@chimix/agentscan 1.0.0 → 1.3.0

package/CHANGELOG.md

@@ -7,6 +7,240 @@ read-only in every version below.
 GitHub already has release pages for [v0.1.0](https://github.com/SimaAlexandru99/agentscan/releases/tag/v0.1.0)
 and [v0.4.0](https://github.com/SimaAlexandru99/agentscan/releases/tag/v0.4.0).
 0.9.0 was planned as a separate train and shipped inside 1.0.0.
+1.0.1 is the shared-MCP hotfix; it is documented below and ships inside 1.1.0
+(the published package version). A separate 1.0.1 npm tag would need an
+intermediate commit that this train does not cut.
+
+## 1.3.0 — 2026-08-31
+
+Native Windsurf / Cascade coverage against 2026-08-31 official docs.
+**99 checks**, **457 tests**.
+
+### Added
+
+- Spec captures `docs/spec/windsurf-rules.md`, `windsurf-agents-md.md`,
+  `windsurf-mcp.md`.
+- Workspace rules: `.devin/rules/*.md` (preferred), `.windsurf/rules/*.md`
+  (fallback), subdirectory-scoped trees, legacy `.windsurfrules`.
+  `.devin` is a scan-root signal.
+- Character budgets: `windsurf.rule.too-large` (12,000) and
+  `windsurf.rule.global-too-large` (6,000). Never `cursor.rule.too-large`.
+- `windsurf.rule.missing-trigger` on workspace `.devin` / `.windsurf` rules
+  that omit frontmatter `trigger`. Not on `.windsurfrules`,
+  `global_rules.md`, or `AGENTS.md`.
+- Portable lowercase `agents.md` (same `sourceProvider: unknown` as
+  `AGENTS.md`).
+- `--global` Cascade MCP at `~/.codeium/windsurf/mcp_config.json`
+  (`windsurf-json`). Launch is `command` or `serverUrl` or `url`.
+  `windsurf.mcp.no-launch` when none are set. Never
+  `claude.mcp.url-without-type`.
+- `--global` `~/.codeium/windsurf/memories/global_rules.md` only. Other
+  files in that memories directory stay unread.
+
+### Unread (intentional)
+
+- Devin Local CLI MCP (no published path).
+- Auto-generated memories other than `global_rules.md`.
+- System / enterprise rule directories.
+- Project MCP (none quoted).
+- Marketplace, admin allowlists, OAuth stores.
+
+## 1.2.1 — 2026-08-31
+
+Codex user MCP under `--global`. **95 checks**, **441 tests**.
+
+### Added
+
+- `$CODEX_HOME/config.toml` (default `~/.codex/config.toml`) is opened only
+  with `--global`. Same `codex-toml` shape as project `.codex/config.toml`.
+- Same-name user and project servers both stay in the inventory. The
+  published page does not quote a replace-entirely rule, so this scanner
+  does not invent `codexEffective`.
+- Spec recapture `docs/spec/codex-mcp.md` (user path, `CODEX_HOME`, unread
+  system / managed / requirements / profiles / plugins / trust / `auth.json`).
+
+### Unread (intentional)
+
+- System `/etc/codex/config.toml`, managed preferences, `requirements.toml`,
+  profile files, plugin MCP, `trust_level`.
+- User-file `project_doc_*` knobs.
+- Claude global settings; Command Code `projects/{slug}/mcp.json`.
+
+## 1.2.0 — 2026-08-31
+
+Native Grok Build provider against 2026-08-31 official docs. **95 checks**,
+**435 tests**. Compatibility with Claude or Cursor is not schema identity.
+
+### Added
+
+- Spec captures `docs/spec/grok-mcp.md`, `grok-hooks.md`, `grok-skills.md`,
+  `grok-rules.md`, `grok-agents.md`.
+- Profiles: `grok-toml` MCP, `grok` hook and skill schemas.
+  `inferHookSchemaProfile("grok")` is `"grok"`, not `"claude"`.
+- Project `.grok/config.toml` walk-up (cwd → scan boundary). User
+  `$GROK_HOME/config.toml` or `~/.grok/config.toml` under `--global`.
+  Same-name project replaces user; closer project file wins.
+  `grok.mcp.no-launch` when neither `command` nor `url` is set. Never
+  `claude.mcp.url-without-type` on `grok-toml`.
+- `.grok/hooks/*.json` and user hooks under `--global`. Fourteen events;
+  handlers `command` / `http`. Copilot `version: 1` remap is not applied.
+- `.grok/skills` (and user skills under `--global`). Frontmatter required;
+  `name` / `description` optional. Agent Skills directory-match and Claude
+  listing-budget checks do not run.
+- `.grok/rules/*.md` with no size cap. `Agents.md` and `AGENT.md` as Grok
+  instruction files beside `AGENTS.md`.
+- Conformance fixture `tests/fixtures/conformance/grok-toml/`.
+- `spec:check` drifts Grok hook event names against the live hooks page.
+
+### Unread (intentional)
+
+- Managed / requirements TOML, plugins, marketplaces, personas, LSP,
+  `sandbox.toml`, `pager.toml`.
+- `[skills] paths` (no quoted resolution base).
+- `.grok/agents/` (directory named, no filename pattern).
+- Claude / Cursor / `.mcp.json` as Grok-consumed.
+- `.gitignore` skip for instruction files.
+- Credential files (`auth.json`, `mcp_credentials.json`).
+
+## 1.1.0 — 2026-08-31
+
+Native Command Code provider, then a correctness pass over every registered
+check against 2026-08-31 official docs. Includes 1.0.1. **87 checks**, **420
+tests**.
+
+### Added
+
+- Hook schema profiles: `claude` | `vscode-native` | `copilot-cli` |
+  `commandcode`. `.github/hooks` with `version: 1` is Copilot CLI.
+- Claude hook schema: required `type` (not inferred from `command`/`url`);
+  `mcp_tool` needs `server` + `tool`; `prompt`/`agent` need `prompt`;
+  documented event/handler compatibility; nested matcher groups only.
+- Copilot CLI: camelCase events mapped onto VS Code names; `bash` /
+  `powershell` / `command`; `cwd`; `timeoutSec` then `timeout`. Prompt
+  hooks only on `sessionStart`. User `~/.copilot/hooks` under `--global`.
+- Agent Skills optional constrained fields: `compatibility` 1..500,
+  `metadata` map<string,string>, `allowed-tools` string. Info for
+  `SKILL.md` >500 lines. File references resolve from the skill root only.
+- Claude skill listing budget: 1% context window, 8000-character fallback,
+  per-entry cap 1536, listing text is description (or first markdown
+  paragraph) plus `when_to_use`. First paragraph satisfies missing
+  description.
+- OpenCode V2: local `command` must be an argv array
+  (`opencode.mcp.command-not-array`).
+- Continue standalone YAML blocks require `name` / `version` / `schema`
+  (`continue.mcp.missing-block-metadata`). Copied JSON is not checked.
+- Gemini underscore alias warning (`gemini.mcp.underscore-alias`).
+- Claude reserved MCP names including `workspace`
+  (`claude.mcp.reserved-name`).
+- Codex chain knobs: `AGENTS.override.md` > `AGENTS.md` >
+  `project_doc_fallback_filenames`; one file per directory; root→cwd;
+  `project_doc_max_bytes`; `project_root_markers`.
+- Coverage matrix uses five dimensions (project discovery, global
+  discovery, schema, precedence, conformance) instead of `full` /
+  `partial`.
+- Conformance fixture `tests/fixtures/conformance/copilot-hooks/`.
+- Spec capture `docs/spec/copilot-hooks.md`. Alias
+  `claude.hook.mcp-tool-without-name` →
+  `claude.hook.mcp-tool-without-server-or-tool`.
+
+### Changed
+
+- Nested `<dir>/.commandcode/AGENTS.md` is Command Code memory when that
+  directory has no `AGENTS.md` (official memory table).
+- Native VS Code remains command-only with its documented eight events.
+  `vscode.hook.http-without-url` and `vscode.hook.mcp-tool-without-name`
+  are removed.
+- Claude agent names: lowercase letters and hyphens (no digits); filename
+  is not compared to `name`.
+- `skill.description-budget` provenance is vendor-recommendation, not a
+  16000-byte heuristic.
+
+### Added (Command Code provider)
+
+- Provider `commandcode` from official pages under `docs/spec/commandcode-*.md`
+  (read 2026-08-31). Unknown stays skip: no invented local-project MCP slug,
+  no bundled-skill scan, no `--skill` flags, no model-id list, no mods
+  execution.
+- Skills: `.commandcode/skills` only at the Command Code project root
+  (Agent Skills contract), `.agents/skills` walk-up (max 10 hops from cwd,
+  stopping at home), extra dirs from the highest-precedence settings
+  `skills` array (replace, not merge; relative paths resolve against the git
+  root). User `~/.commandcode/skills` and `~/.agents/skills` under
+  `--global`.
+- Memory: per directory, first existing of `AGENTS.md` or
+  `.commandcode/AGENTS.md` (project and nested). User
+  `~/.commandcode/AGENTS.md` under `--global`. Unresolved `@path` is not a
+  hard error. Codex's instruction chain excludes `.commandcode/AGENTS.md`.
+- Agents: `<project>/.commandcode/agents/*.md` at the Command Code project
+  root only (git root, or cwd outside a git repo); filename supplies
+  `name`; no `claude.agent.*` on these files. Checks:
+  `commandcode.agent.reserved-name` (`explore` / `plan` / `review` /
+  `general`), `invalid-permission-mode`, `invalid-field-type` covering every
+  documented custom-agent typed field (`reasoningEffort` is not one of them).
+  `maxTurns` must be a positive integer.
+- Hooks: four events (`PreToolUse`, `PostToolUse`, `Stop`, `SessionStart`);
+  nested `hooks` array required; `type` must be the string `"command"`;
+  `command` must be a string (not an argv array); `matcher` must be a string
+  when present. Timeout 0–600. A matcher on `Stop` / `SessionStart` is
+  runtime-dead, not a schema error. Project and user hooks for the same event
+  coexist; only an exact duplicate command string is deduplicated (project
+  wins). `settings.local.json` follows settings merge (an event array
+  replaces the project array for that event). `COMMANDCODE_PROJECT_DIR` and
+  `COMMANDCODE_CWD` expand against the Command Code project root.
+- Settings: Command Code project root is the git root (a child `.cursor`
+  does not hide `<git-root>/.commandcode/`). `model` inventoried, not
+  validated. Inline `mcp.servers` (array or object map; unnamed array items
+  are inventory-only). User `~/.commandcode/mcp.json` under `--global`.
+  Spec/runtime checks skip shadowed lower-precedence definitions; security
+  checks still inspect every readable MCP file.
+- Slash commands: inventory `.commandcode/commands` at the project root and
+  the user dir — no required-field checks.
+- Mods: inventory `mods.paths` — never execute or import TypeScript.
+- Conformance fixture `tests/fixtures/conformance/commandcode/`.
+- `spec:check` tracks captured surfaces and diffs Claude, VS Code, Copilot
+  CLI, and Command Code hook events against live pages.
+
+### Also changed
+
+- Default `skillPaths` includes `.commandcode/skills`.
+- `--global` / `includeGlobal` also scans `~/.commandcode/skills`,
+  `~/.agents/skills`, user Command Code agents, MCP, memory, Copilot user
+  hooks, and Codex global AGENTS files.
+- Shared `.mcp.json` is `mcp-json`, not Claude-only.
+
+## 1.0.1 — 2026-08-31
+
+Shared `.mcp.json` is not Claude-only. Command Code writes it for `--scope
+project` with `transport` (and `type` as an alias). A Claude-keyed
+`url`-without-`type` check on that path is a false positive on valid
+Command Code HTTP config.
+
+### Fixed
+
+- `.mcp.json` uses schema profile `mcp-json`, `consumedBy: ["claude",
+  "commandcode"]`, `sourceProvider: "unknown"`. `.claude/mcp.json` and
+  project `mcp.json` stay `claude-json`.
+- Parse `transport` first; `type` is an alias. Store which field was
+  present.
+- `claude.mcp.url-without-type` on `mcp-json` fires only when `url` is set
+  and transport is unset. On `claude-json` it still fires when the field is
+  `transport` or missing. `{ "transport": "http", "url": "…" }` does not
+  emit this.
+- Command Code transport defects on `mcp-json` and `commandcode-json`:
+  `commandcode.mcp.invalid-transport`, `http-without-url`,
+  `stdio-without-command`. Valid transports are `http` and `stdio`. Claude
+  `sse` / `ws` on shared `.mcp.json` is not a Command Code invalid-transport.
+- Empty launch on `mcp-json` still emits `claude.mcp.no-launch` (both
+  consumers need a launch field). `commandcode-json` empty launch emits
+  `commandcode.mcp.no-launch`.
+- `looksLikeServerEntry` recognises `transport`. Absolute MCP paths under
+  `--global` are not joined as relative.
+
+### Security
+
+- Never open `~/.commandcode/auth.json` or `mcp-tokens.json`.
+- Local `~/.commandcode/projects/{project}/mcp.json` is unread: the slug
+  encoding is unpublished. Prefer skip over inventing it.
 
 ## 1.0.0 — 2026-08-30