@rune-kit/rune 2.11.0 → 2.12.2

package/skills/onboard/scripts/onboard-invariants.js

@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+
+/**
+ * onboard-invariants.js — Orchestrate invariant detection, INVARIANTS.md
+ * generation (merge-preserving), and CLAUDE.md pointer injection.
+ *
+ * Writes/updates:
+ *   - .rune/INVARIANTS.md       (seeded from template, append-only on re-run)
+ *   - CLAUDE.md                 (pointer block between markers)
+ *
+ * Safe re-runs:
+ *   - Existing user sections above the auto-detected block are preserved.
+ *   - New detections land under `## Auto-detected (new)` — never overwrite.
+ *
+ * Usage as CLI:
+ *   node onboard-invariants.js --root <project-root> [--dry]
+ */
+
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseArgs } from 'node:util';
+import { detectInvariants, renderInvariants } from './detect-invariants.js';
+import { applyInvariantsPointer } from './inject-claude-md.js';
+
+const AUTO_HEADER = '## Auto-detected (new)';
+const TEMPLATE_REL_PATH = '../references/invariants-template.md';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+/**
+ * Locate the next `## `-level section boundary in `text`, ignoring any `##`
+ * lines that appear inside fenced code blocks (``` or ~~~).
+ * Returns the index of the start of the boundary line, or -1 if none.
+ */
+function findNextSectionOffset(text) {
+  let offset = 0;
+  let inFence = false;
+  let fenceDelim = null;
+  while (offset < text.length) {
+    const eol = text.indexOf('\n', offset);
+    const lineEnd = eol === -1 ? text.length : eol;
+    const line = text.slice(offset, lineEnd);
+    const trimmed = line.trimStart();
+    if (inFence) {
+      if (trimmed.startsWith(fenceDelim)) {
+        inFence = false;
+        fenceDelim = null;
+      }
+    } else {
+      if (trimmed.startsWith('```') || trimmed.startsWith('~~~')) {
+        inFence = true;
+        fenceDelim = trimmed.startsWith('```') ? '```' : '~~~';
+      } else if (line.startsWith('## ') && !line.startsWith(AUTO_HEADER)) {
+        return offset;
+      }
+    }
+    if (eol === -1) break;
+    offset = eol + 1;
+  }
+  return -1;
+}
+
+export async function loadTemplate(templatePath) {
+  const resolved = templatePath ?? path.resolve(__dirname, TEMPLATE_REL_PATH);
+  return readFile(resolved, 'utf8');
+}
+
+export function mergeInvariantsContent({ existing, autoDetected, template }) {
+  const freshBody = renderAutoDetectedBlock(autoDetected);
+
+  if (!existing || existing.trim().length === 0) {
+    return replaceAutoBlock(template, freshBody, { seeded: true });
+  }
+
+  if (!existing.includes(AUTO_HEADER)) {
+    const trailing = existing.endsWith('\n') ? '' : '\n';
+    const appended = `${existing}${trailing}\n---\n\n${AUTO_HEADER}\n\n${freshBody}\n`;
+    return { content: appended, seeded: false, replaced: false, appended: true };
+  }
+
+  return replaceAutoBlock(existing, freshBody, { seeded: false });
+}
+
+function replaceAutoBlock(source, freshBody, { seeded }) {
+  const headerIdx = source.indexOf(AUTO_HEADER);
+  if (headerIdx === -1) {
+    const trailing = source.endsWith('\n') ? '' : '\n';
+    return {
+      content: `${source}${trailing}\n${AUTO_HEADER}\n\n${freshBody}\n`,
+      seeded,
+      replaced: false,
+      appended: true,
+    };
+  }
+
+  const afterHeader = source.slice(headerIdx + AUTO_HEADER.length);
+  const nextOffsetRaw = findNextSectionOffset(afterHeader);
+  const nextOffset = nextOffsetRaw === -1 ? afterHeader.length : nextOffsetRaw;
+
+  const before = source.slice(0, headerIdx);
+  const after = afterHeader.slice(nextOffset);
+  const replaced = `${before}${AUTO_HEADER}\n\n${freshBody}\n\n${after.replace(/^\n+/, '')}`;
+
+  return { content: replaced, seeded, replaced: true, appended: false };
+}
+
+function renderAutoDetectedBlock(result) {
+  const total =
+    (result?.danger?.length ?? 0) +
+    (result?.critical?.length ?? 0) +
+    (result?.state?.length ?? 0) +
+    (result?.cross?.length ?? 0);
+  if (total === 0) return '_No new detections on this run._';
+  return renderInvariants(result).trimEnd();
+}
+
+export function collectPointerGlobs(result, limit = 8) {
+  const danger = (result?.danger ?? []).map((e) => firstWhere(e)).filter(Boolean);
+  const critical = (result?.critical ?? []).map((e) => firstWhere(e)).filter(Boolean);
+  return Array.from(new Set([...danger, ...critical])).slice(0, limit);
+}
+
+function firstWhere(entry) {
+  if (!entry) return null;
+  if (Array.isArray(entry.where)) return entry.where[0] ?? null;
+  return entry.where ?? null;
+}
+
+export async function runOnboardInvariants({ root, dryRun = false, templatePath } = {}) {
+  if (!root) throw new Error('root is required');
+
+  const runeDir = path.join(root, '.rune');
+  const invariantsPath = path.join(runeDir, 'INVARIANTS.md');
+  const claudeMdPath = path.join(root, 'CLAUDE.md');
+
+  const result = await detectInvariants({ root });
+  const rendered = renderInvariants(result);
+  const template = await loadTemplate(templatePath);
+
+  const existing = existsSync(invariantsPath) ? await readFile(invariantsPath, 'utf8') : '';
+  const merged = mergeInvariantsContent({ existing, autoDetected: result, template });
+
+  if (!dryRun) {
+    await mkdir(runeDir, { recursive: true });
+    await writeFile(invariantsPath, merged.content, 'utf8');
+  }
+
+  const globs = collectPointerGlobs(result);
+  const pointer = await applyInvariantsPointer({
+    claudeMdPath,
+    globs,
+    invariantsPath: path.relative(root, invariantsPath).replaceAll('\\', '/'),
+    dryRun,
+  });
+
+  return {
+    invariants: {
+      path: invariantsPath,
+      action: merged.seeded ? 'seeded' : merged.replaced ? 'replaced' : merged.appended ? 'appended' : 'noop',
+      stats: result.stats ?? null,
+      detected: {
+        danger: result.danger?.length ?? 0,
+        critical: result.critical?.length ?? 0,
+        state: result.state?.length ?? 0,
+        cross: result.cross?.length ?? 0,
+      },
+    },
+    claudeMd: {
+      path: pointer.path,
+      action: pointer.action,
+      reason: pointer.reason ?? null,
+    },
+    rendered,
+  };
+}
+
+async function main() {
+  const { values } = parseArgs({
+    options: {
+      root: { type: 'string' },
+      dry: { type: 'boolean', default: false },
+    },
+  });
+
+  const root = values.root ?? process.cwd();
+  const result = await runOnboardInvariants({ root, dryRun: values.dry });
+  console.log(JSON.stringify(result, null, 2));
+}
+
+if (import.meta.url === `file://${process.argv[1]}` || process.argv[1]?.endsWith('onboard-invariants.js')) {
+  main().catch((err) => {
+    console.error(err.message);
+    process.exit(1);
+  });
+}

package/skills/perf/SKILL.md

@@ -37,6 +37,7 @@ Performance regression gate. Analyzes code changes for patterns that cause measu
 - `audit` (L2): performance dimension delegation
 - `review` (L2): performance patterns detected in diff
 - `deploy` (L2): pre-deploy perf regression check
+- `adversary` (L2): scalability stress test when bottleneck patterns detected in plan
 
 ## References
 

package/skills/plan/SKILL.md

@@ -97,6 +97,8 @@ High-level multi-feature planning — organize features into milestones.
 - `scaffold` (L1): Phase 3 architecture planning
 - `skill-forge` (L2): plan structure for new skill
 - User: `/rune plan` direct invocation
+- `debug` (L2): when root cause requires architectural changes
+- `retro` (L2): reference past plans during retrospective analysis
 
 ## Data Flow
 

package/skills/preflight/SKILL.md

@@ -3,7 +3,7 @@ name: preflight
 description: Pre-commit quality gate that catches "almost right" code. Goes beyond linting — checks logic correctness, error handling, regressions, and completeness.
 metadata:
   author: runedev
-  version: "0.8.0"
+  version: "1.0.0"
   layer: L2
   model: sonnet
   group: quality

package/skills/research/SKILL.md

@@ -27,6 +27,10 @@ None — pure L3 utility using `WebSearch` and `WebFetch` tools directly.
 - `marketing` (L2): competitor analysis, SEO data
 - `hallucination-guard` (L3): verify package existence on npm/pypi
 - `autopsy` (L2): research best practices for legacy patterns
+- `ba` (L2): research similar products and integrations
+- `graft` (L2): research source repo patterns before grafting
+- `mcp-builder` (L2): research MCP standards and existing implementations
+- `scaffold` (L1): research project templates and best practices
 
 ## Execution
 

package/skills/review/SKILL.md

@@ -3,7 +3,7 @@ name: review
 description: Code quality review — patterns, security, performance, correctness. Finds bugs, suggests improvements, triggers fix for issues found. Escalates to opus for security-critical code.
 metadata:
   author: runedev
-  version: "0.8.0"
+  version: "1.0.0"
   layer: L2
   model: sonnet
   group: development
@@ -52,6 +52,8 @@ Every review MUST cite at least one specific concern, suggestion, or explicit ap
 - User: `/rune review` direct invocation
 - `surgeon` (L2): review refactored code quality
 - `rescue` (L1): review refactored code quality
+- `design` (L2): review UI/design implementation quality
+- `graft` (L2): review grafted code integration
 
 ## Cross-Hub Connections
 
@@ -564,7 +566,7 @@ Append to Code Review Report when invoked standalone. Suppress when called as su
 ```yaml
 chain_metadata:
   skill: "rune:review"
-  version: "0.8.0"
+  version: "1.0.0"
   status: "[DONE | DONE_WITH_CONCERNS]"
   domain: "[area reviewed]"
   files_changed: []  # review doesn't change files

package/skills/scope-guard/SKILL.md

@@ -19,7 +19,10 @@ Passive scope monitor. Reads the original task plan, inspects current git diff t
 
 ## Called By (inbound)
 
-- Auto-triggered by L1 orchestrators when files changed exceed plan expectations
+- `cook` (L1): Phase 6.6 scope drift detection when files touched > planned
+- `team` (L1): after each parallel workstream completes, before merge
+- `rescue` (L1): during safeguard phase to detect unplanned changes
+- `plan` (L2): optional scope validation after plan acceptance
 
 ## Calls (outbound)
 

package/skills/scout/SKILL.md

@@ -198,6 +198,12 @@ None — pure scanner using Glob, Grep, Read, and Bash tools directly. Does not
 - `perf` (L2): find hotpath files and performance-critical code
 - `review-intake` (L2): scan codebase for review context
 - `skill-forge` (L2): scan existing skills for patterns when creating new skills
+- `ba` (L2): scan existing codebase for context before requirements elicitation
+- `retro` (L2): scan commit history and codebase for retrospective analysis
+- `graft` (L2): scan target codebase before grafting code from external repo
+- `docs` (L2): scan codebase structure for documentation generation
+- `logic-guardian` (L2): scan business logic modules for protection mapping
+- `adversary` (L2): scan codebase before red-team analysis
 
 ## Output Format
 

package/skills/sentinel/SKILL.md

@@ -47,6 +47,8 @@ If status is BLOCK, output the report and STOP. Do not hand off to commit. The c
 - `audit` (L2): Phase 2 full security audit
 - `incident` (L2): security dimension check during incident response
 - `review-intake` (L2): security scan on code submitted for structured review
+- `adversary` (L2): deep security analysis when attack vectors identified in plan
+- `scaffold` (L1): security baseline for new projects
 
 ## Severity Levels
 

package/skills/session-bridge/SKILL.md

@@ -3,12 +3,13 @@ name: session-bridge
 description: Universal context persistence across sessions. Auto-saves decisions, conventions, and progress to .rune/ files. Loads state at session start. Use when any skill makes architectural decisions or establishes patterns that must survive session boundaries.
 metadata:
   author: runedev
-  version: "0.6.0"
+  version: "0.7.0"
   layer: L3
   model: haiku
   group: state
   tools: "Read, Write, Edit, Glob, Grep"
   listen: phase.complete, checkpoint.request
+  emit: invariants.loaded
 ---
 
 # session-bridge
@@ -37,6 +38,8 @@ Solve the #1 developer complaint: context loss across sessions. Session-bridge a
 - `cook` (L1): auto-save decisions during feature implementation
 - `rescue` (L1): state management throughout refactoring
 - `context-engine` (L3): save state before compaction
+- `context-pack` (L3): coordinate state for sub-agent handoff
+- `neural-memory` (L3): sync key decisions back to `.rune/` files after Capture Mode
 
 ## State Files Managed
 
@@ -354,6 +357,54 @@ Handle results:
 - `SUSPICIOUS` → present warning to user with specific findings. Ask: "Suspicious patterns detected in .rune/ files. Load anyway?" If user approves → proceed. If not → exit load mode.
 - `TAINTED` → **BLOCK load**. Report: ".rune/ integrity check FAILED — possible poisoning detected. Run `/rune integrity` for details."
 
+#### Step 1.7 — Load invariants (auto-discipline)
+
+Before loading the usual state files, run the invariants loader so the agent sees active discipline rules without being told to look:
+
+```
+Execute: node skills/session-bridge/scripts/load-invariants.js --root <project-root> --json
+```
+
+The loader:
+- Reads `.rune/INVARIANTS.md` (silent no-op if missing)
+- Strips the `## Archived` section (retired rules don't re-activate)
+- Parses active rules into `{ section, title, what, where, why }`
+- Returns a token-budgeted preview (≤ 500 tokens by default)
+- Flags staleness when mtime > 30 days
+
+**Emit signal**: `invariants.loaded` with payload `{ loaded, count, rules, stats, stale, overflow, path }` where:
+- `loaded` (boolean) — whether any active rules were parsed
+- `count` (number) — total active rules (convenience alias for `stats.total`)
+- `rules` (array) — full rule objects `[{ section, title, what, where: string[], why }]` — consumers cache these for glob matching
+- `stats` — `{ danger, critical, state, cross, total, archivedSkipped }`
+- `stale` (boolean) — mtime > 30 days
+- `overflow` (number) — rules present but not shown in preview (budget overflow)
+- `path` (string) — absolute path to `.rune/INVARIANTS.md`
+
+Downstream listeners (`logic-guardian`, Pro `autopilot`) consume `rules[]` directly — no second file read needed.
+
+**Present to agent** (injected verbatim into the Load Mode summary):
+
+```
+📎 Active Invariants (.rune/INVARIANTS.md)
+⚠  skills/skill-router/** — L0 router, never bypass
+🔒  compiler/parser.js — IR schema is the adapter contract
+🔁  compiler/hooks/dispatch.js — phase order is pre → run → post
+🔗  .claude-plugin/marketplace.json — mirrors plugin.json
+…+2 more rules in .rune/INVARIANTS.md
+```
+
+**Staleness warning** (emit ONCE per session, not per tool call):
+
+```
+⚠ Invariants file is stale (> 30 days since last onboard). Consider `rune onboard --refresh`.
+```
+
+**Failure modes**:
+- Missing file → silent no-op (no preview, no error). Don't nag fresh repos.
+- Malformed file → `loaded: false, rules: []`. Log a single-line warning, continue.
+- File fails `integrity-check` in Step 1.5 → this step is skipped entirely (load already blocked).
+
 #### Step 2 — Load files
 
 Use `Read` on all four state files in parallel:
@@ -474,6 +525,7 @@ At Load Mode Step 1, after checking `.rune/*.md` existence, also check for `.run
 ## Session Bridge — Loaded
 - **Last session**: [date and summary]
 - **Checkpoint**: [detected — resume point] | [none]
+- **Invariants**: [N loaded from .rune/INVARIANTS.md] | [none] | [stale — run rune onboard --refresh]
 - **Decisions on file**: [count]
 - **Conventions on file**: [count]
 - **Learnings on file**: [count] (top 5 surfaced if 10+)