@rune-kit/rune 2.16.1 → 2.18.0

package/README.md

@@ -5,7 +5,7 @@
 <p align="center">
   <strong>Less skills. Deeper connections.</strong><br>
   A lean, interconnected skill ecosystem for AI coding assistants.<br>
-  63 skills · 215+ mesh connections · 8 platforms · MIT
+  64 skills · 203 connections · 40 signals · 13 platforms · MIT
 </p>
 
 <p align="center">
@@ -16,14 +16,14 @@
 </p>
 
 <p align="center">
-  <strong>Claude Code</strong> (native plugin) · <strong>Cursor</strong> · <strong>Windsurf</strong> · <strong>Google Antigravity</strong> · <strong>OpenAI Codex</strong> · <strong>OpenCode</strong> · any AI IDE
+  <strong>Claude Code</strong> (native plugin) · <strong>Cursor</strong> · <strong>Windsurf</strong> · <strong>Google Antigravity</strong> · <strong>OpenAI Codex</strong> · <strong>OpenCode</strong> · <strong>Aider</strong> · <strong>GitHub Copilot CLI</strong> · <strong>Gemini CLI</strong> · <strong>Qoder</strong> · <strong>Qwen Coder</strong> · any AI IDE
 </p>
 
 ## Why Rune?
 
 Most skill ecosystems are either **too many isolated skills** (540+ that don't talk to each other) or **rigid pipelines** (A → B → C, if B fails everything stops).
 
-Rune is a **mesh** — 63 skills with 215+ connections across a 5-layer architecture. Skills call each other bidirectionally, forming resilient workflows that adapt when things go wrong.
+Rune is a **mesh** — 64 skills with 203 connections + 40 signals across a 5-layer architecture. Skills call each other bidirectionally, forming resilient workflows that adapt when things go wrong.
 
 ```
 Pipeline:  A → B → C → D         (B fails = stuck)
@@ -83,7 +83,19 @@ _Methodology: Claude Code CLI headless mode (`claude -p --output-format json`),
 
 ---
 
-## What's New (v2.16.1 — Skill Enrichment + Triage Workflow + Output Modes)
+## What's New (v2.18.0 — Cross-Platform Reach + Discipline Tightening)
+
+> **v2.18.0 (2026-05-15):** Compiler grew from 8 → 13 platforms with five new adapters: **Aider** (per-skill `aider/rules/` + auto-generated `.aider.conf.yml` `read:` array), **GitHub Copilot CLI** (`.github/instructions/*.instructions.md` w/ documented `applyTo` YAML), **Gemini CLI** (bundled `GEMINI.md` for single-file context), **Qoder** (`.qoder/rules/` + AGENTS.md), **Qwen Coder** (`qwen/skills/` + `QWEN.md` with `@import`). New `adapter.generateExtraFiles()` hook with path-traversal guard + frozen stats snapshot — replaces ad-hoc adapter special-cases (codex AGENTS.md migrated). Discipline tightening: `design` v0.6.0 adds Step 2.9 Rules 4/5/6 (measurable constraints, no #000/#fff/lorem ipsum, CJK-first font stack); `skill-forge` v1.9.0 adds soft `examples/` convention for output-format skills; `sentinel-env` v0.4.0 expands Tier 8 binary detection (Bun, Cargo, Deno, Volta, asdf, proto). New `CONTRIBUTING.md` "What we don't accept" non-goals section. Source: graft from `nexu-io/html-anything` (Apache-2.0). CI 1435/1435.
+
+### Previous (v2.17.1 — One-Command Setup Wizard)
+
+> **v2.17.1 (2026-05-06):** New `rune setup` interactive wizard collapses the multi-step `cd <project> && export RUNE_PRO_ROOT && rune hooks install --preset gentle --tier pro` workflow into one command — auto-detects Pro/Business tiers across env var / sibling / well-known paths, asks for scope (current project / global) + preset, installs hooks. New `--global` flag on `rune hooks install` writes to `~/.claude/settings.json` (every Claude Code session, regardless of project). Non-interactive mode via `--here` / `--global` / `--tier` / `--preset` / `--dry` flags. Anti-paywall — wizard ships in Free, NOT Pro/Business (tier-agnostic infrastructure UX). Doc sweep: README "One-Command Setup", HOOKS.md restructure, agent skill-routing row for "set up rune". CI 1376/1376.
+
+### Previous (v2.17.0 — Quarantine + Hook Drift Reporter)
+
+> **v2.17.0 (2026-05-06):** New L3 skill `quarantine` ships a PostToolUse advisory hook for untrusted external content (MCP user-content, WebFetch, upload Reads). Honest scope: hook lands `[QUARANTINE-NOTICE]` in next-turn `additionalContext`, biasing the model to treat prior external content as data — NOT structural defense. Layered against `permissions.deny` (egress) + `integrity-check` (state). Default trusted-MCP allowlist (linear / github / jira / atlassian / Drive / neural-memory) skips advisory; operator extends at `~/.claude/quarantine.d/trusted-mcp-allowlist.txt`. Per-session disable via `QUARANTINE_DISABLE=1`. Wired into `rune hooks install --preset gentle|strict`. New `rune doctor --hooks` drift reporter. CI 1367/1367.
+
+### Previous (v2.16.1 — Skill Enrichment + Triage Workflow + Output Modes)
 
 > **v2.16.1 patch (2026-05-02):** `ba` v0.13.0 → v1.0.0 first stable major (no functional changes — maturity stamp). Doc/signal hygiene: CLAUDE.md "Current Wave" synced; 4 terminal-observability signals whitelisted in `validate-signals.js`. CI 1349/1349.
 
@@ -193,7 +205,7 @@ cook ───emit:phase.complete────→ session-bridge
 
 ## What Rune Is (and Isn't)
 
-Rune started as a **Claude Code plugin** and now compiles to **every major AI IDE**. Same 63 skills, same mesh connections, same workflows — zero knowledge loss across platforms.
+Rune started as a **Claude Code plugin** and now compiles to **every major AI IDE**. Same 64 skills, same mesh connections, same workflows — zero knowledge loss across platforms.
 
 | | Rune Provides | Claude Code Provides |
 |---|---|---|
@@ -201,7 +213,7 @@ Rune started as a **Claude Code plugin** and now compiles to **every major AI ID
 | **Quality Gates** | preflight + sentinel + review + completion-gate (parallel) | None built-in |
 | **Domain Knowledge** | 14 extension packs (trading, SaaS, mobile, etc.) | General-purpose |
 | **Cross-Session State** | .rune/ directory (decisions, conventions, progress) | Conversation only |
-| **Mesh Resilience** | 215+ skill connections, fail-loud-route-around | Linear execution |
+| **Mesh Resilience** | 203 skill connections + 40 mesh signals, fail-loud-route-around | Linear execution |
 | **Cost Optimization** | Auto model selection (haiku/sonnet/opus per task) | Single model |
 | | | |
 | **Sandbox & Permissions** | — | Claude Code handles this |
@@ -222,6 +234,46 @@ Rune started as a **Claude Code plugin** and now compiles to **every major AI ID
 
 ## Install
 
+### One-Command Setup (recommended)
+
+After installing the plugin, run the wizard once to wire hooks the way you want them — pick scope, pick tiers, done:
+
+```bash
+npx @rune-kit/rune setup
+```
+
+The wizard auto-detects what you have:
+
+```
+Rune Setup Wizard
+──────────────────
+Free version:    2.18.0 (cached)
+Pro detected:    sibling (../Pro) (v1.1.0)
+Business:        not detected
+
+Where to install hooks?
+  [c] Current project — D:/MyProject/.claude/settings.json
+  [g] Global          — ~/.claude/settings.json
+       (every Claude Code session, regardless of project)
+
+Scope [c/g] (default c): g
+Install Pro tier? [Y/n]: y
+Preset [g/s] (default g): g
+
+✓ Wired 5 hooks to ~/.claude/settings.json
+  Verify: rune doctor --hooks
+```
+
+**What does the wizard do?** It writes Rune-managed entries to `.claude/settings.json` (project-local OR global) so Claude Code auto-fires `preflight`, `sentinel`, `dependency-doctor`, `completion-gate`, and `quarantine` at the right moments. With `--tier pro`, it also wires `loop-circuit-breaker` (auto-engages only in autopilot sessions).
+
+**Non-interactive mode** (CI / scripted):
+
+```bash
+npx @rune-kit/rune setup --here --preset gentle --tier pro
+npx @rune-kit/rune setup --global --preset strict --tier pro,business
+npx @rune-kit/rune setup --here --no-tier --dry      # preview without writing
+```
+
 ### Claude Code (Native Plugin)
 
 ```bash
@@ -231,7 +283,7 @@ claude plugin add rune-kit/rune
 
 Or add manually in `~/.claude/settings.json` under `installed_plugins`.
 
-Full mesh: subagents, hooks, adaptive routing, mesh analytics.
+Full mesh: subagents, hooks, adaptive routing, mesh analytics. **Run `npx @rune-kit/rune setup` afterward to wire hooks** (see One-Command Setup above).
 
 ### Cursor / Windsurf / Antigravity / Any IDE
 
@@ -245,14 +297,14 @@ npx @rune-kit/rune init --platform windsurf
 npx @rune-kit/rune init --platform antigravity
 ```
 
-This compiles all 63 skills into your IDE's rules format. Same knowledge, same workflows.
+This compiles all 64 skills into your IDE's rules format. Same knowledge, same workflows.
 
 ### Platform Comparison
 
 | Feature | Claude Code | Cursor / Windsurf / Others |
 |---------|-------------|---------------------------|
-| Skills available | 61/61 | 61/61 |
-| Mesh connections | 215+ (programmatic) | 215+ (rule references) |
+| Skills available | 64/64 | 64/64 |
+| Mesh connections | 203 sync + 40 signals (programmatic) | 203 sync + 40 signals (rule references) |
 | Workflows & HARD-GATEs | Full | Full |
 | Extension packs | 14 | 14 |
 | Subagent parallelism | Native | Sequential fallback |
@@ -596,7 +648,7 @@ See [docs/MULTI-PLATFORM.md](docs/MULTI-PLATFORM.md) for the full architecture.
 | Doc | What's inside |
 |-----|---------------|
 | [`docs/GETTING_STARTED.md`](docs/GETTING_STARTED.md) | Your first 5 minutes with Rune — install to first `/rune cook` |
-| [`docs/SKILLS.md`](docs/SKILLS.md) | All 63 skills, searchable by intent and layer |
+| [`docs/SKILLS.md`](docs/SKILLS.md) | All 64 skills, searchable by intent and layer |
 | [`docs/SIGNALS.md`](docs/SIGNALS.md) | Canonical signal inventory — 25 events, emit/listen graph |
 | [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) | 5-layer mesh architecture reference |
 | [`docs/VISION.md`](docs/VISION.md) | Philosophy — what Rune is and isn't |
@@ -609,11 +661,11 @@ See [docs/MULTI-PLATFORM.md](docs/MULTI-PLATFORM.md) for the full architecture.
 ## Numbers
 
 ```
-Core Skills:       62 (L0: 1 │ L1: 5 │ L2: 29 │ L3: 27)
-Extension Packs:   14 free + 5 pro + 4 business
-Mesh Connections:  215+ cross-references
-Mesh Signals:      25 signals across 63 skills (emit/listen graph)
-Connections/Skill: 3.4 avg
+Core Skills:       64 (L0: 1 │ L1: 5 │ L2: 30 │ L3: 28)
+Extension Packs:   14 free + 6 pro + 4 business
+Mesh Connections:  203 sync calls (rune doctor)
+Mesh Signals:      40 signals · 50 emit/listen edges (rune doctor)
+Connections/Skill: 3.2 avg
 Platforms:         8 (Claude Code, Cursor, Windsurf, Antigravity, Codex, OpenCode, OpenClaw, Generic)
 Compiler:          ~1400 LOC (parser + 8 transforms + 8 adapters + CLI)
 Tests:             1,152+ (compiler + signals + status + visualizer + hooks + scripts + tier-hooks)

package/compiler/__tests__/adapter-model-mapping.test.js

@@ -131,6 +131,86 @@ describe('Anthropic-native adapters are no-op for model field', () => {
   });
 });
 
+describe('qoder adapter model mapping (provider-agnostic)', () => {
+  const qoder = getAdapter('qoder');
+
+  test('opus translates to tier:heavy', () => {
+    const header = qoder.generateHeader({ ...baseSkill, model: 'opus' });
+    assert.match(header, /model: tier:heavy/);
+  });
+
+  test('omitted model produces no model line', () => {
+    const header = qoder.generateHeader({ ...baseSkill });
+    assert.doesNotMatch(header, /model:/);
+  });
+});
+
+describe('copilot adapter model mapping (tier-hint comment)', () => {
+  const copilot = getAdapter('copilot');
+
+  test('opus emits tier-hint:tier:heavy as comment (Copilot ignores model field)', () => {
+    const header = copilot.generateHeader({ ...baseSkill, model: 'opus' });
+    assert.match(header, /tier-hint: tier:heavy/);
+  });
+
+  test('omitted model produces no tier-hint line', () => {
+    const header = copilot.generateHeader({ ...baseSkill });
+    assert.doesNotMatch(header, /tier-hint/);
+  });
+});
+
+describe('aider adapter model mapping (inline header)', () => {
+  const aider = getAdapter('aider');
+
+  test('opus appears as tier:heavy inline', () => {
+    const header = aider.generateHeader({ ...baseSkill, model: 'opus' });
+    assert.match(header, /tier:heavy/);
+  });
+
+  test('omitted model produces no tier line', () => {
+    const header = aider.generateHeader({ ...baseSkill });
+    assert.doesNotMatch(header, /tier:/);
+  });
+});
+
+describe('qwen adapter model mapping (Qwen family)', () => {
+  const qwen = getAdapter('qwen');
+
+  test('opus translates to qwen3-coder-plus', () => {
+    const header = qwen.generateHeader({ ...baseSkill, model: 'opus' });
+    assert.match(header, /qwen3-coder-plus/);
+  });
+
+  test('sonnet translates to qwen3-coder', () => {
+    const header = qwen.generateHeader({ ...baseSkill, model: 'sonnet' });
+    assert.match(header, /qwen3-coder(?!-)/);
+  });
+
+  test('haiku translates to qwen3-coder-flash', () => {
+    const header = qwen.generateHeader({ ...baseSkill, model: 'haiku' });
+    assert.match(header, /qwen3-coder-flash/);
+  });
+});
+
+describe('gemini adapter model mapping (Gemini family)', () => {
+  const gemini = getAdapter('gemini');
+
+  test('opus translates to gemini-2.5-pro', () => {
+    const header = gemini.generateHeader({ ...baseSkill, model: 'opus' });
+    assert.match(header, /gemini-2\.5-pro/);
+  });
+
+  test('sonnet translates to gemini-2.5-flash', () => {
+    const header = gemini.generateHeader({ ...baseSkill, model: 'sonnet' });
+    assert.match(header, /gemini-2\.5-flash/);
+  });
+
+  test('haiku translates to gemini-2.0-flash-lite', () => {
+    const header = gemini.generateHeader({ ...baseSkill, model: 'haiku' });
+    assert.match(header, /gemini-2\.0-flash-lite/);
+  });
+});
+
 describe('cross-adapter consistency', () => {
   test('all 5 non-Anthropic adapters emit a model line for opus skills', () => {
     const adapterNames = ['codex', 'antigravity', 'opencode', 'openclaw', 'generic'];

package/compiler/__tests__/adapters.test.js

@@ -4,9 +4,23 @@ import { getAdapter, listPlatforms } from '../adapters/index.js';
 
 // --- Adapter registry ---
 
-test('listPlatforms returns all 8 platform adapters', () => {
+test('listPlatforms returns all 13 platform adapters', () => {
   const adapters = listPlatforms();
-  const expected = ['claude', 'cursor', 'windsurf', 'antigravity', 'codex', 'opencode', 'openclaw', 'generic'];
+  const expected = [
+    'claude',
+    'cursor',
+    'windsurf',
+    'antigravity',
+    'codex',
+    'opencode',
+    'openclaw',
+    'generic',
+    'aider',
+    'copilot',
+    'gemini',
+    'qoder',
+    'qwen',
+  ];
   for (const name of expected) {
     assert.ok(adapters.includes(name), `missing adapter: ${name}`);
   }
@@ -35,7 +49,19 @@ const REQUIRED_METHODS = [
 
 const REQUIRED_PROPS = ['name', 'outputDir', 'fileExtension', 'skillPrefix', 'skillSuffix'];
 
-const ADAPTER_NAMES = ['cursor', 'windsurf', 'antigravity', 'codex', 'opencode', 'generic'];
+const ADAPTER_NAMES = [
+  'cursor',
+  'windsurf',
+  'antigravity',
+  'codex',
+  'opencode',
+  'generic',
+  'aider',
+  'copilot',
+  'gemini',
+  'qoder',
+  'qwen',
+];
 
 for (const adapterName of ADAPTER_NAMES) {
   describe(`${adapterName} adapter contract`, () => {
@@ -107,3 +133,89 @@ test('codex adapter uses skill directories', () => {
   assert.strictEqual(codex.useSkillDirectories, true);
   assert.strictEqual(codex.skillFileName, 'SKILL.md');
 });
+
+// --- New v2.18 adapters: shape + generateExtraFiles contract ---
+
+test('qoder adapter targets .qoder/rules and emits AGENTS.md', async () => {
+  const qoder = getAdapter('qoder');
+  assert.strictEqual(qoder.outputDir, '.qoder/rules');
+  assert.strictEqual(qoder.useSkillDirectories, false);
+  assert.strictEqual(typeof qoder.generateExtraFiles, 'function');
+  const extras = await qoder.generateExtraFiles({ stats: { skillCount: 5, packCount: 1, files: [] } });
+  assert.ok(extras.some((e) => e.path === 'AGENTS.md' && e.content.includes('Rune')));
+});
+
+test('copilot adapter targets .github/instructions with .instructions.md ext', async () => {
+  const copilot = getAdapter('copilot');
+  assert.strictEqual(copilot.outputDir, '.github/instructions');
+  assert.strictEqual(copilot.fileExtension, '.instructions.md');
+  const header = copilot.generateHeader({ name: 'cook', layer: 'L1', group: 'orchestrator', description: 'Test' });
+  // Per docs.github.com Copilot CLI custom-instructions spec, only `applyTo` is a
+  // documented frontmatter field. Description and tier-hint must live in the body.
+  assert.ok(header.includes('applyTo: "**"'));
+  assert.ok(!/^description:/m.test(header.split('---')[1] || ''), 'description must NOT appear in frontmatter');
+  const extras = await copilot.generateExtraFiles({ stats: { skillCount: 5, packCount: 1, files: [] } });
+  assert.ok(extras.some((e) => e.path === '.github/copilot-instructions.md'));
+  assert.ok(extras.some((e) => e.path === 'AGENTS.md'));
+});
+
+test('codex adapter migrated to generateExtraFiles for AGENTS.md (no longer special-cased in emitter)', async () => {
+  const codex = getAdapter('codex');
+  assert.strictEqual(typeof codex.generateExtraFiles, 'function');
+  const extras = await codex.generateExtraFiles({
+    stats: { skillCount: 64, packCount: 14, crossRefsResolved: 287, files: [] },
+  });
+  const agentsMd = extras.find((e) => e.path === 'AGENTS.md');
+  assert.ok(agentsMd, 'codex must emit AGENTS.md via generateExtraFiles');
+  assert.ok(agentsMd.content.includes('Rune'));
+  assert.ok(agentsMd.content.includes('64 core skills'));
+});
+
+test('emitter rejects absolute paths from generateExtraFiles (path-traversal guard)', async () => {
+  // Smoke: verify both qoder and gemini return relative paths only (no absolute).
+  for (const name of ['qoder', 'copilot', 'aider', 'qwen', 'gemini', 'codex']) {
+    const adapter = getAdapter(name);
+    const extras = await adapter.generateExtraFiles({
+      stats: { skillCount: 1, packCount: 0, crossRefsResolved: 0, files: ['rune-cook.md'] },
+      outputDir: '/tmp/test',
+    });
+    for (const extra of extras || []) {
+      assert.ok(!extra.path.startsWith('/'), `${name} returned absolute path: ${extra.path}`);
+      assert.ok(!/^[A-Z]:[\\/]/.test(extra.path), `${name} returned Windows absolute path: ${extra.path}`);
+    }
+  }
+});
+
+test('aider adapter emits .aider.conf.yml with read array', async () => {
+  const aider = getAdapter('aider');
+  assert.strictEqual(aider.outputDir, 'aider/rules');
+  const extras = await aider.generateExtraFiles({
+    stats: { skillCount: 2, packCount: 0, files: ['rune-cook.md', 'rune-fix.md', 'index.md'] },
+  });
+  const conf = extras.find((e) => e.path === '.aider.conf.yml');
+  assert.ok(conf);
+  assert.ok(conf.content.includes('read:'));
+  assert.ok(conf.content.includes('aider/rules/rune-cook.md'));
+  assert.ok(conf.content.includes('aider/rules/rune-fix.md'));
+  // index.md must NOT be in the read array
+  assert.ok(!conf.content.includes('aider/rules/index.md'));
+});
+
+test('qwen adapter emits QWEN.md with @import lines', async () => {
+  const qwen = getAdapter('qwen');
+  assert.strictEqual(qwen.outputDir, 'qwen/skills');
+  const extras = await qwen.generateExtraFiles({
+    stats: { skillCount: 2, packCount: 0, files: ['rune-cook.md', 'rune-fix.md'] },
+  });
+  const qwenMd = extras.find((e) => e.path === 'QWEN.md');
+  assert.ok(qwenMd);
+  assert.ok(qwenMd.content.includes('@qwen/skills/rune-cook.md'));
+  assert.ok(qwenMd.content.includes('@qwen/skills/rune-fix.md'));
+});
+
+test('gemini adapter declares generateExtraFiles for bundled GEMINI.md', () => {
+  const gemini = getAdapter('gemini');
+  assert.strictEqual(gemini.outputDir, 'gemini/skills');
+  assert.strictEqual(typeof gemini.generateExtraFiles, 'function');
+  // Full bundle test happens in pipeline test (needs filesystem) — contract checked here.
+});

package/compiler/__tests__/doctor-mesh.test.js

@@ -223,6 +223,11 @@ describe('integration: real skills', () => {
     // Should find connections
     assert.ok(results.stats.connections > 100, `Should find 100+ connections, got ${results.stats.connections}`);
 
+    // Should find signals (emit/listen mesh — separate from sync calls)
+    // Free core scan only — Pro/Business packs scanned separately by validate-signals.js
+    assert.ok(results.stats.signals > 20, `Should find 20+ signals, got ${results.stats.signals}`);
+    assert.ok(results.stats.signalEdges > 0, `Should find signal edges, got ${results.stats.signalEdges}`);
+
     // Should not have errors
     assert.strictEqual(results.errors.length, 0, `Should have no errors: ${results.errors.join(', ')}`);
   });

package/compiler/__tests__/hooks-drift.test.js

@@ -0,0 +1,156 @@
+import assert from 'node:assert';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, test } from 'node:test';
+import { checkHookDrift, formatHookDriftResult } from '../commands/hooks/drift.js';
+import { buildPreset, SETTINGS_REL_PATH } from '../commands/hooks/presets.js';
+
+let tmpRoot;
+
+async function seedClaude(root, settings) {
+  await mkdir(path.join(root, '.claude'), { recursive: true });
+  if (settings) {
+    await writeFile(path.join(root, SETTINGS_REL_PATH), `${JSON.stringify(settings, null, 2)}\n`);
+  }
+}
+
+beforeEach(async () => {
+  tmpRoot = await mkdtemp(path.join(tmpdir(), 'rune-drift-'));
+});
+
+afterEach(async () => {
+  if (tmpRoot) await rm(tmpRoot, { recursive: true, force: true });
+});
+
+describe('checkHookDrift', () => {
+  test('returns empty findings when settings.json matches canonical gentle preset', async () => {
+    await seedClaude(tmpRoot, buildPreset('gentle'));
+    const result = await checkHookDrift(tmpRoot);
+    assert.strictEqual(result.findings.length, 0);
+    assert.strictEqual(result.summary.drifted, 0);
+    assert.strictEqual(result.summary.missing, 0);
+    assert.strictEqual(result.platforms.length, 1);
+    assert.strictEqual(result.platforms[0].preset, 'gentle');
+  });
+
+  test('returns empty findings for canonical strict preset', async () => {
+    await seedClaude(tmpRoot, buildPreset('strict'));
+    const result = await checkHookDrift(tmpRoot);
+    assert.strictEqual(result.findings.length, 0);
+    assert.strictEqual(result.platforms[0].preset, 'strict');
+  });
+
+  test('flags drifted entry when installed command differs from canonical', async () => {
+    const baseline = buildPreset('gentle');
+    // Mutate one command to simulate operator hand-edit
+    baseline.hooks.PreToolUse[0].hooks[0].command = 'npx --yes @rune-kit/rune hook-dispatch preflight --custom-flag';
+    await seedClaude(tmpRoot, baseline);
+    const result = await checkHookDrift(tmpRoot);
+    const drift = result.findings.filter((f) => f.status === 'drift');
+    const missing = result.findings.filter((f) => f.status === 'missing');
+    assert.ok(drift.length >= 1, 'should flag the modified entry as drifted');
+    assert.ok(missing.length >= 1, 'canonical entry no longer present → missing');
+    assert.match(drift[0].actual, /--custom-flag/);
+  });
+
+  test('flags missing entry when canonical has more than installed', async () => {
+    const partial = buildPreset('gentle');
+    // Remove one Stop entry to simulate partial install
+    partial.hooks.Stop = [];
+    await seedClaude(tmpRoot, partial);
+    const result = await checkHookDrift(tmpRoot);
+    const missing = result.findings.filter((f) => f.status === 'missing' && f.event === 'Stop');
+    assert.strictEqual(missing.length, 1);
+    assert.match(missing[0].expected, /completion-gate/);
+  });
+
+  test('ignores tier-emitted entries (${RUNE_PRO_ROOT})', async () => {
+    const settings = buildPreset('gentle');
+    // Inject a Pro-tier entry alongside Free preset entries
+    settings.hooks.PostToolUse.push({
+      matcher: 'Edit|Write',
+      hooks: [
+        {
+          type: 'command',
+          command: 'node "${RUNE_PRO_ROOT}/hooks/run-hook.cjs" context-sense',
+          async: false,
+        },
+      ],
+    });
+    await seedClaude(tmpRoot, settings);
+    const result = await checkHookDrift(tmpRoot);
+    // Tier entry should NOT be flagged as drift — it's tier-managed, not Free-preset
+    const tierDrift = result.findings.find(
+      (f) => f.status === 'drift' && typeof f.actual === 'string' && f.actual.includes('RUNE_PRO_ROOT'),
+    );
+    assert.strictEqual(tierDrift, undefined);
+  });
+
+  test('returns empty when settings.json absent', async () => {
+    await mkdir(path.join(tmpRoot, '.claude'), { recursive: true });
+    const result = await checkHookDrift(tmpRoot);
+    assert.strictEqual(result.findings.length, 0);
+    assert.strictEqual(result.platforms.length, 0);
+  });
+
+  test('returns empty when no Rune hooks installed (preset = none)', async () => {
+    await seedClaude(tmpRoot, { env: { FOO: 'bar' } }); // user settings, no Rune hooks
+    const result = await checkHookDrift(tmpRoot);
+    assert.strictEqual(result.findings.length, 0);
+    assert.strictEqual(result.platforms.length, 0);
+  });
+
+  test('reports parse error when settings.json is malformed', async () => {
+    await mkdir(path.join(tmpRoot, '.claude'), { recursive: true });
+    await writeFile(path.join(tmpRoot, SETTINGS_REL_PATH), '{ not valid json');
+    const result = await checkHookDrift(tmpRoot);
+    const errors = result.findings.filter((f) => f.status === 'error');
+    assert.strictEqual(errors.length, 1);
+    assert.match(errors[0].message, /Cannot parse/);
+  });
+
+  test('flags mixed preset (both gentle and strict installed)', async () => {
+    // Mix gentle PreToolUse with strict Stop
+    const gentle = buildPreset('gentle');
+    const strict = buildPreset('strict');
+    const mixed = {
+      hooks: {
+        PreToolUse: gentle.hooks.PreToolUse,
+        Stop: strict.hooks.Stop,
+      },
+    };
+    await seedClaude(tmpRoot, mixed);
+    const result = await checkHookDrift(tmpRoot);
+    const mixedFinding = result.findings.find((f) => f.status === 'mixed-preset');
+    assert.ok(mixedFinding, 'should flag mixed-preset');
+    assert.match(mixedFinding.message, /gentle and strict/);
+  });
+});
+
+describe('formatHookDriftResult', () => {
+  test('clean preset → all-match line', () => {
+    const out = formatHookDriftResult({
+      findings: [],
+      summary: { drifted: 0, missing: 0, errors: 0 },
+      platforms: [{ platform: 'claude', preset: 'gentle' }],
+    });
+    assert.match(out, /All Rune-managed entries match canonical preset/);
+  });
+
+  test('no platforms → install hint', () => {
+    const out = formatHookDriftResult({ findings: [], summary: { drifted: 0, missing: 0, errors: 0 }, platforms: [] });
+    assert.match(out, /No installed Rune hooks detected/);
+  });
+
+  test('drift finding renders actual command', () => {
+    const out = formatHookDriftResult({
+      findings: [{ platform: 'claude', event: 'PreToolUse', status: 'drift', actual: 'custom-cmd' }],
+      summary: { drifted: 1, missing: 0, errors: 0 },
+      platforms: [{ platform: 'claude', preset: 'gentle' }],
+    });
+    assert.match(out, /drift/);
+    assert.match(out, /custom-cmd/);
+    assert.match(out, /Summary: 1 drifted/);
+  });
+});

package/compiler/__tests__/hooks-merge.test.js

@@ -169,10 +169,11 @@ describe('summarizeRuneHooks', () => {
   test('extracts skill names per event', () => {
     const merged = mergePreset({}, buildPreset('gentle'));
     const summary = summarizeRuneHooks(merged);
-    assert.strictEqual(summary.total, 4);
+    assert.strictEqual(summary.total, 5);
     assert.ok(summary.events.PreToolUse.includes('preflight'));
     assert.ok(summary.events.PreToolUse.includes('sentinel'));
     assert.ok(summary.events.PostToolUse.includes('dependency-doctor'));
+    assert.ok(summary.events.PostToolUse.includes('quarantine'));
     assert.ok(summary.events.Stop.includes('completion-gate'));
   });