[zwanski-start]

Problem

In the Expand Project ("add feature with AI") chat, Claude kept saying it wasn't allowed to use WebFetch / WebSearch, even when the user pasted a reference URL. The user's own Claude settings and the project's .claude_settings.json have no effect here, because this session builds its own permissions:

• server/services/expand_chat_session.py writes a temporary settings file (.autoforge/.claude_settings.expand.<uuid>.json) and passes it through ClaudeAgentOptions(settings=...). Since no setting_sources are given, user and project settings are not loaded.
• WebFetch and WebSearch were already in allowed_tools, but they were missing from that settings file's permissions.allow list.
• The system prompt is just the expand-project.md skill, which never mentions web tools. So the model assumed it was restricted to Read plus feature creation, and refused.

Changes

• expand_chat_session.py
  • Added WebFetch, WebSearch and Grep to the generated settings permissions.allow list, matching what is already in allowed_tools.
  • Pulled the built-in tool list out into an EXPAND_BUILTIN_TOOLS constant.
  • Added an EXPAND_TOOLS_PROMPT section to the end of the system prompt. It lists the session's tools and says plainly that WebFetch/WebSearch are allowed and should be used when the user shares a link. It still says file changes and commands are not available.
• spec_chat_session.py: added WebFetch and WebSearch to its settings allow-list too. They were already in allowed_tools there, so this is just for consistency.
• New test_expand_chat_session.py (4 tests): replaces ClaudeSDKClient with a fake that records the options and the generated settings file. The tests check that web tools are allowed and not denied, that the prompt mentions them (and $ARGUMENTS is still filled in), and that Write/Edit/MultiEdit/NotebookEdit/Bash stay disabled.
• CLAUDE.md: added the new test to the testing list.

Verification

• python -m pytest test_expand_chat_session.py: 4 passed
• ruff check .: clean
• python test_security.py: all passed
• mypy on the touched files: the only errors are 8 "unused type: ignore" errors that also appear on master. My change adds none.
• I did not run a live Claude session, because that needs real API credentials. No UI files changed, so I didn't check anything in the browser.

Assumptions / notes

• I put the tool note in Python instead of editing .claude/commands/expand-project.md, because that file is also the interactive /expand-project CLI command, where the available tools are different.
• The read-only guarantees from Assistant implementing code and not delegating to agents #233 are unchanged: mutation tools are still in both disallowed_tools and the settings deny list.
• I pushed from a fork because this account only has read access to the upstream repo.

Closes #86

🤖 Generated with Claude Code

[zwanski-start]

🔍 QA report: ✅ Passed

Tester: Ken (cubefarm agent, in a fresh session) · Round: 1 · Author: Barbara

The Expand Project chat now grants WebFetch and WebSearch (plus Grep) in its generated settings file's permissions.allow, matching allowed_tools, and adds a tools section to its system prompt saying they may be used, which fixes issue #86. Write/Edit/MultiEdit/NotebookEdit/Bash stay blocked in both allowed_tools and the settings deny list. The 4 new tests pass here, and 2 of them fail on master for the right reasons. ruff, mypy (same errors as master), the security tests and the UI build all pass, and the app handles a missing Claude CLI gracefully.

	Check	Details
✅	Issue #86: WebFetch/WebSearch granted in the Expand session settings file	Diff review: the generated settings permissions.allow now has WebFetch, WebSearch and Grep(./**), matching allowed_tools. test_settings_file_allows_web_tools passes on the PR and fails on master, which confirms the original gap.
✅	Issue #86: model is told it may use web tools	EXPAND_TOOLS_PROMPT is appended after $ARGUMENTS is filled in, and says WebFetch/WebSearch are allowed when the user shares a URL. The expand-project.md skill has no conflicting instructions. test_system_prompt_advertises_web_tools passes here and fails on master. No live Claude run (needs paid API access).
✅	Read-only guarantees from #233 not weakened	Write/Edit/MultiEdit/NotebookEdit/Bash are still in disallowed_tools and in the settings deny list. test_mutation_tools_remain_disabled passes. The security.py allowlist is unchanged and the security tests pass.
✅	spec_chat_session consistency change	Only adds WebFetch/WebSearch to the settings allow list; they were already in allowed_tools there.
✅	No regressions in Python suite	Full pytest: 21 failures, all in test_devserver_security.py. Master fails the exact same 21 tests, so they predate this PR and are unrelated to it.
✅	mypy unchanged vs master	mypy reports 24 errors in 9 files on both master and this branch, with an identical list of errors.
✅	Graceful degradation without Claude CLI or API key	Server on 127.0.0.1:5345 with no claude on PATH and no Anthropic keys. The expand WebSocket returned {type:error, 'Claude CLI not found...'}, no .claude_settings.expand.*.json file was left behind, and the server log has no tracebacks. REST: GET /api/projects 200, GET /api/expand/sessions/demo 404 (no session), invalid project name 400.
✅	UI: Kanban and Expand Project chat in a real browser	The Kanban board rendered with one feature. The Expand project with AI button opened the chat, which showed Connected. It rendered correctly at a phone width of 390x844. There were no console errors. The chat said 'Resuming existing expansion session' only because my earlier WebSocket probe had opened a session.
⏭️	UI e2e (Playwright)	The PR changes no UI files, so the e2e run was not required. Build and lint were run instead.

🧪 Commands run

Command	Result
python -m pytest test_expand_chat_session.py -v	4 passed
python -m pytest test_expand_chat_session.py (on an origin/master worktree with the new test copied in)	2 failed, 2 passed (expected: the bug is present on master)
python -m pytest -q	21 failed, 148 passed; the same 21 test_devserver_security.py failures occur on master (21 failed, 144 passed)
ruff check .	All checks passed
python test_security.py	ALL TESTS PASSED
python test_security_integration.py	ALL INTEGRATION TESTS PASSED
mypy . (PR vs master)	24 errors in 9 files on both; identical error list
npm --prefix ui run build	success
npm --prefix ui run lint	0 errors, 6 warnings
uvicorn server.main:app --host 127.0.0.1 --port 5345 (no claude CLI, no API keys) + curl/websocket probes	boots; routes return 200/404/400 as expected; expand WS returns a 'Claude CLI not found' error

No browser screenshots were taken in this round.

_{Posted by cubefarm · merges automatically once GitHub's checks pass}