Hmbown/CodeWhale · error

agent profile may not request allow_shell=true

Error message

agent profile {} may not request allow_shell=true

What it means

The permission-expansion guard for agent profiles rejects `allow_shell = true` outright. Agent profiles can only restrict; shell access is a FleetProfile-level grant, so an agent profile requesting shell access fails to load.

Solutions

1. Set allow_shell = false or remove the allow_shell key from the agent profile
2. Grant shell access via the FleetProfile policy if that agent genuinely needs it
3. Split the agent into its own Fleet workspace with an appropriate policy instead of per-agent shell grants

Example fix

// before
[permissions]
allow_shell = true

// after
[permissions]
allow_shell = false
# shell grants configured at FleetProfile policy level

let allow_shell = profile.get("permissions").and_then(|p| p.get("allow_shell")).and_then(|v| v.as_bool()).unwrap_or(false);
if allow_shell {
    eprintln!("agent profile may not set allow_shell=true");
}

match result {
    Err(e) if e.to_string().contains("allow_shell=true") => {
        eprintln!("remove allow_shell from the profile; grant shell via FleetProfile policy");
    }
    other => other?,
}

When it happens

Trigger: An agent profile TOML containing `[permissions] allow_shell = true` (or omitting the key defaults to false so this only fires when explicitly true) passed through agent_profile_from_toml via the profile loader.

Common situations: Copying a workspace/FleetProfile permissions block into an agent profile; trying to give one agent shell access by editing its profile instead of policy; old example configs written before profiles were locked down.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• agent profile may not disable approval_required
• agent profile may not request trust=true
• agent profile tools.posture= would widen permissions; use…
• agent profile cannot be empty
• agent profile must be a simple token

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/6aa62f687f9b92d1. Report an issue: GitHub.

Appendix: source

Thrown at crates/tui/src/fleet/profile.rs:501

    tools: Option<&AgentProfileTools>,
    permissions: Option<&AgentProfilePermissionsToml>,
) -> Result<()> {
    if let Some(posture) = tools
        .and_then(|tools| tools.posture.as_deref())
        .and_then(trimmed_non_empty)
    {
        match posture {
            "read-only" | "readonly" | "read_only" => {}
            other => bail!(
                "agent profile {} tools.posture={other:?} would widen permissions; use FleetProfile policy for grants",
                path.display()
            ),
        }
    }

    if let Some(permissions) = permissions {
        if permissions.allow_shell.unwrap_or(false) {
            bail!(
                "agent profile {} may not request allow_shell=true",
                path.display()
            );
        }
        if permissions.trust.unwrap_or(false) {
            bail!(
                "agent profile {} may not request trust=true",
                path.display()
            );
        }
        if permissions.approval_required == Some(false) {
            bail!(
                "agent profile {} may not disable approval_required",
                path.display()
            );
        }
    }
    Ok(())

View on GitHub (pinned to 73e0f67d83)