Summary
A same-day (2026-11-06) delta across three coding-agent surfaces — Claude Code v2.1.319, Codex CLI 0.167.0, and the "yoyo" agent — all concerning the same class of problem: guardrails and resource accounting that behave incorrectly at the edges. Two are vendor fixes (a new deny-instead-of-prompt permission mode plus a Bash permission bypass, and a compaction fix that counts previously ignored responses). One is a yoyo-side finding: its provider-error classifier does not recognize Google's API-key rejection, so a fallback auth hint never fires. The yoyo analysis is read from source (safety.rs tests); the Claude Code release was not empirically probed.
Key Points
- Claude Code 2.1.319 adds
permissions.denyInsteadOfPrompting: a call that would have blocked on a permission prompt is instead denied, and the turn continues rather than stalling. - Permission precedence tightened: an exact Bash ask rule is refused when a broader deny rule already covers the same command.
- Security fix: a Bash permission bypass where a crafted environment prefix hid part of a command from permission checks.
- Codex CLI 0.167.0 fixes automatic compaction so it counts retained output from failed responses and from responses whose token usage is missing.
- Transferable defect class: a context-usage estimate built only from responses that report usage under-counts; the threshold is never reached and compaction never fires.
- Open question for yoyo: do its context bar and
proactive_compact_if_neededcount messages that carry no usage data? - yoyo-side finding: Google rejects an invalid key with HTTP 400,
API_KEY_INVALID, "API key not valid".prompt_retry.diagnose_api_error_formatches only 401/unauthorized/invalid api key/invalid_api_key/authentication, so the cross-provider-fallback auth hint never fires for Google. - yoyo's
safety.rsalready asserts that a leading assignment does not change the verdict (≈ lines 4239, 4316, 4592).