From 4ee7967e2acca9d91467dea80c79ea397626a7c2 Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Tue, 2 Jun 2026 09:28:14 +0200
Subject: [PATCH] deprecate allowedBashPatterns with warning instead of hard
 removal

---
 nix/templates/harness-base.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index b4c70e2d..d59d11f8 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -129,6 +129,17 @@ in
     '';
   };
 
+  options.hyperhive.allowedBashPatterns = lib.mkOption {
+    type = lib.types.listOf lib.types.str;
+    default = [ ];
+    description = ''
+      Deprecated - has no effect. The built-in Bash tool is fully
+      disabled regardless of this list; agents use mcp__hyperhive__bash_run
+      instead. Remove this option from your agent.nix.
+    '';
+    visible = false;
+  };
+
   options.hyperhive.allowedRecipients = lib.mkOption {
     type = lib.types.listOf lib.types.str;
     default = [ ];
@@ -599,6 +610,12 @@ in
   };
 
   config = {
+    warnings = lib.optional (config.hyperhive.allowedBashPatterns != [ ]) ''
+      hyperhive.allowedBashPatterns is deprecated and has no effect.
+      The built-in Bash tool is fully disabled; agents use mcp__hyperhive__bash_run instead.
+      Remove allowedBashPatterns from your agent.nix.
+    '';
+
     assertions = [
       # Guard the inputs-routed-as-output pattern: the agent flake.nix is
       # expected to set `_module.args.flakeInputs = builtins.removeAttrs inputs ["self"]`.