[WIP] Update CLI tools to latest versions

[Copilot]

Investigation: www.npmjs.com blocked despite being in 'node' ecosystem

Problem

• User comment: "/q investigate why www.nmpjs.org was blocked" (note: typo - should be npmjs.com)
• Workflow run #18802153054 shows www.npmjs.com was blocked by network permissions
• The workflow has network: allowed: [defaults, node, "api.github.com", "ghcr.io"]
• The node ecosystem in pkg/workflow/data/ecosystem_domains.json includes www.npmjs.com (line 144)

Plan

• Analyze workflow run logs to confirm the blocking
• Check how network permissions are generated for Claude Code engine
• Verify domain expansion logic in domains.go
• Test if www.npmjs.com is properly included when "node" ecosystem is specified
• Identify root cause of blocking
• Fix the issue
• Add tests to prevent regression
• Validate fix

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[ca] Update CLI Tools: Claude Code 2.0.27, Copilot CLI 0.0.351, Codex 0.49.0</issue_title>
<issue_description># CLI Tools Version Update - October 25, 2025

This issue documents the version updates for three agentic CLI tools used in gh-aw workflows.

Summary

Three CLI tools have been updated to their latest versions:

• Claude Code: 2.0.26 → 2.0.27
• Copilot CLI: 0.0.350 → 0.0.351
• Codex: 0.48.0 → 0.49.0
• GitHub MCP Server: v0.19.1 (No change)

Update Details

1. Claude Code (@anthropic-ai/claude-code)

Version: 2.0.26 → 2.0.27

Release Timeline:

• 2.0.26: Published October 23, 2025 at 22:43:25 UTC
• 2.0.27: Published October 24, 2025 at 19:50:51 UTC
• Time between releases: ~21 hours

Changes:

• Breaking Changes: None detected
• New Features: No public changelog available
• Bug Fixes: Likely includes bug fixes and stability improvements (typical for patch releases)
• Security: None announced
• Performance: Unknown

CLI Discovery: No changes detected in --help output between versions 2.0.26 and 2.0.27

• No new commands added
• No new flags or options
• No removed features

Impact Assessment:

• Risk Level: Low
• Affected Features: All Claude Code-based workflows in gh-aw
• Migration Required: No - patch version upgrade with no breaking changes

Additional Information:

• Homepage: https://github.com/anthropics/claude-code
• Package: (redacted)
• Description: "Use Claude, Anthropic's AI assistant, right from your terminal"

---

2. GitHub Copilot CLI (@github/copilot)

Version: 0.0.350 → 0.0.351

Release Timeline:

• 0.0.350: Published October 24, 2025 at 00:32:11 UTC
• 0.0.351: Published October 24, 2025 at 22:45:30 UTC
• Time between releases: ~22 hours

Changes:

• Breaking Changes: None detected
• New Features: No public changelog available
• Bug Fixes: Likely includes bug fixes and improvements (typical for incremental releases)
• Security: None announced
• Performance: Unknown

CLI Discovery: No changes detected in --help output between versions 0.0.350 and 0.0.351

• No new commands added
• No new flags or options
• No removed features

Impact Assessment:

• Risk Level: Low
• Affected Features: All Copilot CLI-based workflows in gh-aw
• Migration Required: No - incremental version with no breaking changes

Additional Information:

• Homepage: https://github.com/github/copilot-cli/#readme
• Repository: https://github.com/github/copilot-cli.git
• Package: (redacted)
• Description: "GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal"

---

3. OpenAI Codex (@openai/codex)

Version: 0.48.0 → 0.49.0

Release Timeline:

• 0.48.0: Published October 23, 2025 at 23:48:47 UTC
• 0.49.0: Published October 24, 2025 at 18:59:44 UTC
• Time between releases: ~19 hours

Changes:

• Breaking Changes: None detected (minor version bump could include new features)
• New Features: Possible - minor version increment suggests potential feature additions
• Bug Fixes: Likely includes bug fixes
• Security: None announced
• Performance: Unknown

CLI Discovery: No changes detected in --help output between versions 0.48.0 and 0.49.0

• No new commands added
• No new flags or options
• No removed features

Impact Assessment:

• Risk Level: Low
• Affected Features: All Codex-based workflows in gh-aw (experimental)
• Migration Required: No - minor version upgrade with backward compatibility expected

Additional Information:

• Homepage: https://github.com/openai/codex#readme
• Repository: https://github.com/openai/codex.git (codex-cli directory)
• Package: (redacted)
• Install: npm i -g @openai/codex`` or brew install --cask codex

---

Implementation Status

✅ Completed Actions:

1. Updated pkg/constants/constants.go with new version numbers
2. Ran make recompile to update all workflows
3. Verified all 121 workflow files compiled successfully (56 in .github/workflows + 65 in pkg/cli/workflows)
4. CLI help outputs compared - no changes detected in any tool
5. Help outputs cached in /tmp/gh-aw/cache-memory/ for future reference

Files Modified:

• pkg/constants/constants.go - Version constants updated
• 53 .lock.yml workflow files in .github/workflows/ - Recompiled with new versions
• All workflow compilations successful: 0 errors, 48 warnings

Validation Results:

• ✅ All workflows compiled without errors
• ✅ No new warnings introduced
• ✅ CLI help outputs identical (no breaking changes)
• ✅ Cached help outputs for future comparisons

---

Release Frequency Analysis

All three tools released updates within a 24-hour window (October 23-24, 2025), suggesting:

• Active maintenance and development
• Potential coordination or common infrastructure updates
• Regular release cadence (too...

• Fixes [ca] Update CLI Tools: Claude Code 2.0.27, Copilot CLI 0.0.351, Codex 0.49.0 #2404

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.