fix: wire allowed_tools/disallowed_tools inputs through to Claude SDK

The disallowed tools env var read in run.ts was DISALLOWED_TOOLS_INPUT
(raw user input) instead of DISALLOWED_TOOLS (computed value including
WebSearch/WebFetch defaults). This meant default tool disallowance was
never enforced. Also removes orphaned ALLOWED_TOOLS env var export from
createPrompt() (tag mode passes allowed tools via claudeArgs instead),
extracts shared parseToolsInput utility to eliminate duplication, and
adds tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/create-prompt/index.ts

@@ -23,6 +23,7 @@ import { GITHUB_SERVER_URL } from "../github/api/config";
 import { detectPlatform } from "../platform/detector";
 import { getForgejoRunIndex } from "../forgejo/comment-logic";
 import { extractUserRequest } from "../utils/extract-user-request";
+import { parseToolsInput } from "../utils/parse-tools-input";
 export type { CommonFields, PreparedContext } from "./types";
 
 /** Filename for the user request file, read by the SDK runner */
@@ -993,17 +994,19 @@ export async function createPrompt(
       console.log("========================");
     }
 
-    // Set allowed tools
-    const hasActionsReadPermission = false;
+    // Compute disallowed tools — merge user inputs with defaults (fixes upstream #181, #287, #724)
+    // Note: Allowed tools are passed via claudeArgs in prepareTagMode(), not through env vars.
+    // DISALLOWED_TOOLS is consumed by run.ts and passed to runClaude().
+    const userAllowedTools = parseToolsInput(process.env.ALLOWED_TOOLS_INPUT);
+    const userDisallowedTools = parseToolsInput(
+      process.env.DISALLOWED_TOOLS_INPUT,
+    );
 
-    const allAllowedTools = buildAllowedToolsString(
-      [],
-      hasActionsReadPermission,
-      context.inputs.useCommitSigning,
+    const allDisallowedTools = buildDisallowedToolsString(
+      userDisallowedTools,
+      userAllowedTools,
     );
-    const allDisallowedTools = buildDisallowedToolsString([], []);
 
-    core.exportVariable("ALLOWED_TOOLS", allAllowedTools);
     core.exportVariable("DISALLOWED_TOOLS", allDisallowedTools);
   } catch (error) {
     throw new Error(`Create prompt failed with error: ${error}`);