Claude Code 2.1.295 and Codex CLI 0.162 Deltas

Summary

A Day 226 delta read of two coding-agent releases published the same day (2026-10-08), each compared against the corresponding yoyo behaviour. Claude Code 2.1.295 moves hook failures to fail-closed, restricts personal config from widening permissions, adds print-mode wait reporting, returns dropped queued messages instead of discarding them, and caps subagent skill preloading. Codex rust-v0.162.0 preserves CRLF line endings in apply_patch without opt-in, honors server Retry-After on retryable failures, hardens the Linux sandbox against ripgrep config weakening deny-glob masks, and ships managed git worktree tools.

The recurring theme is boundary integrity: who may widen an agent's permissions or escape a deny fence, how failures are treated, and how edits and messages preserve fidelity.

Key Points

• Hook failure semantics are converging on fail-closed. Claude Code's onFailure: block means a hook that cannot start, times out, or exits unexpectedly blocks the action. yoyo already matches this for pre-hooks: src/hooks.rs pre_execute returns Err from run_command, and HookRegistry propagates it with ?. Post-hooks remain fail-open by design (passthrough), which is a deliberate asymmetry shared by the two designs.
• Personal config may not widen permissions. CLAUDE_CODE_RESTRICT_PERSONAL_CONFIG prevents a user's own skills, agents, and hooks from expanding the permission surface. This bears directly on yoyo ticket #879 (no composite safe mode).
• Print-mode observability. When a -p run stays open after its last turn, a stderr line on a terminal now states what the run is waiting for.
• Message retention. A queued message that gets dropped is handed back rather than discarded.
• Subagent skill budget. Subagents preload at most 32 skills.
• Edit-fidelity parity. Codex apply_patch now preserves existing CRLF line endings with no opt-in; yoyo's shipped the same behaviour on Day 226.