[2.16.9] — 2026-09-26
Fixed
- Security: every tool call of a Claude org role is now decided by the role's policy. The Claude Code CLI asks the org's
canUseTool gate only about calls its own rules would ask about. Read-only Bash (cat, ls, grep, git status, git log), Read inside the cwd, Agent, ToolSearch and ListAgents ran without it, so for those calls denyTools, allowTools, fileRead scopes, budget exhaustion, a pending decision gate, the fence and approvals did not apply, and no tool audit event was written. The 2.16.7 release run had 959 Bash results against 655 Bash decisions, and 38 ToolSearch, 7 ListAgents and 6 Agent calls had no decision at all. Reproduced against the real CLI: a role with denyTools: ["Bash"] could still run cat, and a role with fileRead: ["docs/**"] could still Read any file in its cwd. Write-type calls were not affected: git commit in a git: 'read' role, writes and non-read-only Bash always reached the gate, and the OS sandbox and git guard held underneath. The gate now also runs from a PreToolUse hook, which fires for every call, including a subagent's calls. A call is decided and audited once even when the CLI also asks canUseTool. ToolSearch is exempt from allowTools, since it only loads tool schemas; denyTools still blocks it. Approvals now cover these calls too: a role whose Bash needs approval (the default, unless autoApproveTools lists Bash or the run passes --auto-approve Bash) now also waits for approval of read-only commands. See Where the policy is enforced.
- Org tools reject argument keys they do not declare. The 2.16.7 release run's captain passed
org_plan_graph nodes deps (org_task's field) instead of after. The schema stripped the unknown key, the graph was accepted with no edges, every node came back ready, and QA was dispatched before the build. Every built-in org tool (org_*, ask_human, knowledge_search) now refuses unknown keys, at the top level and in nested objects, with an error that names each key and changes nothing. deps on a plan-graph node is pointed to after with node names, and after on org_task to deps with task ids. The tool schemas now advertise additionalProperties: false, so the model sees the rule before it calls. Tool-provider tools keep their inputSchema behaviour (#325).
npm: monomind@2.16.9, @monoes/monomindcli@2.16.9
