AI coding tools weekly: Cursor hosts code, Copilot locks down JetBrains, Claude tightens sessions (2026)

Between August 14 and 18, the important changes were less about adding another model to a picker than about deciding where an AI agent may act. Cursor put repositories, pull requests, and CI connections inside Origin; GitHub made Copilot’s JetBrains controls enforceable by enterprise policy; Claude Code tightened the seams around sessions, permissions, and security. Windsurf also shipped a dated JetBrains plugin update, but its public note contains no feature-level detail. 1 2 3 4

For engineering leads, this is a control-plane week: the review should cover code ownership, tool permissions, telemetry, model compatibility, and recovery behavior—not just whether an agent writes a better patch.

The week in one view

Tool and release	Release date	What changed	Why engineering teams should care
Cursor Origin	Aug. 17	Cursor began an early beta for hosted repositories, pull requests, code browsing, GitHub sync, and agents that can act on the code and PRs. Vercel, Depot, and Buildkite integrations are available. 1	Cursor is no longer only the place where an agent edits a checkout. Teams now need an explicit source-of-truth, access, sync, CI, and deployment policy for the same workspace.
GitHub Copilot for JetBrains: managed settings	Aug. 18	Enterprise administrators can centrally govern plugins and marketplaces, MCP server access, OpenTelemetry, and whether the agent can use Bypass Approvals or Autopilot. 2	JetBrains users can now inherit a real control baseline. IDE-specific policy drift becomes something to test and audit rather than a developer-by-developer preference.
Claude Code 2.1.233–2.1.235	Aug. 14, 17, and 18	New GitLab merge-request status, automatic continuation after a usage limit resets, optional prompt spellcheck, cache and permission fixes, stronger Windows path defenses, and better handling of background cloud sessions. Newer models also changed the availability of the built-in todo tools. 3	The release block improves the reliability and safety of long-running sessions, but the model/tool compatibility change can break scripts or workflows that assume todo tools are always present.
Windsurf JetBrains plugin v2.12.27	Aug. 17	The official entry reports “various bug fixes and improvements” without naming individual fixes or new capabilities. 4	Treat this as a maintenance update, not evidence of a new agent workflow. A team needs a more specific release note before changing its IDE strategy.

Cursor makes the repository part of the agent surface

Origin is Cursor’s early-beta code-hosting layer. Paid-plan users can create repositories in Cursor, push a local project through the CLI, browse code, and work with pull requests in the same interface. GitHub repositories can be synced into Origin, while GitHub remains the source of truth for projects that started there. 1

The meaningful change is not the repository page by itself. Cursor puts the repository, PR timeline, checks, changed files, and agent in one operating surface. An agent can answer questions about the code being browsed, make changes, update a pull request, or push a branch. On a synced repository, comments and reactions flow between Cursor and GitHub. Anyone with read or write access to the synced repository can view it in Cursor. 1

That creates a new ownership matrix for platform teams:

Source of truth: A new Origin repository is hosted by Cursor; a synced GitHub repository continues to treat GitHub as authoritative.
Access: Repository permissions now need to be checked in Cursor as well as in GitHub. A user’s ability to read or write in the synced copy is part of the exposure model.
Automation: Vercel can create preview deployments for pull requests. Depot and Buildkite can run existing GitHub Actions workflows, while Buildkite also supports its native pipelines. 1
Enterprise choice: Origin is rolling out to paid plans in early beta, with an opt-out available to enterprise organizations through their administrators. 1

The first pilot should not start with a generic “try Cursor hosting” instruction. Pick one non-sensitive repository and record who can see it, where pull-request comments land, which system runs checks, and what happens when a preview deployment or sync fails. The test should also confirm whether the repository’s existing branch protections and required checks still produce the same merge decision after the agent becomes a participant in the loop.

Copilot turns JetBrains configuration into enterprise policy

GitHub’s August 18 update gives Copilot for JetBrains a set of administrator-managed controls across four surfaces: plugin governance, MCP connections, OpenTelemetry, and agent permission modes. The supported settings include enabledPlugins, extraKnownMarketplaces, and strictKnownMarketplaces; administrators can also use allowedMcpServers and deniedMcpServers to control which MCP servers developers may connect to. 2

The telemetry control is unusually consequential for IDE teams. Administrators can set the collector endpoint, protocol, service name, resource attributes, and content-capture policy. GitHub says managed values take precedence over developer settings, and developers can inspect the applied configuration under Settings > Tools > GitHub Copilot > Chat > OpenTelemetry. 2

The permission control is equally concrete: setting permissions.disableBypassPermissionsMode to disable prevents the Copilot agent in JetBrains from using Bypass Approvals or Autopilot. That gives administrators a way to keep the capability available in the product while removing the highest-autonomy modes from an organization’s operating baseline. 2

A useful rollout test has four parts:

Install a developer-approved plugin and an administrator-approved plugin, then verify which one survives the managed configuration.
Try an MCP server outside the allowlist and confirm that the failure is policy enforcement rather than an ambiguous connection error.
Change a local OpenTelemetry value and verify that the applied endpoint and content-capture policy still come from the managed setting.
Run the same agent task with a policy that disables bypass permissions, and record whether the user receives a clear approval path instead of an unexpected autonomous run.

This is the implementation-level follow-through to the broader JetBrains governance controls discussed last week. The new detail matters because a platform team can now write a concrete policy diff, test precedence, and audit the behavior in the IDE rather than rely on a product label such as “enterprise-ready.”

Claude Code’s latest releases harden the seams

The new Claude Code material in this window is concentrated in versions 2.1.233, 2.1.234, and 2.1.235. Those releases are mostly reliability, security, and session-management work, but two changes deserve an explicit compatibility check. 3

First, Claude Code 2.1.233 says that the built-in todo and task-tracking tools are no longer available on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models. The changelog documents CLAUDE_CODE_ENABLE_TODO_TOOLS=1 as the opt-in override. A workflow that asks the model to use those tools, or checks for them through an integration, should test the model-version combination instead of assuming that the tool list is stable. 3

Second, version 2.1.234 adds automatic session continuation when a claude.ai usage limit resets, with a configuration option to turn it off. The same release adds a GitLab merge-request badge, improves session-scoped permission handling for background subagents, and hardens remote file reads, session restore, CLAUDE.md includes, workflow scripts, and file uploads against Windows NT-namespace paths. 3

Version 2.1.235 continues in the same direction. It adds optional prompt spellcheck using an installed aspell, hunspell, or ispell; fixes whole-prompt-cache invalidation after a language-server disconnect or reconnect; and improves permission dialogs so the displayed text and “don’t ask again” scope match the grant more reliably. It also refuses oversized SendMessage payloads up front and reduces memory and CPU work while cloud sessions run in the background. 3

The operational implication is that a Claude Code upgrade now needs more than a smoke test that generates a patch. Run a long session through a language-server reconnect, test a background subagent with a session-scoped denial, resume after a usage-limit reset, and exercise any automation that depends on todo tools. For teams using GitLab, also check that the MR status displayed by the CLI matches the status that reviewers see in the source-control system. These tests expose failures at the boundaries where agent work becomes asynchronous, remote, or policy-controlled.

What to review before the next issue

Cursor ownership: Map each pilot repository’s source of truth, read/write principals, PR destination, required checks, CI runner, preview deployment, and enterprise opt-out state. Do not treat a synced GitHub repository as a second independent source.
JetBrains policy: Export the intended plugin, marketplace, MCP, telemetry, and permission settings. Compare them with the settings that actually appear in a developer’s IDE, including the managed-value precedence.
Claude compatibility: Test model-specific tool availability, especially any workflow that depends on todo or task-tracking tools. Keep the documented override in mind, but do not enable it without checking the team’s model and plan behavior.
Session recovery: Test Claude Code after a language-server reconnect, a background-task permission prompt, a usage-limit reset, and a remote-session handoff. Record whether the human can still identify the active session, approval scope, and final workspace.
Windsurf signal quality: Record v2.12.27 as a maintenance release only. Do not infer a new capability from a changelog that names no concrete change.

Coverage notes

The official Aider history had no dated release entry in this window, and the accessible Continue.dev releases page showed older releases rather than an August 14–18 entry. 5 6

The verifiable Windsurf item came from the current Windsurf JetBrains plugin changelog hosted in Devin’s documentation, not from a feature-level general Windsurf release note. Its date and version are clear, but its description is intentionally too sparse to support a larger product claim. 4

The common thread is control over the agent’s operating surface. Cursor is making the repository and delivery path part of the agent workspace; GitHub is making IDE configuration enforceable; Claude Code is tightening the behavior of remote, background, and model-dependent sessions. Teams comparing tools should therefore ask not only “which agent is better?” but also “who can change what, where is the evidence, and how does the system fail?”