pin all CLI installations to explicit versions and use pro models by default (#283)

* pin all CLI installations to explicit versions and use pro models by default

- codex: pin @openai/codex to 0.101.0 (was "latest")
- opencode: pin opencode-ai to 1.1.56 (was "latest")
- gemini: pin gemini-cli to v0.28.2 via new tag param on installFromGithub
- cursor: pin to 2026.01.28-fd13201 via direct tarball download (replaces curl install script)
- add installFromDirectTarball to install.ts for versioned tarball URLs
- gemini auto effort now uses pro-preview instead of flash-preview
- test runner model overrides updated to use pro-preview consistently

Co-authored-by: Cursor <cursoragent@cursor.com>

* increase activity timeout

* fix delegation timeout

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

agents/claude.ts

@@ -139,6 +139,7 @@ export const claude = agent({
       cwd: process.cwd(),
       env: process.env,
       stdio: ["ignore", "pipe", "pipe"],
+      activityTimeout: 0, // disabled: process-level timeout in main.ts handles this (subprocess timeout would kill orchestrator during delegation)
       onStdout: async (chunk) => {
         finalOutput += chunk;
 

agents/codex.ts

@@ -14,6 +14,10 @@ import { spawn } from "../utils/subprocess.ts";
 import { ThinkingTimer } from "../utils/timer.ts";
 import { type AgentRunContext, agent } from "./shared.ts";
 
+// pinned CLI version — no 1-1 package.json dependency for the CLI package
+// (package.json has @openai/codex-sdk which is the SDK, not the CLI)
+const CODEX_CLI_VERSION = "0.101.0";
+
 // configuration based on effort level
 // https://developers.openai.com/codex/models/
 type ModelReasoningEffort = "minimal" | "low" | "medium" | "high" | "xhigh";
@@ -124,7 +128,7 @@ async function installCodex(): Promise<string> {
 
   const cliPath = await installFromNpmTarball({
     packageName: "@openai/codex",
-    version: "latest",
+    version: CODEX_CLI_VERSION,
     executablePath: "bin/codex.js",
     installDependencies: true,
   });
@@ -225,6 +229,7 @@ export const codex = agent({
       cwd: process.cwd(),
       env,
       stdio: ["ignore", "pipe", "pipe"],
+      activityTimeout: 0, // disabled: process-level timeout in main.ts handles this (subprocess timeout would kill orchestrator during delegation)
       onStdout: async (chunk) => {
         finalOutput += chunk;
 

agents/cursor.ts

@@ -10,10 +10,15 @@ import type { Effort } from "../external.ts";
 import { ghPullfrogMcpName } from "../external.ts";
 import { markActivity } from "../utils/activity.ts";
 import { log } from "../utils/cli.ts";
-import { installFromCurl } from "../utils/install.ts";
+import { installFromDirectTarball } from "../utils/install.ts";
 import { ThinkingTimer } from "../utils/timer.ts";
 import { type AgentRunContext, agent } from "./shared.ts";
 
+// pinned CLI version — cursor-agent is downloaded as a tarball from downloads.cursor.com.
+// the version format is {date}-{commit_hash}. update by inspecting the install script:
+//   curl -fsSL https://cursor.com/install | grep DOWNLOAD_URL
+const CURSOR_CLI_VERSION = "2026.01.28-fd13201";
+
 // effort configuration for Cursor
 // only "max" overrides the model; mini/auto use default ("auto")
 const cursorEffortModels: Record<Effort, string | null> = {
@@ -95,9 +100,12 @@ type CursorEvent =
   | CursorResultEvent;
 
 async function installCursor(): Promise<string> {
-  return await installFromCurl({
-    installUrl: "https://cursor.com/install",
-    executableName: "cursor-agent",
+  const os = process.platform === "darwin" ? "darwin" : "linux";
+  const arch = process.arch === "arm64" ? "arm64" : "x64";
+  return await installFromDirectTarball({
+    url: `https://downloads.cursor.com/lab/${CURSOR_CLI_VERSION}/${os}/${arch}/agent-cli-package.tar.gz`,
+    executablePath: "cursor-agent",
+    stripComponents: 1,
   });
 }
 

agents/gemini.ts

@@ -24,7 +24,7 @@ const geminiEffortConfig: Record<Effort, { model: string; thinkingLevel: string
   // pass the model directly it works if we ever did need to do something like this,
   // we could write to .gemini/settings.json
   mini: { model: "gemini-3-flash-preview", thinkingLevel: "LOW" },
-  auto: { model: "gemini-3-flash-preview", thinkingLevel: "HIGH" },
+  auto: { model: "gemini-3-pro-preview", thinkingLevel: "HIGH" },
   max: { model: "gemini-3-pro-preview", thinkingLevel: "HIGH" },
 } as const;
 
@@ -85,6 +85,9 @@ type GeminiEvent =
   | GeminiToolResultEvent
   | GeminiResultEvent;
 
+// pinned CLI version — gemini-cli is installed from GitHub releases, not npm
+const GEMINI_CLI_VERSION = "v0.28.2";
+
 // transient API error patterns that warrant a retry.
 // these are server-side issues, not client errors.
 const TRANSIENT_ERROR_PATTERNS = [
@@ -191,6 +194,7 @@ async function installGemini(githubInstallationToken?: string): Promise<string>
   return await installFromGithub({
     owner: "google-gemini",
     repo: "gemini-cli",
+    tag: GEMINI_CLI_VERSION,
     assetName: "gemini.js",
     ...(githubInstallationToken && { githubInstallationToken }),
   });
@@ -231,6 +235,7 @@ export const gemini = agent({
           cmd: "node",
           args: [cliPath, ...args],
           env: process.env,
+          activityTimeout: 0, // disabled: process-level timeout in main.ts handles this (subprocess timeout would kill orchestrator during delegation)
           onStdout: async (chunk) => {
             const text = chunk.toString();
             finalOutput += text;

agents/opencode.ts

@@ -12,6 +12,10 @@ import { spawn } from "../utils/subprocess.ts";
 import { ThinkingTimer } from "../utils/timer.ts";
 import { type AgentRunContext, agent } from "./shared.ts";
 
+// pinned CLI version — no 1-1 package.json dependency for the CLI package
+// (package.json has @opencode-ai/sdk which is the SDK, not the CLI)
+const OPENCODE_CLI_VERSION = "1.1.56";
+
 // known provider error patterns in stderr (from --print-logs output).
 // when OpenCode encounters these, it often goes silent on stdout (Issue #752),
 // so we surface them prominently instead of burying them in debug warnings.
@@ -37,7 +41,7 @@ function detectProviderError(text: string): string | null {
 async function installOpencode(): Promise<string> {
   return await installFromNpmTarball({
     packageName: "opencode-ai",
-    version: "latest",
+    version: OPENCODE_CLI_VERSION,
     executablePath: "bin/opencode",
     installDependencies: true,
   });
@@ -114,6 +118,7 @@ export const opencode = agent({
         cwd: repoDir,
         env,
         timeout: 600000, // 10 minutes timeout to prevent infinite hangs
+        activityTimeout: 0, // disabled: process-level timeout in main.ts handles this (subprocess timeout would kill orchestrator during delegation)
         stdio: ["ignore", "pipe", "pipe"],
         onStdout: async (chunk) => {
           const text = chunk.toString();