agent-sh/agnix v0.58.0

on GitHub

Migration

• Remove retired IDs REF-004, OC-DEP-004, CC-MEM-005, CC-MEM-006, CC-MEM-008, AGM-006, and MCP-005 from disabled_rules, severity overrides, and explicit rule lists. Generic-instruction advice remains under PE-005; unrelated retirements have no replacement.
• Quoted-boolean repairs now require --fix-unsafe. Review the proposed values first: enabling previously ignored settings can change behavior or security policy. Plain --fix leaves these strings unchanged.

Removed

• Retire REF-004: Claude Code supports non-Markdown imports, including @package.json.
• Retire OC-DEP-004: a file named CONTEXT.md is not invalid in an explicit OpenCode instructions list.
• Retire duplicate memory advice CC-MEM-005, CC-MEM-006, and CC-MEM-008 in favor of the PE rules. Retire AGM-006: nested AGENTS.md files are supported instruction hierarchies.
• Retire MCP-005: client consent recommendations do not require invented requiresApproval or confirmation fields in MCP tool definitions.
• Remove prose-rewriting autofixes from CC-MEM-007 and PE-003, the permission-mode rewrite from CC-AG-012, and the invalid tools-to-permission key-only migration from OC-DEP-002.

Added

• Kiro capability permissions YAML validation (KR-PM-001 through KR-PM-004), including optional match / exclude string arrays and the real user/workspace policy paths.
• KR-HK-014 provides safe canonical trigger spelling fixes for supported V3 aliases and advisory legacy CLI hook migration hints. Manual is accepted without claiming CLI invocation support.
• Kiro CLI V3 support: standalone .kiro/hooks/*.json documents validate under
  new rules KR-HK-011 (document version must be v1), KR-HK-012 (documented
  PascalCase triggers, camelCase 2.x aliases accepted, required
  name/trigger/action) and KR-HK-013 (action.type command/agent
  with a non-empty payload; seconds-based timeout with a sanity ceiling).
• KR-AG-015 warns when a Kiro agent profile keeps CLI 2.x trust fields
  (allowedTools, toolsSettings) without a permissions block: CLI V3
  skips such profiles until /upgrade-agent converts them.
• Kiro agent profiles accept the V3 fields excludedTools and includePowers,
  and the V3 permission capabilities power and sandbox_network.
• CC-SET-033 flags a non-boolean idleCompaction in Claude Code settings
  (key added in v2.1.290, documented by the v2.1.299 release notes).

Fixed

• Index Kiro V3 hook edit spans once per document, preserving duplicate decoded-key guards and avoiding quadratic alias validation and diagnostic-location scans.
• Missing or empty MCP tool descriptions no longer produce MCP-002 errors. Descriptions are optional in the MCP schema; MCP-004 provides informational advice instead.
• Add opt-in unsafe migrations for CC-SET-016 permission tool names, COP-027 infer, and KR-HK-011 version strings 1 / 1.0; add unsafe OC-DEP-005 cleanup only after manually copying TUI settings. Keep OC-DEP-001 safe and OC-DEP-002 without a key-only fix.
• CDX-005 accepts zero and removes the invented 65536-byte ceiling on project_doc_max_bytes; negative and non-integer values remain invalid.
• CDX-CFG-001 follows the current Codex approval-policy schema, including granular objects.
• Add opt-in unsafe quoted-boolean fixes for Claude settings, hook once, output-style keep-coding-instructions, and MCP alwaysLoad. Converting ignored strings can activate security-sensitive behavior, so plain --fix leaves them untouched. Other wrong types remain manual corrections.
• Restore VS Code lint and native integration checks: configure ESLint, use the
  compiled test entry point, isolate the test profile, and check explicit settings.
• Accept the Codex rust-v0.162.0 config keys: the [tui] options (mouse_scroll_speed,
  keymap, agents_overview_grouping and the rest of the current schema) and the new
  root keys (goals, cloud, browser_use, computer_use and others).
• Accept the Codex rust-v0.163.0 config keys: root
  include_environment_context_time, js_repl_node_module_dirs,
  js_repl_node_path and the 67 new [features] flags.
• Accept numeric autoCompactWindow on Claude Code subagent frontmatter (v2.1.296).
  A non-number is a CC-AG-007 parse error. No range rule: the published
  AgentDefinition type is number, and the 100000-1000000 window is documented
  for settings and /autocompact, not this field.

Changed

• Make CC-MEM-007, PE-001/002/003, XP-001, CC-PL-003, and MCP-004 informational advice rather than warnings or errors. Keep CC-AG-012 as a permission-safety warning without rewriting a valid mode.
• Update rustls to 0.23.46, quinn-proto to 0.11.18, and refresh editor and website dependency locks.
• Update VS Code development tooling to Mocha 12 and VSCE 4; package and publish on Node 22.
• Bump uuid to 1.27.0 and tokio to 1.53.2. Lockfile only.
• Review Claude Code 2.1.295 and Cursor 3.24.9; no new validation constraints.
• Review Claude Code v2.1.296 and Cursor 3.24.12. The gateway
  managed.policies[].code key lives in gateway.yaml, which agnix does not
  validate. Refresh the reviewed Claude Code hooks, memory, plugins, skills,
  and subagents spec hashes. Hook event names, skill frontmatter fields, plugin
  manifest keys, and the four-hop memory import limit are unchanged.
• Review Claude Code v2.1.299, Codex CLI rust-v0.163.0, Cursor 3.24.18 and
  Gemini CLI v0.64.0; refresh the drifted Cline and Cursor spec hashes.
• Review Kiro CLI 2.30.0 through 2.31.1 (V3 rollout) and add V3 validation.
• Review Cline v4.1.24; rule symlink loading and skill discovery change runtime behavior, with no new validation constraints.