[chaodu-agent]

Summary

Bumps seven npm-distributed CLI version pins in the Dockerfiles to the versions published on the npm registry. The bump matches the versions the nightly build already points at.

CLI	old	new
copilot	1.0.89	1.0.105
gemini-cli	0.61.0	0.66.0
opencode	1.18.33	1.19.5
mimocode	0.1.15	0.1.16
kimi-code	2.1.1	2.4.1
codex	0.159.0	0.166.0
pi-acp	0.0.31	0.0.34

No CLI was dropped from this bump.

Not included, each in its own PR:

• PR B: claude-agent-acp, claude-code, codex-acp
• PR C: agy, grok, devin, cursor, kiro, and their sha256 values
• PR D: pi-coding-agent

Registry sources

Each new version was checked against the npm registry before the pin changed:

• copilot 1.0.105: https://registry.npmjs.org/@github/copilot/1.0.105
• gemini-cli 0.66.0: https://registry.npmjs.org/@google/gemini-cli/0.66.0
• opencode 1.19.5: https://registry.npmjs.org/opencode-ai/1.19.5
• mimocode 0.1.16: https://registry.npmjs.org/@mimo-ai/cli/0.1.16
• kimi-code 2.4.1: https://registry.npmjs.org/@moonshot-ai/kimi-code/2.4.1
• codex 0.166.0: https://registry.npmjs.org/@openai/codex/0.166.0
• pi-acp 0.0.34: https://registry.npmjs.org/pi-acp/0.0.34

Files changed

• Dockerfile.unified
• Dockerfile.package
• Dockerfile.codex
• Dockerfile.copilot
• Dockerfile.gemini
• Dockerfile.kimi
• Dockerfile.mimocode
• Dockerfile.opencode
• Dockerfile.pi
• .github/workflows/docker-smoke-test.yml (the validate-packaged-pins job hardcodes the expected CODEX_VERSION and COPILOT_VERSION values, so its two assert_line lines move to the new pins)

Dockerfile sync rule

Each CLI pin is an ARG <CLI>_VERSION=<value> line that appears in three Dockerfiles: Dockerfile.unified, Dockerfile.package, and the CLI's own Dockerfile. Every copy moved to the new value. That gives 3 copies per CLI and 21 ARG lines in total. A grep for each old ARG value returns no matches in the changed files. The unchanged pins (KIRO, CLAUDE_*, CODEX_ACP, GROK, DEVIN, PI_CODING_AGENT) keep their old values. docs/kimi.md has no version number to change.

Review Contract

Goal

Move the seven npm CLI pins in the Dockerfiles to the versions currently published on npm, so the images ship current CLIs and match the nightly build.

Non-goals

• Bumping any CLI outside the seven listed above (claude-agent-acp, claude-code, codex-acp, agy, grok, devin, cursor, kiro, pi-coding-agent). Each is in a separate PR.
• Updating sha256 values for binary downloads.
• Building the images locally. Verification is left to CI.

Accepted Residual Risks

• Newer CLI releases can change behavior that the smoke tests do not cover. Mitigation: the docker smoke test runs on this PR. Recovery: revert this PR, or pin the previous version in the affected Dockerfile.
• Unverified build: none of the images were built locally. Recovery: CI build failure blocks merge.

Acceptance Criteria

1. Every ARG pin listed in the summary table reads the new version in all three Dockerfiles that carry it. The grep check above is the evidence.
2. Each new version exists on the npm registry at the URLs listed in "Registry sources". Status: PASS, checked during the bump.
3. The docker smoke test passes on this PR. Status: PASS (https://github.com/openabdev/openab/actions/runs/41211485832).
4. The Dockerfile.unified and Dockerfile.package images build with the new pins. Status: PASS, covered by the smoke-test and smoke-test-unified jobs (https://github.com/openabdev/openab/actions/runs/41211485832).

Follow-ups

• PR B, PR C, and PR D, as listed above.

Verification

CI smoke tests (docker-smoke-test.yml) are the verification for this PR. Nothing was built or run locally.

• Registry checks for all seven new versions: PASS (recorded during the bump).
• Grep for old pin values in the changed files: PASS, no matches.
• Docker smoke test: PASS (https://github.com/openabdev/openab/actions/runs/41211485832).
• Image builds: PASS, all smoke-test and smoke-test-unified jobs green.

[chaodu-agent]

Note

LGTM ✅ - The seven npm pin bumps are consistent across all Dockerfile copies, CI is fully green, and the round 1 description finding is resolved.

What This PR Does

Bumps seven npm-distributed CLI version pins (copilot, gemini-cli, opencode, mimocode, kimi-code, codex, pi-acp) to the versions currently published on npm, so the release images match the nightly build.

How It Works

Each pin is an ARG <CLI>_VERSION=<value> line that appears in three places: the CLI's own Dockerfile, Dockerfile.package, and Dockerfile.unified. The first commit moves all 21 copies to the new values. The second commit updates the two hardcoded assert_line expectations for CODEX_VERSION and COPILOT_VERSION in the validate-packaged-pins job of .github/workflows/docker-smoke-test.yml, which would otherwise fail on the new values.

Findings

#	Severity	Finding	Location
1	🟢	Round 1 F1 resolved: PR description now matches the 10-file diff and the green CI	PR body
2	🟢	All 21 pin copies updated consistently; no old values remain	Dockerfile*
3	🟢	Smoke-test assertions updated in the same PR, so validate-packaged-pins passes	.github/workflows/docker-smoke-test.yml:211-212
4	🟢	Full CI matrix green, including every per-agent and unified smoke test	CI
5	🟢	Package metadata and Node engine requirements fit the selected images	npm registry

Finding Details

🟢 F1: Round 1 description finding resolved

Round 1 requested changes because the PR body contradicted the diff. The updated description now:

• lists all 10 changed files, including .github/workflows/docker-smoke-test.yml, with the reason for the change;
• no longer lists the workflow edit as a non-goal, and the dangling "Known failing check" reference is removed;
• reports Acceptance Criteria 3 and 4 and the Verification section as PASS, linking CI run 41211485832.

The Review Contract check re-ran after the edit (run 41220450106) and passed. The head SHA did not change; the fix was description-only.

🟢 F2: Consistent pin updates

Every one of the seven pins reads the new value in all three Dockerfiles that carry it. A grep for each old value (0.159.0, 1.0.89, 0.61.0, 1.18.33, 0.1.15, 2.1.1, 0.0.31) returns no matches in any Dockerfile*. Unrelated pins (KIRO, CLAUDE_*, CODEX_ACP, GROK, DEVIN, PI_CODING_AGENT) are unchanged, which matches the stated scope. git diff --check passes.

🟢 F3: CI contract kept in sync

The second commit updates the hardcoded Codex and Copilot expectations together with the Dockerfiles, so the pin-parity gate stays meaningful rather than being bypassed.

🟢 F4: CI fully green

All smoke-test and smoke-test-unified jobs pass, along with validate-packaged-pins, build-builder, check, and Review Contract.

🟢 F5: Registry and runtime compatibility

All seven new versions return HTTP 200 from registry.npmjs.org with integrity metadata. Declared Node engine requirements fit the image bases (for example, kimi-code 2.4.1 requires Node >=22.19.0; the image uses Node 24). opencode 1.19.5 publishes the Linux x64 and arm64 optional packages the images need.

Follow-up (non-blocking, out of scope for this PR)

Pin parity is still maintained by hand. validate-packaged-pins hardcodes expected values for some pins (KIRO, CODEX, COPILOT, DEVIN, AGY), and the other five npm pins bumped here (gemini-cli, opencode, mimocode, kimi-code, pi-acp) have no three-way parity assertion at all. A future bump can therefore leave a stale CI expectation or a divergent Dockerfile copy. A generic loop that reads each ARG *_VERSION from the per-agent Dockerfile and asserts the same line in Dockerfile.package and Dockerfile.unified would remove both the hardcoded values and the coverage gap, as the Node pin check in the same job already does.

This is pre-existing design that the PR does not introduce, so it does not affect the verdict.

Baseline Check

• PR opened: 2026-10-31
• Head SHA: 2a861f7ed66427c45d703b6b47e9e28ffa10967b (unchanged since round 1)
• Base: main (not stacked); merge-base 6214700a1e52c899b23127025abf3a8ff461a579
• Diff: 10 files, +23/-23
• Main already has: the old pins and the validate-packaged-pins job
• Net-new value: seven pin bumps plus two matching CI assertions
• Inline review comments: none on this PR.

What's Good (🟢)

• Small, isolated change limited to dependency pins and their CI contract.
• Every new version was checked against the npm registry, with sources listed in the PR body.
• Bumps are split into separate PRs by risk class (npm pins here; binary downloads with sha256 values elsewhere).

5. Three Reasons We Might Not Need This PR

1. Freshness is the only direct value - The PR aligns release images with nightly but does not fix a reported runtime defect.
2. Limited smoke coverage - The smoke tests check installation, --help, or an ACP handshake. They do not exercise real agent sessions, so seven simultaneous CLI behavior changes ship with little runtime coverage.
3. Reproducibility is unchanged - npm install -g still resolves transitive dependencies without a lockfile, so bumping top-level pins does not make rebuilds reproducible.