Update agent-sh/agnix action to v0.55.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
agent-sh/agnix	action	minor	v0.36.2 → v0.55.0

---

Release Notes

agent-sh/agnix (agent-sh/agnix)

v0.55.0

Compare Source

Added

• CC-SK-022 flags local Claude Code skill names reserved for synced skills, which
  would otherwise make the skill silently fail to load.

Fixed

• CC-AG-019 now accepts the documented omitClaudeMd subagent field and
  validates its boolean type through the agent schema.
• Cline rules under .cline/rules/ now receive the same content and
  frontmatter checks as Markdown rules under .clinerules/.
• CC-HK-002 now rejects Claude Code agent hooks on PermissionRequest while
  continuing to allow prompt hooks on that event.
• AMP-004 accepts the documented amp.runner.autoUpdate.enabled,
  amp.remoteThreadCreation.enabled, and amp.updates.mode settings keys.
• The MCP server uses rmcp's current ServerConfig name, keeping warning-denied
  builds clean after the rmcp 3.4 update.

Changed

• Update the Homebrew tap through a reviewed PR during releases instead of
  writing the formula directly to its default branch.
• Advance Amp to less-noise, Claude Code to v2.1.283, Cline to
  v4.1.21, Codex CLI to rust-v0.157.1, Cursor to 3.22.7, Gemini CLI to
  v0.61.0, Kiro CLI to 2.24.0, and OpenCode to v1.18.32 after reviewing
  their live releases. The OpenCode and Gemini releases do not change a
  validated configuration format.
• Refresh the CodeQL action components together at v4.38.1, taiki-e/install-action
  at v2.87.18, and anthropics/claude-code-action at v1.0.231.
• Refresh nine spec source hashes after reviewing current Claude Code, Cline,
  Cursor, and MCP documentation. The Cline rules layout and Claude hook
  behavior changes are handled above.
• Add Claude Code 2.1.277+ AGENTS.md fallback and combined-instruction support
  to the tracked compatibility surface. Existing AGM and XP rules already
  validate the documented file, imports, hierarchy, and size constraints.
• Advance Claude Code to v2.1.278, Codex CLI to rust-v0.155.1, and Cursor
  to 3.21.16; refresh the five changed Claude documentation hashes after
  reviewing the current vendor sources. The other release changes affect
  runtime classifier and reasoning-summary defaults outside validated schemas.
• Consolidate the current Rust patch updates, CodeQL v4.38.0 pins,
  actions/setup-java v6.0.1, and anthropics/claude-code-action v1.0.226.
• Advance Amp to one-runner-is-now-enough, Claude Code to v2.1.276, Cline
  to v4.1.19, Codex CLI to rust-v0.155.0, Cursor to 3.21.9, and Kiro CLI
  to 2.22.0 after reviewing their primary release notes. Only Amp changed a
  validated configuration contract; the other releases cover runtime, UI,
  security, model, and session behavior outside the current schemas.

v0.54.0

Compare Source

Added

• CUR-017 validates the matcher field on Cursor hook entries as a regex
  string, now that the hooks documentation types it as one.

Changed

• CUR-010 requires version in .cursor/hooks.json and checks that it is a
  positive integer, matching the hooks documentation's per-file options table.
• Refresh the Cursor rules, hooks, and cloud-agent setup specification hashes
  after review. CUR-006 now cites the help-center migration guide, where the
  .cursorrules deprecation notice moved.
• Advance Claude Code to v2.1.273, Cursor to 3.20.21, Gemini CLI to
  v0.60.0, and OpenCode to v1.18.31 after reviewing their primary release
  notes. The changes are runtime, security, session-restoration, provider, and
  cloud-agent updates outside agnix's validated configuration schemas.
• Update rustls to 0.23.45 to address RUSTSEC-2026-0285, which allowed
  selected TLS 1.3 handshake messages at the wrong encryption level.

Fixed

• CUR-016 no longer rejects the published environment schema's
  egressAllowlist, egressMode, chromeExecutablePath, enable_testing,
  image, and build.dockerfileContents fields, and validates their types.

v0.53.0

Compare Source

Added

• CC-SET-031 validates top-level and per-model maxEffortLevel caps added in
  Claude Code 2.1.267.

Changed

• Accept the eight configuration keys added in Codex CLI 0.154.0, including
  features.worktrees, features.unified_exec_tty, and the new TUI preferences.
• Advance current Amp, Claude Code, Codex CLI, Cursor, Gemini CLI, Kiro CLI,
  and OpenCode release baselines after reviewing their primary release notes.
  Refresh Cursor's hooks specification hash; its documented event and field
  contracts remain covered by CUR-010 through CUR-019.
• Advance the Claude Code release baseline to v2.1.263 and refresh the
  current hooks, memory, plugins, skills, and subagent documentation hashes.
  The patch release contains reliability fixes only, and the documented
  configuration contracts remain covered by existing rules.

v0.52.2

Compare Source

Added

• CC-SET-030 detects local-command entries that Claude Code skips in
  managedMcpServers.

Changed

• Refresh current Claude Code, Codex CLI, OpenCode, Kiro, Cline, Cursor, Amp,
  Cursor/Copilot spec, and Copilot inventory baselines.
• Accept Codex CLI 0.153 configuration keys and synchronize CodeQL v4.37.9
  action pins.

Fixed

• XML-001 now ignores fenced code blocks indented under ordered list items.

Changed

• Claude Code 2.1.261 and ecosystem baseline refresh. Add CC-SET-030
  for local-command entries that Claude Code silently skips in
  managedMcpServers; accept Codex CLI 0.153's tui.auto_recap,
  tui.disable_paste_burst, and experimental context-management keys; and
  refresh Amp, Cline, Cursor, Kiro, OpenCode, and changed specification hashes.
• Maintenance dependencies. Keep CodeQL init/analyze together on v4.37.9
  and refresh the VS Code and docs-site npm lockfiles.
• Claude Code and Codex patch baselines. Advance Claude Code to v2.1.258
  and Codex CLI to rust-v0.152.1. Their primary notes contain only a macOS
  launch repair, remote-session message replay repair, and Guardian Node REPL
  policy fix; neither patch changes a configuration schema agnix validates.
• OpenCode release baseline. Advance OpenCode to v1.18.26; its primary
  release notes contain model-provider, replay, timing, patch metadata, Azure
  sign-in, and desktop bug fixes, with no change to a configuration surface
  agnix validates.
• Tool and specification baselines. Advance Amp to fable-5.1, Claude
  Code to v2.1.257, Codex CLI to rust-v0.152.0, Cursor to 3.18.25, and
  Gemini CLI to v0.58.0 after reviewing their current primary release notes
  and validated configuration surfaces. Refresh the Claude hooks, plugins,
  skills, and subagent documentation hashes after confirming the documented
  event, manifest, frontmatter, and matcher contracts remain covered by the
  existing rules. Claude's new clock and read-boundary preferences are not
  correctness constraints agnix currently validates; Codex's package-style MCP
  names, per-tool output limits, app-server timeout, and opt-in planning flag
  are accepted by the current lenient nested configuration handling. The Amp,
  Cursor, and Gemini markers do not change a schema agnix validates.
• Maintenance dependencies. Update uuid to 1.26.0, synchronize both
  CodeQL steps on 4.37.8, and refresh the pinned setup-java, install-action,
  and Claude Code action revisions.
• Tool release baselines. Advance Amp through amp-on-ios-and-macos, Claude
  Code to v2.1.251, Codex CLI to rust-v0.151.0, Cursor to 3.18.9, OpenCode
  to v1.18.25, and Kiro CLI to 2.20.0 after reviewing their current upstream
  notes and validated configuration surfaces. Claude Code added the
  PreModelSwitch and PostModelSwitch hook events, now accepted by the
  existing CC-HK-001 rule; the other releases do not change a schema agnix
  validates. The
  Codex research inventory now also records its shared MCP rule family and
  accepted .yml, .mcp.json, [mcp_servers.*], and managed-environment
  requirements.toml surfaces, with parity regression assertions.

Fixed

• Floating v0 tag pushes no longer trigger the release pipeline. The
  release workflow matched every v* tag, so the manually pushed floating
  action tag ran the entire pipeline with version "0": the semver verification
  guards stopped crates.io, npm, PyPI, and VS Code, but a junk GitHub release
  was created, a junk Zed update PR was opened, and a version-"0" plugin update
  reached the JetBrains marketplace (all three cleaned up the same day; the
  marketplace update was deleted via the vendor API). The trigger now matches
  only semver-shaped tags (v[0-9]*.[0-9]*.[0-9]*), which the automated
  floating-tag move never produces - and that move uses GITHUB_TOKEN, whose
  events do not start workflows anyway.

Fixed

• uses: agent-sh/agnix@v0 did not resolve. The README, configuration
  guide, and marketplace snippet all instruct agent-sh/agnix@v0, but no v0
  tag or branch has ever existed - every user who copied the documented GitHub
  Action snippet got "unable to resolve action". The repo's own CI never
  noticed because it exercises the action as uses: ./. The floating tag now
  exists (pointing at v0.52.1) and the release workflow force-moves it to each
  new release commit, so the documented ref tracks the latest release the way
  major-version action tags are expected to.

Fixed

• Homebrew tap was 34 releases behind. brew install agnix built v0.18.0
  from source because nothing told the tap about new releases: the tap's
  update-formula.yml listens for a release-published dispatch that the main
  repository never sent. The tap has been dispatched to v0.52.1 manually, the
  vestigial in-repo Formula/agnix.rb copy is synced to match, and release.yml now
  dispatches the tap directly from a new homebrew job. A separate
  release: published workflow could never have worked here: the release is
  published with the default GITHUB_TOKEN, and events created by
  GITHUB_TOKEN do not start workflow runs - which is exactly how the drift
  stayed invisible. The job reuses the existing cross-repo COMMITTER_TOKEN
  (already pushing to other repos in the zed and version-docs jobs), so no new
  secret is needed; the dispatch shape was verified live against the tap's
  update-formula.yml. Manual fallback stays
  gh workflow run update-formula.yml --repo agent-sh/homebrew-agnix -f tag=<tag>.

Changed

• CLAUDE.md/AGENTS.md no longer pin a stale version. The "Current State"
  section claimed v0.37.3 fifteen releases later; nothing in the bookkeeping
  sync touches that line, so it now points at GitHub releases instead of
  hardcoding a number that drifts.

v0.52.1

Compare Source

Fixed

• pre-commit hooks skipped nearly every file agnix validates
  (#​1444,
  #​1445). The files: pattern
  in .pre-commit-hooks.yaml was ^(...)$-anchored with root-level entries, so
  SKILL\.md matched only a repository-root SKILL.md - a skill at its normal
  .claude/skills/<name>/SKILL.md location, a nested AGENTS.md, a plugin
  manifest, or a scoped Copilot instruction file never reached agnix, and the
  hook reported Passed with nothing validated. The pattern now covers
  every tool-scoped path shape file_types/detection.rs recognizes: the
  filename-based entries (SKILL.md, the CLAUDE.md/AGENTS.md variants,
  GEMINI.md, plugin.json, mcp.json, *.mcp.json, mcp-*.json,
  opencode.json{,c}, gemini-extension.json, the .cursorrules,
  .clinerules, .roorules/.roomodes/.rooignore, and .windsurfrules
  legacy files) match at any depth via a shared (?:.*/)? prefix, and the
  .claude, .github, .cursor, .codex, .gemini, .amp, .agents,
  .roo, .windsurf, and .kiro directory surfaces are enumerated -
  including .cursor/rules/**/*.md so CUR-020 can flag plain-markdown rules
  Cursor silently ignores. Also covers plugin
  hooks/hooks.json at any root, bare agents/ directories (which detection
  validates as agent configs, agents/README.md included), .kiro/settings.json,
  and the undotted codex/requirements.toml system surface - while deliberately
  not matching .codex/requirements.toml, which Codex does not read. Verified
  against the 149 concrete paths in detection.rs's own tests; the only
  remaining exclusions are deliberate: detection's loose fallback arms outside a
  tool directory (a bare settings.json, hooks.json, environment.json,
  POWER.md, or requirements.toml anywhere), uppercase directory spellings,
  and generic markdown. Verified end to end: a repo with a nested skill, a
  package-level AGENTS.md, GEMINI.md, and a scoped instruction file - all
  invisible to the old pattern - now produces their diagnostics through the
  hook.

v0.52.0

Compare Source

Changed

• pre-commit hooks install agnix themselves
  (#​1439). The three hooks in
  .pre-commit-hooks.yaml move from language: system to language: python,
  so pre-commit and prek create a virtualenv and pull the agnix wheel that
  matches the pinned rev instead of requiring a manual cargo install on
  PATH. This is what the new PyPI distribution makes possible. A root
  pyproject.toml exists solely for that install: pre-commit clones the repo
  and pip install .s it, so the clone has to be pip-installable, and this shim
  declares the matching agnix==<version> as its only dependency.
  scripts/sync-versions.sh moves the shim's version and its pin together, so a
  hook pinned at rev: vX.Y.Z always runs agnix X.Y.Z. Platforms without a
  wheel can still pin language: system in their own config, which the
  configuration guide now documents.

Added

• CC-SET-028: invalid feedbackDrafts setting
  (#​1435). Claude Code v2.1.247
  added the SendFeedback tool and the feedbackDrafts setting that governs it.
  The setting is a string enum - notify, quiet, or off - so the natural
  guess of a boolean silently leaves the default notify in place. Flags any
  value outside the documented enum.
• CC-SET-029: invalid spinnerTipsOverride shape
  (#​1435). v2.1.247 extended the
  key with tip objects (id, text, cooldownSessions, priority), tipsFile,
  and label. Claude Code drops an invalid tip with a debug warning instead of
  rejecting the file, so a malformed tip is simply never shown. Validates the
  object's fields, each tip entry, the documented id/text limits, the
  0-1000 and -10-10 numeric ranges, the 40-character label cap, and
  that tipsFile is absolute or ~/-rooted.
• CC-PL-016: plugin name not kebab-case. The plugin reference documents
  name as a kebab-case identifier with no spaces, and v2.1.247 hardened
  marketplace handling to reject names containing control or invisible
  characters. Those fail kebab-case by construction, so this catches them before
  a plugin reaches a marketplace.

Fixed

• SendFeedback and ListAgents reported as unknown tools
  (#​1435). KNOWN_AGENT_TOOLS
  had not been refreshed since 2026-07-31, so CC-AG-009/010 flagged two
  documented built-in tools - ListAgents from Claude Code v2.1.224 and
  SendFeedback from v2.1.238 - as invalid names in an agent's tools or
  disallowedTools list. Diffed the whole list against the live tools reference,
  and these were the only two missing.

Changed

• Tool baselines refreshed (closes
  #​1435,
  #​1436,
  #​1437). Claude Code
  v2.1.246 to v2.1.247, Cline v4.1.15 to v4.1.16, and Codex CLI
  rust-v0.149.1 to rust-v0.150.0. Cline's release moves hook workspace
  resolution from shared global state to the VS Code window, which changes
  runtime behaviour rather than any validated file contract. Codex adds an
  Interrupt hook event; CDX-PL-013 validates hook shape without an event-name
  allowlist, so nothing false-positives, and the missing allowlist is recorded in
  RESEARCH-TRACKING along with the uncovered spinnerVerbs setting.

Fixed

• Tool-release triage produced no summaries. Two separate faults, both of
  which the watcher degrades silently to "post the raw changelog": the
  GLM_API_KEY secret had expired, and scripts/glm-extract.js ran with an
  output budget too small for a thinking model. Reasoning tokens are drawn from
  the same max_tokens budget as the answer, so at 4096 the model intermittently
  spent the entire budget reasoning and returned finish_reason: "length" with
  empty content (reproduced at 1 failure in 3 runs, 4095 of 4096 tokens on
  reasoning). MAX_TOKENS is now 32768, roughly six times the 1.9k-5.2k
  reasoning observed on real triage prompts, and thinking stays enabled because
  it measurably improves the "does this touch a validated config surface?"
  judgement. The default model is now named glm-5.3 explicitly rather than
  relying on the endpoint's glm-5 alias, so an alias move cannot change triage
  behaviour silently. The empty-content error now also reports finish_reason,
  reasoning size, and usage instead of just "empty content", and
  scripts/glm-extract.test.js - which no workflow ran - is now part of CI.

v0.51.0

Compare Source

Added

• PyPI distribution. pip install agnix and uvx agnix . now work. The
  wheels in pypi/ bundle the release binary for each supported target
  (manylinux and musllinux x86_64, manylinux aarch64, macOS Apple silicon,
  Windows x86_64), so there is no Rust toolchain to install and nothing is
  downloaded after install. python -m agnix and a small Python API
  (agnix.run, agnix.lint, agnix.version) mirror the Node wrapper.
  pypi/build_wheels.py repacks the archives the release already built and
  verified against their .sha256 sidecars, deriving each manylinux tag from
  the binary's own glibc symbol references rather than a hardcoded floor.
• JetBrains plugin: WSL execution mode
  (#​1346). IntelliJ on Windows
  can now run agnix-lsp from inside a WSL distribution for projects that live
  in WSL, without Remote Development. The plugin launches an argument-safe
  wsl.exe --distribution <name> --exec <path> command, maps document and
  workspace URIs at the LSP boundary, validates configuration, and skips the
  host-local binary installer. Native launches remain unchanged.

Changed

• Tool and spec baselines refreshed (closes
  #​1426,
  #​1427,
  #​1428,
  #​1429). Advanced Claude Code
  from v2.1.245 to v2.1.246, Cursor from 3.17.19 to 3.17.21, and amp from
  friendly-urls-for-sharing-orbs to setup-without-a-commit, and re-baselined
  the eight drifted spec sources (Claude Code hooks/skills/plugins-reference;
  Cursor rules/hooks/subagents/mcp and the environment schema). Reviewing all
  eight against the rules they back found no contract change that agnix asserts
  incorrectly: Claude Code's 31 known hook events still cover every event the
  hooks reference documents, the skill frontmatter allowlist still covers all 20
  documented fields, the plugin path-bearing keys remain a superset of the
  documented table, Cursor's hook events (including the still-supported
  beforeShellExecution / beforeMCPExecution) and per-script options are
  unchanged, subagent frontmatter and model-parameter syntax still validate, the
  environment schema's property set still matches ALLOWED_ROOT_FIELDS, and
  neither MCP nor hook entries reject unknown fields, so newly documented keys
  cannot produce false positives. Coverage gaps the review surfaced (upstream's
  new wildcard-permission warning, unvalidated keybindings.json, Cursor's
  now-required MCP type and STDIO-only envFile) are recorded in
  RESEARCH-TRACKING. amp's release stores pre-clone and pre-setup scripts in
  server-side project settings rather than any validated file. Cline
  (v4.1.16) and Codex (rust-v0.150.0) published after those issues were
  opened and are deliberately left at their previous baselines so the watcher
  files their own triage issues.
• Tool release baselines. Advanced Claude Code from v2.1.243 to
  v2.1.245 and OpenCode from v1.18.22 to v1.18.23 after reviewing their
  live release notes. Claude Code's change is a Linux glibc 2.44 startup-crash
  fix; OpenCode's changes fix Cloudflare AI Gateway routing, Anthropic model
  slugs, parent-session headers, and immutable-OIDC GitHub auth. None changes
  an agnix-validated configuration contract. Advanced Gemini CLI from v0.56.0
  to v0.57.0; its changes affect OAuth redirects, IDE and Git worktree state,
  runtime retry and cancellation behavior, agent enablement, and command help,
  without changing an agnix-validated configuration contract.

Fixed

• Stale rule count in the npm long description. npm/README.md advertised
  405 rules against a canonical 451, and no automation covered it, so the number
  had drifted for several releases and was copied into the new PyPI README.
  Corrected, and both wrapper READMEs are now in sync-rule-bookkeeping.js's
  COUNT_FILES so CI fails on the next drift.

v0.50.0

Compare Source

Added

• Claude Code 2.1.242 settings validation. Add CC-SET-025 for the
  user-or-managed modelPicker scope and documented option shape,
  CC-SET-026 for the promptCacheTtl enum, and CC-SET-027 for the
  subagentPromptCacheTtl enum.

Changed

• Tool release baselines. Advance Claude Code to v2.1.243, Codex CLI to
  rust-v0.149.1, Cursor to 3.17.19, and OpenCode to v1.18.22. Accept
  Codex's new compaction_image_budget feature flag; the remaining release
  changes outside the three Claude settings above do not alter a validated
  configuration contract.
• Tool release baselines. Advance Cline to v4.1.15 and Amp to
  friendly-urls-for-sharing-orbs after reviewing the intervening live release
  notes. The changes affect runtime MCP approval behavior, model metadata,
  telemetry, and shared-orb URLs, not an agnix-validated configuration contract.
• Maintenance refresh. Advance Claude Code to v2.1.241, Cline to
  v4.1.13, OpenCode to v1.18.21, and Amp to explain-usage after reviewing
  the live releases against agnix's validated configuration surfaces. Refresh
  all CodeQL action pins to v4.37.7; these pins move together to avoid the
  action's mixed-version configuration failure.
• Claude Code specification baselines. Refresh the reviewed hooks, memory,
  plugins, skills, and subagent documentation hashes. The current documented
  hook lifecycle and configuration surfaces are already represented by the
  existing schemas and rule families, so no validator rule changes are needed.
• Cursor environment MCP policy. Update CUR-016 for the published
  disableAllMcpServers and mcpServerAllowlist fields, including HTTP and
  stdio server identities, optional tool allowlists, and closed-field checks.
• Tool release baselines. Advance Claude Code to v2.1.238, Codex CLI to
  rust-v0.149.0, Cursor to 3.17.8, Kiro CLI to 2.19.0, Gemini CLI to
  v0.56.0, OpenCode to v1.18.19, and Amp to mcp-in-orbs. Apart from the
  Cursor schema change above, the reviewed releases do not change an
  agnix-validated configuration contract.

Fixed

• Rust 1.98 clippy compatibility. Replace a constant-only format! call
  that is now rejected by clippy::useless_format.
• CC-HK-025 Notification matcher compatibility. Accept the documented
  elicitation_url_dialog matcher instead of reporting it as invalid, and
  advance the reviewed Claude Code hooks, memory, plugins, skills, and
  subagent specification baselines.
• Spec drift baseline hashing. Recalculate the five reviewed Claude Code
  hashes with the sentinel's trailing-newline normalization so those sources
  do not immediately re-report drift.
• RustSec dependency audit. Update h2 from 0.4.13 to 0.4.16 to address
  RUSTSEC-2026-0258 (unbounded empty DATA frames).

Changed

• Tool release baselines. Advanced Claude Code from v2.1.232 to
  v2.1.235, Cline from v4.1.9 to v4.1.10, and Amp's release marker from
  global-plugins-and-skills to edu-discount. These releases do not change
  an agnix-validated configuration surface, so no validator or rule update is
  required.

v0.49.0

Compare Source

Added

• CC-SET-024: ineffective project-level sandbox.ripgrep
  (#​1358). Claude Code
  v2.1.232 honors the sandbox ripgrep binary only from user settings, managed
  settings, and the --settings flag, so a value in a repository's
  .claude/settings.json or .claude/settings.local.json is silently ignored.
  agnix now warns on that dead override and points at the scopes that still
  apply. User and managed settings are unaffected.

Changed

• Tool release baselines (#​1356, #​1357, #​1358, #​1359, #​1375). Advanced the
  tracked releases for Kiro CLI (2.17.0 to 2.18.0), OpenCode (v1.18.17 to
  v1.18.18), Claude Code (v2.1.229 to v2.1.232), Cline (v4.1.8 to
  v4.1.9), and Cursor (3.15.19 to 3.16.17). Only the Claude Code and Kiro
  CLI releases touched a validated surface; the OpenCode, Cline, and Cursor
  deltas were bookkeeping only.
• Kiro CLI inventory covers AGENTS.md steering (#​1356). Kiro CLI 2.18.0
  loads nested AGENTS.md files as steering context from anywhere in the
  workspace tree, so the tool inventory and release baseline now list
  AGENTS.md and the agents_md validator (AGM rules) for Kiro. No validation
  behaviour change - agnix already validated those files.

v0.48.1

Compare Source

Changed

• Tool release and spec baselines (#​1354). Advanced the tracked releases for
  Claude Code (v2.1.226 to v2.1.229), OpenCode (v1.18.15 to v1.18.17),
  Kiro CLI (2.16.0 to 2.17.0), Cline (v4.1.6 to v4.1.8), Cursor
  (3.15.6 to 3.15.19), Gemini CLI (v0.54.4 to v0.55.1), and amp (news
  marker size-the-orbs-of-production to global-plugins-and-skills), plus the
  cursor-environment spec hash. Registered the output_style, gemini_agent,
  and per-client skill validators in the tool inventory and filled in the
  matching config surfaces and rule prefixes (CC-OS, MCP, OC-SK, CR-SK,
  GM-AG) in knowledge-base/RESEARCH-TRACKING.md. Watcher bookkeeping only -
  no validation behaviour changes.

Fixed

• Skill directory size exclusions (#​1360). AS-015 now omits paths matched
  by top-level exclude or [files].exclude when calculating the 8 MB skill
  directory total, while continuing to validate the rest of the skill.
• CC-MEM-001 false positive when several paths are passed on the command
  line (#​1368). The
  workspace root came from the parent of the first path, so a file in a
  subdirectory listed first became the root and CLAUDE.md's root-relative
  @imports were reported as escaping the project. Since pre-commit passes
  matched files in sorted order, .claude/... sorted ahead of CLAUDE.md and
  the same tree passed or failed depending on argument order. The root is now
  the deepest common ancestor of every path, walked up to the nearest .git or
  .agnix.toml marker, so results no longer depend on argument order or on
  which files a commit happens to touch.
• Linux x86_64 release binary unusable on glibc older than 2.39
  (#​1371). The x86_64 gnu
  build ran natively on ubuntu-latest, so it linked the runner's glibc and
  failed at load time with version 'GLIBC_2.39' not found on Debian bookworm,
  RHEL/Rocky 9, and Ubuntu 22.04. Both gnu targets now build through cross
  against an old sysroot (currently GLIBC_2.18), a release gate fails the
  build if any binary needs newer than GLIBC_2.31, and npm install -g agnix
  plus scripts/download.sh probe the downloaded binary and retry with the
  static musl archive when the host cannot load it.

Security

• Dependency lockfile bumps (website + VS Code extension): js-yaml
  GHSA-5p4m-2wfm-xmqj (quadratic !!omap complexity) and nanoid
  GHSA-2v37-7h3g-55p8 (zero-size generator loop). Lockfile-only; no manifest
  range changes.

v0.48.0

Compare Source

Fixed

• Claude Code skill and hook schema compatibility. Accept skills without
  explicit name or description, validate the documented disallowed-tools
  field with the existing Claude tool vocabulary, and parse prompt-hook
  continueOnBlock as a boolean.
• Claude Code specification baselines. Advance the reviewed hooks, memory,
  plugins, skills, and subagent documentation hashes after auditing the current
  validation contracts.

v0.47.0

Compare Source

Added

• CC-SET-022 and CC-SET-023. Validate Claude Code 2.1.224's crossSessionInbound and dialogExpiry enums. Rule count 445 -> 447.

Changed

• Tool release baselines. Advanced Claude Code to v2.1.226, Codex CLI to rust-v0.147.0, OpenCode to v1.18.15, Cline to v4.1.6, Cursor to 3.15.6, Gemini CLI to v0.54.4, and Amp's release marker to size-the-orbs-of-production after reviewing their current validated surfaces.
• Dependency refresh. Updated rmcp to 3.1.2, ignore to 0.4.33, and similar to 3.1.2.
• CI action refresh. Updated actions/setup-node to 7.0.0, github/codeql-action to 4.37.6, softprops/action-gh-release to 3.0.2, and actions/attest to 4.2.2, keeping synchronized action families and SHA assertions in lockstep.

Fixed

• Claude Code 2.1.224 credential masking compatibility. Extend CC-SET-012 for structured environment extraction, JWT-aware decode and maskClaims, AWS credential pairs, and SigV4 policies.
• Codex 0.147 plugin name compatibility. Accept dotted legacy plugin names while rejecting leading, trailing, and repeated dots.

v0.46.0

Compare Source

Added

• CC-SET-021: Ineffective Project Remote Control Auto-start. Claude Code 2.1.222 no longer honors remoteControlAtStartup: true in project settings; agnix now warns on the ignored value while allowing project-level false and managed settings. Rule count 444 -> 445.

Changed

• Tool release baselines. Advanced Claude Code to v2.1.222, OpenCode to v1.18.13, Cline to v4.1.4, Cursor to 3.14.27, the Agent Skills specification to 217be548739f, and Amp's release marker to attach-anything after reviewing their current release notes and validated configuration surfaces (closes #​1311, #​1312, #​1313, #​1316, #​1317, #​1318, and #​1319).

Fixed

• Claude Code credential protection compatibility. Extend CC-SET-012 for environment-variable masking added in 2.1.199 and file masking added in 2.1.221, including ECMAScript extraction validation, structured file controls, injection host lists, environment variable names, and allowPlaintextInject; accept mask-only fields that Claude Code ignores on deny entries; accept the newly documented skills: "." plugin-root path under CC-PL-007.
• Agent Skills metadata type enforcement. Reject non-map metadata and metadata entries with non-string keys or values, matching the clarified Agent Skills specification instead of silently coercing YAML scalars.

Security

• Undici 7.29.0. Refresh both npm lockfiles for the upstream cache-control, request-header, retry-response, and cookie validation security fixes from Dependabot PR #​1314.

v0.45.0

Compare Source

Added

• CUR-020: Ignored Plain Markdown Cursor Rule. Cursor now explicitly documents that project rules under .cursor/rules/ must use .mdc; plain .md files are ignored. agnix reports the silent failure and suggests renaming the file. Rule count 443 -> 444.

Fixed

• Cursor 3.14 configuration compatibility. Accept parameterized subagent model IDs such as composer-2.5[] and claude-opus-5[effort=high]; validate prompt hooks as non-empty strings; accept comments and enforce the full published environment.json schema; and infer HTTP transport for documented URL-only servers in .cursor/mcp.json, including MCP-017 HTTPS enforcement for remote endpoints (closes #​1306).
• Spec Drift Sentinel HTML noise. Hash canonical Markdown/raw source documents instead of rendered site chrome, monitor MCP overview/schema/component sources at 2026-07-28, compare newly detected MCP releases directly, and add Cursor MCP documentation to drift coverage (closes #​1305).

Changed

• Tool release baselines. Advanced Cursor to 3.14.7, Gemini CLI to v0.53.1, and Kiro CLI to 2.16.0 after reviewing their validated configuration surfaces. Gemini's patch is error-reporting only; Kiro adds /tangent and context display without changing persisted config (closes #​1307, #​1308).

v0.44.0

Compare Source

Added

• XP-009: Codex Instruction Chain Exceeds project_doc_max_bytes. Codex's 32 KiB project_doc_max_bytes cap is cumulative across the instruction chain, not per-file - it "stops adding files once the combined size reaches the limit". XP-007 checks each AGENTS.md in isolation, so a project split across several mid-size files was truncated with no diagnostic at all. The new project-level rule builds the chain the way Codex discovers it (root down, at most one file per directory, AGENTS.override.md before AGENTS.md), sums root-first, and reports on the file where the running total crosses the limit - that file and everything deeper is what Codex drops. Rule count 442 -> 443 (closes #​1289).
• args on command hooks. The exec-form field - "When present, command is resolved as an executable and spawned directly with args as the argument vector, with no shell involved" - was absent from the schema, so it was silently ignored and two rules could not tell exec form from shell form.

Removed

• CC-SK-003 (Context Without Agent). The rule errored when context: fork had no agent field and shipped an unsafe autofix inserting agent: general-purpose. The skills reference states "The agent field specifies which subagent configuration to use... If omitted, uses general-purpose", so the rule demanded that users restate a default the tool already applies. Rule count 443 -> 442.
• CC-HK-019 (Deprecated Setup Event). The rule warned that the Setup hook event was deprecated in favor of SessionStart and shipped an unsafe autofix that rewrote the event key. Setup is not deprecated: it is documented as a current event that fires on --init-only and on --init/--maintenance in -p mode, with its own matcher set (init, maintenance), exit-code row, and decision-control entry. SessionStart fires on every session begin/resume, so applying the "fix" silently changed when a hook ran. The rule cited no upstream deprecation notice when it was added. Rule count 444 -> 443. Follows the origin-less-rule removal precedent from PR #​979.

Fixed

• COP-005 rejected the documented excludeAgent value and autofixed it wrong. The valid values are code-review and cloud-agent; agnix listed coding-agent, which was never upstream - so the doc's own value errored, and the unsafe autofix rewrote a correct value into the invalid one. coding-agent is retained as a deprecated alias so configs written against agnix's previous wrong advice keep validating, reported at info level rather than accepted silently, and kept out of the autofix candidate list so the fixer can never write it. Fixed across the validator, all 12 locale files, both rules.json copies, and the knowledge-base docs.
• COP-003 rejected comma-separated applyTo. "You can specify multiple patterns by separating them with commas", with applyTo: "**/*.ts,**/*.tsx" as the doc's own example. The whole string went to glob::Pattern, so every such config errored. A correct brace/bracket-aware splitter already existed with 18 passing tests but was marked #[allow(dead_code)] // reserved for future use and never called.
• CUR-004 rejected comma-separated globs. Same class as COP-003, same upstream wording ("Separate multiple patterns with commas"). This one was intermittently wrong, which is why it survived: the doc's literal example docs/**/*.md, docs/**/*.mdx happens to parse as one pattern, while src/**, tests/** does not.
• CUR-010 required version in .cursor/hooks.json. It is documented with a default of 1 and several of the doc's own examples omit it. Now optional, and type-checked as a number (not an integer) only when present.
• CUR-012 required command on prompt hooks. "Prompt hooks use an LLM to evaluate a natural language condition" and carry prompt instead - the doc's example has only type, prompt, timeout. CUR-018 already checked prompt for those.
• CUR-016 required install in .cursor/environment.json. The published schema has no required array at all (definitions.common) and required: [] (definitions.container), and the setup page's own snapshot example omits install. Terminal entries now require only command (name/description are optional per both oneOf branches, and the array branch is accepted), and update - absent from the schema, which sets unevaluatedProperties: false - is reported as renamed to install rather than accepted as valid.
• Cursor hook timeout suggestions said milliseconds. The option is "Execution timeout in seconds".
• CC-MEM-014 fired on Cursor .mdc files. ClaudeMdValidator is registered for FileType::CursorRule for its generic prose checks, so a .cursor/rules/*.mdc file was reported as CLAUDE.md has N non-empty lines, exceeding the recommended 200 line limit - wrong filename, wrong threshold (Cursor documents 500), wrong tool attribution. Now scoped to Claude memory files.
• Stale evidence URLs for 18 rules. docs.github.com/en/copilot/customizing-copilot 301-redirects and docs.cline.bot/features/cline-rules/overview 308-redirects; both are updated in rules.json and .github/spec-baselines.json, so those two sentinel sources can match again.
• AGENTS.override.md was not recognized as an instruction file. Codex checks it before AGENTS.md in each directory, but is_instruction_file() did not list it, so it was invisible to every cross-platform rule. This also made the AGENTS.override.md handling added to XP-007 in the previous release unreachable in practice.
• CC-SK-009 miscounted dynamic injections in both directions. It counted raw !` occurrences, so inert KEY=!`cmd` forms inflated the count (the doc: a ! following another character "is left as literal text and the command does not run"), while ```! fenced blocks - where every line is a command - counted as zero. Counting now honors both documented forms and ignores plain fences.
• CC-SK-012/CC-SK-016 recognized only $ARGUMENTS. The substitution table documents four forms; a body using the $N shorthand or a $name declared in arguments was reported as ignoring its own arguments, and $0 escaped CC-SK-016 entirely. The arguments frontmatter field is now parsed so named placeholders can be resolved. The shorthand is matched as a single digit, matching the documented examples, so ${CLAUDE_SKILL_DIR}, x$3y, and prose amounts like $500 are not mistaken for positional arguments.
• CC-HK-028 flagged the exec form the doc recommends. ${user_config.*} is rejected only in shell form: "Plugin hooks additionally substitute ${user_config.*} values, in exec form only". The rule fired regardless of args, so {"command": "${user_config.formatter}", "args": ["--fix"]} errored.
• CC-HK-008 skipped scripts named in args. In exec form the script sits in args while command names an interpreter, so exec-form hooks - the form the doc recommends for path placeholders - got no script-existence checking at all.
• AS-013 only inspected references/ paths. The spec scopes skill resources to "scripts/, references/, or assets/" and uses scripts/extract.py in its own example, so deep scripts/ and assets/ paths were invisible. Git ref paths stay excluded.
• AS-017 rejected Claude Code display labels. Claude Code decouples name from the directory ("name sets only the display label... the command still comes from the directory or file name"), and a plugin skill's name deliberately replaces the last command segment - the reference's own name: fancy in skills/review/ example errored. Scoped out for Claude Code skills, following the AS-008 precedent; the agentskills.io baseline still requires the match.
• CC-PL-002 checked four of eight directories. The doc names commands/, agents/, skills/, workflows/, output-styles/, themes/, monitors/, and hooks/ as forbidden inside .claude-plugin/.
• CC-PL-007/CC-PL-008 checked four of ten path fields. workflows, mcpServers, outputStyles, lspServers, experimental.themes, and experimental.monitors accepted absolute paths, .. traversal, and .claude-plugin/ targets unchecked. Dotted experimental.* keys are now traversed, which a plain field lookup could not do.
• XP-007 ignored AGENTS.override.md. Codex reads it first in each directory, so it draws on the same project_doc_max_bytes budget; the code comment claiming Codex "reads this file, not local/override variants" was contradicted by the current guide. The cap is cumulative across the root-to-cwd chain while this check remains per-file - noted in the rule docs as a known gap.
• AGM-006's suggestion contradicted upstream. It advised consolidating files, while Codex documents root-down concatenation with nearest-file-wins precedence and recommends splitting across nested directories to stay under the byte cap.
• MCP-008 flagged the current protocol revision. 2026-07-28 is now the current MCP revision and the unversioned /specification URL serves it, but agnix compared against a single pinned default of 2025-11-25. With no revision pinned, both are now accepted: the two are behaviorally incompatible rather than sequential (2026-07-28 drops the initialize/initialized handshake and Mcp-Session-Id sessions), so a config written for either is legitimately current and demanding one would only move the false positive onto the other. Pinning [spec_revisions] mcp_protocol still enforces exactly one revision and keeps the autofix; the unpinned diagnostic now names every accepted revision instead of claiming a single one is required. A revision outside the current set is still reported.
• CC-SK-001's message listed a stale alias set. It advertised only sonnet, opus, haiku, inherit, or claude-* after the accepted list had been widened.
• codex-cli-agents-md source URL was dead. https://developers.openai.com/codex/guides/agents-md/ 308-redirects to https://learn.chatgpt.com/docs/agent-configuration/agents-md - the doc moved host and site, so the Spec Drift Sentinel baseline for that source could never match again. Updated in spec-baselines.json, in all 20 affected evidence.source_urls entries, and across the knowledge-base docs.
• Parenthesized tool arguments were shattered by tokenization. tools: Agent(worker, researcher), Read, Bash(npm run test:*) - the sub-agents reference's own verbatim example - reported Unknown tool 'researcher)', 'run', and 'test:*)' under CC-AG-009/010, because the string deserializer split on commas and spaces before parentheses were stripped. The skill validator already had a paren-aware tokenizer; it is now shared as validation::split_tool_list so allowed-tools, tools, and disallowedTools cannot drift apart again.
• CC-AG-004 rejected auto and manual, and accepted the undocumented delegate. The permission-modes reference documents six modes (default, acceptEdits, plan, auto, dontAsk, bypassPermissions) plus manual as a CLI alias for default (v2.1.200+). delegate appears in neither that reference nor sub-agents and was added without a cited source, so it is no longer accepted.
• CC-AG-003/CC-SK-001 rejected documented model values. model "Accepts the same values as the --model flag", so default, best, fable, opusplan, sonnet[1m], and opus[1m] are all valid and were all erroring. The alias list is now shared between the agent and skill validators rather than duplicated.
• MCP-020 warned on two valid capability keys. tasks is in the 2025-11-25 capability-negotiation table - the revision agnix already pins - and extensions was added in 2026-07-28. Note the spec calls capabilities an open set ("any server can define its own, additional capabilities"), so this rule is advisory.
• CC-MEM-001 rejected absolute and home-directory imports. The memory reference states "Both relative and absolute paths are allowed" and prescribes @~/.claude/my-project-instructions.md as the way to share personal instructions across git worktrees; Claude Code gates external imports behind a one-time approval dialog rather than rejecting them. Existence is still checked, and the path-shape guard is retained for non-memory files under REF-001, where no spec sanctions escaping the project root.
• CC-MEM-003 allowed two more hops than documented. The doc says "a maximum depth of four hops"; the limit was 5 and the check is depth + 1 > MAX, so the diagnostic first fired at six.
• .claude/rules/ was only validated one level deep. The doc says "All .md files are discovered recursively, so you can organize rules into subdirectories like frontend/ or backend/", but both the file-type detector and the validator required rules/ to be the immediate parent. Nested rule files got no validation at all - CC-MEM-011/012 never ran on them.
• CC-HK-025 rejected the documented fork SessionStart matcher. fork covers --fork-session with --resume/--continue, the /fork background copy, and /branch. It was missing from the known-value list, so a valid hook config was flagged. (resume stays valid: before Claude Code v2.1.214 a forked session reported resume.)
• CC-PL-015 flagged additive and merge-semantics plugin fields as shadowing. The rule warned that a default component folder was ignored whenever the matching manifest key was present, but the plugins reference splits those keys three ways: skills adds to the default (the default skills/ directory is always scanned), while hooks/mcpServers/lspServers have their own merge rules. Neither can shadow, so both skills and hooks produced false warnings on plugins that kept their default folder. The rule now checks only the six documented replace-semantics fields, which also closes a coverage gap: workflows, outputStyles, experimental.themes, and experimental.monitors were never checked. Folder names that differ from their manifest key are handled (outputStyles -> output-styles/, experimental.* -> root-level themes/, monitors/).
• Spec Drift Sentinel pointed maintainers at 15 rule IDs that do not exist. .github/spec-baselines.json mapped claude-code-subagents to CC-SA-001..007, github-copilot to GH-001..004, and cline-rules to CLINE-001..003 - none of which were ever in this repo; the real rules are CC-AG-*, COP-*/CP-SK-*, and CLN-*/CL-SK-*. It also still listed AS-014, removed in PR #​979. Every drift issue rendered these straight into the "rules may need review" list, sending the reader to rules they could not look up. Mappings are now derived from each rule's own evidence URLs, and a new test_spec_baseline_rule_ids_exist parity test fails CI if an unknown ID is ever added.

v0.43.0

Compare Source

Changed

• validation::is_valid_mcp_tool_format accepts the server-only MCP form. The function is in the Public/Unstable tier and its signature is unchanged, but it now returns true for mcp__<server> where it previously returned false, so a downstream caller relying on the stricter behavior will see a change. Whitespace in the server segment is newly rejected.

Fixed

• [[overrides]] had no effect on any skill rule. Reported as Windows-specific path matching, but the platform was incidental: SkillValidator's internal ValidationContext stored the &LintConfig that PerFileLintConfig derefs to, so the per-file override layer was discarded before any is_rule_enabled call. Every AS-* and CC-SK-* rule ignored [[overrides]] on all platforms, with no way to suppress one for a single file. The context now holds the per-file view, and an end-to-end regression test covers the case (closes #​1277).
• CC-SK-008/CC-AG-009/CC-AG-010 rejected the documented server-only MCP form. mcp__playwright errored while the doc-equivalent mcp__playwright__* passed, even though the permissions reference lists both as valid ways to name every tool from one server. Both forms are now accepted. A glob in the server segment (mcp__supabase-*, mcp__*) is still rejected, since a rule must name a specific configured server, and the tool segment may still glob (mcp__github__get_*).
• Unknown-tool false positives on current built-in tools. Workflow, Artifact, ReportFindings, SendUserFile, and EndConversation are in the built-in tools reference but were missing from CC-SK-008's known-tools list. CC-AG-009/010's list was further behind - 26 documented tools absent, including the Cron*/Task* families, PowerShell, LSP, ToolSearch, and the worktree and MCP-resource tools - so a subagent declaring any of them failed. Tools that subagents never receive stay listed: Claude Code filters those from the resolved pool rather than rejecting the name.

v0.42.0

Compare Source

Added

• OC-DEP-007: Deprecated Reference Field. The published OpenCode schema marks the top-level reference key as @deprecated Use 'references' field instead; the new rule warns and offers a safe autofix rename. Rule count increased from 443 to 444.

Fixed

• JetBrains SKILL.md highlighting. Register SKILL.md with the bundled Markdown language and declare the Markdown plugin dependency, restoring syntax highlighting and Markdown editor features in supported JetBrains IDEs.
• Codex 0.146 config compatibility. Accept shell_environment_policy.filters, validate its include/exclude actions and legacy-list conflicts, recognize the four new feature flags, validate structured features.non_prefixed_mcp_tool_names, and refresh the managed requirements.toml allowlist without the removed allowed_permissions key.
• Codex Agent Plugins compatibility. Recognize schema-discriminated Agent Plugins 1.0 root plugin.json manifests, validate required metadata types, inspect Codex apps, hooks, and interface fields under extensions.com.openai, accept all supported hooks forms, stop after unsupported schemas, and avoid Claude plugin location false positives.
• OpenCode MCP environment validation. Validate local server environment maps as string-to-string objects and reject the unsupported env spelling that OpenCode ignores.
• Cursor workspaceOpen hooks. Recognize the documented hook event without a CUR-011 unknown-event warning.
• Rule-count bookkeeping now covers every file CI validates. scripts/check-rule-counts.py enforced the rule total in 13 locations that scripts/sync-rule-bookkeeping.js never wrote — the six editor/website docs, the per-category tables in knowledge-base/INDEX.md and knowledge-base/VALIDATION-RULES.md, and the SPEC.md table — so every rule addition failed the "Rule

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[yegor256]

@rultor please, try to merge, since 8 checks have passed

[rultor]

@rultor please, try to merge, since 8 checks have passed

@yegor256 Unfortunately, either you or I don't have 'write' permissions to the repository, so I can't do what you're asking. Try to add me as a collaborator with 'write' access.