[ca] CLI Version Updates: Claude Code 2.1.104, Copilot 1.0.24, Codex 0.120.0, MCP Gateway v0.2.18

[github-actions]

Summary

Updated 4 CLI/MCP versions in pkg/constants/version_constants.go. All lock files regenerated via make recompile.

Tool	Previous	New	Intermediates
Claude Code	2.1.98	2.1.104	2.1.100, 2.1.101
Copilot CLI	1.0.21	1.0.24	1.0.22, 1.0.23
Codex	0.118.0	0.120.0	0.119.0
MCP Gateway	v0.2.17	v0.2.18	—

No changes: GitHub MCP Server (v0.32.0), Playwright MCP (0.0.70), Playwright Browser (v1.59.1), Gemini (0.37.1).

---

Update Claude Code 2.1.98 → 2.1.104

• Version: 2.1.98 → 2.1.104 (via 2.1.100, 2.1.101)
• Source: https://www.npmjs.com/package/`@anthropic-ai/claude-code`

Impact Assessment

• Risk: Low
• No public changelog; patch-level updates with no breaking changes expected

---

Update Copilot CLI 1.0.21 → 1.0.24

• Version: 1.0.21 → 1.0.24 (via 1.0.22, 1.0.23)
• Source: https://www.npmjs.com/package/`@github/copilot`

CLI Changes (from help diff)

New flags added in 1.0.24 vs 1.0.21:

• --mode <mode>: Set the initial agent mode (choices: "interactive", "plan", "autopilot")
• --plan: Start in plan mode
• --autopilot description updated: "Start in autopilot mode" (was "Enable autopilot continuation in prompt mode")

View Subcommand Changes

From cached help outputs (1.0.21 → 1.0.24):

• New --mode flag provides explicit mode selection at startup
• New --plan flag as shorthand for plan mode
• --autopilot behavior/description clarified

Note: Copilot CLI repository is private; detailed changelog not publicly available.

Impact Assessment

• Risk: Low
• New --mode / --plan flags are additive; existing --autopilot behavior unchanged
• Verify CopilotNoAskUserMinVersion (1.0.19) still satisfied ✓

---

Update Codex 0.118.0 → 0.120.0

• Version: 0.118.0 → 0.120.0 (via 0.119.0)
• Source: https://www.npmjs.com/package/`@openai/codex`
• Release Notes: https://github.com/openai/codex/releases/tag/rust-v0.120.0

View 0.120.0 Highlights (from GitHub)

New Features

• Realtime V2 can now stream background agent progress while work is still running and queue follow-up responses (Stream Realtime V2 background agent progress openai/codex#17264, Queue Realtime V2 response.create while active openai/codex#17306)
• Hook activity in the TUI is easier to scan, with live running hooks shown separately ([codex] Improve hook status rendering openai/codex#17266)
• Custom TUI status lines can include the renamed thread title (Add thread title to configurable TUI status line openai/codex#17187)
• Code-mode tool declarations now include MCP outputSchema details (Add output_schema to code mode render openai/codex#17210)
• SessionStart hooks can distinguish sessions created by /clear from fresh startup or resume sessions (Support clear SessionStart source openai/codex#17073)

Bug Fixes

• Fixed Windows elevated sandbox handling for split filesystem policies (fix: support split carveouts in windows elevated sandbox openai/codex#14568)
• Fixed sandbox permission handling for symlinked writable roots and carveouts (fix(permissions): fix symlinked writable roots in sandbox permissions openai/codex#15981)
• Fixed codex --remote wss://... panics by installing the Rustls crypto provider before TLS websocket connections (Install rustls provider for remote websocket client openai/codex#17288)
• Preserved tool search result ordering instead of alphabetically reordering results (preserve search results order in tool_search_output openai/codex#17263)

Full changelog: openai/codex@rust-v0.119.0...rust-v0.120.0

View 0.119.0 Highlights (from GitHub)

New Features

• Realtime voice sessions now default to the v2 WebRTC path with configurable transport and native TUI media support (Add WebRTC transport to realtime start openai/codex#16960)
• MCP Apps gained richer support including resource reads, tool-call metadata, custom-server tool search, and server-driven elicitations ([mcp] Support MCP Apps part 1. openai/codex#16082)
• Remote/app-server workflows support egress websocket transport, remote --cd forwarding, and an experimental codex exec-server subcommand (Add top-level exec-server subcommand openai/codex#17162)
• TUI can copy the latest agent response with Ctrl+O (feat(tui): Ctrl+O copy hotkey and harden copy-as-markdown behavior openai/codex#16966)
• /resume can now jump directly to a session by ID or name from the TUI (feat: /resume per ID/name openai/codex#17222)

Full changelog: openai/codex@rust-v0.118.0...rust-v0.119.0

Impact Assessment

• Risk: Low–Medium
• Major new features (WebRTC realtime, MCP Apps) are additive
• codex exec-server is a new experimental subcommand (no impact on existing workflows)
• Websocket/remote transport improvements may affect remote session reliability

---

Update MCP Gateway v0.2.17 → v0.2.18

• Version: v0.2.17 → v0.2.18 (released 2026-04-12)
• Docker: ghcr.io/github/gh-aw-mcpg:v0.2.18
• Release Notes: https://github.com/github/gh-aw-mcpg/releases/tag/v0.2.18

Key Changes

New Features

• Maintainer reaction endorsement for integrity promotion/demotion (feat: Maintainer reaction endorsement for integrity promotion/demotion gh-aw-mcpg#3666): Fine-grained DIFC labeling control via reactions
• Wildcard ["*"] support in allowed-tools filtering (Support wildcard ["*"] in allowed-tools filtering gh-aw-mcpg#3445): Simplifies permissive backend configs
• OIDC fail-fast validation for TOML configs (Add OIDC fail-fast validation to TOML config path gh-aw-mcpg#3538): Misconfiguration caught at startup
• DIFC labeling for create_pull_request_with_copilot (Add DIFC labeling rule for create_pull_request_with_copilot gh-aw-mcpg#3651)
• Expanded guard coverage for 3 CLI write operations (Add pre-emptive guard entries for 3 CLI write operations missing from WRITE_OPERATIONS gh-aw-mcpg#3609)

Bug Fixes

• Gateway timeout defaults aligned with spec §4.1.3 (fix: align gateway timeout defaults with spec §4.1.3 gh-aw-mcpg#3592)
• HTTP connection errors now visible to operators via stderr (Fix: log HTTP connection errors to stderr for operator visibility gh-aw-mcpg#3514)
• WriteJSONResponse trailing newline eliminated (fix: use json.Marshal in WriteJSONResponse to avoid trailing newline gh-aw-mcpg#3466)
• gojq module security & compatibility fixes (fix: gojq module review — permissions, collision, rename, upgrade gh-aw-mcpg#3451)
• go-sdk upgraded to v1.5.0 (chore: upgrade go-sdk to v1.5.0 and address go-fan review items gh-aw-mcpg#3610)

Impact Assessment

• Risk: Low
• Security hardening (DIFC, OIDC, guard coverage) are improvements
• allowed-tools: ["*"] wildcard is a new config feature; no existing config affected
• Timeout default alignment may change behavior for workflows near the old defaults

---

References:

• §24325688300

Generated by CLI Version Checker · ● 322.9K · ◷

• expires on Apr 15, 2026, 4:35 AM UTC

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot coding agent.

The Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · ● 176K · ◷

[authora-aria]

Since this touches pkg/constants/version_constants.go and regenerated locks, it’d be worth adding a tiny CI guard that verifies the constants and lockfile contents don’t drift on the next bump. Version-only PRs are easy to merge with stale generated state if make recompile isn’t run from a clean tree.

A simple pattern is: fail CI if git diff --exit-code changes after make recompile, and optionally assert each binary reports the pinned version in a smoke test. That catches cases where a CLI starts returning a different semver format or an MCP package rename slips through. For MCP-specific updates, it’s also useful to run a quick spec/security scan against the upgraded server endpoints before release: https://tools.authora.dev