@rune-kit/rune 2.2.1 → 2.2.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (94) hide show
  1. package/README.md +39 -13
  2. package/compiler/__tests__/adapters.test.js +109 -0
  3. package/compiler/__tests__/openclaw-adapter.test.js +149 -140
  4. package/compiler/__tests__/pack-split.test.js +145 -145
  5. package/compiler/__tests__/parser.test.js +3 -3
  6. package/compiler/__tests__/pipeline.test.js +110 -0
  7. package/compiler/__tests__/skill-validation.test.js +148 -0
  8. package/compiler/__tests__/transformer.test.js +70 -0
  9. package/compiler/__tests__/transforms.test.js +92 -0
  10. package/compiler/adapters/antigravity.js +5 -6
  11. package/compiler/adapters/claude.js +1 -1
  12. package/compiler/adapters/codex.js +69 -77
  13. package/compiler/adapters/cursor.js +5 -6
  14. package/compiler/adapters/generic.js +5 -6
  15. package/compiler/adapters/index.js +3 -3
  16. package/compiler/adapters/openclaw.js +146 -150
  17. package/compiler/adapters/opencode.js +78 -86
  18. package/compiler/adapters/windsurf.js +5 -6
  19. package/compiler/bin/rune.js +52 -21
  20. package/compiler/doctor.js +19 -7
  21. package/compiler/emitter.js +11 -18
  22. package/compiler/parser.js +5 -5
  23. package/compiler/transformer.js +3 -5
  24. package/compiler/transforms/branding.js +5 -4
  25. package/compiler/transforms/compliance.js +40 -40
  26. package/compiler/transforms/frontmatter.js +1 -1
  27. package/compiler/transforms/hooks.js +12 -14
  28. package/compiler/transforms/subagents.js +1 -3
  29. package/compiler/transforms/tool-names.js +1 -1
  30. package/docs/ANTIGRAVITY-GAP-ANALYSIS.md +369 -0
  31. package/docs/ARCHITECTURE.md +332 -0
  32. package/docs/COMMUNITY-PACKS.md +109 -0
  33. package/docs/CONTRIBUTING-L4.md +215 -0
  34. package/docs/CROSS-IDE-ANALYSIS.md +164 -0
  35. package/docs/EXTENSION-TEMPLATE.md +108 -0
  36. package/docs/MESH-RULES.md +34 -0
  37. package/docs/MULTI-PLATFORM.md +804 -0
  38. package/docs/SKILL-DEPTH-AUDIT.md +191 -0
  39. package/docs/SKILL-TEMPLATE.md +72 -0
  40. package/docs/TRADE-MATRIX.md +327 -0
  41. package/docs/VERSIONING.md +91 -0
  42. package/docs/VISION.md +263 -0
  43. package/docs/assets/demo-subtitles.srt +215 -0
  44. package/docs/assets/end-card.html +276 -0
  45. package/docs/assets/mesh-diagram.html +654 -0
  46. package/docs/assets/thumbnail.html +295 -0
  47. package/docs/guides/cli.md +403 -0
  48. package/docs/guides/index.html +1387 -0
  49. package/docs/index.html +739 -0
  50. package/docs/references/claudekit-analysis.md +414 -0
  51. package/docs/references/voltagent-analysis.md +189 -0
  52. package/docs/script.js +277 -0
  53. package/docs/skills/index.html +832 -0
  54. package/docs/style.css +600 -0
  55. package/docs/video-demo-plan.md +172 -0
  56. package/extensions/security/PACK.md +4 -3
  57. package/extensions/security/skills/defense-in-depth.md +103 -0
  58. package/extensions/ui/PACK.md +2 -0
  59. package/extensions/ui/skills/design-decision.md +10 -0
  60. package/extensions/ui/skills/palette-picker.md +11 -0
  61. package/hooks/.gitkeep +0 -0
  62. package/hooks/auto-format/index.cjs +48 -0
  63. package/hooks/context-watch/index.cjs +68 -0
  64. package/hooks/hooks.json +99 -0
  65. package/hooks/metrics-collector/index.cjs +42 -0
  66. package/hooks/post-session-reflect/index.cjs +153 -0
  67. package/hooks/pre-compact/index.cjs +95 -0
  68. package/hooks/pre-tool-guard/index.cjs +68 -0
  69. package/hooks/run-hook +17 -0
  70. package/hooks/run-hook.cjs +16 -0
  71. package/hooks/run-hook.cmd +1 -0
  72. package/hooks/secrets-scan/index.cjs +100 -0
  73. package/hooks/session-start/index.cjs +65 -0
  74. package/hooks/typecheck/index.cjs +65 -0
  75. package/package.json +16 -4
  76. package/references/ui-pro-max-data/LICENSE-UI-PRO-MAX +21 -0
  77. package/references/ui-pro-max-data/charts.csv +26 -0
  78. package/references/ui-pro-max-data/colors.csv +162 -0
  79. package/references/ui-pro-max-data/styles.csv +85 -0
  80. package/references/ui-pro-max-data/typography.csv +74 -0
  81. package/references/ui-pro-max-data/ui-reasoning.csv +162 -0
  82. package/references/ui-pro-max-data/ux-guidelines.csv +100 -0
  83. package/skills/ba/SKILL.md +10 -0
  84. package/skills/completion-gate/SKILL.md +34 -1
  85. package/skills/context-engine/SKILL.md +13 -0
  86. package/skills/cook/SKILL.md +71 -0
  87. package/skills/debug/SKILL.md +71 -1
  88. package/skills/design/SKILL.md +11 -0
  89. package/skills/fix/SKILL.md +26 -1
  90. package/skills/plan/SKILL.md +23 -6
  91. package/skills/review/SKILL.md +2 -0
  92. package/skills/skill-forge/SKILL.md +94 -3
  93. package/skills/test/SKILL.md +44 -2
  94. package/skills/verification/SKILL.md +60 -2
@@ -0,0 +1,153 @@
1
+ // Rune Post-Session Reflect Hook
2
+ // 1. Flushes session metrics from tmpdir to .rune/metrics/ (H3 Intelligence)
3
+ // 2. Displays structured self-review checklist at session end (Stop event)
4
+
5
+ const fs = require('fs');
6
+ const path = require('path');
7
+ const os = require('os');
8
+
9
+ const cwd = process.cwd();
10
+ const hash = Buffer.from(cwd).toString('base64url').slice(0, 16);
11
+
12
+ // === H3: Flush Session Metrics ===
13
+
14
+ const metricsJsonl = path.join(os.tmpdir(), `rune-metrics-${hash}.jsonl`);
15
+ const counterFile = path.join(os.tmpdir(), `rune-context-watch-${hash}.json`);
16
+ const runeMetricsDir = path.join(cwd, '.rune', 'metrics');
17
+
18
+ try {
19
+ flushMetrics();
20
+ } catch (e) {
21
+ // Metrics flush is best-effort — never block session end
22
+ // Silently ignore errors
23
+ }
24
+
25
+ function flushMetrics() {
26
+ // Read session skill invocations from tmpdir JSONL
27
+ let skillEvents = [];
28
+ if (fs.existsSync(metricsJsonl)) {
29
+ const lines = fs.readFileSync(metricsJsonl, 'utf-8').trim().split('\n').filter(Boolean);
30
+ for (const line of lines) {
31
+ try { skillEvents.push(JSON.parse(line)); } catch { /* skip malformed */ }
32
+ }
33
+ }
34
+
35
+ // Read context-watch state for tool counts and session timing
36
+ let watchState = { count: 0, sessionStart: null, toolCounts: {} };
37
+ if (fs.existsSync(counterFile)) {
38
+ try {
39
+ watchState = JSON.parse(fs.readFileSync(counterFile, 'utf-8'));
40
+ } catch { /* use defaults */ }
41
+ }
42
+
43
+ // Nothing to flush if no data
44
+ if (skillEvents.length === 0 && watchState.count === 0) return;
45
+
46
+ // Ensure .rune/metrics/ exists
47
+ fs.mkdirSync(runeMetricsDir, { recursive: true });
48
+
49
+ const now = new Date().toISOString();
50
+ const sessionStart = watchState.sessionStart || now;
51
+ const durationMin = Math.round((new Date(now) - new Date(sessionStart)) / 60000);
52
+
53
+ // Build skill usage map
54
+ const skillCounts = {};
55
+ const skillChain = [];
56
+ for (const evt of skillEvents) {
57
+ skillCounts[evt.skill] = (skillCounts[evt.skill] || 0) + 1;
58
+ skillChain.push(evt.skill);
59
+ }
60
+
61
+ // Determine primary skill (most invoked)
62
+ const primarySkill = Object.entries(skillCounts)
63
+ .sort((a, b) => b[1] - a[1])[0]?.[0] || 'none';
64
+
65
+ // Generate session ID
66
+ const sessionId = `s-${now.slice(0, 10).replace(/-/g, '')}-${now.slice(11, 19).replace(/:/g, '')}`;
67
+
68
+ // 1. Append to sessions.jsonl
69
+ const sessionEntry = {
70
+ id: sessionId,
71
+ date: now.slice(0, 10),
72
+ duration_min: durationMin,
73
+ tool_calls: watchState.count,
74
+ tool_distribution: watchState.toolCounts,
75
+ skill_invocations: skillEvents.length,
76
+ skills_used: Object.keys(skillCounts),
77
+ primary_skill: primarySkill
78
+ };
79
+
80
+ const sessionsFile = path.join(runeMetricsDir, 'sessions.jsonl');
81
+ fs.appendFileSync(sessionsFile, JSON.stringify(sessionEntry) + '\n');
82
+
83
+ // Cap at 100 sessions (rotate oldest)
84
+ try {
85
+ const allLines = fs.readFileSync(sessionsFile, 'utf-8').trim().split('\n').filter(Boolean);
86
+ if (allLines.length > 100) {
87
+ fs.writeFileSync(sessionsFile, allLines.slice(-100).join('\n') + '\n');
88
+ }
89
+ } catch { /* cap is best-effort */ }
90
+
91
+ // 2. Merge into skills.json (running totals)
92
+ const skillsFile = path.join(runeMetricsDir, 'skills.json');
93
+ let skillsData = { version: 1, updated: now, skills: {} };
94
+ if (fs.existsSync(skillsFile)) {
95
+ try {
96
+ skillsData = JSON.parse(fs.readFileSync(skillsFile, 'utf-8'));
97
+ } catch { /* start fresh */ }
98
+ }
99
+
100
+ for (const [skill, count] of Object.entries(skillCounts)) {
101
+ if (!skillsData.skills[skill]) {
102
+ skillsData.skills[skill] = { total_invocations: 0, last_used: now.slice(0, 10) };
103
+ }
104
+ skillsData.skills[skill].total_invocations += count;
105
+ skillsData.skills[skill].last_used = now.slice(0, 10);
106
+ }
107
+ skillsData.updated = now;
108
+
109
+ fs.writeFileSync(skillsFile, JSON.stringify(skillsData, null, 2) + '\n');
110
+
111
+ // 3. Append to chains.jsonl
112
+ if (skillChain.length > 0) {
113
+ const chainsFile = path.join(runeMetricsDir, 'chains.jsonl');
114
+ const chainEntry = {
115
+ session: sessionId,
116
+ chain: skillChain,
117
+ depth: skillChain.length
118
+ };
119
+ fs.appendFileSync(chainsFile, JSON.stringify(chainEntry) + '\n');
120
+ }
121
+
122
+ // 4. Cleanup tmpdir files
123
+ try { fs.unlinkSync(metricsJsonl); } catch { /* already gone */ }
124
+ // Note: counterFile is cleaned by session-start hook on next session
125
+
126
+ // Report metrics flush
127
+ const skillList = Object.entries(skillCounts)
128
+ .sort((a, b) => b[1] - a[1])
129
+ .map(([s, c]) => `${s}(${c})`)
130
+ .join(', ');
131
+
132
+ console.log(`\n📊 [Rune metrics] Session ${sessionId} — ${durationMin}min, ${watchState.count} tool calls, ${skillEvents.length} skill invocations`);
133
+ if (skillList) console.log(` Skills: ${skillList}`);
134
+ console.log(` Saved to .rune/metrics/\n`);
135
+ }
136
+
137
+ // === Original: Verification Checklist ===
138
+
139
+ console.log(`
140
+ ┌─────────────────────────────────────────────────────┐
141
+ │ Rune Session End — Verification Checklist │
142
+ ├─────────────────────────────────────────────────────┤
143
+ │ Before closing this session, confirm: │
144
+ │ │
145
+ │ □ All TodoWrite tasks marked complete? │
146
+ │ □ Tests ran and passing? │
147
+ │ □ No hardcoded secrets introduced? │
148
+ │ □ If schema changed: migration + rollback exist? │
149
+ │ □ Verification ran (lint + types + build)? │
150
+ │ │
151
+ │ If any item is unclear → address it now. │
152
+ └─────────────────────────────────────────────────────┘
153
+ `);
@@ -0,0 +1,95 @@
1
+ // Rune Pre-Compact Hook
2
+ // Saves critical state BEFORE Claude auto-compacts context window.
3
+ // Prevents data loss from losing decisions, progress, and metrics mid-session.
4
+ //
5
+ // Captures: context-watch state, active task summary, decisions made this session.
6
+ // Writes snapshot to .rune/pre-compact-snapshot.md for post-compact recovery.
7
+
8
+ const fs = require('fs');
9
+ const path = require('path');
10
+ const os = require('os');
11
+
12
+ const cwd = process.cwd();
13
+ const runeDir = path.join(cwd, '.rune');
14
+
15
+ // Read context-watch state (tool counts, session timing)
16
+ const hash = Buffer.from(cwd).toString('base64url').slice(0, 16);
17
+ const counterFile = path.join(os.tmpdir(), `rune-context-watch-${hash}.json`);
18
+
19
+ let watchState = null;
20
+ try {
21
+ const raw = fs.readFileSync(counterFile, 'utf-8');
22
+ watchState = JSON.parse(raw);
23
+ } catch {
24
+ // No counter file — session may be fresh
25
+ }
26
+
27
+ // Collect .rune/ state summaries
28
+ const stateFiles = ['progress.md', 'decisions.md', 'conventions.md'];
29
+ const summaries = [];
30
+
31
+ if (fs.existsSync(runeDir)) {
32
+ for (const file of stateFiles) {
33
+ const filePath = path.join(runeDir, file);
34
+ if (fs.existsSync(filePath)) {
35
+ try {
36
+ const content = fs.readFileSync(filePath, 'utf-8').trim();
37
+ if (content.length > 0) {
38
+ // Take first 50 lines to keep snapshot compact
39
+ const lines = content.split('\n').slice(0, 50);
40
+ summaries.push({ file, preview: lines.join('\n') });
41
+ }
42
+ } catch {
43
+ // Skip unreadable files
44
+ }
45
+ }
46
+ }
47
+ }
48
+
49
+ // Build snapshot
50
+ const snapshot = [];
51
+ snapshot.push('# Pre-Compact Snapshot');
52
+ snapshot.push(`Generated: ${new Date().toISOString()}`);
53
+ snapshot.push('');
54
+
55
+ if (watchState) {
56
+ snapshot.push('## Session Metrics');
57
+ snapshot.push(`- Tool calls: ${watchState.count || 0}`);
58
+ snapshot.push(`- Session start: ${watchState.sessionStart || 'unknown'}`);
59
+ if (watchState.toolCounts) {
60
+ const top5 = Object.entries(watchState.toolCounts)
61
+ .sort((a, b) => b[1] - a[1])
62
+ .slice(0, 5);
63
+ snapshot.push(`- Top tools: ${top5.map(([k, v]) => `${k}(${v})`).join(', ')}`);
64
+ }
65
+ snapshot.push('');
66
+ }
67
+
68
+ if (summaries.length > 0) {
69
+ snapshot.push('## State Files (preview)');
70
+ for (const { file, preview } of summaries) {
71
+ snapshot.push(`### .rune/${file}`);
72
+ snapshot.push(preview);
73
+ snapshot.push('');
74
+ }
75
+ }
76
+
77
+ // Write snapshot if we have anything worth saving
78
+ if (watchState || summaries.length > 0) {
79
+ try {
80
+ if (!fs.existsSync(runeDir)) {
81
+ fs.mkdirSync(runeDir, { recursive: true });
82
+ }
83
+ fs.writeFileSync(
84
+ path.join(runeDir, 'pre-compact-snapshot.md'),
85
+ snapshot.join('\n')
86
+ );
87
+ console.log(`[Rune pre-compact] State snapshot saved (${watchState ? watchState.count : 0} tool calls, ${summaries.length} state files).`);
88
+ } catch (e) {
89
+ console.error(`[Rune pre-compact] Failed to save snapshot: ${e.message}`);
90
+ }
91
+ } else {
92
+ console.log('[Rune pre-compact] No state to snapshot — fresh session.');
93
+ }
94
+
95
+ process.exit(0);
@@ -0,0 +1,68 @@
1
+ // Rune Pre-Tool Guard Hook
2
+ // Preventive security gate — warns before AI reads/edits sensitive files
3
+ // Runs as PreToolUse hook for Read, Write, Edit tools
4
+
5
+ const path = require('path');
6
+
7
+ // Read tool_input from Claude Code hook stdin
8
+ let input = '';
9
+ process.stdin.setEncoding('utf-8');
10
+ process.stdin.on('data', (chunk) => { input += chunk; });
11
+ process.stdin.on('end', () => {
12
+ let toolInput = {};
13
+ try {
14
+ const parsed = JSON.parse(input);
15
+ toolInput = parsed.tool_input || parsed;
16
+ } catch {
17
+ // If no stdin or parse fails, exit cleanly (non-blocking)
18
+ process.exit(0);
19
+ }
20
+
21
+ const filePath = toolInput.file_path || toolInput.path || '';
22
+ if (!filePath) process.exit(0);
23
+
24
+ const basename = path.basename(filePath);
25
+ const normalized = filePath.replace(/\\/g, '/');
26
+
27
+ // Sensitive file patterns
28
+ const sensitivePatterns = [
29
+ /^\.env$/, // .env exactly
30
+ /^\.env\.[^e]/, // .env.* but NOT .env.example
31
+ /\.pem$/,
32
+ /\.key$/,
33
+ /\.p12$/,
34
+ /\.pfx$/,
35
+ /^credentials\.json$/,
36
+ /\.secret$/,
37
+ /^\.netrc$/,
38
+ /^id_rsa$/,
39
+ /^id_ed25519$/,
40
+ /^id_ecdsa$/,
41
+ /^\.ssh\//,
42
+ /private.*key/i,
43
+ /secret.*key/i,
44
+ ];
45
+
46
+ // Exclude safe exceptions
47
+ const safeExceptions = [
48
+ /\.env\.example$/,
49
+ /\.env\.sample$/,
50
+ /\.env\.template$/,
51
+ /\.env\.test$/,
52
+ /test.*credential/i,
53
+ /fixture/i,
54
+ /mock/i,
55
+ ];
56
+
57
+ const isSensitive = sensitivePatterns.some((p) => p.test(basename) || p.test(normalized));
58
+ const isSafe = safeExceptions.some((p) => p.test(basename) || p.test(normalized));
59
+
60
+ if (isSensitive && !isSafe) {
61
+ // Output warning to user — does NOT hard-block (developer may legitimately need access)
62
+ console.log(`\n⚠ [Rune pre-tool-guard] Sensitive file detected: ${filePath}`);
63
+ console.log(' This file may contain secrets. Confirm this access is intentional.');
64
+ console.log(' If scanning for secrets, use /rune sentinel instead.\n');
65
+ }
66
+
67
+ process.exit(0);
68
+ });
package/hooks/run-hook ADDED
@@ -0,0 +1,17 @@
1
+ #!/usr/bin/env node
2
+ // Rune hook runner — loads and executes named hook modules
3
+ const path = require('path');
4
+
5
+ const hookName = process.argv[2];
6
+ if (!hookName) {
7
+ console.error('Usage: run-hook <hook-name>');
8
+ process.exit(1);
9
+ }
10
+
11
+ const hookPath = path.join(__dirname, hookName, 'index.js');
12
+ try {
13
+ require(hookPath);
14
+ } catch (e) {
15
+ console.error(`Rune hook "${hookName}" failed: ${e.message}`);
16
+ process.exit(1);
17
+ }
@@ -0,0 +1,16 @@
1
+ // Rune hook runner — loads and executes named hook modules
2
+ const path = require('path');
3
+
4
+ const hookName = process.argv[2];
5
+ if (!hookName) {
6
+ console.error('Usage: run-hook <hook-name>');
7
+ process.exit(1);
8
+ }
9
+
10
+ const hookPath = path.join(__dirname, hookName, 'index.cjs');
11
+ try {
12
+ require(hookPath);
13
+ } catch (e) {
14
+ console.error(`Rune hook "${hookName}" failed: ${e.message}`);
15
+ process.exit(1);
16
+ }
@@ -0,0 +1 @@
1
+ @node "%~dp0run-hook.js" %*
@@ -0,0 +1,100 @@
1
+ // Rune Secrets Scan Hook
2
+ // PreToolUse hook on Bash — intercepts git commit commands
3
+ // Scans staged files for hardcoded secrets before allowing commit
4
+ //
5
+ // Patterns based on gitleaks + common AI-generated secret leaks.
6
+ // Zero false-positive tolerance on BLOCK patterns.
7
+
8
+ const { execSync } = require('child_process');
9
+
10
+ // Only intercept git commit commands
11
+ const input = JSON.parse(process.env.CLAUDE_TOOL_INPUT || '{}');
12
+ const command = (input.command || '').trim();
13
+
14
+ // Check if this is a git commit command
15
+ if (!/^git\s+commit\b/.test(command)) {
16
+ // Not a commit — pass through
17
+ process.exit(0);
18
+ }
19
+
20
+ // Get staged files
21
+ let stagedFiles;
22
+ try {
23
+ stagedFiles = execSync('git diff --cached --name-only', { encoding: 'utf-8' })
24
+ .trim()
25
+ .split('\n')
26
+ .filter(f => f.length > 0);
27
+ } catch {
28
+ // Not in a git repo or no staged files — pass through
29
+ process.exit(0);
30
+ }
31
+
32
+ if (stagedFiles.length === 0) {
33
+ process.exit(0);
34
+ }
35
+
36
+ // Secret patterns (high-confidence, low false-positive)
37
+ const BLOCK_PATTERNS = [
38
+ { name: 'AWS Access Key', regex: /AKIA[0-9A-Z]{16}/ },
39
+ { name: 'GitHub Token', regex: /gh[ps]_[A-Za-z0-9_]{36,}/ },
40
+ { name: 'Slack Token', regex: /xox[bpors]-[0-9a-zA-Z-]{10,}/ },
41
+ { name: 'Stripe Key', regex: /[sr]k_(live|test)_[0-9a-zA-Z]{24,}/ },
42
+ { name: 'SendGrid Key', regex: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/ },
43
+ { name: 'Twilio Key', regex: /SK[0-9a-fA-F]{32}/ },
44
+ { name: 'Firebase Key', regex: /AIza[0-9A-Za-z_-]{35}/ },
45
+ { name: 'Private Key', regex: /-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/ },
46
+ { name: 'OpenAI Key', regex: /sk-[A-Za-z0-9]{32,}/ },
47
+ { name: 'Anthropic Key', regex: /sk-ant-[A-Za-z0-9_-]{32,}/ },
48
+ ];
49
+
50
+ // Files to always skip (test fixtures, examples)
51
+ const SKIP_PATHS = /\/(test|tests|__tests__|fixtures|__mocks__|examples?|\.test\.|\.spec\.)/i;
52
+
53
+ // Scan staged content (not files on disk — staged content via git show)
54
+ const findings = [];
55
+
56
+ for (const file of stagedFiles) {
57
+ // Skip test/fixture files
58
+ if (SKIP_PATHS.test(file)) continue;
59
+
60
+ // Skip binary files and lockfiles
61
+ if (/\.(png|jpg|gif|ico|woff|ttf|lock|lockb)$/i.test(file)) continue;
62
+
63
+ let content;
64
+ try {
65
+ content = execSync(`git show ":${file}"`, { encoding: 'utf-8', maxBuffer: 1024 * 1024 });
66
+ } catch {
67
+ continue; // File deleted or binary
68
+ }
69
+
70
+ const lines = content.split('\n');
71
+ for (let i = 0; i < lines.length; i++) {
72
+ const line = lines[i];
73
+ for (const pattern of BLOCK_PATTERNS) {
74
+ if (pattern.regex.test(line)) {
75
+ findings.push({
76
+ file,
77
+ line: i + 1,
78
+ pattern: pattern.name,
79
+ snippet: line.substring(0, 80).trim(),
80
+ });
81
+ }
82
+ }
83
+ }
84
+ }
85
+
86
+ if (findings.length > 0) {
87
+ console.error('\n\u{1F6A8} [Rune secrets-scan] BLOCKED — hardcoded secrets detected in staged files:\n');
88
+ for (const f of findings) {
89
+ console.error(` ${f.file}:${f.line} — ${f.pattern}`);
90
+ console.error(` ${f.snippet}...`);
91
+ }
92
+ console.error('\n Fix: Remove secrets, use environment variables instead.');
93
+ console.error(' Override: git commit --no-verify (NOT recommended)\n');
94
+
95
+ // BLOCK the commit
96
+ process.exit(2);
97
+ }
98
+
99
+ // No secrets found — allow commit
100
+ process.exit(0);
@@ -0,0 +1,65 @@
1
+ // Rune Session Start Hook
2
+ // Loads and injects .rune/ state file CONTENTS into context at session start
3
+
4
+ const fs = require('fs');
5
+ const path = require('path');
6
+ const os = require('os');
7
+
8
+ const cwd = process.cwd();
9
+ const runeDir = path.join(cwd, '.rune');
10
+
11
+ // Reset context-watch counter on session start (fresh context window)
12
+ const hash = Buffer.from(cwd).toString('base64url').slice(0, 16);
13
+ const counterFile = path.join(os.tmpdir(), `rune-context-watch-${hash}.json`);
14
+ try { fs.unlinkSync(counterFile); } catch { /* no counter yet — fine */ }
15
+
16
+ if (fs.existsSync(runeDir)) {
17
+ const stateFiles = [
18
+ 'progress.md',
19
+ 'decisions.md',
20
+ 'conventions.md',
21
+ 'RESCUE-STATE.md',
22
+ 'DEVELOPER-GUIDE.md',
23
+ 'logic-manifest.json'
24
+ ];
25
+ const loaded = [];
26
+
27
+ for (const file of stateFiles) {
28
+ const filePath = path.join(runeDir, file);
29
+ if (fs.existsSync(filePath)) {
30
+ const content = fs.readFileSync(filePath, 'utf-8').trim();
31
+ if (content.length > 0) {
32
+ console.log(`\n=== .rune/${file} ===\n${content}`);
33
+ loaded.push(file);
34
+ }
35
+ }
36
+ }
37
+
38
+ // Inject active behavioral context mode
39
+ const activeContextFile = path.join(runeDir, 'active-context.md');
40
+ if (fs.existsSync(activeContextFile)) {
41
+ try {
42
+ const mode = fs.readFileSync(activeContextFile, 'utf-8').trim();
43
+ if (mode) {
44
+ // Look for the context file in plugin's contexts/ directory
45
+ const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT || path.join(__dirname, '..', '..');
46
+ const contextFile = path.join(pluginRoot, 'contexts', `${mode}.md`);
47
+ if (fs.existsSync(contextFile)) {
48
+ const contextContent = fs.readFileSync(contextFile, 'utf-8').trim();
49
+ console.log(`\n=== Active Context: ${mode} mode ===\n${contextContent}`);
50
+ loaded.push(`active-context(${mode})`);
51
+ }
52
+ }
53
+ } catch {
54
+ // Non-critical — skip silently
55
+ }
56
+ }
57
+
58
+ if (loaded.length > 0) {
59
+ console.log(`\n[Rune: injected project state from ${loaded.join(', ')}]`);
60
+ } else {
61
+ console.log('[Rune: .rune/ directory found but no state files yet. Run /rune onboard to populate.]');
62
+ }
63
+ } else {
64
+ console.log('[Rune: No .rune/ directory found. Run /rune onboard to set up project context.]');
65
+ }
@@ -0,0 +1,65 @@
1
+ // Rune TypeScript Check Hook
2
+ // PostToolUse hook on Edit/Write — runs tsc --noEmit after .ts/.tsx file edits
3
+ //
4
+ // Only runs if tsconfig.json exists in the project.
5
+ // Async hook — doesn't block the agent, just warns.
6
+
7
+ const { execSync } = require('child_process');
8
+ const fs = require('fs');
9
+ const path = require('path');
10
+
11
+ const input = JSON.parse(process.env.CLAUDE_TOOL_INPUT || '{}');
12
+ const filePath = input.file_path || input.filePath || '';
13
+
14
+ // Only check TypeScript files
15
+ if (!/\.(ts|tsx)$/i.test(filePath)) {
16
+ process.exit(0);
17
+ }
18
+
19
+ // Find tsconfig.json by walking up from the file
20
+ let dir = path.dirname(filePath);
21
+ let tsConfigDir = null;
22
+
23
+ for (let i = 0; i < 10; i++) {
24
+ if (fs.existsSync(path.join(dir, 'tsconfig.json'))) {
25
+ tsConfigDir = dir;
26
+ break;
27
+ }
28
+ const parent = path.dirname(dir);
29
+ if (parent === dir) break;
30
+ dir = parent;
31
+ }
32
+
33
+ if (!tsConfigDir) {
34
+ // No tsconfig.json found — skip
35
+ process.exit(0);
36
+ }
37
+
38
+ // Run tsc --noEmit
39
+ try {
40
+ execSync('npx tsc --noEmit --pretty 2>&1', {
41
+ cwd: tsConfigDir,
42
+ encoding: 'utf-8',
43
+ stdio: 'pipe',
44
+ timeout: 30000,
45
+ });
46
+ // Silent success
47
+ } catch (e) {
48
+ const output = (e.stdout || e.message || '').trim();
49
+ const errorLines = output.split('\n').filter(l => /error TS\d+/.test(l));
50
+ const errorCount = errorLines.length;
51
+
52
+ if (errorCount > 0) {
53
+ console.log(`\n[Rune typecheck] ${errorCount} TypeScript error(s) after editing ${path.basename(filePath)}:`);
54
+ // Show first 5 errors
55
+ errorLines.slice(0, 5).forEach(line => {
56
+ console.log(` ${line.trim()}`);
57
+ });
58
+ if (errorCount > 5) {
59
+ console.log(` ... and ${errorCount - 5} more. Run \`npx tsc --noEmit\` for full list.`);
60
+ }
61
+ console.log('');
62
+ }
63
+ }
64
+
65
+ process.exit(0);
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@rune-kit/rune",
3
- "version": "2.2.1",
3
+ "version": "2.2.3",
4
4
  "description": "58-skill mesh for AI coding assistants — 5-layer architecture, 200+ connections, 8 platforms (Claude Code, Cursor, Windsurf, Antigravity, Codex, OpenCode, OpenClaw, Generic)",
5
5
  "type": "module",
6
6
  "bin": {
@@ -8,8 +8,14 @@
8
8
  },
9
9
  "scripts": {
10
10
  "build": "node compiler/bin/rune.js build",
11
- "doctor": "node compiler/bin/rune.js doctor",
12
- "test": "node --test compiler/__tests__/*.test.js"
11
+ "doctor": "node compiler/bin/rune.js doctor && node scripts/version-sync-check.js",
12
+ "test": "node --test compiler/__tests__/*.test.js",
13
+ "lint": "biome check .",
14
+ "lint:fix": "biome check --fix .",
15
+ "format": "biome format --write .",
16
+ "ci": "biome check . && node --test compiler/__tests__/*.test.js && node compiler/bin/rune.js doctor",
17
+ "version-check": "node scripts/version-sync-check.js",
18
+ "prepublishOnly": "node scripts/version-sync-check.js"
13
19
  },
14
20
  "keywords": [
15
21
  "claude-code",
@@ -41,10 +47,16 @@
41
47
  "extensions/",
42
48
  "contexts/",
43
49
  "commands/",
44
- "agents/"
50
+ "agents/",
51
+ "hooks/",
52
+ "docs/",
53
+ "references/"
45
54
  ],
46
55
  "homepage": "https://github.com/rune-kit/rune",
47
56
  "bugs": {
48
57
  "url": "https://github.com/rune-kit/rune/issues"
58
+ },
59
+ "devDependencies": {
60
+ "@biomejs/biome": "^2.4.7"
49
61
  }
50
62
  }
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2024 Next Level Builder
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.