Agent Harness Newsletter — September 4, 2026

Two fresh releases converge on one unattended-execution rule: if approval or delivery state is uncertain, hold the action explicitly; never convert silence, reconnection, or missing human input into authority.

01 · Fresh · source dates 2026-09-02 / 2026-09-03

Make an absent approver an explicit denial

Use when: a scheduled, CI, SDK, or remote Claude Code run has no human available, yet its active mode or permission host can still produce unresolved prompts.

Action: require Claude Code 2.1.260 or later and launch:

claude -p "Update dependency pins and run tests" \
  --permission-mode auto --permission-prompts none

Keep explicit allow/deny rules and PermissionRequest hooks. This flag handles only requests left unresolved after those controls; do not replace it with bypassPermissions.

Acceptance check: run with stream-json and two owned canaries: one pre-approved read and one write outside the allowlist. Pass only if the read succeeds, the write has no effect, a permission_denied system message appears, the final result lists the denial, and the permission-host callback is never called.

Evidence: official 2.1.259 added the flag; current 2.1.260 retains it. Anthropic’s headless and CLI references document the evaluation order, callback suppression, AskUserQuestion removal, MCP-elicitation cancellation, and receipt fields.

Caveat: a PermissionRequest hook may still allow an action, and auto mode remains model-classified. The flag prevents waiting or retrying for absent approval; it is neither an OS sandbox nor a universal deny.

02 · Fresh · source dates 2026-08-31 / 2026-09-03

Quarantine uncertain input across reconnects

Use when: an out-of-process Codex TUI talks to app-server and the transport can fail while a draft or submission is queued or in flight.

Action: require Codex 0.153.0 or later; 0.153.2 is current. On disconnect, preserve editable drafts, pastes, attachments, runtime settings, and cached transcripts, but mark queued or possibly submitted input for manual review. Reconnect with a fresh client, resume the thread, quarantine stale completions, and never auto-replay input.

Acceptance check: use an owned counter-increment tool and drop the client connection at the submission boundary. After reconnect, the counter must be zero or one, never two; the draft remains visible; no new turn begins until manual confirmation; stale events do not change state; and an unresumable conversation remains read-only.

Evidence: Codex 0.153.0 ships the behavior. Merged PRs #41911, #41916, and #41918 add unit, snapshot, pseudo-terminal, app-level, and Unix-socket replacement tests for draft preservation, input quarantine, resume failure, and stale-event isolation.

Caveat: the repair covers the out-of-process TUI, not embedded app-server clients, and cannot prove whether the server accepted the original request. Side effects still need idempotency keys and post-reconnect reconciliation.

Compact source notes

Claude Code 2.1.259 (published 2026-09-02 22:33 UTC) introduced --permission-prompts none; 2.1.260 (2026-09-03 23:48 UTC) is the current inspected release.
Official headless guide and CLI reference (retrieved 2026-09-04) specify permission evaluation, callback behavior, MCP elicitation, and stream-JSON denial receipts.
Codex 0.153.0 (published 2026-09-03 01:37 UTC) and current patch 0.153.2 (2026-09-03 23:53 UTC). The later patches change model-catalog/display data, not reconnect behavior.
Primary implementations: PR #41911, #41916, and #41918 (merged 2026-08-31), with explicit test scopes and failure-state semantics.
Method: anchor lens—official releases, current docs, merged diffs, and named regression suites; unity lens—unanswered approval and uncertain delivery are both non-authorizing transition states. Confidence: Confirmed for documented/shipped scope; broader cross-client generalization is Likely. Falsifiers: an unresolved prompt waits or executes, reconnect auto-replays input, a duplicate side effect occurs, or a stale completion mutates recovered state.