fix(tools): skip allowlist guard when tools are explicitly disabled

SymbolStar · SymbolStar · commit 748a217de365 · 2026-05-03T16:56:38.000+08:00
When an embedded model run (e.g. llm-task from a Lobster workflow) intentionally disables tools, the explicit tool allowlist guard from the parent session's alsoAllow config should not fire. Previously it would error with 'No callable tools remain' because the allowlist sources existed but no tools were callable (by design). Return null early from buildEmptyExplicitToolAllowlistError when disableTools is true, since disabling tools is an intentional choice that should not be treated as a configuration failure. Fixes #74019
diff --git a/src/agents/tool-allowlist-guard.test.ts b/src/agents/tool-allowlist-guard.test.ts
@@ -17,16 +17,15 @@ describe("tool allowlist guard", () => {
     expect(error?.message).toContain("no registered tools matched");
   });
 
-  it("fails closed for runtime toolsAllow when tools are disabled", () => {
+  it("skips guard when tools are explicitly disabled for the run", () => {
     const error = buildEmptyExplicitToolAllowlistError({
       sources: [{ label: "runtime toolsAllow", entries: ["query_db"] }],
       callableToolNames: [],
       toolsEnabled: true,
       disableTools: true,
     });
 
-    expect(error?.message).toContain("runtime toolsAllow: query_db");
-    expect(error?.message).toContain("tools are disabled for this run");
+    expect(error).toBeNull();
   });
 
   it("fails closed when the selected model cannot use requested tools", () => {
diff --git a/src/agents/tool-allowlist-guard.ts b/src/agents/tool-allowlist-guard.ts
@@ -20,19 +20,19 @@ export function buildEmptyExplicitToolAllowlistError(params: {
   toolsEnabled: boolean;
   disableTools?: boolean;
 }): Error | null {
+  if (params.disableTools === true) {
+    return null;
+  }
   const callableToolNames = params.callableToolNames.map(normalizeToolName).filter(Boolean);
   if (params.sources.length === 0 || callableToolNames.length > 0) {
     return null;
   }
   const requested = params.sources
     .map((source) => `${source.label}: ${source.entries.map(normalizeToolName).join(", ")}`)
     .join("; ");
-  const reason =
-    params.disableTools === true
-      ? "tools are disabled for this run"
-      : params.toolsEnabled
-        ? "no registered tools matched"
-        : "the selected model does not support tools";
+  const reason = params.toolsEnabled
+    ? "no registered tools matched"
+    : "the selected model does not support tools";
   return new Error(
     `No callable tools remain after resolving explicit tool allowlist (${requested}); ${reason}. Fix the allowlist or enable the plugin that registers the requested tool.`,
   );
