Channels Held. Stable Has Mods, Not the Deny Fixes.

At a glance

• Nothing new reached npm for Claude Code, Codex, Copilot CLI or Gemini CLI since our last brief, so every channel read at 6:09 AM ET today the same as it did a day earlier.
• Claude Code's stable channel, at 6:09 AM ET today, has Claude Mods but none of the deny-rule, network-path and fail-closed hook fixes that followed it.
• A Cursor CLI release, posted only on the CLI changelog, makes Auto-review ask before deletes whose target could resolve differently than written.
• Copilot computer use stays off until someone turns it on, while Cursor Remote Control stays on until someone turns it off.

Sunday brought no new builds, since the last npm publish for the four agent CLIs we track landed Friday night ET. That makes the gap between channels the story. At 6:09 AM ET today Claude Code's stable channel carried v2.1.287, the release that added Claude Mods, while every permission fix shipped since then, from the v2.1.288 rm prompt to Thursday's fail-closed hooks, sat only on latest and next. Cursor also shipped a CLI change on Thursday that sits in a separate changelog. Treat today as the day to check which Claude Code build your stable machines run before mods meet your deny rules, update Cursor CLI where agents run in Auto-review, and confirm computer use and Remote Control are off on machines nobody watches.

Top Stories

1. Every channel held through the weekend

At 6:09 AM ET today npm showed Claude Code stable at v2.1.287 with latest and next at v2.1.296, and Anthropic's native installer pointers matched. Codex latest was v0.162.1 with alpha at v0.163.0-alpha.5, Copilot CLI latest was v1.0.95 with prerelease at v1.0.96-2, and Gemini CLI latest was v0.63.0 with preview at v0.64.0-preview.1. All of them match Saturday's 6:02 AM ET check.

The newest publishes behind those tags all landed Friday: Copilot CLI v1.0.95 at 12:04 PM ET, Claude Code v2.1.296 at 12:58 PM ET, Codex v0.162.1 at 3:50 PM ET and Gemini CLI v0.64.0-preview.1 at 4:31 PM ET. The last pre-releases, Codex v0.163.0-alpha.5 and Copilot v1.0.96-2, followed by 10:13 PM ET.

Practical dev impact: A machine that updated Saturday is current, so no new version needs a restart today. The useful work is reading claude --version on each machine, because a stable fleet and a latest fleet are now nine Claude Code releases apart, and those nine releases carry most of the recent permission fixes.

2. Stable has mods but not the deny fixes that followed

Saturday's brief noted that stable stepped to v2.1.287 and so picks up Claude Mods. The safety question is what that step leaves out. Last Sunday we covered v2.1.289, published Saturday 3 Oct, which made a deny or ask rule on a nested part of a compound shell command hold over a user-installed mod's approval on managed machines, meaning those with managed settings or a Team or Enterprise sign-in. The same release stopped sandbox auto-allow from skipping a Bash deny or ask rule behind an environment-variable prefix or a bare variable assignment, and applied Read deny rules to files reached in the IDE through a symlink.

None of that is on stable. Neither is v2.1.288's prompt for a dangerous rm inside bash -c, v2.1.292's fix for hook approvals and auto mode skipping the prompt on network (UNC) path reads, or v2.1.295's onFailure: "block" for command and HTTP hooks that cannot start, time out or exit unexpectedly.

Practical dev impact: Mods arrived in v2.1.287, so as we said on 4 Oct, a managed machine on v2.1.287 has mods switched on and can have the mod gap, where a mod's approval beats a deny rule on part of a compound command. The changelog does not say which release introduced the prefix, assignment and symlink gaps, so do not assume stable is exposed or safe on those. If a stable fleet relies on deny rules, decide before Monday who may install mods there and whether a canary group moves to v2.1.296. Our view is that accepting the gap until stable advances is a choice to make on purpose, not by default.

3. Cursor CLI v2026.10.08 reviews ambiguous deletes

Cursor's CLI changelog posted v2026.10.08, dated Thursday 8 Oct and still marked latest at 6:10 AM ET today. Our Friday and Saturday briefs missed it because they checked only Cursor's main changelog, which still leads with Remote Control. Auto-review now asks for approval before recursive, force, wildcard or mirror deletes whose target could resolve differently than written, such as an unset variable or a stray space in a path. The release also flags oversized skills in /skills and makes edits to large files fail safely instead of truncating them.

Practical dev impact: Cursor's run modes docs describe Auto-review as a classifier for calls that the allowlist and the sandbox do not settle, and they say plainly that it is not a security boundary, so the new check catches a class of mistakes rather than replacing a deny list. Those docs mostly describe the desktop app's settings; our reading is that the CLI's Auto-review works the same way. Run agent --version and agent update on machines that run the CLI in Auto-review, and keep destructive commands out of the allowlist, since allowlisted calls run without review.

4. Computer use stays opt-in while Remote Control stays on

GitHub's docs still describe Copilot computer use, which we covered on 3 Oct, as a public preview in Copilot CLI and the Copilot app on macOS and Windows that is disabled by default. features.computerUse is an enterprise managed-settings key, not the default switch: admins set it to false to stop users from turning computer use on, and a local setting cannot override that. Copilot CLI v1.0.95, npm latest at 6:09 AM ET, also carries the v1.0.94 policy from Thursday that can disable Assisted Permissions and keep sessions in Manual Approval mode. Cursor Remote Control, which we covered on Wednesday, is still on by default for every plan except Enterprise, and it keeps the agent on your computer while the iOS app connects to it.

Practical dev impact: The two defaults point in opposite directions, so the checks differ. On shared machines and agent hosts, run /computer show in Copilot CLI and use /computer off if someone switched it on, and if you administer an enterprise, decide whether features.computerUse should be false. On laptops that should not be reachable from a phone, review the Remote Control section and "Keep this computer awake" in Cursor's desktop settings.

Practical Impact Analysis

A weekend with no releases is a good time to audit, because nothing moves under you while you look. The week's safety work did not land evenly, though. Copilot CLI's policy controls and Cursor's delete review reach machines through their normal updates, while Claude Code's permission fixes sit on latest and next, so for Claude Code the channel itself is the control. That makes the stable fleet the first place to look, since it just gained the largest new surface of the week in mods and has none of the fixes that followed.

Cursor's change is welcome but narrow. A classifier that asks about ambiguous deletes helps only when the command reaches the classifier, so allowlists still decide what runs unreviewed. Computer use and Remote Control need the opposite kind of check, since one is off until someone turns it on and the other is on until someone turns it off.

Tutorial

Record the channels first, then what each machine actually runs. The update and install lines are commented out so you can run the checks safely and uncomment one on purpose.

#!/usr/bin/env bash
# 1. Channel pointers. At 6:09 AM ET Sun 11 Oct, claude-code npm stable was v2.1.287 and latest v2.1.296.
npm view @anthropic-ai/claude-code dist-tags --json
npm view @openai/codex dist-tags.latest dist-tags.alpha
npm view @github/copilot dist-tags --json
npm view @google/gemini-cli dist-tags --json

# 2. What this machine runs
claude --version
codex --version
copilot --version
gemini --version
agent --version

# 3. Cursor CLI, update in place. v2026.10.08 was marked latest on the CLI changelog at 6:10 AM ET.
# agent update

# 4. Claude Code canary, npm installs only, npm latest and next at 6:09 AM ET:
# npm install -g @anthropic-ai/claude-code@2.1.296

If claude --version prints 2.1.287, that machine has mods but not the v2.1.289 deny-rule fixes, so treat it as part of the decision in story 2 rather than upgrading it on the spot. Native installs follow their own pointers, so do not mix npm and native Claude Code installs on one machine. In each Copilot CLI session on a shared machine, run /computer show, and use /computer off if it reports computer use as on. Restart open sessions after any update and trust each tool's --version output over the tag.

Recommended AI prompt

Copy this paragraph into ChatGPT, Claude, Gemini, Grok, or whatever AI you use.