tokenix 0.67.1

use anyhow::Result;
use serde::Deserialize;
use std::path::{Path, PathBuf};
use std::time::{SystemTime, UNIX_EPOCH};

use crate::chunker::count_tokens;
use crate::store::{index_staleness, log_hook_event, HookEvent};

const MIN_LINES_FOR_OUTLINE: usize = 200;

/// Read intercept threshold, overridable via `[hook] read_min_lines` in
/// `.tokenix.toml`. Tune down to intercept more reads (saving more tokens) or
/// up for more verbatim file content.
fn min_lines_for_outline() -> usize {
    crate::chunker::hook_config()
        .read_min_lines
        .filter(|n| *n > 0)
        .unwrap_or(MIN_LINES_FOR_OUTLINE)
}

/// Normalized hook input used by tokenix.
///
/// Claude Code sends `tool_name` and `tool_input` on stdin.
/// GitHub Copilot hooks currently send `toolName` and `toolArgs` on stdin.
/// Older Copilot-like runners may set TOOL_NAME/TOOL_INPUT environment vars.
#[derive(Deserialize, Debug, Default)]
pub struct HookInput {
    #[serde(default)]
    pub tool_name: String,
    #[serde(default)]
    pub tool_input: serde_json::Value,
    /// Claude Code / Codex send this on every hook call. Used to scope
    /// re-read suppression to the conversation that actually received the
    /// bytes; empty for agents that don't send one.
    #[serde(default)]
    pub session_id: String,
    #[serde(skip)]
    raw_tool_name: String,
}

#[derive(Deserialize, Debug)]
struct CopilotHookInput {
    #[serde(rename = "toolName")]
    tool_name: String,
    #[serde(rename = "toolArgs", default)]
    tool_args: serde_json::Value,
}

#[derive(Debug, Deserialize)]
#[serde(rename_all = "camelCase")]
struct AntigravityHookInput {
    tool_call: AntigravityToolCall,
}

#[derive(Debug, Deserialize)]
struct AntigravityToolCall {
    name: String,
    #[serde(default)]
    args: serde_json::Value,
}

impl HookInput {
    fn from_env() -> Option<Self> {
        // Env vars are a fallback for non-standard tools; Copilot uses stdin.
        // Only support generic TOOL_NAME/TOOL_INPUT (not COPILOT_* which can't normalize).
        let tool_name = std::env::var("TOOL_NAME").ok()?;
        let tool_input_raw = std::env::var("TOOL_INPUT").unwrap_or_default();
        let tool_input = serde_json::from_str(&tool_input_raw).unwrap_or(serde_json::Value::Null);
        Some(HookInput {
            raw_tool_name: tool_name.clone(),
            tool_name,
            tool_input,
            session_id: String::new(),
        })
    }

    fn from_stdin(raw: &str) -> Option<Self> {
        let clean = raw.trim_start_matches('\u{feff}').trim();
        if clean.is_empty() {
            return None;
        }
        if let Ok(input) = serde_json::from_str::<AntigravityHookInput>(clean) {
            let tool_name = canonical_tool_name(&input.tool_call.name);
            let tool_input = normalize_tool_input(&tool_name, input.tool_call.args);
            return Some(HookInput {
                raw_tool_name: input.tool_call.name,
                tool_name,
                tool_input,
                session_id: String::new(),
            });
        }
        if let Ok(input) = serde_json::from_str::<HookInput>(clean) {
            if !input.tool_name.is_empty() {
                // Canonicalize here too: newer Copilot/Codex builds send the snake_case
                // `tool_name`/`tool_input` shape with harness names like "view", which
                // must still map to Read/Grep (and `path` -> `file_path`) or the tool
                // is never recognized and interception is silently skipped.
                let tool_name = canonical_tool_name(&input.tool_name);
                let tool_input = normalize_tool_input(&tool_name, input.tool_input);
                return Some(HookInput {
                    raw_tool_name: input.tool_name,
                    tool_name,
                    tool_input,
                    session_id: input.session_id,
                });
            }
        }
        serde_json::from_str::<CopilotHookInput>(clean)
            .ok()
            .map(|input| normalize_copilot_input(&input.tool_name, &input.tool_args))
    }
}

/// Map a harness-specific tool name to tokenix's canonical name.
///
/// Claude Code already sends `Read`/`Grep`/`Bash`; GitHub Copilot (and some Codex
/// builds) send `view`/`read`/`grep` in either the legacy `toolName` field or the
/// newer snake_case `tool_name` field. Canonicalizing in one place means
/// interception no longer depends on which field shape or casing a harness uses.
/// Unrecognized names (Bash variants, Edit, etc.) pass through unchanged.
fn canonical_tool_name(name: &str) -> String {
    match name.to_ascii_lowercase().as_str() {
        "read" | "view" | "read_file" | "view_file" => "Read".to_string(),
        "grep" | "grep_search" => "Grep".to_string(),
        _ => name.to_string(),
    }
}

fn normalize_copilot_input(tool_name: &str, tool_args: &serde_json::Value) -> HookInput {
    let args = if let Some(raw) = tool_args.as_str() {
        serde_json::from_str(raw).unwrap_or(serde_json::Value::Null)
    } else {
        tool_args.clone()
    };

    let tool_name = canonical_tool_name(tool_name);
    let tool_input = normalize_tool_input(&tool_name, args);
    HookInput {
        raw_tool_name: tool_name.clone(),
        tool_name,
        tool_input,
        session_id: String::new(),
    }
}

fn normalize_tool_input(tool_name: &str, args: serde_json::Value) -> serde_json::Value {
    match tool_name {
        "Read" => normalize_read_args(args),
        "Grep" => normalize_grep_args(args),
        _ => args,
    }
}

fn normalize_read_args(mut args: serde_json::Value) -> serde_json::Value {
    if args.get("file_path").and_then(|v| v.as_str()).is_some() {
        return args;
    }

    let path = args
        .get("path")
        .or_else(|| args.get("file"))
        .and_then(|v| v.as_str())
        .map(str::to_string);

    if let Some(path) = path {
        if let Some(obj) = args.as_object_mut() {
            obj.insert("file_path".to_string(), serde_json::Value::String(path));
        }
    }
    args
}

fn normalize_grep_args(mut args: serde_json::Value) -> serde_json::Value {
    if args.get("pattern").and_then(|v| v.as_str()).is_some() {
        return args;
    }

    let pattern = args
        .get("query")
        .or_else(|| args.get("regex"))
        .or_else(|| args.get("search"))
        .and_then(|v| v.as_str())
        .map(str::to_string);

    if let Some(pattern) = pattern {
        if let Some(obj) = args.as_object_mut() {
            obj.insert("pattern".to_string(), serde_json::Value::String(pattern));
        }
    }
    args
}

fn find_repo_root() -> PathBuf {
    let cwd = std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."));
    crate::store::find_project_root(&cwd)
}

fn now_ts() -> f64 {
    SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_secs_f64()
}

fn get_file_outline(file_path: &Path) -> Option<String> {
    let content = std::fs::read_to_string(file_path).ok()?;
    let path_str = file_path.to_string_lossy().replace('\\', "/");
    Some(crate::chunker::generate_outline(&content, &path_str))
}

fn handle_read(
    tool_input: &serde_json::Value,
    repo_root: &Path,
    session: &str,
) -> (bool, String, String) {
    let file_path = match tool_input["file_path"].as_str() {
        Some(p) => p,
        None => return (false, String::new(), "missing file_path".to_string()),
    };

    // Let targeted reads through (offset or limit already specified with a numeric value)
    let has_offset = tool_input["offset"].is_number();
    let has_limit = tool_input["limit"].is_number();
    if has_offset || has_limit {
        return (
            false,
            String::new(),
            "targeted read (offset/limit specified)".to_string(),
        );
    }

    let full_path = {
        let p = Path::new(file_path);
        if p.exists() {
            p.to_path_buf()
        } else {
            repo_root.join(file_path)
        }
    };

    if !full_path.exists() {
        return (
            false,
            String::new(),
            format!("file not found: {}", file_path),
        );
    }

    // Only ever buffer a regular file of bounded size. A FIFO/device would block
    // `read_to_string` until the harness kills the hook, and a huge file would be
    // held in memory twice (here and in `measured_original_tokens`).
    const MAX_READ_BYTES: u64 = 8 * 1024 * 1024;
    match std::fs::metadata(&full_path) {
        Ok(m) if !m.is_file() => {
            return (false, String::new(), "not a regular file".to_string());
        }
        Ok(m) if m.len() > MAX_READ_BYTES => {
            return (
                false,
                String::new(),
                "file too large to outline".to_string(),
            );
        }
        Ok(_) => {}
        Err(_) => return (false, String::new(), format!("read error: {}", file_path)),
    }

    let content = match std::fs::read_to_string(&full_path) {
        Ok(c) => c,
        Err(_) => return (false, String::new(), format!("read error: {}", file_path)),
    };

    // Re-read suppression: if the agent already received these exact bytes
    // recently, resending the file is pure waste. Unlike the outline path this
    // works for any language, since it does not parse the file.
    //
    // Only reads that actually delivered the *full content* are remembered — a
    // read answered with an outline must stay re-readable, or the agent could
    // never get past the outline. `remember_full_read` is therefore called on
    // the pass-through paths only.
    let recall_path = full_path.to_string_lossy().replace('\\', "/");
    let content_tokens = count_tokens(&content);
    let now = now_ts();
    if let Some(hit) =
        crate::recall::find_recent_read(&recall_path, &content, content_tokens, now, session)
    {
        return (
            true,
            crate::recall::read_marker(&hit, now),
            "unchanged since a recent full read".to_string(),
        );
    }
    let remember_full_read =
        || crate::recall::remember_read(&recall_path, &content, content_tokens, now, session);

    let line_count = content.lines().count();
    let min_lines = min_lines_for_outline();
    if line_count < min_lines {
        remember_full_read();
        return (
            false,
            String::new(),
            format!("small file ({} < {} lines)", line_count, min_lines),
        );
    }

    let outline = match get_file_outline(&full_path) {
        Some(o) => o,
        None => {
            remember_full_read();
            return (
                false,
                String::new(),
                "failed to generate outline".to_string(),
            );
        }
    };

    let rel = full_path
        .strip_prefix(repo_root)
        .unwrap_or(&full_path)
        .to_string_lossy()
        .replace('\\', "/");

    // Extensions the outliner (`chunker::detect_lang`) actually supports — keep in
    // sync with it. C/C++, VB and SQL were previously excluded here, so their large
    // files passed through full even though `generate_outline` can outline them; the
    // >=30% savings gate below still rejects any outline that isn't worth it.
    let ext = full_path
        .extension()
        .and_then(|e| e.to_str())
        .unwrap_or("")
        .to_ascii_lowercase();
    let is_code = matches!(
        ext.as_str(),
        "rs" | "py"
            | "ts"
            | "tsx"
            | "js"
            | "jsx"
            | "mjs"
            | "cjs"
            | "go"
            | "c"
            | "cpp"
            | "h"
            | "hpp"
            | "cc"
            | "cxx"
            | "bas"
            | "cls"
            | "ctl"
            | "frm"
            | "sql"
            | "fnc"
            | "trg"
            | "pkg"
            | "prc"
            | "tab"
            | "vw"
    );

    if !is_code {
        return (
            false,
            String::new(),
            format!("unsupported language: .{}", ext),
        );
    }

    // Only intercept when the outline is materially smaller than the file. For
    // files of many tiny symbols the outline can be ~as large as (or larger than)
    // the source, so intercepting would cost ~full price for the outline AND force
    // a re-read for the bodies — a net token loss. Require >=30% savings.
    let file_tokens = count_tokens(&content) as i64;
    let outline_tokens = count_tokens(&outline) as i64;
    if file_tokens <= 0 || (file_tokens - outline_tokens) * 100 < file_tokens * 30 {
        return (
            false,
            String::new(),
            format!(
                "outline saves <30% ({} vs {} tokens) — passing through",
                outline_tokens, file_tokens
            ),
        );
    }

    let msg = format!(
        "{}\n\n[tokenix] File has {} lines. Showing symbol outline above.\n\
        To read a specific symbol: tokenix read {} --symbol <name>\n\
        To read specific lines:   use Read with offset/limit parameters.",
        outline, line_count, rel
    );
    (true, msg, "generated symbol outline".to_string())
}

fn measured_original_tokens(
    tool_name: &str,
    tool_input: &serde_json::Value,
    repo_root: &Path,
) -> Option<i64> {
    if tool_name == "Read" {
        if let Some(fp) = tool_input["file_path"].as_str() {
            let p = Path::new(fp);
            let full = if p.exists() {
                p.to_path_buf()
            } else {
                repo_root.join(fp)
            };
            if let Ok(content) = std::fs::read_to_string(&full) {
                return Some(count_tokens(&content) as i64);
            }
        }
    }
    None
}

fn original_tokens_for_log(
    tool_name: &str,
    tool_input: &serde_json::Value,
    repo_root: &Path,
    actual_tokens: i64,
) -> i64 {
    // If we cannot measure the original tool output before interception, keep
    // gain honest: log the context cost but claim zero saved tokens.
    measured_original_tokens(tool_name, tool_input, repo_root).unwrap_or(actual_tokens)
}

/// Build the PreToolUse JSON output that rewrites a Bash command's input.
/// `hookEventName` is required by Claude Code or the whole `hookSpecificOutput`
/// is ignored and the rewrite silently does not apply.
fn bash_rewrite_output(
    input: &HookInput,
    rewritten: &str,
    reason: &str,
    antigravity: bool,
) -> serde_json::Value {
    if antigravity {
        let mut args = input.tool_input.clone();
        if let Some(obj) = args.as_object_mut() {
            for key in ["command", "CommandLine", "commandLine", "command_line"] {
                obj.insert(
                    key.to_string(),
                    serde_json::Value::String(rewritten.to_string()),
                );
            }
        }
        return serde_json::json!({
            "decision": "allow",
            "reason": reason,
            "overwrite": {
                "name": input.raw_tool_name,
                "args": args
            }
        });
    }

    serde_json::json!({
        "hookSpecificOutput": {
            "hookEventName": "PreToolUse",
            "permissionDecision": "allow",
            "permissionDecisionReason": reason,
            "updatedInput": {
                "command": rewritten,
                "CommandLine": rewritten,
                "commandLine": rewritten,
                "command_line": rewritten,
            }
        }
    })
}

/// Build a PreToolUse output that hands the tool back a *modified argument set*
/// (as opposed to `bash_rewrite_output`, which only rewrites a command string).
fn input_rewrite_output(
    input: &HookInput,
    updated: serde_json::Value,
    reason: &str,
    antigravity: bool,
) -> serde_json::Value {
    if antigravity {
        return serde_json::json!({
            "decision": "allow",
            "reason": reason,
            "overwrite": {
                "name": input.raw_tool_name,
                "args": updated
            }
        });
    }

    serde_json::json!({
        "hookSpecificOutput": {
            "hookEventName": "PreToolUse",
            "permissionDecision": "allow",
            "permissionDecisionReason": reason,
            "updatedInput": updated
        }
    })
}

/// Cap injected into an uncapped content-mode Grep. Measured motivation: a
/// single unbounded lexical Grep over a large repo cost ~937k tokens because
/// tokenix never answers a Grep itself and passes every pattern through.
/// Override with `TOKENIX_GREP_HEAD_LIMIT`; `0` disables the cap.
const DEFAULT_GREP_HEAD_LIMIT: i64 = 100;

fn grep_head_limit() -> i64 {
    std::env::var("TOKENIX_GREP_HEAD_LIMIT")
        .ok()
        .and_then(|v| v.trim().parse::<i64>().ok())
        .unwrap_or(DEFAULT_GREP_HEAD_LIMIT)
}

/// Returns the full replacement tool input with a `head_limit` injected, when a
/// lexical Grep asks for match *content* without bounding how much comes back.
///
/// Deliberately narrow: modes that emit one line per file (`files_with_matches`,
/// `count`) are already cheap, and an agent that set its own `head_limit` has
/// bounded itself — both pass through untouched.
fn grep_cap_input(tool_input: &serde_json::Value) -> Option<(serde_json::Value, String)> {
    let limit = grep_head_limit();
    if limit <= 0 {
        return None;
    }
    if tool_input["head_limit"].is_number() {
        return None;
    }
    if tool_input["output_mode"].as_str() != Some("content") {
        return None;
    }

    let mut updated = tool_input.clone();
    updated.as_object_mut()?.insert(
        "head_limit".to_string(),
        serde_json::Value::Number(limit.into()),
    );
    Some((
        updated,
        format!("tokenix: capped uncapped content grep at head_limit={limit}"),
    ))
}

/// Emit the capped-grep rewrite and exit, when the input qualifies. Returns
/// normally (doing nothing) for any other tool or an already-bounded grep.
fn try_grep_cap(input: &HookInput, repo_root: &Path, antigravity: bool, raw_stdin: &str) {
    if input.tool_name != "Grep" {
        return;
    }
    let Some((updated, reason)) = grep_cap_input(&input.tool_input) else {
        return;
    };
    let out = input_rewrite_output(input, updated, &reason, antigravity);
    let _ = log_hook_event(
        repo_root,
        &HookEvent {
            ts: now_ts(),
            tool: input.tool_name.clone(),
            action: "intercepted".to_string(),
            phase: "pre".to_string(),
            reason,
            // Savings are unmeasurable here — the unbounded output never runs —
            // so log zero rather than inflating `gain`.
            saved_tokens: 0,
            actual_tokens: 0,
            original_estimate: 0,
            input_preview: raw_stdin.chars().take(200).collect(),
            command: String::new(),
        },
    );
    println!("{}", serde_json::to_string(&out).unwrap_or_default());
    exit_success();
}

fn pass_through(antigravity: bool) -> ! {
    if antigravity {
        println!(r#"{{"decision":"allow","reason":"tokenix pass-through"}}"#);
    }
    std::process::exit(0);
}

fn exit_success() -> ! {
    std::process::exit(0);
}

/// True when the command actually *invokes* tokenix — a `tokenix` program token
/// immediately followed by one of its subcommands. A plain substring test also
/// matched `grep -r tokenix .` or `cat tokenix.toml` and silently left those
/// commands uncompressed; requiring the subcommand keeps the recursion guard
/// while letting ordinary mentions through. Token-wise rather than
/// first-word-only so it survives quoted exe paths containing spaces and
/// PowerShell's `& 'C:/…/tokenix.exe' run` call form.
fn invokes_tokenix(command: &str) -> bool {
    const SUBCOMMANDS: &[&str] = &["run", "mcp-proxy", "hook", "hook-post", "mcp"];
    let tokens: Vec<&str> = command.split_whitespace().collect();
    tokens.windows(2).any(|w| {
        let prog = w[0].trim_matches(|c| c == '"' || c == '\'');
        let stem = prog
            .rsplit(['/', '\\'])
            .next()
            .unwrap_or(prog)
            .trim_end_matches(".exe");
        stem.eq_ignore_ascii_case("tokenix") && SUBCOMMANDS.contains(&w[1])
    })
}

/// Quote a string as a POSIX single-quoted literal. Double quotes would leave
/// `$`, backticks and `\` live, so the agent's shell would expand them while
/// rewriting — `echo '$(id)'` would reach `tokenix run` already substituted.
fn shell_quote(s: &str) -> String {
    format!("'{}'", s.replace('\'', r"'\''"))
}

/// Quote a string as a PowerShell single-quoted literal: no `$`/backtick
/// expansion, internal single quotes doubled. Safe for passing an arbitrary
/// command string as one argument to a native exe via `& 'exe' ... 'arg'`.
fn ps_quote(s: &str) -> String {
    format!("'{}'", s.replace('\'', "''"))
}

/// True when `command`, or any of its `&&`/`;`/`||`/`|`-separated segments
/// (raw, or after resolving a leading `cd`/`Set-Location`/package-runner
/// prefix), is a bare `git` invocation.
///
/// Used to keep `git` commands visible as a plain, literal `git ...` program
/// invocation even when a bundled filter would otherwise wrap the whole
/// command in `tokenix run` for compression. A downstream guard that must
/// verify a Bash/PowerShell command really is (and stays) `git` — e.g. Claude
/// Code's worktree-isolation check on a subagent's git operations — cannot
/// see through `'tokenix' run '<command>'` (the real invocation is now a
/// quoted argument to an arbitrary binary) and refuses the opaque wrapper
/// outright, even though the underlying command was exactly the transparent,
/// safe `git` call the guard exists to allow. `git status` already gets its
/// own transparent `--short` rewrite above (see `status_re`); this extends
/// the same guarantee to every other git subcommand.
fn is_git_invocation(command: &str) -> bool {
    crate::filters::split_on_operators(command)
        .iter()
        .any(|segment| segment_is_git(segment))
}

fn segment_is_git(segment: &str) -> bool {
    first_token_is_git(segment)
        || first_token_is_git(&crate::filters::get_effective_command(segment))
}

fn first_token_is_git(s: &str) -> bool {
    crate::filters::tokenize_command(s)
        .first()
        .map(|t| {
            let t = t.as_str();
            let stem = t.rsplit(['/', '\\']).next().unwrap_or(t);
            stem.trim_end_matches(".exe").eq_ignore_ascii_case("git")
        })
        .unwrap_or(false)
}

fn is_bash_tool(name: &str) -> bool {
    let lower = name.to_ascii_lowercase();
    matches!(
        lower.as_str(),
        "bash"
            | "powershell"
            | "cmd"
            | "shell"
            | "run_shell_command"
            | "default_api:run_shell_command"
            | "run_in_terminal"
            | "default_api:run_in_terminal"
            | "run_command"
            | "default_api:run_command"
            | "get_terminal_output"
            | "default_api:get_terminal_output"
    )
}

/// Decide whether a tool invocation must be handled by the PowerShell-aware path
/// (`& 'exe' run --shell pwsh 'cmd'`).
///
/// Claude Code's dedicated `PowerShell` tool always uses it. On Windows, generic
/// command/shell tools (Antigravity's `run_command`/`run_in_terminal`, and the same
/// names from other harnesses) also use it, because Windows executes them under
/// powershell/pwsh and the cmd-style `"exe" run "cmd"` rewrite causes parse errors.
///
/// Crucially this is gated on the tool being a command/shell tool (`is_bash_tool`).
/// Read/Grep are routed through this same hook under Antigravity (canonicalized from
/// `read_file`/`grep_search`); they must reach `handle_read`/`handle_grep`, not the
/// empty-command pass-through of the PowerShell branch.
fn should_route_powershell(tool_name: &str, antigravity: bool, is_windows: bool) -> bool {
    if tool_name == "PowerShell" || tool_name.eq_ignore_ascii_case("powershell") {
        return true;
    }
    if !is_windows || !is_bash_tool(tool_name) {
        return false;
    }
    antigravity
        || matches!(
            tool_name,
            "run_command"
                | "default_api:run_command"
                | "run_in_terminal"
                | "default_api:run_in_terminal"
        )
}

pub fn run_hook(antigravity: bool) -> Result<()> {
    // Read input: prefer env vars (Copilot), fall back to stdin (Claude Code / Codex)
    let raw_stdin = std::io::read_to_string(std::io::stdin()).unwrap_or_default();

    let input = HookInput::from_env()
        .or_else(|| HookInput::from_stdin(&raw_stdin))
        .unwrap_or_default();

    let repo_root = find_repo_root();

    let is_powershell = should_route_powershell(&input.tool_name, antigravity, cfg!(windows));
    let is_bash = is_bash_tool(&input.tool_name) && !is_powershell;
    let is_supported =
        input.tool_name == "Read" || input.tool_name == "Grep" || is_bash || is_powershell;

    if input.tool_name.is_empty() {
        pass_through(antigravity);
    }

    if !is_supported {
        let _ = log_hook_event(
            &repo_root,
            &HookEvent {
                ts: now_ts(),
                tool: input.tool_name,
                action: "pass".to_string(),
                phase: "pre".to_string(),
                reason: "unsupported tool".to_string(),
                saved_tokens: 0,
                actual_tokens: 0,
                original_estimate: 0,
                input_preview: raw_stdin.chars().take(200).collect(),
                command: String::new(),
            },
        );
        pass_through(antigravity);
    }

    if is_bash {
        let command = input.tool_input["command"]
            .as_str()
            .or_else(|| input.tool_input["CommandLine"].as_str())
            .or_else(|| input.tool_input["commandLine"].as_str())
            .or_else(|| input.tool_input["command_line"].as_str())
            .unwrap_or("")
            .trim();

        if command.is_empty() {
            pass_through(antigravity);
        }

        // Avoid infinite recursion: do not rewrite a command that already *is* a
        // tokenix invocation. Matched structurally — a substring test also
        // skipped `grep -r tokenix .` and `cat tokenix.toml`, silently leaving
        // a whole class of commands uncompressed.
        if invokes_tokenix(command) {
            pass_through(antigravity);
        }

        // Per-command escape hatch: a TOKENIX_DISABLED=1 env prefix means
        // "give me the raw output this one time" — skip every rewrite. The
        // bypass is logged so `tokenix gain` can flag overuse.
        if command.contains("TOKENIX_DISABLED=1") {
            let _ = log_hook_event(
                &repo_root,
                &HookEvent {
                    ts: now_ts(),
                    tool: "Bash".to_string(),
                    action: "bypassed".to_string(),
                    phase: "pre".to_string(),
                    reason: "TOKENIX_DISABLED=1".to_string(),
                    saved_tokens: 0,
                    actual_tokens: 0,
                    original_estimate: 0,
                    input_preview: command.chars().take(200).collect(),
                    command: command.to_string(),
                },
            );
            pass_through(antigravity);
        }

        // Recording session active: route every in-scope command through
        // `tokenix run` so its raw output is captured to .tokenix/recordings.
        // PreToolUse is the only path that sees command output under Claude Code,
        // so this is what makes `tokenix filter record` feed filter generation.
        if crate::recordings::is_in_scope(&repo_root, command) {
            let exe_path = std::env::current_exe()
                .map(|p| p.to_string_lossy().replace('\\', "/"))
                .unwrap_or_else(|_| "tokenix".to_string());
            let rewritten = format!("{} run {}", shell_quote(&exe_path), shell_quote(command));
            let out = bash_rewrite_output(
                &input,
                &rewritten,
                "recording: capturing output for filter generation",
                antigravity,
            );

            let _ = log_hook_event(
                &repo_root,
                &HookEvent {
                    ts: now_ts(),
                    tool: "Bash".to_string(),
                    action: "intercepted".to_string(),
                    phase: "pre".to_string(),
                    reason: "recording capture".to_string(),
                    saved_tokens: 0,
                    actual_tokens: 0,
                    original_estimate: 0,
                    input_preview: command.chars().take(200).collect(),
                    command: command.to_string(),
                },
            );

            println!("{}", serde_json::to_string(&out).unwrap_or_default());
            exit_success();
        }

        // 1. Optimize git status -> git status --short. Let it pass through natively
        // on the second pass when the short flag is already present.
        let is_short_git_status = (command.starts_with("git status")
            || command.starts_with("git  status"))
            && (command.contains("-s") || command.contains("--short"));
        if is_short_git_status {
            pass_through(antigravity);
        }

        let status_re = regex::Regex::new(r"^git\s+status(\s+.*)?$").unwrap();
        if status_re.is_match(command) && !command.contains("-") {
            // Strip whitespace-aware: the matcher accepts `git  status <path>`,
            // but `strip_prefix("git status")` would miss the double space and
            // silently drop the path argument.
            let trimmed = command
                .split_once("status")
                .map(|(_, rest)| rest.trim())
                .unwrap_or("");
            let rewritten = if trimmed.is_empty() {
                "git status --short".to_string()
            } else {
                format!("git status --short {}", trimmed)
            };

            let out = bash_rewrite_output(
                &input,
                &rewritten,
                "rewrite git status to git status --short for token efficiency",
                antigravity,
            );

            let _ = log_hook_event(
                &repo_root,
                &HookEvent {
                    ts: now_ts(),
                    tool: "Bash".to_string(),
                    action: "intercepted".to_string(),
                    phase: "pre".to_string(),
                    reason: "rewrote git status to git status --short".to_string(),
                    saved_tokens: 0,
                    actual_tokens: 0,
                    original_estimate: 0,
                    input_preview: command.chars().take(200).collect(),
                    command: command.to_string(),
                },
            );

            println!("{}", serde_json::to_string(&out).unwrap_or_default());
            exit_success();
        }

        // 2. Otherwise check for other active filters to wrap in tokenix run
        let unwrapped =
            crate::filters::unwrap_shell_runner(command).unwrap_or_else(|| command.to_string());

        // Never hide a git invocation behind the opaque `tokenix run` wrapper
        // (see `is_git_invocation`) — pass it through unfiltered instead.
        if is_git_invocation(&unwrapped) {
            pass_through(antigravity);
        }

        let filters = crate::filters::load_filter_groups_for_command(&unwrapped);

        if crate::filters::find_filter_ranked(&unwrapped, &filters).is_some() {
            let exe_path = std::env::current_exe()
                .map(|p| p.to_string_lossy().replace('\\', "/"))
                .unwrap_or_else(|_| "tokenix".to_string());

            let rewritten = format!("{} run {}", shell_quote(&exe_path), shell_quote(command));

            let out = bash_rewrite_output(
                &input,
                &rewritten,
                "wrapped in tokenix compression run",
                antigravity,
            );

            let _ = log_hook_event(
                &repo_root,
                &HookEvent {
                    ts: now_ts(),
                    tool: "Bash".to_string(),
                    action: "intercepted".to_string(),
                    phase: "pre".to_string(),
                    reason: "rewrote command to tokenix run".to_string(),
                    saved_tokens: 0,
                    actual_tokens: 0,
                    original_estimate: 0,
                    input_preview: command.chars().take(200).collect(),
                    command: command.to_string(),
                },
            );

            println!("{}", serde_json::to_string(&out).unwrap_or_default());
            exit_success();
        }

        pass_through(antigravity);
    }

    if is_powershell {
        let command = input.tool_input["command"]
            .as_str()
            .or_else(|| input.tool_input["CommandLine"].as_str())
            .or_else(|| input.tool_input["commandLine"].as_str())
            .or_else(|| input.tool_input["command_line"].as_str())
            .unwrap_or("")
            .trim();

        if command.is_empty() {
            pass_through(antigravity);
        }
        // Avoid recursion: the rewrite itself invokes tokenix under pwsh.
        if invokes_tokenix(command) {
            pass_through(antigravity);
        }

        // Same per-command escape hatch as the Bash path ($env:TOKENIX_DISABLED
        // or an inline TOKENIX_DISABLED=1 marker).
        if command.contains("TOKENIX_DISABLED") {
            let _ = log_hook_event(
                &repo_root,
                &HookEvent {
                    ts: now_ts(),
                    tool: "PowerShell".to_string(),
                    action: "bypassed".to_string(),
                    phase: "pre".to_string(),
                    reason: "TOKENIX_DISABLED".to_string(),
                    saved_tokens: 0,
                    actual_tokens: 0,
                    original_estimate: 0,
                    input_preview: command.chars().take(200).collect(),
                    command: command.to_string(),
                },
            );
            pass_through(antigravity);
        }

        // Never hide a git invocation behind the opaque `tokenix run` wrapper
        // (see `is_git_invocation`) — pass it through unfiltered instead.
        if is_git_invocation(command) {
            pass_through(antigravity);
        }

        let filters = crate::filters::load_filter_groups_for_command(command);
        if crate::filters::find_filter_ranked(command, &filters).is_some() {
            let exe_path = std::env::current_exe()
                .map(|p| p.to_string_lossy().replace('\\', "/"))
                .unwrap_or_else(|_| "tokenix".to_string());

            // Rewrite as a native-exe call in PowerShell syntax; `tokenix run`
            // re-executes the original command under pwsh and compresses output.
            let rewritten = format!(
                "& {} run --shell pwsh {}",
                ps_quote(&exe_path),
                ps_quote(command)
            );

            let out = bash_rewrite_output(
                &input,
                &rewritten,
                "wrapped in tokenix compression run (pwsh)",
                antigravity,
            );

            let _ = log_hook_event(
                &repo_root,
                &HookEvent {
                    ts: now_ts(),
                    tool: "PowerShell".to_string(),
                    action: "intercepted".to_string(),
                    phase: "pre".to_string(),
                    reason: "rewrote command to tokenix run (pwsh)".to_string(),
                    saved_tokens: 0,
                    actual_tokens: 0,
                    original_estimate: 0,
                    input_preview: command.chars().take(200).collect(),
                    command: command.to_string(),
                },
            );

            println!("{}", serde_json::to_string(&out).unwrap_or_default());
            exit_success();
        }

        pass_through(antigravity);
    }

    let staleness = index_staleness(&repo_root);

    if staleness.stale {
        // Bounding an unbounded grep needs no index, so a stale/missing index
        // must not disable it — this is where most repos actually sit.
        try_grep_cap(&input, &repo_root, antigravity, &raw_stdin);
        let _ = log_hook_event(
            &repo_root,
            &HookEvent {
                ts: now_ts(),
                tool: input.tool_name,
                action: "pass".to_string(),
                phase: "pre".to_string(),
                reason: staleness.reason,
                saved_tokens: 0,
                actual_tokens: 0,
                original_estimate: 0,
                input_preview: String::new(),
                command: String::new(),
            },
        );
        pass_through(antigravity);
    }

    let (intercepted, output, reason) = match input.tool_name.as_str() {
        "Read" => handle_read(&input.tool_input, &repo_root, &input.session_id),
        "Grep" => (false, String::new(), "grep runs natively".to_string()),
        _ => (false, String::new(), "unsupported tool".to_string()),
    };

    if !intercepted {
        // A lexical Grep is not something tokenix can answer from the index, but
        // it can still be bounded before it dumps every match into the context.
        try_grep_cap(&input, &repo_root, antigravity, &raw_stdin);

        let _ = log_hook_event(
            &repo_root,
            &HookEvent {
                ts: now_ts(),
                tool: input.tool_name,
                action: "pass".to_string(),
                phase: "pre".to_string(),
                reason,
                saved_tokens: 0,
                actual_tokens: 0,
                original_estimate: 0,
                input_preview: String::new(),
                command: String::new(),
            },
        );
        pass_through(antigravity);
    }

    let actual_tokens = count_tokens(&output) as i64;
    let original_tokens = original_tokens_for_log(
        &input.tool_name,
        &input.tool_input,
        &repo_root,
        actual_tokens,
    );
    let saved = (original_tokens - actual_tokens).max(0);

    let _ = log_hook_event(
        &repo_root,
        &HookEvent {
            ts: now_ts(),
            tool: input.tool_name.clone(),
            action: "intercepted".to_string(),
            phase: "pre".to_string(),
            reason,
            saved_tokens: saved,
            actual_tokens,
            original_estimate: original_tokens,
            input_preview: raw_stdin.chars().take(200).collect(),
            command: String::new(),
        },
    );

    if antigravity {
        println!(
            "{}",
            serde_json::json!({
                "decision": "deny",
                "reason": output
            })
        );
        std::process::exit(0);
    }

    eprintln!("{}", output);
    std::process::exit(2);
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn shell_quote_keeps_command_literal_through_the_outer_shell() {
        // Regression: double-quote wrapping left `$`, `$(…)` and backticks live,
        // so the agent's shell expanded them *while rewriting* and `tokenix run`
        // received a different command than the agent asked for.
        let q = shell_quote("echo '$HOME and $(id -un)'");
        assert!(q.starts_with('\'') && q.ends_with('\''));
        assert!(
            q.contains("$(id -un)"),
            "substitution must stay literal: {q}"
        );
        // Embedded single quotes are re-opened, not left dangling.
        assert_eq!(shell_quote("it's"), r"'it'\''s'");
    }

    #[test]
    fn is_git_invocation_recognizes_bare_and_compound_git_commands() {
        assert!(is_git_invocation("git log -1"));
        assert!(is_git_invocation("git status -sb"));
        // Regression: the tail segment of a compound command still counts —
        // a filter match on that segment used to wrap the *whole* compound
        // command in `tokenix run`, hiding the git call just as much.
        assert!(is_git_invocation(
            "pwd && git status && git log --oneline -5"
        ));
        // A leading cd/Set-Location prefix must not hide the git call either.
        assert!(is_git_invocation("cd /repo && git diff"));
        assert!(is_git_invocation("Set-Location D:/repo; git log -1"));
        assert!(is_git_invocation(
            "'C:/Program Files/Git/bin/git.exe' log -1"
        ));

        assert!(!is_git_invocation("cargo test"));
        assert!(!is_git_invocation("npm test && echo done"));
        assert!(!is_git_invocation("grep -r tokenix ."));
    }

    #[test]
    fn recursion_guard_matches_invocations_not_mentions() {
        assert!(invokes_tokenix("tokenix run 'git status'"));
        assert!(invokes_tokenix("'C:/tools/tokenix.exe' run 'git status'"));
        assert!(invokes_tokenix(
            "& 'C:/tools/tokenix.exe' run --shell pwsh 'ls'"
        ));
        assert!(invokes_tokenix("cd repo && tokenix mcp-proxy -- npx srv"));
        // Regression: these merely mention the word and used to skip compression.
        assert!(!invokes_tokenix("grep -r tokenix ."));
        assert!(!invokes_tokenix("cat tokenix.toml"));
        assert!(!invokes_tokenix("git log --grep=tokenix"));
    }

    #[test]
    fn git_status_rewrite_keeps_path_arg_with_extra_spaces() {
        // Regression: `strip_prefix("git status")` missed the double space and
        // silently widened `git  status src` to a whole-repo status.
        let trimmed = "git  status src"
            .split_once("status")
            .map(|(_, rest)| rest.trim())
            .unwrap_or("");
        assert_eq!(trimmed, "src");
    }

    #[test]
    fn powershell_routing_targets_command_tools_not_read_grep() {
        // Claude's dedicated PowerShell tool always routes to pwsh, any platform.
        assert!(should_route_powershell("PowerShell", false, false));
        assert!(should_route_powershell("powershell", false, true));

        // On Windows, Antigravity command tools route to pwsh.
        assert!(should_route_powershell("run_command", true, true));
        assert!(should_route_powershell("run_in_terminal", true, true));

        // Regression: Read/Grep under Antigravity-on-Windows must NOT route to the
        // pwsh branch, or they bypass handle_read/handle_grep and pass through.
        assert!(!should_route_powershell("Read", true, true));
        assert!(!should_route_powershell("Grep", true, true));

        // Claude's Bash tool on Windows stays on the bash path (runs under cmd/git-bash).
        assert!(!should_route_powershell("Bash", false, true));

        // Off Windows, generic command tools stay on the bash path.
        assert!(!should_route_powershell("run_command", true, false));
    }

    #[test]
    fn ps_quote_wraps_and_escapes_single_quotes() {
        assert_eq!(ps_quote("Get-ChildItem"), "'Get-ChildItem'");
        // Internal single quotes are doubled (PowerShell literal escaping).
        assert_eq!(
            ps_quote("Select-String -Pattern 'foo'"),
            "'Select-String -Pattern ''foo'''"
        );
        // $ and backtick stay literal inside a single-quoted PS string.
        assert_eq!(ps_quote("$env:PATH"), "'$env:PATH'");
    }

    #[test]
    fn ps_rewrite_is_valid_powershell_call() {
        // The rewrite must be a native-exe call (`& 'exe' run --shell pwsh 'cmd'`)
        // that PowerShell can parse, with the original command as one literal arg.
        let exe = "C:/tokenix/bin/tokenix.exe";
        let cmd = "Get-ChildItem | Select-String 'todo'";
        let rewritten = format!("& {} run --shell pwsh {}", ps_quote(exe), ps_quote(cmd));
        assert_eq!(
            rewritten,
            "& 'C:/tokenix/bin/tokenix.exe' run --shell pwsh 'Get-ChildItem | Select-String ''todo'''"
        );
    }

    #[test]
    fn parses_claude_input() {
        let raw = r#"{"tool_name":"Read","tool_input":{"file_path":"src/main.rs"}}"#;
        let input = HookInput::from_stdin(raw).unwrap();
        assert_eq!(input.tool_name, "Read");
        assert_eq!(input.tool_input["file_path"], "src/main.rs");
    }

    #[test]
    fn parses_copilot_view_input() {
        let raw = r#"{"toolName":"view","toolArgs":"{\"path\":\"src/main.rs\"}"}"#;
        let input = HookInput::from_stdin(raw).unwrap();
        assert_eq!(input.tool_name, "Read");
        assert_eq!(input.tool_input["file_path"], "src/main.rs");
    }

    #[test]
    fn empty_stdin_returns_none() {
        assert!(HookInput::from_stdin("").is_none());
        assert!(HookInput::from_stdin("   ").is_none());
    }

    #[test]
    fn bom_prefix_stripped() {
        let raw =
            "\u{feff}{\"tool_name\":\"Grep\",\"tool_input\":{\"pattern\":\"how does auth work\"}}";
        let input = HookInput::from_stdin(raw).unwrap();
        assert_eq!(input.tool_name, "Grep");
    }

    #[test]
    fn unknown_tool_parses_as_is() {
        let raw = r#"{"tool_name":"Edit","tool_input":{"file_path":"x.rs"}}"#;
        let input = HookInput::from_stdin(raw).unwrap();
        assert_eq!(input.tool_name, "Edit");
    }

    #[test]
    fn copilot_grep_normalized() {
        let raw = r#"{"toolName":"grep","toolArgs":{"pattern":"how does auth work"}}"#;
        let input = HookInput::from_stdin(raw).unwrap();
        assert_eq!(input.tool_name, "Grep");
        assert_eq!(input.tool_input["pattern"], "how does auth work");
    }

    #[test]
    fn grep_search_query_normalized() {
        let raw = r#"{"toolName":"grep_search","toolArgs":{"query":"how does auth work"}}"#;
        let input = HookInput::from_stdin(raw).unwrap();
        assert_eq!(input.tool_name, "Grep");
        assert_eq!(input.tool_input["pattern"], "how does auth work");
    }

    #[test]
    fn snake_case_grep_search_regex_normalized() {
        let raw = r#"{"tool_name":"grep_search","tool_input":{"regex":"fn.*main"}}"#;
        let input = HookInput::from_stdin(raw).unwrap();
        assert_eq!(input.tool_name, "Grep");
        assert_eq!(input.tool_input["pattern"], "fn.*main");
    }

    #[test]
    fn run_in_terminal_is_bash_tool() {
        assert!(is_bash_tool("run_in_terminal"));
        assert!(is_bash_tool("default_api:run_in_terminal"));
    }

    #[test]
    fn copilot_read_with_path_key() {
        let raw = r#"{"toolName":"view","toolArgs":{"path":"src/lib.rs"}}"#;
        let input = HookInput::from_stdin(raw).unwrap();
        assert_eq!(input.tool_name, "Read");
        assert_eq!(input.tool_input["file_path"], "src/lib.rs");
    }

    #[test]
    fn snake_case_view_normalized_to_read() {
        // Newer Copilot/Codex builds use the snake_case shape with harness tool
        // names; it must canonicalize just like the legacy camelCase shape does.
        let raw = r#"{"tool_name":"view","tool_input":{"path":"src/main.rs"}}"#;
        let input = HookInput::from_stdin(raw).unwrap();
        assert_eq!(input.tool_name, "Read");
        assert_eq!(input.tool_input["file_path"], "src/main.rs");
    }

    #[test]
    fn antigravity_tool_call_normalizes_read_file() {
        let raw = r#"{"toolCall":{"name":"read_file","args":{"path":"src/main.rs"}}}"#;
        let input = HookInput::from_stdin(raw).unwrap();
        assert_eq!(input.tool_name, "Read");
        assert_eq!(input.tool_input["file_path"], "src/main.rs");
    }

    #[test]
    fn read_intercepts_only_when_outline_saves_tokens() {
        use std::io::Write;
        let dir = std::env::temp_dir().join(format!("tokenix_read_hook_{}", std::process::id()));
        let _ = std::fs::create_dir_all(&dir);

        // Many small-but-indexable one-line functions: the per-symbol outline is
        // ~as large as the file, so intercepting would not save tokens and would
        // force a re-read. handle_read must pass through (intercepted == false).
        let dense = dir.join("dense.rs");
        let mut f = std::fs::File::create(&dense).unwrap();
        for i in 0..220 {
            writeln!(f, "pub fn s{i}(x: i64, y: i64) -> i64 {{ x + y + {i} }}").unwrap();
        }
        drop(f);
        let input = serde_json::json!({ "file_path": dense.to_string_lossy() });
        let (intercepted, _, reason) = handle_read(&input, &dir, "");
        assert!(
            !intercepted,
            "dense small-symbol file should pass through, got: {reason}"
        );

        // A few large functions: the outline is far smaller than the file → intercept.
        let sparse = dir.join("sparse.rs");
        let mut f = std::fs::File::create(&sparse).unwrap();
        for i in 0..6 {
            writeln!(f, "pub fn big{i}(x: i64) -> i64 {{").unwrap();
            for j in 0..50 {
                writeln!(
                    f,
                    "    let v{j} = x + {j} * {i}; // body line padding the function"
                )
                .unwrap();
            }
            writeln!(f, "    x\n}}").unwrap();
        }
        drop(f);
        let input = serde_json::json!({ "file_path": sparse.to_string_lossy() });
        let (intercepted, _, reason) = handle_read(&input, &dir, "");
        assert!(
            intercepted,
            "large-body file should be intercepted, got: {reason}"
        );

        let _ = std::fs::remove_dir_all(&dir);
    }

    #[test]
    fn grep_intercepts_do_not_claim_measured_savings() {
        let input = serde_json::json!({ "pattern": "how does auth work" });
        assert_eq!(
            original_tokens_for_log("Grep", &input, Path::new("."), 1234),
            1234
        );
    }

    #[test]
    fn unmeasured_intercepts_are_neutral_not_estimated() {
        let input = serde_json::json!({ "pattern": "anything" });
        assert_eq!(
            measured_original_tokens("Grep", &input, Path::new(".")),
            None
        );
        assert_eq!(
            original_tokens_for_log("Grep", &input, Path::new("."), 77),
            77
        );
    }

    #[test]
    fn grep_cap_injects_head_limit_on_uncapped_content_grep() {
        let args = serde_json::json!({"pattern": "foo", "output_mode": "content", "-C": 3});
        let (updated, reason) = grep_cap_input(&args).expect("should cap");
        assert_eq!(updated["head_limit"], DEFAULT_GREP_HEAD_LIMIT);
        // Every original field survives — updatedInput replaces the whole input.
        assert_eq!(updated["pattern"], "foo");
        assert_eq!(updated["-C"], 3);
        assert!(reason.contains("head_limit"));
    }

    #[test]
    fn grep_cap_respects_agent_supplied_limit() {
        let args = serde_json::json!({"pattern": "foo", "output_mode": "content", "head_limit": 5});
        assert!(grep_cap_input(&args).is_none());
    }

    #[test]
    fn grep_cap_skips_cheap_output_modes() {
        for mode in ["files_with_matches", "count"] {
            let args = serde_json::json!({"pattern": "foo", "output_mode": mode});
            assert!(grep_cap_input(&args).is_none(), "mode {mode} should pass");
        }
        // No explicit mode: the tool default is not content, so nothing to cap.
        assert!(grep_cap_input(&serde_json::json!({"pattern": "foo"})).is_none());
    }

    #[test]
    fn grep_cap_emits_valid_pretooluse_rewrite() {
        let input = HookInput {
            tool_name: "Grep".to_string(),
            tool_input: serde_json::json!({"pattern": "foo", "output_mode": "content"}),
            raw_tool_name: "Grep".to_string(),
            session_id: String::new(),
        };
        let (updated, reason) = grep_cap_input(&input.tool_input).unwrap();
        let out = input_rewrite_output(&input, updated, &reason, false);
        let hso = &out["hookSpecificOutput"];
        assert_eq!(hso["hookEventName"], "PreToolUse");
        assert_eq!(hso["permissionDecision"], "allow");
        assert_eq!(hso["updatedInput"]["head_limit"], DEFAULT_GREP_HEAD_LIMIT);
        assert_eq!(hso["updatedInput"]["pattern"], "foo");
    }

    #[test]
    fn grep_cap_antigravity_uses_overwrite_shape() {
        let input = HookInput {
            tool_name: "Grep".to_string(),
            tool_input: serde_json::json!({"pattern": "foo", "output_mode": "content"}),
            raw_tool_name: "grep_search".to_string(),
            session_id: String::new(),
        };
        let (updated, reason) = grep_cap_input(&input.tool_input).unwrap();
        let out = input_rewrite_output(&input, updated, &reason, true);
        assert_eq!(out["decision"], "allow");
        assert_eq!(out["overwrite"]["name"], "grep_search");
        assert_eq!(
            out["overwrite"]["args"]["head_limit"],
            DEFAULT_GREP_HEAD_LIMIT
        );
    }

    #[test]
    fn bash_rewrite_output_has_required_hook_event_name() {
        // Claude Code ignores `hookSpecificOutput` (so the rewrite never applies)
        // unless `hookEventName` is present and set to "PreToolUse".
        let input = HookInput {
            tool_name: "Bash".to_string(),
            tool_input: serde_json::json!({"command": "git status"}),
            raw_tool_name: "Bash".to_string(),
            session_id: String::new(),
        };
        let out = bash_rewrite_output(&input, "git status --short", "test reason", false);
        let hso = &out["hookSpecificOutput"];
        assert_eq!(hso["hookEventName"], "PreToolUse");
        assert_eq!(hso["permissionDecision"], "allow");
        assert_eq!(hso["permissionDecisionReason"], "test reason");
        assert_eq!(hso["updatedInput"]["command"], "git status --short");
        // Aliases for non-Claude harnesses (Copilot/Codex) carry the same value.
        assert_eq!(hso["updatedInput"]["CommandLine"], "git status --short");
        assert_eq!(hso["updatedInput"]["commandLine"], "git status --short");
        assert_eq!(hso["updatedInput"]["command_line"], "git status --short");
    }

    #[test]
    fn antigravity_bash_rewrite_uses_native_allow_and_overwrite() {
        let input = HookInput::from_stdin(
            r#"{"toolCall":{"name":"run_command","args":{"CommandLine":"git status","Cwd":"."}}}"#,
        )
        .unwrap();
        let out = bash_rewrite_output(&input, "git status --short", "test reason", true);
        assert_eq!(out["decision"], "allow");
        assert_eq!(out["reason"], "test reason");
        assert_eq!(out["overwrite"]["name"], "run_command");
        assert_eq!(
            out["overwrite"]["args"]["CommandLine"],
            "git status --short"
        );
        assert_eq!(out["overwrite"]["args"]["Cwd"], ".");
    }
}