rtk-ai__rtk/src/hook_audit_cmd.rs

use anyhow::{Context, Result};
use std::collections::HashMap;
use std::path::PathBuf;

/// Default log file location (aligned with hook's $HOME/.local/share/rtk/).
fn default_log_path() -> PathBuf {
    if let Ok(dir) = std::env::var("RTK_AUDIT_DIR") {
        PathBuf::from(dir).join("hook-audit.log")
    } else {
        let home = std::env::var("HOME").unwrap_or_else(|_| "/tmp".to_string());
        PathBuf::from(home)
            .join(".local/share/rtk")
            .join("hook-audit.log")
    }
}

/// A single parsed audit log entry.
struct AuditEntry {
    timestamp: String,
    action: String,
    original_cmd: String,
    _rewritten_cmd: String,
}

/// Parse a single log line: "timestamp | action | original_cmd | rewritten_cmd"
fn parse_line(line: &str) -> Option<AuditEntry> {
    let parts: Vec<&str> = line.splitn(4, " | ").collect();
    if parts.len() < 3 {
        return None;
    }
    Some(AuditEntry {
        timestamp: parts[0].to_string(),
        action: parts[1].to_string(),
        original_cmd: parts[2].to_string(),
        _rewritten_cmd: parts.get(3).unwrap_or(&"-").to_string(),
    })
}

/// Extract the base command (first 1-2 words) for grouping.
fn base_command(cmd: &str) -> String {
    // Strip env var prefixes (FOO=bar ...)
    let stripped = cmd
        .split_whitespace()
        .skip_while(|w| w.contains('='))
        .collect::<Vec<_>>();

    match stripped.len() {
        0 => cmd.to_string(),
        1 => stripped[0].to_string(),
        _ => format!("{} {}", stripped[0], stripped[1]),
    }
}

/// Filter entries to those within the last N days.
fn filter_since_days(entries: &[AuditEntry], days: u64) -> Vec<&AuditEntry> {
    if days == 0 {
        return entries.iter().collect();
    }

    let cutoff = chrono::Utc::now() - chrono::Duration::days(days as i64);
    let cutoff_str = cutoff.format("%Y-%m-%dT%H:%M:%SZ").to_string();

    entries
        .iter()
        .filter(|e| e.timestamp >= cutoff_str)
        .collect()
}

pub fn run(since_days: u64, verbose: u8) -> Result<()> {
    let log_path = default_log_path();

    if !log_path.exists() {
        println!("No audit log found at {}", log_path.display());
        println!("Enable audit mode: export RTK_HOOK_AUDIT=1 in your shell, then use Claude Code.");
        return Ok(());
    }

    let content = std::fs::read_to_string(&log_path)
        .context(format!("Failed to read {}", log_path.display()))?;

    let entries: Vec<AuditEntry> = content.lines().filter_map(parse_line).collect();

    if entries.is_empty() {
        println!("Audit log is empty.");
        return Ok(());
    }

    let filtered = filter_since_days(&entries, since_days);

    if filtered.is_empty() {
        println!("No entries in the last {} days.", since_days);
        return Ok(());
    }

    // Count by action
    let mut action_counts: HashMap<&str, usize> = HashMap::new();
    let mut cmd_counts: HashMap<String, usize> = HashMap::new();

    for entry in &filtered {
        *action_counts.entry(&entry.action).or_insert(0) += 1;
        if entry.action == "rewrite" {
            *cmd_counts
                .entry(base_command(&entry.original_cmd))
                .or_insert(0) += 1;
        }
    }

    let total = filtered.len();
    let rewrites = action_counts.get("rewrite").copied().unwrap_or(0);
    let skips = total - rewrites;
    let rewrite_pct = if total > 0 {
        rewrites as f64 / total as f64 * 100.0
    } else {
        0.0
    };
    let skip_pct = if total > 0 {
        skips as f64 / total as f64 * 100.0
    } else {
        0.0
    };

    // Period label
    let period = if since_days == 0 {
        "all time".to_string()
    } else {
        format!("last {} days", since_days)
    };

    println!("Hook Audit ({})", period);
    println!("{}", "─".repeat(30));
    println!("Total invocations: {}", total);
    println!("Rewrites:          {} ({:.1}%)", rewrites, rewrite_pct);
    println!("Skips:             {} ({:.1}%)", skips, skip_pct);

    // Skip breakdown
    let skip_actions: Vec<(&str, usize)> = action_counts
        .iter()
        .filter(|(k, _)| k.starts_with("skip:"))
        .map(|(k, v)| (*k, *v))
        .collect();

    if !skip_actions.is_empty() {
        let mut sorted_skips = skip_actions;
        sorted_skips.sort_by(|a, b| b.1.cmp(&a.1));
        for (action, count) in &sorted_skips {
            let reason = action.strip_prefix("skip:").unwrap_or(action);
            println!(
                "  {}:{}{}",
                reason,
                " ".repeat(14 - reason.len().min(13)),
                count
            );
        }
    }

    // Top commands (rewrites only)
    if !cmd_counts.is_empty() {
        let mut sorted_cmds: Vec<_> = cmd_counts.iter().collect();
        sorted_cmds.sort_by(|a, b| b.1.cmp(a.1));
        let top: Vec<String> = sorted_cmds
            .iter()
            .take(5)
            .map(|(cmd, count)| format!("{} ({})", cmd, count))
            .collect();
        println!("Top commands: {}", top.join(", "));
    }

    if verbose > 0 {
        println!("\nLog: {}", log_path.display());
    }

    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_parse_line_rewrite() {
        let line = "2026-02-16T14:30:01Z | rewrite | git status | rtk git status";
        let entry = parse_line(line).unwrap();
        assert_eq!(entry.action, "rewrite");
        assert_eq!(entry.original_cmd, "git status");
        assert_eq!(entry._rewritten_cmd, "rtk git status");
    }

    #[test]
    fn test_parse_line_skip() {
        let line = "2026-02-16T14:30:02Z | skip:no_match | echo hello | -";
        let entry = parse_line(line).unwrap();
        assert_eq!(entry.action, "skip:no_match");
        assert_eq!(entry.original_cmd, "echo hello");
    }

    #[test]
    fn test_parse_line_invalid() {
        assert!(parse_line("garbage").is_none());
        assert!(parse_line("").is_none());
    }

    #[test]
    fn test_base_command_simple() {
        assert_eq!(base_command("git status"), "git status");
        assert_eq!(base_command("cargo test --nocapture"), "cargo test");
    }

    #[test]
    fn test_base_command_with_env() {
        assert_eq!(base_command("GIT_PAGER=cat git status"), "git status");
        assert_eq!(base_command("NODE_ENV=test CI=1 npx vitest"), "npx vitest");
    }

    #[test]
    fn test_base_command_single_word() {
        assert_eq!(base_command("ls"), "ls");
        assert_eq!(base_command("pytest"), "pytest");
    }

    fn make_entry(action: &str, cmd: &str) -> AuditEntry {
        AuditEntry {
            timestamp: "2026-02-16T14:30:00Z".to_string(),
            action: action.to_string(),
            original_cmd: cmd.to_string(),
            _rewritten_cmd: "-".to_string(),
        }
    }

    #[test]
    fn test_filter_since_days_zero_returns_all() {
        let entries = vec![
            make_entry("rewrite", "git status"),
            make_entry("skip:no_match", "echo hi"),
        ];
        let result = filter_since_days(&entries, 0);
        assert_eq!(result.len(), 2);
    }

    #[test]
    fn test_token_savings() {
        // Simulate what rtk hook-audit would output vs raw log dump
        let raw_log = r#"2026-02-16T14:30:01Z | rewrite | git status | rtk git status
2026-02-16T14:30:02Z | skip:no_match | echo hello | -
2026-02-16T14:30:03Z | rewrite | cargo test | rtk cargo test
2026-02-16T14:30:04Z | skip:already_rtk | rtk git log | -
2026-02-16T14:30:05Z | rewrite | git log --oneline -10 | rtk git log --oneline -10
2026-02-16T14:30:06Z | rewrite | gh pr view 42 | rtk gh pr view 42
2026-02-16T14:30:07Z | skip:no_match | mkdir -p foo | -
2026-02-16T14:30:08Z | rewrite | cargo clippy --all-targets | rtk cargo clippy --all-targets"#;

        let entries: Vec<AuditEntry> = raw_log.lines().filter_map(parse_line).collect();
        assert_eq!(entries.len(), 8);

        let rewrites = entries.iter().filter(|e| e.action == "rewrite").count();
        assert_eq!(rewrites, 5);

        let skips = entries
            .iter()
            .filter(|e| e.action.starts_with("skip:"))
            .count();
        assert_eq!(skips, 3);

        // Compact output would be ~10 lines vs 8 raw lines — savings test:
        // The purpose of hook-audit is metrics, not filtering, so savings are moderate
        let input_tokens: usize = raw_log.split_whitespace().count();
        // Simulated compact output
        let compact = format!(
            "Hook Audit (all time)\nTotal: {}\nRewrites: {} ({:.1}%)\nSkips: {} ({:.1}%)\nTop: git status (1), cargo test (1)",
            entries.len(),
            rewrites,
            rewrites as f64 / entries.len() as f64 * 100.0,
            skips,
            skips as f64 / entries.len() as f64 * 100.0,
        );
        let output_tokens: usize = compact.split_whitespace().count();
        let savings = 100.0 - (output_tokens as f64 / input_tokens as f64 * 100.0);
        assert!(
            savings >= 30.0,
            "Expected >=30% savings for audit summary, got {:.1}%",
            savings
        );
    }
}