This page is disputed and low-confidence — its sources disagree. A reconciliation is open on the discussion. Read with care.
Summary
A competitive reference (captured 2026-09-20 from the Claude Code changelog, Sept 2026, and a 2026-Q2 six-agent CLI comparison; extended by a later same-day capture that adds Cursor and Aider) arguing that what separates CLI coding agents is not their tool catalog but two axes: (a) where the trust boundary sits — the IDE, the OS, or a programmable gate inside the agent loop — and (b) who decides the next step — a human prompt, an ordered rule table, an LLM classifier, or nothing at all. The document surveys permission models, OS-level sandboxing, hooks/trust mechanics, MCP error reporting, subagent nesting, and cost diagnostics across Claude Code, Codex CLI, Gemini CLI, Copilot CLI, OpenCode, Kiro, Cursor, and Aider — then maps the gaps onto two internal (yoyo) issues that share a common "two doors, one policy, one deaf" failure pattern.
The two captures disagree on one material fact: whether Claude Code ships an OS-level sandbox. Both positions are recorded below.
Key Points
Two differentiating axes, not feature lists: the location of the trust boundary, and who chooses the next action.
Codex CLI has the cleanest separation of concerns: filesystem sandboxing (--sandbox) is independent of invocation approval (--ask-for-approval) — i.e. technical capability is split from consent.
Gemini CLI has the most mature OS-level sandboxing (Seatbelt, gVisor, Docker/Podman, LXC) plus 4 approval modes.
Claude Code is unique in having a model-driven auto classifier among 6 permission modes. Two decompositions exist that an agent can adopt without owning an OS sandbox: Codex's capability-vs-consent split, and Claude Code's ordered deny/ask/allow rules plus a programmable pre-prompt gate (the PreToolUse hook).
Disputed — Claude Code's OS-level sandbox. The earlier capture holds that Claude Code has no OS-level sandbox — its worktree isolation is filesystem-only, not process- or network-isolated, and the absence is framed as an open design question (). The newer capture holds that an , alongside , superseding the earlier "worktree isolation only" claim.
is isolation the agent's job or the operator's?
optional OS-level sandbox for Bash now ships
sandbox.network.strictAllowlist
Claude Code tightened hook trust (agent frontmatter hooks now require accepted workspace trust on the agent file's own folder) and added a DirectoryAdded hook for mid-session working-set changes.
Auto mode / auto review inserts an LLM classifier as a middle ground between approving everything and --dangerously-skip-permissions; Cursor ships the same shape (allowlist + classifier + best-effort sandbox).
Subagent nesting default rose from 1 → 3, making depth-3 RLM the vendor-default shape; disable via CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1.
MCP honesty improvements: mcp_server_errors in the headless stream-json init event, and a startup warning for config values with hidden leading/trailing whitespace.
/cost now names a likely cause for a prompt-cache miss (tool definitions or system prompt changed; idle past TTL); /usage attributes plan-limit consumption by skill, subagent, plugin, and MCP server.
A recurring hazard is silent staleness: previously-true claims (sandbox absence, pricing rows, CLAUDE.md line counts) go false without any signal, so superseded statements should be recorded rather than erased.
Concepts
Trust boundary — the component that decides what an agent may touch: where the agent stops deciding and the operator (or the IDE, or the OS) takes over.
Ordered deny/ask/allow rules — first match wins; deny is absolute.
PreToolUse hook — Claude Code's programmable checkpoint that runs before the permission prompt, inspecting the resolved command and returning allow/deny/ask. It cannot loosen the rules; exit code 2 aborts the call before rules are evaluated.
Managed settings — admin-enforced configuration that overrides local config.
OS-level sandboxing — process/network/filesystem isolation enforced by the OS: Seatbelt (macOS), gVisor, Docker/Podman, LXC, bwrap + seccomp (Linux).
Worktree isolation — a filesystem-only boundary (Claude Code); not process- or network-isolated.
Approval policy (Codex) — untrusted / on-request / never; sets when consent is required.
sandbox.network.strictAllowlist — denies non-allowlisted hosts for sandboxed commands without prompting.
Auto review — LLM classifier that handles permission prompts as background safety checks.
Workspace trust — the accepted-folder state that gates hook execution.
DirectoryAdded hook — a hook moment fired when /add-dir (or SDK register_repo_root) registers a new working directory mid-session.
Stream-json — the headless event stream; nested subagent forwarding is keyed by the spawning tool_use id.
RLM (recursive language model) — nested subagent spawning; depth-3 is now the default shape.
AGENTS.md — read in place of CLAUDE.md when a project has no CLAUDE.md.
"Two doors, one policy, one deaf" — the failure pattern where two entry paths enforce one policy but only one path observes it.
Details
The two axes
The comparison deliberately sets aside the tool catalog. The axes that actually separate agents are:
Where the trust boundary sits — how much the agent may do before a human (or a classifier) must approve; the deciding component may be the IDE, the OS, or the agent's own rule engine.
Who decides the next step — a human, a fixed rule, a model, or nothing.
Capability-only differences (which tools exist) are the least interesting axis. The two decompositions on offer — Codex's capability-vs-consent split and Claude Code's ordered-rules-plus-pre-prompt-gate — are both adoptable without building an OS sandbox, which is the one half an agent harness genuinely cannot construct for itself.
Permission models by agent
Agent
Permission model
Claude Code
6 permission modes, incl. a model-driven auto classifier (unique); ordered deny/ask/allow rules (first match wins, deny absolute); --allowedTools / --disallowedTools; plan mode forbids mutation; programmable PreToolUse pre-prompt gate; managed settings enforceable by admins
the IDE itself is the trust boundary; accept-per-file diff queue; allowlist + LLM classifier + best-effort sandbox
Aider
no sandbox; git is the protocol; architect → editor → auto-commit per edit
Sandboxing landscape
Gemini and Codex invest in OS-level isolation. Kiro and OpenCode have none.
Dispute over Claude Code. The earlier capture states Claude Code has no OS-level sandbox — worktree isolation is filesystem-only, not process- or network-isolated. The newer capture states that an optional OS-level sandbox for Bash now ships, with sandbox.network.strictAllowlist denying non-allowlisted hosts without prompting, and records the earlier claim as superseded (true when written, false at capture time). The earlier capture's framing remains relevant either way: the open question is whether isolation is the agent's job or the operator's, so an absent or optional sandbox can be a deliberate decision rather than automatically a defect.
Rendering diagram…
Claude Code permission pipeline
Permission evaluation runs in a defined order, with the hook operating ahead of rule evaluation and the prompt:
Rendering diagram…
The hook is the distinctive primitive: it can inspect the resolved command and answer allow/deny/ask, but it cannot widen what the rules permit. Managed settings let an administrator enforce policy over a developer's local configuration. Auto mode / auto review replaces prompts with background LLM safety checks; it ships on Pro and is positioned between blanket approval and --dangerously-skip-permissions.
Claude Code hooks and trust (Sept 2026)
Agent frontmatter hooks now require the agent file's own folder to have accepted workspace trust; previously they would run from untrusted folders.
A new DirectoryAdded hook fires when /add-dir registers a new working directory mid-session — a hook moment for "the working set changed", distinct from the pre / post / post_failure hook moments.
MCP honesty
mcp_server_errors is now surfaced in the headless stream-json init event, naming --mcp-config entries skipped by config validation.
A startup warning flags config values containing hidden leading/trailing whitespace.
Nested forwarding in stream-json is keyed by the spawning tool_use id (at depth-2+).
Depth-3 RLM is now the vendor-default shape, not exotic.
Subagent result framing: subagent output reaches the main agent under a header marking it as subagent output, so text in that result cannot masquerade as the session's own instructions — injection hardening on a shared seam.
Dynamic workflows orchestrate dozens-to-hundreds of subagents from a script, defaulting to a "medium" guideline of fewer than 15 agents.
Cost and usage diagnostics
/cost now names a likely cause for a prompt-cache miss: tool definitions changed, the system prompt changed, or the session was idle past the TTL.
/usage attributes plan-limit consumption by skill, subagent, plugin, and MCP server.
Other changelog items
AGENTS.md support as a CLAUDE.md fallback.
Fixes: /context reporting stale pre-compact token usage; claude -p dropping an already-produced answer when a turn dies on a mid-stream API error; a retry loop re-sending identical doomed requests after a context-overflow error with a large thinking budget; turn durations now timed with a monotonic clock instead of wall clock.
Superseded claims (recorded, not erased)
Earlier notes asserted "Claude Code does NOT have an OS-level sandbox (worktree isolation only)." That statement was true when written and has since become false without any signal on the newer capture's account — the same failure class as a stale pricing row or a CLAUDE.md line count. The corrected position, per the newer capture: an optional OS-level Bash sandbox now exists alongside network allowlisting. The earlier capture's contradicting position is retained above so the change is visible rather than silently overwritten.
Why it matters to yoyo
The comparison exists to explain two yoyo gaps:
yoyo owns every --restricted primitive but has no single flag composing them (issue #879).
Project instruction files reach every prompt ungated (issue #902) — and Claude Code shipped a fix for the same class of problem this month, by an independent route.
Both are instances of the known "two doors, one policy, one deaf" pattern: two entry paths governed by one policy, but only one path is observed.