{"version":"2.1.239","anchor":"tool-calls-relayed-from-a-cloud-agent-run-under-a-restricted","canonical_anchor":"tool-calls-relayed-from-a-cloud-agent-run-under-a-restricted","heading":"Tool calls relayed from a cloud agent run under a restricted permission mode","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.239\/e\/tool-calls-relayed-from-a-cloud-agent-run-under-a-restricted","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.239","markdown":"### Tool calls relayed from a cloud agent run under a restricted permission mode\n\nTool calls relayed from a cloud agent are judged strictly: your hooks skip and relaxed permission modes are downgraded.\n\n**What**\n\nWhen a cloud agent relays a tool call to your local Claude Code, the request is now marked as remote execution and evaluated more strictly. Your hooks do not run, and a locally relaxed permission mode is not inherited: `acceptEdits` and `bypassPermissions` are rewritten to `default` before the permission check.\n\n**Details**\n\n- The marker is new in this build; nothing in 2.1.238 sets or reads it.\n- Hooks return immediately for these calls, so a PreToolUse hook cannot approve or block a relayed tool.\n- Bash sandbox auto-allow is skipped, along with several local shortcuts that would otherwise allow a command based on its prefix or leading environment assignments.\n- No separate flag guards the downgrade; it applies whenever a remote agent relays a request.\n\n**Evidence**\n\n`forRemoteExecution`\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 4\/5"}