fix: address automated release and spec drift queue (#1320)

* fix: address automated release and spec drift queue

* fix: satisfy changelog and locale sync gates

* fix: remove invalid self-lint sample

Author: avifenesh

.github/spec-baselines.json

@@ -1,13 +1,13 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "description": "Baseline hashes for canonical specification content. Human-facing URLs are kept separately from machine-readable content URLs.",
-  "last_updated": "2026-08-01T00:00:00Z",
+  "last_updated": "2026-08-05T00:00:00Z",
   "sources": {
     "s-tier": {
       "agent-skills-spec": {
         "url": "https://agentskills.io/specification",
         "content_url": "https://raw.githubusercontent.com/agentskills/agentskills/main/docs/specification.mdx",
-        "hash": "4e758a27be17f5bd9af8d6506890895a412f774a4c09f08ee1cc7565391d16ef",
+        "hash": "dcbdef1ca13e15bb4430a1ecf8da7e185e4202f35ddf0d788cdec88659256b4a",
         "rules": [
           "AS-001",
           "AS-002",
@@ -268,7 +268,7 @@
       "cursor-environment": {
         "url": "https://cursor.com/docs/cloud-agent/setup",
         "content_url": "https://cursor.com/docs/cloud-agent/setup.md",
-        "hash": "058418e383b5bf20786c8a858f37856aa73719759774874b73bf7fb86f18fcd0",
+        "hash": "6565db8120f64cb59b1b4de7c1a0d6dc3c9194f9565c310b06adac3bc1cf161d",
         "rules": [
           "CUR-016"
         ]

.github/tool-release-baselines.json

@@ -1,6 +1,6 @@
 {
   "version": "1.1",
-  "last_updated": "2026-08-04",
+  "last_updated": "2026-08-05",
   "description": "Tracks the latest release of every tool agnix validates (one entry per tool with a validator in crates/agnix-core/src/rules/). Used by .github/workflows/tool-release-watch.yml to open per-tool issues when a new release is published. Untracked tools include the precise publication URL in untracked_reason so a maintainer can monitor manually.\n\nOptional `changes_of_interest` per tool describes what agnix cares about: `config_surfaces` (files agnix validates), `relevant` (change-types that likely affect a validator), `irrelevant` (safe to skip). When set and GLM_API_KEY is available, the watcher runs scripts/glm-extract.js --mode=agnix-triage to produce a pre-filtered summary at the top of the issue body. Falls back gracefully to the full changelog on any LLM failure.",
   "tools": {
     "claude-code": {
@@ -16,7 +16,7 @@
         "mcp"
       ],
       "github_repo": "anthropics/claude-code",
-      "last_known_version": "v2.1.221",
+      "last_known_version": "v2.1.222",
       "tracked": true,
       "changes_of_interest": {
         "config_surfaces": [
@@ -204,7 +204,7 @@
       ],
       "github_repo": "cline/cline",
       "release_tag_regex": "^v[0-9]+\\.[0-9]+\\.[0-9]+$",
-      "last_known_version": "v4.1.3",
+      "last_known_version": "v4.1.4",
       "tracked": true,
       "notes": "Tracks only the core Cline vX.Y.Z release train. The repository also publishes desktop-v*, cli-v*, sdk/*, and other interleaved releases that do not correspond to the validator surfaces.",
       "changes_of_interest": {
@@ -239,7 +239,7 @@
       "github_repo": null,
       "html_url": "https://api2.cursor.sh/updates/api/update/darwin/cursor/0.0.1/stable",
       "version_regex": "[0-9]+\\.[0-9]+\\.[0-9]+",
-      "last_known_version": "3.14.7",
+      "last_known_version": "3.14.27",
       "tracked": true,
       "notes": "Tracked via Cursor's stable update endpoint (the same one the desktop app polls). Returns JSON like {\"url\":\"...\",\"name\":\"3.1.17\"}. Channel is hardcoded to 'stable' for darwin; the version is platform-agnostic (same release ships across darwin/linux/win32). Prose changelog at https://cursor.com/changelog (Next.js SPA - not scrapeable from raw HTML).",
       "changes_of_interest": {
@@ -404,7 +404,7 @@
       ],
       "commit_repo": "agentskills/agentskills",
       "commit_path": "docs/specification.mdx",
-      "last_known_version": "6868401b64f7",
+      "last_known_version": "217be548739f",
       "tracked": true,
       "notes": "The agentskills.io Skill specification (the generic cross-tool SKILL.md standard) - the source for agnix's AS-* rules. It publishes NO releases or tags, so it is tracked by the latest commit SHA touching docs/specification.mdx in the agentskills/agentskills repo (commit_repo + commit_path source). Any change opens an issue to diff the spec against the AS-* rules. Complements the weekly spec-drift.yml check. last_known_version is the short commit SHA.",
       "changes_of_interest": {

AGENTS.md

@@ -57,7 +57,7 @@ editors/
 ├── vscode/         # VS Code extension
 ├── jetbrains/      # JetBrains IDE plugin
 └── zed/            # Zed extension
-knowledge-base/     # 444 rules, 75+ sources, rules.json
+knowledge-base/     # 445 rules, 75+ sources, rules.json
 
 tests/fixtures/     # Test cases by category
 ```
@@ -178,7 +178,7 @@ cargo run --bin agnix-mcp   # Run MCP server
 
 ## Rules Reference
 
-444 rules defined in `knowledge-base/rules.json` (source of truth)
+445 rules defined in `knowledge-base/rules.json` (source of truth)
 
 
 Human-readable docs: `knowledge-base/VALIDATION-RULES.md`
@@ -190,7 +190,7 @@ Format: `[CATEGORY]-[NUMBER]` (AS-004, CC-HK-001, etc.)
 ## Current State
 
 - v0.37.3 - Production-ready with full validation pipeline
-- 444 validation rules across 40 validators
+- 445 validation rules across 40 validators
 
 - 4200+ passing tests
 - LSP + MCP servers with VS Code extension

CHANGELOG.md

@@ -7,11 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- **CC-SET-021: Ineffective Project Remote Control Auto-start**. Claude Code 2.1.222 no longer honors `remoteControlAtStartup: true` in project settings; agnix now warns on the ignored value while allowing project-level `false` and managed settings. Rule count 444 -> 445.
+
 ### Changed
-- **Tool release baselines**. Advanced Claude Code to `v2.1.221`, OpenCode to `v1.18.13`, Cline to `v4.1.3`, and Amp's release marker to `attach-anything` after reviewing their current release notes and validated configuration surfaces (closes #1311, #1312, and #1313).
+- **Tool release baselines**. Advanced Claude Code to `v2.1.222`, OpenCode to `v1.18.13`, Cline to `v4.1.4`, Cursor to `3.14.27`, the Agent Skills specification to `217be548739f`, and Amp's release marker to `attach-anything` after reviewing their current release notes and validated configuration surfaces (closes #1311, #1312, #1313, #1316, #1317, #1318, and #1319).
 
 ### Fixed
 - **Claude Code credential protection compatibility**. Extend CC-SET-012 for environment-variable masking added in 2.1.199 and file masking added in 2.1.221, including ECMAScript extraction validation, structured file controls, injection host lists, environment variable names, and `allowPlaintextInject`; accept mask-only fields that Claude Code ignores on `deny` entries; accept the newly documented `skills: "."` plugin-root path under CC-PL-007.
+- **Agent Skills metadata type enforcement**. Reject non-map `metadata` and metadata entries with non-string keys or values, matching the clarified Agent Skills specification instead of silently coercing YAML scalars.
 
 ### Security
 - **Undici 7.29.0**. Refresh both npm lockfiles for the upstream cache-control, request-header, retry-response, and cookie validation security fixes from Dependabot PR #1314.

CLAUDE.md

@@ -57,7 +57,7 @@ editors/
 ├── vscode/         # VS Code extension
 ├── jetbrains/      # JetBrains IDE plugin
 └── zed/            # Zed extension
-knowledge-base/     # 444 rules, 75+ sources, rules.json
+knowledge-base/     # 445 rules, 75+ sources, rules.json
 
 tests/fixtures/     # Test cases by category
 ```
@@ -178,7 +178,7 @@ cargo run --bin agnix-mcp   # Run MCP server
 
 ## Rules Reference
 
-444 rules defined in `knowledge-base/rules.json` (source of truth)
+445 rules defined in `knowledge-base/rules.json` (source of truth)
 
 
 Human-readable docs: `knowledge-base/VALIDATION-RULES.md`
@@ -190,7 +190,7 @@ Format: `[CATEGORY]-[NUMBER]` (AS-004, CC-HK-001, etc.)
 ## Current State
 
 - v0.37.3 - Production-ready with full validation pipeline
-- 444 validation rules across 40 validators
+- 445 validation rules across 40 validators
 
 - 4200+ passing tests
 - LSP + MCP servers with VS Code extension

README.md

@@ -12,7 +12,7 @@
   </p>
 </div>
 
-<p align="center">Catch broken agent configs before your AI tools silently ignore them.<br>444 rules across Claude Code, Codex CLI, OpenCode, Cursor, Copilot, and more -<br>validating CLAUDE.md, SKILL.md, hooks, MCP configs, and other agent files.</p>
+<p align="center">Catch broken agent configs before your AI tools silently ignore them.<br>445 rules across Claude Code, Codex CLI, OpenCode, Cursor, Copilot, and more -<br>validating CLAUDE.md, SKILL.md, hooks, MCP configs, and other agent files.</p>
 
 <p align="center"><strong>Auto-fix</strong> | <strong><a href="https://github.com/marketplace/actions/agnix-ci">GitHub Action</a></strong> | <strong><a href="https://marketplace.visualstudio.com/items?itemName=avifenesh.agnix">VS Code</a> + <a href="https://plugins.jetbrains.com/plugin/30087-agnix">JetBrains</a> + <a href="https://github.com/agent-sh/agnix.nvim">Neovim</a> + <a href="https://zed.dev/extensions?query=agnix">Zed</a></strong></p>
 
@@ -37,7 +37,7 @@
 
 **Bad patterns get amplified.** AI assistants don't ignore wrong configs - they [learn from them](https://www.augmentcode.com/guides/enterprise-coding-standards-12-rules-for-ai-ready-teams).
 
-agnix validates all of it - 444 rules sourced from official specs, academic research, and real-world breakage patterns. Auto-fix included.
+agnix validates all of it - 445 rules sourced from official specs, academic research, and real-world breakage patterns. Auto-fix included.
 
 > **Want to try it first?** [Open the playground](https://agent-sh.github.io/agnix/playground) - paste any agent config, see diagnostics instantly. No install, runs in your browser.
 

SPEC.md

@@ -14,7 +14,7 @@
 | Agents | agents/*.md | 18 |
 | Plugins | plugin.json | 15 |
 | Claude Output Styles | .claude/output-styles/*.md | 6 |
-| Claude Settings | .claude/settings.json | 20 |
+| Claude Settings | .claude/settings.json | 21 |
 | Prompt Engineering | CLAUDE.md, AGENTS.md | 6 |
 | Cross-Platform | AGENTS.md | 10 |
 | MCP | tool definitions | 26 |

crates/agnix-cli/locales/en.yml

@@ -1313,6 +1313,11 @@ rules:
   cc_set_020:
     message: workflowSizeGuideline must be unrestricted, small, medium, or large (got %{actual})
     suggestion: Set workflowSizeGuideline to one of unrestricted, small, medium, or large.
+  cc_set_021:
+    message: 'remoteControlAtStartup: true cannot enable Remote Control from project settings in Claude Code 2.1.222+;
+      this value is ignored'
+    suggestion: Enable Remote Control in user settings with /config, or set this field to false to disable it for the
+      project.
   cc_hk_028:
     message: Command hook at %{location} uses '${user_config.*}' interpolation, which Claude Code 2.1.207+ rejects at
       load time as a shell-injection fix

crates/agnix-cli/locales/es.yml

@@ -826,6 +826,11 @@ rules:
   cc_set_020:
     message: workflowSizeGuideline debe ser unrestricted, small, medium o large (se obtuvo %{actual})
     suggestion: Establece workflowSizeGuideline en unrestricted, small, medium o large.
+  cc_set_021:
+    message: 'remoteControlAtStartup: true no puede habilitar Remote Control desde la configuracion del proyecto en Claude
+      Code 2.1.222+; este valor se ignora'
+    suggestion: Habilita Remote Control en la configuracion de usuario con /config, o establece este campo en false para
+      deshabilitarlo en el proyecto.
 
 
 # ===========================================================================

crates/agnix-cli/locales/zh-CN.yml

@@ -779,6 +779,9 @@ rules:
   cc_set_020:
     message: workflowSizeGuideline 必须是 unrestricted、small、medium 或 large（实际为 %{actual}）
     suggestion: 将 workflowSizeGuideline 设置为 unrestricted、small、medium 或 large。
+  cc_set_021:
+    message: 'Claude Code 2.1.222+ 无法通过项目设置中的 remoteControlAtStartup: true 启用远程控制；该值会被忽略'
+    suggestion: 使用 /config 在用户设置中启用远程控制，或在此处将该字段设置为 false 以针对项目禁用。
 
 
 # ===========================================================================