You'll noticeTier: how much it should matter to you
4Useful: my rating, 1 to 5
4Signal: worth watching, 1 to 5
PermissionsArea: what it touches
ImprovementsKind: in v2.1.239,
What probably matters to youSection of the release
What
Commands that arrive from a remote agent are no longer eligible for sandboxed execution and no longer auto-approvable by the permission classifier, so they run unsandboxed and wait for a human answer.
Details
Both the Bash and PowerShell permission hooks require the request source to not be a remote agent before treating a command as sandboxable.
The auto-approval path treats a remote-agent source as not classifier-approvable, the same way it treats a request whose ask was capped by organization policy.
No flag or setting gates this.
Evidence
e.requestSource?.type !== "remote-agent"
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
