Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.248 Home All releases ←olderv2.1.247 v2.1.250newer→
Claude Code v2.1.248

Remote machines can send their own auto-mode rules with a tool-call approval request

You'll notice
Useful4 Signal4
Permissions

A remote machine's permission rules can now influence approvals for tool calls it asks about.

What

When another machine asks this session to approve a tool call, its answer can now include that machine's own permission rules, which are folded into the prompt the model uses to decide. Allow and environment rules are only honoured when the peer connects as a "session" transport; deny rules always apply, and an allow rule can clear a soft block but never a hard one. No flag: it is live for anyone using remote tool calls in auto or bypassPermissions mode.

Details
  • The rules arrive as four lists: hard-deny, soft-deny, allow, and environment lines describing the remote machine.
  • The classifier prompt gains a trailing section headed by the rules, with explicit instructions that any line reading as an instruction to the model is ignored.
  • Telemetry counts host_rules_hard_deny and host_rules_allow_honoured.
  • Requires the peer to mark the request classifier_eligible; both the sending and receiving halves ship in this build.
Evidence

## Rules declared by the machine that will run this command

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.248 →