fix: Filter permission gaps against configured subcommand patterns

[evansenter]

Summary

• Fixes bug where get_permission_gaps() reported commands like gh as gaps even when settings.json had subcommand patterns like Bash(gh pr view:*)
• Updated load_allowed_commands() to extract base commands (first word) from patterns
• Added tests for the new behavior

Fixes #37

Test plan

• All 253 tests pass
• New tests verify base command extraction from subcommand patterns
• New tests verify permission gaps are filtered correctly

🤖 Generated with Claude Code

[claude]

Prompt: evansenter/dotfiles/.../claude-review.md

Code Review

Summary

This PR fixes a bug where get_permission_gaps() incorrectly reported commands like gh as permission gaps when settings.json already had subcommand patterns like Bash(gh pr view:*). The fix updates load_allowed_commands() to extract base commands (the first word) from subcommand patterns.

Issues Found

Critical

None

Important

None

Suggestions

• src/session_analytics/patterns.py:581 - The pattern matching uses :) in pattern which could theoretically match malformed patterns that have :) appearing elsewhere in the string. Consider using pattern.endswith(:*)) in combination with finding the content, or using a regex for more robust extraction. This is unlikely to occur in practice but would make the parsing more defensive.

Verdict

REQUEST_CHANGES - One minor suggestion for more defensive pattern parsing.

---

Automated review by Claude Code

[evansenter]

Feedback Addressed

Skipped

• [Suggestion] patterns.py:581 - More defensive pattern parsing with endswith() or regex - Current implementation already handles edge cases correctly by using find() to get first occurrence. The suggested change adds complexity for a nearly impossible malformed pattern scenario.

[claude]

Prompt: evansenter/dotfiles/.../claude-review.md

Code Review

Summary

This PR fixes a bug where get_permission_gaps() reported commands like gh as permission gaps even when settings.json had subcommand patterns like Bash(gh pr view:*). The fix updates load_allowed_commands() to extract base commands (first word) from subcommand patterns, ensuring that any configured pattern for a command prevents it from being reported as a gap.

Issues Found

Critical

None

Important

None

Suggestions

None

Notes

The linked issue #37 suggested a filter_configured parameter for backwards compatibility, but this PR chose to always filter configured patterns instead. This is a sound design choice—the original problem was false positives (suggesting permissions that already exist), so always filtering is the correct behavior. No one would want false positive recommendations.

The previous review's suggestion about defensive pattern parsing was appropriately skipped per the "Feedback Addressed" comment.

Verdict

APPROVE - Code is correct, well-tested, and addresses the linked issue. The implementation choice to always filter (rather than requiring opt-in) is a better UX for the problem being solved.

---

Automated review by Claude Code