@rune-kit/rune 2.18.0 → 2.18.1

package/README.md

@@ -83,7 +83,11 @@ _Methodology: Claude Code CLI headless mode (`claude -p --output-format json`),
 
 ---
 
-## What's New (v2.18.0 — Cross-Platform Reach + Discipline Tightening)
+## What's New (v2.18.1 — Setup Installs Tier Skills, Not Just Hooks)
+
+> **v2.18.1 (2026-05-17):** Bug fix — `rune setup --tier pro|business` now copies the tier's `skills/` directories into the Free plugin's `skills/` folder. Before this fix, paid tiers shipped hooks only, so `rune:autopilot` (Pro) returned `Unknown skill: rune:autopilot` because the SKILL.md was at `Pro/skills/autopilot/` but invisible to the Claude Code plugin runtime. New `installTierSkills` in `compiler/commands/setup.js` runs after `installHooks`, copies each `<tierRoot>/skills/<name>/` into `<runeRoot>/skills/`, idempotent (skips existing — protects Free skills from clobber and user-edited Pro skills from stomp), with path-traversal guard + symlink rejection + partial-copy cleanup + version-drift detection. Paired with Pro `autopilot-v1.5.0` (Step 0 LOAD now reads user-message context for plan path — same pattern cook uses). 25/26 setup tests pass (1 skipped on Windows — symlink test needs admin/dev-mode). Full CI 1444 tests.
+
+### Previous (v2.18.0 — Cross-Platform Reach + Discipline Tightening)
 
 > **v2.18.0 (2026-05-15):** Compiler grew from 8 → 13 platforms with five new adapters: **Aider** (per-skill `aider/rules/` + auto-generated `.aider.conf.yml` `read:` array), **GitHub Copilot CLI** (`.github/instructions/*.instructions.md` w/ documented `applyTo` YAML), **Gemini CLI** (bundled `GEMINI.md` for single-file context), **Qoder** (`.qoder/rules/` + AGENTS.md), **Qwen Coder** (`qwen/skills/` + `QWEN.md` with `@import`). New `adapter.generateExtraFiles()` hook with path-traversal guard + frozen stats snapshot — replaces ad-hoc adapter special-cases (codex AGENTS.md migrated). Discipline tightening: `design` v0.6.0 adds Step 2.9 Rules 4/5/6 (measurable constraints, no #000/#fff/lorem ipsum, CJK-first font stack); `skill-forge` v1.9.0 adds soft `examples/` convention for output-format skills; `sentinel-env` v0.4.0 expands Tier 8 binary detection (Bun, Cargo, Deno, Volta, asdf, proto). New `CONTRIBUTING.md` "What we don't accept" non-goals section. Source: graft from `nexu-io/html-anything` (Apache-2.0). CI 1435/1435.
 

package/compiler/__tests__/setup.test.js

@@ -1,9 +1,11 @@
 import assert from 'node:assert';
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
+import { existsSync, readFileSync } from 'node:fs';
+import { mkdir, mkdtemp, rm, symlink, writeFile } from 'node:fs/promises';
+import { platform as osPlatform, tmpdir } from 'node:os';
 import path from 'node:path';
 import { afterEach, beforeEach, describe, test } from 'node:test';
-import { detectTiers, formatSetupResult, runSetup } from '../commands/setup.js';
+import { resolveTier } from '../commands/hooks/tiers.js';
+import { detectTiers, formatSetupResult, installTierSkills, runSetup } from '../commands/setup.js';
 
 let tmpRoot;
 
@@ -11,11 +13,11 @@ async function seedClaude(root) {
   await mkdir(path.join(root, '.claude'), { recursive: true });
 }
 
-async function seedTier(root, tier) {
-  const dir = path.join(root, '..', tier === 'pro' ? 'Pro' : 'Business', 'hooks');
-  await mkdir(dir, { recursive: true });
+async function seedTier(root, tier, opts = {}) {
+  const tierRoot = path.join(root, '..', tier === 'pro' ? 'Pro' : 'Business');
+  await mkdir(path.join(tierRoot, 'hooks'), { recursive: true });
   await writeFile(
-    path.join(dir, 'manifest.json'),
+    path.join(tierRoot, 'hooks', 'manifest.json'),
     JSON.stringify({
       tier,
       version: '1.0.0',
@@ -24,6 +26,19 @@ async function seedTier(root, tier) {
       entries: [],
     }),
   );
+  if (Array.isArray(opts.skills)) {
+    for (const skill of opts.skills) {
+      const skillDir = path.join(tierRoot, 'skills', skill);
+      await mkdir(skillDir, { recursive: true });
+      await writeFile(path.join(skillDir, 'SKILL.md'), `---\nname: ${skill}\n---\n# ${skill}\n`);
+    }
+  }
+}
+
+async function seedFakeRuneRoot(root) {
+  const runeRoot = path.join(root, 'fake-rune');
+  await mkdir(path.join(runeRoot, 'skills'), { recursive: true });
+  return runeRoot;
 }
 
 beforeEach(async () => {
@@ -120,6 +135,256 @@ describe('runSetup (non-interactive)', () => {
   });
 });
 
+describe('installTierSkills', () => {
+  test('copies Pro skill directories into runeRoot/skills', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await seedTier(projectRoot, 'pro', { skills: ['autopilot', 'context-inject'] });
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.strictEqual(result.tier, 'pro');
+    assert.deepStrictEqual(result.installed.sort(), ['autopilot', 'context-inject']);
+    assert.deepStrictEqual(result.skipped, []);
+    assert.strictEqual(result.reason, null);
+    assert.ok(existsSync(path.join(runeRoot, 'skills', 'autopilot', 'SKILL.md')));
+    assert.ok(existsSync(path.join(runeRoot, 'skills', 'context-inject', 'SKILL.md')));
+  });
+
+  test('skips skills already present (no Free clobber, no edit stomp)', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    // Pre-existing skill at target (e.g. Free skill with same name, or prior install)
+    await mkdir(path.join(runeRoot, 'skills', 'autopilot'), { recursive: true });
+    await writeFile(path.join(runeRoot, 'skills', 'autopilot', 'SKILL.md'), '# existing — must not be overwritten');
+    await seedTier(projectRoot, 'pro', { skills: ['autopilot'] });
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, []);
+    assert.strictEqual(result.skipped.length, 1);
+    assert.strictEqual(result.skipped[0].skill, 'autopilot');
+    const preserved = readFileSync(path.join(runeRoot, 'skills', 'autopilot', 'SKILL.md'), 'utf-8');
+    assert.match(preserved, /existing — must not be overwritten/);
+  });
+
+  test('dry mode reports installs without writing', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await seedTier(projectRoot, 'pro', { skills: ['autopilot'] });
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot, dry: true });
+
+    assert.deepStrictEqual(result.installed, ['autopilot']);
+    assert.ok(!existsSync(path.join(runeRoot, 'skills', 'autopilot')));
+  });
+
+  test('returns reason when tier has no skills/ dir', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await seedTier(projectRoot, 'pro'); // no skills option
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, []);
+    assert.match(result.reason, /no skills\//);
+  });
+
+  test('returns reason when runeRoot/skills target missing', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    await seedTier(projectRoot, 'pro', { skills: ['autopilot'] });
+    const manifest = await resolveTier('pro', projectRoot);
+    const runeRoot = path.join(tmpRoot, 'missing-rune-root');
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, []);
+    assert.match(result.reason, /target skills\/ missing/);
+  });
+
+  test('rejects adversarial skill directory names (path traversal)', async () => {
+    // The OS won't let us mkdir literal '..' or names with '/', so the basename
+    // guard is unit-tested at the path.basename level. The runtime guard inside
+    // installTierSkills uses the same path.basename(name) !== name check.
+    assert.strictEqual(path.basename('normal'), 'normal');
+    assert.notStrictEqual(path.basename('../escape'), '../escape');
+    assert.notStrictEqual(path.basename('a/b'), 'a/b');
+    // Integration smoke: a clean install still works after the guard was added
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await seedTier(projectRoot, 'pro', { skills: ['normal'] });
+    const manifest = await resolveTier('pro', projectRoot);
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+    assert.deepStrictEqual(result.installed, ['normal']);
+  });
+
+  test('rejects relative tierManifest.source path', async () => {
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    const fakeManifest = {
+      tier: 'pro',
+      source: './relative/manifest.json', // not absolute
+      entries: [],
+    };
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: fakeManifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, []);
+    assert.match(result.reason, /must be absolute/);
+  });
+
+  test('skips non-directory entries in skills/ (e.g. stray README.md)', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await seedTier(projectRoot, 'pro', { skills: ['autopilot'] });
+    // Stray file at sibling of skill dirs — must NOT be installed
+    await writeFile(path.join(tmpRoot, 'Pro', 'skills', 'README.md'), '# Pro skills\n');
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, ['autopilot']);
+    assert.ok(!existsSync(path.join(runeRoot, 'skills', 'README.md')));
+  });
+
+  test('skip message includes version drift when source > installed', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    // Installed v1.0.0 at target
+    await mkdir(path.join(runeRoot, 'skills', 'autopilot'), { recursive: true });
+    await writeFile(
+      path.join(runeRoot, 'skills', 'autopilot', 'SKILL.md'),
+      '---\nname: autopilot\nmetadata:\n  version: "1.0.0"\n---\n# autopilot\n',
+    );
+    // Seed Pro tier (creates manifest.json) then source skill with v1.5.0
+    await seedTier(projectRoot, 'pro');
+    await mkdir(path.join(tmpRoot, 'Pro', 'skills', 'autopilot'), { recursive: true });
+    await writeFile(
+      path.join(tmpRoot, 'Pro', 'skills', 'autopilot', 'SKILL.md'),
+      '---\nname: autopilot\nmetadata:\n  version: "1.5.0"\n---\n# autopilot\n',
+    );
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, []);
+    assert.strictEqual(result.skipped.length, 1);
+    assert.match(result.skipped[0].reason, /stale: installed v1\.0\.0, source has v1\.5\.0/);
+  });
+
+  test('rejects symlink entries inside skills/ (no sandbox escape)', async (t) => {
+    // Symlinks on Windows require elevated privileges or Developer Mode — skip cleanly.
+    if (osPlatform() === 'win32') {
+      t.skip('symlink creation needs admin/dev-mode on Windows');
+      return;
+    }
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await seedTier(projectRoot, 'pro', { skills: ['real-skill'] });
+    // Create a malicious symlink targeting /etc inside the Pro skills/ dir
+    const escapeTarget = path.join(tmpRoot, 'attacker-target');
+    await mkdir(escapeTarget, { recursive: true });
+    await writeFile(path.join(escapeTarget, 'SECRET'), 'should not be reachable');
+    await symlink(escapeTarget, path.join(tmpRoot, 'Pro', 'skills', 'escape-link'), 'dir');
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.deepStrictEqual(result.installed, ['real-skill']);
+    const rejected = result.skipped.find((s) => s.skill === 'escape-link');
+    assert.ok(rejected, 'symlink entry should appear in skipped[]');
+    assert.match(rejected.reason, /rejected: symlink/);
+    assert.ok(!existsSync(path.join(runeRoot, 'skills', 'escape-link')), 'symlink must not be recreated at target');
+  });
+
+  test('version regex ignores `version:` text inside multiline description', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    // Installed v1.0.0
+    await mkdir(path.join(runeRoot, 'skills', 'foo'), { recursive: true });
+    await writeFile(
+      path.join(runeRoot, 'skills', 'foo', 'SKILL.md'),
+      '---\nname: foo\nmetadata:\n  version: "1.0.0"\n---\n',
+    );
+    // Source has DECEPTIVE description with `version: 9.9.9` text inside YAML block scalar;
+    // real metadata.version is also 1.0.0 → drift detector must report "same version", NOT "stale v9.9.9 → v1.0.0"
+    await seedTier(projectRoot, 'pro');
+    await mkdir(path.join(tmpRoot, 'Pro', 'skills', 'foo'), { recursive: true });
+    await writeFile(
+      path.join(tmpRoot, 'Pro', 'skills', 'foo', 'SKILL.md'),
+      '---\nname: foo\ndescription: |\n  version: 9.9.9 is the legacy format we used to use\nmetadata:\n  version: "1.0.0"\n---\n',
+    );
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    // Same version — reason should be "already present (v1.0.0)", NOT a stale-drift message
+    assert.strictEqual(result.skipped.length, 1);
+    assert.match(result.skipped[0].reason, /already present \(v1\.0\.0\)/);
+    assert.doesNotMatch(result.skipped[0].reason, /9\.9\.9/);
+    assert.doesNotMatch(result.skipped[0].reason, /stale/);
+  });
+
+  test('skip message reports matching version when source == installed', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+    await mkdir(path.join(runeRoot, 'skills', 'autopilot'), { recursive: true });
+    await writeFile(
+      path.join(runeRoot, 'skills', 'autopilot', 'SKILL.md'),
+      '---\nname: autopilot\nmetadata:\n  version: "1.0.0"\n---\n',
+    );
+    await seedTier(projectRoot, 'pro');
+    await mkdir(path.join(tmpRoot, 'Pro', 'skills', 'autopilot'), { recursive: true });
+    await writeFile(
+      path.join(tmpRoot, 'Pro', 'skills', 'autopilot', 'SKILL.md'),
+      '---\nname: autopilot\nmetadata:\n  version: "1.0.0"\n---\n',
+    );
+    const manifest = await resolveTier('pro', projectRoot);
+
+    const result = await installTierSkills({ tier: 'pro', tierManifest: manifest, runeRoot });
+
+    assert.match(result.skipped[0].reason, /already present \(v1\.0\.0\)/);
+  });
+});
+
+describe('runSetup — Pro skill installation (regression: rune:autopilot Unknown skill)', () => {
+  test('installs Pro skills into runeRoot/skills as part of setup', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    await seedClaude(projectRoot);
+    await seedTier(projectRoot, 'pro', { skills: ['autopilot'] });
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+
+    const result = await runSetup({
+      projectRoot,
+      runeRoot,
+      args: { here: true, preset: 'gentle', tier: 'pro' },
+    });
+
+    assert.deepStrictEqual(result.tiers, ['pro']);
+    assert.strictEqual(result.skillResults.length, 1);
+    assert.strictEqual(result.skillResults[0].tier, 'pro');
+    assert.deepStrictEqual(result.skillResults[0].installed, ['autopilot']);
+    assert.ok(existsSync(path.join(runeRoot, 'skills', 'autopilot', 'SKILL.md')));
+  });
+
+  test('skillResults empty array when no tier selected', async () => {
+    const projectRoot = path.join(tmpRoot, 'project');
+    await seedClaude(projectRoot);
+    const runeRoot = await seedFakeRuneRoot(tmpRoot);
+
+    const result = await runSetup({
+      projectRoot,
+      runeRoot,
+      args: { here: true, preset: 'gentle', 'no-tier': true },
+    });
+
+    assert.deepStrictEqual(result.skillResults, []);
+  });
+});
+
 describe('formatSetupResult', () => {
   test('renders summary with scope and tiers', () => {
     const out = formatSetupResult({
@@ -149,4 +414,65 @@ describe('formatSetupResult', () => {
     });
     assert.match(out, /GLOBAL/);
   });
+
+  test('renders skill install summary when skillResults present', () => {
+    const out = formatSetupResult({
+      scope: 'current',
+      targetRoot: '/path/to/project',
+      tiers: ['pro'],
+      preset: 'gentle',
+      platforms: ['claude'],
+      written: true,
+      notes: [],
+      skillResults: [{ tier: 'pro', installed: ['autopilot'], skipped: [], reason: null }],
+    });
+    assert.match(out, /Skills:.*pro: 1 installed.*autopilot/);
+  });
+
+  test('renders skip + warn lines for tiers with collisions or missing skills/', () => {
+    const out = formatSetupResult({
+      scope: 'current',
+      targetRoot: '/path/to/project',
+      tiers: ['pro', 'business'],
+      preset: 'gentle',
+      platforms: ['claude'],
+      written: true,
+      notes: [],
+      skillResults: [
+        { tier: 'pro', installed: [], skipped: [{ skill: 'autopilot', reason: 'already present' }], reason: null },
+        { tier: 'business', installed: [], skipped: [], reason: 'no skills/ dir at /tmp/Business/skills' },
+      ],
+    });
+    assert.match(out, /Skipped:.*pro: 1 already present/);
+    assert.match(out, /Skill warn:business: no skills\//);
+  });
+
+  test('partitions skipped into benign vs rejected and surfaces rejection details', () => {
+    const out = formatSetupResult({
+      scope: 'current',
+      targetRoot: '/path/to/project',
+      tiers: ['pro'],
+      preset: 'gentle',
+      platforms: ['claude'],
+      written: true,
+      notes: [],
+      skillResults: [
+        {
+          tier: 'pro',
+          installed: ['safe-skill'],
+          skipped: [
+            { skill: 'autopilot', reason: 'already present (v1.0.0)' },
+            { skill: 'evil-link', reason: 'rejected: symlink (would escape sandbox)' },
+            { skill: '../escape', reason: 'rejected: unsafe directory name' },
+          ],
+          reason: null,
+        },
+      ],
+    });
+    // Counts partitioned and reported together
+    assert.match(out, /Skipped:.*pro: 1 already present, 2 rejected/);
+    // Each rejected skill surfaced as a warning line (security visibility)
+    assert.match(out, /⚠ evil-link: rejected: symlink/);
+    assert.match(out, /⚠ \.\.\/escape: rejected: unsafe directory name/);
+  });
 });

package/compiler/commands/setup.js

@@ -21,11 +21,12 @@
  */
 
 import { existsSync, readFileSync } from 'node:fs';
+import { cp, readdir, readFile, rm } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { createInterface } from 'node:readline';
 import { installHooks } from './hooks/install.js';
-import { TIER_ENV_VARS } from './hooks/tiers.js';
+import { resolveTier, TIER_ENV_VARS } from './hooks/tiers.js';
 
 export const WELL_KNOWN_TIER_PATHS = {
   pro: ['D:/Project/Rune/Pro', path.join(os.homedir(), 'rune-pro'), path.join(os.homedir(), 'Project', 'Rune', 'Pro')],
@@ -38,9 +39,9 @@ export const WELL_KNOWN_TIER_PATHS = {
 
 /**
  * @param {{ projectRoot: string, runeRoot: string, args: object }} opts
- * @returns {Promise<{ scope: string, tiers: string[], preset: string, written: boolean, files: string[], notes: string[] }>}
+ * @returns {Promise<{ scope: string, tiers: string[], preset: string, written: boolean, files: string[], notes: string[], skillResults: Array<{tier: string, installed: string[], skipped: Array<{skill: string, reason: string}>, reason: string|null}> }>}
  */
-export async function runSetup({ projectRoot, runeRoot: _runeRoot, args = {} }) {
+export async function runSetup({ projectRoot, runeRoot, args = {} }) {
   const detected = detectTiers(projectRoot);
 
   // Scope resolution
@@ -88,16 +89,180 @@ export async function runSetup({ projectRoot, runeRoot: _runeRoot, args = {} })
     dry: args.dry,
   });
 
+  // Install tier skill files into <runeRoot>/skills/ so Claude Code (and any
+  // plugin-aware platform) discovers them alongside Free skills. Without this
+  // step, paid tiers ship hooks only — `rune:autopilot` returns "Unknown skill"
+  // because Pro/skills/autopilot/ is invisible to the plugin runtime.
+  const skillResults = [];
+  for (const tier of tiers) {
+    try {
+      const tierManifest = await resolveTier(tier, projectRoot);
+      const skillResult = await installTierSkills({
+        tier,
+        tierManifest,
+        runeRoot,
+        dry: args.dry,
+      });
+      skillResults.push(skillResult);
+    } catch (err) {
+      skillResults.push({ tier, installed: [], skipped: [], reason: err.message });
+    }
+  }
+
   return {
     scope,
     targetRoot,
     tiers,
     preset,
     detected,
+    skillResults,
     ...result,
   };
 }
 
+/**
+ * Copy a tier's skill directories into the Free plugin's skills/ folder so
+ * the Claude Code plugin runtime discovers them with the `rune:` prefix.
+ *
+ * Idempotent: existing skill directories are SKIPPED (not overwritten). This
+ * protects Free skills from being clobbered by a same-named Pro skill, and
+ * protects an in-place edit of a previously-installed Pro skill from being
+ * stomped on a re-run.
+ *
+ * Pre-condition: tierManifest.source points at the absolute path of the tier's
+ * manifest.json (set by validateManifest). Tier root = grandparent of that path.
+ *
+ * @param {object} opts
+ * @param {string} opts.tier
+ * @param {import('./hooks/tiers.js').TierManifest} opts.tierManifest
+ * @param {string} opts.runeRoot — target is `<runeRoot>/skills/`
+ * @param {boolean} [opts.dry]
+ * @returns {Promise<{tier: string, installed: string[], skipped: Array<{skill: string, reason: string}>, reason: string|null}>}
+ */
+export async function installTierSkills({ tier, tierManifest, runeRoot, dry }) {
+  if (!tierManifest?.source) {
+    return { tier, installed: [], skipped: [], reason: 'tier manifest source missing' };
+  }
+  // Defensive: validateManifest accepts any string; only locateTierManifest guarantees absolute.
+  // Reject relative to keep tierRoot derivation honest.
+  if (!path.isAbsolute(tierManifest.source)) {
+    return {
+      tier,
+      installed: [],
+      skipped: [],
+      reason: `tier manifest source must be absolute (got ${tierManifest.source})`,
+    };
+  }
+  const tierRoot = path.dirname(path.dirname(tierManifest.source));
+  const sourceDir = path.join(tierRoot, 'skills');
+  if (!existsSync(sourceDir)) {
+    return { tier, installed: [], skipped: [], reason: `no skills/ dir at ${sourceDir}` };
+  }
+  if (!runeRoot) {
+    return { tier, installed: [], skipped: [], reason: 'runeRoot not provided' };
+  }
+  const targetDir = path.join(runeRoot, 'skills');
+  if (!existsSync(targetDir)) {
+    return { tier, installed: [], skipped: [], reason: `target skills/ missing at ${targetDir}` };
+  }
+  const installed = [];
+  const skipped = [];
+  const entries = await readdir(sourceDir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (!entry.isDirectory()) {
+      // Reject symlinks even when their target is a directory — `cp` with default
+      // dereference=false would recreate the symlink and let the Claude Code runtime
+      // follow it outside runeRoot/skills/ at read time (POSIX symlink-escape).
+      if (entry.isSymbolicLink()) {
+        skipped.push({ skill: entry.name, reason: 'rejected: symlink (would escape sandbox)' });
+      }
+      continue;
+    }
+    const skillName = entry.name;
+    // Guard against path traversal via adversarial directory names (../, /, \).
+    // A compromised tier repo with a skill dir like '../../../etc' would otherwise
+    // escape runeRoot/skills/ and overwrite arbitrary files. assertSafeTierName
+    // in tiers.js covers the tier name but NOT per-skill directory names.
+    if (path.basename(skillName) !== skillName || skillName === '.' || skillName === '..') {
+      skipped.push({ skill: skillName, reason: 'rejected: unsafe directory name' });
+      continue;
+    }
+    const src = path.join(sourceDir, skillName);
+    const dst = path.join(targetDir, skillName);
+    if (existsSync(dst)) {
+      const drift = await detectVersionDrift(src, dst);
+      skipped.push({ skill: skillName, reason: drift || 'already present' });
+      continue;
+    }
+    if (!dry) {
+      try {
+        // dereference: true → copy symlink targets as content instead of recreating
+        // symlinks at dst. Belt-and-suspenders alongside the isSymbolicLink reject above
+        // (nested symlinks inside a skill dir would otherwise still recreate).
+        await cp(src, dst, { recursive: true, dereference: true });
+      } catch (err) {
+        // Clean partial-copy residue so next run isn't silently locked-out by
+        // existsSync(dst) on a corrupt half-written directory.
+        await rm(dst, { recursive: true, force: true }).catch(() => {});
+        skipped.push({ skill: skillName, reason: `copy failed: ${err.message}` });
+        continue;
+      }
+    }
+    installed.push(skillName);
+  }
+  return { tier, installed, skipped, reason: null };
+}
+
+/**
+ * Compare source SKILL.md version against installed version. Returns a string
+ * describing the drift if source is newer (so user knows an upgrade exists),
+ * or null when versions match / cannot be parsed. Never throws — best-effort.
+ *
+ * @param {string} srcSkillDir
+ * @param {string} dstSkillDir
+ * @returns {Promise<string|null>}
+ */
+async function detectVersionDrift(srcSkillDir, dstSkillDir) {
+  try {
+    const [srcVer, dstVer] = await Promise.all([
+      readSkillVersion(path.join(srcSkillDir, 'SKILL.md')),
+      readSkillVersion(path.join(dstSkillDir, 'SKILL.md')),
+    ]);
+    if (!srcVer || !dstVer) return null;
+    if (srcVer === dstVer) return `already present (v${dstVer})`;
+    return `stale: installed v${dstVer}, source has v${srcVer} — delete target dir to upgrade`;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Extract version string from a SKILL.md `metadata.version` field. Minimal
+ * YAML scan scoped to the `metadata:` block — avoids false positives from
+ * multiline description continuation lines that contain `version:` text
+ * (e.g. `description: |\n  version: 1.0.0 is legacy`). Avoids pulling in a
+ * full YAML dependency for one field.
+ *
+ * Returns null when SKILL.md cannot be read, frontmatter missing, metadata
+ * block missing, or version field absent.
+ *
+ * @param {string} skillMdPath
+ * @returns {Promise<string|null>}
+ */
+async function readSkillVersion(skillMdPath) {
+  try {
+    const content = await readFile(skillMdPath, 'utf-8');
+    const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
+    if (!fmMatch) return null;
+    // Require metadata: header followed by an indented version: line.
+    // Indent is preserved so a top-level `version:` (outside metadata) doesn't match.
+    const verMatch = fmMatch[1].match(/^metadata:\s*\n(?:\s+[^\n]*\n)*?\s+version:\s*["']?([^"'\s#]+)/m);
+    return verMatch ? verMatch[1] : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Auto-detect Pro/Business tiers across env vars, sibling paths, and well-known
  * locations. Returns { pro: { path, source } | null, business: { ... } | null }.
@@ -228,6 +393,28 @@ export function formatSetupResult(result) {
   lines.push(`  Tiers:     Free${result.tiers.length > 0 ? ` + ${result.tiers.join(' + ')}` : ''}`);
   lines.push(`  Preset:    ${result.preset}`);
   lines.push(`  Platforms: ${(result.platforms || []).join(', ') || '—'}`);
+  for (const sr of result.skillResults || []) {
+    if (sr.installed.length > 0) {
+      const preview = sr.installed.slice(0, 3).join(', ');
+      const more = sr.installed.length > 3 ? `, +${sr.installed.length - 3}` : '';
+      lines.push(`  Skills:    ${sr.tier}: ${sr.installed.length} installed (${preview}${more})`);
+    }
+    if (sr.skipped.length > 0) {
+      const rejected = sr.skipped.filter((s) => s.reason.startsWith('rejected:'));
+      const benign = sr.skipped.length - rejected.length;
+      const parts = [];
+      if (benign > 0) parts.push(`${benign} already present`);
+      if (rejected.length > 0) parts.push(`${rejected.length} rejected`);
+      lines.push(`  Skipped:   ${sr.tier}: ${parts.join(', ')}`);
+      // Surface rejection details so the operator can investigate a compromised tier repo.
+      for (const r of rejected) {
+        lines.push(`    ⚠ ${r.skill}: ${r.reason}`);
+      }
+    }
+    if (sr.reason) {
+      lines.push(`  Skill warn:${sr.tier}: ${sr.reason}`);
+    }
+  }
   if (result.notes?.length) {
     lines.push('');
     lines.push('  Notes:');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rune-kit/rune",
-  "version": "2.18.0",
+  "version": "2.18.1",
   "description": "64-skill mesh for AI coding assistants — runtime auto-discipline via native hooks (Claude/Cursor/Windsurf/Antigravity), 5-layer architecture, 215+ connections, multi-platform compiler. v2.17 adds quarantine L3 for prompt-injection advisory on untrusted external content.",
   "type": "module",
   "bin": {