@rune-kit/rune 2.8.0 → 2.11.0

package/extensions/devops/skills/kubernetes.md

@@ -1,110 +1,110 @@
----
-name: "kubernetes"
-pack: "@rune/devops"
-description: "Kubernetes resource patterns — Deployments, Services, ConfigMaps, resource limits, health probes, HPA, network policies, and RBAC."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# kubernetes
-
-Kubernetes resource patterns — Deployments, Services, ConfigMaps, resource limits, health probes, HPA, network policies, and RBAC.
-
-#### Workflow
-
-**Step 1 — Detect Kubernetes configuration**
-Use Glob to find `k8s/`, `kubernetes/`, `manifests/`, `helm/`, `kustomize/`, or any `.yaml` files with `apiVersion: apps/v1`. Read existing manifests to understand: workload types, resource limits, probe configuration, service exposure, and secret management.
-
-**Step 2 — Audit against production readiness**
-Check for: missing resource requests/limits (noisy neighbor risk), no readiness/liveness probes (unhealthy pods receive traffic), `latest` image tag (non-reproducible), missing PodDisruptionBudget (risky rolling updates), no NetworkPolicy (unrestricted pod-to-pod traffic), secrets in plain ConfigMap (should use Secrets or external vault), no HPA (can't auto-scale), privileged containers.
-
-**Step 3 — Emit production-ready manifests**
-Generate or patch manifests: Deployment with resource limits, probes, and anti-affinity; Service with proper selector; HPA with CPU/memory targets; NetworkPolicy restricting ingress; PDB for safe rollouts; Kustomize overlays for dev/staging/prod environments.
-
-#### Example
-
-```yaml
-# Production-ready Deployment
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: api-server
-  labels:
-    app: api-server
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: api-server
-  template:
-    metadata:
-      labels:
-        app: api-server
-    spec:
-      containers:
-        - name: api
-          image: registry.example.com/api:v1.4.2  # pinned tag
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: 500m
-              memory: 512Mi
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: 3000
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: 3000
-            initialDelaySeconds: 15
-            periodSeconds: 20
-          env:
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: api-secrets
-                  key: database-url
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app: api-server
-                topologyKey: kubernetes.io/hostname
----
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: api-server-pdb
-spec:
-  minAvailable: 2
-  selector:
-    matchLabels:
-      app: api-server
----
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: api-server-hpa
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: api-server
-  minReplicas: 3
-  maxReplicas: 10
-  metrics:
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: 70
-```
+---
+name: "kubernetes"
+pack: "@rune/devops"
+description: "Kubernetes resource patterns — Deployments, Services, ConfigMaps, resource limits, health probes, HPA, network policies, and RBAC."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# kubernetes
+
+Kubernetes resource patterns — Deployments, Services, ConfigMaps, resource limits, health probes, HPA, network policies, and RBAC.
+
+#### Workflow
+
+**Step 1 — Detect Kubernetes configuration**
+Use Glob to find `k8s/`, `kubernetes/`, `manifests/`, `helm/`, `kustomize/`, or any `.yaml` files with `apiVersion: apps/v1`. Read existing manifests to understand: workload types, resource limits, probe configuration, service exposure, and secret management.
+
+**Step 2 — Audit against production readiness**
+Check for: missing resource requests/limits (noisy neighbor risk), no readiness/liveness probes (unhealthy pods receive traffic), `latest` image tag (non-reproducible), missing PodDisruptionBudget (risky rolling updates), no NetworkPolicy (unrestricted pod-to-pod traffic), secrets in plain ConfigMap (should use Secrets or external vault), no HPA (can't auto-scale), privileged containers.
+
+**Step 3 — Emit production-ready manifests**
+Generate or patch manifests: Deployment with resource limits, probes, and anti-affinity; Service with proper selector; HPA with CPU/memory targets; NetworkPolicy restricting ingress; PDB for safe rollouts; Kustomize overlays for dev/staging/prod environments.
+
+#### Example
+
+```yaml
+# Production-ready Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: api-server
+  labels:
+    app: api-server
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: api-server
+  template:
+    metadata:
+      labels:
+        app: api-server
+    spec:
+      containers:
+        - name: api
+          image: registry.example.com/api:v1.4.2  # pinned tag
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 3000
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: api-secrets
+                  key: database-url
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app: api-server
+                topologyKey: kubernetes.io/hostname
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: api-server-pdb
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app: api-server
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: api-server-hpa
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: api-server
+  minReplicas: 3
+  maxReplicas: 10
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+```

package/extensions/devops/skills/monitoring.md

@@ -1,57 +1,57 @@
----
-name: "monitoring"
-pack: "@rune/devops"
-description: "Production monitoring setup — Prometheus, Grafana, alerting rules, SLO/SLI definitions, log aggregation, distributed tracing."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# monitoring
-
-Production monitoring setup — Prometheus, Grafana, alerting rules, SLO/SLI definitions, log aggregation, distributed tracing.
-
-#### Workflow
-
-**Step 1 — Detect monitoring stack**
-Use Grep to find monitoring libraries (`prom-client`, `opentelemetry`, `winston`, `pino`, `morgan`, `dd-trace`, `@sentry/node`). Check for existing Prometheus config, Grafana dashboards, or alerting rules. Read the main server file for existing metrics/logging middleware.
-
-**Step 2 — Audit observability gaps**
-Check the four pillars: metrics (RED metrics — Rate, Errors, Duration), logs (structured JSON, correlation IDs), traces (distributed tracing spans), alerts (SLO-based alerting, not just threshold). Flag missing pillars with priority: metrics and alerts first, structured logs second, tracing third.
-
-**Step 3 — Emit monitoring configuration**
-Based on detected stack, emit: Prometheus metrics middleware (HTTP request duration histogram, error counter, active connections gauge), structured logger configuration (JSON, request ID, log levels), Grafana dashboard JSON, and Prometheus alerting rules for SLO (99.9% availability = error budget of 43 min/month).
-
-#### Example
-
-```typescript
-// Prometheus metrics middleware (prom-client)
-import { Counter, Histogram, Gauge, register } from 'prom-client';
-
-const httpDuration = new Histogram({
-  name: 'http_request_duration_seconds',
-  help: 'HTTP request duration in seconds',
-  labelNames: ['method', 'route', 'status'],
-  buckets: [0.01, 0.05, 0.1, 0.5, 1, 5],
-});
-
-const httpErrors = new Counter({
-  name: 'http_errors_total',
-  help: 'Total HTTP errors',
-  labelNames: ['method', 'route', 'status'],
-});
-
-const metricsMiddleware = (req, res, next) => {
-  const end = httpDuration.startTimer({ method: req.method, route: req.route?.path || req.path });
-  res.on('finish', () => {
-    end({ status: res.statusCode });
-    if (res.statusCode >= 400) httpErrors.inc({ method: req.method, route: req.route?.path, status: res.statusCode });
-  });
-  next();
-};
-
-// GET /metrics endpoint
-app.get('/metrics', async (req, res) => {
-  res.set('Content-Type', register.contentType);
-  res.end(await register.metrics());
-});
-```
+---
+name: "monitoring"
+pack: "@rune/devops"
+description: "Production monitoring setup — Prometheus, Grafana, alerting rules, SLO/SLI definitions, log aggregation, distributed tracing."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# monitoring
+
+Production monitoring setup — Prometheus, Grafana, alerting rules, SLO/SLI definitions, log aggregation, distributed tracing.
+
+#### Workflow
+
+**Step 1 — Detect monitoring stack**
+Use Grep to find monitoring libraries (`prom-client`, `opentelemetry`, `winston`, `pino`, `morgan`, `dd-trace`, `@sentry/node`). Check for existing Prometheus config, Grafana dashboards, or alerting rules. Read the main server file for existing metrics/logging middleware.
+
+**Step 2 — Audit observability gaps**
+Check the four pillars: metrics (RED metrics — Rate, Errors, Duration), logs (structured JSON, correlation IDs), traces (distributed tracing spans), alerts (SLO-based alerting, not just threshold). Flag missing pillars with priority: metrics and alerts first, structured logs second, tracing third.
+
+**Step 3 — Emit monitoring configuration**
+Based on detected stack, emit: Prometheus metrics middleware (HTTP request duration histogram, error counter, active connections gauge), structured logger configuration (JSON, request ID, log levels), Grafana dashboard JSON, and Prometheus alerting rules for SLO (99.9% availability = error budget of 43 min/month).
+
+#### Example
+
+```typescript
+// Prometheus metrics middleware (prom-client)
+import { Counter, Histogram, Gauge, register } from 'prom-client';
+
+const httpDuration = new Histogram({
+  name: 'http_request_duration_seconds',
+  help: 'HTTP request duration in seconds',
+  labelNames: ['method', 'route', 'status'],
+  buckets: [0.01, 0.05, 0.1, 0.5, 1, 5],
+});
+
+const httpErrors = new Counter({
+  name: 'http_errors_total',
+  help: 'Total HTTP errors',
+  labelNames: ['method', 'route', 'status'],
+});
+
+const metricsMiddleware = (req, res, next) => {
+  const end = httpDuration.startTimer({ method: req.method, route: req.route?.path || req.path });
+  res.on('finish', () => {
+    end({ status: res.statusCode });
+    if (res.statusCode >= 400) httpErrors.inc({ method: req.method, route: req.route?.path, status: res.statusCode });
+  });
+  next();
+};
+
+// GET /metrics endpoint
+app.get('/metrics', async (req, res) => {
+  res.set('Content-Type', register.contentType);
+  res.end(await register.metrics());
+});
+```

package/extensions/devops/skills/server-setup.md

@@ -1,64 +1,64 @@
----
-name: "server-setup"
-pack: "@rune/devops"
-description: "Server configuration — Nginx/Caddy reverse proxy, systemd services, firewall rules, SSH hardening, automatic updates."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# server-setup
-
-Server configuration — Nginx/Caddy reverse proxy, systemd services, firewall rules, SSH hardening, automatic updates.
-
-#### Workflow
-
-**Step 1 — Detect server environment**
-Check for `nginx.conf`, `Caddyfile`, `*.service` (systemd), `ufw` or `iptables` rules, `sshd_config` presence. Identify the reverse proxy, process manager, and OS-level security configuration.
-
-**Step 2 — Audit server hardening**
-Check for: SSH password auth enabled (should be key-only), root SSH login enabled (should be disabled), no firewall rules (should allow only 22, 80, 443), no rate limiting on Nginx, missing security headers (`X-Frame-Options`, `X-Content-Type-Options`, `Strict-Transport-Security`), process running as root.
-
-**Step 3 — Emit hardened configuration**
-Emit the corrected configs: Nginx with security headers, rate limiting, and gzip; systemd service with `User=`, `Restart=`, and resource limits; SSH hardening (`PermitRootLogin no`, `PasswordAuthentication no`); firewall rules allowing only necessary ports.
-
-#### Example
-
-```nginx
-# Nginx reverse proxy — hardened
-server {
-    listen 80;
-    server_name example.com;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl http2;
-    server_name example.com;
-
-    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
-
-    # Security headers
-    add_header X-Frame-Options DENY always;
-    add_header X-Content-Type-Options nosniff always;
-    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
-    add_header Referrer-Policy strict-origin-when-cross-origin always;
-
-    # Rate limiting
-    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
-
-    location /api/ {
-        limit_req zone=api burst=20 nodelay;
-        proxy_pass http://127.0.0.1:3000;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Request-Id $request_id;
-    }
-
-    location / {
-        root /var/www/app/dist;
-        try_files $uri $uri/ /index.html;
-        gzip on;
-        gzip_types text/plain text/css application/json application/javascript;
-    }
-}
-```
+---
+name: "server-setup"
+pack: "@rune/devops"
+description: "Server configuration — Nginx/Caddy reverse proxy, systemd services, firewall rules, SSH hardening, automatic updates."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# server-setup
+
+Server configuration — Nginx/Caddy reverse proxy, systemd services, firewall rules, SSH hardening, automatic updates.
+
+#### Workflow
+
+**Step 1 — Detect server environment**
+Check for `nginx.conf`, `Caddyfile`, `*.service` (systemd), `ufw` or `iptables` rules, `sshd_config` presence. Identify the reverse proxy, process manager, and OS-level security configuration.
+
+**Step 2 — Audit server hardening**
+Check for: SSH password auth enabled (should be key-only), root SSH login enabled (should be disabled), no firewall rules (should allow only 22, 80, 443), no rate limiting on Nginx, missing security headers (`X-Frame-Options`, `X-Content-Type-Options`, `Strict-Transport-Security`), process running as root.
+
+**Step 3 — Emit hardened configuration**
+Emit the corrected configs: Nginx with security headers, rate limiting, and gzip; systemd service with `User=`, `Restart=`, and resource limits; SSH hardening (`PermitRootLogin no`, `PasswordAuthentication no`); firewall rules allowing only necessary ports.
+
+#### Example
+
+```nginx
+# Nginx reverse proxy — hardened
+server {
+    listen 80;
+    server_name example.com;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name example.com;
+
+    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
+
+    # Security headers
+    add_header X-Frame-Options DENY always;
+    add_header X-Content-Type-Options nosniff always;
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
+    add_header Referrer-Policy strict-origin-when-cross-origin always;
+
+    # Rate limiting
+    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
+
+    location /api/ {
+        limit_req zone=api burst=20 nodelay;
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Request-Id $request_id;
+    }
+
+    location / {
+        root /var/www/app/dist;
+        try_files $uri $uri/ /index.html;
+        gzip on;
+        gzip_types text/plain text/css application/json application/javascript;
+    }
+}
+```

package/extensions/devops/skills/ssl-domain.md

@@ -1,42 +1,42 @@
----
-name: "ssl-domain"
-pack: "@rune/devops"
-description: "SSL certificate management and domain configuration — Let's Encrypt automation, DNS records, CDN setup, redirect rules."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# ssl-domain
-
-SSL certificate management and domain configuration — Let's Encrypt automation, DNS records, CDN setup, redirect rules.
-
-#### Workflow
-
-**Step 1 — Detect current SSL/domain setup**
-Check for existing certificates (`/etc/letsencrypt/`, Cloudflare config), DNS provider configuration, CDN integration (Cloudflare, AWS CloudFront), and redirect rules. Read Nginx/Caddy config for SSL settings.
-
-**Step 2 — Audit SSL configuration**
-Check for: expired or soon-to-expire certificates, TLS version below 1.2, weak cipher suites, missing HSTS header, no auto-renewal configured, mixed content (HTTP resources on HTTPS page), missing www-to-apex redirect (or vice versa).
-
-**Step 3 — Emit SSL automation**
-Emit: certbot installation and auto-renewal cron, DNS record recommendations (A, CNAME, CAA), Cloudflare/CDN integration if applicable, redirect rules for www normalization, and SSL test verification command.
-
-#### Example
-
-```bash
-# Let's Encrypt automation with auto-renewal
-sudo apt install certbot python3-certbot-nginx -y
-sudo certbot --nginx -d example.com -d www.example.com --non-interactive --agree-tos -m admin@example.com
-
-# Verify auto-renewal
-sudo certbot renew --dry-run
-
-# DNS records (for provider dashboard)
-# A     example.com       → 203.0.113.1
-# CNAME www.example.com   → example.com
-# CAA   example.com       → 0 issue "letsencrypt.org"
-
-# Test SSL configuration
-curl -sI https://example.com | grep -i strict-transport
-# Expected: strict-transport-security: max-age=63072000; includeSubDomains
-```
+---
+name: "ssl-domain"
+pack: "@rune/devops"
+description: "SSL certificate management and domain configuration — Let's Encrypt automation, DNS records, CDN setup, redirect rules."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# ssl-domain
+
+SSL certificate management and domain configuration — Let's Encrypt automation, DNS records, CDN setup, redirect rules.
+
+#### Workflow
+
+**Step 1 — Detect current SSL/domain setup**
+Check for existing certificates (`/etc/letsencrypt/`, Cloudflare config), DNS provider configuration, CDN integration (Cloudflare, AWS CloudFront), and redirect rules. Read Nginx/Caddy config for SSL settings.
+
+**Step 2 — Audit SSL configuration**
+Check for: expired or soon-to-expire certificates, TLS version below 1.2, weak cipher suites, missing HSTS header, no auto-renewal configured, mixed content (HTTP resources on HTTPS page), missing www-to-apex redirect (or vice versa).
+
+**Step 3 — Emit SSL automation**
+Emit: certbot installation and auto-renewal cron, DNS record recommendations (A, CNAME, CAA), Cloudflare/CDN integration if applicable, redirect rules for www normalization, and SSL test verification command.
+
+#### Example
+
+```bash
+# Let's Encrypt automation with auto-renewal
+sudo apt install certbot python3-certbot-nginx -y
+sudo certbot --nginx -d example.com -d www.example.com --non-interactive --agree-tos -m admin@example.com
+
+# Verify auto-renewal
+sudo certbot renew --dry-run
+
+# DNS records (for provider dashboard)
+# A     example.com       → 203.0.113.1
+# CNAME www.example.com   → example.com
+# CAA   example.com       → 0 issue "letsencrypt.org"
+
+# Test SSL configuration
+curl -sI https://example.com | grep -i strict-transport
+# Expected: strict-transport-security: max-age=63072000; includeSubDomains
+```