@rune-kit/rune 2.30.1 → 2.30.2

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rune",
-  "version": "2.30.1",
+  "version": "2.30.2",
   "description": "66-skill engineering mesh with Codex-native skills, subagents, synchronous lifecycle hooks, security gates, MCP-aware workflows, and project memory.",
   "author": {
     "name": "Rune Contributors"

package/README.md

@@ -103,11 +103,15 @@ Plus **9 domain packs** (product, sales, data-science, support, growth, media, p
 
 ---
 
-## What's New (v2.30.1 — Hooks That Land)
+## What's New (v2.30.2 — Blocked, With a Reason)
+
+> **v2.30.2 (2026-07-29):** Finishes the hook I/O sweep, plus the fault that sweep uncovered. Claude Code shows the model **only stderr** for an exit-2 block, and `pre-tool-guard` explained itself on stdout — so a blocked read surfaced as `hook error: […]: No stderr output`. The block worked; the model just never learned why, and could only guess whether to stop or route around it. New `emitBlock()` writes the reason to stderr (Claude Code) and the envelope to stdout (Codex), then exits 2 — verified end-to-end by the model quoting the reason back. Three hooks v2.30.1 missed are also fixed: `quarantine` hand-built its envelope and shipped it with `process.stdout.write` right before `process.exit(0)`, while `auto-format` and `typecheck` printed bare `console.log` with no envelope at all (unflushed on Claude Code, rejected outright by Codex). Two new repo-wide gate tests — no hook writes stdout directly, no hook reads stdin asynchronously — so a new hook cannot reintroduce either. 1,651 tests.
+
+### Previous (v2.30.1 — Hooks That Land)
 
 > **v2.30.1 (2026-07-29):** Five hooks had been running, exiting 0, and reaching nobody — nothing logged an error, so the hook layer looked healthy while contributing nothing. Two independent faults, each fatal on its own: **`process.stdout.write` from an exit handler is not guaranteed to reach a piped stdout** (most hooks emit via `captureConsole`, which flushes on exit — the envelope was built, "written", and lost; now `fs.writeSync(1, …)`), and **a hook that collects stdin with an async listener has its stdout discarded by Claude Code** even when the write is synchronous (new `hooks/lib/hook-stdin.cjs` reads with `readFileSync(0)`; `intent-router`, `context-watch`, `metrics-collector`, `pre-tool-guard`, `quarantine` converted). Both isolated by differential test — identical hooks, one variable at a time — and confirmed by the model quoting hook-injected context back. Separately, `intent-router` never had an index to read: `skill-index.json` is emitted at build time and Claude Code doesn't compile, so all five candidate paths were missing and it exited silently on every prompt since it shipped. New `scripts/build-skill-index.js` generates it at the plugin root with a `--check` staleness gate in CI. It was also registered `"async": true`, which drops `additionalContext` outright. 1,649 tests.
 
-### Previous (v2.30.0 — Tier Restored)
+#### Earlier (v2.30.0 — Tier Restored)
 
 > **v2.30.0 (2026-07-29):** Rune's model tier table had quietly stopped applying on Claude Code, and had been wrong in **23 of 66 places** for longer than that. `agents/*.md` is a hand-written parallel copy of each skill's tier; nothing generated it from `skills/` and no check compared the two, so they drifted — `cook` said opus in one file and sonnet in the other, `verification` said sonnet and haiku. `skills/*/SKILL.md` is now the single source of truth, every pair agrees, and a new **`validateAgentSync`** gate fails CI on any future drift, alongside a model-split check and a warning for a top-level `model` that cannot take effect. Where the two disagreed the tier was decided by role, with one rule overriding both old values: **a gate never runs below sonnet** — `completion-gate`, `constraint-check`, `integrity-check`, `hallucination-guard`, and `verification` exist to catch unverified claims, so running them cheaper than the agent they audit defeats the point. Separately: tiering only ever applied through spawned subagents, and on Opus 5 the harness tells the model not to spawn them unless asked — so every tier assignment had become a silent no-op. `scout` and `docs-seeker` now declare `context: fork` + `model: haiku` and route through the Skill tool instead; verified end-to-end on Opus 5 by per-model billing showing `claude-haiku-4-5`. `cook` deliberately declares no model — an orchestrator inherits the session model, because choosing Opus for a session is a deliberate act. 1,647 tests.
 

package/hooks/auto-format/index.cjs

@@ -5,8 +5,11 @@
 // Silent pass-through if not applicable.
 
 const { execSync } = require('child_process');
+const { captureConsole } = require('../lib/hook-output.cjs');
 const path = require('path');
 
+captureConsole('PostToolUse');
+
 const input = JSON.parse(process.env.CLAUDE_TOOL_INPUT || '{}');
 const filePath = input.file_path || input.filePath || '';
 

package/hooks/lib/hook-output.cjs

@@ -113,4 +113,25 @@ function captureConsole(hookEventName, options = {}) {
   return { buffer, restore };
 }
 
-module.exports = { outputBuffer, emit, captureConsole, CONTEXT_EVENTS };
+/**
+ * Emit a BLOCK reason, then exit 2.
+ *
+ * A blocking hook has to speak on two channels, because the runtimes read
+ * different ones. Claude Code takes the reason for an exit-2 block from STDERR —
+ * a hook that explains itself on stdout gets `hook error: […]: No stderr output`
+ * shown to the model, which learns that it was blocked but never why. Codex reads
+ * the stdout envelope. Write both; neither runtime is confused by the other's.
+ *
+ * @param {string} hookEventName
+ * @param {string} text  human-readable reason
+ */
+function emitBlock(hookEventName, text) {
+  const reason = text.trim();
+  if (!reason) process.exit(2);
+
+  fs.writeSync(2, `${reason}\n`);
+  fs.writeSync(1, `${JSON.stringify({ systemMessage: reason, hookSpecificOutput: { hookEventName } })}\n`);
+  process.exit(2);
+}
+
+module.exports = { outputBuffer, emit, emitBlock, captureConsole, CONTEXT_EVENTS };

package/hooks/pre-tool-guard/index.cjs

@@ -15,7 +15,7 @@
 const fs = require('fs');
 const path = require('path');
 
-const { captureConsole } = require('../lib/hook-output.cjs');
+const { captureConsole, emitBlock } = require('../lib/hook-output.cjs');
 const { readStdinSync } = require('../lib/hook-stdin.cjs');
 // Hook stdout is a JSON contract, not free text (Codex rejects bare lines and
 // discards the output). Capture the prints below and emit one envelope on exit.
@@ -158,10 +158,16 @@ const input = readStdinSync();
       // at this layer and intentionally remain uncaptured (see GAP-1 in governance-collector.js).
       appendGateOutcome('privacy-mesh', 'blocked', `file matched BLOCK-tier pattern: ${basename}`);
 
-      console.log(`\n🚫 [Rune privacy-mesh] BLOCKED: ${filePath}`);
-      console.log('  This file matches a BLOCK-tier pattern (private keys, certificates).');
-      console.log('  Override: add path to .rune/privacy.json "allow" list if intentional.\n');
-      process.exit(2); // Exit code 2 = BLOCK
+      // Exit code 2 = BLOCK. The reason must go to stderr — that is the only
+      // channel Claude Code shows the model for a blocked call.
+      emitBlock(
+        'PreToolUse',
+        [
+          `🚫 [Rune privacy-mesh] BLOCKED: ${filePath}`,
+          '  This file matches a BLOCK-tier pattern (private keys, certificates).',
+          '  Override: add path to .rune/privacy.json "allow" list if intentional.',
+        ].join('\n'),
+      );
     }
 
     const isWarned = warnPatterns.some((p) => p.test(basename) || p.test(normalized));

package/hooks/quarantine/index.cjs

@@ -96,7 +96,9 @@ function main(raw) {
       additionalContext: notice,
     },
   };
-  process.stdout.write(`${JSON.stringify(output)}\n`);
+  // fs.writeSync, not process.stdout.write — process.exit() follows immediately
+  // below, and a piped stdout is not guaranteed to flush before the process ends.
+  fs.writeSync(1, `${JSON.stringify(output)}\n`);
 
   writeTelemetry({ tool: toolName, decision: 'emit', source: decision.source, session_id: sessionId });
   clearTimeout(timeoutHandle);

package/hooks/typecheck/index.cjs

@@ -5,9 +5,12 @@
 // Async hook — doesn't block the agent, just warns.
 
 const { execSync } = require('child_process');
+const { captureConsole } = require('../lib/hook-output.cjs');
 const fs = require('fs');
 const path = require('path');
 
+captureConsole('PostToolUse');
+
 const input = JSON.parse(process.env.CLAUDE_TOOL_INPUT || '{}');
 const filePath = input.file_path || input.filePath || '';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rune-kit/rune",
-  "version": "2.30.1",
+  "version": "2.30.2",
   "description": "66-skill mesh for AI coding assistants — native lifecycle hooks for Claude Code and Codex, 5-layer architecture, 248 connections + 45 signals, and a 13-platform compiler.",
   "type": "module",
   "bin": {