[wilmerdooley]

Resolves #2145.

The rtk hook claude PreToolUse rewriter correctly handles top-level commands and common compound forms (|, ;, &&) but bypasses three runtime-resolved patterns. Result: commands that should be rewritten ship as bare invocations, leaking token savings.

Summary

Test plan

• cargo fmt --all && cargo clippy --all-targets && cargo test
• Manual testing: rtk <command> output inspected

Important: All PRs must target the develop branch (not master).
See CONTRIBUTING.md for details.

[KuSh]

Thank you for this. Both halves target code that has since been replaced: the pipe-tail rewriting in rewrite_compound gave way to the pipeline-safety model merged in #3128 (2026-07-23) and #3343, where only a verified-safe final stage is rewritten and find . | xargs grep TODO is asserted to stay raw, and the hook_cmd::get_rewritten function the subshell handling hooks into was removed by #3955 (2026-09-11) when every hook moved onto the shared decision in src/hooks/decision.rs. There is no way to rebase this as written, so I am closing it. The gaps are still real: xargs targets are not rewritten, and commands inside $(...) or backticks are deliberately deferred because the lexer treats substitutions as unattestable, so #1252 is the right place to argue for relaxing that, and a narrow PR teaching the pipeline-safety model about xargs would be welcome. Please comment or reopen if I have missed something here.