What
A can_use_tool answer that names a different tool than the one being asked about is now ignored, so a stale or crossed response cannot approve the wrong call.
Details
- both the SDK control-protocol client and the remote permission bridge record the pending tool name
- the hook and permission response schema gained an optional toolName field
- telemetry distinguishes a match from a mismatch
- in the remote session manager, a mismatch is logged and the local prompt stays up rather than being dismissed, since the worker would drop the answer anyway
Evidence
bridge_permission_toolname_check, worker will drop it, keeping prompt
Strings lifted out of the shipped bundle, so the claim above can be checked against them.