{"record":{"id":"d546c685e74c1a58","repo":"Hmbown/CodeWhale","slug":"workflow-tool-requires-approval-source-explicit","errorCode":null,"errorMessage":"workflow-tool requires --approval-source explicit-workflow-command","messagePattern":"workflow-tool requires --approval-source explicit-workflow-command","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/lib.rs","lineNumber":10611,"sourceCode":"        Ok(()) => Ok(()),\n        Err(error) => {\n            let _ = emit_exec_stream_event(&ExecStreamEvent::Error {\n                error: format!(\"{error:#}\"),\n            });\n            exit_workflow_tool_failure();\n        }\n    }\n}\n\nasync fn run_workflow_tool_command_inner(\n    cli: &Cli,\n    args: WorkflowToolArgs,\n    plugin_registry: std::sync::Arc<crate::plugins::PluginRegistry>,\n) -> Result<()> {\n    use crate::tools::spec::ToolSpec;\n\n    if args.approval_source != \"explicit-workflow-command\" {\n        bail!(\"workflow-tool requires --approval-source explicit-workflow-command\");\n    }\n    let input: serde_json::Value = serde_json::from_str(&args.input_json)\n        .context(\"--input-json must be a valid Workflow tool input object\")?;\n    if !input.is_object() {\n        bail!(\"--input-json must be a JSON object\");\n    }\n    if !input\n        .get(\"action\")\n        .and_then(serde_json::Value::as_str)\n        .is_some_and(|action| action.eq_ignore_ascii_case(\"run\"))\n    {\n        bail!(\"workflow-tool accepts only action=run\");\n    }\n\n    let workspace = resolve_workspace(cli);\n    let mut config = load_config_from_cli(cli)?;\n    merge_user_workspace_config(&mut config, cli.config.clone(), &workspace);\n    if let Ok(env_url) =","sourceCodeStart":10593,"sourceCodeEnd":10629,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/lib.rs#L10593-L10629","documentation":"The workflow-tool subcommand is an approval-gated escape hatch: it must be invoked with --approval-source explicit-workflow-command so the audit trail records a human-sanctioned workflow command rather than autonomous model choice. Any other value -- or a missing flag -- is rejected before the input JSON is even parsed.","triggerScenarios":"Manually running `codewhale workflow-tool` without the flag; scripts replaying captured tool calls; an agent attempting to invoke the subcommand directly.","commonSituations":"Automation trying to shortcut the workflow approval path; commands copy/pasted with the flag line dropped.","solutions":["Pass `--approval-source explicit-workflow-command` exactly","Prefer the higher-level workflow command that supplies the approval context for you","Do not script around the gate -- it exists to keep human approval in the loop"],"exampleFix":"# before\ncodewhale workflow-tool --input-json '{\"action\":\"run\"}'\n\n# after\ncodewhale workflow-tool --approval-source explicit-workflow-command --input-json '{\"action\":\"run\"}'","handlingStrategy":"validation","validationCode":"case \" $* \" in\n  *'--approval-source explicit-workflow-command'*) ;;\n  *) echo 'workflow-tool requires the explicit approval flag'; exit 1 ;;\nesac","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never script around an approval gate; route through the human-approved workflow command","Keep the flag adjacent to the subcommand in documented examples so it survives copy/paste"],"tags":["workflow","approval","security","argument-validation"],"backgroundTag":"missing-approval-flag","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}