Approving a database read or write now locks it to that exact action and project.
What's wrong with this entry?
When you approve a Claude Design read_db, write_db or watch call, the approval now records which action and which project it was for and re-checks that at execution time. If the action or the target URL changed after you approved, the call is refused with a db_target_changed error instead of running against a different database.
- Consent is stored as an action plus project slug pair in tool state.
- The refusal message states that nothing was written and asks you to retry so the call is checked again.
- No flag involved; this is active in this build.
` action or url no longer names the database write that was approved — nothing was written; retry so it is checked again `
Strings lifted out of the shipped bundle, so the claim above can be checked against them.