Under the hood
Useful1 Signal2
Remote permission checks build placeholder tool ids deterministically from the session and original id.
What's wrong with this entry?
Anonymous. No account, no email.
What
When a relayed request asks for tool permission on behalf of remote execution, the placeholder tool-use id it constructs is now a prefixed sha256 of the session id and the original id, truncated to 32 hex characters, instead of an arbitrary value. Only the remote-execution relay path is affected.
Evidence
sha256
Strings lifted out of the shipped bundle, so the claim above can be checked against them.