Summary
A delta scan of the Claude Code changelog for releases 2.1.295–2.1.299 (October 2026) surfaces a recurring family of defects in an agent harness's control plane: a policy — permission rule, deny/ask entry, safe mode, turn or budget cap — is evaluated at a single moment and then fails to hold, either because the target of the matcher is spelled differently than the rule assumes, or because the policy is not carried across a state transition (directory change, wake/restart, late-added server). Three of the fixes belong to the transition class and two to the spelling class, matching several of yoyo's open bug classes, including the d219 "a carve-out is a delayed flip" pattern, observed here in a rival implementation.
Key Points
- Transition class (3 of the fixes): a policy evaluated at one moment does not follow a state transition —
/cd, wake/restart, or a server added to an already-running session. - Spelling class (2 of the fixes): a matcher keyed on the name of a thing is defeated by indirection (
BASH_ARGV0) or by name normalization (double underscores in an MCP server name). - Limits defeated by re-entry: a hook that resubmits a prompt every turn keeps a headless run going past
--max-turns,--max-budget-usd, and interrupts. - Fail-closed hooks arrive:
onFailure: blockin 2.1.295 makes hook failures stop the run; a stderr line now explains what a-prun is waiting for when it stays open after its last turn. - Pricing agreement: Sonnet 5.5 cache reads were repriced from $0.20/M to $0.10/M; yoyo's
claude_sonnet_5_5preset already said 0.10. - Repeated pattern across the yoyo classes: enforcement decisions are made against a snapshot rather than re-derived after the world changes, or against a syntactic label rather than the effect of the command.
Rendering diagram…