[ca] Update CLI tool versions: Claude Code, Copilot CLI, Codex, GitHub MCP Server #26803

The Copilot CLI repository is private. No detailed changelog available from GitHub. The npm package description is unchanged: "GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal."

10 patch releases were skipped (1.0.21 → 1.0.31). Manual smoke testing recommended per the existing comment:

• MCPs are not blocked from loading (tools.mcp configuration still works end-to-end)
• /models does not silently fail on PATs

Features

• Realtime voice sessions default to v2 WebRTC path with configurable transport, voice selection, native TUI media support
• MCP Apps and custom MCP servers: resource reads, tool-call metadata, custom-server tool search, server-driven elicitations, file-parameter uploads
• Remote/app-server workflows: egress websocket transport, remote --cd forwarding, runtime remote-control enablement, sandbox-aware filesystem APIs, experimental codex exec-server subcommand
• TUI: copy latest agent response with Ctrl+O; /resume can jump directly to a session by ID or name
• TUI notifications: Warp OSC 9 support, opt-in mode for notifications while terminal focused

Bug Fixes

• TUI starts faster (rate limits fetched asynchronously); /status refreshes stale limits
• Resume flows more stable (picker no longer flashes empty states, stabilized timestamps)
• MCP status and startup less noisy
• Sandbox/network/platform edge cases tightened

Full Changelog: openai/codex@rust-v0.118.0...rust-v0.119.0

Features

• Realtime V2 can stream background agent progress while work is running, queue follow-up responses
• Hook activity in TUI: live running hooks shown separately, completed hook output kept only when useful
• Custom TUI status lines can include renamed thread title
• Code-mode tool declarations include MCP outputSchema for typed structured results
• SessionStart hooks can distinguish /clear sessions from fresh startup or resume sessions

Bug Fixes

• Fixed Windows elevated sandbox handling for split filesystem policies
• Fixed sandbox permission handling for symlinked writable roots
• Fixed codex --remote wss://... panics (Rustls crypto provider)
• Preserved tool search result ordering (no more alphabetical reorder)
• Fixed live Stop-hook prompts appearing immediately

Full Changelog: openai/codex@rust-v0.119.0...rust-v0.120.0

Features

• codex marketplace add — install plugin marketplaces from GitHub, git URLs, local directories, or direct marketplace.json URLs (Add marketplace command openai/codex#17087, [codex] Refactor marketplace add into shared core flow openai/codex#17717, [codex] Support local marketplace sources openai/codex#17756)
• TUI prompt history: Ctrl+R reverse search and local recall for accepted slash commands (feat(tui): add reverse history search to composer openai/codex#17550, fix(tui): recall accepted slash commands locally openai/codex#17336)
• TUI and app-server controls for memory mode, memory reset/deletion, memory-extension cleanup (feat: memories menu openai/codex#17632, feat: disable memory endpoint openai/codex#17626, feat: add endpoint to delete memories openai/codex#17913)
• MCP/plugin: MCP Apps tool calls, namespaced MCP registration, parallel-call opt-in, sandbox-state metadata ([mcp] Support MCP Apps part 3 - Add mcp tool call support. openai/codex#17364, register all mcp tools with namespace openai/codex#17404, Add supports_parallel_tool_calls flag to included mcps openai/codex#17667)
• Secure devcontainer profile with bubblewrap support; macOS sandbox allowlists for Unix sockets (feat(devcontainer): add separate secure customer profile openai/codex#10431, Support Unix socket allowlists in macOS sandbox openai/codex#17654)

Bug Fixes

• Fixed macOS sandbox private DNS handling; removed danger-full-access denylist-only mode (fix: unblock private DNS in macOS sandbox openai/codex#17370, fix: Revert danger-full-access denylist-only mode openai/codex#17732)
• Fixed Windows cwd/session matching for verbatim paths (Fix thread/list cwd filtering for Windows verbatim paths openai/codex#17414)
• Guardian timeouts now distinct from policy denials with timeout-specific guidance (representing guardian review timeouts in protocol types openai/codex#17381, changing decision semantics after guardian timeout openai/codex#17486)
• Fixed MCP flattened deferred tool names, elicitation timeout accounting, empty namespace descriptions ([codex] Support flattened deferred MCP tool calls openai/codex#17556, fix(mcp) pause timer for elicitations openai/codex#17566, Fix empty tool descriptions openai/codex#17946)

Full Changelog: openai/codex@rust-v0.120.0...rust-v0.121.0

Features

• Resolve review threads (Feat/resolve review threads github-mcp-server#1919)
• Configurable server name and title via translation strings (Add configurable server name and title via translation strings github-mcp-server#2159)
• list_commits gains path, since, and until parameters (Add path, since and until to list_commits github-mcp-server#2260)
• Initial OSS logging adapter for HTTP (Initial OSS logging adapter for http github-mcp-server#2008)
• Granular PRs and issues toolsets (OSS granular PRs and issues toolsets github-mcp-server#2306)
• --exclude-tools flag to shut off specific tools (Add --exclude-tools (and X-MCP-Exclude-Tools) flag to enable shutting off tools as part of server configuration github-mcp-server#2036)
• HTTP: enforce static CLI flags as upper bound for per-request filtering (feat(http): enforce static CLI flags as upper bound for per-request filtering github-mcp-server#2208)
• ProjectV2 status update tools: list, get, create (Add ProjectV2 status update tools (list, get, create) github-mcp-server#1987)

Bug Fixes

• Fixed SHA validation in create_or_update_file (Fix SHA validation in create_or_update_file github-mcp-server#2134)
• Handle empty files in get_file_contents (fix: Handle empty files in get_file_contents github-mcp-server#2042)
• Fixed panic when fetching resources fails due to network error (Fix panic when fetching resources fails due to network error github-mcp-server#1506)

Full Changelog: github/github-mcp-server@v0.32.0...v0.33.0

New Features

• set_issue_fields tool — set, update, or delete organization-level custom field values on issues (feature-flagged under issues_granular) (Add granular tool to set issue field values github-mcp-server#2338)
• MCP Apps feature flag — remote_mcp_ui_apps feature flag replaces insiders-only mode; rolling out to more users (Migrate MCP Apps support from insiders mode to feature flag with insiders opt-in github-mcp-server#2335)
• X-MCP-Features header validation — HeaderAllowedFeatureFlags for HTTP feature flag control (feat(http): implement HeaderAllowedFeatureFlags for X-MCP-Features header validation github-mcp-server#2332)
• MCP Go SDK upgraded to v1.5.0 (deps: upgrade modelcontextprotocol/go-sdk to v1.5.0 github-mcp-server#2336)

Full Changelog: github/github-mcp-server@v0.33.1...v1.0.0