@rune-kit/rune 2.28.0 → 2.29.0

package/hooks/post-session-reflect/index.cjs

@@ -4,7 +4,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
+const { stateFile } = require('../lib/context-key.cjs');
 const { captureConsole } = require('../lib/hook-output.cjs');
 // Hook stdout is a JSON contract, not free text (Codex rejects bare lines and
 // discards the output). Capture the prints below and emit one envelope on exit.
@@ -12,12 +12,17 @@ captureConsole('Stop');
 
 
 const cwd = process.cwd();
-const hash = Buffer.from(cwd).toString('base64url').slice(0, 16);
+let sessionId;
+try {
+  sessionId = JSON.parse(fs.readFileSync(0, 'utf-8')).session_id;
+} catch {
+  // Older runtimes may not provide hook input.
+}
 
 // === H3: Flush Session Metrics ===
 
-const metricsJsonl = path.join(os.tmpdir(), `rune-metrics-${hash}.jsonl`);
-const counterFile = path.join(os.tmpdir(), `rune-context-watch-${hash}.json`);
+const metricsJsonl = stateFile('rune-metrics', sessionId, cwd).replace(/\.json$/, '.jsonl');
+const counterFile = stateFile('rune-context-watch', sessionId, cwd);
 const runeMetricsDir = path.join(cwd, '.rune', 'metrics');
 
 // Resolve skill names → expected model from agent frontmatter
@@ -101,33 +106,69 @@ function flushMetrics() {
   const modelsUsed = resolveSkillModels(skillCounts);
 
   // Use session ID from context-watch (shared) or generate new
-  const sessionId = watchState.sessionId
+  const metricSessionId = sessionId
+    || watchState.sessionId
     || `s-${now.slice(0, 10).replace(/-/g, '')}-${now.slice(11, 19).replace(/:/g, '')}`;
 
-  // 1. Append to sessions.jsonl
+  // 1. Upsert sessions.jsonl. Stop can fire more than once in one session;
+  // appending every time inflated session counts and duration metrics.
+  let previousSession = null;
+  const sessionsFile = path.join(runeMetricsDir, 'sessions.jsonl');
+  let sessionEntries = [];
+  if (fs.existsSync(sessionsFile)) {
+    sessionEntries = fs
+      .readFileSync(sessionsFile, 'utf-8')
+      .trim()
+      .split('\n')
+      .filter(Boolean)
+      .flatMap((line) => {
+        try {
+          return [JSON.parse(line)];
+        } catch {
+          return [];
+        }
+      });
+    previousSession = [...sessionEntries].reverse().find((entry) => entry.id === metricSessionId) || null;
+  }
+
+  const mergedSkillCounts = { ...(previousSession?.skill_counts || {}) };
+  for (const [skill, count] of Object.entries(skillCounts)) {
+    mergedSkillCounts[skill] = (mergedSkillCounts[skill] || 0) + count;
+  }
+  const mergedSkillDurations = { ...(previousSession?.skill_durations || {}) };
+  for (const [skill, duration] of Object.entries(skillDurations)) {
+    mergedSkillDurations[skill] = (mergedSkillDurations[skill] || 0) + duration;
+  }
+  const mergedModels = { ...(previousSession?.models_used || {}) };
+  for (const [model, count] of Object.entries(modelsUsed)) {
+    mergedModels[model] = (mergedModels[model] || 0) + count;
+  }
+  const mergedSkills = Object.keys(mergedSkillCounts);
+  const mergedPrimarySkill = Object.entries(mergedSkillCounts)
+    .sort((a, b) => b[1] - a[1])[0]?.[0]
+    || previousSession?.primary_skill
+    || primarySkill;
+
   const sessionEntry = {
-    id: sessionId,
+    id: metricSessionId,
     date: now.slice(0, 10),
     duration_min: durationMin,
     tool_calls: watchState.count,
     tool_distribution: watchState.toolCounts,
-    skill_invocations: skillEvents.length,
-    skills_used: Object.keys(skillCounts),
-    primary_skill: primarySkill,
-    models_used: modelsUsed,
-    skill_durations: Object.keys(skillDurations).length > 0 ? skillDurations : undefined
+    skill_invocations: Object.values(mergedSkillCounts).reduce((sum, count) => sum + count, 0),
+    skills_used: mergedSkills,
+    primary_skill: mergedPrimarySkill,
+    models_used: mergedModels,
+    skill_counts: Object.keys(mergedSkillCounts).length > 0 ? mergedSkillCounts : undefined,
+    skill_durations: Object.keys(mergedSkillDurations).length > 0 ? mergedSkillDurations : undefined
   };
 
-  const sessionsFile = path.join(runeMetricsDir, 'sessions.jsonl');
-  fs.appendFileSync(sessionsFile, JSON.stringify(sessionEntry) + '\n');
-
-  // Cap at 100 sessions (rotate oldest)
-  try {
-    const allLines = fs.readFileSync(sessionsFile, 'utf-8').trim().split('\n').filter(Boolean);
-    if (allLines.length > 100) {
-      fs.writeFileSync(sessionsFile, allLines.slice(-100).join('\n') + '\n');
-    }
-  } catch { /* cap is best-effort */ }
+  sessionEntries = sessionEntries.filter((entry) => entry.id !== metricSessionId);
+  sessionEntries.push(sessionEntry);
+  fs.writeFileSync(
+    sessionsFile,
+    `${sessionEntries.slice(-100).map((entry) => JSON.stringify(entry)).join('\n')}\n`,
+  );
 
   // 2. Merge into skills.json (running totals)
   const skillsFile = path.join(runeMetricsDir, 'skills.json');
@@ -153,7 +194,7 @@ function flushMetrics() {
   if (skillChain.length > 0) {
     const chainsFile = path.join(runeMetricsDir, 'chains.jsonl');
     const chainEntry = {
-      session: sessionId,
+      session: metricSessionId,
       chain: skillChain,
       depth: skillChain.length
     };
@@ -170,7 +211,7 @@ function flushMetrics() {
     .map(([s, c]) => `${s}(${c})`)
     .join(', ');
 
-  console.log(`\n📊 [Rune metrics] Session ${sessionId} — ${durationMin}min, ${watchState.count} tool calls, ${skillEvents.length} skill invocations`);
+  console.log(`\n📊 [Rune metrics] Session ${metricSessionId} — ${durationMin}min, ${watchState.count} tool calls, ${skillEvents.length} new skill invocations`);
   if (skillList) console.log(`   Skills: ${skillList}`);
   console.log(`   Saved to .rune/metrics/\n`);
 }

package/hooks/pre-compact/index.cjs

@@ -7,20 +7,26 @@
 
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
+const { stateFile } = require('../lib/context-key.cjs');
 
 const { captureConsole } = require('../lib/hook-output.cjs');
 // Hook stdout is a JSON contract, not free text (Codex rejects bare lines and
 // discards the output). Capture the prints below and emit one envelope on exit.
-captureConsole('PreCompact');
+captureConsole('PreCompact', { captureError: true });
 
 
 const cwd = process.cwd();
 const runeDir = path.join(cwd, '.rune');
 
+let sessionId;
+try {
+  sessionId = JSON.parse(fs.readFileSync(0, 'utf-8')).session_id;
+} catch {
+  // Older runtimes may not provide hook input.
+}
+
 // Read context-watch state (tool counts, session timing)
-const hash = Buffer.from(cwd).toString('base64url').slice(0, 16);
-const counterFile = path.join(os.tmpdir(), `rune-context-watch-${hash}.json`);
+const counterFile = stateFile('rune-context-watch', sessionId, cwd);
 
 let watchState = null;
 try {

package/hooks/pre-tool-guard/index.cjs

@@ -66,14 +66,14 @@ function appendGateOutcome(gate, outcome, detail) {
  *
  * @param {string} toolName
  * @param {object} toolInput
- * @returns {string} target path, or '' when this is not a patch we understand
+ * @returns {string[]} target paths
  */
-function patchTargetPath(toolName, toolInput) {
-  if (toolName !== 'apply_patch') return '';
-  const patch = typeof toolInput === 'string' ? toolInput : toolInput.input || toolInput.patch || '';
-  if (typeof patch !== 'string') return '';
-  const match = patch.match(/^\*\*\* (?:Update|Add|Delete) File:\s*(.+)$/m);
-  return match ? match[1].trim() : '';
+function patchTargetPaths(toolName, toolInput) {
+  if (toolName !== 'apply_patch') return [];
+  const patch =
+    typeof toolInput === 'string' ? toolInput : toolInput.command || toolInput.input || toolInput.patch || '';
+  if (typeof patch !== 'string') return [];
+  return Array.from(patch.matchAll(/^\*\*\* (?:Update|Add|Delete) File:\s*(.+)$/gm), (match) => match[1].trim());
 }
 
 // Read tool_input from Claude Code hook stdin
@@ -92,11 +92,9 @@ process.stdin.on('end', () => {
     process.exit(0);
   }
 
-  const filePath = toolInput.file_path || toolInput.path || patchTargetPath(toolName, toolInput);
-  if (!filePath) process.exit(0);
-
-  const basename = path.basename(filePath);
-  const normalized = filePath.replace(/\\/g, '/');
+  const directPath = toolInput.file_path || toolInput.path;
+  const filePaths = directPath ? [directPath] : patchTargetPaths(toolName, toolInput);
+  if (filePaths.length === 0) process.exit(0);
 
   // Load project-specific privacy config
   const privacyConfig = loadPrivacyConfig();
@@ -147,33 +145,37 @@ process.stdin.on('end', () => {
   const activeSkill = process.env.RUNE_ACTIVE_SKILL || '';
   const isElevated = elevatedSkills.has(activeSkill);
 
-  const isSafe = safeExceptions.some((p) => p.test(basename) || p.test(normalized));
-  if (isSafe) process.exit(0);
-
-  const isBlocked = blockPatterns.some((p) => p.test(basename) || p.test(normalized));
-  if (isBlocked) {
-    // Append block outcome BEFORE printing/exiting — fail-safe, never affects exit code.
-    // Only "blocked" is captured here; "passed" and "bypassed" are not observable
-    // at this layer and intentionally remain uncaptured (see GAP-1 in governance-collector.js).
-    appendGateOutcome('privacy-mesh', 'blocked', `file matched BLOCK-tier pattern: ${basename}`);
-
-    console.log(`\n🚫 [Rune privacy-mesh] BLOCKED: ${filePath}`);
-    console.log('  This file matches a BLOCK-tier pattern (private keys, certificates).');
-    console.log('  Override: add path to .rune/privacy.json "allow" list if intentional.\n');
-    process.exit(2); // Exit code 2 = BLOCK
-  }
+  for (const filePath of filePaths) {
+    const basename = path.basename(filePath);
+    const normalized = filePath.replace(/\\/g, '/');
+    const isSafe = safeExceptions.some((p) => p.test(basename) || p.test(normalized));
+    if (isSafe) continue;
+
+    const isBlocked = blockPatterns.some((p) => p.test(basename) || p.test(normalized));
+    if (isBlocked) {
+      // Append block outcome BEFORE printing/exiting — fail-safe, never affects exit code.
+      // Only "blocked" is captured here; "passed" and "bypassed" are not observable
+      // at this layer and intentionally remain uncaptured (see GAP-1 in governance-collector.js).
+      appendGateOutcome('privacy-mesh', 'blocked', `file matched BLOCK-tier pattern: ${basename}`);
+
+      console.log(`\n🚫 [Rune privacy-mesh] BLOCKED: ${filePath}`);
+      console.log('  This file matches a BLOCK-tier pattern (private keys, certificates).');
+      console.log('  Override: add path to .rune/privacy.json "allow" list if intentional.\n');
+      process.exit(2); // Exit code 2 = BLOCK
+    }
 
-  const isWarned = warnPatterns.some((p) => p.test(basename) || p.test(normalized));
-  if (isWarned && !isElevated) {
-    // Content-aware check: scan first 4KB for secret patterns
-    const contentWarning = scanContentForSecrets(filePath);
+    const isWarned = warnPatterns.some((p) => p.test(basename) || p.test(normalized));
+    if (isWarned && !isElevated) {
+      // Content-aware check: scan first 4KB for secret patterns
+      const contentWarning = scanContentForSecrets(filePath);
 
-    console.log(`\n⚠ [Rune privacy-mesh] Sensitive file: ${filePath}`);
-    if (contentWarning) {
-      console.log(`  Content scan: ${contentWarning}`);
+      console.log(`\n⚠ [Rune privacy-mesh] Sensitive file: ${filePath}`);
+      if (contentWarning) {
+        console.log(`  Content scan: ${contentWarning}`);
+      }
+      console.log('  This file may contain secrets. Confirm access is intentional.');
+      console.log('  Elevated skills (sentinel, review, audit) bypass this warning.\n');
     }
-    console.log('  This file may contain secrets. Confirm access is intentional.');
-    console.log('  Elevated skills (sentinel, review, audit) bypass this warning.\n');
   }
 
   process.exit(0);

package/hooks/run-hook

@@ -8,7 +8,7 @@ if (!hookName) {
   process.exit(1);
 }
 
-const hookPath = path.join(__dirname, hookName, 'index.js');
+const hookPath = path.join(__dirname, hookName, 'index.cjs');
 try {
   require(hookPath);
 } catch (e) {

package/hooks/run-hook.cmd

@@ -1 +1 @@
-@node "%~dp0run-hook.js" %*
+@node "%~dp0run-hook.cjs" %*

package/hooks/secrets-scan/index.cjs

@@ -6,10 +6,26 @@
 // Zero false-positive tolerance on BLOCK patterns.
 
 const { execSync } = require('child_process');
+const fs = require('fs');
+const { captureConsole } = require('../lib/hook-output.cjs');
+
+captureConsole('PreToolUse', { captureError: true });
 
 // Only intercept git commit commands
-const input = JSON.parse(process.env.CLAUDE_TOOL_INPUT || '{}');
-const command = (input.command || '').trim();
+let rawInput = '';
+try {
+  rawInput = fs.readFileSync(0, 'utf-8');
+} catch {
+  // Claude compatibility fallback below.
+}
+let event = {};
+try {
+  event = JSON.parse(rawInput.trim() || process.env.CLAUDE_TOOL_INPUT || '{}');
+} catch {
+  process.exit(0);
+}
+const toolInput = event.tool_input || event;
+const command = (toolInput.command || '').trim();
 
 // Check if this is a git commit command
 if (!/^git\s+commit\b/.test(command)) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rune-kit/rune",
-  "version": "2.28.0",
-  "description": "65-skill mesh for AI coding assistants — runtime auto-discipline via native hooks (Claude/Cursor/Windsurf/Antigravity), 5-layer architecture, 204 connections + 43 signals, multi-platform compiler. converge (L3) scans spec vs code so dead-button/frontend-only implementations can't ship.",
+  "version": "2.29.0",
+  "description": "66-skill mesh for AI coding assistants — native lifecycle hooks for Claude Code and Codex, 5-layer architecture, 248 connections + 45 signals, and a 13-platform compiler.",
   "type": "module",
   "bin": {
     "rune": "./compiler/bin/rune.js"
@@ -52,6 +52,7 @@
     "commands/",
     "agents/",
     "hooks/",
+    ".codex-plugin/",
     "references/"
   ],
   "homepage": "https://rune-kit.github.io/rune",

package/skills/browser-pilot/SKILL.md

@@ -25,6 +25,7 @@ Browser automation for testing and verification using MCP Playwright tools. Navi
 - `launch` (L1): verify live site after deployment
 - `perf` (L2): Lighthouse / Core Web Vitals measurement
 - `audit` (L2): visual verification during quality assessment
+- `design` (L2): render the surface before any visual property is claimed (design Step 5.4 — render blindness)
 
 ## Calls (outbound)
 

package/skills/completion-gate/SKILL.md

@@ -148,11 +148,11 @@ For each claim, look for corresponding evidence in the conversation context:
 
 | Claim Type | Required Evidence | Where to Find |
 |---|---|---|
-| "tests pass" | Test runner stdout with pass count | Bash output from test command |
-| "build succeeds" | Build command stdout showing success | Bash output from build command |
-| "lint clean" | Linter stdout (even if empty = 0 errors) | Bash output from lint command |
-| "fixed" | Git diff showing the change + test proving fix | Edit/Write tool calls + test output |
-| "implemented" | Files created/modified matching the plan | Write/Edit tool calls vs plan |
+| "tests pass" | Test runner stdout with pass count | Shell output from test command |
+| "build succeeds" | Build command stdout showing success | Shell output from build command |
+| "lint clean" | Linter stdout (even if empty = 0 errors) | Shell output from lint command |
+| "fixed" | Git diff showing the change + test proving fix | File-edit evidence + test output |
+| "implemented" | Files created/modified matching the plan | File changes compared with the plan |
 | "no security issues" | Sentinel report with PASS verdict | Sentinel skill output |
 | "coverage ≥ X%" | Coverage tool output with actual percentage | Test runner with coverage flag |
 

package/skills/doc-processor/SKILL.md

@@ -41,7 +41,7 @@ None — pure L3 utility. Receives content, produces formatted output.
 
 | Format | Generate | Parse | Node.js Library | Python Library |
 |--------|----------|-------|-----------------|----------------|
-| PDF | Yes | Yes (via Read tool) | jsPDF, Puppeteer (HTML→PDF) | reportlab, weasyprint |
+| PDF | Yes | Yes (via the runtime's document/PDF reader) | jsPDF, Puppeteer (HTML→PDF) | reportlab, weasyprint |
 | DOCX | Yes | Yes | docx (officegen) | python-docx |
 | XLSX | Yes | Yes | ExcelJS | openpyxl |
 | PPTX | Yes | Yes | pptxgenjs | python-pptx |
@@ -157,7 +157,7 @@ Identify file format from extension and MIME type.
 
 | Format | Extraction Strategy |
 |--------|-------------------|
-| PDF | Use Read tool (Claude can read PDFs natively) |
+| PDF | Use the runtime's native document/PDF reader when available; otherwise use a supported PDF parsing library |
 | DOCX | docx library → extract text, tables, images |
 | XLSX | ExcelJS → extract sheets, rows, formulas |
 | PPTX | pptxgenjs → extract slides, text, notes |

package/skills/hallucination-guard/SKILL.md

@@ -39,6 +39,7 @@ Post-generation validation that verifies AI-generated code references actually e
 - `review-intake` (L2): verify imports in code submitted for review
 - `skill-forge` (L2): verify imports in newly generated skill code
 - `adversary` (L2): verify APIs/packages in plan actually exist
+- `logic-guardian` (L2): verify referenced functions and imports after guarded logic edits
 
 ## Execution
 

package/skills/journal/SKILL.md

@@ -39,6 +39,7 @@ None — pure L3 state management utility.
 - `graft` (L2): auto-log graft operations — source URL, mode, challenge score, files changed
 - `retro` (L2): record retrospective insights and decisions
 - `improve-architecture` (L2): record an ADR when the user rejects a deepening candidate with a load-bearing reason
+- `logic-guardian` (L2): record guarded logic changes for cross-session persistence
 
 ## Files Managed
 

package/skills/retro/SKILL.md

@@ -316,8 +316,8 @@ Pull from all installed domain packs:
 - **Engineering**: git history (commits, velocity, test ratio, fix ratio, hotspots)
 - **Revenue** (@rune-pro/sales): pipeline metrics, deal velocity, churn risk
 - **Support** (@rune-pro/support): ticket volume, SLA compliance, CSAT
-- **Finance** (@rune-business/finance): burn rate, runway, budget variance
-- **Compliance** (@rune-business/legal): framework status, audit dates, open items
+- **Finance** (@rune-pro/finance): burn rate, runway, budget variance
+- **Compliance** (@rune-pro/legal): framework status, audit dates, open items
 
 ### Business Execution Steps
 

package/skills/session-bridge/SKILL.md

@@ -41,6 +41,7 @@ Solve the #1 developer complaint: context loss across sessions. Session-bridge a
 - `context-pack` (L3): coordinate state for sub-agent handoff
 - `neural-memory` (L3): sync key decisions back to `.rune/` files after Capture Mode
 - `adversary` (L2): (oracle-mode) detach protocol when target model is opus-class for non-blocking dispatch
+- `logic-guardian` (L2): preserve logic-manifest state across sessions
 
 ## State Files Managed
 

package/skills/session-bridge/scripts/load-invariants.js

@@ -132,7 +132,7 @@ export function parseInvariants(text) {
   let current = null;
 
   const flush = () => {
-    if (current && current.title) rules.push(current);
+    if (current?.title) rules.push(current);
     current = null;
   };
 

package/skills/video-creator/SKILL.md

@@ -265,7 +265,7 @@ Known failure modes for this skill. Check these before declaring done.
 - Storyboard created scene-by-scene with transitions
 - Shot list categorized by type (screen recording, terminal, code, diagram)
 - Assets needed checklist generated
-- video-plan.md written to output_path via Write tool
+- `video-plan.md` written to `output_path` with the runtime's file-edit capability
 - Video Plan Created report emitted with scene count, shot count, and asset count
 
 ## Cost Profile