Hmbown/CodeWhale · error · anyhow::Error

Tool {name} was called with a network address, but this agen

Error message

Tool {name} was called with a network address, but this agent runs with no network capability (`network_tool = false`). Local sources are still available; a remote one needs a member whose saved ceiling grants network tools.

What it means

Error "Tool {name} was called with a network address, but this agent runs with no network capability (`network_tool = false`). Local sources are still available; a remote one needs a member whose saved ceiling grants network tools." thrown in Hmbown/CodeWhale.

Source

Thrown at crates/tui/src/tools/subagent/mod.rs:15046

/// - `rlm{action:"open", url:...}` calls `FetchUrlTool::execute` directly.
/// - `review{target:"https://github.com/o/r/pull/1"}` shells out to `gh pr
///   diff`, which is the network by way of a subprocess.
///
/// Both are now unreachable by name as well (`rlm_open` is denied outright;
/// `review`'s local forms are the ones worth keeping), so this is the layer that
/// catches the *next* one — a tool that grows a `url` field after this list was
/// written. It fails closed and names the posture, so the refusal reads as a
/// contract rather than a malfunction.
fn reject_network_reaching_input(name: &str, input: &Value) -> Result<()> {
    let github_shell_read = matches!(name, "bash" | "Bash" | "exec_shell")
        && input
            .get("command")
            .and_then(Value::as_str)
            .is_some_and(crate::command_safety::is_github_readonly_command);
    if !github_shell_read && !carries_network_url(input) {
        return Ok(());
    }
    Err(anyhow!(
        "Tool {name} was called with a network address, but this agent runs with no network \
         capability (`network_tool = false`). Local sources are still available; a remote one \
         needs a member whose saved ceiling grants network tools."
    ))
}

/// Refuse the unbounded forms of the verification surface for a write-denied
/// child.
///
/// A read-only member keeps `Run` / `run_tests` / `run_verifiers` on purpose:
/// running the checks is what a verifier is *for*, and removing them would make
/// the role useless. But both tools accept an escape hatch that is not
/// verification at all — `run_verifiers` takes `commands`, an array of arbitrary
/// `program` + `args` pairs, and `run_tests` takes `args`, a raw cargo argv.
/// `{"program": "bash", "args": ["-lc", "rm -rf src"]}` is exactly the raw shell
/// that [`crate::fleet::exact::RAW_SHELL_DENYLIST`] just removed, re-entered
/// through the one door that was left open for honest reasons.
///

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Drop the url/network address and use local sources available to this agent
2. Route the remote fetch through a member whose saved ceiling grants network tools
3. Enable network_tool for this agent if the task genuinely requires it

When it happens

Trigger: Thrown at crates/tui/src/tools/subagent/mod.rs:15046 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/14dcf6341abe89f0. Report an issue: GitHub.