Summary
A four-release window of the Claude Code CLI (2.1.305 through 2.1.308, 2.1.308 being latest as of 2026-10-22) whose changes cluster around three themes: making refusals first-class telemetry, keying retry safety on tool idempotency, and fixing attribution and disclosure bugs (which model a subagent actually ran on, which command was denied, why a write failed). The source annotates each item against a companion agent system ("yoyo"), noting where yoyo already made the same design call and where it still has a gap.
Key Points
claude_code.safety_eventis a new OpenTelemetry event emitted for each tool call that a permission rule, auto mode, safety check, hook, or sandbox stopped, prompted, or sent back. Refusals become recorded, queryable events rather than only user-visible interruptions.- Retries are now idempotency-scoped. HTTP MCP tool calls were being sent twice when the connection closed mid-call; the fix retries only read-only/idempotent tools.
- Unparseable tool calls are retried up to twice before the turn ends.
- Fork subagents launched together are each told which launch is their own, disambiguating concurrent spawns.
/permissionsRecently-denied now names the specific denied command.- Fallback model attribution was wrong in 2.1.305 — Claude named the pre-fallback model for a subagent; the correction makes the actual model name surface.
- Disk-full errors now report "disk full and nothing ran" instead of raw
ENOSPC. - Subagent worktree cleanup: unchanged worktrees were sometimes left behind.
Concepts
- Safety event / refusal telemetry — per-tool-call OTel record of any gate that blocked, prompted, or returned a call.
- Deterministic refusal — a bash refusal classified as non-recoverable: no recovery hint, no auto-retry (yoyo's Day 236 / #1068 classification).