@rune-kit/rune 2.29.0 → 2.30.0

package/compiler/commands/update.js

@@ -0,0 +1,354 @@
+/**
+ * `rune update` — one-shot updater for an already-configured project.
+ *
+ * Mirrors the manual "Updating" flow from the README in a single command:
+ *   1. `git pull --ff-only` any detected paid tier repos (Pro / Business).
+ *      Detection reuses setup's logic: $RUNE_PRO_ROOT / $RUNE_BUSINESS_ROOT
+ *      env vars, then sibling dirs (../Pro, ../Business), then well-known
+ *      paths. Absent tiers and non-git checkouts are skipped with a note;
+ *      a FAILED pull aborts the update (fail loud — never silently continue).
+ *   2. Re-run the managed setup rewrite in place, non-interactively: the
+ *      installed platforms, preset, and tiers are detected from the project's
+ *      existing hook config instead of prompting. Delegates to `runSetup`.
+ *   3. Verify: compiled-output doctor (when a rune.config.json build exists)
+ *      + hook drift report, then print a short summary. Codex users are
+ *      reminded to re-trust hooks via `/hooks` when `.codex/hooks.json`
+ *      changed.
+ *
+ * Non-interactive by design — safe to run from scripts. Flags:
+ *   --no-pull            skip step 1 (tier repos managed some other way)
+ *   --preset <p>         override the detected preset
+ *   --tier <t>[,<t>]     override the detected tier list
+ *   --dry                preview: skip pulls, pass dry to setup (no writes)
+ */
+
+import { execFile } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { ADAPTERS, detectPlatforms } from '../adapters/hooks/index.js';
+import { checkHookDrift } from './hooks/drift.js';
+import { TIER_ENV_VARS } from './hooks/tiers.js';
+import { detectTiers, runSetup } from './setup.js';
+
+/** Installed hook configs that may carry tier tokens (env var references). */
+const TIER_SCAN_FILES = ['.claude/settings.json', '.codex/hooks.json'];
+
+/** Rule/workflow dirs whose Rune-managed files carry `rune-tier:` frontmatter. */
+const TIER_SCAN_DIRS = ['.cursor/rules', '.windsurf/rules', '.windsurf/workflows', '.antigravity/rules'];
+
+const CODEX_HOOKS_REL_PATH = '.codex/hooks.json';
+
+/**
+ * Detect which paid tiers are wired into this project's installed hook config.
+ * Reads the config files Rune manages and looks for tier env-var tokens
+ * (`RUNE_PRO_ROOT` / `RUNE_BUSINESS_ROOT`) or `rune-tier:` frontmatter.
+ * Free preset entries never contain either marker, so a Free-only install
+ * returns [].
+ *
+ * @param {string} projectRoot
+ * @returns {Promise<string[]>} tier names, e.g. ['pro']
+ */
+export async function detectInstalledTiers(projectRoot) {
+  const chunks = [];
+  for (const rel of TIER_SCAN_FILES) {
+    const filePath = path.join(projectRoot, rel);
+    if (existsSync(filePath)) {
+      chunks.push(await readFile(filePath, 'utf-8').catch(() => ''));
+    }
+  }
+  for (const rel of TIER_SCAN_DIRS) {
+    const dir = path.join(projectRoot, rel);
+    if (!existsSync(dir)) continue;
+    const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      if (!entry.isFile() || !/\.(md|mdc)$/.test(entry.name)) continue;
+      chunks.push(await readFile(path.join(dir, entry.name), 'utf-8').catch(() => ''));
+    }
+  }
+  const text = chunks.join('\n');
+  const tiers = [];
+  for (const [tier, envVar] of Object.entries(TIER_ENV_VARS)) {
+    const marker = new RegExp(`${envVar}|rune-tier:\\s*${tier}\\b`);
+    if (marker.test(text)) tiers.push(tier);
+  }
+  return tiers;
+}
+
+/**
+ * Detect the preset the project was installed with, by asking each detected
+ * platform adapter for its status. A `mixed` install resolves to `gentle`
+ * (same fallback the drift reporter uses for canonical comparison).
+ *
+ * @param {string} projectRoot
+ * @returns {Promise<'gentle'|'strict'|null>} null when nothing is installed
+ */
+export async function detectInstalledPreset(projectRoot) {
+  for (const id of detectPlatforms(projectRoot)) {
+    const status = await ADAPTERS[id].status(projectRoot);
+    if (!status.installed || !status.preset) continue;
+    if (status.preset === 'mixed') return 'gentle';
+    if (status.preset === 'gentle' || status.preset === 'strict') return status.preset;
+  }
+  return null;
+}
+
+/**
+ * Default command runner — thin execFile wrapper that never throws.
+ * @returns {Promise<{code: number, stdout: string, stderr: string}>}
+ */
+function defaultExec(cmd, argv) {
+  return new Promise((resolve) => {
+    execFile(cmd, argv, { windowsHide: true }, (err, stdout, stderr) => {
+      if (err) {
+        resolve({
+          code: typeof err.code === 'number' ? err.code : 1,
+          stdout: stdout ?? '',
+          stderr: stderr || err.message,
+        });
+      } else {
+        resolve({ code: 0, stdout: stdout ?? '', stderr: stderr ?? '' });
+      }
+    });
+  });
+}
+
+/**
+ * `git pull --ff-only` each detected tier repo.
+ *
+ * Statuses per tier:
+ *   - absent  — tier not detected (no env var / sibling / well-known path)
+ *   - skipped — detected but not a git checkout (npx/tarball install)
+ *   - pulled  — git pull succeeded
+ *   - failed  — git pull failed (dirty tree, auth, diverged…) → result.ok=false
+ *
+ * @param {{ detected: ReturnType<typeof detectTiers>, exec?: typeof defaultExec }} opts
+ * @returns {Promise<{ ok: boolean, results: Array<{tier: string, root: string|null, status: string, detail: string}> }>}
+ */
+export async function pullTierRepos({ detected, exec = defaultExec }) {
+  const results = [];
+  for (const tier of Object.keys(TIER_ENV_VARS)) {
+    const info = detected[tier];
+    if (!info) {
+      results.push({ tier, root: null, status: 'absent', detail: 'not detected — skipping' });
+      continue;
+    }
+    // detectTiers points at <tierRoot>/hooks/manifest.json — walk back to the root.
+    const tierRoot = path.resolve(path.dirname(path.dirname(info.path)));
+    if (!existsSync(path.join(tierRoot, '.git'))) {
+      results.push({
+        tier,
+        root: tierRoot,
+        status: 'skipped',
+        detail: `${tierRoot} is not a git repo — pull skipped (update it the way it was installed)`,
+      });
+      continue;
+    }
+    const { code, stdout, stderr } = await exec('git', ['-C', tierRoot, 'pull', '--ff-only']);
+    if (code === 0) {
+      const summary = (stdout.trim().split('\n').pop() || 'done').trim();
+      results.push({ tier, root: tierRoot, status: 'pulled', detail: summary });
+    } else {
+      results.push({ tier, root: tierRoot, status: 'failed', detail: (stderr || stdout).trim() });
+    }
+  }
+  return { ok: results.every((r) => r.status !== 'failed'), results };
+}
+
+/**
+ * Compiled-output verification. Only meaningful for build-pipeline projects
+ * (rune.config.json with a non-Claude platform) — Claude Code loads source
+ * SKILL.md files natively, so there is no compiled output to check.
+ */
+async function defaultDoctorCheck(projectRoot, runeRoot) {
+  const configPath = path.join(projectRoot, 'rune.config.json');
+  if (!existsSync(configPath)) {
+    return { skipped: true, reason: 'no rune.config.json — compiled-output check skipped' };
+  }
+  let config;
+  try {
+    config = JSON.parse(await readFile(configPath, 'utf-8'));
+  } catch (err) {
+    return { skipped: true, reason: `rune.config.json unreadable (${err.message}) — compiled-output check skipped` };
+  }
+  if (!config.platform || config.platform === 'claude') {
+    return { skipped: true, reason: 'Claude Code native — no compiled output to check' };
+  }
+  const { runDoctor } = await import('../doctor.js');
+  const { getAdapter } = await import('../adapters/index.js');
+  const resolvedRuneRoot = config.source === '@rune-kit/rune' ? runeRoot : config.source || runeRoot;
+  const results = await runDoctor({
+    outputRoot: projectRoot,
+    adapter: getAdapter(config.platform),
+    config,
+    runeRoot: resolvedRuneRoot,
+  });
+  return { skipped: false, healthy: results.healthy, results };
+}
+
+/**
+ * The full update flow. Pure orchestration — every side-effecting collaborator
+ * is injectable via `deps` for tests.
+ *
+ * @param {object} opts
+ * @param {string} opts.projectRoot
+ * @param {string} opts.runeRoot
+ * @param {object} [opts.args] — CLI flags: no-pull, preset, tier, dry
+ * @param {object} [opts.deps] — { exec, runSetupFn, checkHookDriftFn, doctorFn, skillTarget, wellKnownPaths }
+ * @returns {Promise<object>} structured result for formatUpdateResult
+ */
+export async function runUpdate({ projectRoot, runeRoot, args = {}, deps = {} }) {
+  const notes = [];
+
+  // ── 0. Something to update? ──
+  const platforms = detectPlatforms(projectRoot);
+  if (platforms.length === 0) {
+    return {
+      ok: false,
+      reason:
+        'No Rune installation detected in this project — nothing to update. Run `npx @rune-kit/rune setup` first.',
+      pull: { ok: true, results: [] },
+      notes,
+    };
+  }
+
+  // ── 1. Pull tier repos (fail loud on pull errors) ──
+  const detected = detectTiers(projectRoot, deps.wellKnownPaths ? { wellKnownPaths: deps.wellKnownPaths } : {});
+  let pull;
+  if (args['no-pull'] || args.dry) {
+    const why = args['no-pull'] ? '--no-pull' : '--dry';
+    pull = {
+      ok: true,
+      results: Object.keys(TIER_ENV_VARS).map((tier) => ({
+        tier,
+        root: null,
+        status: detected[tier] ? 'skipped' : 'absent',
+        detail: detected[tier] ? `pull skipped (${why})` : 'not detected — skipping',
+      })),
+    };
+  } else {
+    pull = await pullTierRepos({ detected, exec: deps.exec });
+  }
+  if (!pull.ok) {
+    return {
+      ok: false,
+      reason: 'tier pull failed — resolve it manually (dirty tree? auth?) then re-run `rune update`',
+      pull,
+      notes,
+    };
+  }
+
+  // ── 2. Re-run managed setup, reusing what is already installed ──
+  const preset = args.preset || (await detectInstalledPreset(projectRoot)) || 'gentle';
+  let tiers;
+  if (args.tier) {
+    tiers = String(args.tier)
+      .split(',')
+      .map((t) => t.trim())
+      .filter(Boolean);
+  } else {
+    const installed = await detectInstalledTiers(projectRoot);
+    tiers = installed.filter((tier) => detected[tier]);
+    for (const tier of installed) {
+      if (!detected[tier]) {
+        const envVar = TIER_ENV_VARS[tier] || `RUNE_${tier.toUpperCase()}_ROOT`;
+        notes.push(
+          `${tier}: hooks are installed but the tier repo was not found — skipping. Set $${envVar} or clone the repo next to Free, then re-run \`rune update\`.`,
+        );
+      }
+    }
+  }
+
+  const codexHooksPath = path.join(projectRoot, CODEX_HOOKS_REL_PATH);
+  const codexBefore = existsSync(codexHooksPath) ? await readFile(codexHooksPath, 'utf-8').catch(() => null) : null;
+
+  const setupArgs = {
+    here: true,
+    preset,
+    dry: args.dry,
+    ...(tiers.length > 0 ? { tier: tiers.join(',') } : { 'no-tier': true }),
+  };
+  const setup = await (deps.runSetupFn || runSetup)({
+    projectRoot,
+    runeRoot,
+    args: setupArgs,
+    skillTarget: deps.skillTarget,
+  });
+
+  const codexAfter = existsSync(codexHooksPath) ? await readFile(codexHooksPath, 'utf-8').catch(() => null) : null;
+  const codexReTrust = platforms.includes('codex') && codexBefore !== codexAfter;
+
+  // ── 3. Verify: compiled output + hook drift ──
+  const doctor = await (deps.doctorFn || defaultDoctorCheck)(projectRoot, runeRoot);
+  const drift = await (deps.checkHookDriftFn || checkHookDrift)(projectRoot);
+
+  return { ok: true, pull, platforms, preset, tiers, setup, drift, doctor, codexReTrust, notes };
+}
+
+const PULL_ICONS = { pulled: '✓', absent: '·', skipped: '·', failed: '✗' };
+
+/**
+ * Render a runUpdate result for console output.
+ * @param {Awaited<ReturnType<typeof runUpdate>>} result
+ * @returns {string}
+ */
+export function formatUpdateResult(result) {
+  const lines = [];
+  lines.push('');
+  lines.push('  Rune Update');
+  lines.push('  ────────────');
+
+  if (result.pull?.results?.length > 0) {
+    lines.push('  Tier repos:');
+    for (const r of result.pull.results) {
+      const icon = PULL_ICONS[r.status] || '·';
+      const label = r.status === 'failed' ? 'pull FAILED' : r.status;
+      lines.push(`    ${icon} ${r.tier} — ${label}: ${r.detail}`);
+    }
+  }
+
+  if (!result.ok) {
+    lines.push('');
+    lines.push(`  ✗ Update aborted: ${result.reason}`);
+    lines.push('');
+    return lines.join('\n');
+  }
+
+  lines.push('  Setup rewrite:');
+  lines.push(
+    `    Platforms: ${(result.setup?.platforms || result.platforms || []).join(', ') || '—'} | Preset: ${result.preset} | Tiers: Free${result.tiers?.length ? ` + ${result.tiers.join(' + ')}` : ''}`,
+  );
+  for (const sr of result.setup?.skillResults || []) {
+    if (sr.installed?.length > 0) {
+      lines.push(`    Skills: ${sr.tier}: ${sr.installed.length} installed`);
+    } else if (sr.skipped?.length > 0) {
+      lines.push(`    Skills: ${sr.tier}: ${sr.skipped.length} already present / skipped`);
+    }
+  }
+  if (result.setup && result.setup.written === false) {
+    lines.push('    (dry-run — no files written)');
+  }
+
+  lines.push('  Verify:');
+  if (result.doctor?.skipped) {
+    lines.push(`    Doctor: skipped — ${result.doctor.reason}`);
+  } else if (result.doctor) {
+    lines.push(`    Doctor: ${result.doctor.healthy ? '✓ healthy' : '✗ issues found — run `rune doctor` for detail'}`);
+  }
+  if (result.drift?.summary) {
+    const s = result.drift.summary;
+    lines.push(`    Hook drift: ${s.drifted} drifted, ${s.missing} missing, ${s.errors} error(s)`);
+  }
+
+  for (const note of result.notes || []) {
+    lines.push(`  ⚠ ${note}`);
+  }
+
+  if (result.codexReTrust) {
+    lines.push('');
+    lines.push('  ⚠ Codex: .codex/hooks.json changed — open /hooks in Codex to review and re-trust the definitions.');
+  }
+
+  lines.push('');
+  return lines.join('\n');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rune-kit/rune",
-  "version": "2.29.0",
+  "version": "2.30.0",
   "description": "66-skill mesh for AI coding assistants — native lifecycle hooks for Claude Code and Codex, 5-layer architecture, 248 connections + 45 signals, and a 13-platform compiler.",
   "type": "module",
   "bin": {

package/skills/audit/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "0.5.0"
   layer: L2
-  model: sonnet
+  model: opus
   group: quality
   tools: "Read, Bash, Glob, Grep"
   emit: audit.complete
@@ -585,7 +585,7 @@ LOW      — Nice to have. Style inconsistencies, minor refactors, doc gaps.
 INFO     — Observation only. Architecture notes, tech debt acknowledgment.
 ```
 
-Apply confidence filtering: only report findings with >80% confidence. Consolidate similar issues (e.g., "12 functions missing error handling in src/services/" — not 12 separate findings). Adapt judgment to project type (a `console.log` in a CLI tool is fine; in a production API handler, it's not).
+Apply the Falsification Pass (`../review/SKILL.md` → Step 6): drop a finding only when what you read contains direct counter-evidence against its key claim — never merely because you are unsure. A finding you cannot disprove is reported and typed `ASSUMED` with the unchecked premise named. Consolidate similar issues (e.g., "12 functions missing error handling in src/services/" — not 12 separate findings). Adapt judgment to project type (a `console.log` in a CLI tool is fine; in a production API handler, it's not).
 
 ## Output Format
 
@@ -644,7 +644,7 @@ Report saved to: AUDIT-REPORT.md
 
 1. MUST complete all 8 phases (Phase 8 may report "no data" if .rune/metrics/ doesn't exist yet) — if any phase is skipped, state explicitly which phase and why
 2. MUST delegate Phase 1 to dependency-doctor and Phase 2 to sentinel — no manual replacements
-3. MUST apply confidence filter — only report findings with >80% confidence; consolidate similar issues
+3. MUST apply the Falsification Pass — drop findings only on direct counter-evidence, never on uncertainty; consolidate similar issues
 4. MUST include at least 3 positive findings — an audit with no positives is incomplete
 5. MUST produce quantified health scores (1-10 per dimension) — not vague "needs work"
 6. MUST NOT fabricate findings — every finding requires a specific file:line citation

package/skills/completion-gate/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   author: runedev
   version: "1.10.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: validation
   tools: "Read, Bash, Glob, Grep"
 ---

package/skills/constraint-check/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   author: runedev
   version: "1.1.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: validation
   tools: "Read, Glob, Grep"
 ---

package/skills/context-engine/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   author: runedev
   version: "1.3.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: state
   tools: "Read, Glob, Grep"
   emit: context.preview, output.density.set
@@ -321,7 +321,7 @@ When ORANGE or RED is reached, use this table to determine whether compaction is
 
 ### Mid-Loop Compaction (Phase 4 Emergency)
 
-> From goclaw (nextlevelbuilder/goclaw, 832★): "Compact during run, not just at session boundary."
+Compact during the run, not just at the session boundary.
 
 When context hits RED during Phase 4 (implementation), compaction IS possible at **clean split points**:
 

package/skills/cook/SKILL.md

@@ -640,7 +640,7 @@ Escalation chain: debug-fix (3x) → re-plan (1x) → brainstorm rescue (1x) →
 
 ### Structured Escalation Report
 
-> From agency-agents (msitarzewski/agency-agents, 50.8k★): "After 3 retry failures, structured escalation prevents cargo-cult retrying."
+After 3 retry failures, structured escalation prevents cargo-cult retrying.
 
 When escalation chain exhausts (all retries hit) or cook returns `BLOCKED`, produce a Structured Escalation Report instead of a vague "I can't do this":
 
@@ -678,7 +678,7 @@ When escalation chain exhausts (all retries hit) or cook returns `BLOCKED`, prod
 
 ### Subagent Question Gate
 
-> From superpowers (obra/superpowers, 84k★): "Subagents that start work without asking questions produce the wrong thing 40% of the time."
+Subagents that start work without asking questions frequently produce the wrong thing.
 
 Before dispatching a sub-skill (fix, test, review) for a non-trivial task (3+ files OR ambiguous scope):
 

package/skills/cook/references/loop-detection.md

@@ -4,7 +4,7 @@ The Analysis Paralysis Guard (5-read counter in SKILL.md) catches obvious paraly
 This catches **same-input-same-output loops** — where the agent keeps calling the same tool
 with the same arguments and getting the same result, making zero progress.
 
-Source: goclaw (832★) — SHA256-based loop detection distinguishes true stuck loops from productive retries.
+Hash-based detection distinguishes true stuck loops from productive retries.
 
 ## Detection Logic
 

package/skills/cook/references/mid-run-signals.md

@@ -1,7 +1,7 @@
 # Mid-Run Signal Detection — Two-Stage Intent Classification
 
 When user sends a message DURING cook execution (mid-phase), classify intent before acting.
-Source: goclaw (832★) — two-stage intent classification prevents expensive LLM calls for simple signals.
+Two-stage intent classification prevents expensive LLM calls for simple signals.
 
 ## Stage 1 — Keyword Fast-Path
 

package/skills/debug/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "1.4.0"
   layer: L2
-  model: sonnet
+  model: opus
   group: development
   tools: "Read, Bash, Glob, Grep"
   emit: bug.diagnosed, agent.stuck
@@ -282,7 +282,7 @@ Track fix attempts in the Debug Report. If this is attempt N>1 for the same symp
 
 ### 3+ Fixes as Architectural Signal
 
-> From superpowers (obra/superpowers, 84k★): "Each fix revealing new problems elsewhere = structural issue, not a bug hunt."
+Each fix revealing new problems elsewhere is a structural issue, not a bug hunt.
 
 When 3+ **distinct** fixes fail (not retries of the same fix), STOP treating it as a bug:
 

package/skills/dependency-doctor/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "0.2.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: deps
   tools: "Read, Bash, Glob, Grep"
 ---

package/skills/design/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "0.9.0"
   layer: L2
-  model: sonnet
+  model: opus
   group: creation
   tools: "Read, Write, Edit, Glob, Grep"
 ---

package/skills/docs/SKILL.md

@@ -177,7 +177,7 @@ Delegate to `rune:git changelog` to produce a changelog entry from commits since
 
 #### Step 4 — Cross-Doc Consistency Pass
 
-> From gstack (garrytan/gstack, 50.9k★): "Cross-document consistency prevents the #2 docs problem: docs that exist but contradict each other."
+Cross-document consistency prevents the second-most-common docs problem: docs that exist but contradict each other.
 
 After updating any doc, verify consistency across all project documentation:
 

package/skills/docs-seeker/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: docs-seeker
 description: "Find documentation for APIs, libraries, and error messages. Looks up official docs, changelog entries, and migration guides."
+context: fork
+agent: general-purpose
+model: haiku
 metadata:
   author: runedev
   version: "0.2.0"

package/skills/hallucination-guard/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "0.3.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: validation
   tools: "Read, Bash, Glob, Grep"
 ---
@@ -78,7 +78,7 @@ If export not found → mark as **WARN** (symbol may not be exported).
 
 ### Step 3 — Verify external packages (Dependency Check Before Import)
 
-> From taste-skill (Leonxlnx/taste-skill, 3.4k★): "Before importing ANY 3rd party lib, check package.json."
+Before importing ANY third-party library, check the dependency manifest.
 
 Use `Read` on the project's dependency manifest to confirm each external package is listed:
 

package/skills/incident/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   author: runedev
   version: "0.2.0"
   layer: L2
-  model: sonnet
+  model: opus
   group: delivery
   tools: "Read, Write, Edit, Bash, Glob, Grep"
   listen: incident.detected

package/skills/integrity-check/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   author: runedev
   version: "0.2.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: validation
   tools: "Read, Glob, Grep"
   listen: quarantine.notice.emitted

package/skills/launch/SKILL.md

@@ -8,7 +8,7 @@ metadata:
   author: runedev
   version: "0.4.0"
   layer: L1
-  model: sonnet
+  model: opus
   group: orchestrator
   tools: "Read, Write, Edit, Bash, Glob, Grep"
   listen: audit.complete