From 3e2565d35575b4978aef4a169ed6177b3cdeea95 Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Fri, 10 Jul 2026 17:50:43 +0200
Subject: [PATCH] fix(#2356): enable built-in bash for choom by dropping it
 from managed-settings deny

---
 docs/turn-loop/mcp.md                   | 24 ++++++++++++++++++------
 hive-ag3nt/prompts/claude-settings.json |  2 +-
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/docs/turn-loop/mcp.md b/docs/turn-loop/mcp.md
index 2552e64a..82bfba02 100644
--- a/docs/turn-loop/mcp.md
+++ b/docs/turn-loop/mcp.md
@@ -185,14 +185,26 @@ status hint moved to the wake prompt + UI header.
 - Allowed built-ins: `Edit`, `Glob`, `Grep`, `Read`, `Write`.
 - Tool-group-gated built-ins: `WebFetch`, `WebSearch` (added when the
   `web_tools` tool group is enabled — see P3RM1SS10NS tab).
-- Denied by omission or the managed-settings deny list
-  (`/etc/claude-code/managed-settings.json`): `Bash`, `Task`,
-  `NotebookEdit`, `TodoWrite`.
+- Denied by omission (absent from the harness `--tools` /
+  `--allowedTools`, so they "literally don't exist" in a harness turn):
+  `Bash`, `Task`, `NotebookEdit`, `TodoWrite`.
+- Additionally in the managed-settings deny list
+  (`/etc/claude-code/managed-settings.json`, un-overridable): `Task`,
+  `TodoWrite`. `Bash` is **not** in the managed deny — see below.
 - Allowed MCP tools: as listed above (by tool group).
 
-`Bash` is disallowed — shell execution goes through
-`mcp__bash__run` (background tasks with structured output +
-task-id tracking) instead of an interactive shell. The bash MCP server
+`Bash` is disallowed for the autonomous harness — shell execution goes
+through `mcp__bash__run` (background tasks with structured output +
+task-id tracking) instead of an interactive shell. The harness gate is
+`--tools` / `--allowedTools` (Bash absent from `ALLOWED_BUILTIN_TOOLS`),
+so Bash never exists in a harness turn regardless of managed settings.
+`Bash` is deliberately **not** in the managed-settings deny so that the
+operator-driven `hivectl choom` session — which passes neither `--tools`
+nor `--allowedTools` — gets claude's built-in synchronous `Bash` tool
+(inline, human-approved). That sidesteps the async `mcp__bash__run`
+completion wake landing in the wrong session (the harness inbox) for a
+choom-started task (#2356); `choom` is an operator (root) action, so
+built-in shell there stays within the existing trust boundary. The bash MCP server
 (`run` / `status` / `kill`) uses `allowedTools = ["*"]` so all
 `mcp__bash__*` tools are always available regardless of tool groups.
 
diff --git a/hive-ag3nt/prompts/claude-settings.json b/hive-ag3nt/prompts/claude-settings.json
index 34f8aee8..afa99164 100644
--- a/hive-ag3nt/prompts/claude-settings.json
+++ b/hive-ag3nt/prompts/claude-settings.json
@@ -2,6 +2,6 @@
   "autoCompactEnabled": false,
   "autoMemoryEnabled": false,
   "permissions": {
-    "deny": ["Bash", "Task", "TodoWrite"]
+    "deny": ["Task", "TodoWrite"]
   }
 }