From 0da736f2a1ed6803e4d307cd9936c8b9e663dd07 Mon Sep 17 00:00:00 2001 From: iris Date: Tue, 2 Jun 2026 11:34:21 +0200 Subject: [PATCH] fix(docs): web_tools is a tool group, not a capability Remove web_tools from the C4P4B1L1T13S table in dashboard.md and add it to the T00L GR0UPS section with a note that it gates Claude built-ins rather than MCP tools. Fix turn-loop.md to say 'tool-group-gated' and 'web_tools tool group' throughout. --- docs/turn-loop.md | 8 ++++---- docs/web-ui/dashboard.md | 8 +++++--- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/docs/turn-loop.md b/docs/turn-loop.md index e556d8aa..e768e342 100644 --- a/docs/turn-loop.md +++ b/docs/turn-loop.md @@ -574,8 +574,8 @@ status hint moved to the wake prompt + UI header. ### Tool whitelist (`mcp::ALLOWED_BUILTIN_TOOLS`) - Allowed built-ins: `Edit`, `Glob`, `Grep`, `Read`, `Write`. -- Capability-gated built-ins: `WebFetch`, `WebSearch` (added when the - `web_tools` capability is granted — see P3RM1SS10NS tab). +- Tool-group-gated built-ins: `WebFetch`, `WebSearch` (added when the + `web_tools` tool group is enabled — see P3RM1SS10NS tab). - Denied by omission or `claude-settings.json` deny list: `Bash`, `Task`, `NotebookEdit`, `TodoWrite`. - Allowed MCP tools: as listed above per flavor. @@ -585,6 +585,6 @@ status hint moved to the wake prompt + UI header. task-id tracking) instead of an interactive shell. The `bash_run` / `bash_status` MCP tools are always in the `--allowedTools` list. -`WebFetch` / `WebSearch` are off by default; grant the `web_tools` -capability in the P3RM1SS10NS tab and rebuild the agent to enable them. +`WebFetch` / `WebSearch` are off by default; enable the `web_tools` +tool group in the P3RM1SS10NS tab and rebuild the agent to enable them. diff --git a/docs/web-ui/dashboard.md b/docs/web-ui/dashboard.md index b3f02c1a..79f56f86 100644 --- a/docs/web-ui/dashboard.md +++ b/docs/web-ui/dashboard.md @@ -142,7 +142,6 @@ The current capabilities are: | `manage_root_agent` | allows the `set_status` / lifecycle tools on the root manager | | `read_host_journal` | unlocks `get_host_journal` to read journald from inside a container | | `query_agent_state` | allows `get_loose_ends(agent: "")` calls targeting other agents | -| `web_tools` | adds Claude's built-in `WebFetch` (fetch a URL) and `WebSearch` (web search) to the agent's `--tools` list; off by default | Each row is one agent. Columns are the capability names returned by `GET /api/capabilities` as `caps: Vec`. Checking or unchecking @@ -161,8 +160,11 @@ active for the agent. Backed by `GET /api/tool-groups` (columns) and each save so `HIVE_TOOL_GROUPS` takes effect. The current tool groups are: `messaging`, `meta`, `inbox`, `lifecycle`, -`approvals`, `scheduling`, `diagnostics`, `execution`. All listed in -`ToolGroup::ALL` in `hive-sh4re`. +`approvals`, `scheduling`, `diagnostics`, `execution`, `web_tools`. All +listed in `ToolGroup::ALL` in `hive-sh4re`. The `web_tools` group is +special: it carries no MCP tools; instead it adds Claude's built-in +`WebFetch` and `WebSearch` to `--tools` / `--allowedTools` for that +agent session. Both tables share the same visual shape: `.cap-table-wrap` / `.tg-table-wrap` outer scroll container, `thead` with a label column