Radar brief — 2026-11-03
Kiro CLI 2.37.0 now auto-upgrades V2 agents to V3 when a V3 session starts (opt-out only) — today’s must-know. In the same 36 hours: Claude Code v2.1.317 adds email-exfil prompts and fail-closed Agent SDK hooks; Copilot CLI v1.0.106-6 stops user-only MCP content from reaching th…
What the evidence shows
New GitHub/changelog signals first. mustKnow is a ranking hint; the facts below are from the releases themselves. Several notes have omitted bodies — those extra changes are not inferred here. One tracked source reported errors; treat HTML changelogs as noisier than tagged GitHub releases (trusted mix this brief: 54% GitHub/changelog vs HTML).
Last 36 hours (versioned)
chat.enableAutoAgentUpgrade is false. Rewrites workspace/global (or KIRO_AGENT_CONFIG_DIR) agent files in place after a .json.bak. ACP clients that declare terminal auth can kiro-cli login from a terminal. Mermaid shapes/nested subgraphs; KIRO_RUNTIME_DIR./schedule warns if a cloud task gets unrequested connectors. Web/shell tools prompt before sending your account email. Agent SDK hooks gain onFailure: "block". Desktop Code tab notices for remote managed settings. MCP disconnect-after-first-turn fix. Cost API GET /v1/organizations/analytics/cost. CLAUDE_CODE_DISABLE_NESTED_SESSION_ID=1 restores nested claude -p session IDs. +89 omitted.experimental.unifiedAgentLoop covers more ACP turns. +53 omitted./settings is a unified searchable dashboard. User-addressed MCP content is not sent to the model; images render inline. Failed tool calls expand full errors. Over-limit turns no longer rerun the same tools. MCP connect warnings sanitize escape sequences. +22 omitted.-sea unsigned; Linux publishes SHA256SUMS-sea. No product changelog in the tag body.Last 36 hours (unversioned HTML)
Still relevant this week (not in the 36-hour window)
codex queue --resume; GPT-6.1 Terra in bundled / Vertex / Bedrock catalogs; keyboard transcript selection; codex doctor --network-only; clearer safety-block follow-ups. +132 omitted./presets; inline /model and /permissions; Kitty/Sixel image preview; enterprise MCP auth; mask credentials in remote Bash/Zsh snapshots. +131 omitted./branch; admin-enforceable enable_mcp blocks all user MCP ops including plugin servers. /leanstall Lean agent. +85 omitted./proxy-setup; enable_background_processes = false and enable_subagents = false. +75 omitted.<pluginId>:<skillName> only; bare names no longer invoke. Model-switch confirm (cloud-gated). Remote-control payload limit 10→100 MiB. +19 omitted.For developers
- Kiro 2.37.x: Before the next V3 launch, decide whether auto-migration is acceptable. Files are rewritten in place (
.json.bakfirst). To stay on V2:kiro-cli settings chat.enableAutoAgentUpgrade false. Prefer 2.37.1 for the output-limit notice, idle-CPU fix, and session persistence across CLI upgrades. SetKIRO_RUNTIME_DIRonly if you need a non-bundled runtime. - Claude Code v2.1.317: Expect a prompt when a web/shell tool would send your account email. If you author Agent SDK hooks, set
onFailure: "block"so a failed callback cannot let the action through. Self-hosted runners that nestclaude -pshould setCLAUDE_CODE_DISABLE_NESTED_SESSION_ID=1if they need the old session/transcript ID behavior. Check/scheduleconnector warnings before leaving cloud tasks running. - Copilot CLI v1.0.106-6 (prerelease): Use
/settingssearch. Confirm MCP servers that return user-only images/text — that payload should stay in the TUI, not the model. Failed tool rows now expand; over-budget turns should error instead of looping. - Qwen Code v0.26.6: Web Shell activity/split-view/token plots are the usable delta. Leave
experimental.unifiedAgentLoopoff unless you want more ACP turns (channel prompts, Goal-proposal approvals) on the shared loop. - Kimi Code 2.3.0: Update any skill invocation or docs that used a bare plugin skill name. On model switch mid-thread, choose new session / compact / continue / cancel when the cloud-gated dialog appears.
- Mistral Vibe: If you are on the 3.x line, learn
/branch, compaction-threshold UI, and/leanstall. If you need MCP, check thatenable_mcpis not admin-disabled. 2.26.1 still matters for/proxy-setupand the background/subagent kill switches. - Codex (0.166.0, not the empty alpha): Try
codex queue --resumefor unloaded threads andcodex doctor --network-onlywhen connectivity is the question. GPT-6.1 Terra is in the bundled, Vertex, and Bedrock catalogs per that tag — pin it explicitly if you want it.
For teams
- Kiro: Treat 2.37.0 as a fleet event. Auto-upgrade will rewrite shared agent configs. Roll 2.37.1 after 2.37.0. Communicate the opt-out before people open V3 sessions. ACP terminal login is now a supported path for clients that declare it.
- Claude Code: Use the new gateway cost report (
GET /v1/organizations/analytics/cost) and the IdP-group daily records (retentionadmin.identity_retention_days). Watch Desktop Code-tab notices that remote managed settings failed to load — agents may be running without org policy. Fail-closed hooks (onFailure: "block") are the safer default for production SDK wrappers. - Copilot CLI: The MCP “user-only content stays off the model” change is a privacy control; pair it with the plain-text MCP error rendering (escape sequences can no longer restyle warnings). Still a prerelease tag.
- Sourcegraph Amp: MCP connectors on Agentic Batch Changes expand blast radius to issue trackers and internal docs. Gate which servers agents may call; the “keep chatting while workspaces run” change means the agent turn ends while execution continues — don’t assume the conversation lock equals job completion.
- Factory Droid v1.2.0: API-key revoke now confirms; org-policy timeout false positives are fixed. Remote reconnect-after-sleep reduces dropped agent turns, not policy coverage.
- Mistral Vibe v3.0.0:
enable_mcpis an admin kill switch for add/remove/toggle/login/tool registration, including plugin MCP. Decide the org default before developers hit/mcp. - JetBrains Air Governance livestream is not a ship; do not treat it as a version you can pin.
What to ignore
- OpenAI Codex
rust-v0.167.0-alpha.4: empty body. Do not plan around it. - Augment Code prerelease tag: installer/SEA packaging only; macOS
-seais unsigned in the notes. - Qwen
sdk-typescript-v0.1.27changelog bulk: mostly historical “bundles CLI version …” lines, not new SDK behavior. - JetBrains AI blog post: livestream + mixed posts; omitted body. Not evidence of a product change you can deploy.
- Omitted tails (
+89,+132,+85, …): do not assume hidden breaking changes or features. - Internal scores /
mustKnow: ranking hints, not facts. Cite the release, not the judge. - One source in this window reported errors — if a changelog page disagrees with a GitHub tag, prefer the tag.
Watch next
- Codex 0.167.0 proper notes after alpha.4.
- Kiro V2 file rewrites: backup noise, broken custom agents, and how many people set
chat.enableAutoAgentUpgrade false. - Claude Code hook authors adopting
onFailure: "block", plus whether the email prompt and/scheduleconnector warning show up in real cloud tasks. - Qwen
experimental.unifiedAgentLoopleaving experimental. - Mistral Vibe 3.x
enable_mcpdefaults in managed config. - Kimi qualified skill names breaking plugins that still call bare names.
- Open proposals on the radar: Codex
queue --resume/ GPT-6.1 Terra (developer, P5); Crush thinking/hooks (P4); Cline v4.1.26 model pin (P4); Grok CLI harness (P2); OpenCode PR #38252 videos (P2).
How to use DevAgentRadar
This brief is evidence, not a vendor recap. Use it to decide what to install, pin, or postpone today. Prefer versioned GitHub tags over blogs. If a row has bodyOmitted, read the upstream release before you change production. Developers: apply the concrete flags and breaking names above. Teams: treat auto-migration, MCP connectors, fail-closed hooks, and cost/policy APIs as org changes, not client cosmetics. Re-check the radar after the next 36-hour window — alphas and omitted tails are where the next surprise usually is.
Evidence appendix
- New in the last 36 hours: 13 release(s) from 9 tool(s)
- Evidence window: new releases first, then top curated signals (versioned releases preferred)
- Assistants tracked: 29
- Signals in this brief: 40
- Trusted source mix (GitHub/changelog vs HTML): 54%
- Open improvement proposals: 5
- Sources reporting errors: 1
High-signal releases used
- Claude Code
v2.1.317: Added a warning to/schedulewhen a new cloud scheduled task gets connectors you did not ask for, with how to remove them · Added a check that asks before a w — source - Qwen Code
v0.26.6: See the complete change list below. · No known breaking changes. · Adds a Web Shell sidebar activity view for trusted workspace conversations, showing approva — source - Qwen Code
sdk-typescript-v0.1.27: This SDK release bundles CLI version: 0.26.6 · Source: CLI built from source (same branch/ref as SDK) · --- · This SDK release bundles CLI version: 0.26.4 · Sou — source - GitHub Copilot CLI
v1.0.106-6: Added · Make /settings open the unified dashboard for all users and add global search across settings and local resources. · Interactive CLI reports program — source - Augment Code
v1.2.0-prerelease.202611021510— auggie-v2 v1.2.0-prerelease.202611021510: Install the latest release (macOS/Linux): · curl -fsSL https://github.com/augmentcode/auggie/releases/latest/download/install.sh | bash · Install a specific ver — source - OpenAI Codex CLI
rust-v0.167.0-alpha.4— alpha.4: Release 0.167.0-alpha.4 — source - Kiro
2.37.0— Automatic V2 Agent Upgrades and ACP Sign-In: October 30, 2026 Automatic V2 Agent Upgrades and ACP Sign-In · 2.37.0 · This release turns on automatic V2 agent upgrades by default when a V3 session starts an — source - Kiro
2.37.1— Oct 31, 2026: 2.37.1 | Oct 31, 2026 · Startup notices, agent welcome lines, and What's new now separate titles from details. · The V3 welcome screen groups its docs link and — source - Factory Droid
v1.2.0— · Desktop v1.2.0 (November 3, 2026): Settings search fixes, safer API key actions, screen reader labels, and sturdier desktop windows · Exec startup with many tools - Starting a non-interactive — source - Sourcegraph Amp / Cody lineage — Connect Agentic Batch Changes to the outside world: Bring MCP servers to Agentic Batch Changes with connectors. · Agents need more than code to get the full picture. · Issue trackers and internal documentation li — source
- Sourcegraph Amp / Cody lineage — Keep chatting while workspaces run: Ask follow-up questions in Agentic Batch Changes while workspace runs continue in the background. · You can now keep talking to Agentic Batch Changes while the — source
- Sourcegraph Amp / Cody lineage — See the whole conversation at a glance: Jump around long agent conversations from a single card that lists every message and question in the thread. · Long conversations in Agentic Batch Changes and D — source
- JetBrains AI Assistant — Livestream: Scaling Agentic Development With Air Governance: Join our livestream on November 18 to see how Air Governance helps you manage AI agents, access, and spend across your organization. · Setting coding agents up — source
- OpenAI Codex CLI
rust-v0.166.0: Added keyboard-driven transcript selection with word, line, and page motions, integrated search, and configurable shortcuts. (#57221, #57222, #57223, #57224) · — source
Open proposals
- Resume unloaded Codex threads with
codex queue --resumeand select GPT-6.1 Terra (audience: developer, P5) - Re-add Crush models with --thinking and subscribe hooks to session, turn, and permission e (audience: developer, P4)
- Pin Local and Cloud models after Cline v4.1.26 catalog swap (audience: everyone, P4)
- Improve with xAI Grok CLI (Grok Build) c68e39f: Publish harness and TUI open-source (audience: everyone, P2)
- Improve with OpenCode pr-38252-videos: pr-38252-videos PR #38252 verification videos (audience: everyone, P2)
Anonymous · one vote per visitor · re-click to clear. Helps improve digests—not a product ranking.