Function cmdline_needle 

pub fn cmdline_needle(tool_command: &str) -> String

The normalized command text a wire-tracked tool call is matched on. normalize_ws already trims, so a whitespace-only command yields the empty string and the caller can treat that as “no needle”.