Next Release

.claude/agents/rust-rtk.md

@@ -325,7 +325,7 @@ fn test_real_git_log() {
 - `src/cmds/system/` - ls.rs, tree.rs, read.rs, grep_cmd.rs, find_cmd.rs, etc.
 
 **Hook & analytics** (`src/hooks/`, `src/analytics/`):
-- `src/hooks/init.rs` - rtk init command
+- `src/hooks/init/` - rtk init command
 - `src/analytics/gain.rs` - rtk gain command
 
 **Tests**:

.claude/commands/tech/codereview.md

@@ -63,7 +63,7 @@ git diff "$BASE_BRANCH"...HEAD --stat
 | `src/main.rs`                  | Command routing + Commands enum            |
 | `src/core/tracking.rs`         | SQLite patterns + DB path config           |
 | `src/core/config.rs`           | Configuration system                       |
-| `src/hooks/init.rs`            | Init patterns + hook installation          |
+| `src/hooks/init/`              | Init patterns + hook installation          |
 | `.github/workflows/`           | CI/CD multi-platform build targets         |
 | `tests/` ou `fixtures/`        | Testing Strategy (CLAUDE.md)               |
 | `Cargo.toml`                   | Dependencies + build optimizations         |

.claude/hooks/rtk-rewrite.sh

@@ -1,16 +1,16 @@
 #!/usr/bin/env bash
-# rtk-hook-version: 3
+# rtk-hook-version: 4
 # RTK auto-rewrite hook for Claude Code PreToolUse:Bash
 # Transparently rewrites raw commands to their RTK equivalents.
 # Uses `rtk rewrite` as single source of truth — no duplicate mapping logic here.
 #
 # To add support for new commands, update src/discover/registry.rs (PATTERNS + RULES).
 #
 # Exit code protocol for `rtk rewrite`:
-#   0 + stdout  Rewrite found, no deny/ask rule matched → auto-allow
+#   0 + stdout  Rewrite found, an allow rule matched → auto-allow
 #   1           No RTK equivalent → pass through unchanged
 #   2           Deny rule matched → pass through (Claude Code native deny handles it)
-#   3 + stdout  Ask rule matched → rewrite but let Claude Code prompt the user
+#   3 + stdout  Ask rule matched, or no rule matched → rewrite but let Claude Code prompt the user
 
 # --- Audit logging (opt-in via RTK_HOOK_AUDIT=1) ---
 _rtk_audit_log() {
@@ -45,13 +45,17 @@ case "$CMD" in
 esac
 
 # Rewrite via rtk — single source of truth for all command mappings and permission checks.
+# Scrub RTK_REWRITE_HOST: that channel relaxes RTK's approval gate, and this
+# hook turns exit 0 into an explicit allow, so an inherited value (a shell rc,
+# .envrc, or CI env) must not reach it. Only the delegate that sets it may
+# rely on it.
 # Use "|| EXIT_CODE=$?" to capture non-zero exit codes without triggering set -e.
 EXIT_CODE=0
-REWRITTEN=$(rtk rewrite "$CMD" 2>/dev/null) || EXIT_CODE=$?
+REWRITTEN=$(env -u RTK_REWRITE_HOST rtk rewrite "$CMD" 2>/dev/null) || EXIT_CODE=$?
 
 case $EXIT_CODE in
   0)
-    # Rewrite found, no permission rules matched — safe to auto-allow.
+    # Rewrite found and an allow rule matched — safe to auto-allow.
     if [ "$CMD" = "$REWRITTEN" ]; then
       _rtk_audit_log "skip:already_rtk" "$CMD"
       exit 0
@@ -68,8 +72,8 @@ case $EXIT_CODE in
     exit 0
     ;;
   3)
-    # Ask rule matched — rewrite the command but do NOT auto-allow so that
-    # Claude Code prompts the user for confirmation.
+    # An ask rule matched, or no rule did — rewrite the command but do NOT
+    # auto-allow, so Claude Code prompts the user for confirmation.
     ;;
   *)
     exit 0

.claude/rules/cli-testing.md

@@ -190,18 +190,52 @@ behavior (search/grep compression, guard rails, faithful formatting) rather than
 filter module, and several of them draw on `tests/fixtures/` (real captured aws/glab/gradlew/
 mvn/phpstan/dotnet output) alongside their own inline cases.
 
+### Machine independence (🔴 Critical)
+
+A test that spawns a real process must not depend on the machine it runs on. Two rules,
+both with `src/core/test_isolation/` helpers behind them (`tests/common/mod.rs` for the
+integration tests):
+
+- **Never assert on a third-party tool's wording.** git, grep and coreutils translate their
+  messages, so `stderr.contains("not a git repository")` fails outright in a French shell —
+  and a *negative* assertion (`!out.contains("Is a directory")`) is worse, passing vacuously
+  while testing nothing. Assert RTK's own output, or the structure (exit code, which stream
+  the message went to). Spawn rtk through `test_isolation::rtk_command()`
+  (`common::rtk_command()` under `tests/`): it redirects rtk's data and neutralizes the
+  contributor's git config and exported `GIT_*` variables, but leaves the locale to the
+  test. When a test genuinely needs a tool's English text, set `LC_ALL=C` on that command,
+  and on any native tool its output is compared with. A git the test runs itself goes
+  through `isolate_git()`, which pins it.
+- **Never touch the ambient repository.** Use `test_isolation::temp_git_repo()` and
+  `.current_dir(repo.path())`. A test that runs `git branch` in whatever repo the
+  contributor is sitting in mutates their work, and one that assumes it is inside a repo at
+  all silently stops exercising anything when it isn't.
+
+Verify a change here against a hostile environment, not just yours:
+
+```bash
+LC_ALL=de_DE.UTF-8 LANGUAGE=de cargo test --all -- --include-ignored
+GIT_DIR=/path/to/another/repo/.git RTK_NO_TOML=1 RTK_TEE=0 cargo test --all -- --include-ignored
+TMPDIR=/path/inside/a/git/repo cargo test --all -- --include-ignored
+```
+
+and with a `~/.gitconfig` that signs commits, deny rules in `~/.claude/settings.json`, and a
+`global.json` or `.ignore` above `TMPDIR`: none of it may change a result, and none of it may
+be written to.
+
 ### Real Command Execution
 
 ```rust
 #[test]
 #[ignore] // Run with: cargo test --ignored
 fn test_real_git_log() {
-    // Requires:
-    // 1. RTK binary installed (cargo install --path .)
-    // 2. Git repository available
-
-    let output = std::process::Command::new("rtk")
+    // The binary cargo built for this run, with rtk's data redirected to a
+    // scratch directory (the installed `rtk` would write to the developer's own),
+    // in a throwaway repository rather than the one the tests run from.
+    let repo = common::temp_git_repo();
+    let output = common::rtk_command()
         .args(&["git", "log", "-10"])
+        .current_dir(repo.path())
         .output()
         .expect("Failed to run rtk");
 
@@ -217,16 +251,13 @@ fn test_real_git_log() {
 ### Running Integration Tests
 
 ```bash
-# 1. Install RTK locally
-cargo install --path .
-
-# 2. Run all tests, including top-level tests/*.rs integration tests
+# 1. Run all tests, including top-level tests/*.rs integration tests
 cargo test --all
 
-# 3. Run ignored (real-process) integration tests
+# 2. Run ignored (real-process) integration tests
 cargo test --ignored
 
-# 4. Run specific test
+# 3. Run specific test
 cargo test --ignored test_real_git_log
 ```
 
@@ -457,7 +488,7 @@ fn test_ansi_codes() {
 #[test]
 #[ignore]
 fn test_real_command_execution() {
-    let output = std::process::Command::new("rtk")
+    let output = common::rtk_command()
         .args(&["cmd", "args"])
         .output()
         .expect("Failed to run rtk");

.claude/rules/search-strategy.md

@@ -32,7 +32,7 @@ src/
 │   ├── runner.rs              ← Command execution runner
 │   └── stream.rs              ← Streaming output handling
 ├── hooks/                     ← Hook system
-│   ├── init.rs                ← rtk init command
+│   ├── init/                  ← rtk init command
 │   ├── rewrite_cmd.rs         ← rtk rewrite command
 │   ├── hook_cmd.rs            ← Gemini/Copilot hook processors
 │   ├── hook_check.rs          ← Hook status detection
@@ -62,7 +62,7 @@ src/
 ├── discover/                  ← Claude Code history analysis
 ├── learn/                     ← CLI correction detection
 ├── parser/                    ← Parser infrastructure
-└── filters/                   ← 63 TOML filter configs
+└── filters/                   ← 62 TOML filter configs
 ```
 
 ## Common Search Patterns
@@ -146,7 +146,7 @@ Glob pattern="tests/fixtures/*.txt"
 ### Configuration issues
 
 1. `src/core/config.rs` → `RtkConfig` struct
-2. `src/hooks/init.rs` → `rtk init` command
+2. `src/hooks/init/` → `rtk init` command
 3. Config file: `~/.config/rtk/config.toml`
 4. Filter files: `~/.config/rtk/filters/` (global) or `.rtk/filters/` (project)
 

.claude/skills/rtk-tdd/references/testing-patterns.md

@@ -28,7 +28,7 @@ Prioritized by testability (pure functions first, I/O-heavy last).
 | `find_cmd.rs` | Directory grouping logic | Filesystem-dependent |
 | `wget_cmd.rs` | `compact_url`, `format_size`, `truncate_line`, `extract_filename_from_output` | Some pure helpers worth testing |
 | `gain.rs` | Display formatting | Depends on tracking DB |
-| `init.rs` | CLAUDE.md generation | File I/O |
+| `hooks/init/` | CLAUDE.md generation | File I/O |
 | `main.rs` | CLI routing | Covered by smoke tests |
 
 ## RTK Test Patterns

.github/workflows/cd.yml

@@ -26,7 +26,7 @@ jobs:
     outputs:
       tag: ${{ steps.tag.outputs.tag }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -143,7 +143,7 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           permission-contents: write
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
     name: test presence
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 50
       - name: Check filter modules have tests
@@ -30,7 +30,7 @@ jobs:
     name: fmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt
@@ -41,7 +41,7 @@ jobs:
     needs: fmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
@@ -59,7 +59,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - uses: dtolnay/rust-toolchain@stable
@@ -71,7 +71,7 @@ jobs:
     needs: clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -194,7 +194,7 @@ jobs:
     container:
       image: semgrep/semgrep
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - run: semgrep scan --config .semgrep.yml --baseline-commit ${{ github.event.pull_request.base.sha }} --error
@@ -204,7 +204,7 @@ jobs:
     needs: clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@stable
 
@@ -214,13 +214,13 @@ jobs:
         run: cargo build --release
 
       - name: Install system tools
-        run: sudo apt-get install -y tree
+        run: sudo apt-get install -y tree ripgrep
 
       - name: Install Python tools
         run: pip install ruff pytest mypy
 
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: "stable"
 
@@ -237,7 +237,7 @@ jobs:
     if: github.base_ref == 'develop'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/pr-target-check.yml

@@ -21,7 +21,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Add wrong-base label and comment
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           script: |

.github/workflows/release.yml

@@ -59,7 +59,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -100,7 +100,7 @@ jobs:
           cd ../../..
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: rtk-${{ matrix.target }}
           path: rtk-${{ matrix.target }}.${{ matrix.archive }}
@@ -110,7 +110,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -125,7 +125,7 @@ jobs:
           RTK_TELEMETRY_TOKEN: ${{ secrets.RTK_TELEMETRY_TOKEN }}
 
       - name: Upload DEB
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: rtk-deb
           path: target/debian/*.deb
@@ -136,7 +136,7 @@ jobs:
     container: fedora:latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install dependencies
         run: |
@@ -155,7 +155,7 @@ jobs:
         run: cargo generate-rpm
 
       - name: Upload RPM
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: rtk-rpm
           path: target/generate-rpm/*.rpm
@@ -173,7 +173,7 @@ jobs:
           permission-contents: write
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download all artifacts
         uses: actions/download-artifact@v4
@@ -213,7 +213,7 @@ jobs:
           sha256sum * > checksums.txt
 
       - name: Upload Release Assets
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ steps.version.outputs.version }}
           files: release/*

.github/workflows/stale.yml

@@ -26,7 +26,7 @@ jobs:
           permission-issues: write
           permission-pull-requests: write
 
-      - uses: actions/stale@v9
+      - uses: actions/stale@v11
         with:
           repo-token: ${{ steps.app-token.outputs.token }}
           # --- Issues & PRs ---