Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- **OpenCode v1.14.20 -> v1.14.21 doc refresh** (#766) - re-verified all 46 OC-* rules against the upstream changelog. v1.14.21 is a runtime/UI-only patch (LSP pull diagnostics support, bare Git repo project caching, session compaction improvements, UTF-8 BOM preservation, Roslyn for C#, Mistral high reasoning variant, TUI/Desktop fixes) - zero on-disk file schema changes. No code changes required. Bumped `verified_on` for all 46 OC-* rules to 2026-04-23; bumped `RESEARCH-TRACKING.md` "Last Reviewed" for OpenCode 2026-04-22 -> 2026-04-23 and added OC to the Rules column (was just `AGM, XP`).

### Fixed
- **Codex CLI rust-v0.122.0 -> rust-v0.123.0 catch-up** (#765) - upstream `config-schema.json` (verified 2026-04-23) gained 1 new top-level key: `experimental_thread_store_endpoint` (per #18714 in v0.123.0). Without this fix, agnix would false-positive **CDX-004** (unknown TOML top-level key) for any v0.123.0+ config. Added to both `KNOWN_TOP_LEVEL_KEYS` (schemas/codex.rs, used by CDX-004) and `KNOWN_CONFIG_TOP_LEVEL_KEYS` (rules/codex.rs, used by CDX-CFG-006) plus regression tests for both the TOML and JSON paths. Bumped `verified_on` for all 58 CDX-* rules to 2026-04-23. Other v0.123.0 changes (amazon-bedrock model provider #18744, /mcp verbose #18610, plugin MCP loading dual format #18780, realtime handoffs #18597, `remote_sandbox_config` #18763, model metadata refresh) need no agnix changes — `remote_sandbox_config` does not appear as a top-level key in the published schema; model providers are not allowlisted by agnix; the rest are runtime/CLI/UI.

Copilot AI Apr 23, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changelog bullet uses "(#765)", but #765 is the issue being closed; elsewhere in this file the parentheses appear to reference the PR number (e.g., #766, #748, #752). Please update this reference to the actual PR number (or remove the parentheses) to keep the changelog cross-references consistent.

Suggested change
- **Codex CLI rust-v0.122.0 -> rust-v0.123.0 catch-up** (#765) - upstream `config-schema.json` (verified 2026-04-23) gained 1 new top-level key: `experimental_thread_store_endpoint` (per #18714 in v0.123.0). Without this fix, agnix would false-positive **CDX-004** (unknown TOML top-level key) for any v0.123.0+ config. Added to both `KNOWN_TOP_LEVEL_KEYS` (schemas/codex.rs, used by CDX-004) and `KNOWN_CONFIG_TOP_LEVEL_KEYS` (rules/codex.rs, used by CDX-CFG-006) plus regression tests for both the TOML and JSON paths. Bumped `verified_on` for all 58 CDX-* rules to 2026-04-23. Other v0.123.0 changes (amazon-bedrock model provider #18744, /mcp verbose #18610, plugin MCP loading dual format #18780, realtime handoffs #18597, `remote_sandbox_config` #18763, model metadata refresh) need no agnix changes — `remote_sandbox_config` does not appear as a top-level key in the published schema; model providers are not allowlisted by agnix; the rest are runtime/CLI/UI.
- **Codex CLI rust-v0.122.0 -> rust-v0.123.0 catch-up** - upstream `config-schema.json` (verified 2026-04-23) gained 1 new top-level key: `experimental_thread_store_endpoint` (per #18714 in v0.123.0). Without this fix, agnix would false-positive **CDX-004** (unknown TOML top-level key) for any v0.123.0+ config. Added to both `KNOWN_TOP_LEVEL_KEYS` (schemas/codex.rs, used by CDX-004) and `KNOWN_CONFIG_TOP_LEVEL_KEYS` (rules/codex.rs, used by CDX-CFG-006) plus regression tests for both the TOML and JSON paths. Bumped `verified_on` for all 58 CDX-* rules to 2026-04-23. Other v0.123.0 changes (amazon-bedrock model provider #18744, /mcp verbose #18610, plugin MCP loading dual format #18780, realtime handoffs #18597, `remote_sandbox_config` #18763, model metadata refresh) need no agnix changes — `remote_sandbox_config` does not appear as a top-level key in the published schema; model providers are not allowlisted by agnix; the rest are runtime/CLI/UI.

Copilot uses AI. Check for mistakes.
- **Claude Code v2.1.117 -> v2.1.118 catch-up** (#764) - upstream v2.1.118 added `type: "mcp_tool"` so hooks can invoke MCP tools directly. Without this fix, agnix would false-positive **CC-HK-016** (unknown hook type) on every v2.1.118+ user that follows the release notes. Added `"mcp_tool"` to both `valid_types` arrays AND `known_non_command` arrays in `crates/agnix-core/src/rules/hooks/helpers.rs` (4 sites total — two for the strict-fields pass, two for the async-on-non-command pass) plus a regression test asserting `mcp_tool` doesn't trigger CC-HK-016. Note: as of 2026-04-23 the docs at `code.claude.com/docs/en/hooks` only list 4 types; the v2.1.118 release notes are authoritative for the new `mcp_tool` type until the docs catch up. Bumped `verified_on` for all 25 CC-HK-* rules to 2026-04-23. Other v2.1.118 changes (vim visual mode, `/cost`+`/stats`->`/usage`, custom themes, plugin `themes/` directory, `DISABLE_UPDATES`, `wslInheritsWindowsSettings` policy key, `autoMode.*` `"$defaults"` token, `claude plugin tag`, OAuth and credential bug fixes) need no agnix changes — they're runtime/UI/CLI behavior or settings.json fields agnix doesn't validate directly.
- **GitHub Copilot v0.42.2 -> v0.43.0 catch-up** (#748) - upstream PR `microsoft/vscode-copilot-chat#4964` (in v0.43.0) makes the `description` frontmatter field on `.instructions.md` files a user-visible feature in the VS Code Chat Customizations UI. Without this fix, agnix would false-positive **COP-004** (unknown frontmatter key) and offer an auto-fix to delete the line on every v0.43.0+ user that follows the docs. Added `"description"` to `KNOWN_KEYS` and a typed `description: Option<String>` field on `CopilotScopedSchema` in `crates/agnix-core/src/schemas/copilot.rs` plus two regression tests (parse + unknown-key check). Documentation: bumped `verified_on` for all 25 COP-* rules to 2026-04-22; bumped `RESEARCH-TRACKING.md` "Last Reviewed" for GitHub Copilot from 2026-02-05 to 2026-04-22. Verified other v0.43.0 changes (hooks/plugins UI wiring, AGENTS.md/CLAUDE.md multi-root discovery fix, internal NES/session/telemetry refactors) need no agnix changes - they're UI/runtime only with no schema impact.
- **OpenCode v1.3.13 -> v1.14.20 catch-up** (#752) - upstream PR `anomalyco/opencode#13748` (in v1.3.16) added the `tui.mouse: bool` config key to disable terminal mouse capture. Without this fix, agnix would false-positive **OC-TUI-001** (unknown TUI key) on any current OpenCode config that includes `{"tui": {"mouse": false}}`. Added `"mouse"` to `KNOWN_TUI_KEYS` in `crates/agnix-core/src/schemas/opencode.rs` plus two regression tests (`mouse: false` and `mouse: true`). Documentation: bumped `verified_on` for all 46 OC-* rules to 2026-04-22; bumped `RESEARCH-TRACKING.md` "Last Reviewed" for OpenCode from 2026-02-05 to 2026-04-22. Verified other schema additions in the bump window (MCP `oauth_redirect_uri` in v1.4.3, `compaction.autocontinue` in v1.4.4, `compaction.preserve_recent_tokens` in v1.14.19, LLM Gateway provider in v1.4.9) need no agnix changes - they extend optional sub-fields agnix doesn't enforce. Note: as of v1.14.x, upstream `config.ts` deprecates the in-config `tui` block in favour of a separate `tui.json` file; agnix's TUI validator continues to help users on v1.3-v1.4 and users who keep the deprecated form. Migrating to validate `tui.json` is a future enhancement, not a blocker for this triage.
Expand Down
52 changes: 52 additions & 0 deletions crates/agnix-core/src/rules/codex.rs
Original file line number Diff line number Diff line change
Expand Up @@ -152,6 +152,7 @@ const KNOWN_CONFIG_TOP_LEVEL_KEYS: &[&str] = &[
"experimental_realtime_ws_base_url",
"experimental_realtime_ws_model",
"experimental_realtime_ws_startup_context",
"experimental_thread_store_endpoint",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The addition of experimental_thread_store_endpoint to both KNOWN_CONFIG_TOP_LEVEL_KEYS here and KNOWN_TOP_LEVEL_KEYS in schemas/codex.rs highlights a violation of the Single Source of Truth principle. These lists have already diverged in sorting and content (e.g., experimental_use_freeform_apply_patch is sorted differently in both files), which increases maintenance overhead and the risk of inconsistent validation between TOML and JSON/YAML formats. Since both lists represent the same set of valid Codex configuration keys, they should be refactored into a single shared constant.

References
  1. Instead of merging and deduplicating data from multiple sources, refactor the code to have a single source of truth to avoid duplication in the first place.

"experimental_use_freeform_apply_patch",
"experimental_use_unified_exec_tool",
"features",
Expand Down Expand Up @@ -2204,6 +2205,15 @@ mod tests {
)
}

fn validate_config_json(content: &str) -> Vec<Diagnostic> {
let validator = CodexValidator;
validator.validate(
Path::new(".codex/config.json"),
content,
&LintConfig::default(),
)
Comment on lines +2209 to +2214

Copilot AI Apr 23, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

validate_config_json duplicates the existing validate_config_at_path(".codex/config.json", ...) helper already used later in this test module. Consider removing validate_config_json and using validate_config_at_path in the new JSON test to avoid maintaining two helpers for the same behavior.

Suggested change
let validator = CodexValidator;
validator.validate(
Path::new(".codex/config.json"),
content,
&LintConfig::default(),
)
validate_config_at_path(".codex/config.json", content)

Copilot uses AI. Check for mistakes.
}

fn validate_config_with_config(content: &str, config: &LintConfig) -> Vec<Diagnostic> {
let validator = CodexValidator;
validator.validate(Path::new(".codex/config.toml"), content, config)
Expand Down Expand Up @@ -3154,6 +3164,48 @@ url = "https://example.com/marketplace"
);
}

#[test]
fn test_codex_v0_123_top_level_keys_accepted_toml() {
// Codex CLI rust-v0.123.0 added 1 new top-level config key
// (verified against config-schema.json on 2026-04-23):
// - experimental_thread_store_endpoint
//
// TOML path: CDX-004 fires for unknown top-level keys.
let toml = r#"
experimental_thread_store_endpoint = "https://thread-store.example"
"#;
let diagnostics = validate_config(toml);
let unknown: Vec<_> = diagnostics.iter().filter(|d| d.rule == "CDX-004").collect();
assert!(
unknown.is_empty(),
"experimental_thread_store_endpoint should not trigger CDX-004 (Codex v0.123+), got: {:?}",
unknown
);
}

#[test]
fn test_codex_v0_123_top_level_keys_accepted_json() {
// JSON/YAML path: CDX-CFG-006 fires for unknown top-level keys when
// the file is JSON/YAML (NOT TOML, where CDX-004 takes over via
// skip_top_level). The fix in rules/codex.rs::KNOWN_CONFIG_TOP_LEVEL_KEYS
// must include `experimental_thread_store_endpoint` for CDX-CFG-006
// to accept it. Without that arm of the fix, this test fails even if
// the TOML schema allow-list (schemas/codex.rs) is updated.
let json = r#"{
"experimental_thread_store_endpoint": "https://thread-store.example"
}"#;
let diagnostics = validate_config_json(json);
let unknown: Vec<_> = diagnostics
.iter()
.filter(|d| d.rule == "CDX-CFG-006")
.collect();
assert!(
unknown.is_empty(),
"experimental_thread_store_endpoint should not trigger CDX-CFG-006 (Codex v0.123+), got: {:?}",
unknown
);
}

#[test]
fn test_cdx_cfg_007_danger_full_access_without_ack() {
let diagnostics = validate_config("sandbox_mode = \"danger-full-access\"");
Expand Down
1 change: 1 addition & 0 deletions crates/agnix-core/src/schemas/codex.rs
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,7 @@ pub const KNOWN_TOP_LEVEL_KEYS: &[&str] = &[
"experimental_use_freeform_apply_patch",
"experimental_realtime_start_instructions",
"experimental_realtime_ws_startup_context",
"experimental_thread_store_endpoint",
// Instruction-section toggles (added in Codex rust-v0.122.0 catch-up)
"include_apps_instructions",
"include_environment_context",
Expand Down
Loading
Loading