fix: #3583044 Say tool:run ran as anonymous when access is denied

Matt Glamanrequested to merge
issue/tool-3583044:3583044-issue-branch into 1.0.x

Closes #3583044 (closed)

What changed

When tool:run is denied access and --uid was omitted, the message says it ran as anonymous and names the option:

Access denied for tool 'permission_gated_tool': The 'administer users' permission is required. Ran as anonymous (uid 0); pass --uid=<id> to run as a user.
  • Only when --uid is omitted. An explicit --uid=0 is deliberate and keeps the plain message.
  • It states what happened and does not suggest uid 1, so it doesn't push agents toward the superuser.
  • error_type stays access_denied.

Testing

ToolRunCommandTest::testRunToolAccessDeniedAnonymousHint() covers omitted --uid (hint, JSON), --uid=0 (no hint), and an authenticated denial (no hint). It fails without the fix. ToolRunCommandTest passes; phpcs and phpstan are clean. The full suite is left to CI.

🤖 Generated with Claude Code

Merge request reports