Test Results: Unreachable Permission Rules Detection

Feature: Added detection and warnings for unreachable permission rules, with warnings in /doctor and after saving rules

Tested: 2026-01-16 Version: 2.1.3 features on 2.1.9

Feature Description

Detects permission rules that can never match because a broader rule already covers them. Examples:

• Bash(*) makes Bash(git *) unreachable (first allows all)
• Read makes Read(**/secret.txt) unreachable

Test Setup

Created test settings with intentionally conflicting rules:

{
  "permissions": {
    "allow": [
      "Bash(*)",        // Allows all bash
      "Bash(git *)",    // UNREACHABLE - Bash(*) already allows
      "Bash(npm *)",    // UNREACHABLE - Bash(*) already allows
      "Read",           // Allows all reads
      "Read(**/secret.txt)"  // UNREACHABLE - Read already allows
    ],
    "deny": [
      "Bash(rm -rf *)", // Specific deny
      "Bash(*)"         // Broader deny - makes specific one pointless
    ]
  }
}

Test Results

Status: REQUIRES MANUAL VERIFICATION

/doctor command requires interactive terminal (raw mode) which cannot be invoked from within a Claude session.

Error when attempting:

ERROR Raw mode is not supported on the current process.stdin

Expected Behavior (from changelog)

1. /doctor should show warnings about unreachable rules
2. After saving rules in config, should show warnings
3. Warnings should include:
   • Source of each rule
   • Actionable fix guidance

Manual Test Steps

1. Open new terminal
2. Create .claude/settings.json with conflicting rules (see above)
3. Run claude and then /doctor
4. Look for unreachable rule warnings
5. Also try /config and save rules, check for warnings

Code Review Notes

This is a developer experience improvement:

• Helps catch config mistakes early
• Prevents confusion about why specific rules don't seem to work
• Good for debugging permission issues

Status: DEFERRED (requires manual testing)

Feature exists based on changelog. Cannot verify behavior from within automated test.