Tools left out under --tools can now also be excluded by an extra per-tool check

--tools is a command-line option that limits which built-in tools Claude may use in a session. A tool is an action Claude can take, such as reading a file or running a command. When Claude Code works out which tools to withhold under --tools, that step can now also run an extra check on each tool, and that check can exclude a tool.

A tool withheld because --tools does not name it still produces the warning that it "is not on this session's --tools list and no deny rule names it; withheld".