Tool calls forwarded to a bound or remote machine are now checked against in-session permissions first, and the check's result is logged as caller_gate
What
Before a subagent's tool call is forwarded to a remote or bound machine, Claude Code now runs an in-session permission check (the same kind used for canUseTool decisions locally). If that check denies the call, it is refused immediately with a new outcome, rejected_in_session, and never reaches the remote host at all.
The tengu_remote_tool_forward telemetry event now records a new caller_gate field reflecting whether this in-session check ran and what it allowed, alongside the existing outcome and refusal fields.
Why
This closes a gap where a tool call could be forwarded to a remote machine without first being checked against the permissions that would apply locally, and gives visibility into how often that in-session gate blocks a forward.