The disallowed tools env var read in run.ts was DISALLOWED_TOOLS_INPUT (raw user input) instead of DISALLOWED_TOOLS (computed value including WebSearch/WebFetch defaults). This meant default tool disallowance was never enforced. Also removes orphaned ALLOWED_TOOLS env var export from createPrompt() (tag mode passes allowed tools via claudeArgs instead), extracts shared parseToolsInput utility to eliminate duplication, and adds tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>