2.19.0, Gemini CLI to
  v0.56.0, OpenCode to v1.18.19, and Amp to mcp-in-orbs. Apart from the
  Cursor schema change above, the reviewed releases do not change an
  agnix-validated configuration contract.

Fixed

• Rust 1.98 clippy compatibility. Replace a constant-only format! call
  that is now rejected by clippy::useless_format.
• CC-HK-025 Notification matcher compatibility. Accept the documented
  elicitation_url_dialog matcher instead of reporting it as invalid, and
  advance the reviewed Claude Code hooks, memory, plugins, skills, and
  subagent specification baselines.
• Spec drift baseline hashing. Recalculate the five reviewed Claude Code
  hashes with the sentinel's trailing-newline normalization so those sources
  do not immediately re-report drift.
• RustSec dependency audit. Update h2 from 0.4.13 to 0.4.16 to address
  RUSTSEC-2026-0258 (unbounded empty DATA frames).

Changed

• Tool release baselines. Advanced Claude Code from v2.1.232 to
  v2.1.235, Cline from v4.1.9 to v4.1.10, and Amp's release marker from
  global-plugins-and-skills to edu-discount. These releases do not change
  an agnix-validated configuration surface, so no validator or rule update is
  required.

v0.49.0

Compare Source

Added

• CC-SET-024: ineffective project-level sandbox.ripgrep
  (#​1358). Claude Code
  v2.1.232 honors the sandbox ripgrep binary only from user settings, managed
  settings, and the --settings flag, so a value in a repository's
  .claude/settings.json or .claude/settings.local.json is silently ignored.
  agnix now warns on that dead override and points at the scopes that still
  apply. User and managed settings are unaffected.

Changed

• Tool release baselines (#​1356, #​1357, #​1358, #​1359, #​1375). Advanced the
  tracked releases for Kiro CLI (2.17.0 to 2.18.0), OpenCode (v1.18.17 to
  v1.18.18), Claude Code (v2.1.229 to v2.1.232), Cline (v4.1.8 to
  v4.1.9), and Cursor (3.15.19 to 3.16.17). Only the Claude Code and Kiro
  CLI releases touched a validated surface; the OpenCode, Cline, and Cursor
  deltas were bookkeeping only.
• Kiro CLI inventory covers AGENTS.md steering (#​1356). Kiro CLI 2.18.0
  loads nested AGENTS.md files as steering context from anywhere in the
  workspace tree, so the tool inventory and release baseline now list
  AGENTS.md and the agents_md validator (AGM rules) for Kiro. No validation
  behaviour change - agnix already validated those files.

v0.48.1

Compare Source

Changed

• Tool release and spec baselines (#​1354). Advanced the tracked releases for
  Claude Code (v2.1.226 to v2.1.229), OpenCode (v1.18.15 to v1.18.17),
  Kiro CLI (2.16.0 to 2.17.0), Cline (v4.1.6 to v4.1.8), Cursor
  (3.15.6 to 3.15.19), Gemini CLI (v0.54.4 to v0.55.1), and amp (news
  marker size-the-orbs-of-production to global-plugins-and-skills), plus the
  cursor-environment spec hash. Registered the output_style, gemini_agent,
  and per-client skill validators in the tool inventory and filled in the
  matching config surfaces and rule prefixes (CC-OS, MCP, OC-SK, CR-SK,
  GM-AG) in knowledge-base/RESEARCH-TRACKING.md. Watcher bookkeeping only -
  no validation behaviour changes.

Fixed

• Skill directory size exclusions (#​1360). AS-015 now omits paths matched
  by top-level exclude or [files].exclude when calculating the 8 MB skill
  directory total, while continuing to validate the rest of the skill.
• CC-MEM-001 false positive when several paths are passed on the command
  line (#​1368). The
  workspace root came from the parent of the first path, so a file in a
  subdirectory listed first became the root and CLAUDE.md's root-relative
  @imports were reported as escaping the project. Since pre-commit passes
  matched files in sorted order, .claude/... sorted ahead of CLAUDE.md and
  the same tree passed or failed depending on argument order. The root is now
  the deepest common ancestor of every path, walked up to the nearest .git or
  .agnix.toml marker, so results no longer depend on argument order or on
  which files a commit happens to touch.
• Linux x86_64 release binary unusable on glibc older than 2.39
  (#​1371). The x86_64 gnu
  build ran natively on ubuntu-latest, so it linked the runner's glibc and
  failed at load time with version 'GLIBC_2.39' not found on Debian bookworm,
  RHEL/Rocky 9, and Ubuntu 22.04. Both gnu targets now build through cross
  against an old sysroot (currently GLIBC_2.18), a release gate fails the
  build if any binary needs newer than GLIBC_2.31, and npm install -g agnix
  plus scripts/download.sh probe the downloaded binary and retry with the
  static musl archive when the host cannot load it.

Security

• Dependency lockfile bumps (website + VS Code extension): js-yaml
  GHSA-5p4m-2wfm-xmqj (quadratic !!omap complexity) and nanoid
  GHSA-2v37-7h3g-55p8 (zero-size generator loop). Lockfile-only; no manifest
  range changes.

v0.48.0

Compare Source

Fixed

• Claude Code skill and hook schema compatibility. Accept skills without
  explicit name or description, validate the documented disallowed-tools
  field with the existing Claude tool vocabulary, and parse prompt-hook
  continueOnBlock as a boolean.
• Claude Code specification baselines. Advance the reviewed hooks, memory,
  plugins, skills, and subagent documentation hashes after auditing the current
  validation contracts.

v0.47.0

Compare Source

Added

• CC-SET-022 and CC-SET-023. Validate Claude Code 2.1.224's crossSessionInbound and dialogExpiry enums. Rule count 445 -> 447.

Changed

• Tool release baselines. Advanced Claude Code to v2.1.226, Codex CLI to rust-v0.147.0, OpenCode to v1.18.15, Cline to v4.1.6, Cursor to 3.15.6, Gemini CLI to v0.54.4, and Amp's release marker to size-the-orbs-of-production after reviewing their current validated surfaces.
• Dependency refresh. Updated rmcp to 3.1.2, ignore to 0.4.33, and similar to 3.1.2.
• CI action refresh. Updated actions/setup-node to 7.0.0, github/codeql-action to 4.37.6, softprops/action-gh-release to 3.0.2, and actions/attest to 4.2.2, keeping synchronized action families and SHA assertions in lockstep.

Fixed

• Claude Code 2.1.224 credential masking compatibility. Extend CC-SET-012 for structured environment extraction, JWT-aware decode and maskClaims, AWS credential pairs, and SigV4 policies.
• Codex 0.147 plugin name compatibility. Accept dotted legacy plugin names while rejecting leading, trailing, and repeated dots.

v0.46.0

Compare Source

Added

• CC-SET-021: Ineffective Project Remote Control Auto-start. Claude Code 2.1.222 no longer honors remoteControlAtStartup: true in project settings; agnix now warns on the ignored value while allowing project-level false and managed settings. Rule count 444 -> 445.

Changed

• Tool release baselines. Advanced Claude Code to v2.1.222, OpenCode to v1.18.13, Cline to v4.1.4, Cursor to 3.14.27, the Agent Skills specification to 217be548739f, and Amp's release marker to attach-anything after reviewing their current release notes and validated configuration surfaces (closes #​1311, #​1312, #​1313, #​1316, #​1317, #​1318, and #​1319).

Fixed

• Claude Code credential protection compatibility. Extend CC-SET-012 for environment-variable masking added in 2.1.199 and file masking added in 2.1.221, including ECMAScript extraction validation, structured file controls, injection host lists, environment variable names, and allowPlaintextInject; accept mask-only fields that Claude Code ignores on deny entries; accept the newly documented skills: "." plugin-root path under CC-PL-007.
• Agent Skills metadata type enforcement. Reject non-map metadata and metadata entries with non-string keys or values, matching the clarified Agent Skills specification instead of silently coercing YAML scalars.

Security

• Undici 7.29.0. Refresh both npm lockfiles for the upstream cache-control, request-header, retry-response, and cookie validation security fixes from Dependabot PR #​1314.

v0.45.0

Compare Source

Added

• CUR-020: Ignored Plain Markdown Cursor Rule. Cursor now explicitly documents that project rules under .cursor/rules/ must use .mdc; plain .md files are ignored. agnix reports the silent failure and suggests renaming the file. Rule count 443 -> 444.

Fixed

• Cursor 3.14 configuration compatibility. Accept parameterized subagent model IDs such as composer-2.5[] and claude-opus-5[effort=high]; validate prompt hooks as non-empty strings; accept comments and enforce the full published environment.json schema; and infer HTTP transport for documented URL-only servers in .cursor/mcp.json, including MCP-017 HTTPS enforcement for remote endpoints (closes #​1306).
• Spec Drift Sentinel HTML noise. Hash canonical Markdown/raw source documents instead of rendered site chrome, monitor MCP overview/schema/component sources at 2026-07-28, compare newly detected MCP releases directly, and add Cursor MCP documentation to drift coverage (closes #​1305).

Changed

• Tool release baselines. Advanced Cursor to 3.14.7, Gemini CLI to v0.53.1, and Kiro CLI to 2.16.0 after reviewing their validated configuration surfaces. Gemini's patch is error-reporting only; Kiro adds /tangent and context display without changing persisted config (closes #​1307, #​1308).

v0.44.0

Compare Source

Added

• XP-009: Codex Instruction Chain Exceeds project_doc_max_bytes. Codex's 32 KiB project_doc_max_bytes cap is cumulative across the instruction chain, not per-file - it "stops adding files once the combined size reaches the limit". XP-007 checks each AGENTS.md in isolation, so a project split across several mid-size files was truncated with no diagnostic at all. The new project-level rule builds the chain the way Codex discovers it (root down, at most one file per directory, AGENTS.override.md before AGENTS.md), sums root-first, and reports on the file where the running total crosses the limit - that file and everything deeper is what Codex drops. Rule count 442 -> 443 (closes #​1289).
• args on command hooks. The exec-form field - "When present, command is resolved as an executable and spawned directly with args as the argument vector, with no shell involved" - was absent from the schema, so it was silently ignored and two rules could not tell exec form from shell form.

Removed

• CC-SK-003 (Context Without Agent). The rule errored when context: fork had no agent field and shipped an unsafe autofix inserting agent: general-purpose. The skills reference states "The agent field specifies which subagent configuration to use... If omitted, uses general-purpose", so the rule demanded that users restate a default the tool already applies. Rule count 443 -> 442.
• CC-HK-019 (Deprecated Setup Event). The rule warned that the Setup hook event was deprecated in favor of SessionStart and shipped an unsafe autofix that rewrote the event key. Setup is not deprecated: it is documented as a current event that fires on --init-only and on --init/--maintenance in -p mode, with its own matcher set (init, maintenance), exit-code row, and decision-control entry. SessionStart fires on every session begin/resume, so applying the "fix" silently changed when a hook ran. The rule cited no upstream deprecation notice when it was added. Rule count 444 -> 443. Follows the origin-less-rule removal precedent from PR #​979.

Fixed

• COP-005 rejected the documented excludeAgent value and autofixed it wrong. The valid values are code-review and cloud-agent; agnix listed coding-agent, which was never upstream - so the doc's own value errored, and the unsafe autofix rewrote a correct value into the invalid one. coding-agent is retained as a deprecated alias so configs written against agnix's previous wrong advice keep validating, reported at info level rather than accepted silently, and kept out of the autofix candidate list so the fixer can never write it. Fixed across the validator, all 12 locale files, both rules.json copies, and the knowledge-base docs.
• COP-003 rejected comma-separated applyTo. "You can specify multiple patterns by separating them with commas", with applyTo: "**/*.ts,**/*.tsx" as the doc's own example. The whole string went to glob::Pattern, so every such config errored. A correct brace/bracket-aware splitter already existed with 18 passing tests but was marked #[allow(dead_code)] // reserved for future use and never called.
• CUR-004 rejected comma-separated globs. Same class as COP-003, same upstream wording ("Separate multiple patterns with commas"). This one was intermittently wrong, which is why it survived: the doc's literal example docs/**/*.md, docs/**/*.mdx happens to parse as one pattern, while src/**, tests/** does not.
• CUR-010 required version in .cursor/hooks.json. It is documented with a default of 1 and several of the doc's own examples omit it. Now optional, and type-checked as a number (not an integer) only when present.
• CUR-012 required command on prompt hooks. "Prompt hooks use an LLM to evaluate a natural language condition" and carry prompt instead - the doc's example has only type, prompt, timeout. CUR-018 already checked prompt for those.
• CUR-016 required install in .cursor/environment.json. The published schema has no required array at all (definitions.common) and required: [] (definitions.container), and the setup page's own snapshot example omits install. Terminal entries now require only command (name/description are optional per both oneOf branches, and the array branch is accepted), and update - absent from the schema, which sets unevaluatedProperties: false - is reported as renamed to install rather than accepted as valid.
• Cursor hook timeout suggestions said milliseconds. The option is "Execution timeout in seconds".
• CC-MEM-014 fired on Cursor .mdc files. ClaudeMdValidator is registered for FileType::CursorRule for its generic prose checks, so a .cursor/rules/*.mdc file was reported as CLAUDE.md has N non-empty lines, exceeding the recommended 200 line limit - wrong filename, wrong threshold (Cursor documents 500), wrong tool attribution. Now scoped to Claude memory files.
• Stale evidence URLs for 18 rules. docs.github.com/en/copilot/customizing-copilot 301-redirects and `docs.clin

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[yegor256]

@rultor please, try to merge, since 9 checks have passed

[rultor]

@rultor please, try to merge, since 9 checks have passed

@yegor256 Unfortunately, either you or I don't have 'write' permissions to the repository, so I can't do what you're asking. Try to add me as a collaborator with 'write' access.