@rune-kit/rune 2.30.0 → 2.30.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rune",
-  "version": "2.30.0",
+  "version": "2.30.1",
   "description": "66-skill engineering mesh with Codex-native skills, subagents, synchronous lifecycle hooks, security gates, MCP-aware workflows, and project memory.",
   "author": {
     "name": "Rune Contributors"

package/README.md

@@ -103,11 +103,15 @@ Plus **9 domain packs** (product, sales, data-science, support, growth, media, p
 
 ---
 
-## What's New (v2.30.0 — Tier Restored)
+## What's New (v2.30.1 — Hooks That Land)
+
+> **v2.30.1 (2026-07-29):** Five hooks had been running, exiting 0, and reaching nobody — nothing logged an error, so the hook layer looked healthy while contributing nothing. Two independent faults, each fatal on its own: **`process.stdout.write` from an exit handler is not guaranteed to reach a piped stdout** (most hooks emit via `captureConsole`, which flushes on exit — the envelope was built, "written", and lost; now `fs.writeSync(1, …)`), and **a hook that collects stdin with an async listener has its stdout discarded by Claude Code** even when the write is synchronous (new `hooks/lib/hook-stdin.cjs` reads with `readFileSync(0)`; `intent-router`, `context-watch`, `metrics-collector`, `pre-tool-guard`, `quarantine` converted). Both isolated by differential test — identical hooks, one variable at a time — and confirmed by the model quoting hook-injected context back. Separately, `intent-router` never had an index to read: `skill-index.json` is emitted at build time and Claude Code doesn't compile, so all five candidate paths were missing and it exited silently on every prompt since it shipped. New `scripts/build-skill-index.js` generates it at the plugin root with a `--check` staleness gate in CI. It was also registered `"async": true`, which drops `additionalContext` outright. 1,649 tests.
+
+### Previous (v2.30.0 — Tier Restored)
 
 > **v2.30.0 (2026-07-29):** Rune's model tier table had quietly stopped applying on Claude Code, and had been wrong in **23 of 66 places** for longer than that. `agents/*.md` is a hand-written parallel copy of each skill's tier; nothing generated it from `skills/` and no check compared the two, so they drifted — `cook` said opus in one file and sonnet in the other, `verification` said sonnet and haiku. `skills/*/SKILL.md` is now the single source of truth, every pair agrees, and a new **`validateAgentSync`** gate fails CI on any future drift, alongside a model-split check and a warning for a top-level `model` that cannot take effect. Where the two disagreed the tier was decided by role, with one rule overriding both old values: **a gate never runs below sonnet** — `completion-gate`, `constraint-check`, `integrity-check`, `hallucination-guard`, and `verification` exist to catch unverified claims, so running them cheaper than the agent they audit defeats the point. Separately: tiering only ever applied through spawned subagents, and on Opus 5 the harness tells the model not to spawn them unless asked — so every tier assignment had become a silent no-op. `scout` and `docs-seeker` now declare `context: fork` + `model: haiku` and route through the Skill tool instead; verified end-to-end on Opus 5 by per-model billing showing `claude-haiku-4-5`. `cook` deliberately declares no model — an orchestrator inherits the session model, because choosing Opus for a session is a deliberate act. 1,647 tests.
 
-### Previous (v2.29.1 — One-Command Update)
+#### Earlier (v2.29.1 — One-Command Update)
 
 > **v2.29.1 (2026-07-24):** v2.29.0 documented the update flow; this release automates it. New **`rune update`** command — one-shot updater for an already-configured project: `git pull --ff-only` any detected Pro/Business tier repos (env var → sibling dir, same detection as setup; a failed pull **aborts loudly**, never a silent half-update), re-runs the managed setup rewrite in place non-interactively (your installed platforms, preset, and tiers are detected from the existing hook config — no prompts), then verifies with doctor + hook drift and reminds Codex users to re-trust `/hooks` only when `.codex/hooks.json` actually changed. Flags: `--no-pull`, `--preset`, `--tier`, `--dry`. Plus: "Updating" sections in all three tier READMEs. Docs-and-CLI patch — no skill or mesh changes. 1,641 tests.
 

package/compiler/emitter.js

@@ -897,7 +897,7 @@ const INTENT_KEYWORDS = {
  * @param {Array} parsedSkills - array of parsed skill objects
  * @returns {object} skill index with graph + intents
  */
-function generateSkillIndex(parsedSkills) {
+export function generateSkillIndex(parsedSkills) {
   // Build adjacency graph from cross-references
   const graph = {};
   const skills = {};

package/hooks/context-watch/index.cjs

@@ -14,6 +14,7 @@
 const fs = require('fs');
 const { stateFile } = require('../lib/context-key.cjs');
 const { captureConsole } = require('../lib/hook-output.cjs');
+const { readStdinSync } = require('../lib/hook-stdin.cjs');
 
 captureConsole('PreToolUse');
 
@@ -31,9 +32,9 @@ const CRITICAL_THRESHOLD = 120;
 
 // Read stdin JSON to get tool name (Claude Code passes hook data via stdin)
 let stdinData = '';
-process.stdin.setEncoding('utf-8');
-process.stdin.on('data', chunk => { stdinData += chunk; });
-process.stdin.on('end', () => {
+stdinData = readStdinSync();
+
+(() => {
   let toolName = 'unknown';
   let sessionId;
   try {
@@ -102,8 +103,4 @@ process.stdin.on('end', () => {
   }
 
   process.exit(0);
-});
-
-// Handle empty stdin (pipe closed immediately)
-process.stdin.on('error', () => process.exit(0));
-process.stdin.resume();
+})();

package/hooks/hooks.json

@@ -19,7 +19,7 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cjs\" intent-router",
-            "async": true
+            "async": false
           }
         ]
       }

package/hooks/intent-router/index.cjs

@@ -10,14 +10,14 @@
 const fs = require('fs');
 const path = require('path');
 const { captureConsole } = require('../lib/hook-output.cjs');
+const { readStdinSync } = require('../lib/hook-stdin.cjs');
 
 captureConsole('UserPromptSubmit');
 
-// Read user prompt from Claude Code hook stdin
-let input = '';
-process.stdin.setEncoding('utf-8');
-process.stdin.on('data', (chunk) => { input += chunk; });
-process.stdin.on('end', () => {
+// Read user prompt from the hook payload. Must be synchronous — see hook-stdin.cjs.
+const input = readStdinSync();
+
+(() => {
   let userPrompt = '';
   try {
     const parsed = JSON.parse(input);
@@ -34,6 +34,9 @@ process.stdin.on('end', () => {
   // Find skill-index.json — check multiple locations
   const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT || path.resolve(__dirname, '../..');
   const candidates = [
+    // Uncompiled plugin root (Claude Code serves the repo directly — nothing to
+    // compile, so this is the only index that exists on that runtime).
+    path.join(pluginRoot, 'skill-index.json'),
     path.join(pluginRoot, '.cursor', 'rules', 'skill-index.json'),
     path.join(pluginRoot, '.windsurf', 'rules', 'skill-index.json'),
     path.join(pluginRoot, 'dist', 'cursor', 'skill-index.json'),
@@ -108,4 +111,4 @@ process.stdin.on('end', () => {
   console.log('');
 
   process.exit(0);
-});
+})();

package/hooks/lib/hook-output.cjs

@@ -22,6 +22,8 @@
 // Buffer-then-emit, because the envelope is ONE JSON object: a hook that prints
 // three lines must accumulate them and emit once at exit, not three times.
 
+const fs = require('node:fs');
+
 /** Events where the model-facing payload is `additionalContext`. */
 const CONTEXT_EVENTS = new Set(['SessionStart', 'UserPromptSubmit']);
 
@@ -50,7 +52,11 @@ function outputBuffer(hookEventName) {
       const payload = CONTEXT_EVENTS.has(hookEventName)
         ? { hookSpecificOutput: { hookEventName, additionalContext: text } }
         : { systemMessage: text };
-      process.stdout.write(`${JSON.stringify(payload)}\n`);
+      // fs.writeSync, not process.stdout.write: most of these emits happen from a
+      // `process.on('exit')` handler, where a piped stdout is not guaranteed to
+      // flush before the process is gone. The write reports success either way, so
+      // the loss is silent — every hook using console.log was landing nowhere.
+      fs.writeSync(1, `${JSON.stringify(payload)}\n`);
     },
   };
 }

package/hooks/lib/hook-stdin.cjs

@@ -0,0 +1,52 @@
+'use strict';
+
+// Hook stdin — read it synchronously, always.
+//
+// A hook that collects stdin with `process.stdin.on('data'/'end')` and writes its
+// result from the 'end' callback has its stdout DISCARDED by Claude Code. The hook
+// runs, the payload arrives, the callback fires, the write succeeds, exit code is 0
+// — and the output never reaches the model. Nothing reports an error, which is why
+// five Rune hooks looked healthy while contributing nothing.
+//
+// Verified by differential test on Claude Code 2.1.220: an identical hook writing
+// the identical envelope is seen by the model when stdin is read with
+// `readFileSync(0)`, and unseen when read with an async listener. Switching the
+// write to `fs.writeSync(1, …)` does not rescue the async form, so this is about
+// when the process settles, not about flushing.
+//
+// So: read stdin synchronously, then do the work on the main tick.
+
+const fs = require('node:fs');
+
+/**
+ * Read the hook payload from stdin, synchronously.
+ *
+ * @returns {string} raw stdin, or '' when there is nothing to read
+ */
+function readStdinSync() {
+  try {
+    return fs.readFileSync(0, 'utf-8');
+  } catch {
+    // No stdin attached (manual invocation, or a runtime that omits the payload)
+    return '';
+  }
+}
+
+/**
+ * Read and parse the payload. Hook payloads are JSON, but a runtime invoking a
+ * hook by hand may pipe raw text — callers that want that fallback read `.raw`.
+ *
+ * @returns {{raw: string, data: object}}
+ */
+function readHookInput() {
+  const raw = readStdinSync();
+  let data = {};
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    data = {};
+  }
+  return { raw, data };
+}
+
+module.exports = { readStdinSync, readHookInput };

package/hooks/metrics-collector/index.cjs

@@ -10,6 +10,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const { resolveStateKey, stateFile } = require('../lib/context-key.cjs');
+const { readStdinSync } = require('../lib/hook-stdin.cjs');
 
 // metricsFile + watchFile are keyed by the Claude Code session_id (parsed from
 // stdin in the handler) so they reset per session and match the session-keyed
@@ -17,9 +18,9 @@ const { resolveStateKey, stateFile } = require('../lib/context-key.cjs');
 
 // Read stdin JSON to get tool input (Claude Code passes hook data via stdin)
 let stdinData = '';
-process.stdin.setEncoding('utf-8');
-process.stdin.on('data', chunk => { stdinData += chunk; });
-process.stdin.on('end', () => {
+stdinData = readStdinSync();
+
+(() => {
   let skillName = 'unknown';
   let claudeSessionId; // raw Claude Code session_id — used to key temp files
 
@@ -108,8 +109,4 @@ process.stdin.on('end', () => {
   }
 
   process.exit(0);
-});
-
-// Handle empty stdin (pipe closed immediately)
-process.stdin.on('error', () => process.exit(0));
-process.stdin.resume();
+})();

package/hooks/pre-tool-guard/index.cjs

@@ -16,6 +16,7 @@ const fs = require('fs');
 const path = require('path');
 
 const { captureConsole } = require('../lib/hook-output.cjs');
+const { readStdinSync } = require('../lib/hook-stdin.cjs');
 // Hook stdout is a JSON contract, not free text (Codex rejects bare lines and
 // discards the output). Capture the prints below and emit one envelope on exit.
 captureConsole('PreToolUse');
@@ -76,11 +77,10 @@ function patchTargetPaths(toolName, toolInput) {
   return Array.from(patch.matchAll(/^\*\*\* (?:Update|Add|Delete) File:\s*(.+)$/gm), (match) => match[1].trim());
 }
 
-// Read tool_input from Claude Code hook stdin
-let input = '';
-process.stdin.setEncoding('utf-8');
-process.stdin.on('data', (chunk) => { input += chunk; });
-process.stdin.on('end', () => {
+// Read tool_input from the hook payload. Must be synchronous — see hook-stdin.cjs.
+const input = readStdinSync();
+
+(() => {
   let toolInput = {};
   let toolName = '';
   try {
@@ -179,7 +179,7 @@ process.stdin.on('end', () => {
   }
 
   process.exit(0);
-});
+})();
 
 /**
  * Load .rune/privacy.json from project root

package/hooks/quarantine/index.cjs

@@ -22,6 +22,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const { readStdinSync } = require('../lib/hook-stdin.cjs');
 
 const HOOK_TIMEOUT_MS = 5000;
 
@@ -49,28 +50,18 @@ if (process.env.QUARANTINE_DISABLE === '1') {
   process.exit(0);
 }
 
-let stdinBuf = '';
-process.stdin.setEncoding('utf-8');
-process.stdin.on('data', (chunk) => {
-  stdinBuf += chunk;
-  // Cap stdin at 1MB — Claude Code never sends payloads this large
-  if (stdinBuf.length > 1_000_000) {
-    process.stdin.destroy();
-    process.exit(0);
-  }
-});
-process.stdin.on('end', () => {
-  try {
-    main(stdinBuf);
-  } catch {
-    // Any unexpected error → silent advisory exit (never block tool dispatch)
-    process.exit(0);
-  }
-});
-process.stdin.on('error', () => process.exit(0));
+// Read synchronously — see hook-stdin.cjs for why an async listener loses output.
+const stdinBuf = readStdinSync();
+
+// Cap stdin at 1MB — Claude Code never sends payloads this large
+if (stdinBuf.length > 1_000_000) {
+  process.exit(0);
+}
 
-// If stdin is a TTY (no input), exit clean
-if (process.stdin.isTTY) {
+try {
+  main(stdinBuf);
+} catch {
+  // Any unexpected error → silent advisory exit (never block tool dispatch)
   process.exit(0);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rune-kit/rune",
-  "version": "2.30.0",
+  "version": "2.30.1",
   "description": "66-skill mesh for AI coding assistants — native lifecycle hooks for Claude Code and Codex, 5-layer architecture, 248 connections + 45 signals, and a 13-platform compiler.",
   "type": "module",
   "bin": {
@@ -8,7 +8,7 @@
   },
   "scripts": {
     "build": "node compiler/bin/rune.js build",
-    "doctor": "node compiler/bin/rune.js doctor && node scripts/version-sync-check.js",
+    "doctor": "node compiler/bin/rune.js doctor && node scripts/version-sync-check.js && node scripts/build-skill-index.js --check",
     "test": "node --test compiler/__tests__/*.test.js scripts/__tests__/*.test.js",
     "test:coverage": "c8 --reporter=text --reporter=lcov node --test compiler/__tests__/*.test.js scripts/__tests__/*.test.js",
     "lint": "biome check .",
@@ -53,7 +53,8 @@
     "agents/",
     "hooks/",
     ".codex-plugin/",
-    "references/"
+    "references/",
+    "skill-index.json"
   ],
   "homepage": "https://rune-kit.github.io/rune",
   "bugs": {