fix(codex): catch up to rust-v0.122.0 (8 new top-level config keys)

CHANGELOG.md

@@ -21,6 +21,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Docusaurus** - bumped `@docusaurus/core` and `@docusaurus/preset-classic` from 3.9.2 to 3.10.0.
 
 ### Fixed
+- **Codex CLI rust-v0.118.0 -> rust-v0.122.0 catch-up** (#747) - upstream `config-schema.json` (verified 2026-04-22) gained 8 new top-level keys (`experimental_realtime_start_instructions`, `experimental_realtime_ws_startup_context`, `include_apps_instructions`, `include_environment_context`, `include_permissions_instructions`, `marketplaces`, `realtime`, `tool_suggest`). Without this fix, agnix would false-positive **CDX-004** (unknown TOML top-level key, primary path for `.codex/config.toml`) and CDX-CFG-006 (its JSON/YAML equivalent) on any current Codex config that uses them. Added all 8 to `KNOWN_TOP_LEVEL_KEYS` in `crates/agnix-core/src/schemas/codex.rs` (the TOML path used by CDX-004) AND `KNOWN_CONFIG_TOP_LEVEL_KEYS` in `crates/agnix-core/src/rules/codex.rs` (the JSON/YAML path). Also added `realtime` and `marketplaces` to `KNOWN_TABLE_KEYS` since both can appear as TOML tables (`[realtime]`, `[[marketplaces]]`). Plus a regression test that runs an inline-table config and a section-table config and asserts zero CDX-004 diagnostics. Documentation: bumped `verified_on` for all 58 CDX-* rules to 2026-04-22; bumped `RESEARCH-TRACKING.md` "Last Reviewed" for Codex CLI from 2026-02-05 to 2026-04-22. Verified MCP server config (`env`, `env_vars`), AGENTS.md discovery refactor (#18035), filesystem deny-read globs (#15979), and PermissionRequest hooks (#17563) require no agnix changes - their upstream effects are runtime-only, additive, or already covered by existing validators.
 - **Claude Code v2.1.90 -> v2.1.117 catch-up** (#745) - `Monitor` (the new built-in tool added in v2.1.98 for streaming events from background scripts) is now in `KNOWN_AGENT_TOOLS`, so `tools: [Monitor]` in agent frontmatter no longer false-positives CC-AG-009/CC-AG-010. `xhigh` (the new effort level for Opus 4.7, added in v2.1.111) is now in `schemas::skill::VALID_EFFORT_LEVELS` (the single source of truth shared by both agent CC-AG-014 and skill CC-SK-018 validation), so `effort: xhigh` no longer false-positives in either rule. The agent `color` field (display color for the task list and transcript) is now a typed field on `AgentSchema` and listed in `KNOWN_AGENT_FIELDS`, so `color: blue` no longer false-positives CC-AG-019. Documentation: bumped `verified_on` for CC-AG-009/010/011/014/019 and CC-SK-018 to 2026-04-22; added a single scope note at the top of the `CLAUDE CODE RULES (SUBAGENTS)` section in `VALIDATION-RULES.md` that agent-frontmatter `hooks` and `mcpServers` are loaded for both subagent spawning and `--agent` main-thread sessions (v2.1.116/v2.1.117); bumped `RESEARCH-TRACKING.md` "Last Reviewed" for Claude Code from 2026-02-05 to 2026-04-22.
 - **Clippy errors under Rust 1.95** - collapsed nested `if` blocks into match guards in `kiro_steering.rs`, `roo.rs`, and `windsurf.rs`, and switched `fixes.rs` to `sort_by_key` with `Reverse`. Resolves `collapsible_match` and `unnecessary_sort_by` lints newly enforced on stable 1.95, unblocking CI on `main` and all open PRs.
 - **`[files].exclude` silently half-worked** (#722) - previously this filter ran at `resolve_file_type`, which skipped per-file validators but left project-level rules (AGM-006, XP-004/005/006) collecting vendored paths by filename during the walk. A vendored `AGENTS.md` would still fire "Nested AGENTS.md" even when excluded. `[files].exclude` now joins the walker filter alongside top-level `exclude`, so both filters share one "don't look at this path" semantic and cross-file rules honour it too.

crates/agnix-core/src/rules/codex.rs

@@ -147,9 +147,11 @@ const KNOWN_CONFIG_TOP_LEVEL_KEYS: &[&str] = &[
     "developer_instructions",
     "disable_paste_burst",
     "experimental_compact_prompt_file",
+    "experimental_realtime_start_instructions",
     "experimental_realtime_ws_backend_prompt",
     "experimental_realtime_ws_base_url",
     "experimental_realtime_ws_model",
+    "experimental_realtime_ws_startup_context",
     "experimental_use_freeform_apply_patch",
     "experimental_use_unified_exec_tool",
     "features",
@@ -160,10 +162,14 @@ const KNOWN_CONFIG_TOP_LEVEL_KEYS: &[&str] = &[
     "ghost_snapshot",
     "hide_agent_reasoning",
     "history",
+    "include_apps_instructions",
+    "include_environment_context",
+    "include_permissions_instructions",
     "instructions",
     "js_repl_node_module_dirs",
     "js_repl_node_path",
     "log_dir",
+    "marketplaces",
     "mcp_oauth_callback_port",
     "mcp_oauth_callback_url",
     "mcp_oauth_credentials_store",
@@ -195,6 +201,7 @@ const KNOWN_CONFIG_TOP_LEVEL_KEYS: &[&str] = &[
     "project_doc_max_bytes",
     "project_root_markers",
     "projects",
+    "realtime",
     "review_model",
     "sandbox_mode",
     "sandbox_workspace_write",
@@ -205,6 +212,7 @@ const KNOWN_CONFIG_TOP_LEVEL_KEYS: &[&str] = &[
     "sqlite_home",
     "suppress_unstable_features_warning",
     "tool_output_token_limit",
+    "tool_suggest",
     "tools",
     "tui",
     "web_search",
@@ -3101,6 +3109,51 @@ name = "test"
         assert!(diagnostics.iter().any(|d| d.rule == "CDX-CFG-006"));
     }
 
+    #[test]
+    fn test_codex_v0_122_top_level_keys_accepted() {
+        // 8 top-level keys present in upstream config-schema.json (verified
+        // 2026-04-22) but missing from agnix's TOML allow-list before this
+        // change. CDX-004 is the rule that fires for unknown TOML top-level
+        // keys (CDX-CFG-006 explicitly skips top-level keys when CDX-004 is
+        // enabled, so asserting against CDX-CFG-006 here would be vacuous).
+        // Two of the keys (marketplaces, realtime) can also appear as TOML
+        // tables; covered by the second config below.
+        let toml_inline = r#"
+experimental_realtime_start_instructions = "hi"
+experimental_realtime_ws_startup_context = "ctx"
+include_apps_instructions = true
+include_environment_context = true
+include_permissions_instructions = false
+marketplaces = []
+realtime = {}
+tool_suggest = "off"
+"#;
+        let diagnostics = validate_config(toml_inline);
+        let unknown: Vec<_> = diagnostics.iter().filter(|d| d.rule == "CDX-004").collect();
+        assert!(
+            unknown.is_empty(),
+            "v0.122 top-level keys should not trigger CDX-004, got: {:?}",
+            unknown
+        );
+
+        // Section variants: [realtime] and [[marketplaces]] tables
+        let toml_tables = r#"
+[realtime]
+ws_url = "wss://example"
+
+[[marketplaces]]
+name = "official"
+url = "https://example.com/marketplace"
+"#;
+        let diagnostics = validate_config(toml_tables);
+        let unknown: Vec<_> = diagnostics.iter().filter(|d| d.rule == "CDX-004").collect();
+        assert!(
+            unknown.is_empty(),
+            "v0.122 [realtime] and [[marketplaces]] tables should not trigger CDX-004, got: {:?}",
+            unknown
+        );
+    }
+
     #[test]
     fn test_cdx_cfg_007_danger_full_access_without_ack() {
         let diagnostics = validate_config("sandbox_mode = \"danger-full-access\"");

crates/agnix-core/src/schemas/codex.rs

@@ -84,6 +84,20 @@ pub const KNOWN_TOP_LEVEL_KEYS: &[&str] = &[
     // Experimental
     "experimental_use_unified_exec_tool",
     "experimental_use_freeform_apply_patch",
+    "experimental_realtime_start_instructions",
+    "experimental_realtime_ws_startup_context",
+    // Instruction-section toggles (added in Codex rust-v0.122.0 catch-up)
+    "include_apps_instructions",
+    "include_environment_context",
+    "include_permissions_instructions",
+    // Plugin marketplaces (added in Codex rust-v0.122.0 catch-up; can also be
+    // present as a TOML table)
+    "marketplaces",
+    // Realtime config (added in Codex rust-v0.122.0 catch-up; can also be
+    // present as a TOML table)
+    "realtime",
+    // Tool suggestions toggle (added in Codex rust-v0.122.0 catch-up)
+    "tool_suggest",
     // Legacy camelCase keys (backwards compat)
     "approvalMode",
     "fullAutoErrorMode",
@@ -104,6 +118,10 @@ pub const KNOWN_TABLE_KEYS: &[&str] = &[
     "skills",
     "feedback",
     "notice",
+    // Added in Codex rust-v0.122.0 catch-up - both can appear as TOML tables
+    // ([realtime] / [[marketplaces]]) in addition to inline values.
+    "realtime",
+    "marketplaces",
 ];
 
 /// An unknown key found in config