Feature Request: Add sudo prefix support for command rewriting

Problem

The RTK auto-rewrite hook currently doesn't handle commands prefixed with sudo. This means commands like:

• sudo docker ps
• sudo docker logs <container>
• sudo git status

are not rewritten to their RTK equivalents, resulting in missed token savings when running commands that require elevated privileges.

Proposed Solution

Add logic to strip and preserve the sudo prefix (including flags like sudo -u user) before pattern matching, then restore it in the rewritten command.

Changes to .claude/hooks/rtk-rewrite.sh

1. Extract sudo prefix after env var extraction:

# Strip leading sudo (with optional flags) for pattern matching
# e.g., "sudo docker ps" → match against "docker ps"
# e.g., "sudo -u root docker ps" → match against "docker ps"
# Handles: sudo, sudo -u user, sudo -i, sudo -E, sudo -v, sudo -k, etc.
SUDO_PREFIX=""
if echo "$MATCH_CMD" | grep -qE '^sudo([[:space:]]|$)'; then
  # Extract sudo and any flags (but stop at the actual command)
  SUDO_PREFIX=$(echo "$MATCH_CMD" | grep -oE '^sudo([[:space:]]+-[A-Za-z]+([[:space:]]+[^[:space:]]+)?)*[[:space:]]+' || echo "")
  if [ -n "$SUDO_PREFIX" ]; then
    MATCH_CMD="${MATCH_CMD:${#SUDO_PREFIX}}"
    CMD_BODY="${CMD_BODY:${#SUDO_PREFIX}}"
  fi
fi

2. Update all REWRITTEN assignments to include ${SUDO_PREFIX}:

# Before
REWRITTEN="${ENV_PREFIX}rtk $CMD_BODY"

# After
REWRITTEN="${ENV_PREFIX}${SUDO_PREFIX}rtk $CMD_BODY"

Example Transformations

Testing

Verified working with:

echo '{"tool_input":{"command":"sudo docker ps"}}' | ~/.claude/hooks/rtk-rewrite.sh
# Output: {"hookSpecificOutput":{..."updatedInput":{"command":"sudo rtk docker ps"}}}

Notes

• The regex handles sudo, sudo -u user, sudo -i, sudo -E, and combinations
• Follows the same pattern already used for env var prefix handling

Start with .claude/hooks/rtk-rewrite.sh and trace the existing environment-variable prefix handling and every REWRITTEN assignment. Run the provided JSON echo command, then check sudo, sudo -u root, and the listed Docker and Git examples; done means the sudo prefix is preserved while the command is rewritten to use rtk.