[ca] CLI Version Updates: Claude Code 2.1.181, Codex 0.141.0, Copilot SDK 1.0.2

[github-actions]

Overview

Three agentic CLI tools have newer stable releases than the versions pinned in pkg/constants/version_constants.go. Constants were updated and make recompile ran cleanly (250/250 workflows compiled).

Tool	Pinned → New	Released
Claude Code	2.1.179 → 2.1.181	2026-06-17
OpenAI Codex	0.140.0 → 0.141.0	2026-06-18
Copilot SDK	1.0.1 → 1.0.2	2026-06-18

All other tracked tools are already at latest: Copilot CLI 1.0.63, Gemini 0.39.1, Pi 0.79.6, GitHub MCP Server v1.3.0, MCP Gateway v0.3.26, Playwright MCP 0.0.76, Playwright CLI 0.1.14, Playwright Browser v1.61.0.

Note (unchanged): MCP SDK remains pinned at 1.24.0 (latest 1.29.0). Left as note-only per prior runs pending a separate review.

---

Update OpenAI Codex

• Previous: 0.140.0 → New: 0.141.0 (2026-06-18, stable)

Breaking Changes: None.

Key Features

• Remote executors gained authenticated, end-to-end encrypted Noise relay channels (exec-server: add Noise relay transport openai/codex#26242, exec-server: default remote transport to Noise openai/codex#26245).
• Cross-platform remote execution preserves executor-native working directory and shell across server boundaries ([codex] Carry exec-server cwd as PathUri openai/codex#28032, [codex] exec-server honors remote environment cwd and shell openai/codex#28122).
• Executor plugins can launch stdio MCP servers per thread; new marketplace + curated catalog discovery (Discover stdio MCP servers from selected executor plugins openai/codex#27870, [codex] Add created-by-me remote plugin marketplace openai/codex#28203, [codex] Load API curated marketplace by auth openai/codex#28383).
• App-server clients can list child threads, track external-agent imports, and handle rate-limit reset credits (feat(app-server): filter threads by parent openai/codex#26662, [codex] Add external agent import result accounting openai/codex#28008, feat(app-server): expose rate-limit reset credits openai/codex#28143).
• TUI prompts auto-resolve after inactivity with a countdown that pauses on interaction (Add request user input auto-resolution timer openai/codex#28235).
• Default tool timeout increased to 300 seconds ([mcp] Increase default tool timeout to 300 seconds openai/codex#28234).

Fixes / Security

• Hook trust bypass persists through codex exec; blocking PostToolUse hooks properly reject code-mode calls (Preserve hook trust bypass in codex exec threads openai/codex#26434, Respect blocking PostToolUse hooks in code mode openai/codex#28365).
• Bundled SQLite pinned to a version with the WAL-reset corruption fix ([codex] Pin bundled SQLite to fixed WAL-reset version openai/codex#27992).
• TLS now supports P-521 certificate signatures for enterprise proxies; switched rustls crypto provider to aws-lc-rs (Use aws-lc-rs for rustls crypto provider openai/codex#27706).
• Windows sandbox recovers stale credentials (recover stale Windows sandbox credentials openai/codex#27944).

CLI Discovery

codex --help diff vs cached 0.138.0 baseline:

• New subcommand: delete — "Permanently delete a saved session by id or session name"

Impact Assessment

• Risk: Low — no breaking changes; additive features and fixes. New default 300s tool timeout could lengthen some runs but is bounded by workflow timeouts.

---

Update Claude Code

• Previous: 2.1.179 → New: 2.1.181 (2026-06-17, latest tag)
• No public repository; no 2.1.180 published to npm (jumped 2.1.179 → 2.1.181).

CLI Discovery: claude --help main output identical to 2.1.179 — no new top-level commands or flags detected.

Impact Assessment

• Risk: Low — patch-level bump, no surfaced CLI changes.

---

Update Copilot SDK

• Previous: 1.0.1 → New: 1.0.2 (2026-06-18, stable)
• TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC.

⚠️ Dependency note: 1.0.2 declares @github/copilot ^1.0.64-0, i.e. it expects a Copilot CLI ≥ 1.0.64 prerelease. We currently pin Copilot CLI at 1.0.63 stable. No action needed now (peer is a floor, not enforced at our pin), but watch for a Copilot CLI 1.0.64+ stable to keep SDK and CLI aligned.

Impact Assessment

• Risk: Low — patch bump used in copilot-sdk (headless) mode.

---

Recompile & Verification

• make recompile → single pass, 250/250 workflows compiled, 0 errors.
• No firewall/gateway SHA changes (no double-recompile needed).
• Changed files: pkg/constants/version_constants.go, 143 *.lock.yml, and regenerated actions/setup-cli/install.sh (sync-comment refresh only). No js/*.js changes.
• Version strings verified propagated into lock files (e.g. @anthropic-ai/claude-code@2.1.181, @openai/codex@0.141.0).

Recommendations

• Merge the constants bump; Low overall risk across all three.
• Prioritize Codex 0.141.0 for the hook-trust/PostToolUse and SQLite WAL-reset fixes.
• Track for next run: Copilot CLI 1.0.64+ stable (SDK alignment) and MCP SDK 1.29.0 review.

Package Links

• Claude Code: https://www.npmjs.com/package/`@anthropic-ai/claude-code`
• Codex: https://www.npmjs.com/package/`@openai/codex` — release: https://github.com/openai/codex/releases/tag/rust-v0.141.0
• Copilot SDK: https://www.npmjs.com/package/`@github/copilot-sdk` — repo: https://github.com/github/copilot-sdk

References: §27742557480

Generated by 🔢 CLI Version Checker · ◷

• expires on Jun 19, 2026, 11:09 PM UTC-08:00