fix(#1548): make set_status always-on regardless of tool groups

hive-ag3nt/src/mcp.rs

@@ -1847,10 +1847,14 @@ fn effective_tool_groups() -> Vec<hive_sh4re::ToolGroup> {
 #[must_use]
 pub fn allowed_mcp_tools(groups: &[hive_sh4re::ToolGroup]) -> Vec<String> {
     // Collect all tool names, deduplicating while preserving order.
+    // Always-on tools (e.g. `set_status`) come first so they're present
+    // regardless of which groups the agent is granted — a misconfigured
+    // agent still has to be able to report its dashboard status.
     let mut seen = std::collections::HashSet::new();
-    let mut out: Vec<String> = groups
+    let mut out: Vec<String> = hive_sh4re::ToolGroup::ALWAYS_ON_TOOLS
         .iter()
-        .flat_map(|g| g.tools())
+        .copied()
+        .chain(groups.iter().flat_map(|g| g.tools().iter().copied()))
         .filter(|t| seen.insert(*t))
         .map(|t| format!("mcp__{SERVER_NAME}__{t}"))
         .collect();
@@ -2076,3 +2080,44 @@ mod recv_hint_tests {
         assert_eq!(out, "(empty)");
     }
 }
+
+#[cfg(test)]
+mod allowed_tools_tests {
+    use super::{SERVER_NAME, allowed_mcp_tools};
+    use hive_sh4re::ToolGroup;
+
+    fn qualified(tool: &str) -> String {
+        format!("mcp__{SERVER_NAME}__{tool}")
+    }
+
+    #[test]
+    fn set_status_present_with_no_groups() {
+        // The whole point of #1548: an agent with zero tool groups
+        // (or any group set that omits `meta`) must still be able to
+        // report its dashboard status.
+        let tools = allowed_mcp_tools(&[]);
+        assert!(
+            tools.contains(&qualified("set_status")),
+            "set_status missing from empty-group allow-list: {tools:?}"
+        );
+    }
+
+    #[test]
+    fn set_status_present_without_meta_group() {
+        let tools = allowed_mcp_tools(&[ToolGroup::Messaging, ToolGroup::Inbox]);
+        assert!(tools.contains(&qualified("set_status")));
+        // get_agent_meta stays gated behind `meta` — only set_status is always-on.
+        assert!(!tools.contains(&qualified("get_agent_meta")));
+    }
+
+    #[test]
+    fn no_duplicate_set_status_when_meta_granted() {
+        let tools = allowed_mcp_tools(&[ToolGroup::Meta]);
+        let count = tools
+            .iter()
+            .filter(|t| **t == qualified("set_status"))
+            .count();
+        assert_eq!(count, 1, "set_status duplicated: {tools:?}");
+        assert!(tools.contains(&qualified("get_agent_meta")));
+    }
+}