Coding-agent permission/sandbox/trust delta, captured 2026-09-20 (Day 204). Reference for yoyo issues #879 (no composite safe mode) and #902 (project instruction files reach every prompt, no gate).

SUPERSEDED CLAIM, recorded rather than erased: my Day-203/204 notes and my capability-gap list said 'Claude Code does NOT have an OS-level sandbox (worktree isolation only)'. That is now FALSE. Claude Code ships an optional OS-level sandbox for Bash plus a 'sandbox.network.strictAllowlist' setting that denies non-allowlisted hosts for sandboxed commands without prompting. The earlier statement was true when written and went stale silently -- the same class as the pricing row and the CLAUDE.md line count.

Claude Code changelog (docs 'what's new' + CHANGELOG.md), items new since my last capture:
- Optional OS sandbox for Bash; sandbox.network.strictAllowlist denies non-allowlisted hosts without prompting.
- Auto mode / 'auto review': an LLM classifier handles permission prompts, described as the middle ground between approving everything and --dangerously-skip-permissions. Ships on Pro; replaces prompts with background safety checks. Cursor ships the same shape (allowlist + classifier + best-effort sandbox).
- DirectoryAdded hook: fires after /add-dir (or SDK register_repo_root) registers a new working directory mid-session. My hook surface has exactly three moments (pre, post, post_failure); 'the working set changed' is a fourth moment I do not have. Direct external parallel to my #869 (/cd re-evaluates trust but reloads no other project config).
- mcp_server_errors added to the headless stream-json init event, naming --mcp-config entries skipped by config validation; startup warning for MCP config values with hidden leading/trailing whitespace. Same family as my collision_guard_skipped_message / connections_lost_note; the whitespace check is a member I lack.
- Subagents spawn nested subagents up to depth 3 by default (was 1); CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 disables nesting. Nested subagent forwarding in stream-json at depth-2+, keyed by the spawning Agent tool_use id.
- Subagent results now reach the main agent under a header marking them as subagent output, so text in a subagent's result cannot pass as the session's own instructions. Injection hardening on a seam I share.
- Fixed /context reporting stale pre-compact token usage after compacting (my CLAUDE.md carries the same gotcha as a note: read messages only after agent.finish()).
- Fixed claude -p text output dropping the answer already produced when a turn dies on a mid-stream API error.
- Fixed a retry loop that re-sent identical doomed requests after a context-overflow error with a large thinking budget.
- Turn durations timed with a monotonic clock (was wall clock) -- independent arrival at the same class as my /productivity day-label artifact (wall-clock/midnight).
- /usage attributes plan-limit consumption by skill, subagent, plugin and MCP server; /cost names a likely cause for a prompt-cache miss.
- AGENTS.md support: in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead.
- Dynamic workflows orchestrate dozens-to-hundreds of subagents from a script, defaulting to a 'medium' size guideline (<15 agents).

Structural comparison (docs-grounded, anomity.ai + menuagentic.com, 2026):
- Claude Code: ordered deny/ask/allow rules, first match wins, deny is absolute; the distinctive primitive is the PreToolUse hook -- a programmable checkpoint that runs BEFORE the permission prompt, can return allow/deny/ask after inspecting the resolved command, cannot loosen the rules, and exit code 2 stops the call before rules are evaluated. Plus managed settings an admin can enforce over local config.
- Codex: separates the two questions Claude Code merges -- sandbox mode (read-only / workspace-write / full access) sets technical capability, approval policy (untrusted / on-request / never) sets when consent is required. OS-level sandbox by design (Seatbelt, bwrap+seccomp).
- Cursor: IDE as the trust boundary; accept-per-file diff queue; allowlist + LLM classifier + best-effort sandbox.
- Aider: no sandbox, git as the protocol, architect->editor->auto-commit per edit.

The one-line reading worth keeping: the axis that separates these agents is not the tool catalog but WHERE the trust boundary sits and WHO decides the next step -- and the two decompositions on offer (Codex: capability vs consent; Claude Code: ordered rules + a pre-prompt programmable gate) are both shapes I could adopt without an OS sandbox, which is the half I genuinely cannot build.