$npx -y skills add Rune-kit/rune --skill sentinel-envEnvironment-aware pre-flight check. Use when starting work in a new environment, switching machines, or when 'works on my machine' bugs surface. Validates OS, runtime versions, installed tools, port availability, env vars, and disk space BEFORE coding starts. Like sentinel but fo
| 1 | # sentinel-env |
| 2 | |
| 3 | ## Purpose |
| 4 | |
| 5 | Catch environment mismatches before they waste debugging time. Validates that the developer's machine has the right runtime versions, tools, ports, and configuration to run the project. Prevents the entire class of "works on my machine" failures that masquerade as code bugs. |
| 6 | |
| 7 | This is the environment counterpart to `sentinel` (which checks code security) and `preflight` (which checks code quality). sentinel-env checks the MACHINE, not the code. |
| 8 | |
| 9 | ## Triggers |
| 10 | |
| 11 | - Called by `cook` Phase 0.5 — before planning, after resume check (first run in a new project only) |
| 12 | - Called by `scaffold` — after project bootstrap, verify environment matches generated config |
| 13 | - Called by `onboard` — during project onboarding, verify developer can run the project |
| 14 | - `/rune env-check` — manual environment validation |
| 15 | - Auto-trigger: when `npm install`, `pip install`, or similar fails during cook |
| 16 | |
| 17 | ## Calls (outbound) |
| 18 | |
| 19 | None — sentinel-env never calls another Rune skill and never modifies the developer's machine/environment (no install/update). In `--agents` mode it writes ONE Rune-owned advisory cache file, `.rune/runtimes.json` (a Rune state file, not the dev's environment — same category as the files `journal`/`session-bridge`/`council` write). |
| 20 | |
| 21 | ## Called By (inbound) |
| 22 | |
| 23 | - `cook` (L1): Phase 0.5 — first run detection (no `.rune/` directory exists) |
| 24 | - `scaffold` (L1): post-bootstrap environment validation |
| 25 | - `onboard` (L2): developer onboarding verification |
| 26 | - User: `/rune env-check` direct invocation |
| 27 | - User: `/rune env-check --agents` — also run AI-Agent Fleet Detection (Step 6.6) |
| 28 | |
| 29 | ## Data Flow |
| 30 | |
| 31 | ### Feeds Into → |
| 32 | |
| 33 | - `council` (L3): `.rune/runtimes.json` — when `--agents` mode ran during env pre-flight, it PRE-WARMS council's Step 1 DETECT cache (council reuses a same-session cache instead of re-probing the bridge). Schema + model-family map are OWNED by `skills/council/references/dispatch-protocol.md` §Detect — sentinel-env writes that exact shape, it does not define its own. |
| 34 | |
| 35 | ## Execution |
| 36 | |
| 37 | ### Step 1: Detect Project Type |
| 38 | |
| 39 | Read project configuration files to determine what environment is needed: |
| 40 | |
| 41 | 1. Use `Glob` to check for project config files: |
| 42 | - `package.json` → Node.js project |
| 43 | - `pyproject.toml` / `setup.py` / `requirements.txt` → Python project |
| 44 | - `Cargo.toml` → Rust project |
| 45 | - `go.mod` → Go project |
| 46 | - `Gemfile` → Ruby project |
| 47 | - `docker-compose.yml` / `Dockerfile` → Docker project |
| 48 | - `.nvmrc` / `.node-version` → specific Node version required |
| 49 | - `.python-version` → specific Python version required |
| 50 | |
| 51 | 2. Read each detected config file to extract version constraints: |
| 52 | - `package.json` → `engines.node`, `engines.npm`, dependency versions |
| 53 | - `pyproject.toml` → `requires-python`, dependency versions |
| 54 | - `Cargo.toml` → `rust-version` |
| 55 | - `go.mod` → `go` directive version |
| 56 | |
| 57 | 3. Build an environment requirements checklist from the detected configs. |
| 58 | |
| 59 | ### Step 2: Runtime Version Check |
| 60 | |
| 61 | For each detected runtime, verify the installed version matches constraints: |
| 62 | |
| 63 | ```bash |
| 64 | # Node.js |
| 65 | node --version # Compare against package.json engines.node or .nvmrc |
| 66 | npm --version # Compare against package.json engines.npm |
| 67 | # or pnpm/yarn/bun depending on lockfile present |
| 68 | |
| 69 | # Python |
| 70 | python --version # Compare against pyproject.toml requires-python |
| 71 | pip --version |
| 72 | |
| 73 | # Rust |
| 74 | rustc --version # Compare against Cargo.toml rust-version |
| 75 | cargo --version |
| 76 | |
| 77 | # Go |
| 78 | go version # Compare against go.mod go directive |
| 79 | |
| 80 | # Docker |
| 81 | docker --version |
| 82 | docker compose version |
| 83 | ``` |
| 84 | |
| 85 | **Version comparison logic:** |
| 86 | - If the constraint is `>=18.0.0` and installed is `20.11.1` → PASS |
| 87 | - If the constraint is `>=18.0.0` and installed is `16.20.2` → BLOCK (wrong major version) |
| 88 | - If the runtime is not installed at all → BLOCK |
| 89 | - If no version constraint exists in config → WARN (version unconstrained) |
| 90 | |
| 91 | ### Step 3: Required Tools Check |
| 92 | |
| 93 | Detect and verify tools the project depends on: |
| 94 | |
| 95 | 1. **Package manager**: Check which lockfile exists and verify the matching tool is installed |
| 96 | - `package-lock.json` → npm |
| 97 | - `pnpm-lock.yaml` → pnpm |
| 98 | - `yarn.lock` → yarn |
| 99 | - `bun.lockb` → bun |
| 100 | - `poetry.lock` → poetry |
| 101 | - `uv.lock` → uv |
| 102 | - Mismatched lockfile + installed tool → WARN (e.g., yarn.lock exists but only npm installed) |
| 103 | |
| 104 | 2. **Git**: `git --version` — required for all projects |
| 105 | 3. **Docker**: Check only if `Dockerfile` or `docker-compose.yml` exists |
| 106 | 4. **Database tools**: Check if `prisma`, `drizzle`, `alembic`, `django` migrations exist → verify DB client installed |
| 107 | 5. * |