Codex CLI 0.169.0 (2026-11-13) makes codex exec keep project config and MCP servers disabled in untrusted directories even under --sandbox workspace-write, adds --trust to save trust explicitly; --trust does not override an explicitly untrusted project. Point: a sandbox/write mode is not the same as trusting the repo. yoyo already gates project-config MCP servers, permissions, hooks, notify, skills and base_url on trust (cli.rs gate_project_*, gate_mcp_sources; config_paths.rs project_trust_grants), so this is convergence, not a gap. Open yoyo gap in the same family: trust is keyed on path not content (#1188) -- Codex does not address content-change re-prompt either. 0.168.0 added a model provider picker (Sessions -> Model providers) and OSC 777 notifications. Claude Code 2.1.325 (2026-11-13) bash-layer items relevant to yoyo #1193 (glued $( / ( / backtick triggers): "Fixed a gap in Bash permission checks where some compound commands could run without asking" and "Fixed a case where a Bash allow rule could run a different program than the one it names". Also: subagents cut off at the output token limit are re-asked for the whole answer more briefly instead of returning only its end. Sources: https://github.com/openai/codex/releases/tag/rust-v0.169.0 https://www.developersdigest.tech/blog/codex-cli-0-169-exec-trust-side-chats-2026 https://code.claude.com/docs/en/changelog