pi-rtk-optimizer 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.1] - 2026-05-04
+
+### Changed
+- Clarified the README architecture inventory for delegated `rtk rewrite` ownership and documented Bun as a development verification prerequisite.
+- Pinned TypeScript and esbuild as dev dependencies so build and bundle checks use locked local tooling.
+- Added RTK executable path visibility to runtime verification output and documented audit/debug config expectations.
+
+### Fixed
+- Hardened `RTK_DB_PATH` shell quoting against inherited temp paths containing command-substitution syntax.
+- Made the custom test helper await async tests before reporting pass.
+- Preserved RTK rewrite error details through the extension's existing UI warning path.
+- Expanded Windows command and rewritten-pipeline fixups for leading compound-command cases.
+- Normalized compaction technique return handling while preserving existing output behavior.
+- Added lifecycle and vendored modal regression coverage for high-risk extension event paths.
+
 ## [0.7.0] - 2026-04-30
 
 ### Added
@@ -14,7 +29,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 - Updated README and example configuration defaults for safer read-compaction behavior and troubleshooting guidance.
-- Updated `@mariozechner/pi-coding-agent` and `@mariozechner/pi-tui` peer dependencies to ^0.70.6.
+- Updated `@mariozechner/pi-coding-agent` and `@mariozechner/pi-tui` peer dependencies to ^0.72.0.
 
 ## [0.6.0] - 2026-04-27
 

package/README.md

@@ -16,6 +16,7 @@
 - **Automatic rewriting** or **suggestion-only** mode for common development workflows
 - Delegates bash command rewrite decisions to the installed `rtk rewrite` command, keeping RTK as the source of truth for supported commands, shell parsing, bypasses, and compound-command behavior
 - Runtime guard when `rtk` binary is unavailable (raw commands run unchanged and repeated missing-binary rewrite probes are avoided)
+- `/rtk show` and `/rtk verify` surface the resolved `rtk` executable path when the host can resolve it
 - Pi-specific shell safety fixups for rewritten commands on Windows
 
 ### Output Compaction Pipeline
@@ -107,6 +108,8 @@ Actual global path: $PI_CODING_AGENT_DIR/extensions/pi-rtk-optimizer/config.json
 
 A starter template is included at `config/config.example.json`.
 
+For audit or debugging sessions, keep `showRewriteNotifications` enabled and disable lossy `read` compaction/source filtering before gathering evidence. Existing `config.json` files are user-owned runtime state; do not overwrite local choices unless you intentionally want to change live extension behavior.
+
 ### Configuration Options
 
 #### Top-Level Settings
@@ -207,9 +210,8 @@ src/
 ├── index.ts                # Extension bootstrap and event wiring
 ├── config-store.ts         # Config load/save with normalization
 ├── config-modal.ts         # TUI settings modal and /rtk handler
-├── command-rewriter.ts         # Command tokenization and rewrite logic
-├── rewrite-bypass.ts           # Rewrite safety bypass rules for interactive/structured commands
-├── rewrite-rules.ts            # Rewrite rule catalog
+├── command-rewriter.ts         # Command rewrite decision adapter for RTK delegation
+├── rtk-rewrite-provider.ts     # Calls `rtk rewrite` as the rewrite source of truth
 ├── rewrite-pipeline-safety.ts  # Shell-safety fixups for rewritten commands
 ├── rtk-command-environment.ts  # RTK_DB_PATH scoping for rewritten commands
 ├── shell-env-prefix.ts         # Environment assignment parsing helpers
@@ -252,17 +254,18 @@ Automatic fixes applied on Windows:
 
 - **Peer dependencies:** `@mariozechner/pi-coding-agent`, `@mariozechner/pi-tui`
 - **Runtime:** Node.js ≥20, optional `rtk` binary for command rewriting
+- **Development verification:** Node.js ≥20, npm, and Bun for the test scripts
 
 ## Development
 
 ```bash
-# Build
+# Transpile-only TypeScript build check
 npm run build
 
 # Full typecheck
 npm run typecheck
 
-# Run tests
+# Run Bun-based tests
 npm run test
 
 # Full verification

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-rtk-optimizer",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Pi extension that optimizes RTK command rewriting and tool output compaction for the coding agent.",
   "type": "module",
   "main": "./index.ts",
@@ -16,12 +16,11 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "npx --yes -p typescript@5.7.3 tsc -p tsconfig.json --noCheck",
-    "lint": "npm run build",
-    "typecheck": "npx --yes -p typescript@5.7.3 tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.json --noCheck",
+    "typecheck": "tsc -p tsconfig.json",
     "test": "bun ./src/output-compactor-test.ts && bun ./src/command-rewriter-test.ts && bun ./src/runtime-guard-test.ts && bun ./src/additional-coverage-test.ts && bun ./src/config-modal-test.ts && bun ./src/index-test.ts",
-    "check": "npm run lint && npm run typecheck && npm run test",
-    "build:check": "bunx esbuild ./index.ts --bundle --platform=node --format=esm --outfile=./.pi-rtk-optimizer-check.mjs --external:@mariozechner/pi-coding-agent --external:@mariozechner/pi-tui && bun -e \"import { unlinkSync } from 'node:fs'; unlinkSync('./.pi-rtk-optimizer-check.mjs');\""
+    "check": "npm run typecheck && npm run test && npm run build:check",
+    "build:check": "esbuild ./index.ts --bundle --platform=node --format=esm --outfile=./.pi-rtk-optimizer-check.mjs --external:@mariozechner/pi-coding-agent --external:@mariozechner/pi-tui && node -e \"import { unlinkSync } from 'node:fs'; unlinkSync('./.pi-rtk-optimizer-check.mjs');\""
   },
   "keywords": [
     "pi-package",
@@ -52,13 +51,17 @@
   "publishConfig": {
     "access": "public"
   },
+  "devDependencies": {
+    "esbuild": "0.28.0",
+    "typescript": "5.7.3"
+  },
   "pi": {
     "extensions": [
       "./index.ts"
     ]
   },
   "peerDependencies": {
-    "@mariozechner/pi-coding-agent": "^0.70.6",
-    "@mariozechner/pi-tui": "^0.70.6"
+    "@mariozechner/pi-coding-agent": "^0.72.0",
+    "@mariozechner/pi-tui": "^0.72.0"
   }
 }

package/src/additional-coverage-test.ts

@@ -172,10 +172,36 @@ runTest("RTK command environment preserves explicit leading RTK_DB_PATH override
 	const command = 'RTK_DB_PATH="/custom/history.db" rtk git diff';
 	assert.equal(applyRtkCommandEnvironment(command), command);
 
+	const singleQuotedCommand = "RTK_DB_PATH='/custom/it'\\''s/history.db' rtk git diff";
+	assert.equal(applyRtkCommandEnvironment(singleQuotedCommand), singleQuotedCommand);
+
 	const exportedCommand = 'export RTK_DB_PATH="/custom/history.db"; rtk git diff';
 	assert.equal(applyRtkCommandEnvironment(exportedCommand), exportedCommand);
 });
 
+runTest("RTK command environment single-quotes hostile temp paths", () => {
+	const previousTmpDir = process.env.TMPDIR;
+	const previousTmp = process.env.TMP;
+	const previousTemp = process.env.TEMP;
+	const hostilePath = process.platform === "win32" ? "C:\\Temp\\$(touch owned)`bad`'dir" : "/tmp/$(touch owned)`bad`'dir";
+
+	try {
+		process.env.TMPDIR = hostilePath;
+		process.env.TMP = hostilePath;
+		process.env.TEMP = hostilePath;
+
+		const rewritten = applyRtkCommandEnvironment("rtk git status");
+		assert.ok(rewritten.startsWith("export RTK_DB_PATH='"));
+		assert.ok(rewritten.includes("$(touch owned)`bad`'\\''dir"));
+		assert.ok(rewritten.endsWith("; rtk git status"));
+		assert.equal(/^export RTK_DB_PATH=\"/.test(rewritten), false);
+	} finally {
+		process.env.TMPDIR = previousTmpDir;
+		process.env.TMP = previousTmp;
+		process.env.TEMP = previousTemp;
+	}
+});
+
 runTest("path compaction preserves the tail and handles Windows separators", () => {
 	const unixPath = "/Users/example/projects/pi-rtk-optimizer/src/techniques/path-utils.ts";
 	const compactUnixPath = compactPath(unixPath, 28);
@@ -194,72 +220,93 @@ runTest("path compaction preserves the tail and handles Windows separators", ()
 
 runTest("windows bash compatibility rewrites only when the runtime is Windows", () => {
 	const command = "cd /d C:\\Users\\Administrator\\project && python script.py";
-	const fixed = applyWindowsBashCompatibilityFixes(command);
+	const fixed = applyWindowsBashCompatibilityFixes(command, "win32");
+	assert.deepEqual(fixed.applied, ["cd-/d", "python-utf8"]);
+	assert.equal(
+		fixed.command,
+		'PYTHONIOENCODING=utf-8 cd "C:/Users/Administrator/project" && python script.py',
+	);
 
-	if (process.platform === "win32") {
-		assert.deepEqual(fixed.applied, ["cd-/d", "python-utf8"]);
-		assert.equal(
-			fixed.command,
-			'PYTHONIOENCODING=utf-8 cd "C:/Users/Administrator/project" && python script.py',
-		);
+	const unchanged = applyWindowsBashCompatibilityFixes(command, "linux");
+	assert.deepEqual(unchanged.applied, []);
+	assert.equal(unchanged.command, command);
 
-		const alreadyUtf8 = applyWindowsBashCompatibilityFixes("PYTHONIOENCODING=utf-8 python script.py");
-		assert.deepEqual(alreadyUtf8.applied, []);
-		assert.equal(alreadyUtf8.command, "PYTHONIOENCODING=utf-8 python script.py");
-	} else {
-		assert.deepEqual(fixed.applied, []);
-		assert.equal(fixed.command, command);
-	}
+	const alreadyUtf8 = applyWindowsBashCompatibilityFixes("PYTHONIOENCODING=utf-8 python script.py", "win32");
+	assert.deepEqual(alreadyUtf8.applied, []);
+	assert.equal(alreadyUtf8.command, "PYTHONIOENCODING=utf-8 python script.py");
+});
+
+runTest("windows bash compatibility rewrites compound cd slash-d operators", () => {
+	assert.equal(
+		applyWindowsBashCompatibilityFixes("cd /d C:\\work || echo failed", "win32").command,
+		'cd "C:/work" || echo failed',
+	);
+	assert.equal(
+		applyWindowsBashCompatibilityFixes("cd /d C:\\work ; echo done", "win32").command,
+		'cd "C:/work" ; echo done',
+	);
+	assert.equal(
+		applyWindowsBashCompatibilityFixes("cd /d C:\\work | cat", "win32").command,
+		'cd "C:/work" | cat',
+	);
+	assert.equal(
+		applyWindowsBashCompatibilityFixes('cd /d "C:\\work space" || echo failed', "win32").command,
+		'cd "C:/work space" || echo failed',
+	);
 });
 
 runTest("rewrite pipeline safety buffers rewritten Windows producer commands", () => {
-	const rewritten = applyRewrittenCommandShellSafetyFixups("rtk git diff | grep TODO");
-
-	if (process.platform === "win32") {
-		assert.ok(rewritten.includes('mktemp'));
-		assert.ok(rewritten.includes('trap'));
-		assert.ok(rewritten.includes('rtk git diff > "$__pi_rtk_pipe_tmp"'));
-		assert.ok(rewritten.includes('(grep TODO) < "$__pi_rtk_pipe_tmp"'));
-	} else {
-		assert.equal(rewritten, "rtk git diff | grep TODO");
-	}
+	const rewritten = applyRewrittenCommandShellSafetyFixups("rtk git diff | grep TODO", "win32");
+	assert.ok(rewritten.includes('mktemp'));
+	assert.ok(rewritten.includes('trap'));
+	assert.ok(rewritten.includes('rtk git diff > "$__pi_rtk_pipe_tmp"'));
+	assert.ok(rewritten.includes('(grep TODO) < "$__pi_rtk_pipe_tmp"'));
+
+	assert.equal(
+		applyRewrittenCommandShellSafetyFixups("rtk git diff | grep TODO", "linux"),
+		"rtk git diff | grep TODO",
+	);
+	assert.equal(applyRewrittenCommandShellSafetyFixups("git diff | grep TODO", "win32"), "git diff | grep TODO");
+});
+
+runTest("rewrite pipeline safety buffers leading pipelines before compound suffixes", () => {
+	const andCommand = applyRewrittenCommandShellSafetyFixups("rtk git diff | grep TODO && echo done", "win32");
+	assert.ok(andCommand.includes('(grep TODO) < "$__pi_rtk_pipe_tmp"'));
+	assert.ok(andCommand.endsWith("&& echo done"));
+
+	const orCommand = applyRewrittenCommandShellSafetyFixups("rtk git diff | grep TODO || echo none", "win32");
+	assert.ok(orCommand.includes('(grep TODO) < "$__pi_rtk_pipe_tmp"'));
+	assert.ok(orCommand.endsWith("|| echo none"));
 
-	assert.equal(applyRewrittenCommandShellSafetyFixups("git diff | grep TODO"), "git diff | grep TODO");
+	const semicolonCommand = applyRewrittenCommandShellSafetyFixups("rtk git diff | grep TODO; echo done", "win32");
+	assert.ok(semicolonCommand.includes('(grep TODO) < "$__pi_rtk_pipe_tmp"'));
+	assert.ok(semicolonCommand.endsWith("; echo done"));
 });
 
 runTest("rewrite pipeline safety keeps exported RTK_DB_PATH on rewritten producer commands", () => {
-	const rewritten = applyRewrittenCommandShellSafetyFixups(
-		applyRtkCommandEnvironment("rtk git diff agent/extensions/pi-multi-auth/account-manager.ts | head -200"),
+	const envScopedCommand = applyRtkCommandEnvironment("rtk git diff agent/extensions/pi-multi-auth/account-manager.ts | head -200");
+	const rewritten = applyRewrittenCommandShellSafetyFixups(envScopedCommand, "win32");
+
+	assert.ok(rewritten.startsWith("export RTK_DB_PATH="));
+	assert.equal(rewritten.startsWith("RTK_DB_PATH="), false);
+	assert.ok(rewritten.includes("; {"));
+	assert.ok(
+		rewritten.includes('rtk git diff agent/extensions/pi-multi-auth/account-manager.ts > "$__pi_rtk_pipe_tmp"'),
 	);
+	assert.ok(rewritten.includes('(head -200) < "$__pi_rtk_pipe_tmp"'));
 
-	if (process.platform === "win32") {
-		assert.ok(rewritten.startsWith("export RTK_DB_PATH="));
-		assert.equal(rewritten.startsWith("RTK_DB_PATH="), false);
-		assert.ok(rewritten.includes("; {"));
-		assert.ok(
-			rewritten.includes('rtk git diff agent/extensions/pi-multi-auth/account-manager.ts > "$__pi_rtk_pipe_tmp"'),
-		);
-		assert.ok(rewritten.includes('(head -200) < "$__pi_rtk_pipe_tmp"'));
-	} else {
-		assert.ok(rewritten.startsWith("export RTK_DB_PATH="));
-		assert.equal(
-			rewritten,
-			applyRtkCommandEnvironment("rtk git diff agent/extensions/pi-multi-auth/account-manager.ts | head -200"),
-		);
-	}
+	assert.equal(applyRewrittenCommandShellSafetyFixups(envScopedCommand, "linux"), envScopedCommand);
 });
 
 runTest("rewrite pipeline safety buffers explicit RTK_DB_PATH export preludes", () => {
 	const command = 'export RTK_DB_PATH="/custom/history.db"; rtk git diff | head -200';
-	const rewritten = applyRewrittenCommandShellSafetyFixups(command);
-
-	if (process.platform === "win32") {
-		assert.ok(rewritten.startsWith('export RTK_DB_PATH="/custom/history.db"; {'));
-		assert.ok(rewritten.includes('rtk git diff > "$__pi_rtk_pipe_tmp"'));
-		assert.ok(rewritten.includes('(head -200) < "$__pi_rtk_pipe_tmp"'));
-	} else {
-		assert.equal(rewritten, command);
-	}
+	const rewritten = applyRewrittenCommandShellSafetyFixups(command, "win32");
+
+	assert.ok(rewritten.startsWith('export RTK_DB_PATH="/custom/history.db"; {'));
+	assert.ok(rewritten.includes('rtk git diff > "$__pi_rtk_pipe_tmp"'));
+	assert.ok(rewritten.includes('(head -200) < "$__pi_rtk_pipe_tmp"'));
+
+	assert.equal(applyRewrittenCommandShellSafetyFixups(command, "linux"), command);
 });
 
 runTest("RTK command environment uses export prelude for shell compound commands", () => {
@@ -315,11 +362,16 @@ runTest("streaming sanitizer strips hook notices, sanitizes emoji output, and pr
 			},
 		],
 	};
-	assert.equal(sanitizeStreamingBashExecutionResult(hookNoticeResult, "rtk git status"), true);
+	const hookNoticeSanitization = sanitizeStreamingBashExecutionResult(hookNoticeResult, "rtk git status");
+	assert.equal(hookNoticeSanitization.changed, true);
 	assert.equal(
-		(hookNoticeResult.content[0] as { text: string }).text,
+		((hookNoticeSanitization.result as typeof hookNoticeResult).content[0] as { text: string }).text,
 		"working tree clean\n",
 	);
+	assert.equal(
+		(hookNoticeResult.content[0] as { text: string }).text,
+		"[rtk] /!\\ No hook installed — run `rtk init -g` for automatic token savings\n\nworking tree clean\n",
+	);
 
 	const emojiResult = {
 		content: [
@@ -327,9 +379,14 @@ runTest("streaming sanitizer strips hook notices, sanitizes emoji output, and pr
 			{ type: "image", url: "ignored" },
 		],
 	};
-	assert.equal(sanitizeStreamingBashExecutionResult(emojiResult, "rtk git diff -- src/file.ts"), true);
-	assert.equal((emojiResult.content[0] as { text: string }).text, "> src/file.ts\n[OK] Files are identical\n");
-	assert.deepEqual(emojiResult.content[1], { type: "image", url: "ignored" });
+	const emojiSanitization = sanitizeStreamingBashExecutionResult(emojiResult, "rtk git diff -- src/file.ts");
+	assert.equal(emojiSanitization.changed, true);
+	assert.equal(
+		((emojiSanitization.result as typeof emojiResult).content[0] as { text: string }).text,
+		"> src/file.ts\n[OK] Files are identical\n",
+	);
+	assert.equal((emojiResult.content[0] as { text: string }).text, "📄 src/file.ts\n✅ Files are identical\n");
+	assert.deepEqual((emojiSanitization.result as typeof emojiResult).content[1], { type: "image", url: "ignored" });
 
 	const parseWarningResult = {
 		content: [
@@ -339,7 +396,9 @@ runTest("streaming sanitizer strips hook notices, sanitizes emoji output, and pr
 			},
 		],
 	};
-	assert.equal(sanitizeStreamingBashExecutionResult(parseWarningResult, "rtk git status"), false);
+	const parseWarningSanitization = sanitizeStreamingBashExecutionResult(parseWarningResult, "rtk git status");
+	assert.equal(parseWarningSanitization.changed, false);
+	assert.equal(parseWarningSanitization.result, parseWarningResult);
 	assert.equal(
 		(parseWarningResult.content[0] as { text: string }).text,
 		"[rtk] warning: builtin filters: parse failure\n\nworking tree clean\n",