A cross-agent delta scan (Claude Code 2.1.314, Codex CLI rust-v0.160–0.166, plus a yoyo probe on Day 244) of the knobs, fences, and failure behaviors that govern what a coding agent may do and how it reports what it did. The recurring theme: agents are converging on hard, mode-independent write fences, loud failure instead of silent degradation, bounded context injection, and faithful display of refused-vs-executed actions — and the yoyo probe shows what goes wrong when an agent instead guesses a default and blames the network.
Key Points
Write fences now mirror read fences.permissions.blockWritesOutsideWorkingDirectories makes Write/Edit/NotebookEdit refuse out-of-workdir paths in every permission mode — the write-side twin of an outside-read fence.
Silent success is a bug.claude -p previously exited 0 with no output on startup failure; it now prints the error and exits 1. Startup-failure exit codes are a recurring defect class across agents.
Cap anything you inject into model context. PreCompact hook output was truncated at 10,000 characters because oversized hook output made compaction fail or repeat.
Normalize model-id spelling before lookup. Dotted ids behind an LLM gateway (claude-opus-4.8) were mis-resolved as an older model with the wrong window, output limit, and cost.
Display must distinguish refused from executed. Calls blocked by a deny rule or PreToolUse hook no longer render as though they ran inside a collapsed tool group.
Unknown config values must fail fast. yoyo's --provider anthropc typo silently fell back to an OpenAI-compatible localhost:8080 and retried ~80s before blaming the internet — the anti-pattern all three agents are otherwise moving away from.
Concepts
Write fence / read fence — permission boundaries keyed on the working directory.
Permission mode — the coarse policy setting; fences that ignore mode are stronger than mode-conditional ones.
PreCompact hook / PreToolUse hook — user-supplied scripts at lifecycle points; their output becomes model context and must be bounded.
Model-id normalization — canonicalizing aliases and spellings before preset/window/cost lookup.
Startup-failure exit code — non-zero exit plus diagnostic when an agent cannot initialize.
Mid-turn steering — sending a follow-up message while the agent is still responding (Codex).
Managed git worktrees — per-task isolated checkouts managed by the CLI (Codex).
Details
Claude Code 2.1.314 — safety and diagnosability
Write confinement.permissions.blockWritesOutsideWorkingDirectories refuses Write/Edit/NotebookEdit for any path outside the configured working directories. Crucially it applies in every permission mode, so it is not a softer hint that a permissive mode can override — mirroring the existing fence that already constrained reads.
Exit-code correctness.claude -p (headless/print mode) used to exit 0 with no stdout when startup failed. It now emits the error and exits 1. The scan flags this as part of a recurring class of bugs: startup failure reported as successful completion breaks every wrapper that keys on exit status.
Bounded hook output. PreCompact hook output is now cut at 10,000 characters. Unbounded hook output fed into the model context caused compaction to fail outright or to loop/repeat. The general rule: anything a hook injects into context needs a cap.
Gateway id normalization. Model ids written with a dot (claude-opus-4.8) arriving through an LLM gateway were treated as an older model, producing wrong context window, output limit, and cost estimates. They are now normalized, so preset lookup resolves the intended model.
Refused ≠ executed. Shell and MCP calls blocked by a deny rule or a PreToolUse hook previously looked, inside a collapsed tool group, as if they had run. Display now marks them as refused, preserving the audit trail of what was actually attempted versus allowed.
Shell hygiene and memory. The Bash tool clears inherited which alias/function so shell resolution is not contaminated; and on the memory side, the parent no longer retains every subagent tool result until turn end — cutting retained context growth.
Codex CLI (rust-v0.160–0.166, Oct 2026)
Feature/control additions:
Mid-turn steering — send a follow-up while the agent is still responding.
/presets with ten slots — saved configurations you can switch between.
Inline arguments for /model and /permissions — set them in one command.
Searchable /config that flags which changes require a restart.
Built-in Vertex AI provider; GPT-6.1 Sol as default model.
Correct: yoyo -p with a bad API key or a bad model name exits 1.
Incorrect: an unknown --provider value (typo anthropc) silently falls back to an OpenAI-compatible endpoint at localhost:8080, retries for roughly 80 seconds, then reports a network problem.
The diagnostic chain is wrong at two points: an unrecognized enum value should be rejected at parse time naming the flag and value, and the resulting error should not be attributed to connectivity. This is the exact "silent default + misleading blame" pattern that explicit fences and strict exit codes are meant to eliminate.