feat(mvn): add rtk mvnd support for Maven Daemon

Closes rtk-ai#3184.

mvnd is a separate binary, not a mvn wrapper, so it gets its own
`rtk mvnd` entry point rather than folding into `rtk mvn`: a user who
typed `mvnd` must get the daemon, never `mvn` or a `./mvnw` wrapper
that happens to sit in the working directory.

Everything downstream is shared — phase detection and all four filters
are reused unchanged. mvnd's rolling/parallel console UI only engages
on a TTY, so the output rtk captures is plain Maven output; daemon
status chatter carries no [INFO]/[ERROR] prefix and is already dropped
by the existing keep-lists.

- src/main.rs: `Commands::Mvnd` -> `mvn_cmd::run_daemon`
- src/cmds/jvm/mvn_cmd.rs: thread a `daemon` flag through binary
  selection; `run`/`run_daemon` share `run_tool`
- src/discover/rules.rs: rewrite rule so the hook maps `mvnd <goal>`
  to `rtk mvnd <goal>` (the `mvn\b` pattern never matched `mvnd`)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: kylehgc

src/cmds/jvm/README.md

@@ -5,7 +5,7 @@ Filters for JVM-based build tools.
 | Module           | Tool(s)                              | Modes                                                                                  |
 |------------------|--------------------------------------|----------------------------------------------------------------------------------------|
 | `gradlew_cmd.rs` | `./gradlew`, `gradlew.bat`, `gradle` | Build / Test / ConnectedTest / Lint / Dependencies — streaming line filter + passthrough |
-| `mvn_cmd.rs`     | `mvn`, `./mvnw`, `mvnw.cmd`          | Test / Compile / Package / Passthrough — buffered single-pass filter per phase           |
+| `mvn_cmd.rs`     | `mvn`, `./mvnw`, `mvnw.cmd`, `mvnd`  | Test / Compile / Package / Passthrough — buffered single-pass filter per phase           |
 
 ## Maven (`mvn_cmd.rs`)
 
@@ -28,14 +28,15 @@ Key behaviours:
 - **`<<< ERROR!` markers** — per-test sublines use `<<< ERROR!` for thrown (non-assertion) exceptions; the close-line regex also tolerates an `ERROR!` marker defensively (Surefire 3.5.5 emits `FAILURE!` even for errors-only classes — failure detection keys off the `Failures`/`Errors` counts, not the marker).
 - **Help-boilerplate stripping (all modes)** — the post-failure block Maven emits after `[ERROR] Failed to execute goal` (`See …`, `-> [Help 1]`, `Re-run Maven`, `To see the full stack trace`, `For more information`, help URLs, bare `[ERROR]` dividers) is dropped in quiet *and* non-quiet filters alike (shared `BOILER_PREFIXES`). Deliberately kept as signal: `Failed to execute goal` itself and the multi-module resume hint (`[ERROR] After correcting the problems…` + `[ERROR]   mvn <args> -rf :module` — tells the user/agent how to resume the build). Real durations (`Time elapsed: … s`, `Total time: …`) ship untouched — the numbers are diagnostic signal.
 - **Wrapper detection** — `./mvnw` (POSIX) and `mvnw.cmd` (Windows) detected via string-literal `Command::new` (semgrep-safe); falls back to `resolved_command("mvn")`.
+- **Maven Daemon (`rtk mvnd`)** — `mvnd` is a separate entry point (`run_daemon`), not a `mvn` alias: it shares phase detection and every filter, but always executes `mvnd` and is never substituted by a `./mvnw` wrapper found in the working directory. Its rolling/parallel console UI only engages on a TTY, so the captured output rtk filters is plain Maven output. Daemon status chatter (`Connecting to daemon`, …) carries no `[INFO]`/`[ERROR]` prefix and is dropped by the existing keep-lists.
 - **Reactor Summary preservation** — for multi-module builds, the trailing `Reactor Summary for <root>` block with per-module SUCCESS/FAILURE rows is kept (toggled by a `[INFO] Reactor Summary for ` header and cleared on `BUILD SUCCESS` / `BUILD FAILURE`).
 - **Failure cap** — both the count of emitted failing test classes and the size of the `[ERROR] Failures:` summary block are bounded by `MAX_MVN_FAILING_CLASSES = CAP_WARNINGS` (the shared test-failure cap class from `src/core/truncate.rs`, same binding as pytest/rspec/rake/runner). Excess emissions are replaced by a single `… +N more failing test classes` / `… +N more failures` tail (canonical `join_with_overflow` shape) to keep large failure sets compact; the raw output stays recoverable via the tee `[full output: …]` hint. Per the core cap policy, a cap of `0` means summary-only: no blocks emitted, the tail still counts every dropped class.
 
 Token-savings tests run inline as part of `cargo test --all` and verify ≥90% savings for `mvn test` and ≥85% for `mvn install` on full synthetic fixtures (gzipped, ~1100 lines each). The `flate2` dependency (already in `Cargo.toml`) decompresses the ~3 KB gzipped fixtures in milliseconds.
 
 ### Integrity-check whitelist
 
-`Commands::Mvn` is intentionally omitted from `is_operational_command` in `src/main.rs`, matching the gradle precedent (`Commands::Gradlew` also omitted). The whitelist guards SHA-256 hook-integrity verification; filter modules invoked through an already-verified hook do not need a second check on their own dispatch path. Per the comment above the function, the whitelist is opt-in by design and a forgotten command fails open rather than creating false confidence about what's protected.
+`Commands::Mvn` and `Commands::Mvnd` are intentionally omitted from `is_operational_command` in `src/main.rs`, matching the gradle precedent (`Commands::Gradlew` also omitted). The whitelist guards SHA-256 hook-integrity verification; filter modules invoked through an already-verified hook do not need a second check on their own dispatch path. Per the comment above the function, the whitelist is opt-in by design and a forgotten command fails open rather than creating false confidence about what's protected.
 
 ## Gradle (`gradlew_cmd.rs`)
 

src/cmds/jvm/mvn_cmd.rs

@@ -871,8 +871,12 @@ pub fn filter_quiet(raw: &str) -> String {
 
 // ── Wrapper detection ───────────────────────────────────────────────────────
 
-fn mvn_binary() -> &'static str {
-    if cfg!(windows) {
+/// Maven Daemon (`mvnd`) has no project-local wrapper of its own, so it is
+/// never substituted by `./mvnw`: the user asked for the daemon explicitly.
+fn mvn_binary(daemon: bool) -> &'static str {
+    if daemon {
+        "mvnd"
+    } else if cfg!(windows) {
         if Path::new(".\\mvnw.cmd").exists() {
             ".\\mvnw.cmd"
         } else {
@@ -885,8 +889,10 @@ fn mvn_binary() -> &'static str {
     }
 }
 
-fn new_mvn_command(args: &[String]) -> Command {
-    let mut cmd = if cfg!(windows) {
+fn new_mvn_command(args: &[String], daemon: bool) -> Command {
+    let mut cmd = if daemon {
+        resolved_command("mvnd")
+    } else if cfg!(windows) {
         if Path::new(".\\mvnw.cmd").exists() {
             Command::new(".\\mvnw.cmd")
         } else {
@@ -904,16 +910,27 @@ fn new_mvn_command(args: &[String]) -> Command {
 // ── Entry point ─────────────────────────────────────────────────────────────
 
 pub fn run(args: &[String], verbose: u8) -> Result<i32> {
+    run_tool(args, false, verbose)
+}
+
+/// `rtk mvnd` — Maven Daemon. Non-interactive `mvnd` output is plain Maven
+/// output (the rolling console UI only engages on a TTY), so the same phase
+/// detection and filters apply; only the executed binary differs.
+pub fn run_daemon(args: &[String], verbose: u8) -> Result<i32> {
+    run_tool(args, true, verbose)
+}
+
+fn run_tool(args: &[String], daemon: bool, verbose: u8) -> Result<i32> {
     // Verbose flags bypass filtering — user wants full output.
     if args
         .iter()
         .any(|a| matches!(a.as_str(), "-X" | "--debug" | "-e" | "--errors"))
     {
         let osargs: Vec<OsString> = args.iter().map(OsString::from).collect();
-        return runner::run_passthrough(mvn_binary(), &osargs, verbose);
+        return runner::run_passthrough(mvn_binary(daemon), &osargs, verbose);
     }
 
-    let tool = mvn_binary();
+    let tool = mvn_binary(daemon);
     let args_display = args.join(" ");
 
     // Quiet mode: standard footer guard can't fire (no `BUILD SUCCESS` line
@@ -926,7 +943,7 @@ pub fn run(args: &[String], verbose: u8) -> Result<i32> {
             return runner::run_passthrough(tool, &osargs, verbose);
         }
         return runner::run_filtered(
-            new_mvn_command(args),
+            new_mvn_command(args, daemon),
             tool,
             &args_display,
             filter_quiet,
@@ -938,21 +955,21 @@ pub fn run(args: &[String], verbose: u8) -> Result<i32> {
 
     match phase {
         MvnPhase::Test => runner::run_filtered(
-            new_mvn_command(args),
+            new_mvn_command(args, daemon),
             tool,
             &args_display,
             filter_surefire,
             RunOptions::with_tee("mvn_test"),
         ),
         MvnPhase::Compile => runner::run_filtered(
-            new_mvn_command(args),
+            new_mvn_command(args, daemon),
             tool,
             &args_display,
             filter_compile,
             RunOptions::with_tee("mvn_compile"),
         ),
         MvnPhase::Package => runner::run_filtered(
-            new_mvn_command(args),
+            new_mvn_command(args, daemon),
             tool,
             &args_display,
             filter_package,
@@ -1071,6 +1088,20 @@ mod tests {
         assert_eq!(detect_phase(&s(["--help"])), MvnPhase::Passthrough);
     }
 
+    // ── Binary selection ─────────────────────────────────────────────────────
+
+    /// rtk-ai/rtk#3184 — the daemon is never swapped for `mvn`/`./mvnw`,
+    /// whatever wrapper happens to sit in the working directory.
+    #[test]
+    fn mvnd_binary_is_never_the_wrapper() {
+        assert_eq!(mvn_binary(true), "mvnd");
+    }
+
+    #[test]
+    fn mvn_binary_without_daemon_is_not_mvnd() {
+        assert_ne!(mvn_binary(false), "mvnd");
+    }
+
     // ── Surefire filter ──────────────────────────────────────────────────────
 
     #[test]

src/discover/registry.rs

@@ -3907,6 +3907,27 @@ mod tests {
         );
     }
 
+    /// rtk-ai/rtk#3184 — `mvnd` must route to `rtk mvnd`, never `rtk mvn`,
+    /// so the daemon binary is the one that actually runs.
+    #[test]
+    fn test_rewrite_mvnd_clean_install() {
+        assert_eq!(
+            rewrite_command_no_prefixes("mvnd clean install", &[]),
+            Some("rtk mvnd clean install".into())
+        );
+    }
+
+    #[test]
+    fn test_classify_mvnd_test() {
+        assert!(matches!(
+            classify_command("mvnd test"),
+            Classification::Supported {
+                rtk_equivalent: "rtk mvnd",
+                ..
+            }
+        ));
+    }
+
     // --- Compound operator edge cases ---
 
     #[test]

src/discover/rules.rs

@@ -879,6 +879,18 @@ pub const RULES: &[RtkRule] = &[
         subcmd_savings: &[],
         subcmd_status: &[],
     },
+    RtkRule {
+        // `mvnd` is a separate binary, not a `mvn` wrapper — it must keep its
+        // own rtk_cmd so the daemon is what actually runs.
+        pattern: r"^mvnd\b(?:\s+\S+)*?\s+(compile|test|integration-test|package|install|verify|deploy)\b",
+        rtk_cmd: "rtk mvnd",
+        pipeline_final_safe: false,
+        rewrite_prefixes: &["mvnd"],
+        category: "Build",
+        savings_pct: 82.0,
+        subcmd_savings: &[],
+        subcmd_status: &[],
+    },
     RtkRule {
         pattern: r"^ping\b",
         rtk_cmd: "rtk ping",

src/main.rs

@@ -825,6 +825,14 @@ enum Commands {
         args: Vec<String>,
     },
 
+    /// Maven Daemon (mvnd) with compact output — same filters as `rtk mvn`
+    #[command(name = "mvnd")]
+    Mvnd {
+        /// Maven goals and arguments (e.g., clean install, -DskipTests test, -X)
+        #[arg(trailing_var_arg = true, allow_hyphen_values = true)]
+        args: Vec<String>,
+    },
+
     /// Show hook rewrite audit metrics (requires RTK_HOOK_AUDIT=1)
     #[command(name = "hook-audit")]
     HookAudit {
@@ -2422,6 +2430,8 @@ fn run_cli() -> Result<i32> {
 
         Commands::Mvn { args } => mvn_cmd::run(&args, cli.verbose)?,
 
+        Commands::Mvnd { args } => mvn_cmd::run_daemon(&args, cli.verbose)?,
+
         Commands::HookAudit { since } => {
             hooks::hook_audit_cmd::run(since, cli.verbose)?;
             0
@@ -3154,6 +3164,7 @@ mod tests {
             "golangci-lint",
             "gradlew",
             "mvn",
+            "mvnd",
             "sbt",
             "php",
             "phpunit",