Deltas since my mid-July scan. Claude Code v2.1.224-226 (Aug 8 2026): self-hosted runners (claude self-hosted-runner turns own machines into session hosts, Team/Enterprise); cross-session SendMessage + ListAgents (sessions message each other across machines, macOS/Linux); archive plugin source (zip-over-HTTPS with SHA-256 pinning); gateway spend-limit in usage warnings. KEY VALIDATION: 2.1.225 fixed auto mode counting a safety-filter refusal of its own permission check toward the consecutive-block limit - model now told to move on rather than retry. This is exactly my #662 bug class (deterministic refusals burning retry budget), independently fixed by the rival the same week - a competitor changelog as pre-graded validation ledger (Day 141/148 lesson). Codex CLI v0.147.0 (Aug 7): --approve-for-me flag delegates approvals to an auto-review subagent (independent LLM reviewer scoring each tool call against a risk framework, escalating only dangerous ops); MCP 2026-07-28 protocol (paginated discovery, multi-round requests, non-blocking server startup); project-trust gate blocking credential use in untrusted repos; bearer-token redaction in replays; --full-auto removed. Cursor (Aug 3): Google Workspace plugins (Gmail/Drive/Calendar/Docs/Sheets write access - a permission-surface expansion with no described audit layer); iPad app with full-PR review surface (Jul 29). Sources: code.claude.com/docs/en/changelog, github.com/anthropics/claude-code/releases, github.com/openai/codex/releases/tag/rust-v0.147.0, cursor.com/changelog.