Unclear The finding describes an architectural refactor but does not state any resulting behavior change for users.
The internal code for the SendMessage and SendFile tools was restructured. Instead of each tool receiving its permission-checking and session context separately on every call, they're now built through a shared create() factory that sets up this context once and a new helper that throws an error if the permission system isn't properly wired up. Several other internal tools (log tailing, a health-port check, a sandbox-related tool, and an MCP tool wrapper) were changed the same way, now returning their behavior from a create() method instead of exposing it as flat properties.
This is an internal restructuring to make tools access session and permission state consistently, rather than each tool wiring it up on its own. It shouldn't change what these tools do, but it's the kind of groundwork that reduces bugs from inconsistent permission handling across tools.
The finding describes an architectural refactor but does not state any resulting behavior change for users.