#892
#897

When RTK runs via Claude Code's PreToolUse hook, grep/rg subprocesses
inherit the hook's open stdin pipe. They block waiting for EOF and never
terminate, accumulating memory unboundedly (reported: 514GB on 96GB Mac,
kernel panic).

Fix: set stdin(Stdio::null()) on both rg and grep fallback commands so
subprocesses get immediate EOF instead of inheriting the parent pipe.

Signed-off-by: Patrick szymkowiak <patrick.szymkowiak@innovtech.eu>

pr_merge() was using run_filtered with a filter_fn that ignored stdout
and always returned "ok merged". This made AI agents believe PRs were
merged when they weren't.

Switch to run_passthrough so the real gh output is shown. gh pr merge
is a destructive action — the user must see exactly what happened.

Signed-off-by: Patrick szymkowiak <patrick.szymkowiak@innovtech.eu>

Previously, commands not in any deny/ask list were auto-allowed. This
bypassed Claude Code's least-privilege default where unlisted commands
should prompt the user for confirmation.

Permission precedence is now: Deny > Ask > Allow (explicit) > Default (ask).

Changes:
- permissions.rs: load allow rules from settings.json, add Default variant
- rewrite_cmd.rs: treat Default same as Ask (exit 3)
- hook_cmd.rs: add permission checks to Copilot VS Code hook (ask/allow/deny),
  add deny check to Gemini hook (no ask mode available in Gemini CLI)

Gemini CLI limitation: only supports allow/deny, no ask mode. Codex: ask
is parsed but fails open. These tools document the limitation.

Signed-off-by: Patrick szymkowiak <patrick.szymkowiak@innovtech.eu>

feat(aws): expand CLI filters from 8 to 25 subcommands

Signed-off-by: Patrick szymkowiak <patrick.szymkowiak@innovtech.eu>

…733)

Command::output() sets stdin to Stdio::piped() by default, creating an
empty pipe instead of inheriting the terminal. SSH signing tools
(1Password, YubiKey, gpg-agent with pinentry) need TTY access on stdin
for passphrase prompts or agent communication. This caused signatures
to be silently dropped — commits succeeded but without gpgsig headers.

Fix: add .stdin(Stdio::inherit()) to git commit and git push commands
so they inherit the parent's stdin (terminal or hook pipe). Output
capture via stdout/stderr pipes is preserved.

Signed-off-by: Patrick szymkowiak <patrick.szymkowiak@innovtech.eu>

fix(security): default to ask when no permission rule matches (#886)

fix(git): inherit stdin for commit and push to preserve SSH signing (#733)

Also fixes flaky test_rewrite_rtk_disabled_warns_on_stderr: the subprocess part relied on target/debug/rtk being current, but cargo test doesn't rebuild the standalone binary.

Added mtime guard -> skips when binary is older than test executable.

…/rtk into fix/batch-priority-issues

… unix tmp)

fix(grep): close subprocess stdin to prevent memory leak (#897)

Signed-off-by: em0t <10153971+em0t@users.noreply.github.com>

Signed-off-by: em0t <10153971+em0t@users.noreply.github.com>

Telemetry details are already documented in the README privacy section.
No need to print them during init.

Signed-off-by: Patrick szymkowiak <patrick.szymkowiak@innovtech.eu>

fix(go): preserve failing test location context

fix(git): preserve full diff hunk headers

fix(init): remove opt-out instruction from telemetry message

Signed-off-by: em0t <10153971+em0t@users.noreply.github.com>

fix(gh): pass through gh pr merge instead of canned response (#938)

…/rtk into fix/batch-priority-issues

fix(go): avoid false build errors from download logs

fix(main): kill zombie processes + path for rtk md + missing intergrations

Drop-based ChildGuard doesn't run on signals with panic=abort (release
profile). Register a signal handler that stores the child PID in an
AtomicU32 and kills it on SIGINT/SIGTERM, then re-raises the signal
with default handler for correct exit status propagation.

Fixes orphan processes when rtk proxy is killed by Claude Code, process
managers, or manual kill — the root cause behind issue #897.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

fix(merge): changelog conflicts