Hmbown/CodeWhale · error · anyhow::Error

workflow-tool requires --approval-source explicit-workflow-c

Error message

workflow-tool requires --approval-source explicit-workflow-command

What it means

The workflow-tool subcommand is an approval-gated escape hatch: it must be invoked with --approval-source explicit-workflow-command so the audit trail records a human-sanctioned workflow command rather than autonomous model choice. Any other value -- or a missing flag -- is rejected before the input JSON is even parsed.

Source

Thrown at crates/tui/src/lib.rs:10611

        Ok(()) => Ok(()),
        Err(error) => {
            let _ = emit_exec_stream_event(&ExecStreamEvent::Error {
                error: format!("{error:#}"),
            });
            exit_workflow_tool_failure();
        }
    }
}

async fn run_workflow_tool_command_inner(
    cli: &Cli,
    args: WorkflowToolArgs,
    plugin_registry: std::sync::Arc<crate::plugins::PluginRegistry>,
) -> Result<()> {
    use crate::tools::spec::ToolSpec;

    if args.approval_source != "explicit-workflow-command" {
        bail!("workflow-tool requires --approval-source explicit-workflow-command");
    }
    let input: serde_json::Value = serde_json::from_str(&args.input_json)
        .context("--input-json must be a valid Workflow tool input object")?;
    if !input.is_object() {
        bail!("--input-json must be a JSON object");
    }
    if !input
        .get("action")
        .and_then(serde_json::Value::as_str)
        .is_some_and(|action| action.eq_ignore_ascii_case("run"))
    {
        bail!("workflow-tool accepts only action=run");
    }

    let workspace = resolve_workspace(cli);
    let mut config = load_config_from_cli(cli)?;
    merge_user_workspace_config(&mut config, cli.config.clone(), &workspace);
    if let Ok(env_url) =

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Pass `--approval-source explicit-workflow-command` exactly
2. Prefer the higher-level workflow command that supplies the approval context for you
3. Do not script around the gate -- it exists to keep human approval in the loop

Example fix

# before
codewhale workflow-tool --input-json '{"action":"run"}'

# after
codewhale workflow-tool --approval-source explicit-workflow-command --input-json '{"action":"run"}'

case " $* " in
  *'--approval-source explicit-workflow-command'*) ;;
  *) echo 'workflow-tool requires the explicit approval flag'; exit 1 ;;
esac

When it happens

Trigger: Manually running `codewhale workflow-tool` without the flag; scripts replaying captured tool calls; an agent attempting to invoke the subcommand directly.

Common situations: Automation trying to shortcut the workflow approval path; commands copy/pasted with the flag line dropped.

Related errors

• `codewhale account` does not accept the global `--api-key` f
• --input-json must be a JSON object
• workflow-tool accepts only action=run
• unit must be 'chars' or 'lines'
• max_chars must be > 0

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/d546c685e74c1a58. Report an issue: GitHub.