Under the hood
Permission classifier now short-circuits for passthrough remote tools
What
The internal classifier that decides whether a remote tool call needs a permission check now specifically detects passthrough tools (tools forwarded directly rather than wrapped). If a tool is flagged as a possible passthrough tool and its input already carries certain reserved keys, the classifier skips its normal logic and returns "no_verdict" immediately. It also tags the classifier's internal record of the call with a reason noting that the tool is a passthrough tool.
Why
This avoids running the full permission classifier on tool calls that are already known to be passthrough, keeping their handling separate and consistent with the rest of the passthrough tool system.