$ the-wire · showcase
Codex 0.165 adds Vertex AI and GPT-6.1 Terra; OpenCode v2.2.0 patches a redirect hole in webfetch
By RepoJournal · Filed · About Agentic Coding · Composed from the cited sources · methodology
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4)
19 people shipped this
github-actions[bot]
@github-actions[bot]
2 cited
rekram1-node
@rekram1-node
1 cited
James Arlen
@Myrcurial
1 cited
saoudrizwan
@saoudrizwan
1 cited
Dan-Wuensch
@Dan-Wuensch
1 cited
mhegazy
@mhegazy
GitHub Actions (publish-mods)
@actions-user
copyberry
@copyberry
usrnk1
@usrnk1
gemini-cli-robot
@gemini-cli-robot
duvanka-prasad
@duvanka-prasad
elberthc-byte
@elberthc-byte
Leizhen Zhang
@LeizhenZhang
OpenHands Bot
@all-hands-bot
OrangerXu
@OrangerXu
johnwschoi
@johnwschoi
Iotaslair
@Iotaslair
github-actions
@github-actions
jamadeo
@jamadeo
The day's operator-relevant moves are a new provider and model in Codex, a webfetch allowlist fix and plugin surface in OpenCode, and a reachable DoS floor bump in Cline, with gemini-cli, goose and Claude Code shipping smaller fixes.
0.165.0 openai/codex
Codex 0.165.0 ships a built-in Google Cloud Vertex AI provider, selected with `model_provider = "gcp"`, and adds GPT-6.1 Terra to the model catalogs. The session picker also gains a repository filter and directory grouping, which helps when you run sessions across linked worktrees.
fix(core): apply webfetch URL rules to redirect targets anomalyco/opencode
OpenCode's webfetch used to validate only the URL the model requested and then let fetch follow redirects unchecked, so a deny rule or host allowlist did not apply to the redirect target. It now follows redirects itself and checks each new URL against the rules first, stopping at the first denial without prompting.
v2.2.0 anomalyco/opencode
OpenCode v2.2.0 introduces experimental Desktop plugins you can create, install and share, and refreshes the desktop app experience. The release is flagged breaking, so check your config and any desktop tooling before moving past your current version.
security: undici 7.30.1 floor (two reachable process-crash DoS) (#15287) cline/cline
Cline raised its undici floor from 7.29.0 to 7.30.1 for two reachable process-crash DoS issues logged as AIKIDO-2026-159850 and AIKIDO-2026-393834. Anyone running a Cline build that builds its own bundle or vendors the Hub daemon should be on or above that floor.
fix(bedrock): Fall back to default inference for Bedrock provider models without document block support aaif-goose/goose
goose's Bedrock provider no longer dies on models like OpenAI, GLM and Kimi K3 when an MCP tool returns a `.md` file: goose builds that as a document block, which those models reject with a "This model doesn't support documents" ValidationException. It now falls back to default inference instead of failing the run outright.
fix(hub): stop re-sending a rejected Cline refresh token on every cloud poll cline/cline
Telemetry from the first 3 hours after the Oct 26 release showed the hub on core 0.2.0 logging 32,805 `user.auth_logged_out` events from 49 machines, or roughly one every 16 seconds per machine, plus about 52,000 `user.auth_refresh_soft_failure` events, because a rejected Cline refresh token was re-sent on every cloud poll. The fix stops the re-send; goose 1.57.0 also went out with Lemonade as ...
Action items
- → Upgrade Cline to a build with undici 7.30.1 or later to clear the two process-crash DoS issues cline/cline [immediate]
- → Review your OpenCode config before moving to v2.2.0, which is marked breaking anomalyco/opencode [plan]
