agent-sh/agnix v0.59.0 on GitHub

Migration

Roo Code support is removed (Roo Code shut down on 2026-05-15): ROO-001 to ROO-006 and RC-SK-001 are retired, .roo/ files get only the generic checks, rules.roo_code is a deprecated no-op, and tools = ["roo-code"] only warns. Remove those IDs and settings from your config.
Remove the rule IDs retired in this release from disabled_rules, severity overrides and explicit rule lists: AGM-003, AGM-005, CC-AG-013, CC-HK-017, CC-MEM-007, CC-MEM-009, CC-OS-005, CC-SET-014, CC-SET-015, CC-SET-021, CC-SET-024, CC-SET-032, CDX-001, CDX-002, CDX-003, CDX-AG-004, CDX-AG-007, CDX-CFG-013, CL-SK-002, CL-SK-003, COP-022, COP-023, COP-024, COP-026, GM-007, KIRO-012, KIRO-013, KIRO-014, KR-AG-007, KR-HK-007, KR-HK-008, KR-PW-005, MCP-025, MCP-026, OC-AGM-001, OC-CFG-003, OC-PM-001, PE-001, PE-003, RC-SK-001, ROO-001, ROO-002, ROO-003, ROO-004, ROO-005, ROO-006, XP-007, XP-009. agnix warns about each one and names its replacement where there is one (see the Removed section and knowledge-base/removed-rules.json).
Kiro: CLI settings are validated in .kiro/settings/cli.json and ~/.kiro/settings/cli.json, where Kiro reads them; .kiro/settings.json is not a Kiro CLI file (KIRO-026 reports Kiro keys left there). KR-SET-001 to KR-SET-003 are now warnings, and their fixes require --fix-unsafe.
Kiro: [tool_versions] kiro = "2.x" or "3.x" pins the agent engine the Kiro rules check against. Unpinned, each file is checked against the engines its own fields target, so some findings move between errors and warnings.
Kiro: the kiro_steering toggle now covers every Kiro rule except agent profiles (kiro_agents: KR-AG-, KR-HK-005, KR-HK-006) and skills (skills), including KR-SET-, KR-HK-007 to KR-HK-030, KR-WF-* and KR-IGN-*, which previously ignored both toggles.
Kiro: in permission files, an unknown capability now skips only that rule, as Kiro does, so other problems in the same rule are reported as warnings instead of errors.
--target <tool> and a specific target in .agnix.toml now select only that tool's rules plus the generic ones, exactly like tools = ["<tool>"]. Before, they only disabled CC-* rules, so --target cursor still ran Codex, Copilot and Kiro rules. Without --target, the CLI keeps the config file's target instead of resetting it to generic.
The CLI now finds .agnix.toml in the target's parent directories, up to the repository root, so a project's config applies wherever agnix runs from. Previously it looked only in the target directory and the working directory.

Added

Kiro CLI V2 and V3 engines. [tool_versions] kiro pins an engine (2.x selects V2, 3.x or later V3); unpinned, each Kiro file is checked against the engines its own fields target. A condition that makes every targeted engine skip the file is an error, one that affects only one engine is a warning that names it, and findings point at the offending key or value.
Kiro file detection. Kiro files are detected where each engine loads them: agents (V2 top-level JSON, V3 recursive JSON and Markdown, the .amazonq/cli-agents fallback), standalone hooks, steering, .kiro/settings/cli.json, permissions in YAML or JSON plus managed-settings.json, and powers, including published POWER.md trees, Agent Plugins plugin.json, power mcp.json and power steering. KIRO-026 reports files in Kiro locations that Kiro never loads, such as agent.JSON, permissions.yml, .kiro/mcp.json or nested hook files.
Kiro agents (KR-AG-016 to KR-AG-030): invalid JSON or JSONC, bad Markdown frontmatter, wrong field types and duplicate fields, a missing name for CLI 2.x, non-agent JSON in .kiro/agents, unloadable file:// prompts, reserved or duplicate agent ids, invalid inline MCP servers, tool names that select or trust nothing, CLI 2.x and V3 hook matcher, timeout and field mistakes, agents CLI 2.x does not load, overly broad resource globs and sub-agent descriptions.
Kiro hooks (KR-HK-015 to KR-HK-030): legacy hooks saved as .json, v1 documents saved as .kiro.hook, invalid description, matcher, enabled and timeout values, malformed confirm blocks, matchers that are not valid regular expressions or that name CLI 2.x or Claude Code tools, matchers on triggers that ignore them, misplaced fields Kiro drops, placeholders Kiro does not provide, SessionEnd agent actions and Manual hooks, invalid legacy hook JSON, tool and file hooks that match everything, unanchored regex matchers and file names that are not kebab-case. Agent-embedded hooks get the matcher checks too.
Kiro steering, skills and powers: KIRO-015 (frontmatter Kiro cannot read), KIRO-016 and KIRO-017 (AGENTS.md over the V3 50,000-character truncation, and steering frontmatter in AGENTS.md), KIRO-018 and KR-SK-002 (vague activation descriptions), KR-PW-009 to KR-PW-018 (Agent Plugins plugin.json powers, including skipped plugin skills and a POWER.md Kiro ignores next to plugin.json) and KR-PW-019 (POWER.md is the legacy power format).
Kiro MCP, CLI settings and permissions: KR-MCP-007 to KR-MCP-015 (field types per engine, plain http to remote hosts, variables Kiro does not expand, unknown fields, command plus url, the Agent Plugins power mcp.json including its $schema version, autoApprove: ["*"]), KR-SET-004 to KR-SET-011 (cli.json parse failures, unknown, misplaced and nested keys, value types and documented values for all 140 settings, duplicate keys and global-only keys) and KR-PM-005 to KR-PM-012 (Kiro's strict policy parser: unknown rule keys, presets, patterns with no effect, empty match lists, unrestricted write allows, unsupported glob syntax, shadowed sandbox_network denies and files Kiro does not read).
Kiro workflows and ignore files: KR-WF-001 to KR-WF-009 validate workflow recipes (schema, step-count, depth and unique-id limits, repeat caps, suffix conflicts, interactive steps in parallel, stop conditions, template references, watch handlers and loop stop files), and KR-IGN-001 reports .kiroignore negations that cannot re-include a file under an excluded directory.
Kiro rule reachability test. Every Kiro rule must fire through the full pipeline (detection, registry, validator) on a fixture, with one minimal fixture project for each rule no fixture triggered before.
Copilot (COP-028 to COP-039, CP-SK-002): MCP secrets in custom agents without the COPILOT_MCP_ prefix, ignored copilot-setup-steps job keys and timeouts over 59 minutes, @ references the Copilot CLI does not load, hook constraints (https URLs, prompt hooks only on sessionStart, command combinations, matcher regexes), legacy .chatmode.md files, invalid agent file names, agent MCP servers without a tools list, unsupported MCP features, PowerShell-only or missing hook scripts, literal secrets in hooks, external links in code review instructions, plugin manifest constraints, and skills that pre-approve shell access. Hooks are detected in any .github/hooks/*.json and in Copilot settings files, agents in plain .md files and subfolders of .github/agents/, and plugin manifests are validated.
Cursor (CUR-021 to CUR-040): Cursor CLI config (.cursor/cli.json, ~/.cursor/cli-config.json), permissions.json, plugin and marketplace manifests, .cursorignore, skills and mcp.json are validated: rules over 500 lines, hook paths relative to the wrong base, legacy globs in skills, MCP fields the transport does not support, wildcard allow entries, global settings in a project cli.json, ignored permission entries, subagents without a description or over 2,000 words, invalid plugin manifests, literal secrets in environment.json, beforeMCPExecution hooks without failClosed, hooks cloud agents do not run, ineffective .cursorignore negations, 50 or more subagents, long code blocks in rules, long-running install processes, invalid CLI config and the plugin submission checklist.
Cline (CLN-010 to CLN-016, CL-SK-004): frontmatter Cline cannot parse (with a hint to quote globs that start with *), paths entries that make Cline drop the condition, hook files the VS Code extension cannot run, .clineignore removal notes, literal secrets in rules and workflows, paths patterns that never match, remote MCP servers without type (which default to legacy SSE), and skills without instructions. Workflows and hooks in .cline/ are validated, as are .clineignore and cline_mcp_settings.json.
Claude Code memory (CC-MEM-015 to CC-MEM-021): always-loaded instructions over 400 lines in total (an agnix heuristic), MEMORY.md content past the 200-line or 25 KB load limit, emphasis overuse, a CLAUDE.md that tells Claude to read AGENTS.md instead of importing it, quoted or space-split @imports, CLAUDE.local.md and .claude/settings.local.json not gitignored, and long directory trees or file listings in CLAUDE.md.
Claude Code settings (CC-SET-034 to CC-SET-040, CC-OS-007): keys ignored at the file's scope (from the settings reference's Scope column), permission rules that never take effect, broad code-execution allow rules, sandbox-weakening keys in shared project settings, .claudeignore (Claude Code does not read it), secret files no deny rule protects, relative claudeMdExcludes patterns and non-absolute autoMemoryDirectory values, and outputStyle values with the wrong case.
Claude Code hooks (CC-HK-029 to CC-HK-035): invalid or ineffective onFailure, unquoted path placeholders in shell-form commands, exec-form commands with embedded arguments, PowerShell placeholders that are not expanded, MCP matchers without a wildcard, plugin hooks that name their own MCP server by its bare key, and broad PermissionRequest matchers. Hooks in agent and skill frontmatter get the handler checks too.
Claude Code subagents (CC-AG-021 to CC-AG-024): descriptions over the startup budget, subagents that inherit every tool (info), duplicate names, and disallowedTools specifiers that remove the whole tool.
Claude Code skills (CC-SK-024, CC-SK-025, CC-SK-027, CC-SK-028, CC-SK-030 to CC-SK-034): skills without a description, the skill listing budget, legacy .claude/commands files (a migrate note), injected ! commands that do not run, reserved words or XML tags that block upload, descriptions not in the third person, vague names, and long reference files without a table of contents.
Claude Code plugins and marketplaces (CC-PL-018 to CC-PL-023, CC-MP-001 to CC-MP-005): reserved plugin names, dependency semver ranges, unbraced plugin variables, ignored plugin settings keys, monitor user_config, strict manifest objects, and .claude-plugin/marketplace.json validation.
Claude Code MCP (CC-MCP-001 to CC-MCP-005): credential variables Claude Code reads as empty, ${CLAUDE_PROJECT_DIR} without a default, truncated tool descriptions, and the former MCP-025 (alwaysLoad) and MCP-026 (reserved server names), which now run only on Claude Code MCP files.
Codex: hooks in .codex/hooks.json, inline [hooks] and plugin hooks/hooks.json (CDX-HK-000 to CDX-HK-005), custom agents in .codex/agents/*.toml (CDX-SUB-001 to CDX-SUB-003), .codex/rules/*.rules files (CDX-RL-001, CDX-RL-002), deprecated custom prompts (CDX-DEP-001), new config, requirements and plugin checks (CDX-CFG-031 to CDX-CFG-035, CDX-REQ-002 to CDX-REQ-004, CDX-PL-017 to CDX-PL-019), AGENTS.md checks with Codex-specific fixes (CDX-AG-008 to CDX-AG-010), and skill checks (CX-SK-004, CX-SK-006, CX-SK-007).
OpenCode 1 and 2: each file is checked against the OpenCode release lines it targets. [tool_versions] opencode pins one; unpinned, OpenCode 2 fields select OpenCode 2 and other files are checked against both, so documented OpenCode 1 config gets no errors. Markdown agents, commands, custom tools and plugins have their own file types (Claude subagent rules no longer run on OpenCode agents). New rules: OC-CFG-015, OC-CFG-017 to OC-CFG-022, OC-AG-010, OC-AG-011, OC-PM-003 to OC-PM-007, OC-POL-001, OC-CMD-001 to OC-CMD-003, OC-DEP-008, OC-DEP-009, OC-AGM-003, OC-SK-002 and OC-TOOL-001.
Per-rule tool gating. A rule whose evidence names one tool runs only when that tool is in scope (tools or --target), so AGM-003 (Windsurf), AS-009 (Codex), AS-015, PE-002 and PE-006 (Claude Code) no longer run for other tools.
Gemini CLI (GM-011, GM-013 to GM-028, GM-CMD-001 to GM-CMD-003, GM-AG-002 to GM-AG-006): custom commands and policy files have their own file types; MCP settings and agent frontmatter are validated. Extension hooks/hooks.json and agents/*.md (under .gemini/extensions/ or next to a gemini-extension.json) are linted as Gemini files, not as Claude hooks or subagents.
Amp (AMP-005 to AMP-008, AMP-010, AMP-SK-002, AMP-SK-003): settings are validated against Amp's schema and detected in settings.jsonc, user and managed settings; skill mcp.json files have their own file type; skills masked by an .agents/skills copy and skills too deep to be discovered are reported.
Windsurf / Devin Desktop (WS-005 to WS-011, WS-HK-001 to WS-HK-005): .devin/rules and .devin/workflows, global workflows, global_rules.md and Cascade hooks.json at workspace, user and system paths are validated, next to the legacy .windsurf/ layout.
AGENTS.md (AGM-007 to AGM-009): a root AGENTS.md next to a build manifest that names no build or test command, a legacy AGENT.md, and nested AGENTS.md files without a root file.
Agent Skills (AS-020 to AS-027, XP-SK-003, XP-SK-004): descriptions without a trigger, bodies over 5,000 tokens, interactive scripts, bundled files the skill never mentions, unpinned runners, duplicate skill names, generic pointers, TODO placeholders, literal secrets and backslash paths.
MCP (MCP-027 to MCP-033): server and tool hygiene checks, and MCP server checks on the configs of OpenCode, Gemini CLI, Amp, Codex and Copilot, including VS Code servers maps and JSONC.
CC-SK-023 warns when a Claude Code skill without argument-hint or arguments has an unescaped $N inside code. Claude Code substitutes $N in code blocks too, so awk '{print $1}' receives the second skill argument whenever the skill is invoked with two or more arguments. Escape it as \$1.
XP-SK-002 reports hardcoded user-home paths in skills owned by clients other than Claude Code, using the same scan as CC-SK-021. The Agent Skills spec asks for paths relative to the skill root.

Removed

Retire KIRO-012 (never emitted), KIRO-013 (replaced by KIRO-015), KIRO-014 (no documented heading requirement), KR-PW-005 (POWER.md step sections are not documented), KR-HK-007 (replaced by KR-HK-017 and KR-HK-026), KR-HK-008 (never implemented) and KR-AG-007 (Kiro has no @agent mention syntax; replaced by KR-AG-006).
Retire CDX-AG-004: its 100,000-byte AGENTS.md limit had no source. XP-007 checks AGENTS.md against Codex's documented 32 KiB project_doc_max_bytes default, and XP-009 checks the combined chain.
Retire COP-022 and COP-023 (duplicates of AS-002 to AS-005), COP-024 (CP-SK-001 owns the Copilot skill field list), COP-026 (duplicate of MCP-012) and CL-SK-002 and CL-SK-003 (unreachable; AS-002 and AS-003 report missing skill names and descriptions).
Retire CC-MEM-007 and PE-003 (they pushed for stronger wording, which Anthropic now advises against; CC-MEM-017 reports emphasis overuse), CC-MEM-009 (unsourced 1,500-token budget; CC-MEM-014 covers size), PE-001 (no vendor documents the lost-in-the-middle heuristic), CC-OS-005 (no documented name length limit) and CC-SET-014, CC-SET-015, CC-SET-021, CC-SET-024 and CC-SET-032 (folded into CC-SET-034).
Retire CC-HK-017 ($ARGUMENTS is optional; Claude Code appends the hook input when it is absent), CC-AG-013 (no documented naming format; CC-AG-005 still reports unresolved skills) and MCP-025 and MCP-026 (moved to CC-MCP-004 and CC-MCP-005).
Retire CDX-001 and CDX-002 (keys of the retired TypeScript Codex CLI; CDX-004 reports them), CDX-003 (committing nested AGENTS.override.md files is the documented team pattern), CDX-AG-007 (never ran), CDX-CFG-013 (no such Codex field), OC-CFG-003 (duplicate of OC-004), OC-PM-001 (duplicate of OC-008) and OC-AGM-001 (no OpenCode source).
Retire AGM-005 (XP-001 reports the same features), XP-007 and XP-009 (replaced by the Codex rules CDX-AG-009 and CDX-AG-010, which reported the same files a second time) and RC-SK-001 (Roo Code shut down on 2026-05-15).
Retire GM-007 (Gemini imports are @path, not @import; REF-001 checks them).
Retire AGM-003: WS-011 reports Windsurf's 12,000-character AGENTS.md limit, only in projects that use Devin Desktop.

Fixed

Kiro agents. KR-AG-003 understands Kiro tool selectors (*, @builtin, @server, globs and aliases) and was wrong on 264 of 266 real findings before; KR-AG-004 flags only Claude Code model aliases and wrong types instead of a stale model list; KR-AG-009 accepts "prompt": null; KR-AG-012 checks the original tool name; KR-AG-005 reports only referenced MCP servers CLI 2.x will not load; KR-AG-001 knows the per-engine field lists; KR-AG-014 and KR-AG-015 follow V3 load behavior, and KR-AG-015 offers an unsafe removal of empty trust fields; KR-AG-006 checks documented sub-agent access. On real configs, agnix no longer errors on any agent file kiro-cli 2.x accepts, and with 2.x pinned it errors on every file kiro-cli rejects.
Kiro hooks. Type errors in V3 hook files are reported at the offending value instead of as one "not valid JSON" that hid every other check; KR-HK-011 is an error because Kiro skips the file; KR-HK-012 and KR-HK-014 follow the engine's trigger aliases and reject AgentSpawn; KR-HK-013 drops its 3,600-second ceiling; KR-HK-010 no longer flags words containing sk- or environment references, and now also checks action.command and confirm.confirmCommand in .kiro/hooks/*.json (it covered only legacy .kiro.hook files); KR-HK-001 lists the documented IDE events; KR-HK-004 asks for when.patterns; KR-HK-005 and KR-HK-006 cover object and array agent hooks; KR-HK-009 is an info note.
Kiro steering, skills and powers. The KR-SK-001 autofix no longer corrupts skill YAML: it moves single-line fields under metadata (safe for plain data), deletes other values whole only in unsafe mode, and is offered only when the result re-parses. Kiro skills no longer get a duplicate XP-SK-001, and KR-SK-001 reports allowed-tools. KIRO-003 accepts the documented fileMatchPattern array and brace forms; KIRO-002 no longer requires name for auto steering; KIRO-001's fix edits only the top-level value and is unsafe; KIRO-006 and KR-PW-008 no longer treat identifiers in code samples as secrets; KIRO-010 and KIRO-011 follow the documented defaults and count characters; POWER.md checks follow what Kiro reads, and no message prints a raw placeholder.
Kiro MCP, settings and permissions. KR-MCP-002 no longer flags paths, variable references or placeholders and also checks headers and args; KR-MCP-003 reports a command that includes its arguments; KR-MCP-004 follows Kiro's https-or-localhost rule; KR-MCP-005 reports a duplicate server name; KR-MCP-006 checks clientMetadataUrl; MCP type errors no longer hide other checks; MCP-009 no longer flags url-only servers in Kiro power mcp.json; the KR-SET fixes edit only the exact top-level value and never leave unparseable JSON; the shared secret check ignores $VAR, %VAR%, placeholders and file paths.
Claude Code rules on Kiro files. No @-import (REF-001) findings on Kiro agents, hooks, steering or power steering, no XP-003 on POWER.md and no Claude hook rules on .kiro settings files; Kiro files get Kiro-specific editor completions; the Kiro skill client is detected case-insensitively and includes skills bundled in powers.
Copilot. COP-006 uses Copilot's guidance of about 1,000 lines instead of an unsourced 4,000-character limit; COP-002 treats a missing applyTo as a warning (info when a description exists), since VS Code documents it as optional; COP-004 accepts name; COP-007 skips target: vscode agents; COP-012 no longer reports model; COP-015 knows the built-in ask, agent and plan agents; COP-017 follows the 14 documented hook events with an optional type; COP-018 requires the copilot-setup-steps job and accepts Windows, larger and self-hosted runners; COP-005 still accepts coding-agent; autofixes remove exactly the offending key.
Cursor. CUR-005 removes whole entries and re-parses the result; CUR-006 is a low-severity migrate note that says Cline still reads .cursorrules; CUR-009 is renamed "Rule Applied Only When Mentioned"; every CUR rule cites the current Cursor docs.
Cline. Files under .clinerules/skills/ are no longer linted as rules (CLN-001 and CLN-003 false positives); CLN-009 follows Cline's hook event table, accepts TaskError and SessionShutdown, warns on PreCompact and skips helper files; CLN-003 accepts name, disabled and enabled; CLN-006 reports only unknown or wrongly typed workflow keys; a wrongly typed frontmatter value no longer hides the other checks.
Claude Code rules on other tools' files. Claude memory rules no longer run on Cursor rules, and prompt rules no longer run on GEMINI.md (Gemini advises negative constraints, the opposite of PE-006). PE rules run per file type, where the vendor documents the advice: all of them on Claude files, PE-004 and PE-005 on AGENTS.md, PE-004 on Cursor rules.
Claude Code memory and prompts. CC-MEM-014 counts every line and also checks .claude/rules/ files and @-imports over 200 lines; CC-MEM-011 accepts comma-separated paths and escaped brackets; PE-005 matches "write clean code", no longer flags vendor-endorsed advice such as "be concise", and its fix is unsafe; PE-004 reports only instruction lines; PE-006 accepts rules that give a reason or an alternative; XML-001 to XML-003 are warnings.
Claude Code settings. Type checks on keys ignored at the file's scope report CC-SET-034 instead of a type error; CC-SET-016 ("File Path Rule Never Consulted") covers MultiEdit and is an error in deny and ask.
Claude Code hooks, subagents, skills and plugins. CC-HK-009 is a MEDIUM warning and no longer flags || true or 2>/dev/null; CC-HK-010 covers only the SessionEnd timeout budget (no more "no timeout" warnings); CC-HK-021 errors on if for non-tool events; CC-HK-025 reports tool names that match a built-in only when case is ignored; .vscode/settings.json gets no hook rules; Gemini extension and Codex plugin hooks/hooks.json files get no CC-HK rules; CC-AG-005 resolves a plugin agent's skills in the plugin and knows the 32-skill preload limit; a README in an agents directory is an info note, not an error; CC-AG-019 checks the autoCompactWindow range; CC-SK-006 is MEDIUM and matches whole name segments; CC-PL-007 checks entry types and paths; CC-PL-010 errors on a homepage that does not parse as a URL; CC-PL-014 checks plugin agent files; the CC-AG-001 autofix is unsafe.
Codex. CDX-CFG-007 warns on any full-access posture, including default_permissions = ":danger-full-access"; CDX-APP-001 accepts writes and also checks MCP servers; CDX-APP-003 warns on the removed profile selector and [profiles] table; CDX-PL-014 checks every package field and the 4,000-character description cap (missing fields are info, since Codex enforces them only on upload); CDX-CFG-026 checks permissions.<name>.network; CDX-AG-003 uses its own list of vague Codex instructions instead of the Claude list.
OpenCode. OC-003 accepts JSONC with trailing commas and points at the key or value; OC-004 knows the OpenCode 2 schema; OC-002 accepts ~/ and absolute paths and resolves relative paths from the project root; OC-007 skips built-in agents; OC-CFG-001 accepts #variant and the object form; OC-CFG-005 is a warning and covers MCP headers, environment and OAuth secrets; OC-CFG-012 checks the documented OAuth member sets; OC-AGM-002 runs only in OpenCode projects and matches the real AIza key prefix; rename fixes are unsafe.
AGENTS.md and cross-platform rules. AGM-001 is a warning and follows CommonMark fences; AGM-002 asks for headings only above 50 non-blank lines; AGM-003 counts characters and runs only for Windsurf; AGM-004 checks root files only; XP-001 skips @path when every selected tool expands it; XP-002 checks only skipped heading levels; XP-003 reports only hard-coded home directories (1,080 findings on tool directories in a 17-tree corpus are gone); XP-006 no longer counts .opencode/ or non-Markdown Copilot files; XP-008 reports only @-imports Cursor does not inline.
Skills. Per-client field lists follow each vendor (Cursor paths, icon, color, globs; Cline disabled, enabled; Copilot argument-hint, user-invocable, disable-model-invocation, context; OpenCode disable-model-invocation; Amp mcpServers, builtin-tools); fixes move a field under metadata or delete it only as an unsafe fix and re-parse the result; .agents/skills follows the configured tools; AS-013 follows reference chains instead of directory depth; AS-016 accepts list-form argument-hint and non-string metadata for Claude Code and Kiro; with [tool_versions] opencode = "2.x", AS-004 to AS-006, AS-008 and AS-017 are warnings for OpenCode skills.
MCP. MCP-006 reports only unknown annotation keys; MCP-009 explains a missing type and treats url-only entries in Codex plugins as remote; MCP-011 knows each client's transport types; MCP-012, MCP-013 and MCP-017 are MEDIUM; MCP-018 covers more reference syntaxes, headers and URLs; REF-001 accepts Gemini's absolute and @../ imports; REF-003 is info.
Plugin manifests. CC-PL-001 no longer reports GitHub Copilot or Agent Plugins manifests at the plugin root (including Copilot's legacy format without $schema); it is still an error for a Claude Code manifest outside .claude-plugin/ and a warning when the reader is unclear. MCP server checks (and CC-MCP-001 and CC-MCP-004 for Claude Code) now run on servers declared inline in a plugin manifest's mcpServers, for Claude Code, legacy Copilot and Cursor manifests.
Copilot plugin manifests. COP-019, COP-020 and COP-039 also check a root plugin.json that GitHub Copilot reads (when tools includes Copilot, or the manifest is an Agent Plugins or Copilot manifest; skipped when .plugin/plugin.json exists, which Copilot reads first) and .claude-plugin/plugin.json when tools includes Copilot and no earlier Copilot location exists, so unscoped runs add no Copilot findings to Claude Code plugins. COP-019 warns when a plugin uses the Agent Plugins layout (com.github.copilot/ or an Agent Plugins mcp.json) without an Agent Plugins $schema in plugin.json, because Copilot then loads it as a legacy plugin and ignores those components.
Each problem is reported once. XP-SK-001 leaves fields to the per-client skill rules and CC-SK-017; CC-SK-024 leaves missing descriptions to AS-003; OC-AGM-002 leaves secrets to CDX-AG-002 on the same line; OC-CFG-005, CDX-CFG-010 and CDX-PL-019 leave MCP secrets to MCP-018 and MCP-028; COP-035's SSE check leaves type: "sse" to MCP-012; MCP-009 leaves empty entries to MCP-024; CDX-AG-010 leaves a single oversized file to CDX-AG-009; crossed XML tags get XML-002 only; CC-PL-004 leaves a blank plugin name to CC-PL-005. The deferring rule still reports when the owner rule is disabled. On a 17-tree corpus this removed 180 duplicate findings.
MCP server checks (MCP-018, MCP-019, MCP-027, MCP-028, MCP-029) also cover Gemini agents, SKILL.md mcpServers and a skill's mcp.json, with positions at the key in YAML and TOML; MCP-024 reports only entries whose fields are all blank; WS-SK-001 accepts the Devin CLI skill fields in .windsurf/skills/.
CC-SK-017 runs only where Claude Code reads the skill: in a Claude Code location (.claude/skills/, a Claude plugin's skills/) or, for a skill outside every client directory, when the run selects Claude Code. Unscoped, such a skill may belong to any tool (KiroCrew reads triggers, pi skills carry version), so its non-universal fields get the XP-SK-001 info note instead of a Claude Code warning.
Language server. Diagnostics that belong to another file (for example AMP-003 on a file AGENTS.md mentions) are no longer shown on the open document at a wrong position.
VS Code. The extension activates on and watches every file type agnix lints.
Gemini CLI. GM-004 checks the real hooks.<Event> groups and hooksConfig; GM-009 accepts every documented settings key, including hooks and mcpServers, and its fix keeps the JSON valid; GM-005 errors only on name, version and invalid name characters (advice moved to GM-028); GM-008 accepts arrays and subpaths and errors on absolute paths, .. and missing files; GM-010 says memoryManager is no longer a setting; GM-001 is MEDIUM and GM-002 and GM-003 are LOW heuristics.
Amp. AMP-004 no longer errors on documented amp.* keys (wrong types and non-amp. keys are warnings); AMP-003 checks globs on the files AGENTS.md mentions, not on AGENTS.md; AMP-002 no longer requires severity-default; AMP-001 reports a check with an empty body.
Windsurf. WS-002 and WS-003 count characters, not bytes (no more false positives on CJK text); an oversized workflow is an error; WS-004 points to .devin/rules/ or AGENTS.md.
--target no longer prints a warning that the target config field is deprecated: the flag sets the tools list for the run.
Tool filtering treats every CC-* rule as Claude Code's, including CC-MEM-* rules, whose family the prefix table left out.
REF-002 reports broken links whose text contains inline code again, such as [`docs/RECIPES.md`](docs/RECIPES.md). The link scanner split text at code spans, so these links were never checked. REF-002 also checks link reference definitions ([guide]: docs/guide.md), drops link titles and ?query suffixes, unwraps <...> destinations, and decodes %XX escapes before the existence check.
REF-002 expands ${CLAUDE_SKILL_DIR} and ${CLAUDE_PLUGIN_ROOT} before checking a link, and skips links built on other variables. Targets such as ${CLAUDE_SKILL_DIR}/jobs/scan.md were reported missing although they exist.
REF-002 no longer treats prose such as [name](redis.io link) as a link: CommonMark allows only a quoted title after the destination.
XML-001 no longer reports prose placeholders such as ssh <host> 'df -h', run_key=<date>), Result<Outcome> and <brief description of bug>. An unclosed tag still counts when it starts its line, runs straight into content (<thinking>Think), has attributes, or is closed elsewhere in the file. On a 17-tree corpus this removed 208 of 216 XML-001 findings.
REF-001 and CC-MEM-001 no longer read prose such as @mcp.tool-decorated as an import: a bare name needs an alphanumeric file extension.
CDX-AG-005 checks only inline-code spans shaped like a relative file path, skips fenced code, resolves from the project root as well as the AGENTS.md directory, and reports once per file as intended. Method names, globs, placeholders, versions and bare file names produced about 95% of its findings, up to 113 in one file.
CC-SK-016 ignores $N inside code, which is usually shell or awk syntax where an argument-hint does not help, and honors the documented \$1 escape.
AS-013 ignores reference-directory names inside URLs (.../static-assets/...) and strips backticks and * from paths, so `scripts/vendor/` no longer counts as two levels deep.
CC-SK-021 treats elided names such as C:\Users\... as placeholders.
Skills under ~/.codex/skills resolve to Codex and skills under ~/.config/opencode/skills, OpenCode's global skills directory, to OpenCode, instead of falling back to the Claude Code rules. Hardcoded home paths in those skills are reported by XP-SK-002.
Gemini CLI extension hooks (.gemini/hooks/hooks.json) and Cursor plugin manifests (.cursor-plugin/plugin.json) are no longer validated as Claude Code files.
KR-AG-009 reports a prompt that is set but empty or not a string, and no longer requires the field. The Kiro configuration reference lists prompt among the sections an agent file "can include", and Markdown agents take the prompt from the body. Renamed to "Agent Prompt Empty Or Invalid".
XP-004 reports the same file and line on every run. Package managers were grouped in a hash map, so the reported side of a conflict changed between runs.
The CLI applies a .agnix.toml from the working directory only to targets inside that directory. Linting another tree from a project directory applied that project's exclude patterns to it, which could skip every file.
removed-rules.json now redirects AS-018, AS-019 (removed in 0.28.0), CC-SK-003 and CC-HK-019 (removed in 0.44.0).
XP-009 no longer repeats XP-007 for a single AGENTS.md over the cap, and starts a chain at a nested Git repository, where Codex starts, instead of adding the instruction files above it.
pi subagent definitions are no longer validated as Claude Code agents: files in ~/.pi/agent/agents/ and .pi/agents/, and any agents/ directory whose parent has a pi package manifest (pi or pi-subagents in package.json), pi settings (defaultProvider, packages and other pi-only keys in settings.json), or an extension importing @earendil-works/pi-coding-agent. This also covers a repo that is symlinked into ~/.pi/agent. A .claude root or a .claude-plugin/ folder still marks Claude agents. Before, CC-AG-009 and CC-AG-019 fired on pi tool names and fields, and the unsafe CC-AG-003 fix rewrote pi models to sonnet.
XP-003 checks tool directories such as .claude/ in every file but reports machine paths (~/.<dir>/, /Users/<name>/, ~/Library/) only in files agents load. In generic Markdown, such as design docs, those paths mostly document where a tool keeps its data.