versions.env

# Shared image version pins for local and release builds.
# Update this file when we intentionally move default toolchain or CLI versions.

NODE_MAJOR=22
GO_VERSION=1.27.4
PYTHON_VERSION=3.14t
DELTA_VERSION=0.20.1
TMUX_VERSION=3.6a
TMUX_SHA256=b6d8d9c76585db8ef5fa00d4931902fa4b8cbe8166f528f44fc403961a3f3759

CLAUDE_CODE_VERSION=2.1.323
CCTRACE_VERSION=0.53.0
CODEX_VERSION=0.168.0
GEMINI_CLI_VERSION=0.68.0
GROK_CLI_VERSION=1.0.77
KIMI_CODE_VERSION=2.6.1
OPENCODE_VERSION=1.19.5
PI_CODING_AGENT_VERSION=1.5.2
DSH_VERSION=0.2.2-rc.1
# Cursor CLI. Not on npm; cursor.com/install hardcodes the version and
# offers no pin hook, but the download URL is deterministic:
# downloads.cursor.com/lab/<version>/linux/<arch>/agent-cli-package.tar.gz
# so the image fetches the tarball directly. Version format YYYY.MM.DD-hash.
CURSOR_CLI_VERSION=2026.11.11-b912975
CCX_VERSION=v0.18.0
COPILOT_API_VERSION=0ea08febdd7e3e055b03dd298bf57e669500b5c1
PLAYWRIGHT_VERSION=1.65.0
# CloakBrowser npm wrapper version. This also pins the Chromium binary:
# the wrapper hardcodes per-arch free-binary versions (linux-x64 146.x.x.5,
# linux-arm64 146.x.x.3), so bumping the wrapper is what moves Chromium.
# HOLD below 0.7.0: from 0.7.0 the installer (cloakbrowser install) exits 1
# without a license key ("Get one free ... the key is also emailed to you").
# Taking that on is a decision about upstream's terms, not a pin bump.
# update-version-pins.sh will keep proposing 0.7.x; the cloak CI build
# fails loudly when it does.
CLOAKBROWSER_WRAPPER_VERSION=0.6.5
# Kimi WebBridge daemon + extension. No npm package; resolved from
# cdn.kimi.com/webbridge/latest/version.json. Not consumed by any
# build yet — Dockerfile.cloak starts baking it in #543.
KIMI_WEBBRIDGE_VERSION=v2.0.36

RUST_TOOLCHAINS=stable
RUST_DEFAULT_TOOLCHAIN=stable
RUST_TARGETS=wasm32-unknown-unknown