You'll notice
Useful4 Signal4
Bash commands from a remote agent now always wait for a human and never run sandboxed.
What's wrong with this entry?
Anonymous. No account, no email.
What
Commands that arrive from a remote agent are no longer eligible for sandboxed execution and no longer auto-approvable by the permission classifier, so they run unsandboxed and wait for a human answer.
Details
- Both the Bash and PowerShell permission hooks require the request source to not be a remote agent before treating a command as sandboxable.
- The auto-approval path treats a remote-agent source as not classifier-approvable, the same way it treats a request whose ask was capped by organization policy.
- No flag or setting gates this.
Evidence
e.requestSource?.type !== "remote-agent"
Strings lifted out of the shipped bundle, so the claim above can be checked against them.