fix(agent): probe rtk before rewriting commands through it

A bundled rtk can exist but be unexecutable — wrong arch/libc for the
image, or a mac build whose ad-hoc signing failed — and rewriting every
eligible command through it would fail them all, strictly worse than
having no rtk. The rewrite hook now probes `rtk --version` lazily on
the first command it would rewrite, memoized per session: a failed
probe logs once and downgrades the session to no-rewrite. Both hosts
flow through this one seam, so neither adoption site (bin.ts,
auth-adapter) needs its own check, and `rtk gain` already tolerates a
broken binary.

Generated-By: PostHog Code
Task-Id: b86391cc-4634-4a2b-ae34-fe1f9c0626a0

Author: pauldambra

packages/agent/src/adapters/claude/session/rtk.test.ts

@@ -2,7 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import type { HookInput } from "@anthropic-ai/claude-agent-sdk";
-import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { afterAll, beforeAll, describe, expect, test, vi } from "vitest";
 import type { Logger } from "../../../utils/logger";
 import {
   createRtkRewriteHook,
@@ -140,8 +140,10 @@ describe("createRtkRewriteHook", () => {
       tool_input: { command },
     }) as unknown as HookInput;
 
+  const probeYes = () => vi.fn(async () => true);
+
   test("rewrites an eligible Bash command to updatedInput", async () => {
-    const hook = createRtkRewriteHook("rtk", logger);
+    const hook = createRtkRewriteHook("rtk", logger, probeYes());
     const result = await hook(bashInput("git status"), "tool-1", {
       signal: new AbortController().signal,
     });
@@ -154,16 +156,45 @@ describe("createRtkRewriteHook", () => {
     });
   });
 
+  test("passes eligible commands through untouched when the binary fails its probe", async () => {
+    const probe = vi.fn(async () => false);
+    const hook = createRtkRewriteHook("rtk", logger, probe);
+
+    expect(
+      await hook(bashInput("git status"), "tool-1", {
+        signal: new AbortController().signal,
+      }),
+    ).toEqual({ continue: true });
+    expect(
+      await hook(bashInput("ls -la"), "tool-2", {
+        signal: new AbortController().signal,
+      }),
+    ).toEqual({ continue: true });
+  });
+
+  test("probes at most once per session, and only for eligible commands", async () => {
+    const probe = probeYes();
+    const hook = createRtkRewriteHook("rtk", logger, probe);
+    const signal = new AbortController().signal;
+
+    await hook(bashInput("npm test"), "tool-1", { signal });
+    expect(probe).not.toHaveBeenCalled();
+
+    await hook(bashInput("git status"), "tool-2", { signal });
+    await hook(bashInput("ls -la"), "tool-3", { signal });
+    expect(probe).toHaveBeenCalledExactlyOnceWith("rtk");
+  });
+
   test("passes ineligible commands through untouched", async () => {
-    const hook = createRtkRewriteHook("rtk", logger);
+    const hook = createRtkRewriteHook("rtk", logger, probeYes());
     const result = await hook(bashInput("npm test"), "tool-1", {
       signal: new AbortController().signal,
     });
     expect(result).toEqual({ continue: true });
   });
 
   test("ignores non-Bash tools", async () => {
-    const hook = createRtkRewriteHook("rtk", logger);
+    const hook = createRtkRewriteHook("rtk", logger, probeYes());
     const input = {
       session_id: "s",
       transcript_path: "/tmp/t",

packages/agent/src/adapters/claude/session/rtk.ts

@@ -1,5 +1,7 @@
+import { execFile } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { promisify } from "node:util";
 import type { HookCallback, HookInput } from "@anthropic-ai/claude-agent-sdk";
 import type { Logger } from "../../../utils/logger";
 import { gitSubcommand } from "../git-command";
@@ -129,9 +131,32 @@ export function resolveRtkPrefix(env: NodeJS.ProcessEnv): string | undefined {
   return findOnPath("rtk", env);
 }
 
-export const createRtkRewriteHook =
-  (rtkPrefix: string, logger: Logger): HookCallback =>
-  async (input: HookInput, _toolUseID: string | undefined) => {
+/**
+ * Confirms the resolved rtk binary actually runs on this host. A binary can
+ * exist but be unexecutable — wrong arch/libc for the image, or a mac build
+ * whose ad-hoc signing failed — and rewriting every eligible command through
+ * it would fail them all, strictly worse than having no rtk.
+ */
+async function defaultProbeRtk(binary: string): Promise<boolean> {
+  try {
+    await promisify(execFile)(binary, ["--version"], { timeout: 1_500 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export const createRtkRewriteHook = (
+  rtkPrefix: string,
+  logger: Logger,
+  probeRtk: (binary: string) => Promise<boolean> = defaultProbeRtk,
+): HookCallback => {
+  // Probed lazily on the first command that would be rewritten, then memoized
+  // for the session: an unusable binary downgrades to no-rewrite instead of
+  // breaking every eligible command.
+  let usable: Promise<boolean> | null = null;
+
+  return async (input: HookInput, _toolUseID: string | undefined) => {
     if (input.hook_event_name !== "PreToolUse") return { continue: true };
     if (input.tool_name !== "Bash") return { continue: true };
 
@@ -142,6 +167,16 @@ export const createRtkRewriteHook =
     const rewritten = rewriteBashForRtk(command, rtkPrefix);
     if (!rewritten) return { continue: true };
 
+    usable ??= probeRtk(rtkPrefix).then((ok) => {
+      if (!ok) {
+        logger.warn(
+          `[RtkRewriteHook] ${rtkPrefix} failed its --version probe; disabling command rewriting for this session`,
+        );
+      }
+      return ok;
+    });
+    if (!(await usable)) return { continue: true };
+
     logger.info(`[RtkRewriteHook] Rewriting: ${command} → ${rewritten}`);
     return {
       continue: true,
@@ -151,3 +186,4 @@ export const createRtkRewriteHook =
       },
     };
   };
+};