{"record":{"id":"14dcf6341abe89f0","repo":"Hmbown/CodeWhale","slug":"tool-name-was-called-with-a-network-address-but","errorCode":null,"errorMessage":"Tool {name} was called with a network address, but this agent runs with no network capability (`network_tool = false`). Local sources are still available; a remote one needs a member whose saved ceiling grants network tools.","messagePattern":"Tool (.+?) was called with a network address, but this agent runs with no network capability \\(`network_tool = false`\\)\\. Local sources are still available; a remote one needs a member whose saved ceiling grants network tools\\.","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/tools/subagent/mod.rs","lineNumber":15046,"sourceCode":"/// - `rlm{action:\"open\", url:...}` calls `FetchUrlTool::execute` directly.\n/// - `review{target:\"https://github.com/o/r/pull/1\"}` shells out to `gh pr\n///   diff`, which is the network by way of a subprocess.\n///\n/// Both are now unreachable by name as well (`rlm_open` is denied outright;\n/// `review`'s local forms are the ones worth keeping), so this is the layer that\n/// catches the *next* one — a tool that grows a `url` field after this list was\n/// written. It fails closed and names the posture, so the refusal reads as a\n/// contract rather than a malfunction.\nfn reject_network_reaching_input(name: &str, input: &Value) -> Result<()> {\n    let github_shell_read = matches!(name, \"bash\" | \"Bash\" | \"exec_shell\")\n        && input\n            .get(\"command\")\n            .and_then(Value::as_str)\n            .is_some_and(crate::command_safety::is_github_readonly_command);\n    if !github_shell_read && !carries_network_url(input) {\n        return Ok(());\n    }\n    Err(anyhow!(\n        \"Tool {name} was called with a network address, but this agent runs with no network \\\n         capability (`network_tool = false`). Local sources are still available; a remote one \\\n         needs a member whose saved ceiling grants network tools.\"\n    ))\n}\n\n/// Refuse the unbounded forms of the verification surface for a write-denied\n/// child.\n///\n/// A read-only member keeps `Run` / `run_tests` / `run_verifiers` on purpose:\n/// running the checks is what a verifier is *for*, and removing them would make\n/// the role useless. But both tools accept an escape hatch that is not\n/// verification at all — `run_verifiers` takes `commands`, an array of arbitrary\n/// `program` + `args` pairs, and `run_tests` takes `args`, a raw cargo argv.\n/// `{\"program\": \"bash\", \"args\": [\"-lc\", \"rm -rf src\"]}` is exactly the raw shell\n/// that [`crate::fleet::exact::RAW_SHELL_DENYLIST`] just removed, re-entered\n/// through the one door that was left open for honest reasons.\n///","sourceCodeStart":15028,"sourceCodeEnd":15064,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/tools/subagent/mod.rs#L15028-L15064","documentation":"Error \"Tool {name} was called with a network address, but this agent runs with no network capability (`network_tool = false`). Local sources are still available; a remote one needs a member whose saved ceiling grants network tools.\" thrown in Hmbown/CodeWhale.","triggerScenarios":"Thrown at crates/tui/src/tools/subagent/mod.rs:15046 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Drop the url/network address and use local sources available to this agent","Route the remote fetch through a member whose saved ceiling grants network tools","Enable network_tool for this agent if the task genuinely requires it"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}