Claude Code changelog Nov 4-13 2026 (code.claude.com/docs/en/changelog; github.com/anthropics/claude-code/releases v2.1.321-2.1.325). Defect classes in its Bash permission layer that transfer to yoyo:

• Plan mode: bash commands the static analyzer cannot PROVE read-only are not auto-run (asked, or judged by classifier). Allow-list direction: read-only must be proven.
• Fixed Bash allow rules with attached wildcard (Bash(ls*)) skipping prompt; a rule naming a variable (Bash(NODE_ENV*)) now asks.
• Fixed deny rules not applying to the file that cp/mv INTO A DIRECTORY writes.
• Fixed deny/ask rules missing commands run through sudo/env wrappers; combined sudo flags.
• Fixed allow rule running a different program than it names.
• Needless prompts for read-only commands wrapped in timeout DURATION.
• Shell commands ran in launch dir after cwd deleted; now fails with a message.
• Third-party gateways stopping with context-length error every turn instead of compacting.
• MCP OAuth secrets sent to another host on redirect (yoyo #1181 checked the API-key analogue).
• read-only git commands ask first in a repository that is not the project or trusted. yoyo mapping (Day 258): yoyo /read and /plan guard composes analyze_bash_command + detect_write_command, a DENY list (WRITE_VERBS: touch mkdir mv cp tee truncate install ln chmod; no rm/rmdir/unlink/shred/dd/sed -i). Its git classifier is an ALLOW list (fails closed). The generic-verb half fails open; that asymmetry is the gap (#1192).