@rune-kit/rune 2.10.0 → 2.12.0

package/compiler/adapters/hooks/cursor.js

@@ -0,0 +1,191 @@
+/**
+ * Cursor hooks adapter.
+ *
+ * Cursor has no PreToolUse/PostToolUse primitives. The closest analog is the
+ * `.cursor/rules/*.mdc` auto-attach system: rules with `alwaysApply: true` or
+ * glob-scoped rules inject guidance into the agent's prompt when editing
+ * matching files. This adapter emits Rune skill invocation reminders as rules.
+ *
+ * Fidelity vs Claude:
+ *   - preflight → rule (alwaysApply, agent sees it before every Edit)
+ *   - sentinel  → rule scoped to commit-related files
+ *   - dependency-doctor → rule scoped to package.json / lockfiles
+ *   - completion-gate → no analog (Cursor has no Stop hook) — documented in notes
+ *
+ * All Rune rule files are prefixed `rune-` for unambiguous detection.
+ */
+
+import { existsSync } from 'node:fs';
+import { readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { platformEntries, renderTierRule, unsupportedEntries } from './tier-emitter.js';
+
+export const id = 'cursor';
+
+const RULES_REL_DIR = '.cursor/rules';
+const RUNE_PREFIX = 'rune-';
+const AUTO_SIGNATURE = '@rune-kit/rune hook-dispatch';
+
+export function detect(projectRoot) {
+  return existsSync(path.join(projectRoot, '.cursor'));
+}
+
+export async function emit({ preset, projectRoot, tierManifests = [] }) {
+  if (preset === 'off' && tierManifests.length === 0) return uninstall({ projectRoot });
+  if (preset !== 'off' && preset !== 'strict' && preset !== 'gentle') {
+    throw new Error(`cursor adapter: invalid preset '${preset}'`);
+  }
+
+  const rulesDir = path.join(projectRoot, RULES_REL_DIR);
+  const mode = preset === 'strict' ? 'BLOCK' : 'WARN';
+  const ruleBase = { mode };
+
+  const rules = [
+    {
+      name: 'rune-preflight',
+      globs: ['**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx', '**/*.py', '**/*.go', '**/*.rs'],
+      alwaysApply: true,
+      skill: 'preflight',
+      description: 'Run Rune preflight before editing source files.',
+      detail: `Before editing any source file, mentally run through Rune's preflight checklist: logic preserved, error handling present, no regressions introduced. ${mode} if any concern surfaces.`,
+    },
+    {
+      name: 'rune-sentinel',
+      globs: ['**/*.sh', '**/*.Dockerfile', 'Dockerfile', '.github/workflows/*.yml', '.env*'],
+      alwaysApply: false,
+      skill: 'sentinel',
+      description: 'Security review before shell / infra / secret edits.',
+      detail: `Before running any Bash or editing infrastructure/env files, audit for secrets, destructive commands, and command injection. ${mode} on any finding.`,
+    },
+    {
+      name: 'rune-dependency-doctor',
+      globs: [
+        'package.json',
+        'package-lock.json',
+        'pnpm-lock.yaml',
+        'yarn.lock',
+        'requirements.txt',
+        'Cargo.toml',
+        'go.mod',
+      ],
+      alwaysApply: false,
+      skill: 'dependency-doctor',
+      description: 'Dependency health audit after lockfile edits.',
+      detail:
+        'After modifying any lockfile or manifest, run Rune dependency-doctor to check for outdated packages, CVEs, and breaking change risk.',
+    },
+  ];
+
+  const files =
+    preset === 'off'
+      ? []
+      : rules.map((r) => ({
+          path: path.join(rulesDir, `${r.name}.mdc`),
+          content: renderMdc({ ...r, ...ruleBase }),
+        }));
+
+  const notes =
+    preset === 'off'
+      ? []
+      : [
+          'Cursor has no Stop hook equivalent — `completion-gate` must be invoked manually via `/rune completion-gate`.',
+          `Auto-attach mode: ${preset}. Rules emit ${mode} guidance to the agent.`,
+        ];
+
+  for (const manifest of tierManifests) {
+    const tierMode = mode; // share preset mode with tier rules
+    for (const entry of platformEntries(manifest, 'cursor')) {
+      const content = renderTierRule(entry, 'cursor', { mode: tierMode, tier: manifest.tier });
+      if (!content) continue;
+      files.push({
+        path: path.join(rulesDir, `${RUNE_PREFIX}${manifest.tier}-${entry.id}.mdc`),
+        content,
+      });
+    }
+    const skipped = unsupportedEntries(manifest, 'cursor');
+    if (skipped.length > 0) {
+      notes.push(
+        `cursor: ${manifest.tier} skipped ${skipped.length} entr${skipped.length === 1 ? 'y' : 'ies'} (${skipped.map((e) => e.id).join(', ')}) — platform-unsupported or Claude-only.`,
+      );
+    }
+  }
+
+  return { files, notes };
+}
+
+export async function uninstall({ projectRoot }) {
+  const rulesDir = path.join(projectRoot, RULES_REL_DIR);
+  if (!existsSync(rulesDir)) return { files: [], notes: [] };
+
+  const entries = await readdir(rulesDir, { withFileTypes: true });
+  const runeFiles = entries.filter((e) => e.isFile() && e.name.startsWith(RUNE_PREFIX) && e.name.endsWith('.mdc'));
+
+  const files = [];
+  for (const file of runeFiles) {
+    const abs = path.join(rulesDir, file.name);
+    const content = await readFile(abs, 'utf-8');
+    if (content.includes(AUTO_SIGNATURE) || content.includes('rune-managed: true')) {
+      files.push({ path: abs, content: null });
+    }
+  }
+
+  return { files, notes: files.length === 0 ? ['no Rune-managed rules found'] : [] };
+}
+
+export async function status(projectRoot) {
+  const rulesDir = path.join(projectRoot, RULES_REL_DIR);
+  if (!existsSync(rulesDir)) {
+    return {
+      installed: false,
+      preset: null,
+      wired: [],
+      missing: ['preflight', 'sentinel', 'dependency-doctor'],
+      notes: ['no .cursor/rules directory'],
+    };
+  }
+  const entries = await readdir(rulesDir, { withFileTypes: true });
+  const runeFiles = entries.filter((e) => e.isFile() && e.name.startsWith(RUNE_PREFIX) && e.name.endsWith('.mdc'));
+  const wired = runeFiles.map((f) => f.name.replace(RUNE_PREFIX, '').replace('.mdc', ''));
+  const expected = ['preflight', 'sentinel', 'dependency-doctor'];
+  const missing = expected.filter((s) => !wired.includes(s));
+
+  let preset = null;
+  for (const file of runeFiles) {
+    const content = await readFile(path.join(rulesDir, file.name), 'utf-8');
+    if (/^mode: BLOCK$/m.test(content)) {
+      preset = 'strict';
+      break;
+    }
+    if (/^mode: WARN$/m.test(content)) preset = preset ?? 'gentle';
+  }
+
+  return {
+    installed: runeFiles.length > 0,
+    preset,
+    wired,
+    missing,
+    notes: ['completion-gate not available on Cursor'],
+  };
+}
+
+function renderMdc(rule) {
+  const frontmatter = [
+    '---',
+    `description: ${rule.description}`,
+    `globs: ${JSON.stringify(rule.globs)}`,
+    `alwaysApply: ${rule.alwaysApply}`,
+    'rune-managed: true',
+    `rune-skill: ${rule.skill}`,
+    `mode: ${rule.mode}`,
+    '---',
+  ].join('\n');
+  const body = [
+    `# Rune ${rule.skill}`,
+    '',
+    rule.detail,
+    '',
+    `_Auto-generated by \`rune hooks install\` (${AUTO_SIGNATURE})._`,
+    '_Do not hand-edit — changes will be overwritten. Delete the file to opt out._',
+  ].join('\n');
+  return `${frontmatter}\n\n${body}\n`;
+}

package/compiler/adapters/hooks/index.js

@@ -0,0 +1,82 @@
+/**
+ * Hooks adapter registry — per-platform emitters for `rune hooks install`.
+ *
+ * Each adapter exposes:
+ *   - id: platform key (e.g. 'claude', 'cursor')
+ *   - detect(projectRoot) → boolean  (presence of platform-specific dir)
+ *   - emit({preset, projectRoot}) → Promise<{ files: [{path, content, mode?}], notes: string[] }>
+ *   - uninstall({projectRoot}) → Promise<{ files: [{path, content|null, mode?}], notes: string[] }>
+ *     (content = null means delete the file)
+ *   - status(projectRoot) → Promise<{ installed: boolean, preset: string|null, wired: string[], missing: string[], notes: string[] }>
+ *
+ * The install command iterates adapters, calls emit, and writes files.
+ * Adapters NEVER write files themselves — they return a plan.
+ */
+
+import * as antigravity from './antigravity.js';
+import * as claude from './claude.js';
+import * as cursor from './cursor.js';
+import * as windsurf from './windsurf.js';
+
+export const ADAPTERS = Object.freeze({
+  claude,
+  cursor,
+  windsurf,
+  antigravity,
+});
+
+export const PLATFORM_KEYS = Object.freeze(Object.keys(ADAPTERS));
+
+export function getAdapter(id) {
+  const adapter = ADAPTERS[id];
+  if (!adapter) {
+    throw new Error(`Unknown hooks platform: ${id}. Choose from: ${PLATFORM_KEYS.join(', ')}`);
+  }
+  return adapter;
+}
+
+/**
+ * Auto-detect platforms present in the project. Returns ids with truthy detect().
+ */
+export function detectPlatforms(projectRoot) {
+  return PLATFORM_KEYS.filter((id) => ADAPTERS[id].detect?.(projectRoot));
+}
+
+/**
+ * Platform capability matrix — honest about what each can auto-fire.
+ * Consumed by `rune hooks status` and docs.
+ */
+export const CAPABILITIES = Object.freeze({
+  claude: {
+    maturity: 'stable',
+    preToolEdit: true,
+    preToolBash: true,
+    postToolEdit: true,
+    stop: true,
+    notes: 'Full hook parity — PreToolUse/PostToolUse/Stop all supported.',
+  },
+  cursor: {
+    maturity: 'beta',
+    preToolEdit: 'rule-injection',
+    preToolBash: false,
+    postToolEdit: false,
+    stop: false,
+    notes: 'No tool-level hooks. Uses auto-attach `.mdc` rules as best-effort pre-edit guidance.',
+  },
+  windsurf: {
+    maturity: 'beta',
+    preToolEdit: 'workflow',
+    preToolBash: 'workflow',
+    postToolEdit: false,
+    stop: false,
+    notes: 'Workflows fire on user command, not tool use. Cascade rules approximate auto-fire.',
+  },
+  antigravity: {
+    maturity: 'experimental',
+    preToolEdit: 'rule-injection',
+    preToolBash: false,
+    postToolEdit: false,
+    stop: false,
+    notes: 'Early platform; uses rule-injection fallback only.',
+  },
+});

package/compiler/adapters/hooks/tier-emitter.js

@@ -0,0 +1,182 @@
+/**
+ * Per-platform translation of tier manifest entries.
+ *
+ * Given a tier manifest (Pro / Business / future), each adapter asks this
+ * module for the platform-specific block it should write. Adapters still own
+ * file shape + uninstall semantics; this module only handles manifest → block.
+ *
+ * Keeping translation here (rather than re-implementing per adapter) means:
+ *   - one place to update when manifest schema evolves
+ *   - consistent behavior across adapters (no Cursor-specific drift)
+ *   - Free compiler stays tier-agnostic — any tier's manifest flows through
+ */
+
+export const AUTO_SIGNATURE = '@rune-kit/rune hook-dispatch';
+
+/**
+ * Build a Claude-format block from a tier manifest.
+ *
+ * Returns:
+ *   {
+ *     hooks: { UserPromptSubmit: [...], PreToolUse: [...], ... },
+ *     statusLine: { type, command, padding? } | null,
+ *     notes: string[]
+ *   }
+ */
+export function buildTierBlock(manifest, platformId) {
+  if (platformId !== 'claude') {
+    throw new Error(`buildTierBlock is claude-specific. For '${platformId}', use renderTierForPlatform.`);
+  }
+
+  const hooks = {};
+  let statusLine = null;
+  const notes = [];
+
+  for (const entry of manifest.entries) {
+    if (entry.event === 'statusLine') {
+      statusLine = {
+        type: 'command',
+        command: entry.command,
+        ...(typeof entry.padding === 'number' ? { padding: entry.padding } : {}),
+      };
+      continue;
+    }
+    // Explicit per-platform opt-out still honored even when building the Claude block
+    // (keeps the check symmetric with platformEntries()).
+    if (entry.platforms?.claude === 'unsupported') continue;
+
+    const event = entry.event;
+    const matcher = entry.matcher || '.*';
+    if (!hooks[event]) hooks[event] = [];
+
+    const existingGroup = hooks[event].find((g) => g.matcher === matcher);
+    const hookCmd = {
+      type: 'command',
+      command: entry.command,
+      async: entry.async === true,
+    };
+    if (existingGroup) {
+      existingGroup.hooks.push(hookCmd);
+    } else {
+      hooks[event].push({ matcher, hooks: [hookCmd] });
+    }
+  }
+
+  if (manifest.entries.some((e) => e.claudeOnly && e.event !== 'statusLine')) {
+    notes.push(`${manifest.tier}: some entries are Claude-only and were skipped on other platforms.`);
+  }
+
+  return { hooks, statusLine, notes };
+}
+
+/**
+ * Render a tier manifest entry for a rule-based platform (Cursor / Antigravity).
+ * Returns null if the entry does not apply to that platform.
+ */
+export function renderTierRule(entry, platformId, { mode, tier }) {
+  const hint = entry.platforms?.[platformId];
+  if (hint === 'unsupported' || entry.claudeOnly || entry.event === 'statusLine') return null;
+
+  const globs = entry.globs ?? defaultGlobsForEvent(entry.event);
+  const alwaysApply = hint === 'rule-alwaysApply' || entry.event === 'UserPromptSubmit';
+
+  const frontmatter = [
+    '---',
+    `description: Rune ${tier} ${entry.skill} — ${entry.description || 'tier hook'}`,
+    `globs: ${JSON.stringify(globs)}`,
+    `alwaysApply: ${alwaysApply}`,
+    'rune-managed: true',
+    `rune-tier: ${tier}`,
+    `rune-skill: ${entry.skill}`,
+    `rune-entry: ${entry.id}`,
+    `mode: ${mode}`,
+    '---',
+  ].join('\n');
+
+  const body = [
+    `# Rune ${tier}: ${entry.skill}`,
+    '',
+    entry.description || `Auto-invoke ${entry.skill} when the matching edit pattern fires.`,
+    '',
+    `Trigger: \`${entry.event}\`${entry.matcher ? ` matcher \`${entry.matcher}\`` : ''}.`,
+    `Mode: ${mode}.`,
+    '',
+    "On a matching operation, the agent should mentally run this skill's checklist before proceeding.",
+    `See the ${tier} skill \`${entry.skill}\` for the full guidance.`,
+    '',
+    `_Auto-generated by \`rune hooks install --tier ${tier}\` (${AUTO_SIGNATURE})._`,
+    '_Do not hand-edit — changes will be overwritten. Delete the file to opt out._',
+  ].join('\n');
+
+  return `${frontmatter}\n\n${body}\n`;
+}
+
+/**
+ * Render a Windsurf workflow file for a tier entry.
+ */
+export function renderTierWorkflow(entry, { mode, tier }) {
+  if (entry.claudeOnly || entry.event === 'statusLine' || entry.platforms?.windsurf === 'unsupported') return null;
+  return [
+    '---',
+    `description: Rune ${tier} ${entry.skill} — ${entry.description || 'tier hook'}`,
+    'rune-managed: true',
+    `rune-tier: ${tier}`,
+    `rune-skill: ${entry.skill}`,
+    `rune-entry: ${entry.id}`,
+    `mode: ${mode}`,
+    '---',
+    '',
+    `# /rune-${tier}-${entry.skill}`,
+    '',
+    entry.description || `Run before ${entry.event} operations.`,
+    '',
+    '## Steps',
+    '',
+    `1. Review target context for ${entry.skill} concerns.`,
+    `2. Apply Rune ${tier} skill guidance (see \`${tier}/skills/${entry.skill}/SKILL.md\`).`,
+    `3. Surface any finding — mode ${mode}.`,
+    '',
+    `_Auto-generated by \`rune hooks install --tier ${tier}\` (${AUTO_SIGNATURE})._`,
+    '',
+  ].join('\n');
+}
+
+/**
+ * Filter which entries a platform should emit rules/workflows for.
+ * Statusline + claudeOnly entries are filtered out centrally.
+ */
+export function platformEntries(manifest, platformId) {
+  return manifest.entries.filter((entry) => {
+    if (entry.event === 'statusLine') return false;
+    if (entry.claudeOnly) return false;
+    const hint = entry.platforms?.[platformId];
+    if (hint === 'unsupported') return false;
+    return true;
+  });
+}
+
+/**
+ * Unsupported / skipped entries — exposed so adapters can report them via notes.
+ */
+export function unsupportedEntries(manifest, platformId) {
+  return manifest.entries.filter((entry) => {
+    if (entry.claudeOnly && platformId !== 'claude') return true;
+    if (entry.event === 'statusLine' && platformId !== 'claude') return true;
+    const hint = entry.platforms?.[platformId];
+    return hint === 'unsupported';
+  });
+}
+
+function defaultGlobsForEvent(event) {
+  switch (event) {
+    case 'UserPromptSubmit':
+      return ['**/*'];
+    case 'PreToolUse':
+    case 'PostToolUse':
+      return ['**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx', '**/*.py', '**/*.go', '**/*.rs', '**/*.md'];
+    case 'Stop':
+      return ['**/*'];
+    default:
+      return ['**/*'];
+  }
+}

package/compiler/adapters/hooks/windsurf.js

@@ -0,0 +1,202 @@
+/**
+ * Windsurf hooks adapter.
+ *
+ * Windsurf exposes `.windsurf/workflows/*.md` — user-invoked step-by-step
+ * scripts — and `.windsurf/rules/*.md` — cascade rules that inject context.
+ *
+ * We emit BOTH:
+ *   - Workflows: `rune-<skill>.md` so the user can manually run `/rune-preflight`
+ *   - Rules:     `rune-<skill>-rule.md` that cascade-inject "run the workflow first"
+ *     reminders on matching globs
+ *
+ * Fidelity vs Claude: workflows are user-triggered, not tool-triggered, so
+ * true auto-fire isn't possible. Cascade rules are the closest analog to
+ * PreToolUse.
+ */
+
+import { existsSync } from 'node:fs';
+import { readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { platformEntries, renderTierRule, renderTierWorkflow, unsupportedEntries } from './tier-emitter.js';
+
+export const id = 'windsurf';
+
+const WORKFLOWS_REL_DIR = '.windsurf/workflows';
+const RULES_REL_DIR = '.windsurf/rules';
+const RUNE_PREFIX = 'rune-';
+const AUTO_SIGNATURE = '@rune-kit/rune hook-dispatch';
+
+export function detect(projectRoot) {
+  return existsSync(path.join(projectRoot, '.windsurf'));
+}
+
+export async function emit({ preset, projectRoot, tierManifests = [] }) {
+  if (preset === 'off' && tierManifests.length === 0) return uninstall({ projectRoot });
+  if (preset !== 'off' && preset !== 'strict' && preset !== 'gentle') {
+    throw new Error(`windsurf adapter: invalid preset '${preset}'`);
+  }
+
+  const mode = preset === 'strict' ? 'BLOCK' : 'WARN';
+  const skills = [
+    {
+      name: 'preflight',
+      trigger: 'editing source files',
+      globs: ['**/*.ts', '**/*.tsx', '**/*.js', '**/*.py', '**/*.go', '**/*.rs'],
+    },
+    {
+      name: 'sentinel',
+      trigger: 'editing infra / running shell',
+      globs: ['**/*.sh', 'Dockerfile', '.github/workflows/*.yml', '.env*'],
+    },
+    {
+      name: 'dependency-doctor',
+      trigger: 'editing manifests / lockfiles',
+      globs: ['package.json', '*lock*', 'Cargo.toml', 'go.mod', 'requirements.txt'],
+    },
+  ];
+
+  const workflowsDir = path.join(projectRoot, WORKFLOWS_REL_DIR);
+  const rulesDir = path.join(projectRoot, RULES_REL_DIR);
+
+  const files = [];
+  if (preset !== 'off') {
+    for (const skill of skills) {
+      files.push({
+        path: path.join(workflowsDir, `${RUNE_PREFIX}${skill.name}.md`),
+        content: renderWorkflow(skill, mode),
+      });
+      files.push({
+        path: path.join(rulesDir, `${RUNE_PREFIX}${skill.name}-rule.md`),
+        content: renderRule(skill, mode),
+      });
+    }
+  }
+
+  const notes =
+    preset === 'off'
+      ? []
+      : [
+          'Windsurf workflows are user-invoked. Auto-fire is emulated via cascade rules only.',
+          `Preset: ${preset} (${mode}). No Stop/PostToolUse equivalent — completion-gate is manual.`,
+        ];
+
+  for (const manifest of tierManifests) {
+    for (const entry of platformEntries(manifest, 'windsurf')) {
+      const workflow = renderTierWorkflow(entry, { mode, tier: manifest.tier });
+      const rule = renderTierRule(entry, 'windsurf', { mode, tier: manifest.tier });
+      if (workflow) {
+        files.push({
+          path: path.join(workflowsDir, `${RUNE_PREFIX}${manifest.tier}-${entry.id}.md`),
+          content: workflow,
+        });
+      }
+      if (rule) {
+        files.push({
+          path: path.join(rulesDir, `${RUNE_PREFIX}${manifest.tier}-${entry.id}-rule.md`),
+          content: rule,
+        });
+      }
+    }
+    const skipped = unsupportedEntries(manifest, 'windsurf');
+    if (skipped.length > 0) {
+      notes.push(
+        `windsurf: ${manifest.tier} skipped ${skipped.length} entr${skipped.length === 1 ? 'y' : 'ies'} (${skipped.map((e) => e.id).join(', ')}) — platform-unsupported or Claude-only.`,
+      );
+    }
+  }
+
+  return { files, notes };
+}
+
+export async function uninstall({ projectRoot }) {
+  const files = [];
+  for (const rel of [WORKFLOWS_REL_DIR, RULES_REL_DIR]) {
+    const dir = path.join(projectRoot, rel);
+    if (!existsSync(dir)) continue;
+    const entries = await readdir(dir, { withFileTypes: true });
+    const runeFiles = entries.filter((e) => e.isFile() && e.name.startsWith(RUNE_PREFIX) && e.name.endsWith('.md'));
+    for (const file of runeFiles) {
+      const abs = path.join(dir, file.name);
+      const content = await readFile(abs, 'utf-8');
+      if (content.includes(AUTO_SIGNATURE) || content.includes('rune-managed: true')) {
+        files.push({ path: abs, content: null });
+      }
+    }
+  }
+  return { files, notes: files.length === 0 ? ['no Rune-managed windsurf files found'] : [] };
+}
+
+export async function status(projectRoot) {
+  const dir = path.join(projectRoot, WORKFLOWS_REL_DIR);
+  if (!existsSync(dir)) {
+    return {
+      installed: false,
+      preset: null,
+      wired: [],
+      missing: ['preflight', 'sentinel', 'dependency-doctor'],
+      notes: ['no .windsurf/workflows directory'],
+    };
+  }
+  const entries = await readdir(dir, { withFileTypes: true });
+  const runeFiles = entries.filter((e) => e.isFile() && e.name.startsWith(RUNE_PREFIX) && e.name.endsWith('.md'));
+  const wired = runeFiles.map((f) => f.name.replace(RUNE_PREFIX, '').replace('.md', ''));
+  const expected = ['preflight', 'sentinel', 'dependency-doctor'];
+  const missing = expected.filter((s) => !wired.includes(s));
+
+  let preset = null;
+  for (const file of runeFiles) {
+    const content = await readFile(path.join(dir, file.name), 'utf-8');
+    if (/^mode: BLOCK$/m.test(content)) {
+      preset = 'strict';
+      break;
+    }
+    if (/^mode: WARN$/m.test(content)) preset = preset ?? 'gentle';
+  }
+
+  return { installed: runeFiles.length > 0, preset, wired, missing, notes: [] };
+}
+
+function renderWorkflow(skill, mode) {
+  return [
+    '---',
+    `description: Rune ${skill.name} — run when ${skill.trigger}`,
+    'rune-managed: true',
+    `rune-skill: ${skill.name}`,
+    `mode: ${mode}`,
+    '---',
+    '',
+    `# /rune-${skill.name}`,
+    '',
+    `Run before ${skill.trigger}. Mode: ${mode}.`,
+    '',
+    '## Steps',
+    '',
+    `1. Review the target files for ${skill.name} concerns.`,
+    `2. Apply Rune skill guidance (see \`skills/${skill.name}/SKILL.md\`).`,
+    `3. If findings emerge: ${mode} and surface to the user.`,
+    '',
+    `_Auto-generated by \`rune hooks install\` (${AUTO_SIGNATURE})._`,
+    '',
+  ].join('\n');
+}
+
+function renderRule(skill, mode) {
+  return [
+    '---',
+    `description: Auto-invoke /rune-${skill.name} when ${skill.trigger}`,
+    `globs: ${JSON.stringify(skill.globs)}`,
+    'alwaysApply: false',
+    'rune-managed: true',
+    `rune-skill: ${skill.name}`,
+    `mode: ${mode}`,
+    '---',
+    '',
+    `# Rune ${skill.name} cascade rule`,
+    '',
+    `When ${skill.trigger}, invoke \`/rune-${skill.name}\` workflow before committing the change.`,
+    `Mode: ${mode}. If the workflow surfaces a finding, ${mode} and report to user.`,
+    '',
+    `_Auto-generated by \`rune hooks install\` (${AUTO_SIGNATURE})._`,
+    '',
+  ].join('\n');
+}