Next Release

.github/workflows/cd.yml

@@ -114,7 +114,7 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           permission-contents: write
           permission-pull-requests: write
-      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: release
         with:
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/ci.yml

@@ -57,7 +57,7 @@ jobs:
     needs: fmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo doc --no-deps
@@ -73,7 +73,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: clippy
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy, rustfmt
@@ -91,7 +91,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: clippy
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
@@ -112,18 +112,31 @@ jobs:
           echo "Apache-2.0 edition links no BUSL crate."
 
   test:
-    name: test (${{ matrix.os }})
+    name: test (${{ matrix.os }}${{ matrix.target && format(', {0}', matrix.target) || '' }})
     needs: clippy
     runs-on: ${{ matrix.os }}
+    env:
+      # An explicit target on every leg keeps the run command the same. It also puts
+      # each leg in cross mode, where RUSTFLAGS no longer reach build scripts or proc-macros.
+      CARGO_BUILD_TARGET: ${{ matrix.target || 'host-tuple' }}
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        include:
+          - os: ubuntu-latest
+          - os: windows-latest
+          # Links with MinGW's ld, which link.exe's `/STACK:` spelling breaks (see build.rs).
+          # The runner's host stays msvc, so build.rs also runs with host != target.
+          - os: windows-latest
+            target: x86_64-pc-windows-gnu
+          - os: macos-latest
     steps:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
       - uses: Swatinem/rust-cache@v2
         # `--all` is `--workspace`: `rtk` + `engine`. `proxy/` is tested in
         # its own job, since it is not a member.

.github/workflows/release.yml

@@ -138,7 +138,7 @@ jobs:
           cd ../../..
 
       - name: Upload rtk-oss artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: rtk-oss-${{ matrix.target }}
           path: rtk-oss-${{ matrix.target }}.${{ matrix.archive }}
@@ -182,7 +182,7 @@ jobs:
           cd ../../..
 
       - name: Upload rtk-proxy artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: rtk-proxy-${{ matrix.target }}
           path: rtk-proxy-${{ matrix.target }}.${{ matrix.archive }}
@@ -217,7 +217,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -232,7 +232,7 @@ jobs:
           RTK_TELEMETRY_TOKEN: ${{ secrets.RTK_TELEMETRY_TOKEN }}
 
       - name: Upload DEB
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: rtk-oss-deb
           path: target/debian/*.deb
@@ -243,7 +243,7 @@ jobs:
     container: fedora:latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install dependencies
         run: |
@@ -262,7 +262,7 @@ jobs:
         run: cargo generate-rpm --variant oss
 
       - name: Upload RPM
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: rtk-oss-rpm
           path: target/generate-rpm/*.rpm

Cargo.toml

@@ -93,7 +93,7 @@ crossterm = "0.28"
 libc = "0.2"
 
 [target.'cfg(windows)'.dependencies]
-windows-sys = { version = "0.59", features = [
+windows-sys = { version = "0.61", features = [
     "Win32_System_Console",
     "Win32_Globalization",
 ] }

build.rs

@@ -2,15 +2,35 @@ use std::collections::HashSet;
 use std::fs;
 use std::path::Path;
 
-fn main() {
-    #[cfg(windows)]
-    {
-        // Clap + the full command graph can exceed the default 1 MiB Windows
-        // main-thread stack during process startup. Reserve a larger stack for
-        // the CLI binary so `rtk.exe --version`, `--help`, and hook entry
-        // points start reliably without requiring ad-hoc RUSTFLAGS.
-        println!("cargo:rustc-link-arg=/STACK:8388608");
+/// Reserve a larger main-thread stack for Windows targets.
+///
+/// Clap + the full command graph can exceed the default 1 MiB Windows stack
+/// during process startup, so `rtk.exe --version`, `--help`, and the hook entry
+/// points need the headroom to start reliably without ad-hoc RUSTFLAGS.
+///
+/// Two things here are deliberately keyed off the **target**, not the host:
+/// `CARGO_CFG_TARGET_OS` (a `#[cfg(windows)]` here would describe the machine
+/// running the build, so cross-compiling to Windows from Linux would silently
+/// skip the flag), and the flag syntax itself — `link.exe` takes `/STACK:`
+/// while the MinGW `ld` behind `x86_64-pc-windows-gnu` only understands
+/// `--stack`, and feeding it `/STACK:` makes it look for a file by that name.
+/// Only `msvc` needs its own spelling: `gnu` (gnullvm reports it too) links
+/// through a gcc or clang driver that takes `-Wl,--stack`, and that is also what
+/// an environment the match does not name gets.
+fn set_windows_stack_size() {
+    if std::env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("windows") {
+        return;
     }
+    const STACK_BYTES: usize = 8 * 1024 * 1024;
+    let arg = match std::env::var("CARGO_CFG_TARGET_ENV").as_deref() {
+        Ok("msvc") => format!("/STACK:{STACK_BYTES}"),
+        _ => format!("-Wl,--stack,{STACK_BYTES}"),
+    };
+    println!("cargo:rustc-link-arg={arg}");
+}
+
+fn main() {
+    set_windows_stack_size();
 
     check_cmds_modules_declared();
 

docs/guide/getting-started/supported-agents.md

@@ -196,7 +196,7 @@ Plugin in the `openclaw/` directory. Uses the `before_tool_call` hook, delegates
 
 **Permissions.** RTK keeps the deny gate; OpenClaw owns approval. The plugin runs `rtk rewrite` with `RTK_REWRITE_HOST=openclaw`, which tells RTK that this host applies its own exec policy (`tools.exec.mode`, `security`, `ask`) to whatever the hook returns. RTK therefore does not prompt for a command that matched **no** rule, instead of raising a second approval derived from Claude Code's `settings.json` on a runtime that never opted into it ([#3908](https://github.com/rtk-ai/rtk/issues/3908)).
 
-A command matching a `permissions.deny` rule in those same Claude Code settings files is still refused, and the plugin blocks the tool call — naming the host only relaxes a *default* ask. As in Claude Code, a rule matches the command as written rather than every way of invoking the program (`Bash(git push *)` does not stop `git -C . push`), so a deny rule is not a security boundary. A command matching a `permissions.ask` rule you wrote still prompts when RTK rewrites it, because RTK keeps returning exit 3 for it. Commands containing a command substitution or a redirect to a file are never rewritten, on any host.
+A command matching a `permissions.deny` rule in those same Claude Code settings files is still refused, and the plugin blocks the tool call — naming the host only relaxes a *default* ask. As in Claude Code, a deny or ask rule matches the command as written and the command behind any leading assignment or wrapper (`HUSKY=0`, `timeout 30`, `nohup`, `command`, ...), each layer in turn, but not every way of invoking the program (`Bash(git push *)` does not stop `git -C . push` or `env -i git push`), so a deny rule is not a security boundary. Allow rules match the command as written. A command matching a `permissions.ask` rule you wrote still prompts when RTK rewrites it, because RTK keeps returning exit 3 for it. Commands containing a command substitution or a redirect to a file are never rewritten, on any host.
 
 The exec tool's own checks see the rewritten command. OpenClaw carries hook adjustments forward into the parameters passed to the exec tool, so `tools.exec.mode`, `tools.exec.security`, `tools.exec.ask` and the exec-approvals allowlist are all matched against `rtk git push`, not `git push`; write those rules against the `rtk` form. That was already true before the permission change. A trusted tool policy (`api.registerTrustedToolPolicy(...)`) is the exception: OpenClaw runs trusted policies before ordinary `before_tool_call` hooks, so one of those still sees the original command.