v1.1.0 — Command Code and correctness pass

Native Command Code provider, then a correctness pass over every registered check against 2026-08-31 official docs. Includes 1.0.1. 87 checks, 420 tests. Still offline on check.

Install

npx @chimix/agentscan@latest
npx skills add SimaAlexandru99/agentscan

GitHub Action:

- uses: SimaAlexandru99/agentscan@v1
  with:
    fail-on: error

Skill: https://skills.sh/simaalexandru99/agentscan/agentscan

check against 2026-08-31 official docs. Includes 1.0.1. 87 checks, 420
tests.

Added

• Hook schema profiles: claude | vscode-native | copilot-cli |
  commandcode. .github/hooks with version: 1 is Copilot CLI.
• Claude hook schema: required type (not inferred from command/url);
  mcp_tool needs server + tool; prompt/agent need prompt;
  documented event/handler compatibility; nested matcher groups only.
• Copilot CLI: camelCase events mapped onto VS Code names; bash /
  powershell / command; cwd; timeoutSec then timeout. Prompt
  hooks only on sessionStart. User ~/.copilot/hooks under --global.
• Agent Skills optional constrained fields: compatibility 1..500,
  metadata map<string,string>, allowed-tools string. Info for
  SKILL.md >500 lines. File references resolve from the skill root only.
• Claude skill listing budget: 1% context window, 8000-character fallback,
  per-entry cap 1536, listing text is description (or first markdown
  paragraph) plus when_to_use. First paragraph satisfies missing
  description.
• OpenCode V2: local command must be an argv array
  (opencode.mcp.command-not-array).
• Continue standalone YAML blocks require name / version / schema
  (continue.mcp.missing-block-metadata). Copied JSON is not checked.
• Gemini underscore alias warning (gemini.mcp.underscore-alias).
• Claude reserved MCP names including workspace
  (claude.mcp.reserved-name).
• Codex chain knobs: AGENTS.override.md > AGENTS.md >
  project_doc_fallback_filenames; one file per directory; root→cwd;
  project_doc_max_bytes; project_root_markers.
• Coverage matrix uses five dimensions (project discovery, global
  discovery, schema, precedence, conformance) instead of full /
  partial.
• Conformance fixture tests/fixtures/conformance/copilot-hooks/.
• Spec capture docs/spec/copilot-hooks.md. Alias
  claude.hook.mcp-tool-without-name →
  claude.hook.mcp-tool-without-server-or-tool.

Changed

• Nested <dir>/.commandcode/AGENTS.md is Command Code memory when that
  directory has no AGENTS.md (official memory table).
• Native VS Code remains command-only with its documented eight events.
  vscode.hook.http-without-url and vscode.hook.mcp-tool-without-name
  are removed.
• Claude agent names: lowercase letters and hyphens (no digits); filename
  is not compared to name.
• skill.description-budget provenance is vendor-recommendation, not a
  16000-byte heuristic.

Added (Command Code provider)

• Provider commandcode from official pages under docs/spec/commandcode-*.md
  (read 2026-08-31). Unknown stays skip: no invented local-project MCP slug,
  no bundled-skill scan, no --skill flags, no model-id list, no mods
  execution.
• Skills: .commandcode/skills only at the Command Code project root
  (Agent Skills contract), .agents/skills walk-up (max 10 hops from cwd,
  stopping at home), extra dirs from the highest-precedence settings
  skills array (replace, not merge; relative paths resolve against the git
  root). User ~/.commandcode/skills and ~/.agents/skills under
  --global.
• Memory: per directory, first existing of AGENTS.md or
  .commandcode/AGENTS.md (project and nested). User
  ~/.commandcode/AGENTS.md under --global. Unresolved @path is not a
  hard error. Codex's instruction chain excludes .commandcode/AGENTS.md.
• Agents: <project>/.commandcode/agents/*.md at the Command Code project
  root only (git root, or cwd outside a git repo); filename supplies
  name; no claude.agent.* on these files. Checks:
  commandcode.agent.reserved-name (explore / plan / review /
  general), invalid-permission-mode, invalid-field-type covering every
  documented custom-agent typed field (reasoningEffort is not one of them).
  maxTurns must be a positive integer.
• Hooks: four events (PreToolUse, PostToolUse, Stop, SessionStart);
  nested hooks array required; type must be the string "command";
  command must be a string (not an argv array); matcher must be a string
  when present. Timeout 0–600. A matcher on Stop / SessionStart is
  runtime-dead, not a schema error. Project and user hooks for the same event
  coexist; only an exact duplicate command string is deduplicated (project
  wins). settings.local.json follows settings merge (an event array
  replaces the project array for that event). COMMANDCODE_PROJECT_DIR and
  COMMANDCODE_CWD expand against the Command Code project root.
• Settings: Command Code project root is the git root (a child .cursor
  does not hide <git-root>/.commandcode/). model inventoried, not
  validated. Inline mcp.servers (array or object map; unnamed array items
  are inventory-only). User ~/.commandcode/mcp.json under --global.
  Spec/runtime checks skip shadowed lower-precedence definitions; security
  checks still inspect every readable MCP file.
• Slash commands: inventory .commandcode/commands at the project root and
  the user dir — no required-field checks.
• Mods: inventory mods.paths — never execute or import TypeScript.
• Conformance fixture tests/fixtures/conformance/commandcode/.
• spec:check tracks captured surfaces and diffs Claude, VS Code, Copilot
  CLI, and Command Code hook events against live pages.

Also changed

• Default skillPaths includes .commandcode/skills.
• --global / includeGlobal also scans ~/.commandcode/skills,
  ~/.agents/skills, user Command Code agents, MCP, memory, Copilot user
  hooks, and Codex global AGENTS files.
• Shared .mcp.json is mcp-json, not Claude-only.

1.0.1 (shared .mcp.json is mcp-json, not Claude-only) ships inside this package version; see CHANGELOG.md.