Hmbown/CodeWhale · error · anyhow::Error

Tool {name} not allowed for this sub-agent

Error message

Tool {name} not allowed for this sub-agent

What it means

Permission guard in the sub-agent tool executor: is_tool_allowed(name) or the per-action family check (is_action_allowed) returned false — the tool (or the specific action on an aliased family tool) is not in this agent's allowed_tools list or policy-filtered catalog. The request is refused before hydration or execution.

Source

Thrown at crates/tui/src/tools/subagent/mod.rs:14768

        {
            return Err(anyhow!(
                "Tool Web is limited to search/fetch in the read-only evidence profile"
            ));
        }
        let family_action_allowed = if !Self::ACTION_ALIASES
            .iter()
            .any(|(family, _, _)| *family == name)
        {
            true
        } else if let Some(action) = action {
            self.is_action_allowed(name, action)
        } else {
            self.allowed_tools
                .as_ref()
                .is_none_or(|list| list.iter().any(|allowed| allowed == name))
        };
        if !self.is_tool_allowed(name) || !family_action_allowed {
            return Err(anyhow!("Tool {name} not allowed for this sub-agent"));
        }
        // #3217: authoritative per-role posture — read-only roles cannot mutate
        // and non-`Full`-shell roles cannot run shell, regardless of whether
        // the parent session is auto-approved. This closes the auto-approve
        // bypass where a read-only child could quietly write or shell out.
        if !self.posture_permits_tool(name, Some(&input)) {
            return Err(anyhow!(
                "Tool {name} is not permitted for the read-only Fleet role `{role}`. Use a `builder` or `worker` role (or `custom` with an explicit allowed_tools list) to mutate the workspace or run shell commands.",
                role = self.agent_type.as_str()
            ));
        }
        // The session's permission posture, applied to this child exactly as
        // it is applied to the parent turn: the deterministic Auto-Review
        // floor first, then (Auto-Review) the model guardian for holds it
        // could not prove safe, or (Ask) a prompt raised in the parent's UI.
        // Full Access still fails closed on the non-bypassable safety floor.
        // Role posture and the execution envelope below stay authoritative:
        // this gate can only decide whether a call the role permits also

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Add the tool to the agent's allowed_tools list when spawning
2. Use a role/agent type whose catalog includes the tool
3. For family tools, check whether the specific action is permitted for this agent

When it happens

Trigger: Thrown at crates/tui/src/tools/subagent/mod.rs:14768 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/0aa07dbe01b1e235. Report an issue: GitHub.