Skip to content

Commit c8af8b2

Browse files
committed
fix: address current agnix queue
1 parent 6bb3367 commit c8af8b2

53 files changed

Lines changed: 1297 additions & 173 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/tool-release-baselines.json

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"version": "1.1",
3-
"last_updated": "2026-08-05",
3+
"last_updated": "2026-08-08",
44
"description": "Tracks the latest release of every tool agnix validates (one entry per tool with a validator in crates/agnix-core/src/rules/). Used by .github/workflows/tool-release-watch.yml to open per-tool issues when a new release is published. Untracked tools include the precise publication URL in untracked_reason so a maintainer can monitor manually.\n\nOptional `changes_of_interest` per tool describes what agnix cares about: `config_surfaces` (files agnix validates), `relevant` (change-types that likely affect a validator), `irrelevant` (safe to skip). When set and GLM_API_KEY is available, the watcher runs scripts/glm-extract.js --mode=agnix-triage to produce a pre-filtered summary at the top of the issue body. Falls back gracefully to the full changelog on any LLM failure.",
55
"tools": {
66
"claude-code": {
@@ -16,7 +16,7 @@
1616
"mcp"
1717
],
1818
"github_repo": "anthropics/claude-code",
19-
"last_known_version": "v2.1.222",
19+
"last_known_version": "v2.1.226",
2020
"tracked": true,
2121
"changes_of_interest": {
2222
"config_surfaces": [
@@ -60,21 +60,21 @@
6060
"agents_md"
6161
],
6262
"github_repo": "openai/codex",
63-
"last_known_version": "rust-v0.146.0",
63+
"last_known_version": "rust-v0.147.0",
6464
"tracked": true,
6565
"changes_of_interest": {
6666
"config_surfaces": [
6767
"AGENTS.md",
6868
"codex-rs/core/config.toml (project + ~/.codex/config.toml)",
69-
".codex-plugin/plugin.json (plugin manifest)",
69+
".codex-plugin/plugin.json and Agent Plugins root plugin.json",
7070
".mcp.json or [mcp_servers.*] TOML blocks referenced from config.toml",
7171
"requirements.toml (managed environment config)"
7272
],
7373
"relevant": [
7474
"New / renamed / removed keys in config.toml ([app], [agents], [features], [mcp_servers.*], [permissions], [sandbox], [windows], etc.)",
7575
"Changes to MCP server schema (auth fields, bearer_token/env_var, allow-listed keys)",
7676
"Feature toggles in [features] - new features, flag shapes (flat bool vs nested {enabled})",
77-
"Plugin manifest schema changes in .codex-plugin/plugin.json",
77+
"Plugin manifest schema changes in .codex-plugin/plugin.json or Agent Plugins root plugin.json",
7878
"Apps config shape ([apps.*], tool-approval modes, default_tools_* keys)",
7979
"Hook configuration schema (config.toml hooks block stabilized in 0.124)",
8080
"AGENTS.md size limits, required sections, or directive grammar"
@@ -96,7 +96,7 @@
9696
"agents_md"
9797
],
9898
"github_repo": "sst/opencode",
99-
"last_known_version": "v1.18.13",
99+
"last_known_version": "v1.18.15",
100100
"tracked": true,
101101
"changes_of_interest": {
102102
"config_surfaces": [
@@ -204,7 +204,7 @@
204204
],
205205
"github_repo": "cline/cline",
206206
"release_tag_regex": "^v[0-9]+\\.[0-9]+\\.[0-9]+$",
207-
"last_known_version": "v4.1.4",
207+
"last_known_version": "v4.1.6",
208208
"tracked": true,
209209
"notes": "Tracks only the core Cline vX.Y.Z release train. The repository also publishes desktop-v*, cli-v*, sdk/*, and other interleaved releases that do not correspond to the validator surfaces.",
210210
"changes_of_interest": {
@@ -239,7 +239,7 @@
239239
"github_repo": null,
240240
"html_url": "https://api2.cursor.sh/updates/api/update/darwin/cursor/0.0.1/stable",
241241
"version_regex": "[0-9]+\\.[0-9]+\\.[0-9]+",
242-
"last_known_version": "3.14.27",
242+
"last_known_version": "3.15.6",
243243
"tracked": true,
244244
"notes": "Tracked via Cursor's stable update endpoint (the same one the desktop app polls). Returns JSON like {\"url\":\"...\",\"name\":\"3.1.17\"}. Channel is hardcoded to 'stable' for darwin; the version is platform-agnostic (same release ships across darwin/linux/win32). Prose changelog at https://cursor.com/changelog (Next.js SPA - not scrapeable from raw HTML).",
245245
"changes_of_interest": {
@@ -307,7 +307,7 @@
307307
"html_url": "https://ampcode.com/news.rss",
308308
"version_regex": "https://ampcode\\.com/news/[a-zA-Z0-9._-]+",
309309
"notes_extractor": "rss_cdata",
310-
"last_known_version": "attach-anything",
310+
"last_known_version": "size-the-orbs-of-production",
311311
"tracked": true,
312312
"notes": "Tracked via the amp news RSS feed; the 'version' is the slug of the latest /news/ post (e.g., amp-free-is-ad-free). Source is not on GitHub; npm @sourcegraph/amp publishes per-commit (no semver gates) so npm version-bump tracking would be noise. Issue body uses the first <item><description> CDATA from the RSS feed (already structured HTML - no LLM needed).",
313313
"changes_of_interest": {
@@ -339,7 +339,7 @@
339339
"gemini_ignore"
340340
],
341341
"github_repo": "google-gemini/gemini-cli",
342-
"last_known_version": "v0.53.1",
342+
"last_known_version": "v0.54.4",
343343
"tracked": true,
344344
"changes_of_interest": {
345345
"config_surfaces": [

.github/workflows/README.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,13 @@ is authoritative (last verified: 2026-07-31).
3535
```yaml
3636
# GitHub Official Actions
3737
actions/add-to-project@v2.0.0: 5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd
38-
actions/attest@v4.1.1: a1948c3f048ba23858d222213b7c278aabede763
38+
actions/attest@v4.2.2: 1e69f48acb82d1966a394da916b4c1698aa569d6
3939
actions/checkout@v7.0.0: 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
4040
actions/configure-pages@v6.0.0: 45bfe0192ca1faeb007ade9deae92b16b8254a0d
4141
actions/deploy-pages@v5.0.0: cd2ce8fcbc39b97be8ca5fce6e763baed58fa128
4242
actions/download-artifact@v8.0.1: 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
4343
actions/setup-java@v5.6.0: 03ad4de0992f5dab5e18fcb136590ce7c4a0ac95
44-
actions/setup-node@v6.4.0: 48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
44+
actions/setup-node@v7.0.0: 820762786026740c76f36085b0efc47a31fe5020
4545
actions/setup-python@v7.0.0: 5fda3b95a4ea91299a34e894583c3862153e4b97
4646
actions/stale@v10.4.0: 1e223db275d687790206a7acac4d1a11bd6fe629
4747
actions/upload-artifact@v7.0.1: 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
@@ -55,12 +55,12 @@ taiki-e/install-action@v2.85.0: 7572810d7dd469b651bb7793945692cf78da5dd7
5555

5656
# Security
5757
EmbarkStudios/cargo-deny-action@v2.1.1: 3c6349835b2b7b196a839186cb8b78e02f7b5f25
58-
github/codeql-action/analyze@v4.37.3: c54b30b7df092240050e69945842bc67aee0f0f4
59-
github/codeql-action/init@v4.37.3: c54b30b7df092240050e69945842bc67aee0f0f4
60-
github/codeql-action/upload-sarif@v4.37.3: c54b30b7df092240050e69945842bc67aee0f0f4
58+
github/codeql-action/analyze@v4.37.6: 5595ccaf912efad79be6eef63a5619ff05969be3
59+
github/codeql-action/init@v4.37.6: 5595ccaf912efad79be6eef63a5619ff05969be3
60+
github/codeql-action/upload-sarif@v4.37.6: 5595ccaf912efad79be6eef63a5619ff05969be3
6161

6262
# Release
63-
softprops/action-gh-release@v2: 718ea10b132b3b2eba29c1007bb80653f286566b
63+
softprops/action-gh-release@v3.0.2: 3d0d9888cb7fd7b750713d6e236d1fcb99157228
6464

6565
# Claude Code
6666
anthropics/claude-code-action@v1: e0cf66d1d257526b5d07f141838c338921cb8455

.github/workflows/docs-site.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ jobs:
5858
# v1.7.12, which is also why this is a no-arg invocation rather than a
5959
# widened path. actionlint runs shellcheck over `run:` blocks, so this
6060
# covers the shell in those steps too.
61-
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
61+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
6262
with:
6363
node-version: '20'
6464
cache: 'npm'

.github/workflows/release.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ jobs:
141141
}
142142
143143
- name: Attest build provenance
144-
uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
144+
uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
145145
with:
146146
subject-path: |
147147
agnix-*${{ matrix.target }}.tar.gz
@@ -211,7 +211,7 @@ jobs:
211211
fi
212212
213213
- name: Create draft release with assets
214-
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v2
214+
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
215215
with:
216216
name: ${{ steps.notes.outputs.version }}
217217
body_path: release_notes.md
@@ -369,7 +369,7 @@ jobs:
369369
steps:
370370
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
371371

372-
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
372+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
373373
with:
374374
node-version: '20'
375375

@@ -413,7 +413,7 @@ jobs:
413413
steps:
414414
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
415415

416-
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
416+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
417417
with:
418418
node-version: '20'
419419
registry-url: 'https://registry.npmjs.org'
@@ -555,7 +555,7 @@ jobs:
555555
fetch-depth: 0
556556
token: ${{ secrets.COMMITTER_TOKEN }}
557557

558-
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
558+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
559559
with:
560560
node-version: '20'
561561

.github/workflows/security.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
2626

2727
- name: Initialize CodeQL
28-
uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
28+
uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
2929
with:
3030
languages: rust
3131
queries: security-extended
@@ -34,7 +34,7 @@ jobs:
3434
run: cargo build --release --workspace
3535

3636
- name: Perform CodeQL Analysis
37-
uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
37+
uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
3838
with:
3939
category: "/language:rust"
4040

.github/workflows/test-action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,7 @@ jobs:
251251

252252
- name: Upload SARIF to GitHub
253253
if: steps.agnix.outputs.sarif-file != ''
254-
uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
254+
uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
255255
with:
256256
sarif_file: ${{ steps.agnix.outputs.sarif-file }}
257257
category: agnix-linting

.github/workflows/tool-release-watch.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ jobs:
5252
# even if ubuntu-latest's preinstalled Node version changes. The script
5353
# uses built-in fetch() and AbortSignal.timeout(), both Node >= 18.
5454
- name: Setup Node 20
55-
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
55+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
5656
with:
5757
node-version: '20'
5858

AGENTS.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ editors/
5757
├── vscode/ # VS Code extension
5858
├── jetbrains/ # JetBrains IDE plugin
5959
└── zed/ # Zed extension
60-
knowledge-base/ # 445 rules, 75+ sources, rules.json
60+
knowledge-base/ # 447 rules, 75+ sources, rules.json
6161
6262
tests/fixtures/ # Test cases by category
6363
```
@@ -178,7 +178,7 @@ cargo run --bin agnix-mcp # Run MCP server
178178

179179
## Rules Reference
180180

181-
445 rules defined in `knowledge-base/rules.json` (source of truth)
181+
447 rules defined in `knowledge-base/rules.json` (source of truth)
182182

183183

184184
Human-readable docs: `knowledge-base/VALIDATION-RULES.md`
@@ -190,7 +190,7 @@ Format: `[CATEGORY]-[NUMBER]` (AS-004, CC-HK-001, etc.)
190190
## Current State
191191

192192
- v0.37.3 - Production-ready with full validation pipeline
193-
- 445 validation rules across 40 validators
193+
- 447 validation rules across 40 validators
194194

195195
- 4200+ passing tests
196196
- LSP + MCP servers with VS Code extension

CHANGELOG.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
### Added
11+
- **CC-SET-022 and CC-SET-023**. Validate Claude Code 2.1.224's `crossSessionInbound` and `dialogExpiry` enums. Rule count 445 -> 447.
12+
13+
### Changed
14+
- **Tool release baselines**. Advanced Claude Code to `v2.1.226`, Codex CLI to `rust-v0.147.0`, OpenCode to `v1.18.15`, Cline to `v4.1.6`, Cursor to `3.15.6`, Gemini CLI to `v0.54.4`, and Amp's release marker to `size-the-orbs-of-production` after reviewing their current validated surfaces.
15+
- **Dependency refresh**. Updated `rmcp` to `3.1.2`, `ignore` to `0.4.33`, and `similar` to `3.1.2`.
16+
- **CI action refresh**. Updated `actions/setup-node` to `7.0.0`, `github/codeql-action` to `4.37.6`, `softprops/action-gh-release` to `3.0.2`, and `actions/attest` to `4.2.2`, keeping synchronized action families and SHA assertions in lockstep.
17+
18+
### Fixed
19+
- **Claude Code 2.1.224 credential masking compatibility**. Extend CC-SET-012 for structured environment extraction, JWT-aware `decode` and `maskClaims`, AWS credential pairs, and SigV4 policies.
20+
- **Codex 0.147 plugin name compatibility**. Accept dotted legacy plugin names while rejecting leading, trailing, and repeated dots.
21+
1022
## [0.46.0] - 2026-08-05
1123

1224
### Added

CLAUDE.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ editors/
5757
├── vscode/ # VS Code extension
5858
├── jetbrains/ # JetBrains IDE plugin
5959
└── zed/ # Zed extension
60-
knowledge-base/ # 445 rules, 75+ sources, rules.json
60+
knowledge-base/ # 447 rules, 75+ sources, rules.json
6161
6262
tests/fixtures/ # Test cases by category
6363
```
@@ -178,7 +178,7 @@ cargo run --bin agnix-mcp # Run MCP server
178178

179179
## Rules Reference
180180

181-
445 rules defined in `knowledge-base/rules.json` (source of truth)
181+
447 rules defined in `knowledge-base/rules.json` (source of truth)
182182

183183

184184
Human-readable docs: `knowledge-base/VALIDATION-RULES.md`
@@ -190,7 +190,7 @@ Format: `[CATEGORY]-[NUMBER]` (AS-004, CC-HK-001, etc.)
190190
## Current State
191191

192192
- v0.37.3 - Production-ready with full validation pipeline
193-
- 445 validation rules across 40 validators
193+
- 447 validation rules across 40 validators
194194

195195
- 4200+ passing tests
196196
- LSP + MCP servers with VS Code extension

0 commit comments

Comments
 (0)