feat(qwen): add native hook integration

Author: lntutor

README.md

@@ -114,6 +114,7 @@ rtk gain        # Should show the savings dashboard
 # 1. Install for your AI tool
 rtk init -g                     # Claude Code / Copilot (default)
 rtk init -g --gemini            # Gemini CLI
+rtk init -g --qwen              # Qwen Code CLI
 rtk init -g --codex             # Codex (OpenAI)
 rtk init -g --agent cursor      # Cursor
 rtk init -g --agent windsurf    # Windsurf
@@ -381,7 +382,7 @@ rtk init -g
 
 ## Supported AI Tools
 
-RTK supports 15 AI coding tools. Each integration rewrites shell commands to `rtk` equivalents, reducing the bash output the agent reads where the agent supports command interception.
+RTK supports 16 AI coding tools. Each integration rewrites shell commands to `rtk` equivalents, reducing the bash output the agent reads where the agent supports command interception.
 
 | Tool | Install | Method |
 |------|---------|--------|
@@ -390,6 +391,7 @@ RTK supports 15 AI coding tools. Each integration rewrites shell commands to `rt
 | **GitHub Copilot CLI** | `rtk init -g --copilot` | PreToolUse deny-with-suggestion (CLI limitation) |
 | **Cursor** | `rtk init -g --agent cursor` | preToolUse hook (hooks.json) |
 | **Gemini CLI** | `rtk init -g --gemini` | BeforeTool hook |
+| **Qwen Code CLI** | `rtk init -g --qwen` | PreToolUse hook with native permission preservation |
 | **Codex** | `rtk init -g --codex` | AGENTS.md + RTK.md instructions |
 | **Windsurf** | `rtk init -g --agent windsurf` | .windsurfrules (project-scoped) |
 | **Cline / Roo Code** | `rtk init --agent cline` | .clinerules (project-scoped) |

src/hooks/README.md

@@ -6,7 +6,7 @@
 
 The **lifecycle management** layer for LLM agent hooks: install, uninstall, verify integrity, audit usage, and manage trust. This component creates and maintains the hook artifacts that live in `hooks/` (root), but does **not** execute rewrite logic itself — that lives in `discover/registry`.
 
-Owns: `rtk init` installation flows (5 agents via `AgentTarget` enum + 3 special modes: Gemini, Codex, OpenCode), SHA-256 integrity verification, hook version checking, audit log analysis, `rtk rewrite` CLI entry point, and TOML filter trust management.
+Owns: `rtk init` installation flows (agents via `AgentTarget` plus special Gemini, Qwen, Codex, and OpenCode modes), SHA-256 integrity verification, hook version checking, audit log analysis, `rtk rewrite` CLI entry point, and TOML filter trust management.
 
 Does **not** own: the deployed hook scripts themselves (that's `hooks/`), the rewrite pattern registry (that's `discover/`), or command filtering (that's `cmds/`).
 
@@ -88,6 +88,7 @@ Rules are loaded from all Claude Code `settings.json` files (project + global, i
 | Copilot VS Code (rtk hook copilot) | Yes | `permissionDecision: "ask"` — user prompted |
 | Cursor (rtk hook cursor) | Ready | `permission: "ask",` — users will be prompted when Cursor enforces the permission; in the meantime, allow |
 | Gemini CLI (rtk hook gemini) | No (allow/deny only) | allow (limitation — no ask mode in Gemini) |
+| Qwen Code (rtk hook qwen) | Yes | ask |
 | Copilot CLI (rtk hook copilot) | No updatedInput | deny-with-suggestion (unchanged) |
 | Codex | ask parsed but no-op | allow (limitation — fails open) |
 

src/hooks/constants.rs

@@ -1,5 +1,6 @@
 pub const REWRITE_HOOK_FILE: &str = "rtk-rewrite.sh";
 pub const GEMINI_HOOK_FILE: &str = "rtk-hook-gemini.sh";
+pub const QWEN_HOOK_FILE: &str = "rtk-hook-qwen.sh";
 pub const CLAUDE_DIR: &str = ".claude";
 pub const HOOKS_SUBDIR: &str = "hooks";
 pub const SETTINGS_JSON: &str = "settings.json";
@@ -23,6 +24,7 @@ pub const OPENCODE_PLUGIN_FILE: &str = "rtk.ts";
 pub const CURSOR_DIR: &str = ".cursor";
 pub const CODEX_DIR: &str = ".codex";
 pub const GEMINI_DIR: &str = ".gemini";
+pub const QWEN_DIR: &str = ".qwen";
 
 pub const GITHUB_DIR: &str = ".github";
 pub const COPILOT_HOOK_FILE: &str = "rtk-rewrite.json";

src/hooks/hook_check.rs

@@ -152,7 +152,7 @@ mod tests {
     use crate::hooks::constants::{
         CODEX_DIR, CONFIG_DIR, CURSOR_DIR, GEMINI_DIR, GEMINI_HOOK_FILE, HERMES_DIR,
         HERMES_PLUGINS_SUBDIR, HERMES_PLUGIN_MANIFEST_FILE, HERMES_PLUGIN_NAME,
-        OPENCODE_PLUGIN_FILE, OPENCODE_SUBDIR, PLUGIN_SUBDIR,
+        OPENCODE_PLUGIN_FILE, OPENCODE_SUBDIR, PLUGIN_SUBDIR, QWEN_DIR, QWEN_HOOK_FILE,
     };
 
     fn other_integration_installed(home: &std::path::Path) -> bool {
@@ -168,6 +168,7 @@ mod tests {
             home.join(GEMINI_DIR)
                 .join(HOOKS_SUBDIR)
                 .join(GEMINI_HOOK_FILE),
+            home.join(QWEN_DIR).join(HOOKS_SUBDIR).join(QWEN_HOOK_FILE),
             home.join(HERMES_DIR)
                 .join(HERMES_PLUGINS_SUBDIR)
                 .join(HERMES_PLUGIN_NAME)
@@ -288,6 +289,19 @@ mod tests {
         assert!(other_integration_installed(tmp.path()));
     }
 
+    #[test]
+    fn test_other_integration_qwen() {
+        let tmp = tempfile::tempdir().expect("tempdir");
+        let path = tmp
+            .path()
+            .join(QWEN_DIR)
+            .join(HOOKS_SUBDIR)
+            .join(QWEN_HOOK_FILE);
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(&path, b"hook").unwrap();
+        assert!(other_integration_installed(tmp.path()));
+    }
+
     #[test]
     fn test_other_integration_hermes() {
         let tmp = tempfile::tempdir().expect("tempdir");
@@ -308,6 +322,7 @@ mod tests {
         std::fs::create_dir_all(tmp.path().join(CURSOR_DIR).join(HOOKS_SUBDIR)).unwrap();
         std::fs::create_dir_all(tmp.path().join(CODEX_DIR)).unwrap();
         std::fs::create_dir_all(tmp.path().join(GEMINI_DIR)).unwrap();
+        std::fs::create_dir_all(tmp.path().join(QWEN_DIR)).unwrap();
         std::fs::create_dir_all(
             tmp.path()
                 .join(HERMES_DIR)

src/hooks/hook_cmd.rs

@@ -332,6 +332,115 @@ fn print_gemini(decision: &str, rewrite: Option<&str>) {
     let _ = writeln!(io::stdout(), "{}", gemini_json(decision, rewrite));
 }
 
+// ── Qwen Code hook ────────────────────────────────────────────
+
+/// Run the Qwen Code PreToolUse hook.
+pub fn run_qwen() -> Result<()> {
+    let input = read_stdin_limited()?;
+    let input = strip_leading_bom(&input).trim();
+    if input.is_empty() {
+        return Ok(());
+    }
+
+    let json: Value = match serde_json::from_str(input) {
+        Ok(value) => value,
+        Err(error) => {
+            let _ = writeln!(
+                io::stderr(),
+                "[rtk hook] Failed to parse JSON input: {error}"
+            );
+            return Ok(());
+        }
+    };
+
+    if json.get("tool_name").and_then(Value::as_str) != Some("run_shell_command") {
+        return Ok(());
+    }
+
+    let tool_input = json.get("tool_input").cloned().unwrap_or_else(|| json!({}));
+    let Some(command) = tool_input
+        .get("command")
+        .and_then(Value::as_str)
+        .filter(|command| !command.is_empty())
+    else {
+        return Ok(());
+    };
+
+    let configured_verdict = permissions::check_command_for(command, permissions::Host::Qwen);
+    let verdict = qwen_effective_verdict(
+        configured_verdict,
+        json.get("permission_mode").and_then(Value::as_str),
+    );
+    if let Some(output) = qwen_response(command, &tool_input, verdict) {
+        let _ = writeln!(io::stdout(), "{output}");
+    }
+
+    Ok(())
+}
+
+fn qwen_effective_verdict(
+    configured: PermissionVerdict,
+    permission_mode: Option<&str>,
+) -> PermissionVerdict {
+    if configured == PermissionVerdict::Default && permission_mode == Some("yolo") {
+        PermissionVerdict::Allow
+    } else {
+        configured
+    }
+}
+
+fn qwen_response(command: &str, tool_input: &Value, verdict: PermissionVerdict) -> Option<Value> {
+    match decide_from_verdict(command, verdict) {
+        HookDecision::Deny => {
+            audit_log("deny", command, "");
+            Some(qwen_json("deny", None))
+        }
+        HookDecision::AllowRewrite(rewritten) => {
+            audit_log("rewrite", command, &rewritten);
+            Some(qwen_json(
+                "allow",
+                Some(rewrite_tool_input(tool_input, &rewritten)),
+            ))
+        }
+        HookDecision::AskRewrite { rewritten, .. } => {
+            audit_log("ask", command, &rewritten);
+            Some(qwen_json(
+                "ask",
+                Some(rewrite_tool_input(tool_input, &rewritten)),
+            ))
+        }
+        HookDecision::Defer => None,
+    }
+}
+
+fn rewrite_tool_input(tool_input: &Value, rewritten: &str) -> Value {
+    let mut updated = tool_input.clone();
+    if let Some(object) = updated.as_object_mut() {
+        object.insert("command".to_string(), Value::String(rewritten.to_string()));
+        updated
+    } else {
+        json!({ "command": rewritten })
+    }
+}
+
+fn qwen_json(decision: &str, updated_input: Option<Value>) -> Value {
+    let mut hook_output = json!({
+        "hookEventName": PRE_TOOL_USE_KEY,
+        "permissionDecision": decision,
+        "permissionDecisionReason": if decision == "deny" {
+            "Blocked by RTK permission rule"
+        } else {
+            "RTK auto-rewrite"
+        }
+    });
+
+    if let Some(input) = updated_input {
+        hook_output["updatedInput"] = input;
+    }
+
+    json!({ "hookSpecificOutput": hook_output })
+}
+
 // ── Audit logging ─────────────────────────────────────────────
 
 /// Best-effort audit log when RTK_HOOK_AUDIT=1.
@@ -1682,6 +1791,83 @@ mod tests {
         assert_eq!(v["decision"], "deny");
     }
 
+    // --- Qwen Code rendering ---
+
+    #[test]
+    fn test_qwen_allow_emits_current_pre_tool_use_schema() {
+        let input = json!({ "command": "git status", "description": "Inspect worktree" });
+        let output = qwen_response("git status", &input, PermissionVerdict::Allow).unwrap();
+
+        assert_eq!(
+            output["hookSpecificOutput"]["hookEventName"],
+            PRE_TOOL_USE_KEY
+        );
+        assert_eq!(output["hookSpecificOutput"]["permissionDecision"], "allow");
+        assert_eq!(
+            output["hookSpecificOutput"]["updatedInput"]["command"],
+            "rtk git status"
+        );
+        assert_eq!(
+            output["hookSpecificOutput"]["updatedInput"]["description"],
+            "Inspect worktree"
+        );
+    }
+
+    #[test]
+    fn test_qwen_default_asks_with_rewritten_input() {
+        let input = json!({ "command": "cargo test" });
+        let output = qwen_response("cargo test", &input, PermissionVerdict::Default).unwrap();
+
+        assert_eq!(output["hookSpecificOutput"]["permissionDecision"], "ask");
+        assert_eq!(
+            output["hookSpecificOutput"]["updatedInput"]["command"],
+            "rtk cargo test"
+        );
+    }
+
+    #[test]
+    fn test_qwen_deny_omits_updated_input() {
+        let input = json!({ "command": "rm -rf /tmp/x" });
+        let output = qwen_response("rm -rf /tmp/x", &input, PermissionVerdict::Deny).unwrap();
+
+        assert_eq!(output["hookSpecificOutput"]["permissionDecision"], "deny");
+        assert!(output["hookSpecificOutput"].get("updatedInput").is_none());
+    }
+
+    #[test]
+    fn test_qwen_unsupported_or_unsafe_commands_defer_to_host() {
+        let unsupported = json!({ "command": "unknown-tool --flag" });
+        assert!(qwen_response(
+            "unknown-tool --flag",
+            &unsupported,
+            PermissionVerdict::Default
+        )
+        .is_none());
+        let unsafe_input = json!({ "command": "git status $(rm -rf /tmp/x)" });
+        assert!(qwen_response(
+            "git status $(rm -rf /tmp/x)",
+            &unsafe_input,
+            PermissionVerdict::Allow
+        )
+        .is_none());
+    }
+
+    #[test]
+    fn test_qwen_yolo_only_upgrades_default_permission() {
+        assert_eq!(
+            qwen_effective_verdict(PermissionVerdict::Default, Some("yolo")),
+            PermissionVerdict::Allow
+        );
+        assert_eq!(
+            qwen_effective_verdict(PermissionVerdict::Ask, Some("yolo")),
+            PermissionVerdict::Ask
+        );
+        assert_eq!(
+            qwen_effective_verdict(PermissionVerdict::Deny, Some("yolo")),
+            PermissionVerdict::Deny
+        );
+    }
+
     // --- Factory Droid hook ---
 
     fn droid_input(tool: &str, cmd: &str) -> String {