Claude Code 2.1.294 plugs permission gaps in agent hooks

Read together, the four Claude Code releases read less like a capability jump than a repair of a state machine. Version 2.1.289 addresses a classic boundary problem: a rule that inspected the surface string of a command could be evaded once that command sat inside a compound shell expression or behind an environment variable assignment. Moving the rule to the operation actually executed, rather than its textual form, closes a path by which an allowed command's second half inherited the approval. Version 2.1.294 tackles the opposite failure, where a hook written in natural language permitted what it was meant to deny. Notably, the same change lets teams write short policy sentences while still stopping dangerous operations and continuing work that is unfinished.\n\nThe 2.1.290 and 2.1.291 releases then work on the surrounding plumbing of long runs. agentId and an organization approval ceiling give a hook the context of who is acting and at what level, which permits designs such as allowing an operation for the main session while requiring confirmation for a subagent. The same version restored scheduled task resumption after compaction, continuation of long WebFetch calls, and retention of a resumed subagent's reasoning and prompt cache. 2.1.291 then fixed regressions in which cloud sessions dropped answers to permission questions and lost the final message at exit. The pattern is that autonomy, at least here, looks less like a property of the model and more like the reliability of the stop, approve and resume transitions around it.\n\nThe adjacent items in the roundup point the same direction. Codex bootcamp 301 treats writable roots, execution rules, plan mode, the Codex SDK and non-interactive runs as one control system, and the HYSET tool-selection approach keeps a permission layer as a separate serial boundary instead of mixing it into a single score. The cheaper mid-tier models, and long-output systems that can be interrupted and resumed under internal-activity probes, appear to be pushing the same conclusion: what a model can call, where it can write, and whether it resumes correctly after a stop may matter more than what it knows.