@rune-kit/rune 2.29.1 → 2.30.1

package/skills/review/references/rules/rust.md

@@ -0,0 +1,65 @@
+# Rust
+
+Blocking here: panics on reachable paths, blocking calls inside async, and `unsafe` without a stated
+invariant. The compiler and Clippy already enforce most of what a reviewer might otherwise flag —
+so an idiom finding has to earn its place, and usually does not.
+
+## Panicking paths
+
+- `unwrap` / `expect` on a `Result` or `Option` in library code or a request path
+- Slice or array indexing where the index derives from input or a length not just checked
+- Integer arithmetic that can overflow on a value from outside — release builds wrap silently
+- Division or modulo by a value that can be zero
+- `RefCell::borrow_mut` where another borrow can still be live — a runtime panic, not a compile error
+
+Do not report `unwrap` in tests, in `build.rs`, or immediately after a check that proves the variant
+— `if x.is_some()` then `x.unwrap()` is ugly, not a defect, and is at most LOW.
+
+## Error handling
+
+- `let _ = fallible();` — the error is discarded without a comment saying why
+- `.ok()` used to drop an error the caller needed to see
+- An error type erased to `String` or `Box<dyn Error>` where the caller must branch on the cause
+- A `?` in a function whose error type loses context with no `map_err` or source chain
+
+Do not report an erased error type in a binary's top-level `main` or a CLI handler, where the error
+is about to be printed and the process is about to exit.
+
+## Async correctness
+
+- A blocking call inside `async fn`: `std::thread::sleep`, `std::fs`, a sync HTTP client, or a
+  CPU-bound loop — it stalls the executor thread, not just this task
+- A `std::sync::Mutex` guard held across an `.await`
+- A future created and never awaited — it does nothing at all
+- `block_on` called from inside an async context
+
+Do not report a blocking call wrapped in `spawn_blocking` or an equivalent offload, and do not
+report `std::sync::Mutex` when no guard crosses an await point.
+
+## Ownership and lifetimes
+
+- `Arc<Mutex<...>>` locked in inconsistent order across paths — a deadlock waiting on scheduling
+- A lock guard held far longer than the data access requires, across I/O or a long computation
+- `clone()` on a large structure inside a hot loop where a borrow would do
+
+Do not report a `clone` that exists to satisfy the borrow checker at an ownership boundary, or one
+on a cheap handle type such as `Arc` or `Rc` — that is the intended use.
+
+## Unsafe
+
+- An `unsafe` block with no comment stating the invariant that makes it sound
+- `transmute` where a checked conversion exists
+- A raw pointer dereferenced without a null and alignment argument in the same scope
+- An `unsafe fn` made public without documenting the caller's obligations
+
+Do not report `unsafe` in generated bindings or an FFI shim whose invariants are documented at the
+module level — read the module doc before reporting.
+
+## Resource and correctness
+
+- A `Drop` implementation that can panic — panicking during unwind aborts the process
+- A `Vec` grown in a loop with a known final size and no `with_capacity`
+- Float equality on values that arrive from arithmetic rather than a literal
+
+Do not report the missing `with_capacity` unless the loop is on a measured hot path — otherwise it
+is a LOW-severity suggestion at best.

package/skills/review/references/rules/sql.md

@@ -0,0 +1,65 @@
+# SQL and migrations
+
+Blocking here: anything irreversible, anything that takes a long lock on a live table, and anything
+that concatenates input into a statement. A migration is reviewed as an operation on production
+data, not as a file — the question is always "what happens when this runs against the real table".
+
+## Reversibility
+
+- A migration with no down path, or a down path that does not restore what the up path removed
+- A destructive step and a data backfill in the same migration — a rollback loses the data
+- A down path that recreates a column but not its constraints, defaults, or index
+
+Do not report a missing down migration in a project whose visible convention is forward-only
+migrations — check the neighbouring files first; if they are all forward-only, this is the pattern,
+not the defect.
+
+## Locking and online safety
+
+- `ALTER TABLE` that rewrites a large table: changing a column type, adding a `NOT NULL` column with
+  a volatile default
+- `CREATE INDEX` without a concurrent variant on an engine that supports one
+- Adding a foreign key without a `NOT VALID` / validate split where the engine offers it
+- A migration that holds a transaction open across a long backfill
+
+Do not report lock risk on a table that is demonstrably small or new — a table created earlier in
+the same migration takes no meaningful lock.
+
+## Destructive operations
+
+- `DROP TABLE`, `DROP COLUMN`, or `TRUNCATE` with no evidence the data is already migrated
+- `UPDATE` or `DELETE` with no `WHERE`, or a `WHERE` on a column that is not selective
+- A column dropped in the same release that deploys the code which stops reading it — old instances
+  are still running during the rollout
+
+Do not report a drop that is explicitly the second half of an expand-migrate-contract sequence when
+the earlier migration in the same directory did the expand.
+
+## Query correctness
+
+- `NOT IN` against a subquery whose column is nullable — a single NULL makes the result empty
+- An outer join whose `WHERE` clause filters the outer side, silently making it an inner join
+- `LIMIT` with no `ORDER BY` — the rows returned are whatever the plan produced
+- Aggregates mixed with ungrouped columns
+- Implicit cross joins from a missing join condition
+
+Do not report a missing `ORDER BY` on a query whose result is fed to an aggregate or an existence
+check, where row order cannot affect the outcome.
+
+## Indexing and performance
+
+- A `WHERE` clause wrapping an indexed column in a function or a cast — the index goes unused
+- `LIKE` with a leading wildcard on a large table
+- A foreign key with no index on the referencing side, where the parent gets deleted
+- `SELECT *` in application code that will break when a column is added
+
+Do not report a missing index on a table that is small, append-only, or read once per deployment.
+
+## Injection and privileges
+
+- A statement assembled by string concatenation or interpolation instead of bind parameters
+- Dynamic SQL built from input inside a stored procedure or a function
+- A `GRANT` broader than the operation needs, or a migration that runs as a superuser role
+
+Do not report interpolation of an identifier drawn from a fixed allowlist in the same file — many
+drivers cannot parameterize identifiers, and the allowlist is the correct mitigation.

package/skills/review/references/rules/ts-js.md

@@ -0,0 +1,80 @@
+# TypeScript / JavaScript
+
+Blocking here: async sequencing bugs, unvalidated input reaching a sink, and type escapes on values
+that cross a boundary. Formatting and idiom are non-blocking — a linter already owns them, and
+repeating it spends the report's credibility on findings the author has already seen.
+
+## Async sequencing
+
+- A promise-returning call whose result decides correctness, invoked without `await` or `.then`
+- `await` inside a loop over independent iterations — serial latency for no reason
+- `Promise.all` over operations that must not partially apply: one rejects, the rest still land
+- An `async` function passed where a sync callback is expected (`forEach`, most event emitters) —
+  the caller cannot await it, so a rejection is unobserved
+- `.catch` on a promise that is never returned, so the caller is told it succeeded
+
+Do not report when the call is deliberately fire-and-forget **and** carries its own rejection
+handler, or when the return value is genuinely unused and failure is non-fatal — name which of the
+two you read.
+
+## Type escapes
+
+- `any` on a value crossing a module, API, or storage boundary
+- Non-null assertion `!` on something the path does not prove is present
+- `as` casts that widen or re-label a shape rather than narrow a checked union
+- `@ts-ignore` / `@ts-expect-error` with no comment naming what it suppresses
+
+Do not report when the escape stays inside one function whose inputs are all typed, or when the
+project's own config already permits it (`strict: false`, the rule disabled in its lint config) —
+that is a project decision, not a defect introduced by this diff.
+
+## Null and equality semantics
+
+- `==` / `!=` where a side can be `null`, `undefined`, `0`, or `''` and the coercion changes the outcome
+- `||` for defaulting where `0`, `''`, or `false` are legitimate values (`??` is the intent)
+- Optional chaining that stops short — `a?.b.c` still throws when `b` is nullish
+- `JSON.parse` on untrusted or possibly-empty input with no `try`
+
+Do not report when the value is narrowed earlier in the same path, or when the loose comparison is
+against a literal that makes the coercion unambiguous.
+
+## Mutation and shared state
+
+- Mutating a parameter, prop, or module-level object the caller still holds
+- `sort`, `reverse`, `splice` on an array received from outside the function
+- A closure capturing a variable reassigned before the closure runs
+
+Do not report when the object is constructed inside the same function, or when in-place mutation
+with an explicit ownership comment is the visible convention in neighbouring files.
+
+## React rendering
+
+- `useEffect` missing a dependency its body reads — a stale closure, not a lint nit
+- An effect that sets state it also depends on, unguarded — render loop
+- Array index as `key` on a list that reorders, filters, or inserts
+- `useState` / `useEffect` / event handlers in a Server Component (Next.js App Router)
+- State written during render rather than in an effect or a handler
+
+Do not report when the dependency is stable (a `useRef`, a `useState` setter, a module constant),
+when the list is append-only and static, or when the file declares `'use client'`.
+
+## Server-side request handling
+
+- `req.body`, params, or query reaching a query, file path, template, or shell unvalidated
+- A new route with no auth check where its siblings in the same router have one
+- A public endpoint that authenticates, sends mail, or costs money per call, with no rate limit
+- Synchronous filesystem, crypto, or large-payload serialization inside a request handler
+- User-controlled input concatenated into a redirect target or an HTML string
+
+Do not report when a validation schema, auth middleware, or rate limiter runs earlier in the chain,
+or when rate limiting is applied at a gateway or reverse proxy the repo also owns — open the router
+or that config and confirm, or file it `ASSUMED` naming the file you did not read.
+
+## Errors and resources
+
+- `catch` that swallows: an empty block, or one that logs and continues as though it succeeded
+- Errors re-thrown without preserving `cause` or the original stack
+- `setInterval`, listeners, subscriptions, or streams opened with no matching teardown
+
+Do not report a swallowed error when the catch is a fallback path whose recovery behaviour is
+visible in the same block.

package/skills/sast/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "1.0.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: validation
   tools: "Read, Bash, Glob, Grep"
 ---

package/skills/scout/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: scout
 description: "Fast codebase scanner. Use when any skill needs codebase context. Finds files, patterns, dependencies, project structure. Pure read-only — never modifies files."
+context: fork
+agent: general-purpose
+model: haiku
 metadata:
   author: runedev
   version: "0.4.0"

package/skills/sentinel/SKILL.md

@@ -270,7 +270,7 @@ Before reporting ANY finding as BLOCK or WARN, it MUST pass through these 6 gate
 
 | Gate | Question | If Fails |
 |------|----------|----------|
-| 1. **Process** | Is there concrete evidence (file:line, regex match, tool output)? | Discard — no evidence = hallucination |
+| 1. **Process** | Is there concrete evidence — a **verbatim snippet copied from the file**, a regex match, or tool output? | Discard — no evidence = hallucination |
 | 2. **Reachability** | Can an attacker actually reach this code path? | Downgrade to INFO |
 | 3. **Real Impact** | Would exploitation cause actual harm (data loss, RCE, privilege escalation)? | Downgrade to INFO |
 | 4. **PoC Plausibility** | Can you describe a concrete attack scenario in ≤3 steps? | Downgrade to INFO — theoretical ≠ real |
@@ -285,6 +285,12 @@ Before reporting ANY finding as BLOCK or WARN, it MUST pass through these 6 gate
 
 ### Step 5 — Report
 
+**Anchor Pass first.** Gate 1 above required a verbatim snippet, not a remembered line number. Resolve each surviving finding's line now via the Anchor Ladder defined in `../review/SKILL.md` → Step 6: `Grep` the exact snippet, retry once whitespace-normalised with the outer lines dropped, and on a second miss mark it `UNANCHORED`.
+
+`UNANCHORED` behaves as it does everywhere else — downgrade one level (BLOCK → WARN → INFO), report as `path (unanchored)` with the snippet inline, never drop. **An unanchored finding cannot BLOCK on its own**: a vulnerability nobody can locate halts the pipeline without telling anyone where to look. It still gets reported, because a failed `Grep` is a bookkeeping failure, not a security clearance.
+
+Secrets are the exception worth naming: **never paste the matched secret into the evidence block.** Anchor on the leading substring of the line up to the first few characters of the value (`const apiKey = "sk-` — still a real substring, so `Grep` resolves it), then render the block with the remainder masked: `const apiKey = "sk-…"`. Reporting a leaked key by reprinting it in full copies it into one more log.
+
 Aggregate all findings across all steps. Verdict rules:
 - Any **BLOCK** → overall status = **BLOCK**. List all BLOCK items first.
 - No BLOCK but any **WARN** → overall status = **WARN**. Developer must acknowledge each WARN.
@@ -315,25 +321,41 @@ Generate domain-specific pre-commit hook scripts when requested. Load reference
 
 ## Output Format
 
-```
+````
 ## Sentinel Report
 - **Status**: PASS | WARN | BLOCK
 - **Files Scanned**: [count]
 - **Findings**: [count by severity]
+- **Unanchored**: [count — findings whose evidence did not resolve to a line]
 
 ### BLOCK (must fix before commit)
-- `path/to/file.ts:42` — Hardcoded API key detected (pattern: sk-...)
-- `path/to/api.ts:15` — SQL injection: string concatenation in query
+- `config/client.ts:42` — Hardcoded API key committed to the repo
+  ```ts
+  const apiKey = "sk-…"
+  ```
+- `api/search.ts:15` — SQL injection: user input concatenated into the query string
+  ```ts
+  db.query(`SELECT * FROM items WHERE name = '${req.query.q}'`);
+  ```
 
 ### WARN (must acknowledge)
 - `package.json` — lodash@4.17.20 has known prototype pollution (CVE-2021-23337, CVSS 7.4)
+- `api/upload.ts (unanchored)` — path traversal: request filename joined onto the upload dir without normalisation
+  ```ts
+  fs.writeFileSync(path.join(UPLOAD_DIR, req.body.filename), buf);
+  ```
 
 ### INFO
-- `auth.ts:30` — Consider adding rate limiting to login endpoint
+- `auth/login.ts:30` — Consider adding rate limiting to the login endpoint
+  ```ts
+  router.post("/login", handleLogin);
+  ```
 
 ### Verdict
 BLOCKED — 2 critical findings must be resolved before commit.
-```
+````
+
+Secret values are masked in the evidence block, never reprinted. Dependency findings (`package.json` above) are file-level and carry no snippet. The unanchored WARN shows the shape of a real finding whose snippet would not resolve — downgraded from BLOCK, reported in full, its evidence left visible for the reader to locate by hand.
 
 ## Constraints
 
@@ -378,6 +400,7 @@ BLOCKED — 2 critical findings must be resolved before commit.
 - OWASP checks applied (SQL injection, XSS, CSRF, input validation)
 - Dependency audit ran (or "tool not found" reported as INFO)
 - Framework-specific checks applied for every detected framework
+- Every line-level finding anchored to a verbatim snippet (or reported `(unanchored)` and downgraded), with secret values masked
 - Structured report emitted with PASS / WARN / BLOCK verdict and all files scanned listed
 
 ## Cost Profile

package/skills/skill-router/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   author: runedev
   version: "1.4.0"
   layer: L0
-  model: haiku
+  model: sonnet
   group: orchestrator
   tools: "Read, Glob, Grep"
 ---

package/skills/team/SKILL.md

@@ -197,7 +197,7 @@ Contract format in NEXUS Handoff:
 
 **1d. Question Gate (non-trivial tasks only).**
 
-> From superpowers (obra/superpowers, 84k★): "Subagents that start work without asking questions produce the wrong thing 40% of the time."
+Subagents that start work without asking questions frequently produce the wrong thing.
 
 Before dispatching streams, include in each NEXUS Handoff: "Before starting, ask up to 3 clarifying questions if anything is unclear about scope, conventions, or expected output."
 
@@ -217,7 +217,7 @@ Mark todo[1] `in_progress`.
 
 Launch independent streams (depends_on: []) in parallel using Task tool with worktree isolation.
 
-> From agency-agents (msitarzewski/agency-agents, 50.8k★): "Structured handoff docs prevent the #1 multi-agent failure: context loss between agents."
+Structured handoff docs prevent the most common multi-agent failure: context loss between agents.
 
 Each stream receives a **NEXUS Handoff Template** — not a bare prompt:
 

package/skills/verification/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "0.8.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: validation
   tools: "Read, Bash, Glob, Grep"
   listen: code.changed
@@ -171,8 +171,7 @@ Report which level failed for each file in the Verification Report.
 
 ### Artifact Output Verification
 
-> Inspired by CLI-Anything (HKUDS/CLI-Anything, 14.5k★): "Never trust exit 0."
-> Many tools exit 0 even when they fail silently. Always verify ACTUAL output.
+**Never trust exit 0.** Many tools exit 0 even when they fail silently. Always verify ACTUAL output.
 
 After each phase command, verify that the expected artifact or indicator is present:
 
@@ -311,7 +310,7 @@ Overall:   [PASS/FAIL]
 
 ## Output Completion Enforcement
 
-> From taste-skill (Leonxlnx/taste-skill, 3.4k★): Truncated code is worse than no code — it passes reviews but breaks at runtime.
+Truncated code is worse than no code — it passes reviews but breaks at runtime.
 
 When verifying code files (Level 2 SUBSTANTIVE check), also scan for **truncation patterns** — signs that the agent generated partial output and stopped:
 

package/skills/watchdog/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "0.2.0"
   layer: L3
-  model: sonnet
+  model: haiku
   group: monitoring
   tools: "Read, Bash, Glob, Grep"
   emit: incident.detected