{"version":"2.1.268","anchor":"new-deny-path-for-read-db-writes-outside-working-folders-wit","canonical_anchor":"new-deny-path-for-read-db-writes-outside-working-folders-wit","heading":"read_db\/write_db approval logic gains a trusted-source shortcut and a hard deny for unapproved out-of-folder writes","tier":"notice","area":"Artifacts DB","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268\/e\/new-deny-path-for-read-db-writes-outside-working-folders-wit","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268","markdown":"### read_db\/write_db approval logic gains a trusted-source shortcut and a hard deny for unapproved out-of-folder writes\n\nArtifact database reads can skip approval for recognized trusted sources, while writes outside the working folder are hard-denied with no approver present\n\n**What**\n\n- `read_db` calls now hard-deny outright when they would save documents outside the session's working folders and there's no human present in the session to approve it, returning a dedicated safety-check reason instead of prompting.\n\n- A new helper can recognize an artifact's slug as coming from a pre-trusted, known source; when it does, a `read_db` call is now allowed automatically with the message \"Reading the database of ... needs no approval\", skipping the usual prompt.\n\n- The equivalent `write_db` consent check was extended to treat the same trusted-source signal as already-consented, in addition to the existing per-session consent flags.\n\n**Why**\n\nThis reduces unnecessary approval prompts for artifact database reads\/writes that Claude Code already knows are safe, while closing a gap where a write outside the session's own folders could otherwise proceed unapproved when nobody is around to confirm it.\n\n- Area: Artifacts DB\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}