@rune-kit/rune 2.17.1 → 2.18.1

package/compiler/commands/hooks/drift.js

@@ -62,7 +62,8 @@ export async function checkHookDrift(projectRoot) {
         platform: id,
         event: null,
         status: 'mixed-preset',
-        message: 'settings.json contains both gentle and strict Rune entries — re-run `rune hooks install --preset <gentle|strict>` to converge',
+        message:
+          'settings.json contains both gentle and strict Rune entries — re-run `rune hooks install --preset <gentle|strict>` to converge',
       });
     }
 
@@ -159,7 +160,9 @@ export function formatHookDriftResult(result) {
   }
 
   lines.push('');
-  lines.push(`  Summary: ${result.summary.drifted} drifted, ${result.summary.missing} missing, ${result.summary.errors} error(s).`);
+  lines.push(
+    `  Summary: ${result.summary.drifted} drifted, ${result.summary.missing} missing, ${result.summary.errors} error(s).`,
+  );
   lines.push('  Resolution: re-run `rune hooks install --preset <gentle|strict>` to re-converge.');
   lines.push('  This is a reporter — operator decides what to do with the findings.');
 

package/compiler/commands/setup.js

@@ -21,11 +21,12 @@
  */
 
 import { existsSync, readFileSync } from 'node:fs';
+import { cp, readdir, readFile, rm } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { createInterface } from 'node:readline';
 import { installHooks } from './hooks/install.js';
-import { TIER_ENV_VARS } from './hooks/tiers.js';
+import { resolveTier, TIER_ENV_VARS } from './hooks/tiers.js';
 
 export const WELL_KNOWN_TIER_PATHS = {
   pro: ['D:/Project/Rune/Pro', path.join(os.homedir(), 'rune-pro'), path.join(os.homedir(), 'Project', 'Rune', 'Pro')],
@@ -38,9 +39,9 @@ export const WELL_KNOWN_TIER_PATHS = {
 
 /**
  * @param {{ projectRoot: string, runeRoot: string, args: object }} opts
- * @returns {Promise<{ scope: string, tiers: string[], preset: string, written: boolean, files: string[], notes: string[] }>}
+ * @returns {Promise<{ scope: string, tiers: string[], preset: string, written: boolean, files: string[], notes: string[], skillResults: Array<{tier: string, installed: string[], skipped: Array<{skill: string, reason: string}>, reason: string|null}> }>}
  */
-export async function runSetup({ projectRoot, runeRoot: _runeRoot, args = {} }) {
+export async function runSetup({ projectRoot, runeRoot, args = {} }) {
   const detected = detectTiers(projectRoot);
 
   // Scope resolution
@@ -88,16 +89,180 @@ export async function runSetup({ projectRoot, runeRoot: _runeRoot, args = {} })
     dry: args.dry,
   });
 
+  // Install tier skill files into <runeRoot>/skills/ so Claude Code (and any
+  // plugin-aware platform) discovers them alongside Free skills. Without this
+  // step, paid tiers ship hooks only — `rune:autopilot` returns "Unknown skill"
+  // because Pro/skills/autopilot/ is invisible to the plugin runtime.
+  const skillResults = [];
+  for (const tier of tiers) {
+    try {
+      const tierManifest = await resolveTier(tier, projectRoot);
+      const skillResult = await installTierSkills({
+        tier,
+        tierManifest,
+        runeRoot,
+        dry: args.dry,
+      });
+      skillResults.push(skillResult);
+    } catch (err) {
+      skillResults.push({ tier, installed: [], skipped: [], reason: err.message });
+    }
+  }
+
   return {
     scope,
     targetRoot,
     tiers,
     preset,
     detected,
+    skillResults,
     ...result,
   };
 }
 
+/**
+ * Copy a tier's skill directories into the Free plugin's skills/ folder so
+ * the Claude Code plugin runtime discovers them with the `rune:` prefix.
+ *
+ * Idempotent: existing skill directories are SKIPPED (not overwritten). This
+ * protects Free skills from being clobbered by a same-named Pro skill, and
+ * protects an in-place edit of a previously-installed Pro skill from being
+ * stomped on a re-run.
+ *
+ * Pre-condition: tierManifest.source points at the absolute path of the tier's
+ * manifest.json (set by validateManifest). Tier root = grandparent of that path.
+ *
+ * @param {object} opts
+ * @param {string} opts.tier
+ * @param {import('./hooks/tiers.js').TierManifest} opts.tierManifest
+ * @param {string} opts.runeRoot — target is `<runeRoot>/skills/`
+ * @param {boolean} [opts.dry]
+ * @returns {Promise<{tier: string, installed: string[], skipped: Array<{skill: string, reason: string}>, reason: string|null}>}
+ */
+export async function installTierSkills({ tier, tierManifest, runeRoot, dry }) {
+  if (!tierManifest?.source) {
+    return { tier, installed: [], skipped: [], reason: 'tier manifest source missing' };
+  }
+  // Defensive: validateManifest accepts any string; only locateTierManifest guarantees absolute.
+  // Reject relative to keep tierRoot derivation honest.
+  if (!path.isAbsolute(tierManifest.source)) {
+    return {
+      tier,
+      installed: [],
+      skipped: [],
+      reason: `tier manifest source must be absolute (got ${tierManifest.source})`,
+    };
+  }
+  const tierRoot = path.dirname(path.dirname(tierManifest.source));
+  const sourceDir = path.join(tierRoot, 'skills');
+  if (!existsSync(sourceDir)) {
+    return { tier, installed: [], skipped: [], reason: `no skills/ dir at ${sourceDir}` };
+  }
+  if (!runeRoot) {
+    return { tier, installed: [], skipped: [], reason: 'runeRoot not provided' };
+  }
+  const targetDir = path.join(runeRoot, 'skills');
+  if (!existsSync(targetDir)) {
+    return { tier, installed: [], skipped: [], reason: `target skills/ missing at ${targetDir}` };
+  }
+  const installed = [];
+  const skipped = [];
+  const entries = await readdir(sourceDir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (!entry.isDirectory()) {
+      // Reject symlinks even when their target is a directory — `cp` with default
+      // dereference=false would recreate the symlink and let the Claude Code runtime
+      // follow it outside runeRoot/skills/ at read time (POSIX symlink-escape).
+      if (entry.isSymbolicLink()) {
+        skipped.push({ skill: entry.name, reason: 'rejected: symlink (would escape sandbox)' });
+      }
+      continue;
+    }
+    const skillName = entry.name;
+    // Guard against path traversal via adversarial directory names (../, /, \).
+    // A compromised tier repo with a skill dir like '../../../etc' would otherwise
+    // escape runeRoot/skills/ and overwrite arbitrary files. assertSafeTierName
+    // in tiers.js covers the tier name but NOT per-skill directory names.
+    if (path.basename(skillName) !== skillName || skillName === '.' || skillName === '..') {
+      skipped.push({ skill: skillName, reason: 'rejected: unsafe directory name' });
+      continue;
+    }
+    const src = path.join(sourceDir, skillName);
+    const dst = path.join(targetDir, skillName);
+    if (existsSync(dst)) {
+      const drift = await detectVersionDrift(src, dst);
+      skipped.push({ skill: skillName, reason: drift || 'already present' });
+      continue;
+    }
+    if (!dry) {
+      try {
+        // dereference: true → copy symlink targets as content instead of recreating
+        // symlinks at dst. Belt-and-suspenders alongside the isSymbolicLink reject above
+        // (nested symlinks inside a skill dir would otherwise still recreate).
+        await cp(src, dst, { recursive: true, dereference: true });
+      } catch (err) {
+        // Clean partial-copy residue so next run isn't silently locked-out by
+        // existsSync(dst) on a corrupt half-written directory.
+        await rm(dst, { recursive: true, force: true }).catch(() => {});
+        skipped.push({ skill: skillName, reason: `copy failed: ${err.message}` });
+        continue;
+      }
+    }
+    installed.push(skillName);
+  }
+  return { tier, installed, skipped, reason: null };
+}
+
+/**
+ * Compare source SKILL.md version against installed version. Returns a string
+ * describing the drift if source is newer (so user knows an upgrade exists),
+ * or null when versions match / cannot be parsed. Never throws — best-effort.
+ *
+ * @param {string} srcSkillDir
+ * @param {string} dstSkillDir
+ * @returns {Promise<string|null>}
+ */
+async function detectVersionDrift(srcSkillDir, dstSkillDir) {
+  try {
+    const [srcVer, dstVer] = await Promise.all([
+      readSkillVersion(path.join(srcSkillDir, 'SKILL.md')),
+      readSkillVersion(path.join(dstSkillDir, 'SKILL.md')),
+    ]);
+    if (!srcVer || !dstVer) return null;
+    if (srcVer === dstVer) return `already present (v${dstVer})`;
+    return `stale: installed v${dstVer}, source has v${srcVer} — delete target dir to upgrade`;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Extract version string from a SKILL.md `metadata.version` field. Minimal
+ * YAML scan scoped to the `metadata:` block — avoids false positives from
+ * multiline description continuation lines that contain `version:` text
+ * (e.g. `description: |\n  version: 1.0.0 is legacy`). Avoids pulling in a
+ * full YAML dependency for one field.
+ *
+ * Returns null when SKILL.md cannot be read, frontmatter missing, metadata
+ * block missing, or version field absent.
+ *
+ * @param {string} skillMdPath
+ * @returns {Promise<string|null>}
+ */
+async function readSkillVersion(skillMdPath) {
+  try {
+    const content = await readFile(skillMdPath, 'utf-8');
+    const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
+    if (!fmMatch) return null;
+    // Require metadata: header followed by an indented version: line.
+    // Indent is preserved so a top-level `version:` (outside metadata) doesn't match.
+    const verMatch = fmMatch[1].match(/^metadata:\s*\n(?:\s+[^\n]*\n)*?\s+version:\s*["']?([^"'\s#]+)/m);
+    return verMatch ? verMatch[1] : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Auto-detect Pro/Business tiers across env vars, sibling paths, and well-known
  * locations. Returns { pro: { path, source } | null, business: { ... } | null }.
@@ -222,10 +387,34 @@ export function formatSetupResult(result) {
   lines.push('');
   lines.push('  Rune Setup Complete');
   lines.push('  ──────────────────');
-  lines.push(`  Scope:     ${result.scope === 'global' ? 'GLOBAL (~/.claude/settings.json)' : `current project (${result.targetRoot})`}`);
+  lines.push(
+    `  Scope:     ${result.scope === 'global' ? 'GLOBAL (~/.claude/settings.json)' : `current project (${result.targetRoot})`}`,
+  );
   lines.push(`  Tiers:     Free${result.tiers.length > 0 ? ` + ${result.tiers.join(' + ')}` : ''}`);
   lines.push(`  Preset:    ${result.preset}`);
   lines.push(`  Platforms: ${(result.platforms || []).join(', ') || '—'}`);
+  for (const sr of result.skillResults || []) {
+    if (sr.installed.length > 0) {
+      const preview = sr.installed.slice(0, 3).join(', ');
+      const more = sr.installed.length > 3 ? `, +${sr.installed.length - 3}` : '';
+      lines.push(`  Skills:    ${sr.tier}: ${sr.installed.length} installed (${preview}${more})`);
+    }
+    if (sr.skipped.length > 0) {
+      const rejected = sr.skipped.filter((s) => s.reason.startsWith('rejected:'));
+      const benign = sr.skipped.length - rejected.length;
+      const parts = [];
+      if (benign > 0) parts.push(`${benign} already present`);
+      if (rejected.length > 0) parts.push(`${rejected.length} rejected`);
+      lines.push(`  Skipped:   ${sr.tier}: ${parts.join(', ')}`);
+      // Surface rejection details so the operator can investigate a compromised tier repo.
+      for (const r of rejected) {
+        lines.push(`    ⚠ ${r.skill}: ${r.reason}`);
+      }
+    }
+    if (sr.reason) {
+      lines.push(`  Skill warn:${sr.tier}: ${sr.reason}`);
+    }
+  }
   if (result.notes?.length) {
     lines.push('');
     lines.push('  Notes:');

package/compiler/emitter.js

@@ -700,11 +700,44 @@ export async function buildAll({
   await writeFile(path.join(outputDir, 'skill-index.json'), `${JSON.stringify(skillIndex, null, 2)}\n`, 'utf-8');
   stats.files.push('skill-index.json');
 
-  // Generate AGENTS.md for Codex (OpenAI convention — not used by other platforms)
-  if (adapter.name === 'codex') {
-    const agentsMdContent = generateAgentsMd(stats, adapter);
-    await writeFile(path.join(outputRoot, 'AGENTS.md'), agentsMdContent, 'utf-8');
-    stats.files.push('AGENTS.md');
+  // Generic extra-files hook: any adapter can emit additional index/bundle files
+  // alongside per-skill files (e.g. aider's .aider.conf.yml, qwen's QWEN.md, gemini's GEMINI.md bundle).
+  // Hook contract: paths MUST be relative to outputRoot — absolute paths are rejected to prevent
+  // accidental writes outside the project tree. Adapters receive a frozen stats snapshot so reads
+  // are deterministic regardless of where the hook fires relative to other emit steps.
+  if (typeof adapter.generateExtraFiles === 'function') {
+    const frozenStats = Object.freeze({ ...stats, files: Object.freeze([...stats.files]) });
+    const extras = await adapter.generateExtraFiles({
+      parsedSkills,
+      stats: frozenStats,
+      runeRoot,
+      outputRoot,
+      outputDir,
+    });
+    if (Array.isArray(extras)) {
+      const outputRootResolved = path.resolve(outputRoot);
+      for (const extra of extras) {
+        if (!extra || !extra.path || extra.content == null) continue;
+        if (path.isAbsolute(extra.path)) {
+          stats.errors.push({
+            adapter: adapter.name,
+            error: `generateExtraFiles must return relative paths, got absolute: ${extra.path}`,
+          });
+          continue;
+        }
+        const fullPath = path.resolve(outputRootResolved, extra.path);
+        if (fullPath !== outputRootResolved && !fullPath.startsWith(outputRootResolved + path.sep)) {
+          stats.errors.push({
+            adapter: adapter.name,
+            error: `generateExtraFiles path escapes outputRoot: ${extra.path}`,
+          });
+          continue;
+        }
+        await mkdir(path.dirname(fullPath), { recursive: true });
+        await writeFile(fullPath, extra.content, 'utf-8');
+        stats.files.push(path.relative(outputRoot, fullPath).replaceAll('\\', '/'));
+      }
+    }
   }
 
   // OpenClaw adapter: generate manifest + TypeScript entry point
@@ -774,42 +807,6 @@ function generateIndex(stats, adapter) {
   return lines.join('\n');
 }
 
-/**
- * Generate AGENTS.md for Codex (OpenAI convention)
- * Uses dynamic counts from build stats — no hardcoded skill lists
- */
-function generateAgentsMd(stats, adapter) {
-  const lines = [
-    '# Rune — Project Configuration',
-    '',
-    '## Overview',
-    '',
-    'Rune is an interconnected skill ecosystem for AI coding assistants.',
-    `${stats.skillCount} core skills | 5-layer mesh architecture | ${stats.crossRefsResolved} connections | Multi-platform.`,
-    'Philosophy: "Less skills. Deeper connections."',
-    '',
-    `Platform: ${adapter.name}`,
-    '',
-    '## Skills',
-    '',
-    `**${stats.skillCount} core skills** + **${stats.packCount} extension packs**`,
-    '',
-    '## Usage',
-    '',
-    'Reference skills using the `Skill` tool or delegate to subagents using the `Agent` tool.',
-    '',
-    '## Skills Directory',
-    '',
-    `Skills are located in: ${adapter.outputDir}/`,
-    '',
-    '---',
-    '> Rune Skill Mesh — https://github.com/rune-kit/rune',
-    '',
-  ];
-
-  return lines.join('\n');
-}
-
 /**
  * Intent keyword patterns for each skill — extracted from description + Triggers section
  * Maps common user intent words to the skill that handles them

package/hooks/session-start/index.cjs

@@ -69,3 +69,94 @@ if (fs.existsSync(runeDir)) {
 } else {
   console.log('[Rune: No .rune/ directory found. Run /rune onboard to set up project context.]');
 }
+
+// Tier detection hint (v2.17.1+) — Pro/Business plugins live in private repos
+// and aren't auto-loaded like the Free plugin. If detected at sibling / env /
+// well-known path AND tier hooks aren't already wired in settings.json, nudge
+// user toward `rune setup`. Self-suppressing — once wired, the check fails and
+// the hint stops firing.
+detectTierHint();
+
+function detectTierHint() {
+  const envVars = { pro: 'RUNE_PRO_ROOT', business: 'RUNE_BUSINESS_ROOT' };
+  const wellKnown = {
+    pro: [
+      'D:/Project/Rune/Pro',
+      path.join(os.homedir(), 'rune-pro'),
+      path.join(os.homedir(), 'Project', 'Rune', 'Pro'),
+    ],
+    business: [
+      'D:/Project/Rune/Business',
+      path.join(os.homedir(), 'rune-business'),
+      path.join(os.homedir(), 'Project', 'Rune', 'Business'),
+    ],
+  };
+
+  const detected = [];
+  for (const tier of ['pro', 'business']) {
+    let manifest = null;
+    let source = null;
+
+    const fromEnv = process.env[envVars[tier]];
+    if (fromEnv) {
+      const m = path.join(fromEnv, 'hooks', 'manifest.json');
+      if (fs.existsSync(m)) {
+        manifest = m;
+        source = `$${envVars[tier]}`;
+      }
+    }
+    if (!manifest) {
+      const m = path.join(cwd, '..', tier === 'pro' ? 'Pro' : 'Business', 'hooks', 'manifest.json');
+      if (fs.existsSync(m)) {
+        manifest = m;
+        source = 'sibling';
+      }
+    }
+    if (!manifest) {
+      for (const root of wellKnown[tier]) {
+        const m = path.join(root, 'hooks', 'manifest.json');
+        if (fs.existsSync(m)) {
+          manifest = m;
+          source = 'well-known';
+          break;
+        }
+      }
+    }
+
+    if (manifest) {
+      detected.push({ tier, source, version: readManifestVersion(manifest) });
+    }
+  }
+
+  if (detected.length === 0) return;
+
+  // Suppress hint if any tier hook already wired (project-local OR global)
+  const tierEnvRe = /\$\{RUNE_[A-Z][A-Z0-9_]*_ROOT\}/;
+  const settingsPaths = [path.join(cwd, '.claude', 'settings.json'), path.join(os.homedir(), '.claude', 'settings.json')];
+  for (const settingsPath of settingsPaths) {
+    if (!fs.existsSync(settingsPath)) continue;
+    try {
+      const content = fs.readFileSync(settingsPath, 'utf-8');
+      if (tierEnvRe.test(content)) return;
+    } catch {
+      // ignore unreadable settings.json — fall through to print hint
+    }
+  }
+
+  console.log('\n=== Rune Tier Hint ===');
+  for (const { tier, source, version } of detected) {
+    const cap = tier.charAt(0).toUpperCase() + tier.slice(1);
+    console.log(`${cap} detected: ${source} (v${version})`);
+  }
+  const tierFlag = detected.map((d) => d.tier).join(',');
+  console.log(`Wire it: \`npx @rune-kit/rune setup --global --tier ${tierFlag}\``);
+  console.log('(adds tier-specific hooks: autopilot circuit-breaker, context-sense, statusline)');
+}
+
+function readManifestVersion(manifestPath) {
+  try {
+    return JSON.parse(fs.readFileSync(manifestPath, 'utf-8')).version || 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rune-kit/rune",
-  "version": "2.17.1",
+  "version": "2.18.1",
   "description": "64-skill mesh for AI coding assistants — runtime auto-discipline via native hooks (Claude/Cursor/Windsurf/Antigravity), 5-layer architecture, 215+ connections, multi-platform compiler. v2.17 adds quarantine L3 for prompt-injection advisory on untrusted external content.",
   "type": "module",
   "bin": {

package/skills/asset-creator/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: asset-creator
-description: "Creates code-based visual assets — SVG icons, OG image HTML templates, social banners, and icon sets. Outputs files with usage instructions."
+description: "Creates code-based visual assets — SVG icons, OG image HTML templates, social banners, and icon sets. Use when generating visuals as code (vector/HTML), NOT raster images — for raster generation see @rune-pro/media. Outputs files with usage instructions."
 metadata:
   author: runedev
   version: "0.2.0"

package/skills/audit/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: audit
-description: "Comprehensive project audit — security, dependencies, code quality, architecture, performance, infra, docs, and mesh analytics. Delegates to specialist skills and generates an 8-dimension health score."
+description: "Comprehensive project audit — security, dependencies, code quality, architecture, performance, infra, docs, and mesh analytics. Use when needing a full 8-dimension health-score snapshot before a major release, M&A diligence, or quarterly review. Delegates to specialist skills (sentinel, dependency-doctor, perf, autopsy, etc.)."
 metadata:
   author: runedev
-  version: "0.4.0"
+  version: "0.5.0"
   layer: L2
   model: sonnet
   group: quality
@@ -130,6 +130,24 @@ grep -rn "\.unwrap()" src/ --include="*.rs"
 
 Merge autopsy report + supplementary findings.
 
+**3.5 Zombie Code Detection**
+
+Identify code that is effectively dead but hasn't been formally removed. Zombie code increases surface area, confuses contributors, and accumulates security debt.
+
+| Signal | Detection Method | Severity |
+|--------|-----------------|----------|
+| No commits in 6+ months | `git log --since="6 months ago" -- <file>` returns empty | MEDIUM |
+| No test coverage | File not imported by any test file (Grep for filename in `**/*.test.*` / `**/*.spec.*`) | MEDIUM |
+| No owner | File not in CODEOWNERS, no author active in last 6 months | LOW |
+| Failing tests referencing the module | Test suite has skipped/failing tests for this module | HIGH |
+| Unpatched CVEs in dependencies only this module uses | Cross-reference dependency-doctor CVE list with per-file imports | HIGH |
+| Orphaned docs | README/docs reference files or APIs that no longer exist | LOW |
+
+**Zombie Code Verdict:**
+- 3+ signals on same file/module → flag as **ZOMBIE** in audit report
+- Recommend: archive (move to `_deprecated/`), delete, or assign owner
+- Do NOT auto-delete — present zombie list to user for decision
+
 ---
 
 ### Phase 4: Architecture Audit