agent-sh/agnix v0.38.0 on GitHub

CC-SET-014: autoMode Setting Ignored in settings.local.json (#1203). Claude Code v2.1.207 stopped reading autoMode from repo-resident .claude/settings.local.json; the new rule warns when the key is present there so users move it to ~/.claude/settings.json.
CC-SET-015: Dead pluginConfigs in Project-Level Settings (#1203). Claude Code v2.1.207 removed support for pluginConfigs in project-level .claude/settings.json and .claude/settings.local.json; plugin option values are now only read from user settings, --settings files, and managed settings. The new rule warns on presence in the wrong tier.
CC-HK-028: Rejected user_config Interpolation in Shell-Form Command (#1203). Claude Code v2.1.207 rejects ${user_config.*} in shell-form hook command strings at load time as a shell-injection fix; the rule flags (error) any command string containing the pattern and directs users to $CLAUDE_PLUGIN_OPTION_<KEY> or environment-passing instead. Rule count 432 → 435.

Tool release baselines (2026-07-15 sweep). Advanced Claude Code to v2.1.207, Cline to cli-v3.0.40, Codex CLI to rust-v0.144.4, Cursor to 3.11.19, and OpenCode to v1.17.20 (closes #1198 through #1202); the three rule-worthy v2.1.207 changes landed as CC-SET-014/015 and CC-HK-028 above.
Tool release baselines. Triaged the current release-watch batch and advanced Claude Code to v2.1.206, Codex CLI to rust-v0.144.1, OpenCode to v1.17.18, Kiro CLI to 2.12.0, Cline to cli-v3.0.39, Cursor to 3.11.13, amp to the-dial, and Gemini CLI to v0.50.0 (closes #1181 through #1188). Releases without validated schema changes were classified as runtime, UI, provider, packaging, or news updates.

Rust 1.97 CI compatibility. Apply the new Clippy simplifications in YAML parsing and CLI result destructuring so the warnings-denied Linux gate remains clean.
Crossbeam advisory remediation. Update the locked crossbeam-epoch dependency to 0.9.20, resolving RUSTSEC-2026-0204 in both dependency security gates.
Codex 0.144.1 config compatibility. Accept the current feature and MCP server keys, including session authentication, and recognize the managed marketplaces requirements table so valid Codex configuration no longer triggers unknown-key diagnostics.
Kiro 2.12 OAuth validation. Treat oauth.clientId as optional for Dynamic Client Registration, validate the new clientSecret, redirectUri, and oauthScopes fields, and enforce documented HTTP loopback redirect forms.
Locale mirror parity. Reconcile the canonical locale files with recently added panic, config-load, and hook-timeout messages, then resync all crate-local copies so the locale parity gate passes on Linux.