feat(): batch fixs + aws extended + filter quality batch by aeppling · Pull Request #997 · rtk-ai/rtk

aeppling · 2026-04-03T09:38:11Z

Feat :

8 to 20 aws commands supports

Filters quality :

git diff hunk header no trunc
go ->preserve failing test location (by keyword)

Fixs :

Add 17 specialized filters for high-token-waste AWS operations: - CloudWatch Logs (get-log-events, filter-log-events, get-query-results) - CloudFormation describe-stack-events (failures-first) - Lambda list-functions, get-function (strips Environment secrets) - IAM list-roles (extract principals), list-users - DynamoDB scan/query/get-item (recursive type unwrapping) - ECS describe-tasks (stoppedReason + exitCode) - EC2 describe-security-groups (compact rule notation) - S3API list-objects-v2, S3 sync/cp (text summary) - EKS describe-cluster, SQS receive-message - Secrets Manager get-secret-value Architecture: - Extract run_aws_filtered() shared runner with Result<i32> return - Add force_tee_hint() for truncation recovery (no dead ends for LLMs) - Follow six-phase contract (stderr tracking, tee on failure, exit codes) - Migrate existing 8 handlers to shared runner Inspired by #644 for DynamoDB get-item, S3 transfer, Secrets Manager, query-results, and N-type precision.

#892 #897

When RTK runs via Claude Code's PreToolUse hook, grep/rg subprocesses inherit the hook's open stdin pipe. They block waiting for EOF and never terminate, accumulating memory unboundedly (reported: 514GB on 96GB Mac, kernel panic). Fix: set stdin(Stdio::null()) on both rg and grep fallback commands so subprocesses get immediate EOF instead of inheriting the parent pipe. Signed-off-by: Patrick szymkowiak <[email protected]>

pr_merge() was using run_filtered with a filter_fn that ignored stdout and always returned "ok merged". This made AI agents believe PRs were merged when they weren't. Switch to run_passthrough so the real gh output is shown. gh pr merge is a destructive action — the user must see exactly what happened. Signed-off-by: Patrick szymkowiak <[email protected]>

Previously, commands not in any deny/ask list were auto-allowed. This bypassed Claude Code's least-privilege default where unlisted commands should prompt the user for confirmation. Permission precedence is now: Deny > Ask > Allow (explicit) > Default (ask). Changes: - permissions.rs: load allow rules from settings.json, add Default variant - rewrite_cmd.rs: treat Default same as Ask (exit 3) - hook_cmd.rs: add permission checks to Copilot VS Code hook (ask/allow/deny), add deny check to Gemini hook (no ask mode available in Gemini CLI) Gemini CLI limitation: only supports allow/deny, no ask mode. Codex: ask is parsed but fails open. These tools document the limitation. Signed-off-by: Patrick szymkowiak <[email protected]>

feat(aws): expand CLI filters from 8 to 25 subcommands

Signed-off-by: Patrick szymkowiak <[email protected]>

…733) Command::output() sets stdin to Stdio::piped() by default, creating an empty pipe instead of inheriting the terminal. SSH signing tools (1Password, YubiKey, gpg-agent with pinentry) need TTY access on stdin for passphrase prompts or agent communication. This caused signatures to be silently dropped — commits succeeded but without gpgsig headers. Fix: add .stdin(Stdio::inherit()) to git commit and git push commands so they inherit the parent's stdin (terminal or hook pipe). Output capture via stdout/stderr pipes is preserved. Signed-off-by: Patrick szymkowiak <[email protected]>

fix(security): default to ask when no permission rule matches (#886)

fix(git): inherit stdin for commit and push to preserve SSH signing (#733)

Also fixes flaky test_rewrite_rtk_disabled_warns_on_stderr: the subprocess part relied on target/debug/rtk being current, but cargo test doesn't rebuild the standalone binary. Added mtime guard -> skips when binary is older than test executable.

…/rtk into fix/batch-priority-issues

… unix tmp)

fix(grep): close subprocess stdin to prevent memory leak (#897)

CLAassistant · 2026-04-03T09:38:26Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
3 out of 4 committers have signed the CLA.

✅ pszymkowiak
✅ aeppling
✅ em0t
❌ Jb

Jb seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

Signed-off-by: em0t <[email protected]>

Telemetry details are already documented in the README privacy section. No need to print them during init. Signed-off-by: Patrick szymkowiak <[email protected]>

fix(go): preserve failing test location context

fix(git): preserve full diff hunk headers

fix(init): remove opt-out instruction from telemetry message

Signed-off-by: em0t <[email protected]>

fix(gh): pass through gh pr merge instead of canned response (#938)

Signed-off-by: em0t <[email protected]>

…/rtk into fix/batch-priority-issues

fix(go): avoid false build errors from download logs

aeppling · 2026-04-03T14:25:51Z

CLA-assistant fail to lookup @jbronssin but he has already signed CLA

fix(main): kill zombie processes + path for rtk md + missing intergrations

aeppling · 2026-04-04T18:00:18Z

Need : #1021 , once merged ok for me

Integrates ~30 develop commits (PR #997): AWS expansion (8→25 cmds), SSH signing for git commit/push, go test context, grep stdin leak fix, default-to-ask permissions, gh pr merge passthrough. Conflict resolution (4 files): - git.rs: kept .output()+stdin(inherit) for commit/push (SSH/GPG signing) - go_cmd.rs: accepted incoming + added pub(crate) visibility - hook_check.rs: merged binary_hook_registered + other_integration_installed - hook_cmd.rs: fixed permissions path, println→writeln for Gemini deny Verified: 1445 tests pass, 0 clippy errors, all manual integration tests pass. Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Jb and others added 16 commits March 30, 2026 20:38

fix(main): kill zombie processes + path for rtk md

d16fc6d

#892 #897

Merge pull request #885 from jbronssin/feat/aws-expand-cli-filters

402c48e

feat(aws): expand CLI filters from 8 to 25 subcommands

docs(hooks): document permission precedence model in README

d9ef47f

Signed-off-by: Patrick szymkowiak <[email protected]>

Merge pull request #981 from rtk-ai/fix/permission-default-ask

158c745

fix(security): default to ask when no permission rule matches (#886)

fix(docs): clean some docs + disclaimer

deda44f

Merge pull request #982 from rtk-ai/fix/git-commit-ssh-signing

eefeae4

fix(git): inherit stdin for commit and push to preserve SSH signing (#733)

fix(cmd): read/cat multiple file and consistent behavior

3f58018

Merge branch 'fix/batch-priority-issues' of https://github.com/rtk-ai…

46b923f

…/rtk into fix/batch-priority-issues

fix(tracking): use std::env::temp_dir() for compatibility (instead of…

e918661

… unix tmp)

Merge pull request #979 from rtk-ai/fix/grep-stdin-leak

7217562

fix(grep): close subprocess stdin to prevent memory leak (#897)

em0t and others added 9 commits April 3, 2026 18:09

fix(go): avoid false build errors from download logs

d44fd3e

Signed-off-by: em0t <[email protected]>

fix(git): preserve full diff hunk headers

09b3ff9

Signed-off-by: em0t <[email protected]>

fix(go): preserve failing test location context

374fe64

Signed-off-by: em0t <[email protected]>

fix(init): remove telemetry info lines from init output

7dbef2c

Telemetry details are already documented in the README privacy section. No need to print them during init. Signed-off-by: Patrick szymkowiak <[email protected]>

Merge pull request #994 from em0t/fix/go-test-failure-context

1481bc5

fix(go): preserve failing test location context

Merge pull request #993 from em0t/fix/git-diff-hunk-context

62f4452

fix(git): preserve full diff hunk headers

Merge pull request #1000 from rtk-ai/fix/telemetry-init-message

7571c8e

fix(init): remove opt-out instruction from telemetry message

fix(go): restore build error coverage

1177c9c

Signed-off-by: em0t <[email protected]>

Merge pull request #980 from rtk-ai/fix/gh-pr-merge-canned

8465ca9

fix(gh): pass through gh pr merge instead of canned response (#938)

aeppling changed the title ~~feat(): batch fixs + aws extended filters~~ feat(): batch fixs + aws extended + filter quality batch Apr 3, 2026

em0t and others added 3 commits April 3, 2026 21:44

fix(go): cover more build failure shapes

2425ad6

Signed-off-by: em0t <[email protected]>

Merge branch 'fix/batch-priority-issues' of https://github.com/rtk-ai…

13004e8

…/rtk into fix/batch-priority-issues

Merge pull request #992 from em0t/fix/go-build-false-errors

9c1cf2f

fix(go): avoid false build errors from download logs

aeppling added 2 commits April 3, 2026 18:22

fix(review): address ChildGuard disarm, stdin dedup, hook masking

d85fe33

Merge pull request #978 from rtk-ai/fix/batch-priority-issues

a919335

fix(main): kill zombie processes + path for rtk md + missing intergrations

aeppling requested review from FlorianBruniaux and pszymkowiak April 4, 2026 18:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(): batch fixs + aws extended + filter quality batch#997

feat(): batch fixs + aws extended + filter quality batch#997
aeppling wants to merge 30 commits intomasterfrom
develop

aeppling commented Apr 3, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Apr 3, 2026 •

edited

Loading

Uh oh!

aeppling commented Apr 3, 2026

Uh oh!

aeppling commented Apr 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

aeppling commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Feat :

Filters quality :

Fixs :

Uh oh!

CLAassistant commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aeppling commented Apr 3, 2026

Uh oh!

aeppling commented Apr 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

aeppling commented Apr 3, 2026 •

edited

Loading

CLAassistant commented Apr 3, 2026 •

edited

Loading