feat(#1058): disallow built-in Bash; remove allowedBashPatterns; prompt sweep

docs/turn-loop.md

@@ -569,22 +569,13 @@ status hint moved to the wake prompt + UI header.
 
 ### Tool whitelist (`mcp::ALLOWED_BUILTIN_TOOLS`)
 
-- Allowed built-ins: `Bash`, `Edit`, `Glob`, `Grep`, `Read`, `Write`.
-- Denied by omission: `WebFetch`, `WebSearch`, `Task`,
-  `NotebookEdit`, `TodoWrite`.
+- Allowed built-ins: `Edit`, `Glob`, `Grep`, `Read`, `Write`.
+- Denied by omission or `claude-settings.json` deny list: `Bash`,
+  `WebFetch`, `WebSearch`, `Task`, `NotebookEdit`, `TodoWrite`.
 - Allowed MCP tools: as listed above per flavor.
 
-By default `Bash` is approved wholesale — any shell command runs
-without confirmation. To restrict an agent to specific command
-families, set `hyperhive.allowedBashPatterns` in its `agent.nix`:
-
-```nix
-hyperhive.allowedBashPatterns = [ "git *" "ls *" ];
-```
-
-The harness reads `/etc/hyperhive/bash-allow.json` and replaces
-`Bash` in `--allowedTools` with `Bash(git *)` + `Bash(ls *)` etc.
-Commands outside the pattern list require confirmation — which in
-`--print` mode means they will not run. An empty list (default) keeps
-the current wholesale `Bash` entry.
+`Bash` is disallowed — shell execution goes through
+`mcp__hyperhive__bash_run` (background tasks with structured output +
+task-id tracking) instead of an interactive shell. The `bash_run` /
+`bash_status` MCP tools are always in the `--allowedTools` list.