rtk discover undercounts RTK adoption when PreToolUse hook is active

[Hiraly-wang]

Summary

When the recommended Claude Code PreToolUse hook (rtk hook claude) is configured
and actively rewriting commands, rtk discover reports adoption as ~0% and lists
already-rewritten commands as "missed savings". The hook is working correctly —
only the reporting is wrong.

Environment

• rtk: 0.40.0 (also reproduced on 0.39.0)
• OS: Ubuntu 22.04 x86_64
• Claude Code with ~/.claude/settings.json:

  "PreToolUse": [{
    "matcher": "Bash",
    "hooks": [{ "type": "command", "command": "rtk hook claude" }]
  }]

Symptoms

rtk discover reports:

Scanned: 172 sessions (last 30 days), 4063 Bash commands
Already using RTK: 6 commands (0.1%)
...
git status       662    rtk git    existing    ~87.9K tokens
grep -n          581    rtk grep   existing    ~99.8K tokens
ls -la           463    rtk ls     existing    ~27.4K tokens

Yet rtk gain shows 1154+ rewritten commands with 520K+ tokens saved over
the same window, and the hook itself works correctly (verified via
echo '{"tool_name":"Bash","tool_input":{"command":"git status"}}' | rtk hook claude
returning the expected updatedInput.command = "rtk git status").

Root cause

Claude Code session logs (~/.claude/projects/**/*.jsonl) record:

1. The original user input under the top-level "command" field —
   always pre-rewrite, e.g. "command":"git status"
2. The hook rewrite nested inside the hook output as escaped JSON, e.g.
   \"command\":\"rtk git status\" (inside RTK auto-rewrite / updatedInput
   payloads)

rtk discover appears to scan only the top-level "command" field via a
pattern like `grep '"command":"rtk '`, so it never sees the rewritten form
even when the hook is rewriting 100% of Bash invocations.

Evidence from a single session today

RTK auto-rewrite occurrences:        67
updatedInput occurrences:            67
Top-level "command":"git status":     0
Top-level "command":"rtk git status": 0
Escaped \"command\":\"rtk ...\":     many (nested in hook output)

So actual hook coverage was 100%, but discover still classified every
underlying git status / ls -la etc. as "missed".

Impact

For users who already follow the README and install the hook, rtk discover
produces misleading output:

• "Already using RTK" massively understated (0.1% vs ~100% reality)
• "Missed savings" massively overstated (counts already-saved tokens as missed)

This makes the command hard to use for its intended purpose (showing real
opportunities to add new command wrappers, e.g. python, git checkout).

Suggested fix

Either:

1. When scanning session logs, also look for the RTK auto-rewrite /
   updatedInput.command nested payload and count those as "already using RTK".
2. Or cross-reference rtk's own local telemetry (which rtk gain already
   exposes accurately) to subtract hook-rewritten commands from the "missed"
   list.

Option 2 is probably simpler since rtk gain already has the ground truth.

Workaround for users

Right now, configured-hook users should rely on rtk gain and ignore the
adoption % from rtk discover. The "Top Unhandled Commands" section of
discover is still useful for finding genuinely unsupported commands.