[BUG] CRITICAL BUG: Commands execute BEFORE user approval

Environment

• Platform (select one):
• [x] Anthropic API
• [ ] AWS Bedrock
• [ ] Google Vertex AI
• [ ] Other: <!-- specify -->
• Claude CLI version: 1.0.51 (Claude Code)
• Operating System: Ubuntu 24.04
• Terminal: Ubuntu terminal

Bug Description

Database migration commands (alembic, migrate, etc.) execute immediately when tool is called, BEFORE user approval dialog. User blocking has no effect - command already executed.

Steps to Reproduce

1. Claude calls Bash(alembic downgrade base) or similar migration command
2. Migration executes IMMEDIATELY
3. User sees approval dialog and clicks "No (tell Claude what to do differently)"
4. Migration has already completed despite explicit user rejection

Expected Behavior

• Show migration command to user FIRST
• Execute ONLY after user approves
• "No" prevents execution entirely

Actual Behavior

• Migration executes instantly when tool called
• User approval dialog is cosmetic only
• "No" response has zero effect - migration already completed

Additional Context

CRITICAL: Dangerous migration commands bypass user approval entirely.

Example showing migration blocked by user but already executed:
● Bash(source venv/bin/activate && alembic downgrade base)
⎿ No (tell Claude what to do differently)

User explicitly blocked destructive migration command, but it had already executed.

Unlike rm commands which are protected, migration commands appear unprotected and execute without proper approval flow.

Migration commands must require actual user approval before execution.