Repository navigation
⬆️ Upstream sync — v0.48.0 - #3
Merged
Merged
Conversation
github-actions
Bot
force-pushed
the
upstream-sync
branch
7 times, most recently
from
July 6, 2026 10:07
d29a9ca to
9b3d3d3
Compare
github-actions
Bot
force-pushed
the
upstream-sync
branch
8 times, most recently
from
July 14, 2026 07:53
4f3e899 to
a3d2f26
Compare
github-actions
Bot
force-pushed
the
upstream-sync
branch
7 times, most recently
from
July 21, 2026 08:16
dd4242e to
bff8063
Compare
github-actions
Bot
force-pushed
the
upstream-sync
branch
6 times, most recently
from
July 27, 2026 09:39
6279b69 to
330ba07
Compare
github-actions
Bot
changed the title
github-actions
Bot
force-pushed
the
upstream-sync
branch
from
July 28, 2026 08:24
330ba07 to
1fabac0
Compare
- relocate run_err_cmd/run_test_cmd and filters to core::runner - cmds/rust/runner keeps shell wrappers delegating to core - bun/deno call core::runner, no reach into cmds/rust
- extract_test_summary recognizes bun test and deno test - bun/deno failures now emit structured [FAIL], not just tail
- print via core::runner::print_with_hint, matching deno - failed bun install/pm ls now write raw output for recovery
- main.rs: X variant, shared run_bunx_tool dispatch - rules.rs: add x to bun rewrite pattern with boundary - classify bun, bunx, deno in passthrough gate test
- runner.rs: anchor bun count lines, stop echoed source leak - capture error and Expected/Received detail per failure - add real bun 1.3.6 fixtures with golden and savings tests
- bun_cmd.rs: delete char-whitelist validation, args are argv-only - pkg_argv seam passes semver, protocol, git specs verbatim - regression test locks verbatim passthrough incl shell metachars
- bun 1.x ignores --json for pm ls, JSON path never fired - bun_cmd.rs: tree parser for glyph rows, sorted and deduped - parser choice sniffs printed content, not the flag passed - real bun 1.3.6 fixture replaces synthetic-JSON-only coverage
- deno 2.x prints FAILURES section and 'FAILED | N passed' footer, old anchors (test result:, failures:) never fired - capture ERRORS diagnostics, strip ANSI before anchoring - TestEcosystem enum picked once at boundary, match replaces co-firable substring flags (cargo test contains go test) - real deno 2.9.1 fixtures with golden and savings tests
- run_filtered_subcmd hand-rolled spawn, tee, and print, skipping the never_worse output guard every other filter applies - replace with core::runner::run_filtered, one emission policy
- core/runner.rs: bun error blocks are kept only with proof bun wrote them - core/runner.rs: emit diagnostics when no failure marker was printed - core/runner.rs: deno section boundaries close an open failure block - tests: real bun 1.3.6 and deno 2.9.6 fixtures for all three cases
- bun_cmd.rs: run_pkg and run_pm_ls use run_filtered, which interleaves the streams and tracks what was actually shown - bun_cmd.rs: pm ls JSON requires a version, so a grouped shape falls through to the tree parser instead of reporting group names as packages - bun_cmd.rs: keep original indentation on kept install lines
- rules.rs: anchor the deno pattern so it cannot match subcommand prefixes - rules.rs: mark deno install and bun pm (non-ls) as passthrough - registry.rs: normalize whitespace in a captured subcommand
- bun_cmd.rs: bun build passes through unless an output flag sends the bundle to disk, and bunx uses the light npm filter instead of errors-only - core/runner.rs: the err and test runners record the tool that actually ran, with a per-tool tee slug - utils.rs, tsc_cmd.rs, main.rs: resolve tools via the project package manager, and keep the tool name when routing eslint - tracking.rs, README.md: categorize bun and deno as js, and describe what the deno check and bun build filters really do
- core/runner.rs: bun and deno share a buffered engine and differ only in an open, prove, close policy table, so a guard cannot land on one runtime alone - core/runner.rs: deno gains the proof rule it never had, so a passing test that logs its own error line no longer reports as a failed suite - core/runner.rs: a block closes when the next one opens, so consecutive stack-free failures stay separate - tests: every scenario is asserted on both runtimes from real fixtures
- utils.rs: tool_exec prefers an explicitly named package runner over lockfile detection, which applies only when nothing was named - tsc_cmd.rs, lint_cmd.rs, main.rs: thread that runner from the invocation - utils.rs: detection can be asked about a directory, so its test needs no chdir - bun_cmd.rs, rules.rs: strip ANSI on the pm ls text fallback, and stop bun build claiming savings it does not deliver
- utils.rs: MissingTool says whether the npm arm may fetch, instead of every newly routed caller inheriting --no-install by accident - tsc_cmd.rs: tsc fetches as it always did, lint and the rest still do not
Failure detection, so a green run is never reported red: - a failure marker vouches for the block it closes, so a frameless failure such as a timeout keeps the line that says why it failed - bun's marker and run footer are matched with the duration and test count they carry, since a test is free to log a line that starts the same way - deno's FAILURES entries are matched by shape, because a bare " => " also occurs in arrow functions and assertion messages - deno fences output it did not write, and names the fence for when it was printed, so the rule is matched by shape and gates both the failures list and the block engine Diagnostics that were reaching nobody: - deno's type-check errors are kept with the frame under them: they open no block and carry no section, so a type error left the caller with a bare "Type checking failed." - bun's frames are kept, since two failing tests that share a name, and a module error that has no marker at all, cannot otherwise be located Runs whose output rtk must not touch: - watch mode on every filtered entry point goes through unfiltered, since the runners buffer the whole stream until a child that never exits - a deno reporter the user named is left alone, because --reporter=junit and --junit-path write the report to stdout - bun build and deno compile run unfiltered: without an output flag the bundle is stdout, with one the emitted-file summary is the point of the run, and on failure the diagnostics are, none of which an errors-only filter keeps Tool resolution: - a package runner the user named wins over lockfile detection, and over a tool that merely happens to be on PATH - lockfile detection never resolves through bunx, which always fetches a missing tool and cannot be told not to - a tool rtk may fetch resolves through npx, the only runner that can Input and output: - bunx forwards the caller's stdin when it is a pipe, since the filtered path buffers output and an inherited terminal would let a prompt wait invisibly - strip the resolution lines bun actually prints when piped, count the tree levels drawn with a leading pipe, and stop injecting --json into a command the user typed - the lint label records the arguments once, and the shell runners' placeholder tool name stays out of their verbose line Fixtures are real bun 1.2.20 and deno 2.9.6 captures for each case. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A subcommand that runs unfiltered cannot save anything, so classify_command zeroes its estimate rather than letting it inherit the rule's headline. The status and the percentage were separate fields and only the percentage reaches the projection, so marking a subcommand passthrough left the claim standing. The bun and deno percentages are measured against real output rather than against fixtures shaped to the filter: bun install 70, deno lint 40, deno check 50. Each is backed by a captured fixture the module's own test measures. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
feat(bun,deno): add Bun and Deno runtime support
ci(stale): more op per run
…gitignored matches `rtk find /tmp/nope` exited 0 with no output where `find` prints `find: '/tmp/nope': No such file or directory` and exits 1. The dispatcher read a nonexistent path as RTK name-pattern syntax (`!is_dir()` is true for both), rewrote it to `-name /tmp/nope`, defaulted the search root to `.`, and the existence guard then checked `.` instead of the argument. A token with a path separator can never be a `-name` pattern (`-name` matches basenames), so treat it as a path whether or not it exists; find's own status then surfaces. `run`, `run_compress`, `run_verbatim` and `run_from_args` return the status instead of calling `process::exit`, and the `Find` arm in main.rs yields it. The native walk skips hidden and gitignored entries, so `rtk find . -name secret.txt` printed nothing for a gitignored file and exited 0 — an existence check reads that as "not on disk". The output now ends with `... (N filtered: hidden or gitignored; dirs listed with / were not searched)` plus a tee file listing them, the shape `rtk ls` already uses, and says so even when nothing else matched. The note rides on both sides of the never-worse guard, since the raw listing never holds filtered entries and would otherwise win on size and drop it. The disclosure is derived from the walk that already happened: for each directory the filtered walk visited, its raw children are listed and any child the walk did not visit was hidden or ignored. Skipped files are named when they match; a skipped directory is reported once as `dir/` and never descended. Cost is one read_dir per visited directory: on ext4, a 116-directory checkout with 3000 gitignored files measures 12-14 ms against 14-21 ms before. (Re-walking with the filters off to count matches inside ignored trees took 7.5 s against 350 ms on the same checkout, which is why it is not done.) On a Windows mount under WSL each read_dir is a 9P round-trip, so the disclosure adds roughly 2 ms per visited directory there. Bare names without a separator keep RTK's pattern semantics (`rtk find Cargo.toml`); a pattern starting with `.` still walks hidden entries. Fixes rtk-ai#3851
… root, align the note with ls Review follow-ups on the disclosure added for rtk-ai#3851. - The walk kept every visited path in a set for the whole run, so on a 108k-entry tree RSS went from 7 MB to 18 MB and the extra read_dir pass doubled the time. Disclosure now switches off once 20 000 entries have been visited and the bookkeeping is dropped; below that nothing changes. Measured on /usr: 3.9-4.0 s and 9.6 MB against develop's 3.9-7.0 s and 6.9 MB. - A symlinked search root reported its file type as a symlink, so it never counted as a visited directory and its filtered children went unreported. The root's type is now read through the link. - The note is `... (N filtered)`, the same shape rtk ls emits; the trailing `/` on a reported directory already says it was not searched. - `.git` comes from a named constant instead of an inline literal. - The fixture test disables global gitignore rules so a developer's own excludes cannot change its result; two tests point RTK_TEE_DIR at a tempdir instead of writing under ~/.local/share/rtk. - find_cmd.rs is included through automod, which cargo fmt does not see; the file is now rustfmt-clean when checked directly.
…dens fix(find): report a missing path like find does, and disclose hidden/gitignored matches
…ting names count_find_names and count_find_total treat every unrecognised line as a row of names. Since find began reporting hidden and gitignored matches, its output ends with `... (N filtered)` and a `[see remaining: ...]` pointer, so `rtk find '*' --max 10` counted 19 names (10 + 3 + 6 words) and the --max cap check failed. Skip both lines, as the header, `+N more` and `ext:` lines already are.
…ure-lines fix(benchmark): skip find's disclosure note and tee pointer when counting names
Next Release
…master--components--rtk chore(master): release 0.48.0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstream Sync — v0.48.0
Upstream release notes (rtk-ai/rtk):
0.48.0 (2026-09-04)
Features
Bug Fixes
Commits (first 50):
🤖 AI Security Review
Raw Pattern Scan Hits
[network: hardcoded URL] src/cmds/cloud/aws_cmd.rs:1741 — {"OutputKey": "ApiUrl", "OutputValue": "https://api.example.com"},
\nSome text";
\nSome text";
\n
\n
\n";
\nText";
[network: hardcoded URL] src/cmds/cloud/aws_cmd.rs:1748 — assert!(result.text.contains("ApiUrl=https://api.example.com"));
[network: hardcoded URL] src/cmds/cloud/aws_cmd.rs:2046 — "Code": {"Location": "https://awslambda-us-east-1-tasks.s3.amazonaws.com/snapshots/123/my-func?versionId=abc&X-Amz-Security-Token=very-long-token"},
[network: hardcoded URL] src/cmds/cloud/aws_cmd.rs:2073 — "Code": {"Location": "https://example.com/code"}
[network: hardcoded URL] src/cmds/cloud/aws_cmd.rs:2328 — "endpoint": "https://ABC123.gr7.us-east-1.eks.amazonaws.com",
[network: hardcoded URL] src/cmds/cloud/aws_cmd.rs:2337 — .contains("my-cluster ACTIVE k8s/1.28 https://ABC123.gr7.us-east-1.eks.amazonaws.com"));
[embed: compile-time file embed] src/cmds/cloud/aws_cmd.rs:2746 — let fixture = include_str!(
[embed: compile-time file embed] src/cmds/cloud/container.rs:1013 — let input_str = include_str!("../../../tests/fixtures/oc_pods.json");
[exec: process execution] src/cmds/cloud/curl_cmd.rs:40 — let output = cmd.output().context("Failed to run curl")?;
[network: hardcoded URL] src/cmds/cloud/wget_cmd.rs:194 — .strip_prefix("https://")
[network: hardcoded URL] src/cmds/cloud/wget_cmd.rs:195 — .or_else(|| url.strip_prefix("http://"))
[network: hardcoded URL] src/cmds/cloud/wget_cmd.rs:269 — assert_eq!(compact_url("https://example.com/file.zip"), "example.com/file.zip");
[network: hardcoded URL] src/cmds/cloud/wget_cmd.rs:270 — assert_eq!(compact_url("http://example.com/file.zip"), "example.com/file.zip");
[network: hardcoded URL] src/cmds/cloud/wget_cmd.rs:275 — let long = "https://example.com/very/long/path/that/exceeds/fifty/characters/file.zip";
[network: hardcoded URL] src/cmds/cloud/wget_cmd.rs:283 — let short = "https://x.com/f";
[network: hardcoded URL] src/cmds/cloud/wget_cmd.rs:356 — extract_filename_from_output("", "https://example.com/x", &args),
[network: hardcoded URL] src/cmds/cloud/wget_cmd.rs:363 — let result = extract_filename_from_output("", "https://example.com/file.tar.gz", &[]);
[network: hardcoded URL] src/cmds/cloud/wget_cmd.rs:369 — let result = extract_filename_from_output("", "https://example.com/", &[]);
[embed: compile-time file embed] src/cmds/dotnet/binlog.rs:1556 — let input = include_str!("../../../tests/fixtures/dotnet/build_failed.txt");
[embed: compile-time file embed] src/cmds/dotnet/binlog.rs:1592 — let input = include_str!("../../../tests/fixtures/dotnet/test_failed.txt");
[network: hardcoded URL] src/cmds/dotnet/dotnet_cmd.rs:1385 —
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1040 — let result = ok_confirmation("created", "rtk-ai#42 https://github.com/foo/bar/pull/42");
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1438 — let input = "# Title\n
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1447 — let input = "# Title\n
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1495 — let input = "## Summary\n- Item 1\n- Item 2\n\nLink\n\n| Col1 | Col2 |\n| --- | --- |\n| a | b |";
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1500 — assert!(result.contains("Link"));
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1514 —
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1515 —
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1517 —
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1571 —
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1572 —
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1579 — "url": "https://github.com/foo/bar/pull/42",
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1599 — "url": "https://github.com/foo/bar/pull/42",
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1621 — "url": "https://github.com/foo/bar/pull/42",
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1632 —
[network: hardcoded URL] src/cmds/git/gh_cmd.rs:1638 — "url": "https://github.com/foo/bar/issues/99",
[exec: process execution] src/cmds/git/git.rs:2781 — Command::new("git")
[fs: ~/.claude access] src/cmds/git/git.rs:3505 — let (files, _) = parse_stash_stat(" .claude/CLAUDE.md | 234 +-\n");
[fs: ~/.claude access] src/cmds/git/git.rs:3506 — assert_eq!(files, vec![".claude/CLAUDE.md 234 +-"]);
[exec: process execution] src/cmds/git/git.rs:4350 — let output = Command::new("git")
[exec: process execution] src/cmds/git/git.rs:4352 — .output()
[exec: process execution] src/cmds/git/git.rs:4361 — let _ = Command::new("git").args(["branch", "-d", branch]).output();
[exec: process execution] src/cmds/git/git.rs:4371 — let output = Command::new("git")
[exec: process execution] src/cmds/git/git.rs:4373 — .output()
[exec: process execution] src/cmds/git/git.rs:4381 — let _ = Command::new("git").args(["branch", "-d", branch]).output();
[exec: process execution] src/cmds/git/git.rs:4464 — let output = std::process::Command::new(&bin_path)
[exec: process execution] src/cmds/git/git.rs:4467 — .output()
[network: hardcoded URL] src/cmds/git/git.rs:4627 — To https://github.com/foo/bar.git
[network: hardcoded URL] src/cmds/git/git.rs:4639 — assert!(result.contains("To https://github.com/foo/bar.git"));
[network: hardcoded URL] src/cmds/git/git.rs:4657 — To https://github.com/foo/bar.git
[network: hardcoded URL] src/cmds/git/git.rs:4669 — To https://github.com/foo/bar.git
[network: hardcoded URL] src/cmds/git/git.rs:4671 — error: failed to push some refs to 'https://github.com/foo/bar.git'
[network: hardcoded URL] src/cmds/git/git.rs:4686 — To https://github.com/foo/bar.git
[network: hardcoded URL] src/cmds/git/git.rs:4704 — To https://github.com/foo/bar.git
[network: hardcoded URL] src/cmds/git/glab_cmd.rs:951 — if trimmed.starts_with("http://") || trimmed.starts_with("https://") {
[network: hardcoded URL] src/cmds/git/glab_cmd.rs:1050 — let url = "https://gitlab.example.com/group/project/-/merge_requests/42";
[network: hardcoded URL] src/cmds/git/glab_cmd.rs:1094 — "# Title\n
[network: hardcoded URL] src/cmds/git/glab_cmd.rs:1103 — let input = "## Summary\n- Item 1\n- Item 2\n\nLink";
[network: hardcoded URL] src/cmds/git/glab_cmd.rs:1107 — assert!(result.contains("Link"));
[network: hardcoded URL] src/cmds/git/glab_cmd.rs:1114 — "!42 https://gitlab.example.com/-/merge_requests/42",
[embed: compile-time file embed] src/cmds/git/glab_cmd.rs:1142 — let input = include_str!("../../../tests/fixtures/glab_mr_list_raw.json");
[embed: compile-time file embed] src/cmds/git/glab_cmd.rs:1158 — let input = include_str!("../../../tests/fixtures/glab_mr_list_raw.json");
[embed: compile-time file embed] src/cmds/git/glab_cmd.rs:1169 — let input = include_str!("../../../tests/fixtures/glab_mr_list_raw.json");
[embed: compile-time file embed] src/cmds/git/glab_cmd.rs:1179 — let input = include_str!("../../../tests/fixtures/glab_issue_list_raw.json");
[embed: compile-time file embed] src/cmds/git/glab_cmd.rs:1195 — let input = include_str!("../../../tests/fixtures/glab_issue_list_raw.json");
[embed: compile-time file embed] src/cmds/git/glab_cmd.rs:1347 — let input = include_str!("../../../tests/fixtures/glab_release_list_raw.txt");
[embed: compile-time file embed] src/cmds/git/glab_cmd.rs:1356 — let input = include_str!("../../../tests/fixtures/glab_release_list_raw.txt");
[embed: compile-time file embed] src/cmds/git/glab_cmd.rs:1388 — let input = include_str!("../../../tests/fixtures/glab_ci_trace_raw.txt");
[embed: compile-time file embed] src/cmds/git/glab_cmd.rs:1409 — let input = include_str!("../../../tests/fixtures/glab_ci_trace_raw.txt");
[embed: compile-time file embed] src/cmds/git/glab_cmd.rs:1428 — let input = include_str!("../../../tests/fixtures/glab_release_view_raw.txt");
[embed: compile-time file embed] src/cmds/git/glab_cmd.rs:1448 — let input = include_str!("../../../tests/fixtures/glab_release_view_raw.txt");
[network: hardcoded URL] src/cmds/git/glab_cmd.rs:1504 — r#"{"iid":10,"title":"X","state":"closed","author":{"username":"u"},"web_url":"http://e","description":null}"#,
[network: hardcoded URL] src/cmds/git/glab_cmd.rs:1537 — "web_url": "https://gitlab.example.com/acme/toolkit/-/merge_requests/42",
[network: hardcoded URL] src/cmds/git/gt_cmd.rs:548 — "Created pull request rtk-ai#42 for feat/add-auth: https://github.com/org/repo/pull/42\n";
[network: hardcoded URL] src/cmds/git/gt_cmd.rs:552 — assert!(output.contains("https://github.com/org/repo/pull/42"));
[network: hardcoded URL] src/cmds/git/gt_cmd.rs:567 — Created pull request rtk-ai#42 for feat/add-auth: https://github.com/org/repo/pull/42
[network: hardcoded URL] src/cmds/git/gt_cmd.rs:577 — Updated pull request rtk-ai#40 for feat/add-db: https://github.com/org/repo/pull/40
[embed: compile-time file embed] src/cmds/js/bun_cmd.rs:259 — let raw = include_str!("../../../tests/fixtures/bun_install_raw.txt");
[embed: compile-time file embed] src/cmds/js/bun_cmd.rs:273 — let raw = include_str!("../../../tests/fixtures/bun_install_raw.txt");
[network: hardcoded URL] src/cmds/js/bun_cmd.rs:340 — "express": {"version": "4.18.2", "resolved": "https://registry.npmjs.org/express/-/express-4.18.2.tgz", "integrity": "sha512-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
[network: hardcoded URL] src/cmds/js/bun_cmd.rs:341 — "lodash": {"version": "4.17.21", "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz", "integrity": "sha512-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
[network: hardcoded URL] src/cmds/js/bun_cmd.rs:342 — "axios": {"version": "1.6.0", "resolved": "https://registry.npmjs.org/axios/-/axios-1.6.0.tgz", "integrity": "sha512-ccccccccccccccccccccccccccccccccccccccccccc
[embed: compile-time file embed] src/cmds/js/bun_cmd.rs:370 — let raw = include_str!("../../../tests/fixtures/bun_pm_ls_all_raw.txt");
[embed: compile-time file embed] src/cmds/js/bun_cmd.rs:418 — let raw = include_str!("../../../tests/fixtures/bun_pm_ls_all_raw.txt");
[network: hardcoded URL] src/cmds/js/bun_cmd.rs:461 — "git+https://github.com/user/repo.git",
[embed: compile-time file embed] src/cmds/js/deno_cmd.rs:114 — include_str!("../../../tests/fixtures/deno_lint_raw.txt"),
[embed: compile-time file embed] src/cmds/js/deno_cmd.rs:119 — include_str!("../../../tests/fixtures/deno_check_raw.txt"),
[embed: compile-time file embed] src/cmds/js/deno_cmd.rs:134 — let raw = include_str!("../../../tests/fixtures/deno_lint_raw.txt");
[network: hardcoded URL] src/cmds/js/deno_cmd.rs:147 — let input = r#"Download https://deno.land/std@0.200.0/path/mod.ts
[network: hardcoded URL] src/cmds/js/deno_cmd.rs:148 — Download https://deno.land/x/oak@v12.6.1/mod.ts
[network: hardcoded URL] src/cmds/js/deno_cmd.rs:162 — let input = "Download https://deno.land/std@0.200.0/path/mod.ts\n\
[network: hardcoded URL] src/cmds/js/deno_cmd.rs:163 — Download https://deno.land/x/oak@v12.6.1/mod.ts\n\
[network: hardcoded URL] src/cmds/js/deno_cmd.rs:174 — let input = r#"Download https://deno.land/std@0.200.0/path/mod.ts
[network: hardcoded URL] src/cmds/js/deno_cmd.rs:176 — Download https://deno.land/x/oak@v12.6.1/mod.ts
[network: hardcoded URL] src/cmds/js/deno_cmd.rs:186 — let input = "\x1b[33mDownload https://deno.land/std@0.200.0/path/mod.ts\x1b[0m\n\x1b[31merror: something\x1b[0m\n";
[network: hardcoded URL] src/cmds/js/deno_cmd.rs:201 — let input = r#"Download https://deno.land/std@0.210.0/path/mod.ts
[network: hardcoded URL] src/cmds/js/deno_cmd.rs:202 — error: Module not found "https://deno.land/x/nonexistent/mod.ts"
[embed: compile-time file embed] src/cmds/js/tsc_cmd.rs:400 — let output = include_str!("../../../tests/fixtures/tsc_pretty_raw.txt");
[embed: compile-time file embed] src/cmds/js/tsc_cmd.rs:422 — let output = include_str!("../../../tests/fixtures/tsc_global_config_error_raw.txt");
[embed: compile-time file embed] src/cmds/js/tsc_cmd.rs:517 — let input = include_str!("../../../tests/fixtures/tsc_pretty_raw.txt");
[embed: compile-time file embed] src/cmds/js/tsc_cmd.rs:549 — let input = include_str!("../../../tests/fixtures/tsc_global_config_error_raw.txt");
[embed: compile-time file embed] src/cmds/js/tsc_cmd.rs:658 — let input = include_str!("../../../tests/fixtures/tsc_no_project_raw.txt");
[exec: process execution] src/cmds/jvm/gradlew_cmd.rs:90 — Command::new(".\gradlew.bat")
[exec: process execution] src/cmds/jvm/gradlew_cmd.rs:95 — Command::new("./gradlew")
[network: hardcoded URL] src/cmds/jvm/gradlew_cmd.rs:707 — > Get more help at https://help.gradle.org
[network: hardcoded URL] src/cmds/jvm/gradlew_cmd.rs:746 — https://gradle.com/s/abc123"#;
[network: hardcoded URL] src/cmds/jvm/gradlew_cmd.rs:858 — > Get more help at https://help.gradle.org
[embed: compile-time file embed] src/cmds/jvm/gradlew_cmd.rs:961 — let input = include_str!("../../../tests/fixtures/gradlew_build_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/gradlew_cmd.rs:975 — let input = include_str!("../../../tests/fixtures/gradlew_build_failed_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/gradlew_cmd.rs:989 — let input = include_str!("../../../tests/fixtures/gradlew_test_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/gradlew_cmd.rs:1002 — let input = include_str!("../../../tests/fixtures/gradlew_test_failed_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/gradlew_cmd.rs:1018 — let input = include_str!("../../../tests/fixtures/gradlew_connected_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/gradlew_cmd.rs:1028 — let input = include_str!("../../../tests/fixtures/gradlew_lint_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/gradlew_cmd.rs:1046 — let input = include_str!("../../../tests/fixtures/gradlew_build_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/gradlew_cmd.rs:1059 — let input = include_str!("../../../tests/fixtures/gradlew_build_failed_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/gradlew_cmd.rs:1073 — let input = include_str!("../../../tests/fixtures/gradlew_test_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/gradlew_cmd.rs:1082 — let input = include_str!("../../../tests/fixtures/gradlew_test_failed_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/gradlew_cmd.rs:1093 — let input = include_str!("../../../tests/fixtures/gradlew_connected_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/gradlew_cmd.rs:1101 — let input = include_str!("../../../tests/fixtures/gradlew_lint_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/gradlew_cmd.rs:1113 — let input = include_str!("../../../tests/fixtures/gradlew_lint_raw.txt");
[exec: process execution] src/cmds/jvm/mvn_cmd.rs:1804 — Command::new(".\mvnw.cmd")
[exec: process execution] src/cmds/jvm/mvn_cmd.rs:1809 — Command::new("./mvnw")
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:1959 — let i = include_str!("../../../tests/fixtures/mvnd_reactor_pass_raw.txt");
[network: hardcoded URL] src/cmds/jvm/mvn_cmd.rs:2199 — [main] [ERROR] See https://docs.example.com/troubleshoot for details\n
[network: hardcoded URL] src/cmds/jvm/mvn_cmd.rs:2205 — "See https://docs.example.com/troubleshoot",
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:2438 — include_str!("../../../tests/fixtures/mvn_test_fail_slice_raw.txt"),
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:2446 — include_str!("../../../tests/fixtures/mvn_test_multifail_slice_raw.txt"),
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:2569 — let i = include_str!("../../../tests/fixtures/mvnd_reactor_pass_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:2590 — let i = include_str!("../../../tests/fixtures/mvnd_reactor_pass_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:2601 — let i = include_str!("../../../tests/fixtures/mvnd_test_fail_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:2623 — let i = include_str!("../../../tests/fixtures/mvnd_test_fail_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:2638 — let i = include_str!("../../../tests/fixtures/mvnd_reactor_fail_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:2666 — let i = include_str!("../../../tests/fixtures/mvnd_reactor_fail_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3778 — let i = include_str!("../../../tests/fixtures/mvnd_reactor_pass_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3779 — let expected = include_str!("../../../tests/fixtures/mvnd_reactor_pass_expected.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3785 — let i = include_str!("../../../tests/fixtures/mvnd_test_fail_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3786 — let expected = include_str!("../../../tests/fixtures/mvnd_test_fail_expected.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3792 — let i = include_str!("../../../tests/fixtures/mvnd_reactor_fail_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3793 — let expected = include_str!("../../../tests/fixtures/mvnd_reactor_fail_expected.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3799 — let i = include_str!("../../../tests/fixtures/mvnd_compile_error_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3800 — let expected = include_str!("../../../tests/fixtures/mvnd_compile_error_expected.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3808 — let i = include_str!("../../../tests/fixtures/mvnd_compile_error_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3822 — let i = include_str!("../../../tests/fixtures/mvnd_compile_error_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3832 — let i = include_str!("../../../tests/fixtures/mvn_test_pass_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3847 — let i = include_str!("../../../tests/fixtures/mvn_test_fail_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3855 — let i = include_str!("../../../tests/fixtures/mvn_test_pass_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3881 — let i = include_str!("../../../tests/fixtures/mvn_test_fail_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:3969 — let i = include_str!("../../../tests/fixtures/mvn_test_multifail_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4007 — let i = include_str!("../../../tests/fixtures/mvn_test_multifail_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4141 — let i = include_str!("../../../tests/fixtures/mvn_test_fail_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4170 — let i = include_str!("../../../tests/fixtures/mvn_test_multifail_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4186 — let i = include_str!("../../../tests/fixtures/mvn_test_multifail_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4235 — let i = include_str!("../../../tests/fixtures/mvn_test_compile_fail_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4257 — let i = include_str!("../../../tests/fixtures/mvn_compile_error_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4344 — let i = include_str!("../../../tests/fixtures/mvn_locale_fr_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4361 — let i = include_str!("../../../tests/fixtures/mvn_no_pom_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4382 — let i_lf = include_str!("../../../tests/fixtures/mvn_test_pass_slice_raw.txt")
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4396 — let i_lf = include_str!("../../../tests/fixtures/mvn_install_slice_raw.txt")
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4410 — let i_lf = include_str!("../../../tests/fixtures/mvnd_compile_error_raw.txt")
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4583 — let i = include_str!("../../../tests/fixtures/mvn_reactor_pass_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4613 — let i = include_str!("../../../tests/fixtures/mvn_reactor_fail_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4659 — let i = include_str!("../../../tests/fixtures/mvn_compile_error_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4671 — let i = include_str!("../../../tests/fixtures/mvn_compile_error_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4702 — let i = include_str!("../../../tests/fixtures/mvn_install_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4714 — let i = include_str!("../../../tests/fixtures/mvn_install_slice_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4738 — let pf = gunzip(include_bytes!("../../../tests/fixtures/mvn_test_pass_full_raw.txt.gz"));
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4748 — let inst = gunzip(include_bytes!("../../../tests/fixtures/mvn_install_full_raw.txt.gz"));
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4761 — let bytes = include_bytes!("../../../tests/fixtures/mvn_test_pass_full_raw.txt.gz");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4776 — let bytes = include_bytes!("../../../tests/fixtures/mvn_install_full_raw.txt.gz");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4821 — let i = include_str!("../../../tests/fixtures/mvn_quiet_fail_raw.txt");
[embed: compile-time file embed] src/cmds/jvm/mvn_cmd.rs:4889 — let i = include_str!("../../../tests/fixtures/mvn_quiet_fail_raw.txt");
[embed: compile-time file embed] src/cmds/php/phpstan_cmd.rs:412 — let input = include_str!("../../../tests/fixtures/phpstan_raw.json");
[embed: compile-time file embed] src/cmds/php/phpstan_cmd.rs:559 — let input = include_str!("../../../tests/fixtures/phpstan_raw.json");
[embed: compile-time file embed] src/cmds/python/uv_cmd.rs:554 — let input = include_str!("../../../tests/fixtures/uv_run_pytest_failure.txt");
[exec: process execution] src/cmds/rust/runner.rs:9 — let mut c = Command::new("cmd");
[exec: process execution] src/cmds/rust/runner.rs:13 — let mut c = Command::new("sh");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:536 — let input = include_str!("../../../tests/fixtures/sbt/sbt_test_pass.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:549 — let input = include_str!("../../../tests/fixtures/sbt/sbt_test_pass.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:564 — let input = include_str!("../../../tests/fixtures/sbt/sbt_test_fail.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:583 — let input = include_str!("../../../tests/fixtures/sbt/sbt_test_fail.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:595 — let input = include_str!("../../../tests/fixtures/sbt/sbt_test_fail.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:610 — let input = include_str!("../../../tests/fixtures/sbt/sbt_test_mockito_fail.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:639 — let input = include_str!("../../../tests/fixtures/sbt/sbt_test_mockito_fail.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:654 — let input = include_str!("../../../tests/fixtures/sbt/sbt_test_scalamock_fail.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:670 — let input = include_str!("../../../tests/fixtures/sbt/sbt_test_scalamock_fail.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:685 — let input = include_str!("../../../tests/fixtures/sbt/sbt_it_test_pass.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:728 — let input = include_str!("../../../tests/fixtures/sbt/sbt_test_munit_pass.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:739 — let input = include_str!("../../../tests/fixtures/sbt/sbt_test_munit_fail.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:750 — let input = include_str!("../../../tests/fixtures/sbt/sbt_test_munit_pass.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:777 — let input = include_str!("../../../tests/fixtures/sbt/sbt_compile_error.txt");
[embed: compile-time file embed] src/cmds/scala/sbt_cmd.rs:788 — let input = include_str!("../../../tests/fixtures/sbt/sbt_compile_error.txt");
[embed: compile-time file embed] src/cmds/system/ctest_cmd.rs:1165 — include_str!("../../../tests/fixtures/ctest_regex_fail_output_on_failure_raw.txt");
[embed: compile-time file embed] src/cmds/system/ctest_cmd.rs:1181 — let input = include_str!("../../../tests/fixtures/ctest_stop_on_failure_raw.txt");
[embed: compile-time file embed] src/cmds/system/ctest_cmd.rs:1196 — let input = include_str!("../../../tests/fixtures/ctest_long_regex_list_raw.txt");
[embed: compile-time file embed] src/cmds/system/ctest_cmd.rs:1218 — let input = include_str!("../../../tests/fixtures/ctest_green_skipped_raw.txt");
[embed: compile-time file embed] src/cmds/system/ctest_cmd.rs:1234 — let input = include_str!("../../../tests/fixtures/ctest_repeat_until_pass_raw.txt");
[embed: compile-time file embed] src/cmds/system/ctest_cmd.rs:1247 — let input = include_str!("../../../tests/fixtures/ctest_nested_result_raw.txt");
[embed: compile-time file embed] src/cmds/system/ctest_cmd.rs:1379 — let input = include_str!(
[embed: compile-time file embed] src/cmds/system/ctest_cmd.rs:1397 — let input = include_str!("../../../tests/fixtures/ctest_spoofed_framing_raw.txt");
[embed: compile-time file embed] src/cmds/system/ctest_cmd.rs:1453 — include_str!("../../../tests/fixtures/ctest_noisy_fail_output_on_failure_raw.txt");
[... truncated at 200 hits]
Summary
v0.48.0 adds Bun/Deno runtime support with routing through a unified
runner.rs, introduces Windows console code page handling for proper child-process output decoding, and modernizes regex patterns fromlazy_static!toLazyLock<Regex>(Rust 1.80+ std feature). The release also adds OpenShift (oc) support to container.rs, enhances ccusage parsing to accept current schema variants, and includes numerous filter improvements (find/head/tail/git-diff fixes, mvnd daemon support, phpstan/pest/pint/paratest/ecs support).Security Flags
src/core/telemetry.rs — No new endpoints, no consent-check removal. Payload now includes
meta_usagedict (6 meta-commands: gain/discover/proxy/verify/learn/init counted) anduntrusted_filterswarning ingain.rs. Assessment: Legitimate telemetry enrichment; consent still required.src/discover/registry.rs — Rewrite-rule changes are extensive (Bun/Deno routing, head/tail → rtk read, golangci-lint global opts stripping, PHP tool normalization,
uv runtransparent wrapper, multi-line block handling). All changes align with documented patterns; no dangerous argument injection observed. Assessment: Legitimate rewrite logic, bounded by test coverage.Cargo.toml — New deps:
encoding_rs,codepage,oem_cp(Windows code-page support);windows-sys(Win32 console APIs). Removed:lazy_static.coloredbumped 2→3. Assessment: Benign; code-page libraries are standard, uncontroversial.src/cmds/cloud/aws_cmd.rs:312, 335 —
exec_capture()replaces.output()call; newCaptureResulttype. No change to rewrite path. Assessment: Internal refactor, safe.src/analytics/gain.rs:159-163 — New warning block prints untrusted filter count via
eprintln!if >0; callsuntrusted_active_filter_count(). Assessment: Benign user-facing feedback.src/analytics/session_cmd.rs:43, 113 — New
is_already_rtk()check explicitly excludesrtk proxyfrom adoption counting (proxy runs unfiltered). Addedtool_use_idfield toExtractedCommand. Assessment: Legitimate accounting fix; prevents self-flattery via escape hatch..claude/agents/code-reviewer.md et al. — Documentation updates:
lazy_static!→LazyLock, no prompt-injection payloads. Assessment: Benign documentation.Pattern Scan Assessment
[network: hardcoded URL] (40+ hits in test fixtures, examples) — All in test code or comments (aws_cmd line 1741, gh_cmd line 1040, etc.). None in rewrite path or telemetry sender beyond the compiled
TELEMETRY_URL(which was already present). BENIGN — test data and examples.[embed: compile-time file embed] (60+ hits via
include_str!/include_bytes!) — All in test modules, loading fixture files fromtests/fixtures/. Standard Rust testing pattern. BENIGN — test fixtures only.[exec: process execution] (7 hits: aws_cmd.rs line 40, git.rs lines 2781+, gradlew_cmd.rs line 90, mvn_cmd.rs line 1804, runner.rs lines 9+13) — All legitimate command runners or test setup. No new execution paths in rewrite logic. BENIGN — expected in command-execution tool.
[fs: ~/.claude access] (git.rs line 3505) — Test assertion checking
.claude/CLAUDE.mdis parsed in git stash stat output. Not credential access. BENIGN — test mock data.Recommendation
MERGE SAFE — Registry and telemetry changes are well-tested and conservative; new dependencies are uncontroversial; no new credential/secret access; code-page support is localized and safe; prompt injection surface (.claude/) unchanged substantively.
🔒 cargo audit (RustSec)
After merging, rebuild your local binary:
Auto-generated by upstream-sync workflow