Tools can now be blocked for a single turn

What

A turn is one request to Claude and its reply. A request for a turn can now carry a list of tools that are not allowed for that turn only:

• disallowed_tools on a turn request: only names in the form mcp__server__tool are accepted (tools that come from MCP servers, which are add-ons that give Claude extra tools), at most 64 of them. They are added to the deny rules for that turn.
• Queued work: a per-turn disallowedTools list is gathered from the queued items. When replaceDenyRules is set, the list is also added to the deny rules for commands.
• Headless input: in headless mode (Claude Code driven by another program, without its usual screen), incoming user messages now set disallowedTools on the queued command. It is empty for messages delivered by a peer session and worked out from the message otherwise.
• Revoked-tool notices: tools on the turn's list are no longer reported as revoked, so you are not told a tool was taken away when it was blocked on purpose.
• Turn start: at the start of each turn that queries the model, unless skipSkillPermissionReset is set, the list of tools a skill was allowed to use is trimmed. Only tools that are in the turn's disallowedTools list and known to the tool descriptions are kept.

Separately, results from the auto mode classifier (the check that decides whether an action can go ahead without asking you) can now carry an optional category, and one classifier call is marked judgesServedCall: true.

Why

Programs that drive Claude Code can now block particular MCP tools for one turn without changing the session's settings. Skill permissions are reset each turn, so what a skill was allowed earlier may not carry over.