{"record":{"id":"cabe7833d6ed580a","repo":"Hmbown/CodeWhale","slug":"fleet-tool-authority-cannot-be-combined-with-exec","errorCode":null,"errorMessage":"Fleet tool authority cannot be combined with exec --resume, --session-id, or --continue","messagePattern":"Fleet tool authority cannot be combined with exec --resume, --session-id, or --continue","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/lib.rs","lineNumber":11294,"sourceCode":"    model: String,\n    prompt: String,\n    output: String,\n    tools: Vec<ExecToolEntry>,\n    outcomes: Vec<ExecOutcome>,\n    status: Option<String>,\n    termination_reason: Option<String>,\n    error_category: Option<String>,\n    error: Option<String>,\n    #[serde(skip_serializing_if = \"Vec::is_empty\")]\n    released_services: Vec<crate::tools::shell::PersistentServiceReceipt>,\n}\n\nfn validate_exec_tool_authority_resume(\n    tool_authority_json: Option<&str>,\n    resuming: bool,\n) -> Result<()> {\n    if tool_authority_json.is_some() && resuming {\n        bail!(\n            \"Fleet tool authority cannot be combined with exec --resume, --session-id, or --continue\"\n        );\n    }\n    Ok(())\n}\n\nfn exec_network_policy(\n    config: &Config,\n    outer_network_access: Option<bool>,\n) -> Option<crate::network_policy::NetworkPolicyDecider> {\n    // Fleet caps are an outer authority boundary: user configuration may\n    // narrow them further, but it may never widen an explicit network denial.\n    if outer_network_access == Some(false) {\n        return Some(crate::network_policy::NetworkPolicyDecider::new(\n            crate::network_policy::NetworkPolicy {\n                default: crate::network_policy::DecisionToml::Deny,\n                ..crate::network_policy::NetworkPolicy::default()\n            },","sourceCodeStart":11276,"sourceCodeEnd":11312,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/lib.rs#L11276-L11312","documentation":"validate_exec_tool_authority_resume rejects combining fleet tool-authority JSON with exec session resumption (--resume, --session-id, --continue). A resumed session restores its own tool surface; applying fresh fleet authority to a restored conversation would change permissions mid-history, so the combination is refused before the turn starts.","triggerScenarios":"Thrown at crates/tui/src/lib.rs:11294 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Drop --tool-authority when resuming a session","Or start a fresh exec run instead of resuming"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}