@rune-kit/rune 2.17.1 → 2.18.0

package/compiler/adapters/index.js

@@ -4,13 +4,18 @@
  * Central registry for all platform adapters.
  */
 
+import aider from './aider.js';
 import antigravity from './antigravity.js';
 import claude from './claude.js';
 import codex from './codex.js';
+import copilot from './copilot.js';
 import cursor from './cursor.js';
+import gemini from './gemini.js';
 import generic from './generic.js';
 import openclaw from './openclaw.js';
 import opencode from './opencode.js';
+import qoder from './qoder.js';
+import qwen from './qwen.js';
 import windsurf from './windsurf.js';
 
 const adapters = {
@@ -22,6 +27,11 @@ const adapters = {
   openclaw,
   codex,
   opencode,
+  aider,
+  copilot,
+  gemini,
+  qoder,
+  qwen,
 };
 
 /**

package/compiler/adapters/qoder.js

@@ -0,0 +1,102 @@
+/**
+ * Qoder Adapter
+ *
+ * Emits per-skill rule files into .qoder/rules/ — Qoder's documented project-level
+ * rule directory. Qoder also reads AGENTS.md as its project-context file.
+ *
+ * Qoder rules dir: .qoder/rules/
+ * Qoder rule file: .qoder/rules/rune-{name}.md (one file per skill)
+ * Qoder project context: AGENTS.md (open AGENTS.md standard)
+ *
+ * @see https://docs.qoder.com/user-guide/rules
+ * @see https://agents.md/
+ *
+ * MODEL TIER MAPPING (v2.18+):
+ * Qoder is provider-agnostic — emits semantic tier hints rather than concrete
+ * model names. Qoder IDE resolves the tier to its configured provider model.
+ */
+
+import { BRANDING_FOOTER } from '../transforms/branding.js';
+
+const MODEL_MAP = {
+  opus: 'tier:heavy',
+  sonnet: 'tier:mid',
+  haiku: 'tier:light',
+};
+
+const TOOL_MAP = {
+  Read: 'read the file',
+  Write: 'write/create the file',
+  Edit: 'edit the file',
+  Glob: 'find files by pattern',
+  Grep: 'search file contents',
+  Bash: 'run a shell command',
+  TodoWrite: 'track task progress',
+  Skill: 'follow the referenced rune-{name} rule',
+  Agent: 'execute the workflow',
+};
+
+export default {
+  name: 'qoder',
+  outputDir: '.qoder/rules',
+  fileExtension: '.md',
+  skillPrefix: 'rune-',
+  skillSuffix: '',
+
+  // Qoder rules are flat .md files, not directory-per-skill
+  useSkillDirectories: false,
+
+  transformReference(skillName, raw) {
+    const isBackticked = raw.startsWith('`') && raw.endsWith('`');
+    const ref = `the rune-${skillName} rule`;
+    return isBackticked ? `\`${ref}\`` : ref;
+  },
+
+  transformToolName(toolName) {
+    return TOOL_MAP[toolName] || toolName;
+  },
+
+  generateHeader(skill) {
+    const desc = (skill.description || '').replace(/"/g, '\\"');
+    const lines = ['---', `name: rune-${skill.name}`, `description: "${desc}"`];
+    const translatedModel = skill.model ? MODEL_MAP[skill.model] || skill.model : null;
+    if (translatedModel) lines.push(`model: ${translatedModel}`);
+    lines.push('---', '', '');
+    return lines.join('\n');
+  },
+
+  generateFooter() {
+    return BRANDING_FOOTER;
+  },
+
+  transformSubagentInstruction(text) {
+    return text;
+  },
+
+  scriptsDir(skillName) {
+    return `rune-${skillName}-scripts`;
+  },
+
+  postProcess(content) {
+    return content.replace(/^context: fork\n/gm, '').replace(/^agent: general-purpose\n/gm, '');
+  },
+
+  // Qoder reads AGENTS.md at the project root as its high-level context file.
+  generateExtraFiles({ stats }) {
+    const agentsMd = [
+      '# Rune — Project Configuration',
+      '',
+      'Rune is an interconnected skill ecosystem for AI coding assistants.',
+      `${stats.skillCount} core skills + ${stats.packCount} extension packs.`,
+      '',
+      'Per-skill rules live under `.qoder/rules/rune-<name>.md`. Qoder loads them automatically.',
+      '',
+      'Reference a skill by name (e.g. "follow the rune-cook rule") inside any chat — the rule file is auto-injected.',
+      '',
+      '---',
+      '> Rune Skill Mesh — https://github.com/rune-kit/rune',
+      '',
+    ].join('\n');
+    return [{ path: 'AGENTS.md', content: agentsMd }];
+  },
+};

package/compiler/adapters/qwen.js

@@ -0,0 +1,111 @@
+/**
+ * Qwen Coder Adapter
+ *
+ * Emits per-skill rule files into qwen/skills/ and a top-level QWEN.md that
+ * uses Qwen Code's @import syntax to load each rule file. Qwen Code loads
+ * QWEN.md hierarchically (cwd → parent → ~/.qwen/QWEN.md).
+ *
+ * Qwen rules dir: qwen/skills/
+ * Qwen rule file: qwen/skills/rune-{name}.md
+ * Qwen project context: QWEN.md at project root (with @path imports)
+ *
+ * @see https://qwenlm.github.io/qwen-code-docs/en/users/configuration/settings/
+ * @see https://github.com/QwenLM/qwen-code
+ *
+ * MODEL TIER MAPPING (v2.18+):
+ * Qwen Coder defaults to Qwen3-Coder family. Anthropic-style tier names
+ * translate to Qwen size hints (heavy=qwen3-coder-plus, mid=qwen3-coder,
+ * light=qwen3-coder-flash). Hint only — Qwen Code reads model from settings.
+ */
+
+import { BRANDING_FOOTER } from '../transforms/branding.js';
+
+const MODEL_MAP = {
+  opus: 'qwen3-coder-plus',
+  sonnet: 'qwen3-coder',
+  haiku: 'qwen3-coder-flash',
+};
+
+const TOOL_MAP = {
+  Read: 'read the file',
+  Write: 'write/create the file',
+  Edit: 'edit the file',
+  Glob: 'find files by pattern',
+  Grep: 'search file contents',
+  Bash: 'run a shell command',
+  TodoWrite: 'track task progress',
+  Skill: 'follow the imported rune-{name} skill',
+  Agent: 'execute the workflow',
+};
+
+export default {
+  name: 'qwen',
+  outputDir: 'qwen/skills',
+  fileExtension: '.md',
+  skillPrefix: 'rune-',
+  skillSuffix: '',
+
+  // Qwen skills are flat per-skill markdown files imported from QWEN.md.
+  useSkillDirectories: false,
+
+  transformReference(skillName, raw) {
+    const isBackticked = raw.startsWith('`') && raw.endsWith('`');
+    const ref = `the rune-${skillName} skill`;
+    return isBackticked ? `\`${ref}\`` : ref;
+  },
+
+  transformToolName(toolName) {
+    return TOOL_MAP[toolName] || toolName;
+  },
+
+  generateHeader(skill) {
+    const desc = (skill.description || '').replace(/"/g, '\\"');
+    const lines = ['---', `name: rune-${skill.name}`, `description: "${desc}"`];
+    const translatedModel = skill.model ? MODEL_MAP[skill.model] || skill.model : null;
+    if (translatedModel) lines.push(`# model-hint: ${translatedModel}`);
+    lines.push('---', '', '');
+    return lines.join('\n');
+  },
+
+  generateFooter() {
+    return BRANDING_FOOTER;
+  },
+
+  transformSubagentInstruction(text) {
+    return text;
+  },
+
+  scriptsDir(skillName) {
+    return `rune-${skillName}-scripts`;
+  },
+
+  postProcess(content) {
+    return content.replace(/^context: fork\n/gm, '').replace(/^agent: general-purpose\n/gm, '');
+  },
+
+  // Emit QWEN.md at project root with @import lines for every per-skill file.
+  generateExtraFiles({ stats }) {
+    const skillFiles = stats.files
+      .filter((f) => f.startsWith('rune-') && f.endsWith('.md') && !f.includes('/') && !f.includes('\\'))
+      .sort();
+
+    const qwenMd = [
+      '# Rune — Project Configuration',
+      '',
+      'Rune is an interconnected skill ecosystem for AI coding assistants.',
+      `${stats.skillCount} core skills + ${stats.packCount} extension packs.`,
+      '',
+      '## Loaded Skills',
+      '',
+      'Qwen Code loads each referenced file as part of this project context.',
+      '',
+      ...skillFiles.map((f) => `@qwen/skills/${f}`),
+      '',
+      '---',
+      '> Rune Skill Mesh — https://github.com/rune-kit/rune',
+      '',
+    ].join('\n');
+
+    return [{ path: 'QWEN.md', content: qwenMd }];
+  },
+};

package/compiler/bin/rune.js

@@ -20,13 +20,13 @@ import { fileURLToPath } from 'node:url';
 import { getAdapter, listPlatforms } from '../adapters/index.js';
 import { getAllAnalytics } from '../analytics.js';
 import { dispatchHook } from '../commands/hook-dispatch.js';
+import { checkHookDrift, formatHookDriftResult } from '../commands/hooks/drift.js';
 import { installHooks } from '../commands/hooks/install.js';
 import { hookStatus } from '../commands/hooks/status.js';
 import { uninstallHooks } from '../commands/hooks/uninstall.js';
+import { formatSetupResult, runSetup } from '../commands/setup.js';
 import { generateDashboardHTML } from '../dashboard.js';
 import { checkMeshIntegrity, formatDoctorResults, formatMeshResults, runDoctor } from '../doctor.js';
-import { checkHookDrift, formatHookDriftResult } from '../commands/hooks/drift.js';
-import { runSetup, formatSetupResult } from '../commands/setup.js';
 import { buildAll } from '../emitter.js';
 import { collectStats, renderStatus, renderStatusJson } from '../status.js';
 import { collectGraphData, generateMeshHTML } from '../visualizer.js';
@@ -720,7 +720,9 @@ async function main() {
       log('  Rune CLI — Skill mesh for AI coding assistants');
       log('');
       log('  Commands:');
-      log('    setup    Interactive wizard — auto-detect tiers, pick scope, install hooks (recommended for first-time)');
+      log(
+        '    setup    Interactive wizard — auto-detect tiers, pick scope, install hooks (recommended for first-time)',
+      );
       log('             [--here|--global] [--tier pro,business] [--preset gentle|strict] [--dry]');
       log('    init     Interactive setup for build pipeline (auto-detects platform)');
       log('    build    Compile skills for configured platform');

package/compiler/commands/hooks/drift.js

@@ -62,7 +62,8 @@ export async function checkHookDrift(projectRoot) {
         platform: id,
         event: null,
         status: 'mixed-preset',
-        message: 'settings.json contains both gentle and strict Rune entries — re-run `rune hooks install --preset <gentle|strict>` to converge',
+        message:
+          'settings.json contains both gentle and strict Rune entries — re-run `rune hooks install --preset <gentle|strict>` to converge',
       });
     }
 
@@ -159,7 +160,9 @@ export function formatHookDriftResult(result) {
   }
 
   lines.push('');
-  lines.push(`  Summary: ${result.summary.drifted} drifted, ${result.summary.missing} missing, ${result.summary.errors} error(s).`);
+  lines.push(
+    `  Summary: ${result.summary.drifted} drifted, ${result.summary.missing} missing, ${result.summary.errors} error(s).`,
+  );
   lines.push('  Resolution: re-run `rune hooks install --preset <gentle|strict>` to re-converge.');
   lines.push('  This is a reporter — operator decides what to do with the findings.');
 

package/compiler/commands/setup.js

@@ -222,7 +222,9 @@ export function formatSetupResult(result) {
   lines.push('');
   lines.push('  Rune Setup Complete');
   lines.push('  ──────────────────');
-  lines.push(`  Scope:     ${result.scope === 'global' ? 'GLOBAL (~/.claude/settings.json)' : `current project (${result.targetRoot})`}`);
+  lines.push(
+    `  Scope:     ${result.scope === 'global' ? 'GLOBAL (~/.claude/settings.json)' : `current project (${result.targetRoot})`}`,
+  );
   lines.push(`  Tiers:     Free${result.tiers.length > 0 ? ` + ${result.tiers.join(' + ')}` : ''}`);
   lines.push(`  Preset:    ${result.preset}`);
   lines.push(`  Platforms: ${(result.platforms || []).join(', ') || '—'}`);

package/compiler/emitter.js

@@ -700,11 +700,44 @@ export async function buildAll({
   await writeFile(path.join(outputDir, 'skill-index.json'), `${JSON.stringify(skillIndex, null, 2)}\n`, 'utf-8');
   stats.files.push('skill-index.json');
 
-  // Generate AGENTS.md for Codex (OpenAI convention — not used by other platforms)
-  if (adapter.name === 'codex') {
-    const agentsMdContent = generateAgentsMd(stats, adapter);
-    await writeFile(path.join(outputRoot, 'AGENTS.md'), agentsMdContent, 'utf-8');
-    stats.files.push('AGENTS.md');
+  // Generic extra-files hook: any adapter can emit additional index/bundle files
+  // alongside per-skill files (e.g. aider's .aider.conf.yml, qwen's QWEN.md, gemini's GEMINI.md bundle).
+  // Hook contract: paths MUST be relative to outputRoot — absolute paths are rejected to prevent
+  // accidental writes outside the project tree. Adapters receive a frozen stats snapshot so reads
+  // are deterministic regardless of where the hook fires relative to other emit steps.
+  if (typeof adapter.generateExtraFiles === 'function') {
+    const frozenStats = Object.freeze({ ...stats, files: Object.freeze([...stats.files]) });
+    const extras = await adapter.generateExtraFiles({
+      parsedSkills,
+      stats: frozenStats,
+      runeRoot,
+      outputRoot,
+      outputDir,
+    });
+    if (Array.isArray(extras)) {
+      const outputRootResolved = path.resolve(outputRoot);
+      for (const extra of extras) {
+        if (!extra || !extra.path || extra.content == null) continue;
+        if (path.isAbsolute(extra.path)) {
+          stats.errors.push({
+            adapter: adapter.name,
+            error: `generateExtraFiles must return relative paths, got absolute: ${extra.path}`,
+          });
+          continue;
+        }
+        const fullPath = path.resolve(outputRootResolved, extra.path);
+        if (fullPath !== outputRootResolved && !fullPath.startsWith(outputRootResolved + path.sep)) {
+          stats.errors.push({
+            adapter: adapter.name,
+            error: `generateExtraFiles path escapes outputRoot: ${extra.path}`,
+          });
+          continue;
+        }
+        await mkdir(path.dirname(fullPath), { recursive: true });
+        await writeFile(fullPath, extra.content, 'utf-8');
+        stats.files.push(path.relative(outputRoot, fullPath).replaceAll('\\', '/'));
+      }
+    }
   }
 
   // OpenClaw adapter: generate manifest + TypeScript entry point
@@ -774,42 +807,6 @@ function generateIndex(stats, adapter) {
   return lines.join('\n');
 }
 
-/**
- * Generate AGENTS.md for Codex (OpenAI convention)
- * Uses dynamic counts from build stats — no hardcoded skill lists
- */
-function generateAgentsMd(stats, adapter) {
-  const lines = [
-    '# Rune — Project Configuration',
-    '',
-    '## Overview',
-    '',
-    'Rune is an interconnected skill ecosystem for AI coding assistants.',
-    `${stats.skillCount} core skills | 5-layer mesh architecture | ${stats.crossRefsResolved} connections | Multi-platform.`,
-    'Philosophy: "Less skills. Deeper connections."',
-    '',
-    `Platform: ${adapter.name}`,
-    '',
-    '## Skills',
-    '',
-    `**${stats.skillCount} core skills** + **${stats.packCount} extension packs**`,
-    '',
-    '## Usage',
-    '',
-    'Reference skills using the `Skill` tool or delegate to subagents using the `Agent` tool.',
-    '',
-    '## Skills Directory',
-    '',
-    `Skills are located in: ${adapter.outputDir}/`,
-    '',
-    '---',
-    '> Rune Skill Mesh — https://github.com/rune-kit/rune',
-    '',
-  ];
-
-  return lines.join('\n');
-}
-
 /**
  * Intent keyword patterns for each skill — extracted from description + Triggers section
  * Maps common user intent words to the skill that handles them

package/hooks/session-start/index.cjs

@@ -69,3 +69,94 @@ if (fs.existsSync(runeDir)) {
 } else {
   console.log('[Rune: No .rune/ directory found. Run /rune onboard to set up project context.]');
 }
+
+// Tier detection hint (v2.17.1+) — Pro/Business plugins live in private repos
+// and aren't auto-loaded like the Free plugin. If detected at sibling / env /
+// well-known path AND tier hooks aren't already wired in settings.json, nudge
+// user toward `rune setup`. Self-suppressing — once wired, the check fails and
+// the hint stops firing.
+detectTierHint();
+
+function detectTierHint() {
+  const envVars = { pro: 'RUNE_PRO_ROOT', business: 'RUNE_BUSINESS_ROOT' };
+  const wellKnown = {
+    pro: [
+      'D:/Project/Rune/Pro',
+      path.join(os.homedir(), 'rune-pro'),
+      path.join(os.homedir(), 'Project', 'Rune', 'Pro'),
+    ],
+    business: [
+      'D:/Project/Rune/Business',
+      path.join(os.homedir(), 'rune-business'),
+      path.join(os.homedir(), 'Project', 'Rune', 'Business'),
+    ],
+  };
+
+  const detected = [];
+  for (const tier of ['pro', 'business']) {
+    let manifest = null;
+    let source = null;
+
+    const fromEnv = process.env[envVars[tier]];
+    if (fromEnv) {
+      const m = path.join(fromEnv, 'hooks', 'manifest.json');
+      if (fs.existsSync(m)) {
+        manifest = m;
+        source = `$${envVars[tier]}`;
+      }
+    }
+    if (!manifest) {
+      const m = path.join(cwd, '..', tier === 'pro' ? 'Pro' : 'Business', 'hooks', 'manifest.json');
+      if (fs.existsSync(m)) {
+        manifest = m;
+        source = 'sibling';
+      }
+    }
+    if (!manifest) {
+      for (const root of wellKnown[tier]) {
+        const m = path.join(root, 'hooks', 'manifest.json');
+        if (fs.existsSync(m)) {
+          manifest = m;
+          source = 'well-known';
+          break;
+        }
+      }
+    }
+
+    if (manifest) {
+      detected.push({ tier, source, version: readManifestVersion(manifest) });
+    }
+  }
+
+  if (detected.length === 0) return;
+
+  // Suppress hint if any tier hook already wired (project-local OR global)
+  const tierEnvRe = /\$\{RUNE_[A-Z][A-Z0-9_]*_ROOT\}/;
+  const settingsPaths = [path.join(cwd, '.claude', 'settings.json'), path.join(os.homedir(), '.claude', 'settings.json')];
+  for (const settingsPath of settingsPaths) {
+    if (!fs.existsSync(settingsPath)) continue;
+    try {
+      const content = fs.readFileSync(settingsPath, 'utf-8');
+      if (tierEnvRe.test(content)) return;
+    } catch {
+      // ignore unreadable settings.json — fall through to print hint
+    }
+  }
+
+  console.log('\n=== Rune Tier Hint ===');
+  for (const { tier, source, version } of detected) {
+    const cap = tier.charAt(0).toUpperCase() + tier.slice(1);
+    console.log(`${cap} detected: ${source} (v${version})`);
+  }
+  const tierFlag = detected.map((d) => d.tier).join(',');
+  console.log(`Wire it: \`npx @rune-kit/rune setup --global --tier ${tierFlag}\``);
+  console.log('(adds tier-specific hooks: autopilot circuit-breaker, context-sense, statusline)');
+}
+
+function readManifestVersion(manifestPath) {
+  try {
+    return JSON.parse(fs.readFileSync(manifestPath, 'utf-8')).version || 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rune-kit/rune",
-  "version": "2.17.1",
+  "version": "2.18.0",
   "description": "64-skill mesh for AI coding assistants — runtime auto-discipline via native hooks (Claude/Cursor/Windsurf/Antigravity), 5-layer architecture, 215+ connections, multi-platform compiler. v2.17 adds quarantine L3 for prompt-injection advisory on untrusted external content.",
   "type": "module",
   "bin": {

package/skills/asset-creator/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: asset-creator
-description: "Creates code-based visual assets — SVG icons, OG image HTML templates, social banners, and icon sets. Outputs files with usage instructions."
+description: "Creates code-based visual assets — SVG icons, OG image HTML templates, social banners, and icon sets. Use when generating visuals as code (vector/HTML), NOT raster images — for raster generation see @rune-pro/media. Outputs files with usage instructions."
 metadata:
   author: runedev
   version: "0.2.0"

package/skills/audit/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: audit
-description: "Comprehensive project audit — security, dependencies, code quality, architecture, performance, infra, docs, and mesh analytics. Delegates to specialist skills and generates an 8-dimension health score."
+description: "Comprehensive project audit — security, dependencies, code quality, architecture, performance, infra, docs, and mesh analytics. Use when needing a full 8-dimension health-score snapshot before a major release, M&A diligence, or quarterly review. Delegates to specialist skills (sentinel, dependency-doctor, perf, autopsy, etc.)."
 metadata:
   author: runedev
-  version: "0.4.0"
+  version: "0.5.0"
   layer: L2
   model: sonnet
   group: quality
@@ -130,6 +130,24 @@ grep -rn "\.unwrap()" src/ --include="*.rs"
 
 Merge autopsy report + supplementary findings.
 
+**3.5 Zombie Code Detection**
+
+Identify code that is effectively dead but hasn't been formally removed. Zombie code increases surface area, confuses contributors, and accumulates security debt.
+
+| Signal | Detection Method | Severity |
+|--------|-----------------|----------|
+| No commits in 6+ months | `git log --since="6 months ago" -- <file>` returns empty | MEDIUM |
+| No test coverage | File not imported by any test file (Grep for filename in `**/*.test.*` / `**/*.spec.*`) | MEDIUM |
+| No owner | File not in CODEOWNERS, no author active in last 6 months | LOW |
+| Failing tests referencing the module | Test suite has skipped/failing tests for this module | HIGH |
+| Unpatched CVEs in dependencies only this module uses | Cross-reference dependency-doctor CVE list with per-file imports | HIGH |
+| Orphaned docs | README/docs reference files or APIs that no longer exist | LOW |
+
+**Zombie Code Verdict:**
+- 3+ signals on same file/module → flag as **ZOMBIE** in audit report
+- Recommend: archive (move to `_deprecated/`), delete, or assign owner
+- Do NOT auto-delete — present zombie list to user for decision
+
 ---
 
 ### Phase 4: Architecture Audit