Hmbown/CodeWhale · error · anyhow::Error

Tool {name} is not permitted for the read-only Fleet role `{

Error message

Tool {name} is not permitted for the read-only Fleet role `{role}`. Use a `builder` or `worker` role (or `custom` with an explicit allowed_tools list) to mutate the workspace or run shell commands.

What it means

Error "Tool {name} is not permitted for the read-only Fleet role `{role}`. Use a `builder` or `worker` role (or `custom` with an explicit allowed_tools list) to mutate the workspace or run shell commands." thrown in Hmbown/CodeWhale.

Source

Thrown at crates/tui/src/tools/subagent/mod.rs:14775

            .any(|(family, _, _)| *family == name)
        {
            true
        } else if let Some(action) = action {
            self.is_action_allowed(name, action)
        } else {
            self.allowed_tools
                .as_ref()
                .is_none_or(|list| list.iter().any(|allowed| allowed == name))
        };
        if !self.is_tool_allowed(name) || !family_action_allowed {
            return Err(anyhow!("Tool {name} not allowed for this sub-agent"));
        }
        // #3217: authoritative per-role posture — read-only roles cannot mutate
        // and non-`Full`-shell roles cannot run shell, regardless of whether
        // the parent session is auto-approved. This closes the auto-approve
        // bypass where a read-only child could quietly write or shell out.
        if !self.posture_permits_tool(name, Some(&input)) {
            return Err(anyhow!(
                "Tool {name} is not permitted for the read-only Fleet role `{role}`. Use a `builder` or `worker` role (or `custom` with an explicit allowed_tools list) to mutate the workspace or run shell commands.",
                role = self.agent_type.as_str()
            ));
        }
        // The session's permission posture, applied to this child exactly as
        // it is applied to the parent turn: the deterministic Auto-Review
        // floor first, then (Auto-Review) the model guardian for holds it
        // could not prove safe, or (Ask) a prompt raised in the parent's UI.
        // Full Access still fails closed on the non-bypassable safety floor.
        // Role posture and the execution envelope below stay authoritative:
        // this gate can only decide whether a call the role permits also
        // clears the session's approval boundary.
        if let ChildGateVerdict::Deny(reason) =
            self.gate_held_call(agent_id, tool_id, name, &input).await
        {
            return Err(anyhow!(reason));
        }
        reject_subagent_terminal_takeover(name, &input)?;

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Use a builder or worker role for this child so it can mutate the workspace and run shell commands
2. Use a custom role with an explicit allowed_tools list granting the needed tools
3. Keep read-only Fleet agents on read/search-style tools only

When it happens

Trigger: Thrown at crates/tui/src/tools/subagent/mod.rs:14775 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/2f029986f9a630ce. Report an issue: GitHub.