zeroclaw-labs/zeroclaw · error · anyhow::Error

--allowed-tool is only supported with --prompt cron jobs

Error message

--allowed-tool is only supported with --prompt cron jobs

What it means

In the expression-based cron creation path (cron add with --expression), a tool allowlist only exists for agent prompt jobs: --allowed-tool constrains which tools an agent may use while executing its prompt. A shell job (created without --prompt) runs a fixed command string, so an allowlist has no meaning and is rejected before the job is stored.

Source

Thrown at src/cron/mod.rs:225

                );
                println!(
                    "{}",
                    get_required_cli_string_with_args(
                        "cli-cron-next",
                        &[("v", &job.next_run.to_rfc3339())]
                    )
                );
                println!(
                    "{}",
                    get_required_cli_string_with_args(
                        "cli-cron-prompt",
                        &[("v", job.prompt.as_deref().unwrap_or_default())]
                    )
                );
                print_delivery_line(&job);
            } else {
                if !allowed_tools.is_empty() {
                    bail!("--allowed-tool is only supported with --prompt cron jobs");
                }
                let job = add_shell_job_with_approval(
                    config,
                    &agent_alias,
                    None,
                    schedule,
                    &command,
                    delivery,
                    false,
                )?;
                println!(
                    "{}",
                    get_required_cli_string_with_args("cli-cron-added", &[("id", &job.id)])
                );
                println!(
                    "{}",
                    get_required_cli_string_with_args("cli-cron-expr2", &[("v", &job.expression)])
                );

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Remove the --allowed-tool flags; shell jobs are gated by the approval flow instead (add_shell_job_with_approval).
2. Or switch the job to an agent prompt job by passing --prompt so the allowlist applies.
3. If you need to constrain a shell job, put the constraint inside the command itself (full path, sandboxing wrapper) rather than an agent allowlist.

Example fix

# before
zeroclaw cron add bot --expression '0 3 * * *' --command 'backup.sh' --allowed-tool bash
# after (shell job: drop the flag)
zeroclaw cron add bot --expression '0 3 * * *' --command 'backup.sh'
# after (agent job: keep the flag, add --prompt)
zeroclaw cron add bot --expression '0 3 * * *' --prompt 'run the backup' --allowed-tool bash

fn validate_cron_add(is_prompt: bool, allowed_tools: &[String]) -> Result<(), String> {
    if !is_prompt && !allowed_tools.is_empty() {
        Err("--allowed-tool requires --prompt on cron add".into())
    } else {
        Ok(())
    }
}
// run before shelling out to `zeroclaw cron add ...`

enum JobSpec<'a> {
    Prompt { allowed_tools: &'a [String] },
    Shell,
}
// constructing JobSpec::Shell forces the caller to drop allowed_tools;
// only JobSpec::Prompt can carry them, making the bad state unrepresentable

match run_cron_add(args).await {
    Err(e) if e.to_string().contains("only supported with --prompt") => {
        // strip --allowed-tool or re-issue with --prompt; never retry unchanged
    }
    other => other,
}

When it happens

Trigger: `zeroclaw cron add <alias> --expression '...' --command 'backup.sh' --allowed-tool bash` — i.e. the Add path without --prompt while one or more --allowed-tool values are present.

Common situations: Copy-pasting a prompt-job command line and swapping --prompt for --command; scripts templating one flag set over all job types; assuming allowlists gate shell commands the way approval prompts do.

Related errors

• --allowed-tool is only supported for agent cron jobs
• cli-cron-update-no-field
• Cannot update expression/tz on a non-cron schedule
• Unknown agent {agent_alias:?} (no [agents.{agent_alias}] ent
• cli-skills-install-skill-requires-git

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/488f4c6e95e55ad8. Report an issue: GitHub.