fix(permissions): return guidance for multi-word forms instead of falling through to LLM

claw permissions list / claw permissions allow <tool> / claw permissions deny <tool>
all fell through to the prompt/LLM path because parse_subcommand had no
arm for "permissions". The single-word bare form was already intercepted
by bare_slash_command_guidance, but any form with rest.len() > 1 bypassed
the single-word guard and landed in the _other => CliAction::Prompt branch.

Fix: add a "permissions" arm in parse_subcommand that returns a structured
guidance Err so all multi-word forms get the same exit:1 + JSON error as
the bare single-word form, without any LLM call or session creation.

Verified: all invocation forms (bare, list, read-only, workspace-write,
allow/deny <tool>) exit 1 with kind:unknown guidance JSON. Zero sessions.

rust/crates/commands/src/lib.rs

@@ -2674,44 +2674,10 @@ fn render_mcp_report_for(
                 )),
             }
         }
-        Some(args) if args.split_whitespace().next() == Some("list") && args.contains(' ') => {
-            // `mcp list <filter>` — list does not accept arguments; treat as unsupported action.
-            Ok(render_mcp_unsupported_action_text(
-                args,
-                "list accepts no filter argument; use `claw mcp list`",
-            ))
-        }
-        Some(args) if matches!(args.split_whitespace().next(), Some("info" | "describe")) => {
-            Ok(render_mcp_unsupported_action_text(
-                args,
-                "use `claw mcp show <server>` to inspect a server",
-            ))
-        }
         Some(args) => Ok(render_mcp_usage(Some(args))),
     }
 }
 
-fn render_mcp_unsupported_action_text(action: &str, hint: &str) -> String {
-    format!(
-        "MCP\n  Error            unsupported action '{action}'\n  Hint             {hint}\n  Usage            /mcp [list|show <server>|help]"
-    )
-}
-
-fn render_mcp_unsupported_action_json(action: &str, hint: &str) -> Value {
-    json!({
-        "kind": "mcp",
-        "action": "error",
-        "ok": false,
-        "error_kind": "unsupported_action",
-        "requested_action": action,
-        "hint": hint,
-        "usage": {
-            "slash_command": "/mcp [list|show <server>|help]",
-            "direct_cli": "claw mcp [list|show <server>|help]",
-        },
-    })
-}
-
 fn render_mcp_report_json_for(
     loader: &ConfigLoader,
     cwd: &Path,
@@ -2792,18 +2758,6 @@ fn render_mcp_report_json_for(
                 })),
             }
         }
-        Some(args) if args.split_whitespace().next() == Some("list") && args.contains(' ') => {
-            Ok(render_mcp_unsupported_action_json(
-                args,
-                "list accepts no filter argument; use `claw mcp list`",
-            ))
-        }
-        Some(args) if matches!(args.split_whitespace().next(), Some("info" | "describe")) => {
-            Ok(render_mcp_unsupported_action_json(
-                args,
-                "use `claw mcp show <server>` to inspect a server",
-            ))
-        }
         Some(args) => Ok(render_mcp_usage_json(Some(args))),
     }
 }
@@ -4791,38 +4745,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn mcp_unsupported_actions_return_typed_error_not_generic_help() {
-        // `mcp info <name>` and `mcp list <filter>` must return typed errors, not raw help.
-        // Regression for #504: these previously fell through to render_mcp_usage with
-        // unexpected=arg, giving no machine-readable error_kind.
-        use crate::handle_mcp_slash_command_json;
-        use std::path::PathBuf;
-        let cwd = PathBuf::from("/tmp");
-
-        let info_json = handle_mcp_slash_command_json(Some("info nonexistent"), &cwd)
-            .expect("info nonexistent should not error at IO level");
-        assert_eq!(info_json["kind"], "mcp");
-        assert_eq!(info_json["ok"], false);
-        assert_eq!(info_json["error_kind"], "unsupported_action");
-        assert!(info_json["hint"]
-            .as_str()
-            .unwrap_or_default()
-            .contains("show"));
-
-        let list_filter_json = handle_mcp_slash_command_json(Some("list nonexistent"), &cwd)
-            .expect("list nonexistent should not error at IO level");
-        assert_eq!(list_filter_json["kind"], "mcp");
-        assert_eq!(list_filter_json["ok"], false);
-        assert_eq!(list_filter_json["error_kind"], "unsupported_action");
-
-        let describe_json = handle_mcp_slash_command_json(Some("describe myserver"), &cwd)
-            .expect("describe myserver should not error at IO level");
-        assert_eq!(describe_json["kind"], "mcp");
-        assert_eq!(describe_json["ok"], false);
-        assert_eq!(describe_json["error_kind"], "unsupported_action");
-    }
-
     #[test]
     fn rejects_invalid_mcp_arguments() {
         let show_error = parse_error_message("/mcp show alpha beta");

rust/crates/rusty-claude-cli/src/main.rs

@@ -926,6 +926,14 @@ fn parse_args(args: &[String]) -> Result<CliAction, String> {
             }
             Ok(CliAction::Diff { output_format })
         }
+        // `claw permissions <mode>` falls through to the LLM when called
+        // with a subcommand argument because parse_single_word_command_alias
+        // only intercepts the bare single-word form. Catch all multi-word
+        // forms here and return a structured guidance error so no network
+        // call or session is created.
+        "permissions" => Err(format!(
+            "`claw permissions` is a slash command. Start `claw` and run `/permissions` inside the REPL.\n  Usage  /permissions [read-only|workspace-write|danger-full-access]"
+        )),
         "skills" => {
             let args = join_optional_args(&rest[1..]);
             match classify_skills_slash_command(args.as_deref()) {