Bump CLI versions: Copilot 0.0.403, Codex 0.97.0, MCP Gateway v0.0.99

[Copilot]

Updates three agentic CLI tools to latest stable versions with security hardening, tool approval improvements, and OAuth discovery fixes.

Version Changes

GitHub Copilot CLI: 0.0.402 → 0.0.403

• Module isolation restricts usage to application bundle
• MCP servers now stop cleanly before updates
• Reasoning summaries enabled by default

OpenAI Codex: 0.94.0 → 0.97.0

• Session-scoped tool approvals with "allow and remember"
• Live skill hot-reloading without restart
• Thread-aware shell execution (CODEX_THREAD_ID)

MCP Gateway: v0.0.98 → v0.0.99

• OAuth discovery endpoint at /.well-known/oauth-authorization-server
• Support for Google Maps/Drive, Slack, Sentry, Brave Search MCP servers

Technical Changes

• Updated version constants in pkg/constants/constants.go
• Recompiled 58 workflow lock files to propagate new versions

All updates maintain backward compatibility.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[ca] Update CLI versions: Copilot 0.0.403, Codex 0.97.0, MCP Gateway v0.0.99</issue_title>
<issue_description>Three agentic CLI tools have new versions available with significant improvements across security, features, and stability.

Summary

• GitHub Copilot CLI: 0.0.402 → 0.0.403 (published 2026-02-04)
• OpenAI Codex: 0.94.0 → 0.97.0 (published 2026-02-05, 3 intermediate versions)
• MCP Gateway: v0.0.98 → v0.0.99 (published 2026-02-04)

Update Priority: Medium - Security enhancements and stability improvements with no breaking changes

Status: constants.go updated in this workflow run, requires make recompile and testing

---

GitHub Copilot CLI v0.0.403

Release Date: February 4, 2026

Breaking Changes

None

Key Features

• Security enhancements: Module usage restricted to application bundle
• Plugin improvements: MCP servers stop before updates, skills work in prompt mode
• Configuration preservation: Config files now preserve custom fields during CLI updates
• Enhanced reasoning: Reasoning summaries enabled by default for supported models
• Cross-platform fixes: Detached shell processes work on vanilla macOS, Windows Task Manager shows correct app names

View Full Changelog

Security & Safety

• Implemented security checks to prevent module usage outside the application bundle
• Enhanced permission dialog behavior with consistent Escape key handling

Plugin & MCP Improvements

• MCP servers now stop before plugin updates
• Plugin skills function in prompt mode
• Skills with unrecognized frontmatter fields load with warnings rather than silencing

Configuration & Data Handling

• Config files preserve custom fields when CLI updates them
• ACP model info now includes usage multiplier and enablement status

User Experience

• Windows Task Manager displays correct application names
• Detached shell processes work on vanilla macOS installations
• Reasoning summaries enabled by default for supported models
• Custom agent frontmatter supports comma-separated tools

Bug Fixes

• Fixed logic checking user organization membership
• Improved custom agent field handling with warnings instead of silent failures

Impact Assessment

• Risk: Low
• Affects: Security posture, plugin system, config handling, cross-platform compatibility
• Migration: None required, backward compatible

Package Links

• NPM Package: https://www.npmjs.com/package/`@github/copilot`
• Repository: https://github.com/github/copilot-cli
• Changelog: https://github.com/github/copilot-cli/blob/main/changelog.md

---

OpenAI Codex v0.97.0

Release Date: February 5, 2026 (spans versions 0.95.0 through 0.97.0)

Breaking Changes

None

Key Features

• Session-scoped tool approvals: "Allow and remember" option enables auto-approval of repeated MCP/App tool calls within a session
• Live skill updates: Skill file changes detected and applied without restart
• Mixed media support: Dynamic tool outputs support combined text and image content
• Debug command: New /debug-config slash command for inspecting effective configuration
• Memory infrastructure: Initial API client and local persistence for thread memory summaries
• Configurable logging: New log_dir configuration option via CLI overrides
• macOS launcher: codex app (path) launches Codex Desktop from CLI with automatic DMG download
• Personal skill loading: Loads skills from ~/.agents/skills and ~/.codex/skills with app-server APIs
• Enhanced /plan command: Supports inline prompt arguments and image attachments
• Parallel shell execution: Multi-command throughput improvements
• Thread environment variable: Shell executions receive CODEX_THREAD_ID for thread/session detection

View Full Changelog

Version 0.97.0 (February 5, 2026)

New Features

• Session-scoped tool approvals with "Allow and remember" option (Add option to approve and remember MCP/Apps tool usage openai/codex#10584)
• Live skill updates without restart (Added support for live updates to skills openai/codex#10478)
• Mixed media support in dynamic tool outputs (feat(app-server, core): allow text + image content items for dynamic tool outputs openai/codex#10567)
• New /debug-config slash command (Add /debug-config slash command openai/codex#10642)
• Memory infrastructure: API client and local persistence (feat: add phase 1 mem client openai/codex#10629, feat: add phase 1 mem db openai/codex#10634)
• Configurable logging with log_dir option (feat(core): add configurable log_dir openai/codex#10678)

Bug Fixes

• Stabilized TUI apps/connectors picker rendering (Fix jitter in TUI apps/connectors picker  openai/codex#10593)
• Restored "working" status indicator during preamble (fix: ensure status indicator present earlier in exec path openai/codex#10700, fix(tui): restore working shimmer after preamble output openai/codex#10701)
• Enhanced cloud requirements reliability with timeout...

• Fixes [ca] Update CLI versions: Copilot 0.0.403, Codex 0.97.0, MCP Gateway v0.0.99 #13898

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

---

Changeset

• Type: patch
• Description: Update the default Copilot CLI to 0.0.403, the Codex CLI to 0.97.0, and the MCP Gateway to v0.0.99 so installs and workflows pull the latest releases.

Generated by Changeset Generator

[github-actions]

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

[github-actions]

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

[github-actions]

✅ Changeset Generator completed successfully!

[github-actions]

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

[github-actions]

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21(1)-release
sh	✅	available
git	✅	2.52.0
jq	✅	1.7
yq	✅	4.50.1
curl	✅	8.5.0
gh	✅	2.86.0
node	✅	20.20.0
python3	✅	3.12.3
go	✅	1.24.12
java	✅	openjdk 21.0.6
dotnet	❌	not found

Result: 11/12 tools available
Status: ⚠️ FAIL - 1 tool missing (.NET runtime)

Summary

• ✅ All shell, version control, JSON/YAML, and HTTP tools present
• ✅ GitHub CLI available
• ✅ Node.js, Python, Go, and Java runtimes installed
• ❌ .NET runtime (dotnet) not available in container

AI generated by Agent Container Smoke Test

[github-actions]

Smoke Test Results — §21714209546

• ✅ GitHub MCP (chore: add video tutorials for adding and creating workflows #13927, Use workflow-id markers for close-older-discussions #13914)
• ✅ Safe Inputs GH CLI (Remove unnecessary test dependency from canary_go job #13925, Fix firewall SSL-bump field extraction in frontmatter parser #13920)
• ✅ Serena MCP
• ✅ Playwright
• ✅ File Writing & Bash
• ✅ Discussion Interaction
• ✅ Build gh-aw
• ✅ Workflow Dispatch

Status: ✅ PASS

cc: @pelikhan @Copilot

AI generated by Smoke Copilot

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[pelikhan]

@copilot revert Claude update

[Copilot]

Pull request overview

This pull request updates three agentic CLI tools to their latest versions with security improvements, feature enhancements, and bug fixes. The changes maintain backward compatibility.

Changes:

• Updated GitHub Copilot CLI from 0.0.402 to 0.0.403 (security hardening, MCP server improvements)
• Updated OpenAI Codex from 0.94.0 to 0.97.0 (session-scoped tool approvals, live skill hot-reloading)
• Updated MCP Gateway from v0.0.98 to v0.0.99 (OAuth discovery endpoint support)

Reviewed changes

Copilot reviewed 60 out of 60 changed files in this pull request and generated no comments.

File	Description
pkg/constants/constants.go	Core version constants updated for all three CLI tools
.changeset/patch-update-cli-versions.md	Changeset file documenting the patch-level updates
.github/workflows/*.lock.yml (58 files)	Propagated version updates across all workflow lock files for consistency

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.