v0.50.0

Added

• Claude Code 2.1.242 settings validation. Add CC-SET-025 for the
  user-or-managed modelPicker scope and documented option shape,
  CC-SET-026 for the promptCacheTtl enum, and CC-SET-027 for the
  subagentPromptCacheTtl enum.

Changed

• Tool release baselines. Advance Claude Code to v2.1.243, Codex CLI to
  rust-v0.149.1, Cursor to 3.17.19, and OpenCode to v1.18.22. Accept
  Codex's new compaction_image_budget feature flag; the remaining release
  changes outside the three Claude settings above do not alter a validated
  configuration contract.
• Tool release baselines. Advance Cline to v4.1.15 and Amp to
  friendly-urls-for-sharing-orbs after reviewing the intervening live release
  notes. The changes affect runtime MCP approval behavior, model metadata,
  telemetry, and shared-orb URLs, not an agnix-validated configuration contract.
• Maintenance refresh. Advance Claude Code to v2.1.241, Cline to
  v4.1.13, OpenCode to v1.18.21, and Amp to explain-usage after reviewing
  the live releases against agnix's validated configuration surfaces. Refresh
  all CodeQL action pins to v4.37.7; these pins move together to avoid the
  action's mixed-version configuration failure.
• Claude Code specification baselines. Refresh the reviewed hooks, memory,
  plugins, skills, and subagent documentation hashes. The current documented
  hook lifecycle and configuration surfaces are already represented by the
  existing schemas and rule families, so no validator rule changes are needed.
• Cursor environment MCP policy. Update CUR-016 for the published
  disableAllMcpServers and mcpServerAllowlist fields, including HTTP and
  stdio server identities, optional tool allowlists, and closed-field checks.
• Tool release baselines. Advance Claude Code to v2.1.238, Codex CLI to
  rust-v0.149.0, Cursor to 3.17.8, Kiro CLI to 2.19.0, Gemini CLI to
  v0.56.0, OpenCode to v1.18.19, and Amp to mcp-in-orbs. Apart from the
  Cursor schema change above, the reviewed releases do not change an
  agnix-validated configuration contract.

Fixed

• Rust 1.98 clippy compatibility. Replace a constant-only format! call
  that is now rejected by clippy::useless_format.
• CC-HK-025 Notification matcher compatibility. Accept the documented
  elicitation_url_dialog matcher instead of reporting it as invalid, and
  advance the reviewed Claude Code hooks, memory, plugins, skills, and
  subagent specification baselines.
• Spec drift baseline hashing. Recalculate the five reviewed Claude Code
  hashes with the sentinel's trailing-newline normalization so those sources
  do not immediately re-report drift.
• RustSec dependency audit. Update h2 from 0.4.13 to 0.4.16 to address
  RUSTSEC-2026-0258 (unbounded empty DATA frames).

Changed

• Tool release baselines. Advanced Claude Code from v2.1.232 to
  v2.1.235, Cline from v4.1.9 to v4.1.10, and Amp's release marker from
  global-plugins-and-skills to edu-discount. These releases do not change
  an agnix-validated configuration surface, so no validator or rule update is
  required.