A filtered scan of two upstream agent-CLI releases — Claude Code 2.1.300–2.1.303 (Oct 14–18, 2026) and Codex rust-v0.163.0 — keeping only changelog items that map onto yoyo (the project under development, via its yoagent library). Each upstream fix is annotated with the corresponding yoyo/yoagent status: already covered, already fixed on a given day, or unprobed gap. The result is a short list of confirmed-safe areas and a smaller list of real risks to act on.
Key Points
Most file-read hazards were already closed in yoagent 0.25.9: read_file requires a regular file before the image branch, caps images at 20MB (stricter than upstream's 128MB), and uses read_to_string, which errors on non-UTF-8 rather than returning binary garbage as text.
Search-failure signalling is aligned: Claude Code 2.1.301 stopped reporting "no matches" when rg failed before producing results; yoyo's /grep was fixed on Day 221 and yoagent search reads rg exit code 2.
The one unprobed gap is MCP schema robustness: 2.1.300 fixed a conversation where a single MCP tool's rejected input schema caused every turn to fail with HTTP 400; yoyo has no equivalent probe and would likely break the same way.
Two recurring failure classes are named and tracked: exit-code honesty (claude daemon stop printed "stopped" while the service kept running — equivalent to yoyo issue #982) and wrong-reason reporting (a tool call cut off mid permission check was surfaced to the model as "rejected by the user").
Codex confirms two yoyo positions: prompt completion when a child holds an output pipe open (yoyo fixed Day 232, #1049) and searchable, restart-marked configuration.
Concepts
yoagent — the library implementing yoyo's tool layer (read_file, search wrappers); version 0.25.9 referenced here.
yoyo — the host agent; tracks issues by number (e.g. #982, #1049) and fixes by working day (Day 221, Day 232).
Error-honesty / exit-code honesty — reporting a failure as the reason it actually failed (error vs. "no matches"; stopped vs. still running).
Wrong-reason reporting — telling the model a misleading cause for a missing tool result, which distorts its next decision.
MCP input schema — the per-tool JSON schema declared by an MCP server; one malformed schema can poison every request in a session.
Transcript reproducibility — recording system prompt, tool list, and parameters per request so a shared transcript can replay it.
Hook updatedInput — rewritten tool arguments supplied by a hook, which must be validated exactly like model-authored input.
Details
Mapping table
Upstream item
Version
yoyo / yoagent status
Read tool refuses images >128MB, doesn't load pipes/devices named like images
2.1.302
Covered — require_regular_file before image branch, 20MB cap
Grep/Glob return an error instead of "no matches" when the search program failed
Read tool no longer reads binary files (.xlsm, .parquet, .epub, .heic) as text
2.1.301
Covered — read_to_string errors on non-UTF-8
One bad MCP tool schema caused every turn to 400; tool now sent without parameters
2.1.300
Unprobed gap — likely kills every turn
"Daemon stop" printed "stopped" while the service kept running; now waits, force-kills, exits 1
2.1.300
Same class as yoyo #982
Tool call cut off mid permission check was reported as "rejected by the user"
2.1.301
Wrong-reason class; not yet matched
Force-kill background commands still alive 1.5s after stop request
2.1.300
Lifecycle hardening
Subcommands exited before a queued settings write finished (lost change, stray .tmp)
2.1.302
Settings-write durability
Hooks' updatedInput validated like model input; unknown keys dropped, rejected input denies the call
2.1.300
Trust boundary: hook args are untrusted input
Local transcripts record system prompt, tools, params for request reproduction
2.1.300
Debuggability / replay
Claude not told about an MCP server's tools until the next call when it connected after compaction
2.1.300
Stale tool inventory after compaction
Codex: /config searchable with restart-required marking
0.163.0
Config UX parity
Codex: local commands finish promptly when a child holds an output pipe open
0.163.0
Fixed Day 232 (#1049)
Codex: independent read-only tools run in parallel; resume restores permissions/network approvals
0.163.0
Concurrency + resume fidelity
The actionable gap: MCP schema poisoning
The highest-value item is the 2.1.300 fix in which a single MCP tool whose input schema the API rejected made every turn of the conversation fail with a 400. Upstream's remedy is degradation, not repair: the offending tool is sent without parameters so the rest of the session survives. yoyo has no probe for this, and because tool schemas are sent on each request, one bad declaration from a connected server plausibly takes down the whole session rather than one call. A probe would register an MCP server exposing a deliberately invalid schema and assert that other tools remain usable.
Failure-honesty patterns worth copying
Two upstream bugs share a shape yoyo already tracks:
Exit-code honesty. The daemon stop command reported success while the process survived. The fix is behavioral, not cosmetic: wait, escalate to force-kill, and return exit 1 if the process is still present. This is the same class as yoyo #982.
Wrong-reason reporting. When a tool call was interrupted during a permission check, the model was told the user had rejected it. The model then reasons about a fabricated human decision. The correct signal is "interrupted / inconclusive", never a fabricated rejection.
A third, adjacent item — MCP servers connecting after compaction leaving Claude unaware of their tools until the next call — is the same family: the model acting on a stale or invented picture of its environment.
Process and trust-boundary hardening
Background command teardown (2.1.300): a stop request now escalates to force-kill after a 1.5s grace period, so orphaned processes don't outlive the session.
Hook input validation (2.1.300): updatedInput from hooks is treated as untrusted — unknown keys are dropped and input that fails validation denies the call entirely. Hooks sit on the trust boundary and must not be able to inject arbitrary parameters.
Settings-write durability (2.1.302): subcommands could exit before a queued settings write completed, losing the change or leaving a stray .tmp file — a flush-before-exit requirement.
Codex parity notes
Codex 0.163.0 contributes three confirmations rather than new risks: searchable /config entries annotated with whether a restart is required; prompt termination of local commands when a child process holds the output pipe open (the exact issue yoyo closed on Day 232 as #1049); parallel execution of independent read-only tools; and resume restoring permission and network approvals rather than silently resetting them — a resume-fidelity concern that applies equally to yoyo.