vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#2356): enable built-in bash for choom by dropping it from managed-settings deny

Browse source
This commit is contained in:
damocles 2026-07-10 17:50:43 +02:00 • committed by mara
commit 3e2565d355
2 changed files with 19 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

24
docs/turn-loop/mcp.md
View file

@ -185,14 +185,26 @@ status hint moved to the wake prompt + UI header.
- Allowed built-ins: `Edit`, `Glob`, `Grep`, `Read`, `Write`.
- Tool-group-gated built-ins: `WebFetch`, `WebSearch` (added when the
`web_tools` tool group is enabled — see P3RM1SS10NS tab).
- Denied by omission or the managed-settings deny list
(`/etc/claude-code/managed-settings.json`): `Bash`, `Task`,
`NotebookEdit`, `TodoWrite`.
- Denied by omission (absent from the harness `--tools` /
`--allowedTools`, so they "literally don't exist" in a harness turn):
`Bash`, `Task`, `NotebookEdit`, `TodoWrite`.
- Additionally in the managed-settings deny list
(`/etc/claude-code/managed-settings.json`, un-overridable): `Task`,
`TodoWrite`. `Bash` is **not** in the managed deny — see below.
- Allowed MCP tools: as listed above (by tool group).
`Bash` is disallowed — shell execution goes through
`mcp__bash__run` (background tasks with structured output +
task-id tracking) instead of an interactive shell. The bash MCP server
`Bash` is disallowed for the autonomous harness — shell execution goes
through `mcp__bash__run` (background tasks with structured output +
task-id tracking) instead of an interactive shell. The harness gate is
`--tools` / `--allowedTools` (Bash absent from `ALLOWED_BUILTIN_TOOLS`),
so Bash never exists in a harness turn regardless of managed settings.
`Bash` is deliberately **not** in the managed-settings deny so that the
operator-driven `hivectl choom` session — which passes neither `--tools`
nor `--allowedTools` — gets claude's built-in synchronous `Bash` tool
(inline, human-approved). That sidesteps the async `mcp__bash__run`
completion wake landing in the wrong session (the harness inbox) for a
choom-started task (#2356); `choom` is an operator (root) action, so
built-in shell there stays within the existing trust boundary. The bash MCP server
(`run` / `status` / `kill`) uses `allowedTools = ["*"]` so all
`mcp__bash__*` tools are always available regardless of tool groups.