@rune-kit/rune 2.17.1 → 2.18.1

package/README.md

@@ -5,7 +5,7 @@
 <p align="center">
   <strong>Less skills. Deeper connections.</strong><br>
   A lean, interconnected skill ecosystem for AI coding assistants.<br>
-  64 skills · 203 connections · 40 signals · 8 platforms · MIT
+  64 skills · 203 connections · 40 signals · 13 platforms · MIT
 </p>
 
 <p align="center">
@@ -16,7 +16,7 @@
 </p>
 
 <p align="center">
-  <strong>Claude Code</strong> (native plugin) · <strong>Cursor</strong> · <strong>Windsurf</strong> · <strong>Google Antigravity</strong> · <strong>OpenAI Codex</strong> · <strong>OpenCode</strong> · any AI IDE
+  <strong>Claude Code</strong> (native plugin) · <strong>Cursor</strong> · <strong>Windsurf</strong> · <strong>Google Antigravity</strong> · <strong>OpenAI Codex</strong> · <strong>OpenCode</strong> · <strong>Aider</strong> · <strong>GitHub Copilot CLI</strong> · <strong>Gemini CLI</strong> · <strong>Qoder</strong> · <strong>Qwen Coder</strong> · any AI IDE
 </p>
 
 ## Why Rune?
@@ -83,7 +83,15 @@ _Methodology: Claude Code CLI headless mode (`claude -p --output-format json`),
 
 ---
 
-## What's New (v2.17.1 — One-Command Setup Wizard)
+## What's New (v2.18.1 — Setup Installs Tier Skills, Not Just Hooks)
+
+> **v2.18.1 (2026-05-17):** Bug fix — `rune setup --tier pro|business` now copies the tier's `skills/` directories into the Free plugin's `skills/` folder. Before this fix, paid tiers shipped hooks only, so `rune:autopilot` (Pro) returned `Unknown skill: rune:autopilot` because the SKILL.md was at `Pro/skills/autopilot/` but invisible to the Claude Code plugin runtime. New `installTierSkills` in `compiler/commands/setup.js` runs after `installHooks`, copies each `<tierRoot>/skills/<name>/` into `<runeRoot>/skills/`, idempotent (skips existing — protects Free skills from clobber and user-edited Pro skills from stomp), with path-traversal guard + symlink rejection + partial-copy cleanup + version-drift detection. Paired with Pro `autopilot-v1.5.0` (Step 0 LOAD now reads user-message context for plan path — same pattern cook uses). 25/26 setup tests pass (1 skipped on Windows — symlink test needs admin/dev-mode). Full CI 1444 tests.
+
+### Previous (v2.18.0 — Cross-Platform Reach + Discipline Tightening)
+
+> **v2.18.0 (2026-05-15):** Compiler grew from 8 → 13 platforms with five new adapters: **Aider** (per-skill `aider/rules/` + auto-generated `.aider.conf.yml` `read:` array), **GitHub Copilot CLI** (`.github/instructions/*.instructions.md` w/ documented `applyTo` YAML), **Gemini CLI** (bundled `GEMINI.md` for single-file context), **Qoder** (`.qoder/rules/` + AGENTS.md), **Qwen Coder** (`qwen/skills/` + `QWEN.md` with `@import`). New `adapter.generateExtraFiles()` hook with path-traversal guard + frozen stats snapshot — replaces ad-hoc adapter special-cases (codex AGENTS.md migrated). Discipline tightening: `design` v0.6.0 adds Step 2.9 Rules 4/5/6 (measurable constraints, no #000/#fff/lorem ipsum, CJK-first font stack); `skill-forge` v1.9.0 adds soft `examples/` convention for output-format skills; `sentinel-env` v0.4.0 expands Tier 8 binary detection (Bun, Cargo, Deno, Volta, asdf, proto). New `CONTRIBUTING.md` "What we don't accept" non-goals section. Source: graft from `nexu-io/html-anything` (Apache-2.0). CI 1435/1435.
+
+### Previous (v2.17.1 — One-Command Setup Wizard)
 
 > **v2.17.1 (2026-05-06):** New `rune setup` interactive wizard collapses the multi-step `cd <project> && export RUNE_PRO_ROOT && rune hooks install --preset gentle --tier pro` workflow into one command — auto-detects Pro/Business tiers across env var / sibling / well-known paths, asks for scope (current project / global) + preset, installs hooks. New `--global` flag on `rune hooks install` writes to `~/.claude/settings.json` (every Claude Code session, regardless of project). Non-interactive mode via `--here` / `--global` / `--tier` / `--preset` / `--dry` flags. Anti-paywall — wizard ships in Free, NOT Pro/Business (tier-agnostic infrastructure UX). Doc sweep: README "One-Command Setup", HOOKS.md restructure, agent skill-routing row for "set up rune". CI 1376/1376.
 
@@ -243,7 +251,7 @@ The wizard auto-detects what you have:
 ```
 Rune Setup Wizard
 ──────────────────
-Free version:    2.17.1 (cached)
+Free version:    2.18.0 (cached)
 Pro detected:    sibling (../Pro) (v1.1.0)
 Business:        not detected
 

package/compiler/__tests__/adapter-model-mapping.test.js

@@ -131,6 +131,86 @@ describe('Anthropic-native adapters are no-op for model field', () => {
   });
 });
 
+describe('qoder adapter model mapping (provider-agnostic)', () => {
+  const qoder = getAdapter('qoder');
+
+  test('opus translates to tier:heavy', () => {
+    const header = qoder.generateHeader({ ...baseSkill, model: 'opus' });
+    assert.match(header, /model: tier:heavy/);
+  });
+
+  test('omitted model produces no model line', () => {
+    const header = qoder.generateHeader({ ...baseSkill });
+    assert.doesNotMatch(header, /model:/);
+  });
+});
+
+describe('copilot adapter model mapping (tier-hint comment)', () => {
+  const copilot = getAdapter('copilot');
+
+  test('opus emits tier-hint:tier:heavy as comment (Copilot ignores model field)', () => {
+    const header = copilot.generateHeader({ ...baseSkill, model: 'opus' });
+    assert.match(header, /tier-hint: tier:heavy/);
+  });
+
+  test('omitted model produces no tier-hint line', () => {
+    const header = copilot.generateHeader({ ...baseSkill });
+    assert.doesNotMatch(header, /tier-hint/);
+  });
+});
+
+describe('aider adapter model mapping (inline header)', () => {
+  const aider = getAdapter('aider');
+
+  test('opus appears as tier:heavy inline', () => {
+    const header = aider.generateHeader({ ...baseSkill, model: 'opus' });
+    assert.match(header, /tier:heavy/);
+  });
+
+  test('omitted model produces no tier line', () => {
+    const header = aider.generateHeader({ ...baseSkill });
+    assert.doesNotMatch(header, /tier:/);
+  });
+});
+
+describe('qwen adapter model mapping (Qwen family)', () => {
+  const qwen = getAdapter('qwen');
+
+  test('opus translates to qwen3-coder-plus', () => {
+    const header = qwen.generateHeader({ ...baseSkill, model: 'opus' });
+    assert.match(header, /qwen3-coder-plus/);
+  });
+
+  test('sonnet translates to qwen3-coder', () => {
+    const header = qwen.generateHeader({ ...baseSkill, model: 'sonnet' });
+    assert.match(header, /qwen3-coder(?!-)/);
+  });
+
+  test('haiku translates to qwen3-coder-flash', () => {
+    const header = qwen.generateHeader({ ...baseSkill, model: 'haiku' });
+    assert.match(header, /qwen3-coder-flash/);
+  });
+});
+
+describe('gemini adapter model mapping (Gemini family)', () => {
+  const gemini = getAdapter('gemini');
+
+  test('opus translates to gemini-2.5-pro', () => {
+    const header = gemini.generateHeader({ ...baseSkill, model: 'opus' });
+    assert.match(header, /gemini-2\.5-pro/);
+  });
+
+  test('sonnet translates to gemini-2.5-flash', () => {
+    const header = gemini.generateHeader({ ...baseSkill, model: 'sonnet' });
+    assert.match(header, /gemini-2\.5-flash/);
+  });
+
+  test('haiku translates to gemini-2.0-flash-lite', () => {
+    const header = gemini.generateHeader({ ...baseSkill, model: 'haiku' });
+    assert.match(header, /gemini-2\.0-flash-lite/);
+  });
+});
+
 describe('cross-adapter consistency', () => {
   test('all 5 non-Anthropic adapters emit a model line for opus skills', () => {
     const adapterNames = ['codex', 'antigravity', 'opencode', 'openclaw', 'generic'];

package/compiler/__tests__/adapters.test.js

@@ -4,9 +4,23 @@ import { getAdapter, listPlatforms } from '../adapters/index.js';
 
 // --- Adapter registry ---
 
-test('listPlatforms returns all 8 platform adapters', () => {
+test('listPlatforms returns all 13 platform adapters', () => {
   const adapters = listPlatforms();
-  const expected = ['claude', 'cursor', 'windsurf', 'antigravity', 'codex', 'opencode', 'openclaw', 'generic'];
+  const expected = [
+    'claude',
+    'cursor',
+    'windsurf',
+    'antigravity',
+    'codex',
+    'opencode',
+    'openclaw',
+    'generic',
+    'aider',
+    'copilot',
+    'gemini',
+    'qoder',
+    'qwen',
+  ];
   for (const name of expected) {
     assert.ok(adapters.includes(name), `missing adapter: ${name}`);
   }
@@ -35,7 +49,19 @@ const REQUIRED_METHODS = [
 
 const REQUIRED_PROPS = ['name', 'outputDir', 'fileExtension', 'skillPrefix', 'skillSuffix'];
 
-const ADAPTER_NAMES = ['cursor', 'windsurf', 'antigravity', 'codex', 'opencode', 'generic'];
+const ADAPTER_NAMES = [
+  'cursor',
+  'windsurf',
+  'antigravity',
+  'codex',
+  'opencode',
+  'generic',
+  'aider',
+  'copilot',
+  'gemini',
+  'qoder',
+  'qwen',
+];
 
 for (const adapterName of ADAPTER_NAMES) {
   describe(`${adapterName} adapter contract`, () => {
@@ -107,3 +133,89 @@ test('codex adapter uses skill directories', () => {
   assert.strictEqual(codex.useSkillDirectories, true);
   assert.strictEqual(codex.skillFileName, 'SKILL.md');
 });
+
+// --- New v2.18 adapters: shape + generateExtraFiles contract ---
+
+test('qoder adapter targets .qoder/rules and emits AGENTS.md', async () => {
+  const qoder = getAdapter('qoder');
+  assert.strictEqual(qoder.outputDir, '.qoder/rules');
+  assert.strictEqual(qoder.useSkillDirectories, false);
+  assert.strictEqual(typeof qoder.generateExtraFiles, 'function');
+  const extras = await qoder.generateExtraFiles({ stats: { skillCount: 5, packCount: 1, files: [] } });
+  assert.ok(extras.some((e) => e.path === 'AGENTS.md' && e.content.includes('Rune')));
+});
+
+test('copilot adapter targets .github/instructions with .instructions.md ext', async () => {
+  const copilot = getAdapter('copilot');
+  assert.strictEqual(copilot.outputDir, '.github/instructions');
+  assert.strictEqual(copilot.fileExtension, '.instructions.md');
+  const header = copilot.generateHeader({ name: 'cook', layer: 'L1', group: 'orchestrator', description: 'Test' });
+  // Per docs.github.com Copilot CLI custom-instructions spec, only `applyTo` is a
+  // documented frontmatter field. Description and tier-hint must live in the body.
+  assert.ok(header.includes('applyTo: "**"'));
+  assert.ok(!/^description:/m.test(header.split('---')[1] || ''), 'description must NOT appear in frontmatter');
+  const extras = await copilot.generateExtraFiles({ stats: { skillCount: 5, packCount: 1, files: [] } });
+  assert.ok(extras.some((e) => e.path === '.github/copilot-instructions.md'));
+  assert.ok(extras.some((e) => e.path === 'AGENTS.md'));
+});
+
+test('codex adapter migrated to generateExtraFiles for AGENTS.md (no longer special-cased in emitter)', async () => {
+  const codex = getAdapter('codex');
+  assert.strictEqual(typeof codex.generateExtraFiles, 'function');
+  const extras = await codex.generateExtraFiles({
+    stats: { skillCount: 64, packCount: 14, crossRefsResolved: 287, files: [] },
+  });
+  const agentsMd = extras.find((e) => e.path === 'AGENTS.md');
+  assert.ok(agentsMd, 'codex must emit AGENTS.md via generateExtraFiles');
+  assert.ok(agentsMd.content.includes('Rune'));
+  assert.ok(agentsMd.content.includes('64 core skills'));
+});
+
+test('emitter rejects absolute paths from generateExtraFiles (path-traversal guard)', async () => {
+  // Smoke: verify both qoder and gemini return relative paths only (no absolute).
+  for (const name of ['qoder', 'copilot', 'aider', 'qwen', 'gemini', 'codex']) {
+    const adapter = getAdapter(name);
+    const extras = await adapter.generateExtraFiles({
+      stats: { skillCount: 1, packCount: 0, crossRefsResolved: 0, files: ['rune-cook.md'] },
+      outputDir: '/tmp/test',
+    });
+    for (const extra of extras || []) {
+      assert.ok(!extra.path.startsWith('/'), `${name} returned absolute path: ${extra.path}`);
+      assert.ok(!/^[A-Z]:[\\/]/.test(extra.path), `${name} returned Windows absolute path: ${extra.path}`);
+    }
+  }
+});
+
+test('aider adapter emits .aider.conf.yml with read array', async () => {
+  const aider = getAdapter('aider');
+  assert.strictEqual(aider.outputDir, 'aider/rules');
+  const extras = await aider.generateExtraFiles({
+    stats: { skillCount: 2, packCount: 0, files: ['rune-cook.md', 'rune-fix.md', 'index.md'] },
+  });
+  const conf = extras.find((e) => e.path === '.aider.conf.yml');
+  assert.ok(conf);
+  assert.ok(conf.content.includes('read:'));
+  assert.ok(conf.content.includes('aider/rules/rune-cook.md'));
+  assert.ok(conf.content.includes('aider/rules/rune-fix.md'));
+  // index.md must NOT be in the read array
+  assert.ok(!conf.content.includes('aider/rules/index.md'));
+});
+
+test('qwen adapter emits QWEN.md with @import lines', async () => {
+  const qwen = getAdapter('qwen');
+  assert.strictEqual(qwen.outputDir, 'qwen/skills');
+  const extras = await qwen.generateExtraFiles({
+    stats: { skillCount: 2, packCount: 0, files: ['rune-cook.md', 'rune-fix.md'] },
+  });
+  const qwenMd = extras.find((e) => e.path === 'QWEN.md');
+  assert.ok(qwenMd);
+  assert.ok(qwenMd.content.includes('@qwen/skills/rune-cook.md'));
+  assert.ok(qwenMd.content.includes('@qwen/skills/rune-fix.md'));
+});
+
+test('gemini adapter declares generateExtraFiles for bundled GEMINI.md', () => {
+  const gemini = getAdapter('gemini');
+  assert.strictEqual(gemini.outputDir, 'gemini/skills');
+  assert.strictEqual(typeof gemini.generateExtraFiles, 'function');
+  // Full bundle test happens in pipeline test (needs filesystem) — contract checked here.
+});

package/compiler/__tests__/setup.test.js

@@ -1,9 +1,11 @@
 import assert from 'node:assert';
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
+import { existsSync, readFileSync } from 'node:fs';
+import { mkdir, mkdtemp, rm, symlink, writeFile } from 'node:fs/promises';
+import { platform as osPlatform, tmpdir } from 'node:os';
 import path from 'node:path';
 import { afterEach, beforeEach, describe, test } from 'node:test';
-import { detectTiers, formatSetupResult, runSetup } from '../commands/setup.js';
+import { resolveTier } from '../commands/hooks/tiers.js';
+import { detectTiers, formatSetupResult, installTierSkills, runSetup } from '../commands/setup.js';
 
 let tmpRoot;
 
@@ -11,11 +13,11 @@ async function seedClaude(root) {
   await mkdir(path.join(root, '.claude'), { recursive: true });
 }
 
-async function seedTier(root, tier) {
-  const dir = path.join(root, '..', tier === 'pro' ? 'Pro' : 'Business', 'hooks');
-  await mkdir(dir, { recursive: true });
+async function seedTier(root, tier, opts = {}) {
+  const tierRoot = path.join(root, '..', tier === 'pro' ? 'Pro' : 'Business');
+  await mkdir(path.join(tierRoot, 'hooks'), { recursive: true });
   await writeFile(
-    path.join(dir, 'manifest.json'),
+    path.join(tierRoot, 'hooks', 'manifest.json'),
     JSON.stringify({
       tier,
       version: '1.0.0',
@@ -24,6 +26,19 @@ async function seedTier(root, tier) {
       entries: [],
     }),
   );
+  if (Array.isArray(opts.skills)) {
+    for (const skill of opts.skills) {
+      const skillDir = path.join(tierRoot, 'skills', skill);
+      await mkdir(skillDir, { recursive: true });
+      await writeFile(path.join(skillDir, 'SKILL.md'), `---\nname: ${skill}\n---\n# ${skill}\n`);
+    }
+  }
+}
+
+async function seedFakeRuneRoot(root) {
+  const runeRoot = path.join(root, 'fake-rune');
+  await mkdir(path.join(runeRoot, 'skills'), { recursive: true });
+  return runeRoot;
 }
 
 beforeEach(async () => {
@@ -120,6 +135,256 @@ describe('runSetup (non-interactive)', () => {
   });
 });
 
+describe('installTierSkills', () => {
+  test('copies Pro skill directories into runeRoot/skills', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await seedTier(projectRoot, 'pro', { skills: ['autopilot', 'context-inject'] });
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.strictEqual(result.tier, 'pro');
+    assert.deepStrictEqual(result.installed.sort(), ['autopilot', 'context-inject']);
+    assert.deepStrictEqual(result.skipped, []);
+    assert.strictEqual(result.reason, null);
+    assert.ok(existsSync(path.join(runeRoot, 'skills', 'autopilot', 'SKILL.md')));
+    assert.ok(existsSync(path.join(runeRoot, 'skills', 'context-inject', 'SKILL.md')));
+  });
+
+  test('skips skills already present (no Free clobber, no edit stomp)', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    // Pre-existing skill at target (e.g. Free skill with same name, or prior install)
+    await mkdir(path.join(runeRoot, 'skills', 'autopilot'), { recursive: true });
+    await writeFile(path.join(runeRoot, 'skills', 'autopilot', 'SKILL.md'), '# existing — must not be overwritten');
+    await seedTier(projectRoot, 'pro', { skills: ['autopilot'] });
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, []);
+    assert.strictEqual(result.skipped.length, 1);
+    assert.strictEqual(result.skipped[0].skill, 'autopilot');
+    const preserved = readFileSync(path.join(runeRoot, 'skills', 'autopilot', 'SKILL.md'), 'utf-8');
+    assert.match(preserved, /existing — must not be overwritten/);
+  });
+
+  test('dry mode reports installs without writing', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await seedTier(projectRoot, 'pro', { skills: ['autopilot'] });
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot, dry: true });
+
+    assert.deepStrictEqual(result.installed, ['autopilot']);
+    assert.ok(!existsSync(path.join(runeRoot, 'skills', 'autopilot')));
+  });
+
+  test('returns reason when tier has no skills/ dir', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await seedTier(projectRoot, 'pro'); // no skills option
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, []);
+    assert.match(result.reason, /no skills\//);
+  });
+
+  test('returns reason when runeRoot/skills target missing', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    await seedTier(projectRoot, 'pro', { skills: ['autopilot'] });
+    const manifest = await resolveTier('pro', projectRoot);
+    const runeRoot = path.join(tmpRoot, 'missing-rune-root');
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, []);
+    assert.match(result.reason, /target skills\/ missing/);
+  });
+
+  test('rejects adversarial skill directory names (path traversal)', async () => {
+    // The OS won't let us mkdir literal '..' or names with '/', so the basename
+    // guard is unit-tested at the path.basename level. The runtime guard inside
+    // installTierSkills uses the same path.basename(name) !== name check.
+    assert.strictEqual(path.basename('normal'), 'normal');
+    assert.notStrictEqual(path.basename('../escape'), '../escape');
+    assert.notStrictEqual(path.basename('a/b'), 'a/b');
+    // Integration smoke: a clean install still works after the guard was added
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await seedTier(projectRoot, 'pro', { skills: ['normal'] });
+    const manifest = await resolveTier('pro', projectRoot);
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+    assert.deepStrictEqual(result.installed, ['normal']);
+  });
+
+  test('rejects relative tierManifest.source path', async () => {
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    const fakeManifest = {
+      tier: 'pro',
+      source: './relative/manifest.json', // not absolute
+      entries: [],
+    };
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: fakeManifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, []);
+    assert.match(result.reason, /must be absolute/);
+  });
+
+  test('skips non-directory entries in skills/ (e.g. stray README.md)', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await seedTier(projectRoot, 'pro', { skills: ['autopilot'] });
+    // Stray file at sibling of skill dirs — must NOT be installed
+    await writeFile(path.join(tmpRoot, 'Pro', 'skills', 'README.md'), '# Pro skills\n');
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, ['autopilot']);
+    assert.ok(!existsSync(path.join(runeRoot, 'skills', 'README.md')));
+  });
+
+  test('skip message includes version drift when source > installed', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    // Installed v1.0.0 at target
+    await mkdir(path.join(runeRoot, 'skills', 'autopilot'), { recursive: true });
+    await writeFile(
+      path.join(runeRoot, 'skills', 'autopilot', 'SKILL.md'),
+      '---\nname: autopilot\nmetadata:\n  version: "1.0.0"\n---\n# autopilot\n',
+    );
+    // Seed Pro tier (creates manifest.json) then source skill with v1.5.0
+    await seedTier(projectRoot, 'pro');
+    await mkdir(path.join(tmpRoot, 'Pro', 'skills', 'autopilot'), { recursive: true });
+    await writeFile(
+      path.join(tmpRoot, 'Pro', 'skills', 'autopilot', 'SKILL.md'),
+      '---\nname: autopilot\nmetadata:\n  version: "1.5.0"\n---\n# autopilot\n',
+    );
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, []);
+    assert.strictEqual(result.skipped.length, 1);
+    assert.match(result.skipped[0].reason, /stale: installed v1\.0\.0, source has v1\.5\.0/);
+  });
+
+  test('rejects symlink entries inside skills/ (no sandbox escape)', async (t) => {
+    // Symlinks on Windows require elevated privileges or Developer Mode — skip cleanly.
+    if (osPlatform() === 'win32') {
+      t.skip('symlink creation needs admin/dev-mode on Windows');
+      return;
+    }
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await seedTier(projectRoot, 'pro', { skills: ['real-skill'] });
+    // Create a malicious symlink targeting /etc inside the Pro skills/ dir
+    const escapeTarget = path.join(tmpRoot, 'attacker-target');
+    await mkdir(escapeTarget, { recursive: true });
+    await writeFile(path.join(escapeTarget, 'SECRET'), 'should not be reachable');
+    await symlink(escapeTarget, path.join(tmpRoot, 'Pro', 'skills', 'escape-link'), 'dir');
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, ['real-skill']);
+    const rejected = result.skipped.find((s) => s.skill === 'escape-link');
+    assert.ok(rejected, 'symlink entry should appear in skipped[]');
+    assert.match(rejected.reason, /rejected: symlink/);
+    assert.ok(!existsSync(path.join(runeRoot, 'skills', 'escape-link')), 'symlink must not be recreated at target');
+  });
+
+  test('version regex ignores `version:` text inside multiline description', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    // Installed v1.0.0
+    await mkdir(path.join(runeRoot, 'skills', 'foo'), { recursive: true });
+    await writeFile(
+      path.join(runeRoot, 'skills', 'foo', 'SKILL.md'),
+      '---\nname: foo\nmetadata:\n  version: "1.0.0"\n---\n',
+    );
+    // Source has DECEPTIVE description with `version: 9.9.9` text inside YAML block scalar;
+    // real metadata.version is also 1.0.0 → drift detector must report "same version", NOT "stale v9.9.9 → v1.0.0"
+    await seedTier(projectRoot, 'pro');
+    await mkdir(path.join(tmpRoot, 'Pro', 'skills', 'foo'), { recursive: true });
+    await writeFile(
+      path.join(tmpRoot, 'Pro', 'skills', 'foo', 'SKILL.md'),
+      '---\nname: foo\ndescription: |\n  version: 9.9.9 is the legacy format we used to use\nmetadata:\n  version: "1.0.0"\n---\n',
+    );
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    // Same version — reason should be "already present (v1.0.0)", NOT a stale-drift message
+    assert.strictEqual(result.skipped.length, 1);
+    assert.match(result.skipped[0].reason, /already present \(v1\.0\.0\)/);
+    assert.doesNotMatch(result.skipped[0].reason, /9\.9\.9/);
+    assert.doesNotMatch(result.skipped[0].reason, /stale/);
+  });
+
+  test('skip message reports matching version when source == installed', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await mkdir(path.join(runeRoot, 'skills', 'autopilot'), { recursive: true });
+    await writeFile(
+      path.join(runeRoot, 'skills', 'autopilot', 'SKILL.md'),
+      '---\nname: autopilot\nmetadata:\n  version: "1.0.0"\n---\n',
+    );
+    await seedTier(projectRoot, 'pro');
+    await mkdir(path.join(tmpRoot, 'Pro', 'skills', 'autopilot'), { recursive: true });
+    await writeFile(
+      path.join(tmpRoot, 'Pro', 'skills', 'autopilot', 'SKILL.md'),
+      '---\nname: autopilot\nmetadata:\n  version: "1.0.0"\n---\n',
+    );
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.match(result.skipped[0].reason, /already present \(v1\.0\.0\)/);
+  });
+});
+
+describe('runSetup — Pro skill installation (regression: rune:autopilot Unknown skill)', () => {
+  test('installs Pro skills into runeRoot/skills as part of setup', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    await seedClaude(projectRoot);
+    await seedTier(projectRoot, 'pro', { skills: ['autopilot'] });
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+
+    const result = await runSetup({
+      projectRoot,
+      runeRoot,
+      args: { here: true, preset: 'gentle', tier: 'pro' },
+    });
+
+    assert.deepStrictEqual(result.tiers, ['pro']);
+    assert.strictEqual(result.skillResults.length, 1);
+    assert.strictEqual(result.skillResults[0].tier, 'pro');
+    assert.deepStrictEqual(result.skillResults[0].installed, ['autopilot']);
+    assert.ok(existsSync(path.join(runeRoot, 'skills', 'autopilot', 'SKILL.md')));
+  });
+
+  test('skillResults empty array when no tier selected', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    await seedClaude(projectRoot);
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+
+    const result = await runSetup({
+      projectRoot,
+      runeRoot,
+      args: { here: true, preset: 'gentle', 'no-tier': true },
+    });
+
+    assert.deepStrictEqual(result.skillResults, []);
+  });
+});
+
 describe('formatSetupResult', () => {
   test('renders summary with scope and tiers', () => {
     const out = formatSetupResult({
@@ -149,4 +414,65 @@ describe('formatSetupResult', () => {
     });
     assert.match(out, /GLOBAL/);
   });
+
+  test('renders skill install summary when skillResults present', () => {
+    const out = formatSetupResult({
+      scope: 'current',
+      targetRoot: '/path/to/project',
+      tiers: ['pro'],
+      preset: 'gentle',
+      platforms: ['claude'],
+      written: true,
+      notes: [],
+      skillResults: [{ tier: 'pro', installed: ['autopilot'], skipped: [], reason: null }],
+    });
+    assert.match(out, /Skills:.*pro: 1 installed.*autopilot/);
+  });
+
+  test('renders skip + warn lines for tiers with collisions or missing skills/', () => {
+    const out = formatSetupResult({
+      scope: 'current',
+      targetRoot: '/path/to/project',
+      tiers: ['pro', 'business'],
+      preset: 'gentle',
+      platforms: ['claude'],
+      written: true,
+      notes: [],
+      skillResults: [
+        { tier: 'pro', installed: [], skipped: [{ skill: 'autopilot', reason: 'already present' }], reason: null },
+        { tier: 'business', installed: [], skipped: [], reason: 'no skills/ dir at /tmp/Business/skills' },
+      ],
+    });
+    assert.match(out, /Skipped:.*pro: 1 already present/);
+    assert.match(out, /Skill warn:business: no skills\//);
+  });
+
+  test('partitions skipped into benign vs rejected and surfaces rejection details', () => {
+    const out = formatSetupResult({
+      scope: 'current',
+      targetRoot: '/path/to/project',
+      tiers: ['pro'],
+      preset: 'gentle',
+      platforms: ['claude'],
+      written: true,
+      notes: [],
+      skillResults: [
+        {
+          tier: 'pro',
+          installed: ['safe-skill'],
+          skipped: [
+            { skill: 'autopilot', reason: 'already present (v1.0.0)' },
+            { skill: 'evil-link', reason: 'rejected: symlink (would escape sandbox)' },
+            { skill: '../escape', reason: 'rejected: unsafe directory name' },
+          ],
+          reason: null,
+        },
+      ],
+    });
+    // Counts partitioned and reported together
+    assert.match(out, /Skipped:.*pro: 1 already present, 2 rejected/);
+    // Each rejected skill surfaced as a warning line (security visibility)
+    assert.match(out, /⚠ evil-link: rejected: symlink/);
+    assert.match(out, /⚠ \.\.\/escape: rejected: unsafe directory name/);
+  });
 });