Added
- CC-SET-017: Non-boolean sandbox.filesystem.disabled Setting. Claude Code v2.1.216 added a strict boolean setting that disables filesystem isolation while preserving network isolation; the new rule catches quoted and other non-boolean values.
- CC-SET-018: Non-boolean emojiCompletionEnabled Setting. Claude Code v2.1.217 added a strict boolean setting for named emoji completion; the new rule catches non-boolean values.
- Claude Code v2.1.218-v2.1.219 validation. Added CC-AG-020 for colon-containing agent names, CC-SET-019 for non-boolean
sandbox.network.strictAllowlist, and CC-SET-020 for invalidworkflowSizeGuidelinevalues. - KR-AG-014: Invalid Kiro agent permission. Kiro CLI 2.14 universal agent profiles now validate permission capabilities, effects, match patterns, and exclusions. Rule count increased from 437 to 443.
Changed
- Tool release baselines (2026-07-26 sweep). Advanced amp to
event-driven-orbs, Claude Code tov2.1.220, OpenCode tov1.18.5, Kiro CLI to2.14.0, Cline tov4.0.11, Cursor to3.13.10, and Gemini CLI tov0.52.0; confirmed Codex CLIrust-v0.145.0and the other tracked markers remain current (closes #1238, #1239, #1240, #1241, #1242, #1243, #1244, and #1245). - Claude Code skill frontmatter compatibility. Boolean skill fields now accept the documented case-insensitive boolean aliases, and the v2.1.218
backgroundfield is recognized. - Tool release baselines (2026-07-20 sweep). Advanced Claude Code to
v2.1.215, Codex CLI torust-v0.144.6, OpenCode tov1.18.3, Kiro CLI to2.13.0, Cline tov4.0.10, Cursor to3.12.17, Gemini CLI tov0.51.0, and amp tosubscriptionsafter reviewing the current release notes (closes #1217, #1218, #1219, #1220, #1221, #1222, #1223, and #1234). - Dependency and CI action refresh. Updated
tomlto1.1.3,clapto4.6.2,rust-i18nto4.2.1,regexto1.13.1, andignoreto0.4.30; refreshed the pinned cargo-deny, CodeQL, setup-java, and taiki-e action revisions. Therust-i18nupdate removes the deprecated transitiveserde_yamlpackage.
Fixed
- Codex 0.145 config compatibility. Accept the four new feature flags and
tui.resume_cwd, and evolve CDX-CFG-029 for the unified positive-integer agent concurrency limit. The currentagents.max_concurrent_threads_per_sessionfield and legacyagents.max_threadsalias now work withmulti_agent_v2without the obsolete conflict diagnostic. - Claude Code hook compatibility. Recognize the v2.1.219
DirectoryAddedhook event without an unknown-event false positive. - Kiro 2.14 universal agent compatibility. Validate nested Markdown or JSON profiles under
.kiro/agents/, derive omitted agent names from relative paths, and resolve nested subagent references. - Cline release tracking. Filter the mixed GitHub release feed to the core
vX.Y.Ztrain so desktop, CLI, and SDK releases no longer produce false tool-release issues. - Cline UTF-8 BOM compatibility. Parse BOM-prefixed Cline rules, workflows, and skill frontmatter so validation matches Cline's current parser behavior instead of silently skipping scoped rules.
- CodeQL action version consistency. Pin CodeQL initialization, analysis, and SARIF upload to the same
v4.37.1revision, preventing mixed-version configuration failures.