@claude-flow/cli 3.25.5 → 3.26.0

package/.claude/.proven-config-version

@@ -0,0 +1 @@
+sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.23.0
+3.25.6

package/.claude/helpers/helpers.manifest.json

@@ -1,12 +1,13 @@
 {
   "manifest": {
-    "version": "3.25.4",
+    "version": "3.26.0",
     "files": {
       "auto-memory-hook.mjs": "68be7e9a9eba7bf9c4e8a230db7bf61a243b965639f8504842799d6c6ca28762",
-      "hook-handler.cjs": "bc4d2d26823d49b3ab1dded2946b66369f1f67bd76b4c30dca9f3b6df3cca8f0",
-      "intelligence.cjs": "bd1f8e4b034944aee1df0391dc47ac2e8cc4b3aa542c65407a59d49620bbf76b"
+      "hook-handler.cjs": "2a18a761f0dc4839df8b6eeadf8f0ceb6badcc5bf14414c91555711a5e9d4bdc",
+      "intelligence.cjs": "bd1f8e4b034944aee1df0391dc47ac2e8cc4b3aa542c65407a59d49620bbf76b",
+      "statusline.cjs": "ac6be4ed31b30cef7b325c15d0feb77f3a8a26a69f7186907ba0340d332f2d05"
     }
   },
-  "signature": "F3TIRoNcQTCkNeMEk5Isah5CWkV/zddUKR/6pieOlAWoYgI2BEUO7avQj8B8UP4vhvgT9TSgbYsis2UnnnQyBg==",
+  "signature": "htvyWBS+UYspE4SIyoVj+S4HdaJymRlQGYQSMSP5PCang0CelajiGJKyaY3c0vzBUn7DAMxbXDl9jLlSe+j/DA==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/hook-handler.cjs

@@ -15,9 +15,79 @@
 
 const path = require('path');
 const fs = require('fs');
+const os = require('os');
 
 const helpersDir = __dirname;
 
+// Resolve an installed @claude-flow/cli (or ruflo) bin — mirrors
+// statusline-generator.ts's resolveCliBin() candidate list. Used only to
+// spawn the detached funnel-refresh helper below; failures are silent (no
+// candidate found just means the refresh never fires this session).
+function resolveCliBinForHook() {
+  try {
+    const home = os.homedir();
+    const cwd = process.cwd();
+    const candidates = [
+      path.join(home, '.claude', 'plugins', 'marketplaces', 'ruflo', 'bin', 'cli.js'),
+      path.join(cwd, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js'),
+      path.join(cwd, 'node_modules', 'ruflo', 'bin', 'cli.js'),
+      path.join(cwd, 'v3', '@claude-flow', 'cli', 'bin', 'cli.js'),
+      // helpersDir is .claude/helpers/ inside the package itself when this
+      // file is running from a real @claude-flow/cli install (not a project
+      // that merely copied the helper) — its bin/ is two levels up.
+      path.join(helpersDir, '..', '..', 'bin', 'cli.js'),
+    ];
+    for (const p of candidates) {
+      if (fs.existsSync(p)) return p;
+    }
+  } catch (e) { /* ignore */ }
+  return null;
+}
+
+// Fire-and-forget doesn't work when the CALLER is itself a short-lived
+// subprocess (confirmed live: two consecutive statusline renders 5s apart
+// both saw an empty funnel-messages-cache, because the async HTTPS fetch
+// inside a `void refreshRemoteMessages()` call gets killed when the spawning
+// process exits before the request completes). Spawning fully DETACHED +
+// unref'd decouples the refresh's lifetime from this hook's — it keeps
+// running (up to message-transport.ts's own 4s fetch timeout) even after
+// session-restore's own process has already exited, so it actually gets a
+// chance to write the cache. Never awaited here — must not add to
+// SessionStart's own timeout budget.
+function spawnDetachedFunnelRefresh() {
+  try {
+    const cliBin = resolveCliBinForHook();
+    if (!cliBin) return;
+    const { spawn } = require('child_process');
+    const child = spawn(process.execPath, [cliBin, 'hooks', 'refresh-funnel', '--quiet'], {
+      detached: true,
+      stdio: 'ignore',
+      env: process.env,
+    });
+    child.unref();
+  } catch (e) { /* best-effort only */ }
+}
+
+// Same detached/unref'd pattern as spawnDetachedFunnelRefresh() above, for
+// ADR-316's co-pilot advisor tip. Safe to call on EVERY session-restore:
+// refresh-advisor's own action checks consent + a 24h TTL BEFORE spending
+// anything, so an unconsented or already-fresh install is a fast no-op file
+// read, never a network call. Never awaited here — must not add to
+// SessionStart's own timeout budget.
+function spawnDetachedAdvisorRefresh() {
+  try {
+    const cliBin = resolveCliBinForHook();
+    if (!cliBin) return;
+    const { spawn } = require('child_process');
+    const child = spawn(process.execPath, [cliBin, 'hooks', 'refresh-advisor', '--quiet'], {
+      detached: true,
+      stdio: 'ignore',
+      env: process.env,
+    });
+    child.unref();
+  } catch (e) { /* best-effort only */ }
+}
+
 // Safe require with stdout suppression - the helper modules have CLI
 // sections that run unconditionally on require(), so we mute console
 // during the require to prevent noisy output.
@@ -168,6 +238,57 @@ const handlers = {
     } else {
       console.log('[INFO] Router not available, using default routing');
     }
+
+    // Rate-limit -> sponsored-capacity nudge (ADR-312/313). Fires here,
+    // client-side, BEFORE the API call this prompt would make — so it still
+    // reaches the transcript even if that call then fails from the rate
+    // limit. Cheap local file reads only; never a network call or a child
+    // process, so it cannot add latency to prompt submission.
+    try {
+      const rlFunnelEnv = process.env.RUFLO_FUNNEL;
+      const rlDisabledByEnv = rlFunnelEnv !== undefined && /^(0|false|off|no)$/i.test(String(rlFunnelEnv).trim());
+      const rlCiVars = ['CI', 'GITHUB_ACTIONS', 'GITLAB_CI', 'CIRCLECI', 'TRAVIS', 'BUILDKITE', 'JENKINS_URL', 'TEAMCITY_VERSION', 'TF_BUILD'];
+      const rlIsCi = rlCiVars.some((v) => {
+        const val = process.env[v];
+        return val !== undefined && val !== '' && val !== '0' && String(val).toLowerCase() !== 'false';
+      });
+      const rlHome = path.join(os.homedir(), '.ruflo');
+      let rlUserDisabled = false;
+      try {
+        const rlUserCfg = JSON.parse(fs.readFileSync(path.join(rlHome, 'funnel.json'), 'utf8'));
+        rlUserDisabled = !!(rlUserCfg && rlUserCfg.enabled === false);
+      } catch (e) { /* absent/malformed = not disabled */ }
+      let rlProjectDisabled = false;
+      try {
+        const rlProjCfg = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'claude-flow.config.json'), 'utf8'));
+        rlProjectDisabled = !!(rlProjCfg && rlProjCfg.funnel && rlProjCfg.funnel.enabled === false);
+      } catch (e) { /* absent/malformed = not disabled */ }
+
+      if (!rlDisabledByEnv && !rlIsCi && !rlUserDisabled && !rlProjectDisabled) {
+        let rlStatus = null;
+        try { rlStatus = JSON.parse(fs.readFileSync(path.join(rlHome, 'rate-limit-status.json'), 'utf8')); } catch (e) { /* not flagged */ }
+        let rlIsLimited = false;
+        if (rlStatus && rlStatus.limited) {
+          if (rlStatus.since) {
+            const rlSinceMs = Date.parse(rlStatus.since);
+            rlIsLimited = isNaN(rlSinceMs) ? true : (Date.now() - rlSinceMs) < 6 * 60 * 60 * 1000;
+          } else {
+            rlIsLimited = true;
+          }
+        }
+        if (rlIsLimited) {
+          let rlConsented = false;
+          try {
+            const rlConsentFile = JSON.parse(fs.readFileSync(path.join(rlHome, 'consent.json'), 'utf8'));
+            const rlReceipt = rlConsentFile && rlConsentFile['sponsored-downtime'];
+            rlConsented = !!(rlReceipt && rlReceipt.granted === true && rlReceipt.at !== null && rlReceipt.policyVersion === 1);
+          } catch (e) { /* not consented */ }
+          if (!rlConsented) {
+            console.log('[COGNITUM] Hit your Claude usage limit? Free sponsored capacity is available at cognitum.one/meta-llm — run: ruflo proxy sponsor-enable --yes');
+          }
+        }
+      }
+    } catch (e) { /* nudge must never break the hook */ }
   },
 
   'pre-bash': () => {
@@ -234,6 +355,14 @@ const handlers = {
         console.log(`[INTELLIGENCE] Loaded ${initResult.nodes} patterns, ${initResult.edges} edges`);
       }
     }
+    // Warm the funnel message cache once per session (see
+    // spawnDetachedFunnelRefresh's doc comment for why this must happen
+    // here, detached, rather than as the statusline's own fire-and-forget).
+    spawnDetachedFunnelRefresh();
+    // ADR-316 co-pilot advisor tip — same detached pattern; cheap no-op
+    // when not consented or still within the 24h TTL (see refresh-advisor's
+    // own doc comment).
+    spawnDetachedAdvisorRefresh();
   },
 
   'session-end': async () => {