[xiaozou-second]

Summary

• rtk init (install and upgrade) and rtk verify now print a stderr warning
  for any Bash(...) allow rule that grants every rtk … command — e.g.
  Bash(rtk:*) reads as "rtk's own commands" but also auto-allows
  rtk git push, which the user never allowed on its own. Closes Warn when a Bash(rtk:*) allow rule is present #4649.
• The predicate asks the existing matcher (command_matches_pattern) against
  rtk gain, rtk git push and rtk cargo test rather than re-deriving
  wildcard semantics, so Bash(rtk), Bash(rtk*:*) and Bash(*rtk*) are
  caught while Bash(rtk git:*) and Bash(rtk git push) are not. Bash(*)
  stays unflagged: not rtk-specific, and the "narrow it" advice would mislead.
• Fires from the end of the Commands::Init arm, so the per-agent branches
  warn too; the hook path and rtk verify --filter stay silent.

Test plan

• cargo fmt --all && cargo clippy --all-targets && cargo test

• Manual testing: rtk <command> output inspected

• New tests/broad_rtk_allow_warning_test.rs: init / init -g --gemini /
  verify warn; Bash(rtk git push), Bash(rtk git:*), Bash(*rtk),
  Bash(*) stay silent; Bash(rtk) warns; hook path and verify --filter
  silent with a positive control and exit-status check; repeated rule warns
  once.

• Manual, temp CLAUDE_CONFIG_DIR: verify, init -g and init -g --gemini
  each warn for Bash(rtk:*) and Bash(rtk), silent for Bash(rtk git push),
  Read(rtk:*) and Bash(*); --dry-run, --show, verify --filter cargo
  and hook claude warn nothing.

[CLAassistant]

All committers have signed the CLA.

[rtk-wshm-sync-bot]

wshm · Automated triage by AI

📊 Automated PR Analysis

✨ Type	feature
🟢 Risk	low

Summary

Adds a stderr warning emitted during rtk init and rtk verify when a Claude Code settings file contains a Bash allow rule that broadly matches every 'rtk ...' command (e.g. Bash(rtk:*)), since such rules also auto-allow underlying commands like rtk git push that the user never explicitly allowed. The check reuses the existing command_matches_pattern matcher against three probe commands to distinguish broad rules from legitimately narrow ones, and excludes the hook execution path and verify --fil…

Review Checklist

• Tests present
• Breaking change
• Docs updated

Linked issues: #4649

---

Analyzed automatically by wshm · This is an automated analysis, not a human review.