Radar brief — 2026-09-22

What the evidence shows

Fifteen curated signals across 23 tracked assistants. About half the mix is versioned GitHub/changelogs; the rest is HTML docs pages, including one source that reported errors. Treat Windsurf, Kiro, Tabnine, and Factory copy as noisier than GitHub tags. Several GitHub notes omit dozens of extra commits (bodyOmitted) — those are not assessed here.

Versioned GitHub-style releases (preferred)

HTML changelogs (noisier; one error-reporting source in the mix)

Seven open improvement proposals sit on this radar (two P5: Goose Desktop ACP routing; Windsurf CVE patch).

For developers

• Claude Code: Upgrade to v2.1.277 if you hit empty-text failures, hung -p/SDK sessions, or surprise logouts from an IDE-bundled older CLI. Add AGENTS.md only as the fallback when you have no CLAUDE.md; do not expect it on Bedrock/Vertex/Foundry yet.
• Codex CLI: Take rust-v0.154.0 then rust-v0.155.0 together. Use /worktree when you want an isolated checkout; treat /voice as experimental. On a Mac, expect Touch ID on MCP. GPT-6-Astra is in the picker and Bedrock catalogs — select it explicitly if you do not want server defaults after a fork.
• Goose: After v1.51.0, auto-compact at 100% means off. If you pair a gateway, you now need the operator allowlist. Desktop ACP routing is the behavior change to verify (open P5 proposal).
• Zed (pre): In v1.21.0-pre, leave agent.prevent_idle_sleep on for long agent turns; SuperGrok and DeepSeek Flash 4.1 are the new Agent Panel model paths (open P4 proposal).
• Antigravity: Set excludeDefaultComponents: true on locked-down custom agents. Prefer --continue after a crash or subdirectory launch — that path was starting a new chat.
• Cline desktop: PR/CI in the composer needs gh signed in; Cline still will not push or file the PR. Install desktop-v0.0.27 if sign-in expiry produced stacked errors or sign-out bounced back.
• OpenCode: If you attach images on Bedrock, only Claude/Nova/Llama 4 hoist them after v1.18.32. Grok 4.7 is on Zen/Go.
• Kiro V3: Use /sessions and /config before assuming local files are the source of truth — cloud config can load into new local sessions without writing .kiro.

For teams

• Patch first: Windsurf v3.10.31 for CVE-2026-81376 (nested Restricted Mode bypass) — P5 team proposal. Tabnine v6.6.0 for CVE-2026-64642; also stop assuming team managers can invite Admins.
• Claude gateways: If the only egress is a forward proxy, set CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1 and use upstream headers: for the proxy you actually run. Do not roll AGENTS.md as an org standard on Bedrock/Vertex/Foundry yet.
• Codex in enterprise: Review Bedrock command-sourced AWS creds (cache + refresh), Windows shared daemon/updates, and MCP OAuth that now surfaces reconnect instead of silently replaying tools. Consider Touch ID for local MCP on Macs.
• Tabnine agent rollout: CLI is available to all customers; IDE beta stays off until an installation admin enables it and a team lead turns on Beta agent under Teams → Features (P4 team proposal). Use the new per-MCP-tool usage page to see what agents actually call.
• Goose / Factory MCP: Goose gateway pairing is allowlisted. Factory org allowlists now take hostname wildcards and autocomplete-to-permit — audit entries so one * does not widen MCP more than you intend. Factory Pro now includes managed computers with five hours/month.
• Kiro cloud sync: Decide whether “apply cloud configuration to local sessions” is allowed; it injects Steering, custom agents, Skills, Powers, and Hooks without writing local files.
• Cline: Desktop auth and secret-reimport bugs were real; require desktop-v0.0.27 before treating sign-out / SSO as reliable.

What to ignore

• The +86 / +131 / +147 omitted GitHub bullets — no evidence here for what they are.
• Zed Guild marketing, Factory wordmark/animation/onboarding-button notes, OpenCode contributor shout-outs.
• Kiro v2.21.3 as a separate story; it duplicates the v2.21.4 HTML.
• Windsurf’s bundled v3.10.23/v3.10.27 SSH/ACP/MCP notes if you are already deciding from v3.10.31 — except do not ignore the CVE on 3.10.31.
• Grok CLI prompt/MCP cleanup proposals in this brief’s proposal list: there is no Grok CLI release in the evidence JSON, so do not invent a ship.
• HTML changelogs as a whole when they conflict with GitHub tags. Trusted-source mix is 49%, and one source reported errors.

Watch next

• Whether AGENTS.md stays a Claude-only fallback or becomes the cross-tool instruction file.
• Codex worktrees and /voice leaving experimental; GPT-6-Astra availability beyond picker + Bedrock catalogs.
• Goose Desktop ACP state-machine (open P5, audience everyone).
• Windsurf nested-settings Restricted Mode class and Tabnine org-wide agent enablement.
• MCP allowlists, OAuth reconnect, and Touch ID spreading from Codex/Goose/Factory.
• Open P4 Grok CLI prompt/MCP cleanup items — only if a versioned Grok CLI signal appears.
• OpenCode PR #38252 verification videos (P2; low urgency).

How to use DevAgentRadar

This brief is a public cut of DevAgentRadar: 23 assistants tracked, 15 signals in-window, 7 open proposals. Prefer GitHub tags over HTML product blogs; if a note says bodyOmitted, do not guess the rest. Act on P5 security/behavior proposals first (Windsurf CVE, Goose ACP routing), then developer P4 item enablement (Zed models/sleep, Tabnine agent flags). Use the radar to choose upgrades and defaults from shipped evidence, not from launch copy.

Evidence appendix

• Evidence window: top curated signals (versioned releases preferred)
• Assistants tracked: 23
• Signals in this brief: 15
• Trusted source mix (GitHub/changelog vs HTML): 49%
• Open improvement proposals: 7
• Sources reporting errors: 1

High-signal releases used

• Claude Code v2.1.277: Added AGENTS.md support: in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead; change it under "Project instructions" in /config (not yet on Be — source

• OpenAI Codex CLI rust-v0.155.0: Added experimental /voice conversations with live transcripts and microphone controls on supported builds, enabled through /experimental. (#43581, #43651, # — source

• OpenAI Codex CLI rust-v0.154.0: GPT-6-Astra is now available in the model picker and Amazon Bedrock catalogs. (#42879, #42619) · Experimental worktree support lets you create isolated checkout — source

• Goose v1.51.0: Route Desktop to state-machine loop via ACP prompt meta #11247 · EUrouter as a declarative provider [#11619](h — source

• Zed AI v1.21.0-pre: This week's release includes faster rendering in syntax-highlighted files and Markdown code blocks, a language server command picker, and a setting that keeps y — source

• Cline desktop-v0.0.26: The composer now shows the current branch's GitHub pull request — PR number, merge status, changed-line totals, and CI checks. · Click through to open it in you — source

• Cline desktop-v0.0.27: An expired Cline sign-in now produces one actionable error instead of two dead ends. · A turn that fails before the runtime takes the prompt was reported twice — source

• Google Antigravity 1.2.1: Added support for excludeDefaultComponents: true in custom agent Markdown frontmatter, allowing custom agents to opt out of default prompt sections and built- — source

• Windsurf v3.10.31: v3.10.31 September 16, 2026 Devin Desktop Restricted Mode blocks restricted workspace settings written in nested object form, not just the dotted form (CVE-2026 — source

• OpenCode v1.18.32: Fixed Bedrock image attachments so they are only hoisted for Claude, Nova, and Llama 4 models. · Fixed Together AI streaming usage reporting. · **Thank you to 1 — source

• Kiro v2.21.4: 2.21.4 Sep 11, 2026 · 2.21.3 Sep 10, 2026 · 2.21.2 Sep 8, 2026 +1 more Session Dashboard, Configuration Panel, and Cloud Sync Browse and manage local and cloud — source

• Tabnine v6.6.0: v6.6.0 September 15, 2026 Features and Improvements Enterprise Agent: Tabnine CLI, powered by OpenCode : Now available to all customers. · One installer for mac — source

• Factory Droid v0.217.0 — · Desktop v0.174.0 (September 11, 2026): Browser shortcuts, smoother command animations, cleaner retries, and clearer organization controls · Smoother command animations - Long-running commands now — source

• Factory Droid v0.216.0 — · Desktop v0.173.0 (September 9, 2026): Managed computers on Pro, faster connector connection status, MCP allowlist wildcards, and steadier Gemini streams · Managed computers on Pro - The Pro plan — source

Open proposals

• Route Goose Desktop through the ACP state-machine loop after v1.51.0 (audience: everyone, P5)
• Install Windsurf v3.10.31 to close nested Restricted Mode bypass (CVE-2026-81376) (audience: team, P5)
• Enable prevent_idle_sleep, SuperGrok, and DeepSeek Flash 4.1 in Zed Agent Panel (audience: developer, P4)
• Enable Tabnine CLI and IDE Beta Agent under Teams > Features (audience: team, P4)
• Replace <output_efficiency> with <response_guidelines> in Grok CLI prompts (audience: developer, P4)
• Drop legacy managed MCP configs and shadowed platform skills in Grok CLI (audience: developer, P4)
• Improve with OpenCode pr-38252-videos: pr-38252-videos PR #38252 verification videos (audience: everyone, P2)