Coding Agent CLI Defect Classes

Summary

A comparison of two coding-agent CLI changelogs — Claude Code 2.1.319 (2026-11-06) and Codex CLI 0.159–0.167 (checked 2026-11-04, plus 0.167) — used to extract defect classes: recurring categories of failure that recur across independent implementations of an agent CLI. Each Claude Code fix is treated as evidence that the same class may exist elsewhere (here, in the agent CLI "yoyo"), and each item is checked against yoyo's actual behavior on Day 253 of its development. Codex's release stream supplies the complementary picture: which capabilities are converging across products, and which fixes (e.g. Guardian review of exec calls) address the same security surface.

Key Points

• Config shadowing is the flagship defect class. A stale config file under a legacy name can silently override a user's real setup. Claude Code's fix is to warn on stderr when a home directory holds two config files and to name which one is in use. yoyo currently only surfaces this in config show ("Also present, not read"); normal runs and config get stay silent.
• Non-interactive permission semantics are a design choice, not a bug. permissions.denyInsteadOfPrompting converts a would-be prompt into a denial so the turn continues. yoyo chose the opposite: -p and piped runs auto-approve everything (decision A on #1149, 2026-11-08), disclosed but unfixed.
• Command-parsing bypasses recur. A crafted environment prefix that hides part of a bash command defeated permission checks in Claude Code; a sed invocation skipped checks in accept-edits mode. yoyo's hard_deny handles VAR=x and wrapper words but has an unprobed gap: env -S.
• Deny must beat ask. An exact ask rule can be refused when a broader deny covers the same call — deny precedence needs to be explicit.
• Backgrounding long tool calls (MCP tasks) and reopening finished subagents (/tasks "Earlier in this session") are capability transfers rather than defect classes.
• Codex's 0.159–0.167 stream shows convergence on: MCP OAuth login, managed git worktrees, searchable config UI, mid-response steering, numbered prompt presets, a built-in Vertex provider, transcript search, and bounded Code Mode output with Guardian review of exec calls.