[olafkfreund]

Opened by the hub agent-CLI freshness job (Factory#459, #556).

Bumps the baked agent-CLI pins in the npm install -g step, on dev:

• @anthropic-ai/claude-code -> 2.1.316
• @google/gemini-cli -> 0.66.0
• @openai/codex -> 0.166.0

Why a workflow and not a bot

Nothing else proposes these. The Renovate App is not installed on this
account, and Dependabot -- which bumps the FROM lines in this same
Dockerfile every day -- cannot see an npm install -g @scope/pkg@version
argument, because no package-ecosystem parses shell arguments in a RUN
layer. So these three have been hand-managed with nothing watching them.

Do not merge this without the image build passing

These CLIs run inside the image that executes untrusted repository content.
image-build.yml compiles target: runtime on this PR and the bake step
runs claude --version during that build, so a yanked or broken upstream
release fails here rather than in the fleet. Nothing auto-merges this, on
purpose.

AIFactory, PFactory get the same branch in the same run, to the same versions.
factory-gitops' cli-canary asserts all three repos pin identically, so
merging one alone turns that check red -- merge the set.

If this sits

The branch is rebased onto the base branch on every weekly run, so this PR is
refreshed in place and a second one is never opened. If it is still unmerged
when the newest release passes the 30-day window, the hub cli-freshness
job goes red -- that red now means "a bump PR has been ignored" rather than
"nobody bumped". Close this PR to reject the bump; the next run will reopen
it, which is the point. Hold it back deliberately by raising the window with
the reason, as that job's own guidance says.

[Copilot]

🔵 Needs a closer look

The required runtime-image build is still in progress, and fleet-canary results are unavailable, leaving compatibility and coordinated release conditions across three services unverified.

No open issues 🎉

What changed in this PR

This PR refreshes the agent CLI versions baked into TFactory’s runtime image without changing the installation process.

Changes:

• Updates Claude Code from 2.1.310 to 2.1.316.
• Updates Codex from 0.164.0 to 0.166.0 and Gemini CLI from 0.65.0 to 0.66.0.
• Preserves the existing Claude installation and build-time version check.

File	Description
Dockerfile	Bumps the three globally installed agent CLI version pins.

_{Review effort: Balanced}

[github-actions]

TFactory coverage

54.91% on this PR vs 54.82% on its base (+0.09 pts).

PASS - Coverage 54.91% (unchanged vs base 54.82%)

Measured by the TFactory coverage gate on both the PR head and its base.