# CLI-046 Tasks

Spec: `.agents/spec-docs/done/CLI-046-denied-tools-flag.md`

## Tasks

- [x] TC-01: --denied-tools Bash → deniedTools parsed as 'Bash'; split and passed to createSession({ deniedTools: ['Bash'] }) in print-mode.ts
- [x] TC-02: --denied-tools "_" → deniedTools parsed as '_'; runtime receives ['*'] → all tools blocked by permission enforcer wildcard
- [x] TC-03: toSessionRunOptions with both allowedTools and deniedTools → both preserved; denied-wins enforced by permission-enforcer.ts in agent-framework

## Unit Tests Added

`packages/agent-cli/src/utils/__tests__/cli-args.test.ts` — `denied-tools flag` describe block (5 tests, TC-01/TC-02/TC-03 labeled inline)
