AI Coding Tools Roundup: Claude Code 2.1.292, Copilot CLI Sandboxing for Everyone and OpenCode 1.18.35

Another busy day for AI coding tools. Claude Code shipped 2.1.292 per its official changelog, GitHub Copilot CLI moved sandboxing to all users, Codex pushed 0.161 and 0.162 builds, and OpenCode 1.18.35 landed.

Claude Code 2.1.292

Version 2.1.292 follows yesterday's regression fixes in 2.1.291 with a broad set of additions and security fixes:

• effort parameter on the Agent tool, so Claude can run a sub-agent at the effort level you ask for.
• claude plugin install --marketplace <source> adds the marketplace if needed, under the same policy checks as marketplace add, then installs the plugin.
• CLAUDE_CODE_OVERLOADED_RETRY_BASE_DELAY_MS sets a longer base delay for backoff when retrying overloaded (529) requests.
• Security: PreToolUse hook approvals and auto mode no longer bypass the permission prompt for file reads from network (UNC) paths, and sandboxed commands can no longer read staged /ultrareview upload copies.
• Reliability: saved scheduled tasks created after /resume now fire, a background /loop survives a process restart, and plan mode is restored when resuming from the session picker.

If you rely on hooks or auto mode in shared environments, the permission fixes alone justify updating.

GitHub Copilot: CLI Sandboxing and Code Review API

The Copilot CLI v1.0.93 pre-releases make command sandboxing available to all users through /sandbox and --sandbox. Sandbox network allowlists now support localhost and loopback hosts, and MCP server configuration changes apply between turns without restarting the session.

On the platform side, Copilot code review can now be requested through REST and GraphQL APIs with a per-request effort level, and Balanced is the new default effort (effective September 28). The September VS Code release adds scheduled automations in the Agents window, agent merge for handling review feedback, failed checks and conflicts, and PR creation straight from agent sessions.

OpenAI Codex and OpenCode

Codex's stable channel is at 0.160.1 with alpha builds toward 0.161 and 0.162 shipping daily; see the Codex releases page for notes. OpenCode 1.18.35 (October 6) adds agent-readable stats formats and now passes supported images in xAI tool results while skipping unsupported formats. Version 1.18.34 re-signed macOS binaries with a Developer ID for macOS 27+.

What to do today

• Update Claude Code to 2.1.292, especially if you use hooks, auto mode or scheduled tasks.
• Try Copilot CLI sandboxing before running agents on untrusted repositories.
• If you automate PR review, review your Copilot effort setting now that Balanced is the default.

Sources

• Claude Code changelog · Copilot CLI releases · Codex releases · OpenCode releases · Copilot code review changelog