Hmbown/CodeWhale · error

agent profile {} may not request allow_shell=true

Error message

agent profile {} may not request allow_shell=true

What it means

Agent profile files may not request permissions.allow_shell = true. Shell access is a security-relevant grant that must come from the FleetProfile policy, not from a self-declared profile, so the loader rejects the file outright (the check treats an absent flag as false).

Source

Thrown at crates/tui/src/fleet/profile.rs:442

    tools: Option<&AgentProfileTools>,
    permissions: Option<&AgentProfilePermissionsToml>,
) -> Result<()> {
    if let Some(posture) = tools
        .and_then(|tools| tools.posture.as_deref())
        .and_then(trimmed_non_empty)
    {
        match posture {
            "read-only" | "readonly" | "read_only" => {}
            other => bail!(
                "agent profile {} tools.posture={other:?} would widen permissions; use FleetProfile policy for grants",
                path.display()
            ),
        }
    }

    if let Some(permissions) = permissions {
        if permissions.allow_shell.unwrap_or(false) {
            bail!(
                "agent profile {} may not request allow_shell=true",
                path.display()
            );
        }
        if permissions.trust.unwrap_or(false) {
            bail!(
                "agent profile {} may not request trust=true",
                path.display()
            );
        }
        if permissions.approval_required == Some(false) {
            bail!(
                "agent profile {} may not disable approval_required",
                path.display()
            );
        }
    }
    Ok(())

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Remove allow_shell (or set it to false) from the profile's [permissions] block
2. If the worker genuinely needs shell, grant it centrally in the FleetProfile policy with review
3. Prefer read-only tools in the profile and keep privileged capabilities out of worker-declared files

Example fix

# before
[permissions]
allow_shell = true

# after
[permissions]
allow_shell = false

fn profile_permissions_ok(permissions: &Option<AgentProfilePermissionsToml>) -> bool {
    permissions
        .as_ref()
        .map(|p| !p.allow_shell.unwrap_or(false))
        .unwrap_or(true)
}

if let Err(err) = load_agent_profile_file(&path) {
    if err.to_string().contains("allow_shell=true") {
        eprintln!("remove allow_shell from the profile; grant shell centrally via FleetProfile policy");
    }
    return Err(err.into());
}

When it happens

Trigger: An agent profile TOML containing [permissions] allow_shell = true.

Common situations: Trying to let a profile run shell commands by editing its TOML; copying a profile from a setup where shell was profile-level; testing whether the flag is honored.

Related errors

• agent profile {} may not request trust=true
• agent profile {} tools.posture={other:?} would widen permiss
• duplicate agent profile id {}
• agent profile path {} is not a directory
• persistent allow rules must be scoped to a workspace

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/6aa62f687f9b92d1. Report an issue: GitHub.