sypi-rtk

Forces every bash command through the rtk token-killer proxy. It hooks tool_call for the agent's bash tool — mutating input.command to rtk <command> in place — and user_bash for manual !/!! commands, where it returns custom BashOperations that wrap the command before delegating to a local shell backend. Compound shell constructs (pipes, &&, redirects, etc.) are left raw since rtk proxies single commands only. The explicit NORTK prefix is the escape hatch: the prefix is stripped, the command runs unproxied, and the bypass is appended to ~/.sypi/logs/rtk-bypass.log. rtk is a separate binary you install per machine — this extension does not ship or install it — so the binary is probed once at load and cached (honoring the rtk.binary settings override); when it is absent, commands run raw and a one-time notice is shown, rather than every bash call being rewritten to a missing binary and failing. If rtk is removed mid-session (after that probe), the first manual ! command it would have wrapped fails with "command not found"; the user_bash exec wrapper catches this, flips the cached flag to absent, shows the same one-time notice, and re-runs the command raw. No tool, no commands — hooks only.

Settings are host-resolved: the rtk block is read from the active global profile merged with the trusted project layer (rtk.binary, rtk.bypassPrefix). The factory probes it at load through readRegistrationScopedSettings; every handler re-reads it via ctx.readScopedSettings so changes stay live per event. The rewrite helpers come from the extension-api barrel (BYPASS_PREFIX, isBypass, stripBypass, wrapBash, logBypass); the local bash backend stays in local-bash.ts because this package's node-only stand-in and the barrel's local shell backend differ in surface.