{"version":"2.1.300","anchor":"tool-calls-can-be-held-until-a-person-types-no-in-bundle-wr","canonical_anchor":"tool-calls-can-be-held-until-a-person-types-no-in-bundle-wr","heading":"Tool calls can be held until a person types, and plugins can't loosen Cowork web calls","tier":"notice","area":"Permissions","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300\/e\/tool-calls-can-be-held-until-a-person-types-no-in-bundle-wr","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300","markdown":"### Tool calls can be held until a person types, and plugins can't loosen Cowork web calls\n\nNew permission holds pause tool calls until the user writes, and stop plugin allow verdicts from loosening Cowork cloud web calls\n\n**Unclear.** Nothing shown sets the held state, so it is not clear what turns it on or whether it is in use.\n\n**What**\n\nA tool call is an action Claude wants to take, such as running a command or fetching a web page. Two new holds limit when tool calls can run and who can approve them:\n\n- Held until a person types: when a session's `toolsHeldUntilAPersonTypes` property is on, any tool call that isn't exempt is denied with reason `tools_held_until_a_person_types`. Claude is told the tool was not run, that tool calls are paused until the user sends a new message themselves, that a message sent by an app or automation does not count, not to retry or find another way, and to say where things stand. The finder found nothing in the code that turns this on. A related `isPersonsOut` setting, off by default, also appears.\n\n- Cowork web calls: in a Cowork cloud session, a plugin's allow verdict on a web call is now ignored, because a plugin can only tighten such a call. The same applies while tool calls are held. Before, only remote session MCP calls, calls needing user interaction and plan-mode writes were protected this way.\n\n- Auto mode: the rule that let auto mode (where a classifier decides on tool calls) skip the classifier for plugin-origin calls now has an extra exclusion, and its records note `coworkWebAllowOverride`.\n\n- Denial reasons: denials can now be classified as `toolsHeld` or `noConfigHome`.\n\n**Why**\n\nIn unattended or remote sessions, messages from apps or automations can no longer drive tool calls once the hold is on, and plugins or hooks cannot loosen permissions for Cowork web calls. Auto mode may let fewer plugin-origin calls through without a check.\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 4\/5\n- Scope: individual\n- Heads-up: yes"}