Description
Tool availability changes across modes and permission gates are difficult for agents to interpret.
Observed behavior
In a branch-cleanup planning test:
- In Plan Mode, shell execution was blocked.
- The agent asked the user to switch to Agent or YOLO mode.
- The user approved proceeding.
- In Agent Mode,
exec_shell was still unavailable because shell access was gated by allow_shell.
- The agent then asked again for either
allow_shell = true or YOLO mode.
The transcript made it hard to distinguish whether the problem was Plan Mode, Agent Mode, allow_shell, deferred tool loading, or the active tool catalog.
Why this is confusing
The agent experiences this as a missing-tool or rejected-tool event, but the underlying cause can be several different layers:
- current collaboration mode
- shell permission setting
- auto-approval mode
- deferred tool catalog state
- workspace trust/config policy
The user and agent then have to debug the harness state instead of the task.
Impact
Agent Mode can feel broken even when the underlying policy is behaving as configured. The model may incorrectly tell the user to switch modes when the real blocker is a separate permission gate.
Environment
- codewhale version: observed around v0.8.52
- Target milestone: v0.8.53
- Area: modes, tool availability, permissions, shell gating
Description
Tool availability changes across modes and permission gates are difficult for agents to interpret.
Observed behavior
In a branch-cleanup planning test:
exec_shellwas still unavailable because shell access was gated byallow_shell.allow_shell = trueor YOLO mode.The transcript made it hard to distinguish whether the problem was Plan Mode, Agent Mode,
allow_shell, deferred tool loading, or the active tool catalog.Why this is confusing
The agent experiences this as a missing-tool or rejected-tool event, but the underlying cause can be several different layers:
The user and agent then have to debug the harness state instead of the task.
Impact
Agent Mode can feel broken even when the underlying policy is behaving as configured. The model may incorrectly tell the user to switch modes when the real blocker is a separate permission gate.
Environment