{"record":{"id":"cabe7833d6ed580a","repo":"Hmbown/CodeWhale","slug":"fleet-tool-authority-cannot-be-combined-with-exec","errorCode":null,"errorMessage":"Fleet tool authority cannot be combined with exec --resume, --session-id, or --continue","messagePattern":"Fleet tool authority cannot be combined with exec --resume, --session-id, or --continue","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/lib.rs","lineNumber":12980,"sourceCode":"    model: String,\n    prompt: String,\n    output: String,\n    tools: Vec<ExecToolEntry>,\n    outcomes: Vec<ExecOutcome>,\n    status: Option<String>,\n    termination_reason: Option<String>,\n    error_category: Option<String>,\n    error: Option<String>,\n    #[serde(skip_serializing_if = \"Vec::is_empty\")]\n    released_services: Vec<crate::tools::shell::PersistentServiceReceipt>,\n}\n\nfn validate_exec_tool_authority_resume(\n    tool_authority_json: Option<&str>,\n    resuming: bool,\n) -> Result<()> {\n    if tool_authority_json.is_some() && resuming {\n        bail!(\n            \"Fleet tool authority cannot be combined with exec --resume, --session-id, or --continue\"\n        );\n    }\n    Ok(())\n}\n\nfn exec_network_policy(\n    config: &Config,\n    outer_network_access: Option<bool>,\n) -> Option<crate::network_policy::NetworkPolicyDecider> {\n    // Fleet caps are an outer authority boundary: user configuration may\n    // narrow them further, but it may never widen an explicit network denial.\n    if outer_network_access == Some(false) {\n        return Some(crate::network_policy::NetworkPolicyDecider::new(\n            crate::network_policy::NetworkPolicy {\n                default: crate::network_policy::DecisionToml::Deny,\n                ..crate::network_policy::NetworkPolicy::default()\n            },","sourceCodeStart":12962,"sourceCodeEnd":12998,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/lib.rs#L12962-L12998","documentation":"The exec subcommand's tool-authority option (a JSON spec restricting which tools the run may use) is only meaningful for a fresh run. When combined with resume-style flags (--resume, --session-id, --continue), validate_exec_tool_authority_resume rejects it, since a resumed session already has its recorded tool authority and applying a new one would conflict.","triggerScenarios":"Running e.g. `codewhale exec --resume <id> --tool-authority '{...}'`, or `--session-id` / `--continue` together with the tool-authority JSON flag in a single CLI invocation.","commonSituations":"Scripted re-runs that blindly pass all stored flags including tool authority while also resuming; users wanting to tighten permissions on a session mid-flight; copied command lines from docs mixing both options.","solutions":["Drop the --tool-authority flag when resuming; the session restores its own authority","Start a fresh exec run (no --resume/--session-id/--continue) if you need a new tool-authority spec","Split the operation: resume without authority changes, then launch a new run with the new authority"],"exampleFix":"# before\ncodewhale exec --resume abc123 --tool-authority '{\"exec\":\"deny\"}' -p \"continue\"\n# after\ncodewhale exec --resume abc123 -p \"continue\"","handlingStrategy":"validation","validationCode":"if (args.toolAuthority && (args.resume || args.sessionId || args.continue)) {\n  throw new Error(\"--tool-authority is only valid for fresh exec runs\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  runExec(args);\n} catch (e) {\n  if (String(e).includes(\"cannot be combined with exec\")) {\n    // strip --tool-authority and retry the resume without it, or surface choice to user\n  }\n}","preventionTips":["Build CLI wrappers that store resume args and tool-authority args in disjoint profiles","Never persist --tool-authority into saved session resume commands","Document tool-authority as fresh-run-only in team runbooks"],"tags":["cli","flags","validation"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}