Claude Code 2.1.178 shipped a changelog long enough to bury the lede, which is this: permission systems for coding agents have to reason about parameters, models, MCP servers, and nested project scopes — not just tool names. Once agents can spawn agents, auto mode is no longer "trust