[WIP][vibe-coded] Update Cloud CLI to 1.37.2

[louisremi]

Hello, I wanted to see how hard it would be to let Claude to try to update Cloud CLI to its latest version, mainly because I was annoyed by the lack of a "gpt-5.6" option in the model picker.

I let Claude run for a few hours, and it produced two new docker images. I've deployed the full image on my NAS, and I'm testing. So far I haven't encountered any problem, and the gpt-5.6 option is indeed present.

This PR is not meant to be merged as is, as it has been entirely vibecoded. I'm opening it mainly to make you aware of my experiment. Feel free to throw it away and start over if you believe I went in the wrong direction (I'd love an explanation though), or maybe see if it is worth improving?

Claude has been thorough in maintaining the changelog. I'm copying it below.

Changed

• Updated Claude Code to the latest stable release, 2.1.231, and Cursor Agent to build 2026.08.11-e8db854, retaining checksum verification for both Linux architectures.
• Updated the vendored CloudCLI baseline from 1.36.3 to 1.37.2, which adds the gpt-5.6 model family (gpt-5.6, -sol, -luna, -terra) to the provider model picker.
• Rebased the account-management bridge onto CloudCLI's modular server refactor. Password rotation and session-token revocation now live in the auth module: auth.service.ts owns changePassword, auth.routes.ts exposes /api/auth/change-password, and auth.module.ts injects the repository, app-config, and token-generation dependencies.
• Retargeted the Docker-build CloudCLI patches at the modular layout. openai-codex.js became codex-runtime.provider.js, server/cli.js became the cli module, and the /api/system/update route moved into the system module.
• Extended Multer field-nesting hardening to CloudCLI 1.37.x's fourth multipart parser, the chat attachment upload.
• Raised CloudCLI's nested nanoid to 3.3.18, ip-address to 10.5.0, and fast-uri to 3.1.6 so the Docker overlays no longer downgrade the verified artifact.
• Updated CloudCLI's reviewed production dependency tree with compatible security fixes for @remix-run/router, brace-expansion, glob, ip-address, and React Router, keeping the artifact's production audit at 0 Critical and 0 High.
• Moved the CloudCLI entrypoint symlink to dist-server/server/modules/cli/cli.js, which is where 1.37.x publishes its bin target.
• Updated the pinned Debian Chromium trio from 151.0.7922.108-1deb12u1 to 151.0.7922.173-1deb12u1. Bookworm security superseded the previous upload and removed it from the archive, so the pinned build could no longer resolve; the replacement is a later security release on the same branch.

TODO

There was a problem exposed by the evaluator, and to be honest I have no idea how to fix it. Here's what Claude had to say on the subject:

The evaluator exposed a reproducibility blocker: the newly refreshed 2026-08-25 Grype DB reports 12 unresolved Critical findings in full (3 in slim) plus hundreds of new Highs, largely advisories newer than the committed ledger; it also finds Debian package drift (xserver-common/xvfb u13 vs ledger’s u12). Resolving these would require new severity decisions and/or High exceptions, which your instruction explicitly withholds. I’m running the non-security source gates now and checking whether a preserved older DB snapshot exists before deciding whether the release can safely be finalized.