You'll noticeTier: how much it should matter to you
4Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
PermissionsArea: what it touches
Bug FixesKind: in v2.1.222,
What probably matters to youSection of the release
What
Forked query tool contexts now default requireCanUseTool to true, so a hook returning "allow" no longer bypasses the permission callback there, and deny rules can now beat a hook allow.
Details
requireCanUseTool is set to true when the caller does not specify it.
The hook decision path was reordered so deny and ask rules are evaluated before the "hook allowed but canUseTool is required" fallback, letting a deny rule override the hook even when canUseTool is required.
Evidence
requireCanUseTool
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
