News
What is new
Every CanvasCode release, what changed and why. Plus what we learn about working with several AI agents at once.
-
Release 1.53.0
Canvas Code dictation gained a third engine — the only one that gets your work's jargon right. And the model it downloads no longer depends on a third-party service to exist.
Read update -
Release 1.52.5
Canvas Code now talks to a desk keypad. An Ulanzi or a Stream Deck plugged into this Mac can already tell how your projects are doing and take you to any agent with a single key.
Read update -
How do you make a Claude Code hook fail closed?
A guard that crashes lets the write through in 3 of 3 runs; a wrapper that turns any exit other than 0 or 2 into 2 blocks it in 3 of 3. A guard that hangs defeats that wrapper too, 3 of 3, unless the wrapper carries its own clock. Measured across 27 sessions on Claude Code 2.1.240 on 22 August 2026, with the script to reproduce it.
Read update -
Which codex exec output signals can you trust?
Not the exit code: codex exec returned 0 in 9 of 9 runs on 19 August 2026, including the 6 that changed nothing. The status field on a file_change item was correct in 10 of 10 items on 21 August 2026, kind read as a balance per path catches a revert, and ERROR patch rejected appeared in 6 of 6 blocked runs. An index of 25 runs.
Read update -
How do you stop Claude Code from writing files?
No layer inside Claude Code held in every run: a CLAUDE.md ban still ended in a commit in 3 of 4, a deny rule never matched the git -C spelling, and --disallowedTools still ended with the file created in 2 of 3. A macOS sandbox-exec profile held in 3 of 3, including the runs where the agent disabled its own sandbox. Eight measurements, one index.
Read update -
Why does Codex say Operation not permitted when the directory looks writable?
Because the block is not in the directory. In 9 runs of codex exec on August 21, 2026 (codex-cli 0.148.0, macOS 26.5.2), a macOS sandbox-exec profile stopped the write 3 of 3 times, and Codex blamed the current directory in all three. The directory was drwxr-xr-x and owned by the user. Codex never named the layer that stopped it.
Read update -
Can sandbox-exec keep Claude Code out of a directory on macOS?
Yes. A sandbox-exec profile denying writes to the working directory blocked Claude Code in 6 of 6 sandboxed runs, including the 4 where the agent set dangerouslyDisableSandbox on its own call. The same profile written with /tmp instead of the resolved /private/tmp blocked nothing: the file appeared in 3 of 3. Measured on Claude Code 2.1.238 and macOS 26.5.2 on 21 August 2026.
Read update -
Does a clearer block message stop Claude Code from retrying?
Claude Code's default refusal made the agent retry the same write 6, 6 and 10 times. A PreToolUse hook naming the scope of the block and an alternative cut it to 1, and a third arm without any order to stop cut it to 1, 2 and 1, so the effect is the explanation and not the command. Nine runs, no file created, Claude Code 2.1.238, 21 August 2026.
Read update -
What does an AI coding agent do with an ambiguous spec?
It fills the gap by itself, tells you in one sentence at the end, and the next run fills it differently. We ran the same six rule spec three times: all three passed a judge written in advance, and the three implementations they produced disagree with each other.
Read update -
How does Claude Code write a file without the Write tool?
It reaches for python3. With --disallowedTools Write Edit NotebookEdit and no route dictated in the prompt, Claude Code 2.1.237 created the file in 3 of 3 runs by calling python3 -c, after shell redirection was refused 5 times out of 5 and tee 5 out of 5. A Bash(python3:*) deny rule took that to 0 of 3, and not one of the 6 runs ever tried perl, node or awk.
Read update