[TheGreatAxios]

Summary

• web_search and web_fetch join the auto-approve read set, so fetching docs no longer blocks where a grep does not
• per-URL/per-query grant keying stays untouched, so a future restriction still scopes grants the same way

Verification

• bun test src/agent/tool-classification.test.ts src/permission/permission.test.ts src/exec/runner.test.ts passes (243 pass, 0 fail)
• bunx tsc --noEmit passes

Closes CL-10556
https://linear.app/abklabs/issue/CL-10556/auto-approve-web-search-and-web-fetch-in-edit-mode

[linear-code]

CL-10556

[corbits-triage]

No changes needed from you. A maintainer will review this pull request.

[TheGreatAxios]

Review · Comment

Adds web_fetch and web_search to the unconditional read-allow set and retargets ask-tier denial tests onto write_file. Per-URL and per-query buildRequests branches are unchanged.

Findings

No findings. bun test src/agent/tool-classification.test.ts src/permission/permission.test.ts src/exec/runner.test.ts src/permission/denial-memory.test.ts — 251 pass, 0 fail.

[TheGreatAxios]

Review · Request changes

Puts web_fetch and web_search on the unconditional read-allow tier. That is not how network egress was classified, and it is not limited to auto/edit mode. Native SSRF checks still run after the gate.

Findings

• src/agent/tool-classification.ts:45 — AUTO_ALLOW_READ_TOOLS now keeps web_fetch and web_search. classifyTool returns allow with no mode check, and decide returns allow before auto, before buildRequests, and before any prompt (src/permission/gate.ts:759). A headless gate with auto unset allows web_fetch of an external URL and web_search of a query that may carry workspace text. On main, that headless web_fetch was denied. run_shell curl -d still asks in every mode via network-upload. --no-auto only restores ask-on-write, so it does not gate these tools. The tests at src/permission/permission.test.ts:625 lock in the wider allow. Per-URL grant keying is now dead for these tools because the short-circuit always wins, which also makes the comment at src/agent/tool-classification.ts:39 (a future restriction still scopes grants) untrue.

Suggest gating the allow on edit/auto mode, or keeping these tools on the ask path outside that mode, and adding a regression that fails if headless or auto: false allows them while curl -d still asks.