Silent output corruption when stdout is piped or redirected (suggest isatty passthrough)

[panwudi]

Summary

When rtk rewrites a command (e.g. grep, find, ls) and the output is piped into another program or redirected to a file, the compressed human-readable format silently corrupts the downstream consumer. The caller usually has no way to detect this until a downstream assertion fails.

We suggest RTK follow the same convention as ls --color=auto, git diff, grep --color=auto, etc.: check isatty(stdout) at runtime, and fall back to raw passthrough whenever stdout is not a TTY (pipe, redirect, or process substitution).

Reproduction

Environment: rtk 0.36.0, Claude Code PreToolUse hook (rtk-rewrite.sh v3), Linux.

# A file with exactly 83 lines matching the pattern                                                                                                                                                                                                                                                     
$ grep -cE '^- \[ \]' TODO.md                                                                                                                                                                                                                                                                             
83                                                                                                                                                                                                                                                                                                        
                                                                                                                                                                                                                                                                                                          
# Naive redirection through RTK hook rewrite                                                                                                                                                                                                                                                              
$ grep -n '^- \[ \]' TODO.md > /tmp/pending.txt                                                                                                                                                                                                                                                         
$ wc -l /tmp/pending.txt                                                                                                                                                                                                                                                                                  
136 /tmp/pending.txt   # <-- WRONG, expected 83                                                                                                                                                                                                                                                         
                                                                                                                                                                                                                                                                                                          
$ head -3 /tmp/pending.txt                                                                                                                                                                                                                                                                              
83 matches in 36F:                                                                                                                                                                                                                                                                                        
                                                                                                                                                                                                                                                                                                          
// ... 134 more lines (total: 136)...                                                                                                                                                                                                                                                                     

The file contains RTK's compressed human summary ("83 matches in 36F", "// ... 134 more lines", per-file headers like "[file] 921 (1):"), not raw grep output.

Using rtk proxy as a manual opt-out recovers correctness:

$ rtk proxy grep -n '^- \[ \]' TODO.md > /tmp/pending.txt                                                                                                                                                                                                                                               
$ wc -l /tmp/pending.txt                                                                                                                                                                                                                                                                                  
83 /tmp/pending.txt   # correct

Why this matters

1. Silent failure. The downstream consumer (wc -l, jq, diff, curl -d @file) sees syntactically valid but semantically wrong input. No error message, no exit code hint — the only signal is a factual discrepancy the caller may or may not notice.

2. Compounds through pipelines. If the corrupted output is fed to an LLM subagent (our case: classifying 83 TODO items via a MiniMax subagent), the downstream LLM receives garbage input and produces confidently wrong output. Correctness has to be verified via counts/diffs afterwards, because
   the corruption leaves no exception trail.

3. AI agent risk. RTK's primary audience is LLM hooks (per the README). LLM agents frequently pipe grep/find output into jq/awk/other tools to build reasoning pipelines. A compression mode that is opt-out rather than opt-in is hostile to this use case.

Suggested fix

In the Rust code path that emits compressed output, add an IsTerminal check before applying compression:

use std::io::IsTerminal;                                                                                                                                                                                                                                                                                
                                                                                                                                                                                                                                                                                                          
if std::io::stdout().is_terminal() {
    print_compressed(output);                                                                                                                                                                                                                                                                             
} else {                                                                                                                                                                                                                                                                                                  
    print_raw_passthrough(output);
}                                                                                                                                                                                                                                                                                                         

std::io::IsTerminal is stable since Rust 1.70, so no external crate is needed.

This is the same contract as:

• ls --color=auto
• grep --color=auto
• git diff (pager auto-detection)
• cargo (coloring)

Users who explicitly want compression in a non-TTY context can still opt in via an env var (e.g. RTK_FORCE_COMPACT=1) or a rtk compact <cmd> subcommand.

Workaround we adopted

Until this is fixed upstream, we added a redirection/pipe detection layer to our rtk-rewrite.sh PreToolUse hook:

# Bypass RTK rewrite when the command shape indicates the output will be                                                                                                                                                                                                                                
# consumed by a program (file, pipe, substitution) instead of displayed.                                                                                                                                                                                                                                  
if [[ "$CMD" =~ [\>\|\`] ]] || [[ "$CMD" == *'$('* ]] || [[ "$CMD" == *'<('* ]]; then
  exit 0  # pass through unchanged — no RTK rewrite                                                                                                                                                                                                                                                       
fi                                                                                                                                                                                                                                                                                                        

This works at the hook layer but does not help users who invoke rtk directly from an interactive terminal and then pipe it somewhere unexpectedly. An upstream fix is strictly better.

Design note

RTK's current default is compress unless opted out via rtk proxy. We would gently suggest the inverted default is safer: raw passthrough unless stdout is a TTY. Compression is valuable for humans reading a terminal; it is actively harmful for machines reading a stream. The TTY boundary is the
most reliable signal for which audience is on the other end.

Environment

• rtk version: 0.36.0
• OS: Linux 6.8.0-106-generic
• Shell: zsh / bash
• Consumer: Claude Code LLM hook (rtk-rewrite.sh v3)

Happy to file a PR implementing the IsTerminal check if the maintainers agree with the direction.

[panwudi]

Follow-up: anti-tamper UX for legitimate hook modifications

Filing this as a follow-up to the silent-corruption discussion above, since both are about the hook layer. We ran into a second design issue while implementing the workaround.

What happened

I added a redirect/pipe detection bypass to ~/.claude/hooks/rtk-rewrite.sh (the workaround mentioned in the original issue) and immediately hit:

rtk: hook integrity check FAILED                                                                                                                                                                                                                                                                        
  Expected hash: 742418d70728fc3b...                                                                                                                                                                                                                                                                      
  Actual hash:   243e9cf13ac35a0a...                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                          
  The hook at ~/.claude/hooks/rtk-rewrite.sh has been modified.                                                                                                                                                                                                                                           
  This may indicate tampering. RTK will not execute.                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                          
  To restore:  rtk init -g --auto-patch                                                                                                                                                                                                                                                                   
  To inspect:  rtk verify                                                                                                                                                                                                                                                                                 

All bash commands in all Claude Code sessions (across all projects on this machine) immediately stopped working. The recovery suggestion (rtk init -g --auto-patch) would have overwritten my modification and lost the silent-corruption fix.

I worked around it by:

1. chmod 644 ~/.claude/hooks/.rtk-hook.sha256 (the file is intentionally 444)
2. Writing the new sha256 of the modified hook into the file
3. chmod 444 to restore RTK's intent

This works but is hostile to legitimate users who have a valid reason to patch the hook (in our case, a bug fix that hasn't landed upstream yet).

Suggested UX improvements (any of these would help)

1. rtk hook approve subcommand — computes the current hook's sha256 and writes it to .rtk-hook.sha256. Equivalent to "I have reviewed this modification and approve it." Doesn't require the user to know about the hidden hash file or its format.

2. In-hook self-declaration — recognize a magic comment like # rtk-allow-modification: <reason> near the top of the hook script. RTK's integrity check sees this and skips (or downgrades to a one-line warning instead of refusing to run). The comment is auditable; users have to opt in
   explicitly per modification.

3. Better recovery message — at minimum, the To restore line in the error should mention the alternative rtk hook approve (or whatever the equivalent becomes), not just the destructive auto-patch.

4. Distinguish "tampering" from "modification" — the current language ("This may indicate tampering. RTK will not execute.") assumes a hostile threat model. A more neutral phrasing like "Hook checksum mismatch — review changes and run rtk hook approve if intended" would be both more accurate
   and less alarming.

Threat model sanity check

The current anti-tamper design is reasonable defense against a third-party that modifies the hook to insert malicious commands without the user knowing. But it provides no defense against:

• The user themselves (root of trust) intentionally patching the hook
• A genuinely malicious third-party that has shell access (they can also chmod the hash file, as I just demonstrated)

So the defense is mostly "alert the user that the hook changed and refuse to run until they acknowledge." That's a useful property to keep, but the acknowledgement path should be a one-line rtk hook approve rather than chmod gymnastics.

Combined with the original issue

The two findings together suggest the same underlying observation: RTK's hook layer is the seam where users with legitimate needs collide with RTK's defaults. Both the silent-corruption issue (binary-level fix needed) and the anti-tamper UX (CLI subcommand needed) would benefit from treating
"user has patched the hook for a real reason" as a first-class case rather than an edge case.

Happy to file separate issues if you'd prefer to track them independently — let me know.

[pszymkowiak]

wshm · Automated triage by AI

🔍 Automated Triage

🐛 Category	bug
🟠 Priority	high
🎯 Confidence	88%

Summary

RTK silently corrupts piped/redirected output by applying human-readable formatting instead of raw passthrough; recommends isatty(stdout) check to match ls/git/grep color=auto convention

---

Triaged automatically by wshm · This is an automated analysis, not a human review.