{"record":{"id":"87c99a3c3b685e3d","repo":"deepseek-ai/deepseek-harness","slug":"tools-restrict-is-a-no-op-pass-allow-and-or","errorCode":null,"errorMessage":"tools.restrict({}) is a no-op: pass `allow` and/or `deny` (an empty filter is almost always a materialized-empty-config bug)","messagePattern":"tools\\.restrict\\((.+?)\\) is a no-op: pass `allow` and/or `deny` \\(an empty filter is almost always a materialized-empty-config bug\\)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/tools/src/index.ts","lineNumber":1079,"sourceCode":"    )\n  }\n\n  /**\n   * Restrict global tools for the calling agent scope. Empty filters, unknown\n   * names, scope-local names, and reserved transport names fail. Restrictions\n   * intersect; scoped registrations remain visible.\n   * @param filter - global-tool mask: `allow` (keep only) and/or `deny` (remove).\n   * @returns the exact disposer that lifts this restriction.\n   */\n  restrict(filter: ToolRestriction): () => void {\n    const scope = scopeOf(this.ctx)\n    if (scope === undefined) {\n      throw new Error('tools.restrict() requires a scoped context (agent.ctx): a context-global restriction would mask every agent — deny the tool for the intended agent instead')\n    }\n    const allow = filter.allow\n    const deny = filter.deny\n    if (allow === undefined && deny === undefined) {\n      throw new Error('tools.restrict({}) is a no-op: pass `allow` and/or `deny` (an empty filter is almost always a materialized-empty-config bug)')\n    }\n    const compiled: CompiledToolRestriction = {\n      ...allow !== undefined ? { allow: new Set(allow) } : {},\n      ...deny !== undefined ? { deny: new Set(deny) } : {},\n    }\n    if ([...allow ?? [], ...deny ?? []].includes(RUN_CODE_NAME)) {\n      throw new Error(`tools.restrict() cannot name reserved Code Mode presentation transport \"${RUN_CODE_NAME}\"; restrict end-capability tools instead`)\n    }\n    const known = this.view(scope).restrictableNames\n    const unknown = [...allow ?? [], ...deny ?? []].filter(name => !known.has(name))\n    if (unknown.length > 0) {\n      throw new Error(`tools.restrict() names unknown global tool${unknown.length > 1 ? 's' : ''} ${unknown.map(n => `\"${n}\"`).join(', ')}; known global tools: ${[...known].sort().join(', ') || '(none)'}`)\n    }\n    return this.layers.effect(\n      this.ctx,\n      layer => layer.restrictions.append(compiled),\n      { label: 'tools.restrict()' },\n    )","sourceCodeStart":1061,"sourceCodeEnd":1097,"githubUrl":"https://github.com/deepseek-ai/deepseek-harness/blob/b150a551b8d465e31e418e1b2eaf5e79bbb7d28e/packages/core/tools/src/index.ts#L1061-L1097","documentation":"Error \"tools.restrict({}) is a no-op: pass `allow` and/or `deny` (an empty filter is almost always a materialized-empty-config bug)\" thrown in deepseek-ai/deepseek-harness.","triggerScenarios":"Thrown at packages/core/tools/src/index.ts:1079 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b150a551b8d465e31e418e1b2eaf5e79bbb7d28e","analyzedAt":"2026-08-24T18:12:29.105Z","schemaVersion":2},"datasetVersion":"2026-08-24T22:17:12.610Z"}