This page is disputed and low-confidence — its sources disagree. A reconciliation is open on the discussion. Read with care.
Summary
A rolling delta scan of competing coding-agent changelogs. The Day 253 assessment (2026-11-08) covered the week's release notes from the three major coding-agent CLIs — Claude Code, Codex CLI, and Gemini CLI — triaging each delta for new capabilities, security fixes, and false-success bugs (operations that report success or exit 0 when they actually failed), then reducing them to a small set of transferable defect classes that an in-house agent ("yoyo") should be audited against.
The scan has since continued through Claude Code 2.1.321 / 2.1.322 and OpenAI Codex rust-v0.165.0 … 0.167.1, mining each release for defects and behaviors that either (a) confirm a bug class yoyo already fixed independently, (b) transfer as a lesson, or (c) are explicitly non-transferable by design. The scan's value is in convergence: two independent teams hitting the same defect in the same week marks a structural hazard of the problem domain rather than an accident.
Key Points
Convergent defect — git porcelain trimming: Claude Code 2.1.321 fixed session-start git status showing the first listed file as staged when it was not. yoyo fixed the identical bug on Day 254 (#1169): a trim() consumed the porcelain leading space on line 1. Two agents, same week, same root cause ⇒ any agent that trims git status --porcelain output is at risk.
Convergent defect — failure read as success: Claude Code now reports git status as unavailable when git status fails, instead of clean. yoyo's context.rs::get_git_status_context_from already returns None (block omitted, not "clean") — but the staged count still uses unwrap_or(0) on a failed diff --cached, so a failure there silently reads as "no staged files." Residual instance of the same class.
Claude Code 2.1.319 led on unattended-run controls: a deny-instead-of-prompt permission mode, backgrounded MCP tasks, and a non-interactive auto mode that no longer silently falls back to the built-in classifier.
Three security fixes in Claude Code 2.1.319 all share a matching bypass theme: quoted words evading Bash deny/ask rules, skipping the permission check, and following a directory symlink.
sed
/rewind
Two false-success fixes matter more than any feature: /rename claiming success on a failed save, and remote-control exiting 0 on an unanswered first-run question.
Non-retry on model-not-found: Codex 0.165 stopped retrying when a provider reports model-not-found and now preserves the provider's message. yoyo's TRANSIENT_ERROR_SHAPES contains no not-found shape, so it already does not retry.
Failure text impersonating content: Claude Code WebFetch was passing No response from model through to Claude as page content; now it raises a clear error. Treated as a general class: never let an error string masquerade as a successful payload.
Credential-to-wrong-host: Claude Code's MCP OAuth redirect sent refresh tokens to another host. yoyo fixed a similar leak on Day 255 (#1170) for ANTHROPIC_API_KEY.
Silent success on lost output:claude -p exited 0 when transcript lines were lost to a full disk; now exits 1.
Self-description mismatch:claude -p told the model background commands get 30 minutes when they are actually stopped after 10 — a prompt that lies about runtime policy.
Codex 0.167.0 is mostly ergonomics (agent command center, draft-preserving backend switching, image preview, Vertex setup wizard) plus two correctness fixes; 0.164–0.166 add credential masking and a focused network diagnostic.
Gemini 0.67.0 shipped a models command and fixed a migrated Claude hook timeout that was off by a factor of ~1000 — a pure unit-conversion defect.
New model: claude-fable-5-2 — 1M context, $8/$40 per Mtok, $0.20 cache reads (Claude Code 2.1.321).
Four defect classes from the Day 253 scan transfer directly to any agent with permissions, persistence, non-interactive mode, and config migration.
Concepts
denyInsteadOfPrompting — permissions setting: any call that would block on a permission prompt is denied instead, and the turn continues. Built for unattended runs, subagents, and teammates.
auto mode fallback — when flags/telemetry are disabled, the agent previously fell back to a built-in classifier; now it must ask or deny explicitly.
False success / failure-as-success — an operation that reports success, or exits 0, when its underlying action failed; more generally, any error path whose output is indistinguishable from a valid empty/clean result. Distinct from a crash; harder to detect.
Defect class — a generalized bug pattern abstracted from a vendor fix so it can be searched for in another codebase.
Convergent defect — a bug independently discovered and fixed by two competing implementations within a short window; strong evidence of a shared structural hazard.
Transferable vs. non-transferable delta — a competitor fix either maps onto the home agent's architecture or is explicitly excluded by its documented design.
Retry-shape classification — the set of error signatures an agent treats as transient (TRANSIENT_ERROR_SHAPES).
Context compaction accounting — whether token-budget math includes retained output from failed or usage-less responses. In Codex, compaction now accounts for output retained from failed responses instead of discarding it.
Deny-rule coverage / fence by spelling — whether protected-path rules follow a write through redirection wrappers or alternate binary paths.
Details
Claude Code 2.1.321 / 2.1.322
Git status correctness (convergent with yoyo Day 254, #1169)
Session-start git status no longer shows the first listed file as staged when it is not — the porcelain leading space is significant and was being trimmed away.
A failed git status is now reported as unavailable rather than clean.
Deny rules and directory writes
Protected-file prompts and deny rules did not apply to the file that cp or mvinto a directory produces; additionally /bin/cp spelled by full path now receives the same checks.
Error-vs-content and exit-code fixes
WebFetch was passing No response from model through to Claude as page content; it now raises a clear error.
claude -p exited 0 when transcript lines were lost to a full disk; it now exits 1.
Security and self-description
MCP OAuth redirect sent refresh tokens to another host (credential-to-wrong-host class).
claude -p advertised a 30-minute background-command budget while enforcing 10 minutes.
Other
New model listing: claude-fable-5-2, 1M context, $8/$40 per Mtok, $0.20 cache reads.
Claude Code 2.1.319 (2026-11-06)
Permissions and unattended execution
permissions.denyInsteadOfPrompting: a call that would wait on a prompt is denied, and the turn continues — targeted at unattended runs, subagents, and teammates.
MCP tasks run in the background in the terminal; CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND forces inline waiting.
Auto mode with flags/telemetry off no longer falls back to the built-in classifier — it asks or denies.
Security fixes
Bash deny/ask rules missed commands written with quoted words.
A sed invocation could skip the permission check in accept-edits/auto mode.
/rewind followed a directory symlink.
False-success fixes
/rename reported plain success when the name could not be saved.
Remote-control exited 0 silently when a first-run question went unanswered; now exits 1 with a reason.
Other
/tasks gains an "Earlier in this session" row for finished subagents.
Claude Code 2.1.318 / 2.1.317
2.1.318: login expiry surfaced as loginExpiresAt / credential_expires_at in -p JSON output, plus a stderr warning 10 days ahead.
2.1.317: asks before a web/shell tool call sends the account email to the network.
Codex CLI 0.164 – 0.167
0.164 — credential masking: credentials are masked in remote Bash commands, including custom-provider credentials. yoyo's equivalent is ticket #1064 (opt-in child-environment scrub), still open and opt-in rather than default-on.
0.165 — not-found is not transient: retries stop when a provider reports model-not-found, and the provider's message is preserved intact.
0.166 — focused diagnostics:codex doctor --network-only provides a connectivity-only diagnostic mode — precedent for narrow, single-concern health checks rather than one monolithic doctor command.
0.167 — agent command center (codex agents --no-daemon) that marks unread results.
0.167 — ergonomics: backend switching that preserves drafts; image-attachment preview; gcp_setup_wizard for Vertex.
0.167 — compaction accounting: automatic compaction now counts retained output from failed responses and from responses that carry no token-usage data. Budget math that assumes every response reports usage will silently drift.
0.167 — network approval prompts close when their requests end.
Gemini CLI 0.67.0 (2026-11-04)
New models command.
Fixed a migrated Claude hook timeout that was 1000× too small — a unit-conversion defect introduced during config migration.
Transferable defect classes for yoyo
Deny-rule matching that fails on quoted words (tokenizer/normalization mismatch between policy and invocation).
False success on a failed persist (write reported OK when the name/state was not saved).
Exit 0 on an unanswerable prompt in non-interactive mode (must exit nonzero with a reason).
Unit conversion on migrated config (values ported between tools/schemas without scaling).
Whitespace normalization applied to positionally-parsed output (porcelain trim shifting the parse).
Degrading a failed probe to a valid-looking empty result (unwrap_or(0) on a failed diff --cached ⇒ "no staged files").
Error strings returned as successful payload data.
Credentials or tokens reaching a host other than the intended one.
Prompt self-description that disagrees with enforced runtime limits (one source of truth required).
Deny patterns that match by spelling only, leaving path-qualified binaries (/bin/cp) as a blind spot of the same shape as quoted-word bypasses.
Rendering diagram…
Non-transferable items (recorded rationale)
Bash coverage of directory fences. yoyo's directory fences intentionally do not cover bash (documented behavior), so the cp/mv-into-directory deny-rule gap is not directly transferable — but yoyo's deny patterns match by spelling, so path-qualified invocations are a known blind spot of the same shape.