Open source · v0.1.1

Rune

Name: Rune
Author: Savoir

An AI coding harness, built from scratch.

Your models. Your machine. A coding engine you can inspect and control.

Version: v0.1.1
Released: 16 September 2026
Platforms: macOS · Linux · Windows preview
Licence: Apache-2.0

macOS · Linuxcurl -fsSL https://savoir.services/install.sh | bash

Windowsirm https://savoir.services/install.ps1 | iex

Source Releases Documentation What is verified Privacy

rune · example session

~ $ curl -fsSL https://savoir.services/install.sh | bash

downloading rune v0.1.1 · darwin-arm64

✓ verified against SHA256SUMS

✓ installed to ~/.rune/bin

~ $ rune doctor

sandboxseatbelt · active

models3 routes healthy · 1 local

~ $ rune

› Add a nightly job that reconciles orders and invoices

plan · 1st gear, asks before every action

1read the schema✓ file read

2write the job and test✓ test passed

3schedule it nightly● waiting for your approval

~ $

~ $ curl -fsSL https://savoir.services/install.sh | bash

downloading rune v0.1.1 · darwin-arm64

✓ verified against SHA256SUMS

✓ installed to ~/.rune/bin

~ $ rune doctor

sandboxseatbelt · active

models3 routes healthy · 1 local

~ $ rune

› Add a nightly job that reconciles orders and invoices

plan · 1st gear, asks before every action

1read the schema✓ file read

2write the job and test✓ test passed

3schedule it nightly● waiting for your approval

~ $

Under the surface

Power, with control.

Why we built it

You cannot make an AI system safe from the outside. So we built the whole harness ourselves: the provider gateway, the tool executor, the sandbox, the permission ladder, the session store. The same engineering goes into every system we build for clients.

“Will it act without asking?”: Five permission levels. First gear asks before everything.
“Can we see what it did?”: Every step is logged with its proof and its reason.
“Will it leak our data?”: Commands run in a sandbox. Stored credentials stay unreadable.
“Are we tied to one AI company?”: Thirty-odd providers or local models, with automatic fallback.
“Will the bill run away?”: A spending cap stops the run and hands over cleanly.
“What if it crashes?”: Checkpoints and rewind. Interrupted work resumes where it stopped.

Explore the engine

One engine, four clients: the terminal, rune serve, ACP for editors and headless rune -P. Every feature below is in the same binary.

Multi-provider gateway: Thirty-odd cloud presets and local Ollama from one /login, with fallback, retry and backoff. A quota cap stops the turn and writes a resume handoff first, instead of silently swapping models under you.
Tool suite: read, write, edit, multi-edit, glob, grep, list, bash, symbol search, AST query, web fetch and search, todos, plus task sub-agents for read-only investigation and worker sub-agents for implementation. File and shell tools run through a native Rust executor.
Permissions and sandbox: A five-rung ladder on Shift+Tab: 1st gear asks about everything, 4th is full autonomy, Auto is classifier-reviewed. Beneath it a separate OS sandbox policy, Seatbelt on macOS and bubblewrap on Linux, with credential stores unreadable to tool calls.
The plan ledger: A step closes on a write, a run or a passing check the harness measured, not on the model’s say-so. A step with nothing behind it is shown as unproven, and rune audit prints the whole run: goal, plan with receipts, safety decisions and their reasons, cost.
Sessions and recovery: A SQLite session store, checkpoints and /rewind. A run killed mid-tool resumes with its work, its worker’s work, its contract and its counters intact; orphaned processes die with the engine.
Extensions and surfaces: Hooks, user skills, custom slash commands, plugin bundles and MCP connectors. rune -P "<prompt>" --stream-json for CI, rune serve plus rune attach for a remote engine, rune acp for editors. Telemetry is off by default.

Install

One command per operating system.

The installer downloads the release for your machine, verifies it against the release’s SHA256SUMS, and only then writes to the install directory. A mismatch installs nothing.

01
Run the installer
Downloads rune and rune-tools for your chip to a staging directory, verifies both against SHA256SUMS, then moves them into ~/.rune/bin. Nothing reaches the install directory before verification passes.
zsh
```
curl -fsSL https://savoir.services/install.sh | bash
```
02
Put ~/.rune/bin on your PATH
When piped from curl there is nobody to ask, so the installer prints the exact line and does not edit your shell profile. Add it yourself, or re-run with --path to have it appended for you.
zsh
```
echo 'export PATH="$HOME/.rune/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc
```
Or let the installer write it
zsh
```
curl -fsSL https://savoir.services/install.sh | bash -s -- --path
```
03
Check the install
doctor reports the state of the install and which of your routes are healthy. tools-smoke exercises the native file, search and shell tools.
zsh
```
rune --version
rune doctor
rune tools-smoke
```
04
First run
Type rune with no configuration. /setup chooses a provider and model, adds a key or signs in, and sets search, a spend cap and a sandbox policy, inside the terminal, without editing a file. Free routes are listed first: OpenRouter’s free tier, Google AI Studio, or a local Ollama.
zsh
```
rune
```

01
Run the installer
Downloads rune and rune-tools for your architecture, verifies both against SHA256SUMS, then moves them into ~/.rune/bin. The same script serves Debian, Fedora, Arch, Alpine-with-glibc and WSL2.
bash
```
curl -fsSL https://savoir.services/install.sh | bash
```
02
Put ~/.rune/bin on your PATH
The installer prints the line and leaves your profile alone when piped. Append it to ~/.bashrc, ~/.zshrc or ~/.profile, or re-run with --path.
bash
```
echo 'export PATH="$HOME/.rune/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc
```
fish
bash
```
fish_add_path ~/.rune/bin
```
03
Install the sandbox backend
Rune contains shell commands with bubblewrap. Without it, commands run with path-guard checks only, /status reads NOT ISOLATED, and the shell loses auto-approval in 3rd gear and Auto.
bash
```
sudo apt install bubblewrap        # Debian, Ubuntu
sudo dnf install bubblewrap        # Fedora, RHEL
sudo pacman -S bubblewrap          # Arch
```
04
Check the install
doctor names the sandbox backend it found and the state of each route. If it reports that unprivileged user namespaces are refused, that is the kernel or an AppArmor profile, not Rune; commands still run, uncontained, and Rune says so.
bash
```
rune --version
rune doctor
rune tools-smoke
```
05
First run
Type rune. /setup walks through provider, model, key, search, spend cap and sandbox policy. On a headless box, rune login <provider> --no-browser prints the URL to open elsewhere.
bash
```
rune
```

01
Run the installer in PowerShell
Downloads rune.exe and rune-tools.exe, verifies both against SHA256SUMS, installs them to %LOCALAPPDATA%\Rune\bin, and adds that directory to your user PATH. It prints the PATH change before making it and touches nothing machine-wide.
powershell
```
irm https://savoir.services/install.ps1 | iex
```
02
Open a new terminal
The installer patches the PATH of the session it ran in. Every other shell sees it after a restart.
powershell
```
rune --version
rune doctor
rune tools-smoke
```
03
First run
Type rune. /setup chooses provider, model and key. Free to start: a Google AI Studio key in $env:GOOGLE_API_KEY, or OpenRouter’s free tier.
powershell
```
rune
```
04
With options
The piped form cannot take parameters. Fetch the script, then run it with -Version, -InstallDir, -NoPath or -SkipTools. If the execution policy refuses a downloaded script, bypass it for this process only.
powershell
```
irm https://savoir.services/install.ps1 -OutFile install.ps1
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
.\install.ps1 -Version v0.1.1 -NoPath
```

Requirements

Windows 10 or 11, x64
PowerShell 5.1 or PowerShell 7
Windows Terminal recommended

Notes

Why preview: The release workflow builds the Windows pair, installs it on a fresh Windows runner and runs --version, doctor, tools-smoke and a headless prompt. The author does not use Rune on Windows day to day, and the v0.1.0 notes list it as unsupported. Both statements are true; this label is the honest sum.
No OS sandbox: 1st and 2nd gear behave exactly as elsewhere. 3rd and 4th gear run shell commands without the containment macOS and Linux provide; /status reads NOT ISOLATED and Auto reviews every command. For the sandbox, install under WSL2 with the Linux command.
Architecture: x64 only. The installer refuses ARM64 rather than silently installing an emulated binary. Credentials are stored with DPAPI, per user.

From source

Needs Bun and Rust. install.sh compiles the CLI and the native rune-tools executor into ~/.rune/bin, then runs rune serve --check against the staged binary before promoting it onto your PATH, so a binary that cannot host a session never lands. On Windows, build under WSL2.

bash

git clone https://github.com/ritikkyyadav/Rune.git && cd Rune
./scripts/install.sh
export PATH="$HOME/.rune/bin:$PATH"

After the install

Pin a version: curl -fsSL https://savoir.services/install.sh | RUNE_VERSION=v0.1.1 bash
Relocate: curl -fsSL https://savoir.services/install.sh | RUNE_INSTALL_DIR=/usr/local/bin bash
Check for a release: rune upgrade --check
Upgrade: rune upgrade # download, verify, install; keeps one .backup
Uninstall (macOS, Linux): curl -fsSL https://savoir.services/install.sh | bash -s -- --uninstall
Uninstall (Windows): .\install.ps1 -Uninstall
Verify by hand: curl -fsSLO https://github.com/ritikkyyadav/Rune/releases/latest/download/SHA256SUMS sha256sum -c SHA256SUMS --ignore-missing # shasum -a 256 -c on macOS

Uninstall removes the binaries and the PATH line and nothing else. Sessions, config and credentials stay in ~/.rune until you remove them. Rune looks for a newer release at most once a day and prints one line at startup; nothing is replaced without rune upgrade being typed.

Platforms

Where it runs.

Platform	Architecture	Sandbox	Credentials	Status
macOS	arm64 · x64	Seatbelt (sandbox-exec)	Keychain	Supported
Linux	x64 · arm64	bubblewrap	Secret Service, plaintext fallback	Supported
Windows	x64	None, path guards only	DPAPI	Preview

Each platform ships a rune and rune-tools pair, and the pair is required: file, search and shell tools run through the native executor. Every release publishes SHA256SUMS generated in the same job that built the binaries; both installers refuse a release without it, and refuse a download that does not match it.

Your next move

Let’s make
it work.

Tell us what you have in mind hello@savoir.services

Rune

Power, with control.

One command per operating system.

Run the installer

Put ~/.rune/bin on your PATH

Check the install

First run

Run the installer

Put ~/.rune/bin on your PATH

Install the sandbox backend

Check the install

First run

Run the installer in PowerShell

Open a new terminal

First run

With options

From source

After the install

Where it runs.

Let’s makeit work.

Let’s make
it work.