fix: guard invalid RTK hook suggestions

Author: LK4D4

docs/DEVELOPMENT.md

@@ -103,15 +103,21 @@ Rewrite action order:
 - Already preferred RTK commands are left alone, such as `rtk git status --short`.
   Invalid `rtk read` forms with invented window flags such as `--line`,
   `--lines`, `--range`, `--start-line`, `--start`, `--from`, `--to`, or
-  `--line-number` are denied with `rtk read --help` so agents do not confuse RTK
-  parse fallback errors with a missing `rtk read` command.
+  `--line-number`, plus path range forms like `file.md:35-160`, are denied with
+  `rtk read --help` so agents do not confuse RTK parse fallback errors with a
+  missing `rtk read` command.
+- Invalid `rtk grep` forms that put ripgrep context flags such as `-C N` or
+  `--context N` before the pattern are denied with a corrected suggestion that
+  moves those flags after `--`.
 - Mutating PowerShell commands are left alone, including `Remove-Item`,
   `Set-Content`, `Add-Content`, `New-Item`, `Move-Item`, and `Copy-Item`.
 - Windows/PowerShell and Unix shell reads/searches are handled locally first and
   auto-rewritten only when the hook can preserve semantics.
 - Generic cross-platform tools are delegated to `rtk rewrite`, such as
   `git status --short` to `rtk git status --short` and `ls src` to `rtk ls src`.
   Delegated rewrites stay as deny guidance in the first `updatedInput` release.
+  Raw `git diff -- path...` is left alone because the current RTK git wrapper
+  does not preserve Git pathspec separator behavior for that form.
 - If `rtk rewrite` is unavailable or returns no suggestion, a small local
   fallback preserves legacy suggestions for common noisy tools such as `git`,
   `cargo`, `npm`, `pytest`, `busted`, `luacheck`, `dotnet`, `pnpm`, `pip`, `go`,

src/rewrite.rs

@@ -21,6 +21,7 @@ pub fn action(command: &str) -> Option<HookAction> {
 
     invalid_rtk_read_redirect(command)
         .map(HookAction::DenySuggestion)
+        .or_else(|| invalid_rtk_grep_redirect(command).map(HookAction::DenySuggestion))
         .or_else(|| {
             if starts_with_rtk(command) && preferred_rtk_command(command)
                 || is_preferred_pwsh_wrapper(command)
@@ -96,10 +97,91 @@ fn invalid_rtk_read_redirect(command: &str) -> Option<String> {
                 || token.text.starts_with("--from=")
                 || token.text.starts_with("--to=")
                 || token.text.starts_with("--line-number=")
+                || looks_like_rtk_read_path_range(&token.text)
         })
         .then(|| "rtk read --help".to_string())
 }
 
+fn looks_like_rtk_read_path_range(value: &str) -> bool {
+    let Some((path, range)) = value.rsplit_once(':') else {
+        return false;
+    };
+    !path.is_empty()
+        && path != "."
+        && range.split_once('-').map_or_else(
+            || range.chars().all(|ch| ch.is_ascii_digit()),
+            |(start, end)| {
+                !start.is_empty()
+                    && !end.is_empty()
+                    && start.chars().all(|ch| ch.is_ascii_digit())
+                    && end.chars().all(|ch| ch.is_ascii_digit())
+            },
+        )
+}
+
+fn invalid_rtk_grep_redirect(command: &str) -> Option<String> {
+    let tokens = tokenize(command);
+    if command_name(&tokens.first()?.text) != "rtk" || command_name(&tokens.get(1)?.text) != "grep"
+    {
+        return None;
+    }
+
+    let passthrough_with_values = [
+        "-C",
+        "--context",
+        "-A",
+        "--after-context",
+        "-B",
+        "--before-context",
+    ];
+    let mut rtk_options = Vec::new();
+    let mut passthrough = Vec::new();
+    let mut index = 2;
+    while index < tokens.len() && tokens[index].text.starts_with('-') && tokens[index].text != "--"
+    {
+        let option = tokens[index].text.as_str();
+        if matches!(option, "-n" | "--line-number") {
+            rtk_options.push("-n".to_string());
+            index += 1;
+            continue;
+        }
+        if passthrough_with_values.contains(&option) && index + 1 < tokens.len() {
+            passthrough.push(tokens[index].text.clone());
+            index += 1;
+            passthrough.push(tokens[index].text.clone());
+            index += 1;
+            continue;
+        }
+        return None;
+    }
+
+    if passthrough.is_empty() || index >= tokens.len() || tokens[index].text == "--" {
+        return None;
+    }
+
+    let pattern = &tokens[index].text;
+    let paths = tokens[index + 1..]
+        .iter()
+        .take_while(|token| token.text != "--")
+        .map(|token| token.text.as_str())
+        .collect::<Vec<_>>();
+    if paths.iter().any(|path| path.starts_with('-')) {
+        return None;
+    }
+
+    let mut parts = vec!["rtk".to_string(), "grep".to_string()];
+    parts.extend(rtk_options);
+    parts.push(quote_pattern(pattern));
+    if paths.is_empty() {
+        parts.push(".".to_string());
+    } else {
+        parts.extend(paths.into_iter().map(quote_arg));
+    }
+    parts.push("--".to_string());
+    parts.extend(passthrough.into_iter().map(|arg| quote_arg(&arg)));
+    Some(parts.join(" "))
+}
+
 fn preferred_rtk_command(command: &str) -> bool {
     let tokens = tokenize(command);
     let second = tokens.get(1).map(|token| command_name(&token.text));
@@ -1087,6 +1169,9 @@ fn is_rg_files_command(command: &str) -> bool {
 fn local_rtk_miss_fallback(command: &str) -> Option<String> {
     let tokens = tokenize(command);
     let first = tokens.first().map(|token| command_name(&token.text));
+    if is_git_diff_pathspec_command(command) {
+        return None;
+    }
     match first.as_deref() {
         Some("python") if python_pytest_args(&tokens).is_some() => {
             let args = python_pytest_args(&tokens)?;
@@ -1105,6 +1190,14 @@ fn local_rtk_miss_fallback(command: &str) -> Option<String> {
     }
 }
 
+fn is_git_diff_pathspec_command(command: &str) -> bool {
+    let tokens = tokenize(command);
+    tokens.len() >= 4
+        && command_name(&tokens[0].text) == "git"
+        && tokens.get(1).is_some_and(|token| token.text == "diff")
+        && tokens.iter().skip(2).any(|token| token.text == "--")
+}
+
 fn python_pytest_args(tokens: &[Token]) -> Option<String> {
     if tokens.len() >= 3 && tokens[1].text == "-m" && command_name(&tokens[2].text) == "pytest" {
         Some(join_args(&tokens[3..]))
@@ -1171,7 +1264,7 @@ fn rtk_rewrite(command: &str) -> Option<String> {
 }
 
 fn safe_external_rtk_rewrite(command: &str) -> Option<String> {
-    if blocks_external_posix_rewrite(command) {
+    if blocks_external_posix_rewrite(command) || is_git_diff_pathspec_command(command) {
         return None;
     }
     rtk_rewrite(command)

tests/pretool.rs

@@ -246,6 +246,8 @@ fn invalid_rtk_read_flags_suggest_help() {
         "rtk read src/client/source.lua --line 1 --lines 650",
         "rtk read src/ui.lua --line 1-120",
         "rtk read src/ui.lua --range 130:310",
+        "rtk read docs/notes.md:35-160",
+        "rtk read src/ui.lua:130",
         "rtk read docs/notes.md --start-line 130 --max-lines 60",
         "rtk read docs/notes.md --start-line=130 --max-lines 60",
         "rtk read docs/notes.md --start 130 --max-lines 60",
@@ -282,9 +284,22 @@ fn powershell_mutations_are_noops() {
 fn generic_rtk_rewrite_fallbacks_apply_to_common_tools() {
     assert_deny("git status --short", "rtk git status --short");
     assert_deny("ls src", "rtk ls src");
+    assert_no_output("git diff -- src/rewrite.rs tests/pretool.rs");
     assert_no_output("gh pr view --json title");
 }
 
+#[test]
+fn invalid_rtk_grep_passthrough_flags_are_corrected() {
+    assert_deny(
+        r#"rtk grep -n -C 25 "refreshChapterMenu" suwayomi spec"#,
+        r#"rtk grep -n "refreshChapterMenu" suwayomi spec -- -C 25"#,
+    );
+    assert_deny(
+        r#"rtk grep -n --context 4 "foo|bar" src tests"#,
+        r#"rtk grep -n "foo|bar" src tests -- --context 4"#,
+    );
+}
+
 #[test]
 fn get_content_redirects_to_rtk_read() {
     assert_rewrite(