Agentic fuzzer + 7 filter bug fixes

.claude/agents/technical-writer.md

@@ -115,7 +115,7 @@ rtk --version  # Should show rtk X.Y.Z
 
 **Option 2: From Source**
 ```bash
-git clone https://github.com/rtk-ai/rtk.git
+git clone https://github.com/algolia/rtk.git
 cd rtk
 cargo install --path .
 rtk --version  # Verify installation
@@ -130,7 +130,7 @@ rtk gain  # Should show token savings analytics
 
 **From Source** (Cargo required):
 ```bash
-git clone https://github.com/rtk-ai/rtk.git
+git clone https://github.com/algolia/rtk.git
 cd rtk
 cargo install --path .
 
@@ -141,7 +141,7 @@ rtk --version
 
 **Binary Download** (faster):
 ```bash
-curl -sSL https://github.com/rtk-ai/rtk/releases/download/v0.16.0/rtk-linux-x86_64 -o rtk
+curl -sSL https://github.com/algolia/rtk/releases/download/v0.16.0/rtk-linux-x86_64 -o rtk
 chmod +x rtk
 sudo mv rtk /usr/local/bin/
 rtk --version
@@ -172,7 +172,7 @@ rtk --version
 - **Fix**: Uninstall and reinstall correct RTK
   ```bash
   cargo uninstall rtk
-  cargo install --path .  # From rtk-ai/rtk repo
+  cargo install --path .  # From algolia/rtk repo (fork of rtk-ai/rtk)
   rtk gain --help  # Should work
   ```
 ```

.claude/hooks/bash/pre-commit-format.sh

@@ -1,16 +1,33 @@
 #!/bin/bash
-# Auto-format Rust code before commits
-# Hook: PreToolUse for git commit
+# Auto-format and lint Rust code before commits
+# Hook: PreToolUse for git commit (Claude Code)
+# Also installed as .git/hooks/pre-commit for native git
+
+set -e
 
 echo "🦀 Running Rust pre-commit checks..."
 
-# Format code
+# Find cargo (support both rustup and system installs)
+if [ -f "$HOME/.cargo/env" ]; then
+    # shellcheck source=/dev/null
+    source "$HOME/.cargo/env"
+fi
+
+if ! command -v cargo &>/dev/null; then
+    echo "⚠️  cargo not found — skipping pre-commit checks"
+    exit 0
+fi
+
+# Auto-fix formatting
 cargo fmt --all
 
-# Check for compilation errors only (warnings allowed)
-if cargo clippy --all-targets 2>&1 | grep -q "error:"; then
-    echo "❌ Clippy found errors. Fix them before committing."
+# Stage any fmt changes so they're included in the commit
+git add -u
+
+# Strict clippy — matches CI exactly
+if ! cargo clippy --all-targets -- -D warnings 2>&1; then
+    echo "❌ Clippy -D warnings failed. Fix errors before committing."
     exit 1
 fi
 
-echo "✅ Pre-commit checks passed (warnings allowed)"
+echo "✅ Pre-commit checks passed"

.claude/hooks/rtk-rewrite.sh

@@ -39,9 +39,13 @@ case "$FIRST_CMD" in
   rtk\ *|*/rtk\ *) _rtk_audit_log "skip:already_rtk" "$CMD"; exit 0 ;;
 esac
 
-# Skip commands with heredocs, variable assignments as the whole command, etc.
+# Skip commands with heredocs, subshell assignments, or process substitution.
+# Subshell assignments like VAR=$(grep ...) confuse the ENV_PREFIX regex
+# which misparsed "APP_ID=$(grep " as an env prefix, mangling the rewrite.
 case "$FIRST_CMD" in
   *'<<'*) _rtk_audit_log "skip:heredoc" "$CMD"; exit 0 ;;
+  *'=$('*) _rtk_audit_log "skip:subshell_assignment" "$CMD"; exit 0 ;;
+  *'=`'*) _rtk_audit_log "skip:backtick_assignment" "$CMD"; exit 0 ;;
 esac
 
 # Strip leading env var assignments for pattern matching

.claude/skills/ship.md

@@ -187,7 +187,7 @@ gh release view v0.17.0
 ### 3. Installation Verification
 ```bash
 # Test installation from release
-curl -sSL https://github.com/rtk-ai/rtk/releases/download/v0.17.0/rtk-macos-latest -o rtk
+curl -sSL https://github.com/algolia/rtk/releases/download/v0.17.0/rtk-macos-latest -o rtk
 chmod +x rtk
 ./rtk --version
 # Should show v0.17.0

.github/workflows/benchmark.yml

@@ -2,7 +2,7 @@ name: Benchmark Token Savings
 
 on:
   push:
-    branches: [master, main]
+    branches: [main]
   pull_request:
 
 jobs:

.github/workflows/ci.yml

@@ -0,0 +1,115 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  # ── Cheap pre-checks (no compilation, run in parallel) ──────────────────────
+  fmt:
+    name: Format Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --all --check
+
+  telemetry-guard:
+    name: Telemetry Guard
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Block telemetry code
+        run: |
+          echo "## Telemetry Guard" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          FAILED=0
+
+          # Check for telemetry module
+          if [ -f src/telemetry.rs ]; then
+            echo "::error::src/telemetry.rs exists — this fork does not permit telemetry"
+            echo "- src/telemetry.rs detected" >> $GITHUB_STEP_SUMMARY
+            FAILED=1
+          fi
+
+          # Check for telemetry dependencies
+          for dep in ureq reqwest hyper sha2 hostname; do
+            if grep -q "^${dep} " Cargo.toml 2>/dev/null || grep -q "\"${dep}\"" Cargo.toml 2>/dev/null; then
+              echo "::error::Forbidden dependency '${dep}' found in Cargo.toml"
+              echo "- Forbidden dep: ${dep}" >> $GITHUB_STEP_SUMMARY
+              FAILED=1
+            fi
+          done
+
+          # Check for phone-home patterns in Rust source
+          if grep -rE "telemetry|phone.?home|TELEMETRY_URL|TELEMETRY_TOKEN|send_ping|maybe_ping" src/ --include="*.rs" | grep -v "// *no.telemetry\|tracking.rs\|SECURITY.md"; then
+            echo "::error::Telemetry-related code patterns found in src/"
+            echo "- Telemetry patterns in source" >> $GITHUB_STEP_SUMMARY
+            FAILED=1
+          fi
+
+          # Check for HTTP client usage (ureq/reqwest) in source
+          if grep -rE "ureq::|reqwest::" src/ --include="*.rs"; then
+            echo "::error::HTTP client usage found in source — RTK should not make network calls"
+            echo "- HTTP client usage in source" >> $GITHUB_STEP_SUMMARY
+            FAILED=1
+          fi
+
+          if [ "$FAILED" -eq 1 ]; then
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "This fork maintains a strict no-telemetry policy." >> $GITHUB_STEP_SUMMARY
+            echo "See CLAUDE.md 'Telemetry Exclusion Policy' for details." >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+          echo "No telemetry code detected." >> $GITHUB_STEP_SUMMARY
+
+  # ── Heavy matrix job (shares one compile via target/ within each runner) ────
+  build-and-test:
+    name: Build & Test (${{ matrix.os }})
+    needs: [fmt, telemetry-guard]
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - name: Cargo cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-
+
+      # Single compile shared by clippy + test (target/ persists across steps)
+      - name: Clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Test
+        run: cargo test --all
+
+      # Release build only on main — PRs don't need it
+      - name: Build release
+        if: github.ref == 'refs/heads/main'
+        run: cargo build --release

.github/workflows/release-please.yml

@@ -3,7 +3,7 @@ name: Release Please
 on:
   push:
     branches:
-      - master
+      - main
 
 permissions:
   contents: write

.github/workflows/release.yml

@@ -184,111 +184,3 @@ jobs:
           files: release/*
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  homebrew:
-    name: Update Homebrew formula
-    needs: [release]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Get version
-        id: version
-        run: |
-          TAG="${{ inputs.tag }}"
-          if [ -z "$TAG" ]; then
-            TAG="${{ github.event.release.tag_name }}"
-          fi
-          VERSION="${TAG#v}"
-          echo "tag=$TAG" >> $GITHUB_OUTPUT
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Download checksums
-        run: |
-          gh release download "${{ steps.version.outputs.tag }}" \
-            --repo rtk-ai/rtk \
-            --pattern checksums.txt
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Parse checksums
-        id: sha
-        run: |
-          echo "mac_arm=$(grep aarch64-apple-darwin.tar.gz checksums.txt | head -1 | awk '{print $1}')" >> $GITHUB_OUTPUT
-          echo "mac_intel=$(grep x86_64-apple-darwin.tar.gz checksums.txt | head -1 | awk '{print $1}')" >> $GITHUB_OUTPUT
-          echo "linux_arm=$(grep aarch64-unknown-linux-gnu.tar.gz checksums.txt | head -1 | awk '{print $1}')" >> $GITHUB_OUTPUT
-          echo "linux_intel=$(grep x86_64-unknown-linux-gnu.tar.gz checksums.txt | head -1 | awk '{print $1}')" >> $GITHUB_OUTPUT
-
-      - name: Generate formula
-        run: |
-          cat > rtk.rb << 'FORMULA'
-          class Rtk < Formula
-            desc "Rust Token Killer - High-performance CLI proxy to minimize LLM token consumption"
-            homepage "https://www.rtk-ai.app"
-            version "VERSION_PLACEHOLDER"
-            license "MIT"
-
-            if OS.mac? && Hardware::CPU.arm?
-              url "https://github.com/rtk-ai/rtk/releases/download/TAG_PLACEHOLDER/rtk-aarch64-apple-darwin.tar.gz"
-              sha256 "SHA_MAC_ARM_PLACEHOLDER"
-            elsif OS.mac? && Hardware::CPU.intel?
-              url "https://github.com/rtk-ai/rtk/releases/download/TAG_PLACEHOLDER/rtk-x86_64-apple-darwin.tar.gz"
-              sha256 "SHA_MAC_INTEL_PLACEHOLDER"
-            elsif OS.linux? && Hardware::CPU.arm?
-              url "https://github.com/rtk-ai/rtk/releases/download/TAG_PLACEHOLDER/rtk-aarch64-unknown-linux-gnu.tar.gz"
-              sha256 "SHA_LINUX_ARM_PLACEHOLDER"
-            elsif OS.linux? && Hardware::CPU.intel?
-              url "https://github.com/rtk-ai/rtk/releases/download/TAG_PLACEHOLDER/rtk-x86_64-unknown-linux-gnu.tar.gz"
-              sha256 "SHA_LINUX_INTEL_PLACEHOLDER"
-            end
-
-            def install
-              bin.install "rtk"
-            end
-
-            def caveats
-              <<~EOS
-                rtk is installed! Get started:
-
-                  # Initialize for Claude Code
-                  rtk init -g          # Global hook-first setup (recommended)
-                  rtk init             # Add to ./CLAUDE.md (this project only)
-
-                  # See all commands
-                  rtk --help
-
-                  # Measure your token savings
-                  rtk gain
-
-                Full documentation: https://www.rtk-ai.app
-              EOS
-            end
-
-            test do
-              system "#{bin}/rtk", "--version"
-            end
-          end
-          FORMULA
-          sed -i "s/VERSION_PLACEHOLDER/${{ steps.version.outputs.version }}/g" rtk.rb
-          sed -i "s/TAG_PLACEHOLDER/${{ steps.version.outputs.tag }}/g" rtk.rb
-          sed -i "s/SHA_MAC_ARM_PLACEHOLDER/${{ steps.sha.outputs.mac_arm }}/g" rtk.rb
-          sed -i "s/SHA_MAC_INTEL_PLACEHOLDER/${{ steps.sha.outputs.mac_intel }}/g" rtk.rb
-          sed -i "s/SHA_LINUX_ARM_PLACEHOLDER/${{ steps.sha.outputs.linux_arm }}/g" rtk.rb
-          sed -i "s/SHA_LINUX_INTEL_PLACEHOLDER/${{ steps.sha.outputs.linux_intel }}/g" rtk.rb
-          # Remove leading spaces from heredoc
-          sed -i 's/^          //' rtk.rb
-
-      - name: Push to homebrew-tap
-        run: |
-          CONTENT=$(base64 -w 0 rtk.rb)
-          SHA=$(gh api repos/rtk-ai/homebrew-tap/contents/Formula/rtk.rb --jq '.sha' 2>/dev/null || echo "")
-          if [ -n "$SHA" ]; then
-            gh api -X PUT repos/rtk-ai/homebrew-tap/contents/Formula/rtk.rb \
-              -f message="rtk ${{ steps.version.outputs.version }}" \
-              -f content="$CONTENT" \
-              -f sha="$SHA"
-          else
-            gh api -X PUT repos/rtk-ai/homebrew-tap/contents/Formula/rtk.rb \
-              -f message="rtk ${{ steps.version.outputs.version }}" \
-              -f content="$CONTENT"
-          fi
-        env:
-          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}

.github/workflows/security-check.yml

@@ -2,7 +2,7 @@ name: Security Check
 
 on:
   pull_request:
-    branches: [ master ]
+    branches: [ main ]
 
 permissions:
   contents: read
@@ -46,7 +46,7 @@ jobs:
       - name: Critical files check
         run: |
           echo "### 🎯 Critical Files Modified" >> $GITHUB_STEP_SUMMARY
-          CRITICAL=$(git diff --name-only origin/master...HEAD | grep -E "(runner|summary|tracking|init|pnpm_cmd|container)\.rs|Cargo\.toml|workflows/.*\.yml" || true)
+          CRITICAL=$(git diff --name-only origin/main...HEAD | grep -E "(runner|summary|tracking|init|pnpm_cmd|container)\.rs|Cargo\.toml|workflows/.*\.yml" || true)
           if [ -n "$CRITICAL" ]; then
             echo "⚠️ **HIGH RISK**: The following critical files were modified:" >> $GITHUB_STEP_SUMMARY
             echo '```' >> $GITHUB_STEP_SUMMARY
@@ -66,7 +66,7 @@ jobs:
       - name: Dangerous patterns scan
         run: |
           echo "### 🚨 Dangerous Code Patterns" >> $GITHUB_STEP_SUMMARY
-          PATTERNS=$(git diff origin/master...HEAD | grep -E "Command::new\(\"sh\"|Command::new\(\"bash\"|\.env\(\"LD_PRELOAD|\.env\(\"PATH|reqwest::|std::net::|TcpStream|UdpSocket|unsafe \{|\.unwrap\(\) |panic!\(|todo!\(|unimplemented!\(" || true)
+          PATTERNS=$(git diff origin/main...HEAD | grep -E "Command::new\(\"sh\"|Command::new\(\"bash\"|\.env\(\"LD_PRELOAD|\.env\(\"PATH|reqwest::|std::net::|TcpStream|UdpSocket|unsafe \{|\.unwrap\(\) |panic!\(|todo!\(|unimplemented!\(" || true)
           if [ -n "$PATTERNS" ]; then
             echo "⚠️ **Potentially dangerous patterns detected:**" >> $GITHUB_STEP_SUMMARY
             echo '```diff' >> $GITHUB_STEP_SUMMARY
@@ -88,7 +88,7 @@ jobs:
       - name: New dependencies check
         run: |
           echo "### 📚 Dependencies Changes" >> $GITHUB_STEP_SUMMARY
-          if git diff origin/master...HEAD Cargo.toml | grep -E "^\+.*=" | grep -v "^\+\+\+" > new_deps.txt; then
+          if git diff origin/main...HEAD Cargo.toml | grep -E "^\+.*=" | grep -v "^\+\+\+" > new_deps.txt; then
             echo "⚠️ **New dependencies added:**" >> $GITHUB_STEP_SUMMARY
             echo '```toml' >> $GITHUB_STEP_SUMMARY
             cat new_deps.txt >> $GITHUB_STEP_SUMMARY

.github/workflows/validate-docs.yml

@@ -9,7 +9,7 @@ on:
       - '.claude/hooks/*.sh'
   push:
     branches:
-      - master
+      - main
       - feat/**
 
 jobs:

ARCHITECTURE.md

@@ -1483,4 +1483,4 @@ When implementing a new command, consider:
 
 **Last Updated**: 2026-02-22
 **Architecture Version**: 2.2
-**rtk Version**: 0.22.2
+**rtk Version**: 0.22.4