chore(deps): bump bundled agents to latest

[dohooo]

Automated daily refresh of Helmor's bundled coding agents to their latest stable upstream versions. This is the long-lived vendor-bump PR — new bumps are rebased onto origin/main and stacked here.

Vendor versions

Vendor	Current (main)	Target	Notes
@anthropic-ai/claude-code	2.1.191	2.1.197	npm latest. Staged binary — SHA256 added (arm64+x64).
@anthropic-ai/claude-agent-sdk	0.3.191	0.3.197	npm latest. Lockstep with claude-code (claudeCodeVersion: 2.1.197 ✓).
@cursor/sdk	1.0.21	1.0.22	npm latest. Class A SDK (no SHA); @connectrpc/connect-node resolves; Node 24 ≥ engines floor >=22.13 ✓.
@openai/codex	0.142.0	0.142.4	npm latest. Staged binary — SHA256 added (arm64+x64).
opencode-ai + @opencode-ai/sdk	1.17.10	1.17.11	npm latest. SDK + CLI in lockstep.
Kimi	0.19.2	0.20.3	latest GitHub release (stable). 4-platform SHA256 added.

Changes

• sidecar/package.json — pins for claude-code, claude-agent-sdk, cursor, codex, opencode (sdk & cli).
• sidecar/scripts/vendor-platform.ts — added CLAUDE_CODE_SHA256["2.1.197"], CODEX_SHA256["0.142.4"], KIMI_SHA256["0.20.3"], and bumped KIMI_VERSION to 0.20.3 (intermediate unmerged 2.1.195 / 0.142.3 / 0.20.1 entries superseded for a clean diff). Each staged binary has both arm64 + x64 (Kimi: 4 platforms) SHA256, computed from the upstream tarballs / release-asset digests.
• .changeset/bump-bundled-agents.md — single rolling changeset (helmor: patch) listing the bumped agents.

Breaking-change assessment

No breaking changes detected. All bumps are patch/minor and additive:

• Claude 2.1.191 → 2.1.197: lockstep SDK/CLI; typecheck passes (no SDK export/type breaks); stored-fixture pipeline tests green (no stdout event-shape drift).
• Cursor 1.0.21 → 1.0.22: Class A SDK; typecheck passes; @connectrpc/connect-node resolves; Node engines floor satisfied.
• Codex 0.142.0 → 0.142.4: patch bump; no item//turn//thread/ method changes observed (CI build gate verifies staging + SHA + layout descriptor).
• OpenCode 1.17.10 → 1.17.11: typecheck passes; message.part event shapes unchanged.
• Kimi 0.19.2 → 0.20.3: stable release; release notes are TUI / shell-mode / plugins only — no ACP protocol change (ACP_PROTOCOL_VERSION unaffected).

Verification gates (all green, run locally)

Gate	Result
bun install	✅ resolved 2.1.197 / 0.3.197 / 1.0.22 / 0.142.4 / 1.17.11; lockstep claudeCodeVersion: 2.1.197 ✓
bun run typecheck	✅ exit 0
bun test	✅ 406 pass, 1 skip, 0 fail
cargo test --test pipeline_scenarios --test pipeline_fixtures --test pipeline_streams	✅ all pass (exit 0)

The heavy bun run build (full staging + SHA256 verification + compile) was not run locally — stage-vendor.ts was untouched and SHAs were computed directly from source tarballs/release digests; CI re-runs the full build on this PR (which is what verifies SHA256 + cross-arch staging).

🤖 Automated by the daily bundled-vendor bump routine.

https://claude.ai/code/session_01Rf79ULQtq2MiigcSg5Ue7b

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
helmor-marketing	Ignored	Preview	Jun 30, 2026 6:58pm