From 6ddc1129406421ae98ea571fa39ab74d0f72bc06 Mon Sep 17 00:00:00 2001 From: viettranx Date: Sun, 5 Apr 2026 22:27:16 +0700 Subject: [PATCH] fix(prompt): skip credentialed CLI context when exec tool is denied MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Agents with exec in their deny list cannot run CLI commands, so injecting wrangler/gh credential context is misleading — the LLM sees instructions for tools it cannot use. Gate the section on exec being present in the filtered tool list. --- internal/agent/systemprompt.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/internal/agent/systemprompt.go b/internal/agent/systemprompt.go index 60f68108..bf94ce57 100644 --- a/internal/agent/systemprompt.go +++ b/internal/agent/systemprompt.go @@ -217,8 +217,9 @@ func BuildSystemPrompt(cfg SystemPromptConfig) string { lines = append(lines, buildToolCallStyleSection()...) } - // 2.5. Credentialed CLI context (appended after tooling, before safety) — skip during bootstrap - if !cfg.IsBootstrap && cfg.CredentialCLIContext != "" { + // 2.5. Credentialed CLI context (appended after tooling, before safety) — skip during bootstrap. + // Only inject when exec tool is available — CLI tools require exec to run. + if !cfg.IsBootstrap && cfg.CredentialCLIContext != "" && slices.Contains(cfg.ToolNames, "exec") { lines = append(lines, cfg.CredentialCLIContext, "") }