Function apply_blocked_tools 

pub(crate) fn apply_blocked_tools(
    settings: &mut SessionLaunchSettings,
    kind: SessionKind,
    interactive: bool,
)

Deny every session - lead, resumed or worker - the tools forge has replaced, merging into a --disallowedTools value already there, so the flag is emitted once with every name in it rather than twice. A worker’s spawn is the case that carries one: its own denials already hold that entry. Called from the one spawn path every session goes through and from the respawn stamp, so no launch can be assembled without it.

interactive decides the question denial, and each caller answers it from the only place it can. A worker’s spawn hands it the flag it was given; a respawn reads the worker’s stored row, which is where the flag outlives the launch settings a view rebuilds. The one spawn path in get_agent_handle_at_key passes true because it cannot know: a worker’s build_worker_extra_args has already written that name into the same entry, and the merge leaves it there.