{"record":{"id":"47e649ec51151dae","repo":"zeroclaw-labs/zeroclaw","slug":"allowed-tool-is-only-supported-for-agent-cron-jo","errorCode":null,"errorMessage":"--allowed-tool is only supported for agent cron jobs","messagePattern":"--allowed-tool is only supported for agent cron jobs","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/cron/mod.rs","lineNumber":599,"sourceCode":"                        expr,\n                        tz: existing_tz,\n                    } => (expr.clone(), existing_tz.clone()),\n                    _ => bail!(\"Cannot update expression/tz on a non-cron schedule\"),\n                };\n                Some(Schedule::Cron {\n                    expr: expression.unwrap_or(existing_expr),\n                    tz: tz.or(existing_tz),\n                })\n            } else {\n                None\n            };\n\n            if !allowed_tools.is_empty() {\n                let existing = existing\n                    .as_ref()\n                    .expect(\"existing job must be loaded when updating allowed tools\");\n                if existing.job_type != JobType::Agent {\n                    bail!(\"--allowed-tool is only supported for agent cron jobs\");\n                }\n            }\n\n            let patch = CronJobPatch {\n                schedule,\n                command,\n                name,\n                allowed_tools: if allowed_tools.is_empty() {\n                    None\n                } else {\n                    Some(allowed_tools)\n                },\n                uses_memory,\n                delivery,\n                ..CronJobPatch::default()\n            };\n\n            let job = update_shell_job_with_approval(config, &agent_alias, &id, patch, false)?;","sourceCodeStart":581,"sourceCodeEnd":617,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/src/cron/mod.rs#L581-L617","documentation":"When `cron update` receives --allowed-tool values, it loads the existing job and requires its job_type to be JobType::Agent. Tool allowlists exist only for agent prompt jobs; updating a shell job (--command job) with an allowlist is rejected before the CronJobPatch is built, leaving the job unchanged.","triggerScenarios":"`zeroclaw cron update <id> --allowed-tool bash` where job <id> was created without --prompt (shell job via add/add-at/add-every/once), so its job_type is not Agent.","commonSituations":"Trying to add restrictions to an existing shell job after the fact; scripts applying a uniform allowlist update to every job id; converting jobs by patching flags instead of recreating them.","solutions":["Remove --allowed-tool from the update command for shell jobs.","If the allowlist matters, recreate the job as a prompt job (delete + `cron add ... --prompt ... --allowed-tool ...`).","In bulk-update scripts, look up each job's type before deciding whether to emit allowlist flags."],"exampleFix":"# before\nzeroclaw cron update abc123 --allowed-tool bash   # abc123 is a --command job\n# after: recreate as an agent prompt job\nzeroclaw cron remove abc123\nzeroclaw cron add bot --expression '0 5 * * *' --prompt 'run backup' --allowed-tool bash","handlingStrategy":"validation","validationCode":"// before `cron update <id> --allowed-tool ...`, check the job's type\n// `zeroclaw cron list` shows prompt jobs vs command jobs; only send\n// --allowed-tool when the job was created with --prompt","typeGuard":null,"tryCatchPattern":"match run_cron_update(args).await {\n    Err(e) if e.to_string().contains(\"only supported for agent cron jobs\") => {\n        // shell job: drop the allowlist flags; or recreate as a prompt job\n    }\n    other => other,\n}","preventionTips":["Look up job_type before emitting allowlist flags in update scripts.","Standardize on prompt jobs where tool restriction is a requirement, so allowlists are always valid."],"tags":["cron","cli","argument-validation","allowed-tool","update"],"backgroundTag":"invalid-cli-flag-combination","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}