Rune v1.4.7

Rune v1.4.7

A patch on v1.4.6, and the sixth phase of the reliability plan: long commands keep their work. An
install, a test suite or a build that runs past its timeout is handed over as a background shell
instead of being killed, and background shells have lifetimes.

Install or upgrade

curl -fsSL https://savoir.services/install.sh | bash

An existing install can run rune upgrade.

What changed

• A long command that reaches its timeout keeps its work. A foreground command that ran past
  its timeout used to be killed with its whole process group. One install's record has 30 of them
  between July and October, and most were commands whose run time is the work: npm install six
  times, bun test three, a pip install, a playwright install, an ollama pull, a typecheck.
  An install killed at two minutes leaves a half-written node_modules, and the next attempt
  starts over.

  Installs, test suites, builds, type checks and downloads now start as a background shell. They
  get the same launch decision and the same sandbox as foreground bash, and the call waits as long
  as it did before.

  • If the command finishes in time, the result is the ordinary foreground result.
  • If it is still running, it is not stopped: the result gives the shell id and the output so
    far, the model reads the rest with bash_output, and the result says when a cd inside the
    command does not carry over to the next one.

  Every other command runs exactly as before. A command that starts with sleep is never handed
  over. On Windows, long commands still run in the foreground: a background shell there is
  bash -lc, and Rune has no Windows shell contract yet.

• Background shells have lifetimes. A shell Rune handed over itself is stopped after 30
  minutes. In a headless run (rune -P), where nobody is watching, every background shell is.
  bash_output says when a shell was stopped at its limit rather than by kill_shell, and every
  shell is still reaped when Rune exits.

Checked, and stated

• The hand-over was driven with real make targets through the real bash wrapper:
  • a target that finishes in time gave a foreground result and left no shell behind;
  • a target that outlived a 400 ms timeout was handed over, kept running, and finished, read
    through bash_output;
  • Esc while waiting stopped it.
• The matcher was checked against the commands that timed out in the record, and against ordinary
  ones that must not match (ls, git status, echo npm install, a server started with
  python3 -m http.server).
• 12 deliberate breakages, all caught. These included:
  • a timed-out command killed after all;
  • a finished run leaving its shell behind;
  • a handed-over shell with no lifetime;
  • the unattended default ignored;
  • Esc leaving the command running.
• Suites: unit 7,947 passed and 0 failed; integration 488 and 0; the scripted evaluation 63
  of 63.
• This release was tagged only after CI passed on its own commit: macOS, Linux and Windows.

Known, and stated

• A shell's two streams arrive as one. A handed-over command's output is in stdout, in the
  order it was printed; stderr is empty.
• Only these shapes are handed over. A long command that is none of them (a custom script, a
  server started in the foreground) still stops at its timeout, as before; run_in_background
  is the way to start one.
• No live run has exercised this yet; the live sitting (R8) is where it is measured.

License

Apache-2.0. See LICENSE.

Rune v1.4.6

Rune v1.4.6

A patch on v1.4.5, and the fifth phase of the reliability plan: state you can get back. /rewind
can now put the files back, a long output is saved whole, and a session that cannot save says so.

Install or upgrade

curl -fsSL https://savoir.services/install.sh | bash

An existing install can run rune upgrade.

What changed

• /rewind can put the files back, not only the conversation. Until now it rolled back the
  conversation and left every edit of the rewound turns on disk. Before a turn's first write to a
  file, Rune now keeps what the file held, or that it did not exist.

  Command	What it does
  /rewind	Lists the turns, with how many files each changed
  /rewind <n>	Rewinds the conversation, as before, and says if files changed since
  /rewind <n> code	Puts the files back to how turn n found them
  /rewind <n> both	Both

  A code rewind restores the files the later turns changed and removes the ones they created. What
  is tracked is what Rune's own file tools write: write_file, edit_file, multi_edit,
  apply_patch, and a worker's declared files. A file a shell command changed is not tracked,
  and every code rewind says so. Snapshots are kept for the last 100 turns of a session and for 30
  days, under ~/.rune/file-history, and they survive a resume. A file over 5 MB is noted, not
  copied, and a rewind reports it untouched.

• A long tool output is saved whole. Output over the transcript's 30,000 characters kept its
  head and tail, and the model was told to re-run the command to see the middle: four minutes of
  test suite to read one stack trace. The whole output is now saved under
  <workspace>/.rune/outputs/, and the marker for the missing middle names the file, so the model
  reads it with read_file. The folder ignores itself in git, the search tools skip it, and only
  the newest 50 are kept.

• A full disk no longer stops a session saving in silence. Every transcript write is
  best-effort, so a full disk, a read-only database or an I/O error dropped messages, and a resume
  later found the conversation short. Now the run says "Recent messages may not be saved for
  resume", with the cause and what fixes it. It says this when writes start failing, again at the
  end of every turn while they do, and once more when saving works again.

• Compaction that cannot keep up stops instead of looping. When the context was full again
  within two turns of being compacted, three times running, each compaction was another summary
  call that bought two more turns. The run now ends with a named error and what to change: read
  large files in pages, narrow searches and output, or hand the large output to a sub-agent.

• The sleep check no longer takes a system time change for a sleep. 1.4.4's check measured
  gaps on the wall clock alone, so a moved system time looked like the machine had slept, and the
  next failures were re-sent without counting. In CI on Windows, a test that moved the time made
  later runs in the same process re-send three times. A gap now counts only when the monotonic
  clock agrees. On macOS that clock keeps counting through sleep, so a real sleep is still seen;
  on Linux it pauses in suspend, so a sleep there is not seen, as before 1.4.4.

Checked, and stated

• The rewind was driven through the real engine. A scripted model wrote files through the real
  permission check and the real file tools over two turns:
  • /rewind 2 code gave back turn 1's version and removed the file turn 2 created;
  • /rewind 1 code gave back the original;
  • a write the permission check refused left no snapshot.
• The saving failure was driven against a real SQLite database put into read-only mode.
  A constraint error is not treated as a sick database.
• 17 deliberate breakages, all caught. These included:
  • the latest snapshot used instead of the first;
  • a refused write snapshotted;
  • a conversation rewind keeping snapshots whose turn numbers get reused;
  • no .gitignore beside saved output;
  • a two-turn refill not counted as thrash;
  • a recovered database still reported as failing.
• The time-change defect was reproduced on macOS: a test that moves the system time, run before
  the transport tests in the same process, failed four of them with 1.4.4's check and none with
  this one. A test with a real ticking clock now proves a moved time costs a failure as usual.
• Suites: unit 7,939 passed and 0 failed; integration 488 and 0; the scripted evaluation 63
  of 63.
• This release was tagged only after CI passed on its own commit: macOS, Linux and Windows.

Known, and stated

• Shell changes are not tracked. A sed -i or a script that writes files is outside the
  snapshots; the rewind says so every time.
• A sub-agent's own long output is not saved yet, only the lead's; a sub-agent keeps head and
  tail as before.
• No live run has exercised these yet; the live sitting (R8) is where they are measured.

License

Apache-2.0. See LICENSE.

Rune v1.4.5

Rune v1.4.5

A patch on v1.4.4, and the fourth phase of the reliability plan: what stops a run. A safety block
now stops the action, not the run, and the turn ceiling is the person's to set.

Install or upgrade

curl -fsSL https://savoir.services/install.sh | bash

An existing install can run rune upgrade.

What changed

• A safety block stops the action, not the run. Between 14 September and 14 October Auto mode
  ended three runs. None of them had read anything injected:

  • a pip install --break-system-packages, where the reviewer refused 2 actions in a row;
  • an npx fetch for a video task, where it refused 2 in a row;
  • a recursive delete outside the workspace.

  A run now ends on safety grounds only when a tool result in its session was flagged as likely
  prompt injection. That is evidence the run may no longer be the person's, and it carries to
  later runs of the same session, because the injected text stays in the transcript. Without it:

  • the action is not run, the agent is told why, and the run goes on;
  • an attack shape (exfiltration, a credential in an outbound payload, host destruction) is
    blocked every time, and is never held or offered to anyone to run;
  • after 3 refusals in a row (it was 2) or 20 in a run, the next blocked action is held on the
    end-of-turn list, where you can run exactly it.

  Auto mode still never opens a prompt mid-run. The reviewer's denials still make every later
  review in the run more careful, but suspicion is not evidence. The screen says blocked for an
  action that stopped while the run went on, and run halted only when the run ended.

• The turn ceiling is yours to set. Five runs in that month ended at 80 turns, and one long
  plan collapsed against the ceiling. Now:

  • an interactive session has no turn ceiling, unless you set [reliability] maxTurns, or set
    /config turns to a number (or to 0 or none);
  • a headless run keeps 80 by default;
  • rune -P takes --max-turns <n> (0 for none) and --max-budget-usd <usd>, and a bad value is
    a usage error (exit 2) before anything runs.

  What looks at what the turns actually do all stays: the loop detector, the barren-turn breaker,
  the outage clock and the budget.

Checked, and stated

• Every way a run used to halt has two tests: one where the session read a flagged tool result
  and the run halts, and one where it did not and the run goes on. That covers the supervisor's
  objection, the reviewer's streak, and the broker's attack shapes, at the unit level and through
  the real engine and agent loop together.
• 23 deliberate breakages, all caught. These included:
  • every run treated as captured, and no run treated as captured;
  • a flagged result not counted as evidence, or not carried to the next run;
  • an attack shape held for the person;
  • the limit asking instead of holding;
  • an interactive session keeping its ceiling, or a headless run losing its own;
  • 0 refused by /config.
• A run with no ceiling was driven for 95 turns and ended on its own answer.
• Auto mode's never-asks matrix (3 sandbox modes × 2 machines × 4 reviewer behaviours, every shape
  of action) still records no prompt.
• Suites: unit 7,907 passed and 0 failed; integration 486 and 0; the scripted evaluation 63
  of 63.
• This release was tagged only after CI passed on its own commit: macOS, Linux and Windows.

Known, and stated

• The loop detector and the barren-turn breaker still end a run. The plan had them advisory.
  In an interactive session, ending hands the turn back to you, and you can say "continue". In a
  headless run they are what stops a run repeating itself until its ceiling. Neither has fired
  since 14 September.
• Editor sessions (rune engine-host) keep the default ceiling; only the terminal session
  changed.
• No live run has exercised this yet. The record above is from runs before this release; the
  live sitting (R8) is where it is measured.
• The reviewer already never saw tool output, and plain reads and workspace edits already skipped
  it, with .git, .github, .rune and credential files still reviewed. That half of the plan
  needed no change.

License

Apache-2.0. See LICENSE.

Rune v1.4.4

Rune v1.4.4

A patch on v1.4.3, and the third phase of the reliability plan: the connection to the provider. A
laptop that sleeps no longer ends a run, a response cut partway keeps the tool calls it finished,
and a prompt over the model's window is never sent again unchanged.

Install or upgrade

curl -fsSL https://savoir.services/install.sh | bash

An existing install can run rune upgrade.

What changed

• A laptop that sleeps no longer ends a run. On 12 October the lid closed over a research run
  at 01:21. Every failure that run recorded fell inside the dark wakes that followed: the few
  seconds a closed Mac runs between sleeps, with no network (pmset -g log, read beside Rune's own
  incident record). Each failure spent the run's error budget. The outage clock ran through the
  sleep, so at 01:49, the third dark wake, the run ended provider_lost: "3 consecutive errors,
  600s unanswered". Now:

  • a call cut by a sleep, or started within 30 seconds of a wake, does not count as an error and
    does not run the outage clock;
  • it is sent again only once the machine has been awake for 10 seconds straight, so a closed
    lid's dark wakes are waited through instead of failed in;
  • free re-sends are bounded: 3 per wake and 50 per run, so a clock that misreads cannot keep a
    dead provider's run going;
  • the notice says how long the computer slept, and the incident record says provider.slept.

• A response cut after it finished tool calls keeps them. A stream that failed partway used to
  be re-sent from zero, even when the model had already finished tool calls in it, so a long think
  or a long file was paid for and written twice. Now the run carries out every call the response
  finished, drops the half-sent one and any text after the last finished call, and continues from
  the results. The notice says how many calls were kept. A response that failed before it
  finished any call is re-sent from zero, as before.

• An over-limit prompt is never sent again unchanged. When the provider refused the prompt as
  over the model's window and compacting the conversation could not make it fit, Rune re-sent the
  identical prompt until the error budget ran out. The run then ended provider_lost, blaming a
  provider that was answering. It now ends at once with an error that says what to do: resume in
  a fresh session from the handoff, or use a model with a larger window. In rune -P that is
  max_tokens, exit 4.

Checked, and stated

• The sleep rule was driven through the real agent loop with a probe standing in for the clock:

  • a slept call is re-sent and the run finishes, whether the failure was thrown or reported by
    the stream;
  • a call started 15 seconds after a wake is the sleep's, and one started 45 seconds after is
    not;
  • the re-send waits until the machine has been awake 10 seconds;
  • the bounds hold: 3 per wake, then a failure counts again, and at most 50 per run.

  The clock itself was driven by hand: a late timer is not a sleep, a sleep before a call is not
  the call's, and a wake that just ended is seen before any timer fires.

• The cut was driven through the real gateway and the real loop: only the finished call runs, the
  next request carries its result and never the cut one, and a user's cancel is still a cancel.

• 30 deliberate breakages, all caught. Each of the following turned tests red: no grace after
  a wake, no wait before the re-send (on either failure path), no bound per wake or per run, a cut
  with nothing finished, an unfinished call kept, and an over-limit prompt re-sent.

• Suites: unit 7,885 passed and 0 failed; integration 485 and 0; the scripted evaluation 63
  of 63.

• This release was tagged only after CI passed on its own commit: macOS, Linux and Windows.

Known, and stated

• No live run has slept on this build yet. The dark-wake story is from the record of 12
  October, and the fix was checked against a stand-in clock, not a closed lid. The live sitting
  (R8) includes a run with the lid closed for five minutes.
• The over-limit path has not been seen live. This install's record holds no such refusal; the
  path was found by reading the code.
• Not in this release, and why:
  • one retry ladder (ten attempts, 0.5 s to 32 s, three kinds of 429): the outage deadline
    already bounds the total wait, and changing retry counts without live measurements risks
    longer hangs;
  • a response cut after text alone is still re-sent from zero, and a stall gets no per-phase
    rule; continuing from half an answer needs the live sitting to judge;
  • shrinking max_tokens on an over-limit refusal: reading each provider's wording for the
    input and output split is provider-specific.

License

Apache-2.0. See LICENSE.

Rune v1.4.3

Rune v1.4.3

A patch on v1.4.2, and the second phase of the reliability plan: a run says how it ended. The exit
code now reports execution, and a provider's usage cap is reported as a pause with a reset time,
not as a lost provider.

Install or upgrade

curl -fsSL https://savoir.services/install.sh | bash

An existing install can run rune upgrade.

What changed

• The exit code of rune -P says how the run ended.

  Code	Meaning
  0	finished: the model ended its turn
  1	failed: an error, a stall, a stopped loop, open planned steps, a safety halt
  3	needed permission and had nobody to ask
  4	stopped at a limit: turns, output tokens or budget
  5	the provider could not go on: a usage cap, or lost after the retries
  130	cancelled
  129, 130, 143	a signal's own code, which wins over everything above

  Whether the task was met is still the envelope's to say: ok, verdict and shortfall, which
  mean what they meant before. Until this release a finished run whose own verdict was partial
  or unmet exited 1, the same code as a crash, and every live run in the October sittings did
  that on work that passed every hidden check. If a script relied on that exit 1, pass
  --strict-verdict, which keeps the old rule. The envelope also gains subtype (success,
  error_max_turns, error_quota, error_provider, …). rune --help now lists the headless flags,
  and docs/ci.md has a table of every way a run ends and what to do about each.

• A usage cap is named as one. Until now a plan or usage cap ended a run as provider_lost.
  In one install's record, 39 of the 44 runs that ended that way had hit a Codex limit with a known
  reset. The gateway already knew the difference; the run now keeps it:

  • the run ends quota_wall, and the reset is carried as resumeAt;
  • the closing row reads "paused at the provider's usage limit -- it resets at HH:MM" instead of
    "stopped on an error";
  • the TUI's auto-resume and --resume-until wait for that exact time.

  A refusal that is not a cap still ends provider_lost.

Checked, and stated

• The cap path was driven through the real agent loop with a gateway sending exactly what the
  real one sends (usage_cap and resetAt): it ends quota_wall with the reset, hands off as a
  quota wall before the error, and still stops on the first capped turn without waiting.
• Every ending has a test for its exit code and subtype, and six deliberate breakages each turned
  tests red: a cap not treated as a wall, the cap's code dropped again, a quota exit of 0, the
  strict rule ignored, the reset ignored on resume, and the pause row removed.
• Suites: unit 7,844 passed and 0 failed; integration 485 and 0; the scripted evaluation 63
  of 63.
• This release was tagged only after CI passed on its own commit: macOS, Linux and Windows.

Known, and stated

• The verdict itself is unchanged. A finished run can still report its work as partial
  when it could not show terms it wrote for itself. That no longer makes the run exit 1; making
  the verdict reach met when the evidence is there is separate work.
• A run stopped with its own planned steps open still exits 1 (error_open_steps). That is
  the loop ending the run, not a verdict.
• No live run has hit a quota wall on this build yet. The ending was checked with the gateway's
  real event shape, not against a live Codex cap.

License

Apache-2.0. See LICENSE.

Rune v1.4.2

Rune v1.4.2

The first release of the 1.4 line. It carries two pieces of work: runs that cost less and wait
less, measured against OpenCode on 14 October, and the first phase of a reliability plan, in which
Rune's file tools stop changing what they were not asked to change. The rest of that plan ships in
this line, one phase per patch: 1.4.3, 1.4.4 and on. There was no 1.4.0 or 1.4.1.

Install or upgrade

curl -fsSL https://savoir.services/install.sh | bash

An existing install can run rune upgrade.

What changed

Files

• An edit no longer changes what it was not asked to change. Until this release:

  • every file edit_file or write_file wrote was left at mode 600, so an edited script lost
    its executable bit and git showed a mode change;
  • one byte that was not UTF-8 was rewritten as U+FFFD;
  • a CRLF file came back with mixed line endings;
  • an edit whose old text had the wrong indentation was applied anyway, to a Python file that
    then failed to parse, and was reported as a success.

  Now a write keeps the file's permissions, line endings and byte-order mark. A file that is not
  UTF-8 is refused with nothing written, and read_file says so before an edit is tried.
  write_file writes through a symlink instead of replacing it. The same rules hold in
  multi_edit and apply_patch.

• Edits match exactly, and a miss says what nearly matched. The whitespace- and
  indentation-insensitive fallbacks are gone; they had matched 3 of 1,448 recorded edits. A miss
  names the lines that would have matched and what differs, so the next attempt can be right.
  Line endings are the one conversion: old text written with LF still matches a CRLF file.

• An edit to a file that changed since it was read goes through when it still fits. That is,
  when the text being replaced is still there exactly once. The result says the file changed.
  multi_edit now needs the file read first, as edit_file always has.

Cost and time

• The end-of-turn check no longer inherits Rune's own state. For a project whose tests read
  Rune's environment (Rune's own repository is one), the check ran against the live session and
  was killed at its 120 s limit. On the recorded tree it now takes 62 s and passes.
• A check the run already watched pass is not run again while the tree is byte-for-byte the
  same. [verify] reuse = false turns it off.
• A check that cannot finish stops being waited for. For a bun test suite, the test files
  the change wrote are run in its place.
• On Codex, the second request of a run is cached again. It read 0 cached tokens; it now
  reads 10,368 of a 10.7k prompt. On hosts that cache, the system prompt also stays the same for
  the whole request.
• The background safety screen runs on the session's model. Auto mode also no longer takes
  the name of a service in a script for a command that runs it. Replayed over three recorded
  runs, the reviewer's cost went from $0.568 to about $0.08, and the safety corpus still blocks
  and allows exactly what it did.
• With no browser, Rune no longer asks for a review that cannot see the page. A headless run
  with nobody to ask is also no longer told to ask, to research or to read back.
• A headless result says why its verdict is short of met (shortfall).
  [llm] effortRouting = "task" is available and off by default.

The full list is in CHANGELOG.md.

Checked, and stated

• The file tools. Six same-input probes
  (edit-probes.sh) fail six of
  six against 1.3.4's tools and pass six of six against 1.4.2's. A table of cases runs against
  both the Rust tools and the TypeScript ones: it fails 15 of 19 on the old binary and passes 19
  of 19 on this one. Eight deliberate breakages of the new rules each turned at least one case
  red. Claude Code's own Edit and Write, given the same six inputs, refuse or keep the file intact
  in the same way.

• Cost and time, live. Six runs on 14 October, Rune against OpenCode on the same model
  (gpt-6-sol on the Codex subscription):

  • small task: Rune took 22 s and 4 model calls ($0.046); OpenCode's two runs took 34 s and 46 s
    ($0.061 and $0.083);
  • hard task: Rune took 313 s ($0.649) and OpenCode 368 s ($0.654), and both passed all 15
    hidden checks.

  Two tasks are not a score.

• Suites: unit 7,822 passed and 0 failed; integration 485 and 0; the scripted evaluation 63
  of 63.

• This release was tagged only after CI passed on its own commit: macOS, Linux and Windows.

Known, and stated

• Rune still calls finished work unfinished. Every live run in the 14 October sitting ended
  "partial" or "unmet" with exit 1, on work that passed every hidden check. shortfall says which kind, and
  the exit code is unchanged. Making the exit code say how a run ended is a later 1.4 patch.
• A quota wall is reported as provider_lost. Of 163 recorded runs since 14 September, 44
  ended provider_lost, and 39 of those had hit a Codex usage limit rather than lost the
  provider. They are to be named separately in a later 1.4 patch.
• apply_patch never recorded how its hunks matched before this release. How often its old
  fallbacks were used is unknown; it reports how each hunk matched now.
• The file-tool changes were checked by tests and probes, not in a live run.
  effortRouting = "task" has not been measured for the quality of the work.
• A check still runs outside the sandbox. Only Rune's own variables are removed from its
  environment.

License

Apache-2.0. See LICENSE.

Rune v1.3.4

Rune v1.3.4

A patch on v1.3.3. It fixes a rule that 1.3.2 introduced and that did not work in an ordinary
terminal.

Install or upgrade

curl -fsSL https://savoir.services/install.sh | bash

An existing install can run rune upgrade.

What changed

• A test that was already failing is left alone, in a real project's suite. When a check goes
  red, Rune compares the failing tests with the tree the run started from, and a failure that was
  already there is reported and not handed to the agent. Since 1.3.2 that did not happen for a Bun
  suite of more than about twenty tests, in a terminal or inside GitHub Actions. Bun closes such a
  run by listing its failures a second time; Rune read that list as more failures, found more of
  them than the totals gave, and refused to compare. The agent was then asked to repair tests it
  had never touched. In one measured run it did so by rewriting the project's own test script.
  If you run Rune on a Bun project, upgrade.

• When Rune cannot tell whether a failure was already there, it says why. The reason was
  worked out and thrown away. It is now in the notice you see, on the verification_completed
  event as attributionUnknown, and in the saved task state.

• A run that ends before its background reviewer answers says so. In Auto mode ordinary
  actions run at once and a reviewer reads them in the background. rune -P exits when its work
  is done and does not wait for that reviewer, so an action still waiting was never answered for,
  and its audit row went on saying it was allowed under supervision. Rune now writes a row for
  each such action when it closes. Exit takes no longer and no reviewer is called. rune doctor
  and rune audit print how many actions ran with no background review; that count had been
  taken and never shown.

• rune upgrade over a source install no longer leaves Rune telling you to rebuild.

The full list is in CHANGELOG.md.

Checked, and stated

• How the first fault was found. A live run from 2026-10-07 was replayed through a real
  rune -P process, with a scripted model in place of a provider. Before the fix the replay was
  asked for a repair, and gave the reason "something failed that the report does not name as a
  test". After it, the two failing tests are named as already failing, no repair is asked for,
  and the project's files are left as they were.
• Why no test had caught it. Bun prints a shorter report, with no closing list, when it thinks
  an agent is reading. The tests for this rule ran in such a shell, on two test files. There are
  now two more: Bun's closing list word for word, and thirty real test files read through the
  report a terminal gets.
• A first comparison on hard tasks, made on 1.3.3. Three tasks drawn from Rune's own history,
  Rune against OpenCode on the same model. Both passed every hidden check with no regression.
  Rune made fewer model calls on all three at about the same list cost, and took longer on two.
  Three pairs is half of what a score needs, so there is no score.
• This release was tagged only after CI passed on its own commit: macOS, Linux and Windows.

Known, and stated

• Rune can call finished work unfinished. In that comparison all three runs passed everything
  and ended with Rune's own verdict saying "unmet" or "partial". With no criteria stated for a
  task, "unmet" is what the verdict is built to say; it reads as a failure, and it is not one.
  Not changed in 1.3.4.
• The check at the end of a turn gives up after 120 seconds. On a project whose suite takes
  longer it waits the full time and measures nothing. Seen on two of the three runs. Not changed
  in 1.3.4.
• A background review that fails — the reviewer cannot be reached, times out, or gives an
  answer that cannot be read — still leaves no audit row.
• The "already failing" rule reads Bun's test report only. Under another test runner the answer
  is "unknown", and the failure is handed to the agent as before.
• On Windows, Rune cannot yet rebuild the tree a run started from when the project has installed
  dependencies or other git-ignored files to carry over. It says the answer is unknown there.
• The fixes in this release were checked by replay and by test. None was measured in a live run.

License

Apache-2.0. See LICENSE.

Rune v1.3.3

Rune v1.3.3

A patch on v1.3.2. One fix to Rune, and the first release whose tests ran on Linux and Windows
before it shipped.

Install or upgrade

curl -fsSL https://savoir.services/install.sh | bash

An existing install can run rune upgrade.

What changed

• A failing test in a file the run edited is the run's, in GitHub Actions and on Windows too.
  When a check goes red, Rune separates a failure that was already there from one the run made,
  and a test in a file the run changed always counts as the run's. In two places that last rule
  did not hold. Inside GitHub Actions and on Windows, Rune misread the test file's name in Bun's
  report, so the name matched no changed file. A failing test the run had edited was called
  "already failing", and when it was the only failure Rune asked for no repair. The check was
  still reported red. If you run Rune in a workflow or on Windows, upgrade.

Nothing else in Rune changed. The full list is in CHANGELOG.md.

Checked, and stated

• The tests now run on all three systems. CI had failed on every run on record since late
  September, and 1.3.2's new tests had only ever run on a Mac. Thirty-nine of them failed on Linux
  or Windows: eight because of the fault above, the rest because of assumptions in the tests — /
  in paths, a #! script, LF line endings, a rune-tools on the path, a Chromium in the home
  folder.
• Four tests depended on the clock, and each failed once on a CI runner: a delete that did not
  delete, a count that batching changes, and two five-second limits around real builds. Each was
  fixed at its cause, and every test now has thirty seconds unless it sets its own limit.
• This release was tagged only after CI passed on its own commit: macOS, Linux and Windows.

Known, and stated

• A headless run does not wait for its background reviewer. In Auto mode, ordinary actions
  run and are reviewed in the background. rune -P exits when the run is done, so an action still
  waiting for that review is never read, and its audit row still says "allowed under
  supervision". With a reviewer scripted to take 400 ms, a script of five quick commands had one
  shown to the reviewer. An interactive session stays up and hears the verdict. The mechanical
  checks run on every action either way. This is not changed in 1.3.3.
• On Windows, Rune cannot yet rebuild the tree a run started from when the project has installed
  dependencies or other git-ignored files to carry over. It says the answer is unknown there; it
  does not guess.
• Nothing was measured in a live run for this release. The standing against OpenCode, and the
  list of unverified changes, are as stated for
  v1.3.2.

License

Apache-2.0. See LICENSE.

Rune v1.3.2

Rune v1.3.2

A patch on v1.3.1. Rune's own checks stop leaving build files in your repository and stop calling
a slow test suite a failed one. Sub-agents can be opened and watched. A run that is killed, or
whose provider goes quiet, ends cleanly and can be resumed.

Install or upgrade

curl -fsSL https://savoir.services/install.sh | bash

An existing install can run rune upgrade.

What changed

• Rune's checks leave your tree as they found it. After a turn, Rune runs the project's own
  checks. In a turbo workspace typecheck builds every package, and one run left 129 git-ignored
  files behind. When a pass of checks Rune chose ends, the git-ignored paths it created are
  removed. A folder that was already there keeps what the check put in it; a new file git does not
  ignore is left for you to see; node_modules, virtualenvs, .env* and editor folders are never
  taken; a command you wrote in [verify] commands keeps what it builds. To turn it off, set
  [verify] keepGenerated = true.
• A check that ran out of time is not a failed check. Verification is now passed, failed or
  inconclusive. A timeout, a cancel or a missing toolchain no longer sends Rune to "repair" working
  code. A project's own test script is what runs, a test that was already failing is named and
  left alone, and a TypeScript change no longer runs the Rust checks beside it.
• Sub-agents can be opened and watched. With the composer empty, the right arrow steps onto the
  agent blocks on the working row and enter opens that agent's transcript, live. Finished agents
  stay readable, including after a restart.
• The working row shows what the turn is doing. One mark, struck by the run's own output, with
  the stage, the current action and the step. The tab's working mark is a pill paced by the work.
• A run stops cleanly. kill, a closed terminal or a shutdown now stops the commands Rune
  started, records the run as interrupted and exits with the signal's code; the next run of that
  session continues it. A provider that stops answering ends the run after ten minutes with the
  work kept. A provider cap waits until the moment the provider named.
• bun add works in the sandbox. Once a call has network, an install no longer fails with
  "unable to write files to tempdir". Bun's cache is kept inside the project.
• The Auto-mode reviewer has thirty seconds, not twelve. Its ordinary latency was within a
  second of its old limit, so a slow provider meant a refused command.
• A headless run's exit code follows its verdict. rune -P exits 1, with ok: false in the
  JSON envelope, when a change did not meet the terms it was held to: the run stated what done
  means and changed files, or was held to an --acceptance check, and the verdict is partial or
  unmet. A greeting, a question and a review that changes nothing are judged by whether they
  ran, as before.
• The instructions sent with every request are about a third shorter. 7,807 tokens to 5,402.
• Signing in with a Claude Pro or Max plan is removed. Anthropic's terms do not permit it.
  Claude models still work with an API key, through Bedrock and through Vertex.

The full list is in CHANGELOG.md.

Measured, and stated

This release was measured against OpenCode on one model (gpt-6-sol), with the same tasks and the
same graders. The record is in docs/program/rune-parity-progress-ledger.md.

• Small and medium tasks: a tie on correctness. Eighteen pairs over nine tasks; both tools
  finished all eighteen, cleanly. Rune was slightly faster and cost about 1.56 times as much at
  list price. That sitting ran before the changes listed as unverified below, the shorter
  instructions among them.
• One hard task: lost twice. Rune passed every hidden check and broke one existing behaviour,
  the same one both times. The other tool did not.
• Not measured: frontend, review and long-context tasks, and hard tasks beyond that one.

Unverified, and stated

• These changes passed their tests and have not been measured in a live run: the shorter
  instructions, the exit code that follows the verdict, the reviewer's longer deadline, the
  read-back's wording, bun add in the sandbox, and the session cache key.
• A run that states what done means, changes files and proves only part of it now exits 1. That
  is the intent, and it is strict: a script that treated any finished run as success will see
  failures it did not see before.
• The removal of generated files cannot tell a check's output from something else that first
  wrote a git-ignored path in the same seconds — a watcher the run started, or a second agent in
  the same folder. keepGenerated is the switch.
• Each later check in a session rebuilds what the earlier one built and removed: about four
  seconds on Rune's own repository.
• Rune's end-of-turn check still runs a project's whole test script under a 120-second limit. On
  a large suite it measures nothing and costs two minutes.
• The new tests ran on macOS. The Linux and Windows jobs are CI's to run.

Everything else is as in v1.3.1.

License

Apache-2.0. See LICENSE.

Rune v1.3.1

Rune v1.3.1

A patch on v1.3.0. On macOS, the keychain dialog that appeared every time Rune started is gone.
And the model lists catch up with what the vendors have shipped, including models released
after this version.

Install or upgrade

curl -fsSL https://savoir.services/install.sh | bash

An existing install can run rune upgrade.

What changed

• No more login-password prompt on every launch. macOS kept asking: "security wants to use
  your confidential information stored in "rune"". The item was the key Rune signs its memory
  with. It had been stored with an access list that locked out every program, Rune included,
  so every read asked for your password. That is true of every release from v0.1.0 to v1.3.0.
  A failed read also made it worse: it was never remembered, so the next check asked again, and
  a refused read could replace the real key with a new one. The key now moves to a new keychain
  item, "Rune memory key", with the default access list. The move needs the old item read one
  last time, so the first launch after upgrading shows a one-line notice, then the dialog once.
  After that, never again.
• The latest models. GPT-6 Sol and GPT-6 Luna, released 2026-09-22, join GPT-6 Astra on
  Codex and become its standard and light tiers. Claude Opus 5.5 is the new Anthropic default.
  xAI's grok-4.7 is added. OpenRouter gains Qwen3.8 27B as a free model, and GLM-5.2's free
  listing is removed. The prices are the vendors' published rates as of 2026-09-28.
• /model shows what your account can use, not only what this version knew. For a signed-in
  account, Rune now reads the provider's own model list and merges it into the built-in one.
  That covers the Codex catalogue and the OpenAI API's list. A model released after v1.3.1 still
  appears. Built-in entries are never dropped, dated snapshot ids fold into their names, and
  non-text models (speech, images, live audio) are left out. rune models codex --refresh shows
  what your account's list contains.
• The cost column had astra at an eighth of its price. GPT-6 Astra carried an estimated
  $1.25 in and $10 out per million tokens; its published rate is $10 and $50. Sessions on astra
  now show their real metered-equivalent cost. On a Codex plan the marginal cost is still zero;
  the column answers "what would this have cost on the API".

Unverified, and stated

• The keychain fix's tests never touch a real keychain, by design. Its live check is the first
  launch after upgrading: one notice, one dialog, then none. A dialog that still appears later
  and names "rune" rather than "Rune memory key" is a provider's stored key, which is a
  different item.
• Live model discovery has not yet been run against real Codex and OpenAI accounts.
• Codex filters its catalogue by client version. Rune asks as the newest published Codex CLI,
  looked up once per launch with a 1.5-second limit, and falls back to a built-in version when
  the lookup fails.

Everything else is as in v1.3.0.

License

Apache-2.0. See LICENSE.