Served tool sessions turn off fork subagents and let a tool host approve monitor commands

What

Claude Code can run as an MCP server, serving its tools to another program (a tool host). Two things changed there:

• disableForkSubagent(): a new switch that turns off fork subagents. A subagent is a helper agent Claude starts for a task, and a fork is one that inherits the current conversation. Served MCP sessions now call this switch, next to the existing switches that stop background agent launches, remote agent isolation and background deadlines.
• RunMonitorCommand can now take a monitor_input tied to a ToolHost permission request, so the tool host decides whether the command may run. A separate check (checkMonitorRun) and a claim-and-release step refuse a call that was already started once or was already reported as not started. That refusal reads: "this session was already told that this call had not started, so it can no longer run. Send a new call." If monitor_input arrives without a permission request this server decides, it is refused with "Retrying won't help."
• Without monitor_input, the old path stays: the served Bash check against the deny rules.
• Separately, the side-query request builder now passes toolNames to its request setup.

Why

Programs that drive Claude Code as a tool server cannot use fork subagents, and can take over the decision on monitor commands. A monitor call that was refused or already reported as not started has to be sent again as a new call rather than retried.