hive-ag3nt/prompts/claude-settings.json

@@ -1,9 +1,5 @@
 {
   "autoCompactEnabled": false,
   "autoMemoryEnabled": false,
-  "effortLevel": "medium",
+  "effortLevel": "medium"
-  "permissions": {
-    "defaultMode": "bypassPermissions",
-    "deny": ["WebFetch", "WebSearch", "Task", "TodoWrite"]
-  }
 }

hive-ag3nt/src/bin/hive-ag3nt.rs

@@ -6,7 +6,7 @@ use anyhow::Result;
 use clap::{Parser, Subcommand};
 use hive_ag3nt::events::{Bus, LiveEvent, TurnState};
 use hive_ag3nt::login::{self, LoginState};
-use hive_ag3nt::{DEFAULT_SOCKET, DEFAULT_WEB_PORT, client, mcp, plugins, turn, web_ui};
+use hive_ag3nt::{DEFAULT_SOCKET, DEFAULT_WEB_PORT, client, mcp, turn, web_ui};
 use hive_sh4re::{AgentRequest, AgentResponse};
 
 #[derive(Parser)]
@@ -71,7 +71,6 @@ async fn main() -> Result<()> {
             let login_state = Arc::new(Mutex::new(initial));
             let bus = Bus::new();
             let files = turn::TurnFiles::prepare(&cli.socket, &label, mcp::Flavor::Agent).await?;
-            plugins::install_configured().await;
             tokio::spawn(web_ui::serve(
                 label,
                 port,

hive-ag3nt/src/bin/hive-m1nd.rs

@@ -10,7 +10,7 @@ use anyhow::Result;
 use clap::{Parser, Subcommand};
 use hive_ag3nt::events::{Bus, LiveEvent, TurnState};
 use hive_ag3nt::login::{self, LoginState};
-use hive_ag3nt::{DEFAULT_SOCKET, DEFAULT_WEB_PORT, client, mcp, plugins, turn, web_ui};
+use hive_ag3nt::{DEFAULT_SOCKET, DEFAULT_WEB_PORT, client, mcp, turn, web_ui};
 use hive_sh4re::{HelperEvent, ManagerRequest, ManagerResponse, SYSTEM_SENDER};
 
 #[derive(Parser)]
@@ -61,7 +61,6 @@ async fn main() -> Result<()> {
             let login_state = Arc::new(Mutex::new(initial));
             let bus = Bus::new();
             let files = turn::TurnFiles::prepare(&cli.socket, &label, mcp::Flavor::Manager).await?;
-            plugins::install_configured().await;
             tokio::spawn(web_ui::serve(
                 label,
                 port,

hive-ag3nt/src/lib.rs

@@ -6,7 +6,6 @@ pub mod events;
 pub mod login;
 pub mod login_session;
 pub mod mcp;
-pub mod plugins;
 pub mod turn;
 pub mod web_ui;
 

hive-ag3nt/src/mcp.rs

@@ -548,23 +548,86 @@ impl ServerHandler for ManagerServer {}
 /// tools as `mcp__<this>__<tool>` (e.g. `mcp__hyperhive__send`).
 pub const SERVER_NAME: &str = "hyperhive";
 
-/// Which hyperhive MCP surface to advertise — sub-agent (short tool
+/// Built-in claude tools the turn loop enables via `--tools`. Anything not
-/// list) or manager (full lifecycle surface). Threaded through the
+/// in this list literally doesn't exist in the session (claude won't even
-/// system-prompt renderer and the per-flavor web UI dispatch; tool
+/// try to call it). Web egress (`WebFetch`/`WebSearch`) and nested agents
-/// gating itself now lives in `claude-settings.json`'s
+/// (`Task`) are intentionally omitted for now; `Bash` is allowed pending a
-/// `permissions.{defaultMode, deny}`, not here.
+/// finer-grained allow-list system for shell command patterns. Edit later
+/// as our trust model evolves.
+pub const ALLOWED_BUILTIN_TOOLS: &[&str] =
+    &["Bash", "Edit", "Glob", "Grep", "Read", "TodoWrite", "Write"];
+
+/// Which MCP tool surface to advertise via `--allowedTools`. The agent
+/// list is the strict subset of the manager list, so we just thread the
+/// flavor through.
 #[derive(Debug, Clone, Copy)]
 pub enum Flavor {
     Agent,
     Manager,
 }
 
+/// MCP tools claude is allowed to call without prompting. Mirrors the
+/// hyperhive surface so a new tool added in the corresponding `#[tool_router]`
+/// impl needs to be listed here too.
+#[must_use]
+pub fn allowed_mcp_tools(flavor: Flavor) -> Vec<String> {
+    let names: &[&str] = match flavor {
+        Flavor::Agent => &["send", "recv", "ask_operator"],
+        Flavor::Manager => &[
+            "send",
+            "recv",
+            "request_spawn",
+            "kill",
+            "start",
+            "restart",
+            "update",
+            "request_apply_commit",
+            "ask_operator",
+        ],
+    };
+    let mut out: Vec<String> = names
+        .iter()
+        .map(|t| format!("mcp__{SERVER_NAME}__{t}"))
+        .collect();
+    // Extra MCP servers declared via `hyperhive.extraMcpServers` in
+    // the agent's NixOS config. Each entry maps its `allowedTools`
+    // pattern list to `mcp__<server>__<pattern>` so claude can call
+    // them without per-tool operator approval. `["*"]` (the default)
+    // expands to `mcp__<server>__*` — every tool from that server.
+    for (server, spec) in load_extra_mcp() {
+        if server == SERVER_NAME {
+            continue;
+        }
+        for pat in spec.allowed_tools {
+            out.push(format!("mcp__{server}__{pat}"));
+        }
+    }
+    out
+}
+
+/// Combined allow-list passed to `--allowedTools` (auto-approve) — covers
+/// both the built-ins and the MCP surface.
+#[must_use]
+pub fn allowed_tools_arg(flavor: Flavor) -> String {
+    let mut all: Vec<String> = ALLOWED_BUILTIN_TOOLS
+        .iter()
+        .map(|s| (*s).to_owned())
+        .collect();
+    all.extend(allowed_mcp_tools(flavor));
+    all.join(",")
+}
+
+/// Built-in tools list for `--tools` (which built-ins exist in this
+/// session). Same as `ALLOWED_BUILTIN_TOOLS` but joined comma-separated.
+#[must_use]
+pub fn builtin_tools_arg() -> String {
+    ALLOWED_BUILTIN_TOOLS.join(",")
+}
+
 /// Where the NixOS module writes the per-agent extra-MCP spec (see
 /// `nix/templates/harness-base.nix`). Each entry becomes an additional
-/// `mcpServers.<key>` block in the rendered claude config; the
+/// `mcpServers.<key>` block in the rendered claude config + a
-/// `allowedTools` field is parsed for back-compat but no longer wired
+/// `mcp__<key>__<tool>` pattern in `--allowedTools`.
-/// anywhere — under `bypassPermissions` every MCP tool auto-approves
-/// unless listed in `permissions.deny`.
 const EXTRA_MCP_PATH: &str = "/etc/hyperhive/extra-mcp.json";
 
 /// Where the NixOS module writes the per-agent send allow-list (see
@@ -624,7 +687,6 @@ struct ExtraMcpServer {
     env: std::collections::BTreeMap<String, String>,
     #[serde(default = "default_allowed_tools")]
     #[serde(rename = "allowedTools")]
-    #[allow(dead_code)] // back-compat: superseded by `permissions.deny`
     allowed_tools: Vec<String>,
 }
 

hive-ag3nt/src/plugins.rs

@@ -1,48 +0,0 @@
-//! Boot-time `claude plugin install` driver. Reads the list declared
-//! via the `hyperhive.claudePlugins` NixOS option (rendered to
-//! `/etc/hyperhive/claude-plugins.json` by the harness module) and
-//! shells out `claude plugin install <spec>` for each entry. Runs once
-//! per harness boot before the turn loop; `claude plugin install`
-//! is expected to be idempotent so reinstalling on each container
-//! recreate is fine. Failures log a warning but do not abort boot —
-//! we'd rather start without a plugin than refuse to serve.
-
-use tokio::process::Command;
-
-const PLUGINS_PATH: &str = "/etc/hyperhive/claude-plugins.json";
-
-pub async fn install_configured() {
-    let raw = match tokio::fs::read_to_string(PLUGINS_PATH).await {
-        Ok(s) => s,
-        Err(_) => return,
-    };
-    let specs: Vec<String> = match serde_json::from_str(&raw) {
-        Ok(v) => v,
-        Err(e) => {
-            tracing::warn!(path = PLUGINS_PATH, error = ?e, "claude-plugins spec parse failed; skipping");
-            return;
-        }
-    };
-    for spec in specs {
-        match Command::new("claude")
-            .args(["plugin", "install", &spec])
-            .output()
-            .await
-        {
-            Ok(out) if out.status.success() => {
-                tracing::info!(spec = %spec, "claude plugin install ok");
-            }
-            Ok(out) => {
-                tracing::warn!(
-                    spec = %spec,
-                    status = ?out.status,
-                    stderr = %String::from_utf8_lossy(&out.stderr),
-                    "claude plugin install failed",
-                );
-            }
-            Err(e) => {
-                tracing::warn!(spec = %spec, error = ?e, "claude plugin install spawn failed");
-            }
-        }
-    }
-}

hive-ag3nt/src/turn.rs

@@ -22,13 +22,9 @@ use crate::mcp;
 /// to read and edit; we ship it via `include_str!`. We turn off claude's
 /// in-session auto-compaction and its cross-session auto-memory because
 /// hyperhive owns those concerns (`/compact` on overflow, notes
-/// persistence under `/state`). `permissions.defaultMode =
+/// persistence under `/state`). Unknown keys are silently ignored by
-/// bypassPermissions` skips the per-tool approval prompt entirely;
+/// claude-code; if a key gets renamed we'll spot it because the
-/// `permissions.deny` keeps a short list of tools we don't want claude
+/// corresponding behavior will start firing mid-turn again.
-/// reaching for (web egress, nested agents, the ephemeral todo list).
-/// Unknown keys are silently ignored by claude-code; if a key gets
-/// renamed we'll spot it because the corresponding behavior will start
-/// firing mid-turn again.
 const CLAUDE_SETTINGS: &str = include_str!("../prompts/claude-settings.json");
 
 /// Regex-ish marker claude-code emits when context overflows. Same string
@@ -85,10 +81,7 @@ pub async fn write_mcp_config(socket: &Path) -> Result<PathBuf> {
 
 /// Drop the static `--settings` JSON next to the MCP config so we can
 /// pass a path (`--settings <file>`) instead of an ever-growing inline
-/// blob — the CLI argv has a finite length budget. The file carries
+/// blob — the CLI argv has a finite length budget.
-/// `permissions.defaultMode = bypassPermissions` + a small `deny` list,
-/// so everything not in `deny` auto-approves without a per-flavor allow
-/// list.
 pub async fn write_settings(socket: &Path) -> Result<PathBuf> {
     let parent = socket.parent().unwrap_or_else(|| Path::new("/run/hive"));
     tokio::fs::create_dir_all(parent).await.ok();
@@ -254,7 +247,11 @@ async fn run_claude(prompt: &str, files: &TurnFiles, bus: &Bus) -> Result<bool>
     cmd.arg("--system-prompt-file").arg(&files.system_prompt);
     cmd.arg("--mcp-config")
         .arg(&files.mcp_config)
-        .arg("--strict-mcp-config");
+        .arg("--strict-mcp-config")
+        .arg("--tools")
+        .arg(mcp::builtin_tools_arg())
+        .arg("--allowedTools")
+        .arg(mcp::allowed_tools_arg(files.flavor));
     let mut child = cmd
         .stdin(Stdio::piped())
         .stdout(Stdio::piped())

nix/templates/harness-base.nix

@@ -82,22 +82,6 @@
     '';
   };
 
-  options.hyperhive.claudePlugins = lib.mkOption {
-    type = lib.types.listOf lib.types.str;
-    default = [ ];
-    example = [ "formatter@my-marketplace" "thinking-tools@anthropics" ];
-    description = ''
-      Claude Code plugins to install at harness boot. Each entry is
-      passed verbatim to `claude plugin install <spec>` once per
-      container start, before the turn loop opens. `claude plugin
-      install` is expected to be idempotent, so reinstalling on every
-      boot is cheap. Failures log a warning but do not abort boot — a
-      missing plugin is preferable to a non-serving agent. Rendered to
-      `/etc/hyperhive/claude-plugins.json`; the harness reads it via
-      `plugins::install_configured`.
-    '';
-  };
-
   config = {
     environment.etc."hyperhive/extra-mcp.json".text =
       builtins.toJSON config.hyperhive.extraMcpServers;
@@ -105,9 +89,6 @@
     environment.etc."hyperhive/send-allow.json".text =
       builtins.toJSON config.hyperhive.allowedRecipients;
 
-    environment.etc."hyperhive/claude-plugins.json".text =
-      builtins.toJSON config.hyperhive.claudePlugins;
-
     boot.isNspawnContainer = true;
 
     # `claude-code` is unfree. Each per-agent container's nixosConfiguration