{"version":"2.1.290","anchor":"served-remote-tool-permission-pipeline-hardened","canonical_anchor":"served-remote-tool-permission-pipeline-hardened","heading":"Stricter checks when Claude Code runs tools for a remote host","tier":"notice","area":"Permissions","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.290\/e\/served-remote-tool-permission-pipeline-hardened","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.290","markdown":"### Stricter checks when Claude Code runs tools for a remote host\n\nRemotely hosted tool calls now refuse over-long paths and settings-file edits, deny on a rule-check crash, and use up approvals that arrive too late\n\n**Unclear.** It is not clear which of these checks apply in every setup and which depend on a setting or remote switch.\n\n**What**\n\nClaude Code can run tools on behalf of a remote host, meaning another program that asks Claude Code to carry out actions and asks for your approval. The permission checks around those tool calls now handle several cases differently:\n\n- A path that is too long is refused.\n\n- An approval that arrives after its time has run out is used up and nothing runs. The message says: \"nothing ran, and the approval is used up. Run the tool again if it is still needed.\" Before, a late approval left the request waiting as still pending.\n\n- If the check against your permission rules crashes, the tool call is denied rather than allowed.\n\n- Refusals involving credential files and settings files are now recorded.\n\n- Edits to settings files made through these remotely hosted tools are refused.\n\nThis release also reads a new environment variable, `CLAUDE_CODE_REMOTE_TOOLS_HOST_ALLOWS_UNATTENDED`, and passes it through to the programs Claude Code starts.\n\n**Why**\n\nThese changes decide what happens when an approval expires or a check goes wrong. In each case the tool now does not run, so an approval cannot quietly hang around and a failed check does not let a call through. If a remotely hosted tool reports that its approval was used up, run the tool again.\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: yes"}