Unclear Whether the new checks apply depends on a server-side switch whose default is not known.
What
In a remote session, a permission prompt can be parked: left waiting while the session is paused, then picked up again when it resumes. The handling of answers to these parked prompts has been rewritten.
Matching answers to the right call:
- Strict matching: a new handler rejects answers that cannot be read, that belong to another tool, or that do not repeat the call's input.
- Timeout: it gives up after a wait, ending with
wait_lapsed. - Refusal message: an unmatched answer refuses the call with: 'This tool call was refused and did not run: the permission answer for it could not be matched to this call.'
- New flag: a new flag,
tengu_quizzical_knuth, is added. Nothing has been read about it.
Handling a Deny:
- Deny as refusal: in a gated mode, a Deny is treated as a refusal.
- Blanked Deny: a blanked Deny is matched by a suppressed request id.
- Mismatched tool name: the Deny is rewritten rather than dropped.
- Unreadable Deny: one that cannot be read yet is remembered, and the session keeps waiting.
- Clear: a clear is sent after the Deny is queued.
- Later answers: a later non-Deny answer for the same call is dropped, with a log line saying a Deny for it came first.
- Before: there was one answer path, a Deny got no special handling, and a request id mismatch dropped the answer.
When tengu_eager_pillow is on, the strict-answer path also passes the transcript's message rows. The flag server returned that flag on for this site's account and for the anonymous baseline; no reading has been taken under this release. Nothing has been read about tengu_resume_parked_permission.
Why
Resumed permission prompts in remote sessions are less likely to approve the wrong call. When you deny one, the denial should actually take effect instead of being lost.
Whether the new checks apply depends on a server-side switch whose default is not known.