Radar brief — 2026-10-27

What the evidence shows

Versioned GitHub-style releases first. Several changelogs omit dozens of lines (bodyOmitted); those extra items are not inferred here.

Copilot product changelog (not a GitHub tag): Assisted permissions GA in Copilot CLI, Copilot app, and VS Code — an LLM classifies command/path/URL permission requests; “clearly safe” auto-proceeds, else you approve. Enterprise settings can block Allow All, disable Assisted, and set the default mode. Separate post: GPT-6.1 Terra GA for Copilot Pro through Enterprise, billed at provider list pricing under usage-based billing, gradual rollout; Business/Enterprise admins gate it via model policy.

Still relevant from earlier this window (not in the last 36 hours): Mistral Vibe v3.0.0 — compaction-threshold reporting, /branch, admin enable_mcp kill switch, Lean agent install commands. Treat v3.0.3 as the patch on that surface.

Noisy / thin: Qwen Code sdk-typescript-v0.1.23 is a bundled-CLI version dump, not a product changelog. OpenAI Codex rust-v0.166.0-alpha.1 and rust-v0.165.0-alpha.1.2 have empty notes. Augment v1.2.0-prerelease.202610261519 is install/SEA packaging. Sourcegraph’s Oct 26 entry is only “See what changed.” One tracked source reported errors; weight GitHub tags over those HTML pages (trusted mix this brief: 54% GitHub/changelog vs HTML).

For developers

• Cline: Pin both Local and Cloud models before the next task. If you relied on a provider default, you are on a different model (ClinePass → Kimi K3.1 Pro; empty Cline provider → Claude Sonnet 5.5). Gemini gemini keys: do not expect native Google Search; free-tier 429s on Gemini 3+ were the stated reason. Desktop: use the Changes pane and project files tree to review agent edits instead of hunting diffs. CLI: reopen a live task to attach, not duplicate.
• Mistral Vibe 3.0.3: Drop the /reload habit for on-disk skills. Set outside_workdir = "deny" if you want a hard sandbox error instead of a prompt. Run vibe config schema and consider strict_config = true so misspelt keys fail closed.
• Claude Code 2.1.311: Upgrade if startup/edit freezes, interrupts that wait out MCP/skill I/O, or the 200K-token “1M context” credit stop were in your way. Self-hosted runner hosts that leave processes behind can hold the idle session with the new flags.
• Copilot CLI 1.0.104: /permissions → assisted. Fusion sessions start on Auto. Do not assume COPILOT_TASK_WAIT_TIMEOUT_SECONDS still kills interactive/SDK Autopilot waits.
• Windsurf 3.11.228: In Remote-SSH/WSL, re-check the Agent Window folder picker — it should no longer offer local folders or open local file links.
• Kilo Code 7.8.18: Update for the VS Code 1.143 copy fix and the vite CVE. If you talk to hosted sessions through the local API, confirm you actually want editors reaching those sessions without provider credentials.
• Kimi Code 2.3.3: A swarm reject with swarm mode off is not a failed swarm; look for the /swarm hint and the new usage warning.

For teams

• Cline orgs: Treat v4.1.26 as a fleet default-model change. Pin Local and Cloud models in policy or docs (open proposal: Pin Local and Cloud models after Cline v4.1.26). Cloud sessions hide Plan/Act and the auto-approve bar — do not train reviewers to look there. CLI attach-to-running-task reduces duplicate spend and unstoppable twins.
• GitHub Copilot admins: Assisted Permissions is GA — decide whether to block Allow All, disable Assisted, and what default mode new sessions get. Gate GPT-6.1 Terra in model policy; new models auto-enable unless you turned off default enablement. Vendor “solved more tasks” language is a Copilot blog claim, not independent evidence.
• Windsurf: The Devin for Cloud team setting is gone. Cloud access now follows the account in IDE mode the same way as the Agent Window — audit who actually has Cloud access.
• Mistral Vibe: v3.0.0’s admin enable_mcp still matters if you need to block add/remove/login and plugin MCP. v3.0.3’s outside_workdir = "deny" and strict_config are the enforcement knobs for individual agents.
• Factory Droid: Slack will open a channel only for a new code change Droid writes; otherwise it stays in-thread. Update incident/review routing.
• Kilo: Hosted session access via the local API without credentials is a trust-boundary change — review who can bind an editor to a hosted session.

What to ignore

• Empty Codex alpha tags and the Sourcegraph one-liner — no actionable evidence.

• Augment prerelease install/SEA notes and the Qwen TypeScript SDK’s stacked “bundles CLI version …” list.

• Any “+N more changes” tail. Those lines were omitted from the evidence pack.

• Copilot blog comparison of Terra vs older Terra on terminal/C# tasks until a versioned changelog or independent run says the same.

• Ranking tags (mustKnow, scores) are not facts; the release text is.

Watch next

• Fallout from Cline’s unpinned-default swap and whether cloud vs local model drift shows up in reviews.
• Copilot Terra actually appearing in pickers (changelog says gradual) and how Assisted Permissions behaves under enterprise defaults.
• Whether Codex 0.166.0-alpha.1 grows real notes, and whether Vibe’s omitted 76 v3.0.3 items include further permission/MCP breaks.
• Open proposals: Cline pin (P4, everyone); Qwen daemon --save-token (P5, team); Codex /presets for team slash commands (P5, team).

How to use DevAgentRadar

This brief is a public cut of the radar: what shipped, in which version, with enough impact to change how you run the tool — not a vendor roundup. Prefer the GitHub tag over the blog. isNew means the signal hit the radar in the last 36 hours; mustKnow is only a ranking hint that the change likely hits daily users of that assistant. If a body is omitted, do not assume the missing bullets. Use For developers for personal config/upgrade actions and For teams for policy, defaults, and fleet pins. Ignore empty tags and marketing comparisons. Recheck tomorrow; alphas and catalog swaps move faster than docs.

Evidence appendix

• New in the last 36 hours: 17 release(s) from 13 tool(s)
• Evidence window: new releases first, then top curated signals (versioned releases preferred)
• Assistants tracked: 29
• Signals in this brief: 40
• Trusted source mix (GitHub/changelog vs HTML): 54%
• Open improvement proposals: 5
• Sources reporting errors: 1

High-signal releases used

• Mistral Vibe v3.0.3: Skills added or edited on disk are picked up by running sessions without /reload · The footer shows the active model and its thinking level next to the token — source

• Claude Code v2.1.311: Added --hold-idle-file and --max-hold-min to self-hosted-runner, to keep an idle session while your host reports processes it left running · Added a tip f — source

• GitHub Copilot CLI v1.0.104: 2026-10-27 · Managed model "fusion" now starts sessions on Auto and applies fusionTier settings · Interactive and SDK Autopilot sessions keep waiting for attach — source

• Qwen Code sdk-typescript-v0.1.23: This SDK release bundles CLI version: 0.26.1 · Source: CLI built from source (same branch/ref as SDK) · --- · This SDK release bundles CLI version: 0.26.0 · Sou — source

• Cline v4.1.26: Cloud tasks: Settings > API Configuration has a Local | Cloud toggle when cloud sessions are on. · Cloud picks the Cline model new cloud tasks run on, saved sep — source

• Kimi Code @moonshot-ai/kimi-code@2.3.3: #4414 f36c127 — source

• Cline desktop-v0.0.49: A new Changes button in the session header shows the session's line counts and opens a pane listing the files changed in the last turn or across the whole s — source

• Kilo Code v7.8.18 — (release): #15472 9d28e36 - Fi — source

• Cline cli-v3.0.74: Opening a task that's already running in another Cline app now attaches to that run instead of starting a second one that couldn't be stopped. · If an app close — source

• Factory Droid v0.250.0 — · Desktop v0.207.0 (October 27, 2026): Collapsible long messages, pull request state on sessions, Slack fixes, and CLI and app fixes · Long message collapsing - A long message you sent now starts — source

• Augment Code v1.2.0-prerelease.202610261519 — auggie-v2 v1.2.0-prerelease.202610261519: Install the latest release (macOS/Linux): · curl -fsSL https://github.com/augmentcode/auggie/releases/latest/download/install.sh | bash · Install a specific ver — source

• OpenAI Codex CLI rust-v0.166.0-alpha.1 — alpha.1: Release 0.166.0-alpha.1 — source

• OpenAI Codex CLI rust-v0.165.0-alpha.1.2 — alpha.1.2: Release 0.165.0-alpha.1.2 — source

• Windsurf v3.11.228: v3.11.228 October 26, 2026 · In Remote-SSH and Remote-WSL windows, the Agent Window folder picker correctly sets the session’s working directory. · It lists the — source

Open proposals

• Persist Qwen daemon tokens with qwen daemon start --save-token (audience: team, P5)
• Save team slash commands in Codex /presets slots (audience: team, P5)
• Pin Local and Cloud models after Cline v4.1.26 catalog swap (audience: everyone, P4)
• Improve with xAI Grok CLI (Grok Build) c68e39f: Publish harness and TUI open-source (audience: everyone, P2)
• Improve with OpenCode pr-38252-videos: pr-38252-videos PR #38252 verification videos (audience: everyone, P2)