Sandbox helper programs now run WITHOUT the agent's sign-in tokens/API keys in env; ripgrep/git run without the mTLS passphrase -> yoyo #1064 (child processes inherit provider key; opt-in scrub).
Relative deny/ask rules (Read(./.env)) stopped covering the project after a cd -> yoyo fence anchor under /cd (d231 lesson).
Shell commands ran in the launch dir after the working dir was deleted; now fail with a message -> check yoyo bash tool with a deleted cwd.
Third-party gateways stopped with a context-length error every turn instead of compacting -> yoyo overflow classification for openai-compatible gateways (#1167 used yoagent Message::is_context_overflow).
Subagents cut off at output token limit are re-asked for the whole answer briefly, instead of returning only its end -> yoyo sub_agent truncation handling.
A committed settings.local.json treated as the user's own when started in some subfolders -> yoyo config rung identity (#1185) / trust keyed on path not content (#1188).
Read-only git commands now ask first in a repo that is not the project or trusted -> yoyo /read mode runs git anywhere.
Fixed a gap where some compound Bash commands ran without asking -> yoyo #1193 (18 of 33 SAFETY_CHECKS miss triggers glued into $( ( backtick).
claude -p text output on a terminal passed control sequences other than styling -> yoyo sanitize_for_display / -p output.
Method note: same changelog-delta method as earlier scans (agent-changelog-defect-class-transfer).