From 370748b243a62599dce3c13bfb9c790dc9f07139 Mon Sep 17 00:00:00 2001
From: mohamed zwanski <mohaaibb4@gmail.com>
Date: Thu, 22 Oct 2026 22:55:25 +0100
Subject: [PATCH] Fix #86: Allow WebFetch/WebSearch in expand-project chat

The expand session writes its own settings file, so user/project
.claude_settings.json do not apply. Add WebFetch, WebSearch and Grep to
its permission allow list and tell the assistant in the prompt that it
can open links the user shares.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .claude/commands/expand-project.md     |  2 ++
 server/services/expand_chat_session.py | 25 +++++++++++++++++--------
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/.claude/commands/expand-project.md b/.claude/commands/expand-project.md
index 731505eb8..63a5f3574 100644
--- a/.claude/commands/expand-project.md
+++ b/.claude/commands/expand-project.md
@@ -80,6 +80,8 @@ Start with open questions:
 - What happens as a result
 - What errors could occur
 
+**Reference material:** If the user shares a link (e.g. design examples, a competitor's page, API docs), open it with the `WebFetch` tool and use what you find to make the features concrete. You may also use `WebSearch` to look up references the user mentions by name. These tools are available to you in this session — do not tell the user you cannot browse the web. You can read files in the project (`Read`, `Glob`, `Grep`), but you cannot write files or run commands; features are created only through the feature tools.
+
 ## Phase 2: Clarify Details
 
 For each new capability, understand:
diff --git a/server/services/expand_chat_session.py b/server/services/expand_chat_session.py
index 66edb94e1..2fcbf4f89 100644
--- a/server/services/expand_chat_session.py
+++ b/server/services/expand_chat_session.py
@@ -44,6 +44,19 @@
     "mcp__features__feature_get_stats",
 ]
 
+# Read-only built-in tools for the expand session. WebFetch/WebSearch let the
+# assistant open reference links the user shares (e.g. design examples).
+# The session uses its own generated settings file, so these must be listed
+# here -- the user's ~/.claude/settings.json and the project's
+# .claude_settings.json do not apply to this chat.
+EXPAND_BUILTIN_TOOLS = [
+    "Read",
+    "Glob",
+    "Grep",
+    "WebFetch",
+    "WebSearch",
+]
+
 
 class ExpandChatSession:
     """
@@ -146,6 +159,9 @@ async def start(self) -> AsyncGenerator[dict, None]:
                 "allow": [
                     "Read(./**)",
                     "Glob(./**)",
+                    "Grep(./**)",
+                    "WebFetch",
+                    "WebSearch",
                     *EXPAND_FEATURE_TOOLS,
                 ],
                 "deny": ["Write", "Edit", "MultiEdit", "NotebookEdit", "Bash"],
@@ -190,14 +206,7 @@ async def start(self) -> AsyncGenerator[dict, None]:
                     effort=effort,  # type: ignore[arg-type]  # SDK 0.1.61 Literal omits "xhigh"
                     cli_path=system_cli,
                     system_prompt=system_prompt,
-                    allowed_tools=[
-                        "Read",
-                        "Glob",
-                        "Grep",
-                        "WebFetch",
-                        "WebSearch",
-                        *EXPAND_FEATURE_TOOLS,
-                    ],
+                    allowed_tools=[*EXPAND_BUILTIN_TOOLS, *EXPAND_FEATURE_TOOLS],
                     disallowed_tools=["Write", "Edit", "MultiEdit", "NotebookEdit", "Bash"],
                     mcp_servers=mcp_servers,  # type: ignore[arg-type]  # SDK accepts dict config at runtime
                     permission_mode="bypassPermissions",