The headless cloud client now checks repository-trust prompts before forwarding them to the host, dropping suspicious ones
When a permission request needs to be passed from a headless/cloud client through to the host machine, and that request involves a repository-trust question (whether a given tool call should be trusted for the current repository), the client now verifies the request more carefully before forwarding it. If the request's input doesn't exactly match the digest the host actually served, or it's unclear what's attached, the request is dropped and a warning is logged instead of being relayed.
This prevents a repository-trust prompt from being forwarded to the host if it's been tampered with or doesn't correspond to what the host actually asked about, closing off a potential way to trick the trust check.