Hmbown/CodeWhale · error · anyhow::Error

Tool {name} was called with operator-supplied commands or ar

Error message

Tool {name} was called with operator-supplied commands or arguments that can name a program or redirect what runs, which spawns arbitrary programs and can mutate the workspace. This agent runs read-only, so only the built-in verification gates and test-selection arguments are available. Drop `commands`, drop the redirecting flag, or use a write-capable role.

What it means

Error "Tool {name} was called with operator-supplied commands or arguments that can name a program or redirect what runs, which spawns arbitrary programs and can mutate the workspace. This agent runs read-only, so only the built-in verification gates and test-selection arguments are available. Drop `commands`, drop the redirecting flag, or use a write-capable role." thrown in Hmbown/CodeWhale.

Source

Thrown at crates/tui/src/tools/subagent/mod.rs:15081

/// through the one door that was left open for honest reasons.
///
/// So the tools stay and the arbitrary arguments go. The default form — the one
/// the deny list's comment actually promises is bounded — keeps working.
fn reject_unbounded_verification(name: &str, input: &Value, shell: bool) -> Result<()> {
    use crate::tools::execution_envelope::{VerificationBound, classify_verification};

    match classify_verification(canonical_action_alias(name, input), input) {
        None | Some(VerificationBound::Default) => Ok(()),
        // A pure test selection is what the shipped `verifier` role exists to
        // run. It starts a process, so it costs shell authority — and nothing
        // else, because `write` is not what a test filter needs.
        Some(VerificationBound::Filter) if shell => Ok(()),
        Some(VerificationBound::Filter) => Err(anyhow!(
            "Tool {name} was called with test-selection arguments, which start a test process, \
             and this agent has no shell authority. Drop `args` to run the default verification \
             gate."
        )),
        Some(VerificationBound::Unbounded) => Err(anyhow!(
            "Tool {name} was called with operator-supplied commands or arguments that can name a \
             program or redirect what runs, which spawns arbitrary programs and can mutate the \
             workspace. This agent runs read-only, so only the built-in verification gates and \
             test-selection arguments are available. Drop `commands`, drop the redirecting flag, \
             or use a write-capable role."
        )),
    }
}

fn is_internal_coordination_state_tool(name: &str) -> bool {
    matches!(
        name,
        "agent"
            | "agents/list"
            | "agents/message"
            | "agents/followup"
            | "agents/interrupt"
            | "agents/coordinate"

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Drop the commands array / redirecting flag and run the built-in verification gate
2. Move the arbitrary command to a write-capable role or the parent
3. Keep read-only verifiers on the default bounded form of run_verifiers/run_tests

When it happens

Trigger: Thrown at crates/tui/src/tools/subagent/mod.rs:15081 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/acec635504585ebf. Report an issue: GitHub.