Tags

v0.5.1

rune v0.5.1

- feat: rune audit -- detect content regressions across registries
- docs: rewrite README with multi-registry auth guide
  - Per-registry authentication (token_env, glab/gh auto-detect)
  - Multiple GitLab identity pattern with RUNE_TOKEN_{NAME}
  - Complete command table, lockfile model, upstream imports
- docs: generic examples (no specific registry names in README)

v0.5.0

rune v0.5.0

Per-registry authentication for private skill registries.

Token resolution order (per registry):
1. token_env -- explicit env var in registry config
2. glab auth token -- auto-detect for gitlab.com URLs
3. gh auth token -- auto-detect for github.com URLs
4. No auth -- system credential helpers or public access

This enables registries across different namespaces with separate
PATs. For example, nomograph tools with a personal token and
work-scoped private skills with a fine-grained project token.

Config example:
  [[registry]]
  name = "arcana"
  url = "https://gitlab.com/work-namespace/arcana.git"
  token_env = "RUNE_TOKEN_ARCANA"

Also in this release:
- v0.4.0: lockfile, modified detection, drift direction fix
- v0.4.0: rune status, rune clean, --dry-run, --message, --force
- v0.4.0: colored output, 47 tests
- v0.4.1: CI hardening (deny.toml, pipeline v2.1.0)

v0.4.1

rune v0.4.1

CI hardening -- no functional changes from v0.4.0.

- deny.toml: cargo-deny license allow-list (MIT, Apache-2.0, BSD, ISC, MPL-2.0)
- Pipeline v2.1.0: all images from nomograph container registry, no Docker Hub
- Release page includes tag annotation body + mise/manual install instructions
- audit_allow_failure: false (deny config makes audit pass cleanly)
- Updated yanked fastrand 2.4.0 -> 2.4.1
- Cargo.toml version matches tag (--version reports correctly)

v0.4.0

rune v0.4.0

Architecture:
- Lockfile (.claude/rune.lock): records hash + registry_commit per skill,
  enabling reproducible installs and accurate drift detection
- Modified flag detection: sync compares local hash to lockfile, sets
  pedigree modified=true for imported skills changed locally
- Content-based drift direction replaces unreliable mtime comparison
- File locking (flock) prevents concurrent cache corruption
- Archive etag caching skips redundant tarball downloads
- sync --force required to overwrite locally modified skills
- add/remove update lockfile immediately

New commands and flags:
- rune status: combined summary (registries + project + upstream)
- rune clean: purge stale cache entries for removed registries
- --dry-run global flag on sync/push/update/clean
- --message on push for custom commit messages
- --force on sync to overwrite local modifications

Polish:
- Colored output with isatty detection
- Safer settings.json handling (backup, better errors)
- doctor respects --project flag
- 47 tests (up from 17), clippy clean

v0.3.1

v0.3.0

v0.3.0

v0.2.2

v0.2.2

v0.2.1

v0.2.1

v0.2.0

v0.2.0: directory skills, priority resolution, readonly registries