@rune-kit/rune 2.2.6 → 2.3.1

package/docs/style.css

@@ -653,6 +653,68 @@ font[style] > font { vertical-align: unset !important; }
 }
 @keyframes spin { to { transform: rotate(360deg); } }
 .pay-hint { font-size: 12px; color: var(--text-muted); text-align: center; margin-top: 12px; line-height: 1.5; }
+/* Success page */
+.pay-success { text-align: center; }
+
+.pay-success-badge {
+  width: 72px; height: 72px; border-radius: 50%;
+  background: var(--accent-dim); color: var(--accent);
+  display: flex; align-items: center; justify-content: center;
+  margin: 0 auto 20px;
+  animation: successPop 0.4s cubic-bezier(0.34, 1.56, 0.64, 1) both;
+}
+
+.pay-success-circle {
+  stroke-dasharray: 151; stroke-dashoffset: 151;
+  animation: successCircle 0.6s 0.2s ease-out forwards;
+}
+.pay-success-tick {
+  stroke-dasharray: 40; stroke-dashoffset: 40;
+  animation: successTick 0.4s 0.6s ease-out forwards;
+}
+
+@keyframes successPop { 0% { transform: scale(0); opacity: 0; } 100% { transform: scale(1); opacity: 1; } }
+@keyframes successCircle { to { stroke-dashoffset: 0; } }
+@keyframes successTick { to { stroke-dashoffset: 0; } }
+
+.pay-success-title {
+  font-family: var(--font-display); font-size: 26px; font-weight: 700;
+  margin-bottom: 6px; color: var(--text-primary);
+}
+.pay-success-sub {
+  font-size: 14px; color: var(--text-secondary); margin-bottom: 24px;
+}
+
+.pay-success-steps {
+  text-align: left; display: flex; flex-direction: column; gap: 14px;
+  background: var(--accent-dim); border-radius: var(--radius-md);
+  padding: 20px; margin-bottom: 24px;
+}
+.pay-success-step {
+  display: flex; align-items: flex-start; gap: 12px;
+}
+.pay-success-num {
+  flex-shrink: 0; width: 26px; height: 26px; border-radius: 50%;
+  background: var(--accent); color: #fff; font-size: 13px; font-weight: 700;
+  display: flex; align-items: center; justify-content: center;
+  margin-top: 1px;
+}
+.pay-success-step strong {
+  display: block; font-size: 14px; color: var(--text-primary); margin-bottom: 2px;
+}
+.pay-success-step span {
+  font-size: 13px; color: var(--text-secondary); line-height: 1.4;
+}
+
+.pay-success-done {
+  width: 100%; margin-bottom: 12px;
+}
+.pay-success-help {
+  font-size: 12px; color: var(--text-secondary); opacity: 0.7;
+}
+.pay-success-help a { color: var(--accent); }
+
+/* Legacy (keep for backwards compat) */
 .pay-success-icon {
   width: 64px; height: 64px; border-radius: 50%; background: var(--accent);
   color: #fff; font-size: 32px; display: flex; align-items: center; justify-content: center;

package/extensions/ai-ml/PACK.md

@@ -76,6 +76,13 @@ deep-research → embedding-search: relevance scoring uses embeddings for semant
 - **Prompt injection**: Web pages may contain adversarial content targeting extraction LLMs — system prompt must block.
 - **Sandbox escape**: Use rootless Docker or gVisor for high-security code execution environments.
 
+## Done When
+
+- LLM API client implemented with retry logic, exponential backoff, and structured output validation via Zod/Pydantic
+- RAG pipeline operational: chunking, embedding, vector store, retrieval, and reranking all configured and tested
+- Embedding index metadata includes pinned model version and dimension count to prevent upgrade mismatches
+- AI agent state persists across requests with no cross-session leakage and graceful crash recovery
+
 ## Cost Profile
 
 ~24,000–40,000 tokens per full pack run (all 10 skills). Individual skill: ~2,500–5,000 tokens. Sonnet default. Use haiku for code detection scans; escalate to sonnet for pipeline design, extraction strategy, and research loop orchestration.

package/extensions/content/PACK.md

@@ -84,6 +84,13 @@ Called By ← marketing (L2): when creating blog content
 | Sitemap includes draft/unpublished pages | MEDIUM | Filter sitemap to `status === 'published'` only; add `noindex` to draft preview pages |
 | `hreflang` tags point to wrong locale | MEDIUM | Generate hreflang from route params, not hardcoded; test with hreflang validator |
 
+## Done When
+
+- Blog architecture set up with pagination, RSS feed, and canonical URLs all resolving correctly
+- CMS integration live with preview mode, publish webhooks triggering ISR revalidation and search index updates
+- All translation keys resolved with fallback locale — no raw keys visible in any locale
+- SEO audit passing: valid JSON-LD structured data, complete sitemap (published pages only), and hreflang tags verified
+
 ## Cost Profile
 
 ~16,000–28,000 tokens per full pack run (all 7 skills). Individual skill: ~2,000–5,000 tokens. Sonnet default. Use haiku for detection scans and alt-text audits; escalate to sonnet for CMS integration, SEO audit, video pipeline, and content scoring.

package/extensions/mobile/PACK.md

@@ -35,15 +35,15 @@ Mobile development has platform-specific pitfalls that web developers hit repeat
 
 | Skill | Model | Description |
 |-------|-------|-------------|
-| react-native | sonnet | New Architecture migration, navigation, state management, performance optimization |
-| flutter | sonnet | Widget composition, Riverpod/BLoC state, platform channels, adaptive layouts |
-| deep-linking | sonnet | Universal Links (iOS), App Links (Android), auth + deep link race condition |
-| push-notifications | sonnet | FCM v1, APNs, Expo Notifications, permission handling, delivery debugging |
-| ota-updates | sonnet | EAS Update, runtime version management, rollback, bytecode compatibility |
-| app-store-prep | sonnet | Screenshots, metadata, privacy manifests, submission checklist |
-| native-bridge | sonnet | Expo Modules API, TurboModules, Swift/Kotlin interop, background tasks |
-| ios-build-pipeline | sonnet | Certificate generation, provisioning, Xcode archive, IPA export, TestFlight upload |
-| app-store-connect | sonnet | Version management, localization, screenshot upload, IAP, review submission |
+| [react-native](skills/react-native.md) | sonnet | New Architecture migration, navigation, state management, performance optimization |
+| [flutter](skills/flutter.md) | sonnet | Widget composition, Riverpod/BLoC state, platform channels, adaptive layouts |
+| [deep-linking](skills/deep-linking.md) | sonnet | Universal Links (iOS), App Links (Android), auth + deep link race condition |
+| [push-notifications](skills/push-notifications.md) | sonnet | FCM v1, APNs, Expo Notifications, permission handling, delivery debugging |
+| [ota-updates](skills/ota-updates.md) | sonnet | EAS Update, runtime version management, rollback, bytecode compatibility |
+| [app-store-prep](skills/app-store-prep.md) | sonnet | Screenshots, metadata, privacy manifests, submission checklist |
+| [native-bridge](skills/native-bridge.md) | sonnet | Expo Modules API, TurboModules, Swift/Kotlin interop, background tasks |
+| [ios-build-pipeline](skills/ios-build-pipeline.md) | sonnet | Certificate generation, provisioning, Xcode archive, IPA export, TestFlight upload |
+| [app-store-connect](skills/app-store-connect.md) | sonnet | Version management, localization, screenshot upload, IAP, review submission |
 
 Skill files: `skills/<skill-name>.md`
 

package/extensions/zalo/PACK.md

@@ -107,6 +107,15 @@ Called By ← mcp-builder (L2): when building Zalo-specific MCP server
 4. Credentials (tokens, cookies, secrets) MUST never be logged or committed
 5. Webhook signature verification MUST NOT be skipped — even in development
 
+## Sharp Edges
+
+| Failure Mode | Severity | Mitigation |
+|---|---|---|
+| OAuth2 access token expires (1h) without auto-refresh causing silent API failures | HIGH | Implement token refresh middleware that intercepts 401 responses and retries with new token before propagating errors |
+| zca-js session lost when running personal bot and Zalo app simultaneously on same account | HIGH | Use a dedicated account for bot automation — single-session limit is non-negotiable on Track B |
+| Webhook signature verification skipped in development, then deployed to production unsigned | HIGH | Always validate `X-Zalo-Signature` header from first commit — skip in dev only via explicit `SKIP_WEBHOOK_VERIFY=true` env flag |
+| Rate limit hit causes account ban with no warning (HTTP 429 mishandled as transient error) | HIGH | Implement token bucket per endpoint; treat sustained 429s as ban-risk signal and back off for 60+ seconds |
+
 ## Done When
 
 - OA OAuth2 flow working with auto-refresh

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rune-kit/rune",
-  "version": "2.2.6",
-  "description": "58-skill mesh for AI coding assistants — 5-layer architecture, 200+ connections, 8 platforms (Claude Code, Cursor, Windsurf, Antigravity, Codex, OpenCode, OpenClaw, Generic)",
+  "version": "2.3.1",
+  "description": "59-skill mesh for AI coding assistants — 5-layer architecture, 200+ connections, 8 platforms (Claude Code, Cursor, Windsurf, Antigravity, Codex, OpenCode, OpenClaw, Generic)",
   "type": "module",
   "bin": {
     "rune": "./compiler/bin/rune.js"
@@ -9,11 +9,12 @@
   "scripts": {
     "build": "node compiler/bin/rune.js build",
     "doctor": "node compiler/bin/rune.js doctor && node scripts/version-sync-check.js",
-    "test": "node --test compiler/__tests__/*.test.js",
+    "test": "node --test compiler/__tests__/*.test.js scripts/__tests__/*.test.js",
+    "test:coverage": "c8 --reporter=text --reporter=lcov node --test compiler/__tests__/*.test.js scripts/__tests__/*.test.js",
     "lint": "biome check .",
     "lint:fix": "biome check --fix .",
     "format": "biome format --write .",
-    "ci": "biome check . && node --test compiler/__tests__/*.test.js && node compiler/bin/rune.js doctor",
+    "ci": "biome check . && node --test compiler/__tests__/*.test.js scripts/__tests__/*.test.js && node compiler/bin/rune.js doctor",
     "version-check": "node scripts/version-sync-check.js",
     "prepublishOnly": "node scripts/version-sync-check.js"
   },
@@ -52,11 +53,12 @@
     "docs/",
     "references/"
   ],
-  "homepage": "https://github.com/rune-kit/rune",
+  "homepage": "https://rune-kit.github.io/rune",
   "bugs": {
     "url": "https://github.com/rune-kit/rune/issues"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.7"
+    "@biomejs/biome": "^2.4.7",
+    "c8": "^10.1.3"
   }
 }

package/skills/adversary/SKILL.md

@@ -266,6 +266,18 @@ Trigger: plan involves auth, crypto, payment, or user data handling.
 - Findings formatted for consumption by cook Phase 3 (if PROCEED) or plan (if REVISE)
 - Strength Notes section acknowledges well-designed aspects of the plan
 
+## Returns
+
+| Artifact | Format | Location |
+|----------|--------|----------|
+| Adversary Report | Markdown | inline (stdout) |
+| Threat findings | Structured list (CRITICAL/HIGH/MEDIUM) | inline |
+| Risk matrix per dimension | Table | inline |
+| Verdict + remediation list | Markdown | inline |
+| Hardened plan notes (if PROCEED) | Text | passed to cook Phase 3 |
+
 ## Cost Profile
 
 ~4000-8000 tokens input (plan + codebase context), ~2000-3000 tokens output. Opus model for adversarial depth. Runs once per feature plan — high cost justified by preventing wasted implementation cycles.
+
+**Scope guardrail:** adversary reviews THE PLAN only — never audits existing codebase quality or rewrites code.