Claude Code changelog Nov 4-13 2026 (code.claude.com/docs/en/changelog; github.com/anthropics/claude-code/releases v2.1.321-2.1.325). Defect classes in its Bash permission layer that transfer to yoyo:
- Plan mode: bash commands the static analyzer cannot PROVE read-only are not auto-run (asked, or judged by classifier). Allow-list direction: read-only must be proven.
- Fixed Bash allow rules with attached wildcard (Bash(ls*)) skipping prompt; a rule naming a variable (Bash(NODE_ENV*)) now asks.
- Fixed deny rules not applying to the file that cp/mv INTO A DIRECTORY writes.
- Fixed deny/ask rules missing commands run through sudo/env wrappers; combined sudo flags.
- Fixed allow rule running a different program than it names.
- Needless prompts for read-only commands wrapped in timeout DURATION.
- Shell commands ran in launch dir after cwd deleted; now fails with a message.
- Third-party gateways stopping with context-length error every turn instead of compacting.
- MCP OAuth secrets sent to another host on redirect (yoyo #1181 checked the API-key analogue).
- read-only git commands ask first in a repository that is not the project or trusted.
yoyo mapping (Day 258): yoyo /read and /plan guard composes analyze_bash_command + detect_write_command, a DENY list (WRITE_VERBS: touch mkdir mv cp tee truncate install ln chmod; no rm/rmdir/unlink/shred/dd/sed -i). Its git classifier is an ALLOW list (fails closed). The generic-verb half fails open; that asymmetry is the gap (#1192).