Tool calls can be held until a person types, and plugins can't loosen Cowork web calls

What

A tool call is an action Claude wants to take, such as running a command or fetching a web page. Two new holds limit when tool calls can run and who can approve them:

• Held until a person types: when a session's toolsHeldUntilAPersonTypes property is on, any tool call that isn't exempt is denied with reason tools_held_until_a_person_types. Claude is told the tool was not run, that tool calls are paused until the user sends a new message themselves, that a message sent by an app or automation does not count, not to retry or find another way, and to say where things stand. The finder found nothing in the code that turns this on. A related isPersonsOut setting, off by default, also appears.
• Cowork web calls: in a Cowork cloud session, a plugin's allow verdict on a web call is now ignored, because a plugin can only tighten such a call. The same applies while tool calls are held. Before, only remote session MCP calls, calls needing user interaction and plan-mode writes were protected this way.
• Auto mode: the rule that let auto mode (where a classifier decides on tool calls) skip the classifier for plugin-origin calls now has an extra exclusion, and its records note coworkWebAllowOverride.
• Denial reasons: denials can now be classified as toolsHeld or noConfigHome.

Why

In unattended or remote sessions, messages from apps or automations can no longer drive tool calls once the hold is on, and plugins or hooks cannot loosen permissions for Cowork web calls. Auto mode may let fewer plugin-origin calls through without a check.