From c0f16c870f9fbdb9f603bb68a5f7db747d342aaa Mon Sep 17 00:00:00 2001
From: iris <iris@hyperhive.local>
Date: Tue, 2 Jun 2026 11:31:33 +0200
Subject: [PATCH] fix(web_tools): remove WebFetch/WebSearch from
 permissions.deny
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The deny list takes precedence over --allowedTools, so granting the
web_tools group had no effect — both tools were silently blocked.

WebFetch/WebSearch are now gated solely via --tools (builtin_tools_arg):
agents without the web_tools tool group don't get them in --tools so
claude never sees them; agents with the group get them in both --tools
and --allowedTools.
---
 hive-ag3nt/prompts/claude-settings.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hive-ag3nt/prompts/claude-settings.json b/hive-ag3nt/prompts/claude-settings.json
index edf04d70..a433e8e7 100644
--- a/hive-ag3nt/prompts/claude-settings.json
+++ b/hive-ag3nt/prompts/claude-settings.json
@@ -3,6 +3,6 @@
   "autoMemoryEnabled": false,
   "effortLevel": "medium",
   "permissions": {
-    "deny": ["Bash", "WebFetch", "WebSearch", "Task", "TodoWrite"]
+    "deny": ["Bash", "Task", "TodoWrite"]
   }
 }