{"record":{"id":"fe543803de2afa1e","repo":"Hmbown/CodeWhale","slug":"tool-web-is-limited-to-search-fetch-in-the-read-on","errorCode":null,"errorMessage":"Tool Web is limited to search/fetch in the read-only evidence profile","messagePattern":"Tool Web is limited to search/fetch in the read-only evidence profile","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/tools/subagent/mod.rs","lineNumber":14751,"sourceCode":"\n    async fn execute_full(\n        &self,\n        agent_id: &str,\n        tool_id: &str,\n        name: &str,\n        input: Value,\n    ) -> Result<RichToolResult> {\n        if self.role_blocks_unhardened_process_tool(name) {\n            return Err(anyhow!(\n                \"Tool {name} is not available to this read-only worker because its process path does not share the hardened evidence boundary. Use read/search, classifier-bounded bash reads, or the verifier's bounded Run tool instead.\"\n            ));\n        }\n        let action = input.get(\"action\").and_then(Value::as_str);\n        if matches!(&self.agent_type, FleetRole::Scout | FleetRole::Reviewer)\n            && name == \"Web\"\n            && !matches!(action, Some(\"search\" | \"fetch\"))\n        {\n            return Err(anyhow!(\n                \"Tool Web is limited to search/fetch in the read-only evidence profile\"\n            ));\n        }\n        let family_action_allowed = if !Self::ACTION_ALIASES\n            .iter()\n            .any(|(family, _, _)| *family == name)\n        {\n            true\n        } else if let Some(action) = action {\n            self.is_action_allowed(name, action)\n        } else {\n            self.allowed_tools\n                .as_ref()\n                .is_none_or(|list| list.iter().any(|allowed| allowed == name))\n        };\n        if !self.is_tool_allowed(name) || !family_action_allowed {\n            return Err(anyhow!(\"Tool {name} not allowed for this sub-agent\"));\n        }","sourceCodeStart":14733,"sourceCodeEnd":14769,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/tools/subagent/mod.rs#L14733-L14769","documentation":"Role-profile guard in the read-only evidence worker's execute_full: the Web tool was invoked with an action outside search/fetch (the matched action fell outside the allowed set). The read-only evidence profile deliberately narrows Web to retrieval; mutating or exotic Web actions are refused before dispatch.","triggerScenarios":"Thrown at crates/tui/src/tools/subagent/mod.rs:14751 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Restrict Web calls to search or fetch actions in this worker","Perform other Web actions from a write-capable agent or the parent","Check the action alias used — unknown aliases also fail the allow set"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}