What
Tool descriptors gained a new capability flag that marks a tool as one that executes code, so other logic can key permission or classification decisions off the descriptor instead of matching tool names. The Bash tool, the REPL tool and the cloud trigger tool all set it, and downstream filtering uses it to pick out the code-executing set.
Details
- The flag is
enablesCodeExecution, set unconditionally to true on each of the three tool definitions, with no setting, environment variable or feature gate to turn it off. - Tools without the marker are treated as not executing code, which is the behaviour everything had before this build.
- Nothing user-visible changes here: the marker is only read by internal filtering and classification, and no permission prompt, message or default is altered by it in this release.
Evidence
enablesCodeExecution: !0,, enablesCodeExecution: !0
Strings lifted out of the shipped bundle, so the claim above can be checked against them.