From b136dc47a3f7a53538d8225df6b273b95c868430 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 25 May 2026 15:25:03 +0000
Subject: [PATCH] =?UTF-8?q?chore:=20remove=20dead=20functions=20=E2=80=94?=
 =?UTF-8?q?=201=20function=20removed?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove hasBashWildcardInTools which is unreachable from any production
binary entry point as identified by the deadcode static analyzer.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pkg/workflow/claude_engine_tools_test.go | 78 ------------------------
 pkg/workflow/claude_tools.go             | 29 ---------
 2 files changed, 107 deletions(-)

diff --git a/pkg/workflow/claude_engine_tools_test.go b/pkg/workflow/claude_engine_tools_test.go
index d43caf6372a..d7873e0992c 100644
--- a/pkg/workflow/claude_engine_tools_test.go
+++ b/pkg/workflow/claude_engine_tools_test.go
@@ -547,84 +547,6 @@ func TestClaudeEngineAddsTmpByDefault(t *testing.T) {
 	}
 }
 
-func TestHasBashWildcardInTools(t *testing.T) {
-	tests := []struct {
-		name     string
-		tools    map[string]any
-		expected bool
-	}{
-		{
-			name:     "nil tools",
-			tools:    nil,
-			expected: false,
-		},
-		{
-			name:     "empty tools (no bash key)",
-			tools:    map[string]any{},
-			expected: false,
-		},
-		{
-			name: "bash with specific commands only",
-			tools: map[string]any{
-				"bash": []any{"git", "echo"},
-			},
-			expected: false,
-		},
-		{
-			name: "bash with wildcard *",
-			tools: map[string]any{
-				"bash": []any{"*"},
-			},
-			expected: true,
-		},
-		{
-			name: "bash with colon-wildcard :*",
-			tools: map[string]any{
-				"bash": []any{":*"},
-			},
-			expected: true,
-		},
-		{
-			name: "bash with wildcard mixed with other commands",
-			tools: map[string]any{
-				"bash": []any{"git", "*", "echo"},
-			},
-			expected: true,
-		},
-		{
-			name: "bash with nil value (non-list — unrestricted)",
-			tools: map[string]any{
-				"bash": nil,
-			},
-			expected: true,
-		},
-		{
-			name: "bash with true value (non-list — unrestricted)",
-			tools: map[string]any{
-				"bash": true,
-			},
-			expected: true,
-		},
-		{
-			name: "no bash key at all",
-			tools: map[string]any{
-				"edit":   nil,
-				"github": map[string]any{},
-			},
-			expected: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := hasBashWildcardInTools(tt.tools)
-			if result != tt.expected {
-				t.Errorf("hasBashWildcardInTools(%v): expected %v, got %v", tt.tools, tt.expected, result)
-			}
-		})
-	}
-}
-
 func TestGenerateAllowedToolsComment(t *testing.T) {
 	engine := NewClaudeEngine()
 
diff --git a/pkg/workflow/claude_tools.go b/pkg/workflow/claude_tools.go
index 73169daeacf..de97716b69d 100644
--- a/pkg/workflow/claude_tools.go
+++ b/pkg/workflow/claude_tools.go
@@ -15,35 +15,6 @@ var claudeToolsLog = logger.New("workflow:claude_tools")
 
 const defaultClaudeTmpWritePath = "/tmp"
 
-// hasBashWildcardInTools returns true when the neutral tools map grants unrestricted
-// bash access — either because bash is not a list (e.g. bash: true) or because the
-// list contains a "*" or ":*" wildcard entry.
-//
-// When bash is unrestricted the agent can already reach any tool via the shell, so
-// --permission-mode bypassPermissions is safe and produces a smoother headless
-// experience than acceptEdits (which can stall on some non-file-edit permission
-// requests that do not match the acceptEdits auto-approval pattern).
-func hasBashWildcardInTools(tools map[string]any) bool {
-	if tools == nil {
-		return false
-	}
-	bashVal, hasBash := tools["bash"]
-	if !hasBash {
-		return false
-	}
-	// bash: true (non-list value) means unrestricted bash
-	bashCommands, ok := bashVal.([]any)
-	if !ok {
-		return true
-	}
-	for _, cmd := range bashCommands {
-		if cmdStr, ok := cmd.(string); ok && (cmdStr == "*" || cmdStr == ":*") {
-			return true
-		}
-	}
-	return false
-}
-
 // expandNeutralToolsToClaudeTools converts neutral tool names to Claude-specific tool configurations
 func (e *ClaudeEngine) expandNeutralToolsToClaudeTools(tools map[string]any) map[string]any {
 	claudeToolsLog.Printf("Starting neutral tools expansion: input_tools=%d", len(tools))