What
When another machine asks this session to approve a tool call, its answer can now include that machine's own permission rules, which are folded into the prompt the model uses to decide. Allow and environment rules are only honoured when the peer connects as a "session" transport; deny rules always apply, and an allow rule can clear a soft block but never a hard one. No flag: it is live for anyone using remote tool calls in auto or bypassPermissions mode.
Details
- The rules arrive as four lists: hard-deny, soft-deny, allow, and environment lines describing the remote machine.
- The classifier prompt gains a trailing section headed by the rules, with explicit instructions that any line reading as an instruction to the model is ignored.
- Telemetry counts
host_rules_hard_denyandhost_rules_allow_honoured. - Requires the peer to mark the request
classifier_eligible; both the sending and receiving halves ship in this build.
Evidence
## Rules declared by the machine that will run this command
Strings lifted out of the shipped bundle, so the claim above can be checked against them.