{"version":"2.1.222","anchor":"forked-and-background-agent-queries-require-canusetool-by-de","canonical_anchor":"forked-and-background-agent-queries-require-canusetool-by-de","heading":"Forked and background agent queries require canUseTool by default","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.222\/e\/forked-and-background-agent-queries-require-canusetool-by-de","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.222","markdown":"### Forked and background agent queries require canUseTool by default\n\nBackground and forked agents now run your permission callback even when a hook says allow, and deny rules win.\n\n**What**\n\nForked query tool contexts now default requireCanUseTool to true, so a hook returning \"allow\" no longer bypasses the permission callback there, and deny rules can now beat a hook allow.\n\n**Details**\n\n- requireCanUseTool is set to true when the caller does not specify it.\n- The hook decision path was reordered so deny and ask rules are evaluated before the \"hook allowed but canUseTool is required\" fallback, letting a deny rule override the hook even when canUseTool is required.\n\n**Evidence**\n\n`requireCanUseTool`\n\n- Area: Permissions\n- Names: `canUseTool`\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 0\/5"}