From 60628fbb1361c0ae2d59a626ef00dd4f519c82bf Mon Sep 17 00:00:00 2001 From: damocles Date: Thu, 4 Jun 2026 13:01:42 +0200 Subject: [PATCH] docs(tools/bash): fix incorrect execution tool group claims --- docs/tools/bash.md | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/docs/tools/bash.md b/docs/tools/bash.md index 873f5074..a99f4de0 100644 --- a/docs/tools/bash.md +++ b/docs/tools/bash.md @@ -1,9 +1,11 @@ -# Bash execution tools (`execution` tool group) +# Bash execution tools Background shell execution via `hive-bash-mcp`. Tools land as `mcp__bash__` (the MCP server name is `bash`, not `hyperhive`). -Enabled for any agent whose tool groups include `execution` — the -default preset (`AGENT_DEFAULT`) includes it. +Available on every agent unconditionally — `harness-base.nix` always +injects bash into `hyperhive.extraMcpServers` (with `allowedTools = +["*"]`), so `mcp__bash__*` is in `--allowedTools` for every claude +invocation regardless of tool groups. ## Tools @@ -41,9 +43,11 @@ the tool names in claude are `mcp__bash__run` and `mcp__bash__status`. The `Bash` built-in tool is blocked — all shell execution goes through this structured path so tasks get task-id tracking and structured output. -## Tool whitelist cross-reference +## Relationship to the `execution` tool group -`mcp__bash__run` and `mcp__bash__status` are unconditionally in -`--allowedTools` whenever the harness spawns claude (they are not -gated by the `execution` group at the `--allowedTools` level — the -group only gates whether the MCP server registers the tools at all). +`ToolGroup::Execution` exists and appears in `AGENT_DEFAULT`, but its +`tools()` returns `["run", "status"]` which the harness expands to +`mcp__hyperhive__run` / `mcp__hyperhive__status` — tools that don't +exist in the hyperhive MCP server (dead entries). Removing `execution` +from an agent's groups has no effect on bash availability. Bash is +registered separately via the `extraMcpServers` path described above.