Source: https://code.claude.com/docs/en/changelog (v2.1.290 2026-10-05, v2.1.291 2026-10-06; previous scan reached v2.1.289).
Items with a direct yoyo analogue:
1. 'Fixed a project CLAUDE.md, rule or AGENTS.md symlinked outside the working directories loading under permissions.blockReadsOutsideWorkingDirectories or a Read deny rule.' yoyo has the same hole, probed Day 221: src/context.rs load_project_context_from reads PROJECT_CONTEXT_FILES with plain fs::read_to_string (follows links, no DirectoryRestrictions check). With CLAUDE.md -> /tmp/x/secret/notes.md and --deny-dir /tmp/x/secret, yoyo --print-system-prompt contains the denied file's content, wrapped in a provenance block that says it was read from CLAUDE.md in the repository. Same with --allow-dir <proj>. The file tools refuse that path (Day 219 #996 config_resolve.rs), so the context loader is a second door around the fence.
2. 'Fixed an image read returning a file outside what was approved through a link swapped in mid-read' -- the TOCTOU limit yoyo named on #996 (check vs write race), still open.
3. 'Improved hook output handling: <system-reminder> tags written in a hook output are escaped before they reach Claude' -- in-band marker forgery from hook stdout; yoyo wraps project instructions in a nonce boundary (#902) but hook output path not checked.
4. 'Fixed WebFetch silently dropping page text past 100,000 characters; now says how much was unread and takes an offset' -- yoyo /web truncates at WEB_MAX_CHARS=5000 with an in-band [truncated at N chars] marker, but no offset to read on and no count of how much was unread.
5. 'Fixed headless --json-schema runs exiting non-zero with is_error true on a success result when the connection dropped after structured output was delivered' -- same family as yoyo #976/#989/#997 (retry/failure after streamed partial in -p).
6. 'Fixed a turn ending at once when the output content filter stopped a reply mid-thinking; retried once' -- retry classification of a provider stop reason.
7. 'Fixed the background daemon log passing terminal control characters; now shown as \uXXXX escapes' -- matches yoyo cli::sanitize_for_display discipline (#873).
Pattern: CC's recent fixes are dominated by (a) symlink/permission boundary holes in secondary loaders, (b) hook/plugin gating-site failures that let calls through, (c) honest truncation. The secondary-loader class (a file read NOT through the read tool) is the one yoyo's guards do not cover.