@claude-flow/cli 3.25.5 → 3.26.0

package/dist/src/funnel/event-transport.js

@@ -0,0 +1,199 @@
+/**
+ * Event transport — batches the local funnel event queue and posts it to the
+ * Cognitum analytics Cloud Function (ADR-308 endpoint contract).
+ *
+ * Design discipline (ADR-308 client failure policy — all normative):
+ *   1. Telemetry never blocks the CLI. Every network call is best-effort,
+ *      capped by a short timeout, and swallows every error path.
+ *   2. Events are LOCAL FIRST. The queue in `events.ts` accumulates
+ *      regardless of API reachability. This transport is the flush layer.
+ *   3. Idempotency: every batch carries a UUIDv4 idempotency key so a retry
+ *      never double-counts (ADR-308 idempotent-batches invariant).
+ *   4. Exponential backoff on transient failures. Successful flushes stamp
+ *      a "last flush" timestamp so we don't hammer the API each render.
+ *   5. Consent-gated. Zero network activity when telemetry consent is off.
+ *   6. Bounded. Never send more than MAX_BATCH events at once, so a large
+ *      backlog doesn't blow the endpoint request-size limit.
+ *   7. Credit-exhaustion detection. If the endpoint replies 402 (Payment
+ *      Required) or the body carries the ADR-303
+ *      `COGNITUM_CREDIT_EXHAUSTED` code, we surface via `credit-notifier.ts`
+ *      — the same recovery UX ADR-303 already ships.
+ */
+import * as fs from 'fs';
+import * as https from 'https';
+import { URL as NodeUrl } from 'url';
+import { randomUUID } from 'crypto';
+import { hasConsent } from './consent.js';
+import { readStateJson, statePath, writeStateJson } from './state.js';
+import { markCreditExhausted } from './credit-notifier.js';
+const EVENTS_FILE = 'funnel-events.jsonl';
+const FLUSH_STATE_FILE = 'funnel-events-flush.json';
+/**
+ * Default endpoint — the ruflo-funnel-analytics endpoint on the ruv.io
+ * domain, mapped via Cloud Run domain mapping to the cognitum-analytics
+ * Cloud Function on cognitum-20260110. Overridable by env for staging or
+ * self-hosted deploys. The domain choice is deliberate: an rUv-authored
+ * OSS project's telemetry endpoint belongs on rUv's own domain, not on
+ * cognitum.one — that keeps the CLI attribution honest.
+ */
+export const DEFAULT_ENDPOINT = process.env.RUFLO_FUNNEL_EVENTS_ENDPOINT ?? 'https://funnel.ruv.io/v1/events';
+/** Cap per POST — server enforces its own limits too; this is a safety net. */
+export const MAX_BATCH = 100;
+/** Min interval between flushes (ms). Rate limits the client from within. */
+export const MIN_FLUSH_INTERVAL_MS = 60_000; // 1 min
+/** POST timeout — telemetry must not stall the CLI. */
+export const FLUSH_TIMEOUT_MS = 4_000;
+/** Read the current flush bookkeeping state (never throws). */
+function readFlushState() {
+    const raw = readStateJson(FLUSH_STATE_FILE);
+    return {
+        lastFlushAt: raw?.lastFlushAt ?? null,
+        consecutiveFailures: raw?.consecutiveFailures ?? 0,
+        lastError: raw?.lastError,
+    };
+}
+/** Persist flush bookkeeping. Never throws. */
+function writeFlushState(state) {
+    writeStateJson(FLUSH_STATE_FILE, state);
+}
+/** Read the local event queue as JSON lines. Returns [] when absent. */
+function readQueue() {
+    try {
+        const raw = fs.readFileSync(statePath(EVENTS_FILE), 'utf-8');
+        return raw
+            .split('\n')
+            .filter(Boolean)
+            .map((line) => {
+            try {
+                return JSON.parse(line);
+            }
+            catch {
+                return null;
+            }
+        })
+            .filter((x) => x !== null);
+    }
+    catch {
+        return [];
+    }
+}
+/** Overwrite the local queue with the survivors (events we didn't flush). */
+function writeQueue(events) {
+    try {
+        const body = events.length === 0 ? '' : events.map((e) => JSON.stringify(e)).join('\n') + '\n';
+        fs.writeFileSync(statePath(EVENTS_FILE), body, { encoding: 'utf-8', mode: 0o600 });
+    }
+    catch {
+        /* telemetry must never block */
+    }
+}
+/** Exponential backoff — cap at 30 minutes. */
+function backoffElapsed(state, now) {
+    if (!state.lastFlushAt)
+        return true;
+    const last = Date.parse(state.lastFlushAt);
+    if (Number.isNaN(last))
+        return true;
+    const base = MIN_FLUSH_INTERVAL_MS;
+    const factor = Math.min(2 ** state.consecutiveFailures, 30); // cap at 30x → ~30 min
+    const nextAllowed = last + base * factor;
+    return now.getTime() >= nextAllowed;
+}
+/**
+ * POST a batch to the endpoint. Resolves to { ok, status } — never rejects.
+ * Kept internal so callers can't hand it a URL that dodges the allowlist.
+ */
+function postBatch(endpoint, batch) {
+    return new Promise((resolve) => {
+        let target;
+        try {
+            target = new NodeUrl(endpoint);
+        }
+        catch {
+            resolve({ ok: false, status: 0, body: 'bad-endpoint' });
+            return;
+        }
+        if (target.protocol !== 'https:') {
+            resolve({ ok: false, status: 0, body: 'non-https-endpoint' });
+            return;
+        }
+        const body = JSON.stringify(batch);
+        const req = https.request({
+            hostname: target.hostname,
+            port: target.port || 443,
+            path: target.pathname + target.search,
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Content-Length': Buffer.byteLength(body),
+                'Idempotency-Key': batch.batchId,
+                'User-Agent': `ruflo-funnel/${batch.release}`,
+            },
+        }, (res) => {
+            let chunks = '';
+            res.setEncoding('utf-8');
+            res.on('data', (chunk) => { chunks += chunk; });
+            res.on('end', () => {
+                const status = res.statusCode ?? 0;
+                resolve({ ok: status >= 200 && status < 300, status, body: chunks });
+            });
+        });
+        req.setTimeout(FLUSH_TIMEOUT_MS, () => {
+            req.destroy();
+            resolve({ ok: false, status: 0, body: 'timeout' });
+        });
+        req.on('error', (err) => resolve({ ok: false, status: 0, body: String(err) }));
+        req.write(body);
+        req.end();
+    });
+}
+/**
+ * Best-effort flush of the local event queue to the endpoint. Returns a
+ * summary the CLI can log at --verbose; the caller should never fail on it.
+ */
+export async function flushEvents(opts) {
+    const now = opts?.now ?? new Date();
+    const endpoint = opts?.endpoint ?? DEFAULT_ENDPOINT;
+    if (!hasConsent('telemetry'))
+        return { flushed: 0, skipped: 'no-consent' };
+    const state = readFlushState();
+    if (!opts?.force && !backoffElapsed(state, now)) {
+        return { flushed: 0, skipped: 'backoff' };
+    }
+    const queue = readQueue();
+    if (queue.length === 0) {
+        // Nothing to send — record the check anyway so we don't retry every render.
+        writeFlushState({ ...state, lastFlushAt: now.toISOString() });
+        return { flushed: 0, skipped: 'empty-queue' };
+    }
+    const batchEvents = queue.slice(0, MAX_BATCH);
+    const batch = {
+        batchId: randomUUID(),
+        events: batchEvents,
+        release: opts?.release ?? 'unknown',
+        emittedAt: now.toISOString(),
+    };
+    const res = await postBatch(endpoint, batch);
+    // Credit-exhaustion detection (ADR-303 route in).
+    //   402 Payment Required  → out of Cognitum credits.
+    //   Body carrying the exact ADR-303 machine-readable code → same.
+    if (res.status === 402 || (typeof res.body === 'string' && res.body.includes('COGNITUM_CREDIT_EXHAUSTED'))) {
+        markCreditExhausted(now);
+    }
+    if (res.ok) {
+        // Drop the sent events; keep survivors.
+        writeQueue(queue.slice(batchEvents.length));
+        writeFlushState({
+            lastFlushAt: now.toISOString(),
+            consecutiveFailures: 0,
+        });
+        return { flushed: batchEvents.length, skipped: null, status: res.status };
+    }
+    writeFlushState({
+        lastFlushAt: now.toISOString(),
+        consecutiveFailures: state.consecutiveFailures + 1,
+        lastError: `HTTP ${res.status}`,
+    });
+    return { flushed: 0, skipped: `transport-failed`, status: res.status };
+}
+//# sourceMappingURL=event-transport.js.map

package/dist/src/funnel/events.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Funnel events — ADR-305 attribution / ADR-309 constrained schema.
+ *
+ * LOCAL-ONLY by design: this module performs no network I/O. Events are
+ * appended to a bounded local queue only when the telemetry consent domain
+ * is granted (ADR-302). Server-side ingestion (POST /v1/events, ADR-308)
+ * is a separate opt-in transport that does not exist in this build — until
+ * it does, the queue is simply a bounded local record the user can inspect
+ * and delete.
+ *
+ * Constraints enforced here, permanently (ADR-309): closed event set, daily
+ * timestamp buckets (never full timestamps), no raw prompts/commands/paths/
+ * repo names — the schema has no field that could carry them.
+ */
+import type { FunnelEventName, FunnelSurface } from './types.js';
+/**
+ * Lazily created pseudonymous funnel ID — random UUID, derived from nothing
+ * (no hardware, account, email, or path). Exists only when attribution
+ * consent (telemetry domain) is granted; deleted on opt-out.
+ */
+export declare function getFunnelId(now?: Date): string | null;
+/** Opt-out: stop emission, delete the ID and the local queue (ADR-305). */
+export declare function deleteFunnelData(): void;
+/**
+ * Most recent local record of `event`, as a daily bucket (`YYYY-MM-DD`) —
+ * events never carry a full timestamp (ADR-309). Returns null when nothing
+ * is recorded, which is also what you get with telemetry consent off (the
+ * queue is never written at all in that case) — this can't distinguish
+ * "never happened" from "not being recorded," by design.
+ */
+export declare function lastRecordedEvent(event: FunnelEventName): string | null;
+/**
+ * Record a funnel event to the local queue. No-op (returns false) when
+ * telemetry consent is absent — consent-off means zero funnel records.
+ * `messageId` is only carried for promo_impression / promo_open events; on
+ * every other event it is dropped so the schema stays clean.
+ */
+export declare function recordFunnelEvent(event: FunnelEventName, surface: FunnelSurface, release: string, optsOrNow?: Date | {
+    now?: Date;
+    messageId?: string;
+}): boolean;
+//# sourceMappingURL=events.d.ts.map

package/dist/src/funnel/events.js

@@ -0,0 +1,150 @@
+/**
+ * Funnel events — ADR-305 attribution / ADR-309 constrained schema.
+ *
+ * LOCAL-ONLY by design: this module performs no network I/O. Events are
+ * appended to a bounded local queue only when the telemetry consent domain
+ * is granted (ADR-302). Server-side ingestion (POST /v1/events, ADR-308)
+ * is a separate opt-in transport that does not exist in this build — until
+ * it does, the queue is simply a bounded local record the user can inspect
+ * and delete.
+ *
+ * Constraints enforced here, permanently (ADR-309): closed event set, daily
+ * timestamp buckets (never full timestamps), no raw prompts/commands/paths/
+ * repo names — the schema has no field that could carry them.
+ */
+import * as fs from 'fs';
+import { randomUUID } from 'crypto';
+import { hasConsent } from './consent.js';
+import { deleteStateFile, funnelStateDir, readStateJson, statePath, writeStateJson } from './state.js';
+const EVENTS_FILE = 'funnel-events.jsonl';
+const FUNNEL_ID_FILE = 'funnel-id.json';
+/** Bounded queue: ≤ 1000 events / ≤ 256 KiB — telemetry never grows unbounded. */
+const MAX_QUEUE_BYTES = 256 * 1024;
+const MAX_QUEUE_EVENTS = 1000;
+const EVENT_NAMES = [
+    'disclosure_shown',
+    'funnel_disabled',
+    'signup_opened',
+    'account_created',
+    'proxy_activated',
+    'promo_impression',
+    'promo_open',
+    'sponsor_mode_enabled',
+    'sponsor_mode_disabled',
+    'sponsor_capacity_exhausted',
+    'power_saver_enabled',
+    'power_saver_disabled',
+    'toggle_cooldown_blocked',
+    'training_share_enabled',
+    'training_share_disabled',
+    'advisor_tip_enabled',
+    'advisor_tip_disabled',
+];
+const SURFACES = ['statusline', 'init', 'credit_exhaustion'];
+/** Rotate the pseudonymous ID every 90 days (ADR-305). */
+const FUNNEL_ID_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+/**
+ * Lazily created pseudonymous funnel ID — random UUID, derived from nothing
+ * (no hardware, account, email, or path). Exists only when attribution
+ * consent (telemetry domain) is granted; deleted on opt-out.
+ */
+export function getFunnelId(now = new Date()) {
+    if (!hasConsent('telemetry'))
+        return null;
+    const existing = readStateJson(FUNNEL_ID_FILE);
+    if (existing?.id) {
+        const created = Date.parse(existing.createdAt);
+        if (!Number.isNaN(created) && now.getTime() - created < FUNNEL_ID_TTL_MS)
+            return existing.id;
+    }
+    const record = { id: randomUUID(), createdAt: now.toISOString() };
+    writeStateJson(FUNNEL_ID_FILE, record);
+    return record.id;
+}
+/** Opt-out: stop emission, delete the ID and the local queue (ADR-305). */
+export function deleteFunnelData() {
+    deleteStateFile(FUNNEL_ID_FILE);
+    deleteStateFile(EVENTS_FILE);
+}
+/**
+ * Most recent local record of `event`, as a daily bucket (`YYYY-MM-DD`) —
+ * events never carry a full timestamp (ADR-309). Returns null when nothing
+ * is recorded, which is also what you get with telemetry consent off (the
+ * queue is never written at all in that case) — this can't distinguish
+ * "never happened" from "not being recorded," by design.
+ */
+export function lastRecordedEvent(event) {
+    try {
+        const raw = fs.readFileSync(statePath(EVENTS_FILE), 'utf-8');
+        const lines = raw.split('\n').filter(Boolean);
+        for (let i = lines.length - 1; i >= 0; i--) {
+            const parsed = JSON.parse(lines[i]);
+            if (parsed.event === event)
+                return parsed.timestampBucket;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function dailyBucket(now) {
+    return now.toISOString().slice(0, 10);
+}
+/**
+ * Record a funnel event to the local queue. No-op (returns false) when
+ * telemetry consent is absent — consent-off means zero funnel records.
+ * `messageId` is only carried for promo_impression / promo_open events; on
+ * every other event it is dropped so the schema stays clean.
+ */
+export function recordFunnelEvent(event, surface, release, optsOrNow = new Date()) {
+    if (!EVENT_NAMES.includes(event) || !SURFACES.includes(surface))
+        return false;
+    if (!hasConsent('telemetry'))
+        return false;
+    const now = optsOrNow instanceof Date ? optsOrNow : (optsOrNow.now ?? new Date());
+    const messageId = optsOrNow instanceof Date ? undefined : optsOrNow.messageId;
+    const payload = {
+        schemaVersion: 1,
+        event,
+        surface,
+        release,
+        timestampBucket: dailyBucket(now),
+    };
+    const id = getFunnelId(now);
+    if (id)
+        payload.pseudonymousId = id;
+    // messageId is only carried on promo events; validated + length-capped so
+    // the schema stays predictable.
+    if (messageId && (event === 'promo_impression' || event === 'promo_open')) {
+        if (typeof messageId === 'string' && messageId.length > 0 && messageId.length <= 64) {
+            payload.messageId = messageId;
+        }
+    }
+    try {
+        fs.mkdirSync(funnelStateDir(), { recursive: true, mode: 0o700 });
+        const file = statePath(EVENTS_FILE);
+        let existing = '';
+        try {
+            existing = fs.readFileSync(file, 'utf-8');
+        }
+        catch {
+            // first event
+        }
+        const lines = existing ? existing.split('\n').filter(Boolean) : [];
+        lines.push(JSON.stringify(payload));
+        let out = lines.slice(-MAX_QUEUE_EVENTS).join('\n') + '\n';
+        while (Buffer.byteLength(out, 'utf-8') > MAX_QUEUE_BYTES) {
+            const trimmed = out.split('\n').filter(Boolean);
+            trimmed.shift();
+            out = trimmed.join('\n') + '\n';
+        }
+        fs.writeFileSync(file, out, { encoding: 'utf-8', mode: 0o600 });
+        return true;
+    }
+    catch {
+        // Telemetry must never block or break the CLI (ADR-308 failure policy).
+        return false;
+    }
+}
+//# sourceMappingURL=events.js.map

package/dist/src/funnel/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Funnel module — ruflo → Cognitum lifecycle system (ADR-301..310).
+ * Local-only: nothing in this module performs network I/O.
+ */
+export * from './types.js';
+export { funnelStateDir } from './state.js';
+export { isCI, isInteractive, reducedMotion } from './environment.js';
+export { resolveFunnelEnabled } from './precedence.js';
+export { CONSENT_DOMAINS, getConsent, hasConsent, readConsents, recordConsent, revokeConsent, } from './consent.js';
+export { DISCLOSURE_GRACE_MS, DISCLOSURE_ROTATION_SLOT_MS, getDisclosure, promoEligible, recordDisclosureDeclined, recordDisclosureReenabled, recordDisclosureShown, selectDisclosureMessage, } from './disclosure.js';
+export { MAX_MESSAGE_COLUMNS, MESSAGES, containsForbiddenSequences, displayWidth, eligibleMessages, eligibleMessagesFromPools, isAllowedUrl, isValidMessage, } from './messages.js';
+export { DEFAULT_MESSAGES_ENDPOINT, getRemoteMessages, refreshRemoteMessages, } from './message-transport.js';
+export { PROMO_REPEAT_CAP_MS, PROMO_SLOT_MODULO, ROTATION_SLOT_MS, selectMessage, } from './rotation.js';
+export { CREDIT_RECOVERY_HINT, classifyCreditError, renderCreditRecovery, shouldShowCreditRecovery, type CreditPromptSession, type ProviderErrorLike, } from './credit-errors.js';
+export { deleteFunnelData, getFunnelId, lastRecordedEvent, recordFunnelEvent } from './events.js';
+export { getFunnelPromo, type PromoContext } from './promo.js';
+export { RATE_LIMIT_TTL_MS, clearRateLimitStatus, markRateLimited, rateLimitNotice, readRateLimitStatus, type RateLimitStatus, } from './rate-limit-notifier.js';
+export { QUOTA_LOW_TTL_MS, clearQuotaLowStatus, markQuotaLow, quotaLowNotice, readQuotaLowStatus, type QuotaLowStatus, } from './power-saver-notifier.js';
+export { TOGGLE_COOLDOWN_MS, cooldownActive, cooldownRemainingMin } from './toggle-cooldown.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/funnel/index.js

@@ -0,0 +1,20 @@
+/**
+ * Funnel module — ruflo → Cognitum lifecycle system (ADR-301..310).
+ * Local-only: nothing in this module performs network I/O.
+ */
+export * from './types.js';
+export { funnelStateDir } from './state.js';
+export { isCI, isInteractive, reducedMotion } from './environment.js';
+export { resolveFunnelEnabled } from './precedence.js';
+export { CONSENT_DOMAINS, getConsent, hasConsent, readConsents, recordConsent, revokeConsent, } from './consent.js';
+export { DISCLOSURE_GRACE_MS, DISCLOSURE_ROTATION_SLOT_MS, getDisclosure, promoEligible, recordDisclosureDeclined, recordDisclosureReenabled, recordDisclosureShown, selectDisclosureMessage, } from './disclosure.js';
+export { MAX_MESSAGE_COLUMNS, MESSAGES, containsForbiddenSequences, displayWidth, eligibleMessages, eligibleMessagesFromPools, isAllowedUrl, isValidMessage, } from './messages.js';
+export { DEFAULT_MESSAGES_ENDPOINT, getRemoteMessages, refreshRemoteMessages, } from './message-transport.js';
+export { PROMO_REPEAT_CAP_MS, PROMO_SLOT_MODULO, ROTATION_SLOT_MS, selectMessage, } from './rotation.js';
+export { CREDIT_RECOVERY_HINT, classifyCreditError, renderCreditRecovery, shouldShowCreditRecovery, } from './credit-errors.js';
+export { deleteFunnelData, getFunnelId, lastRecordedEvent, recordFunnelEvent } from './events.js';
+export { getFunnelPromo } from './promo.js';
+export { RATE_LIMIT_TTL_MS, clearRateLimitStatus, markRateLimited, rateLimitNotice, readRateLimitStatus, } from './rate-limit-notifier.js';
+export { QUOTA_LOW_TTL_MS, clearQuotaLowStatus, markQuotaLow, quotaLowNotice, readQuotaLowStatus, } from './power-saver-notifier.js';
+export { TOGGLE_COOLDOWN_MS, cooldownActive, cooldownRemainingMin } from './toggle-cooldown.js';
+//# sourceMappingURL=index.js.map

package/dist/src/funnel/insights.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Local insight ticker — environment/task-aware suggestions sharing the
+ * promo row's screen real estate, but a deliberately SEPARATE data path
+ * from it.
+ *
+ * Why separate: the promo row is "zero local content, fully remote-served,
+ * fail-closed" (an explicit earlier design call — nothing about WHAT shows
+ * ships in the package). Insights are the opposite by nature — CVE counts,
+ * uncommitted changes, sponsored-mode state — none of that is knowable
+ * server-side. Conflating the two would mean either routing local logic
+ * through the remote-content validation pipeline (messages.ts's
+ * isValidMessage(), built for untrusted REMOTE content) or quietly giving
+ * the promo row a second, unrelated job. So: same rendered slot, same
+ * PromoRow shape, but a totally separate module, never touching
+ * message-transport.ts or the remote message cache.
+ *
+ * Cheapness discipline (learned the hard way — see the funnel-cache fix):
+ * every insight source here MUST be either (a) synchronous local file/state
+ * reads, already-computed data the caller passes in, or (b) a read of a
+ * cache some OTHER, separately-scheduled process populates. NEVER a network
+ * call from here — that would reintroduce the exact bug where a statusline
+ * render silently ate a multi-second fetch it could never actually finish.
+ */
+export interface LocalInsight {
+    id: string;
+    text: string;
+    /** Higher = shown first when multiple insights are candidates this slot. */
+    priority: number;
+}
+export interface LocalInsightContext {
+    security?: {
+        status: string;
+        cvesFixed: number;
+        totalCves: number;
+    };
+    swarm?: {
+        activeAgents: number;
+        maxAgents: number;
+        coordinationActive: boolean;
+    };
+    /** Count of uncommitted-changed files (git status --short line count). */
+    gitUncommittedCount?: number;
+    now?: Date;
+}
+/** All candidate insights for this render, unsorted. */
+export declare function computeLocalInsights(ctx: LocalInsightContext): LocalInsight[];
+/** Highest-priority insight this render, or null if nothing is actionable. */
+export declare function selectLocalInsight(ctx: LocalInsightContext): LocalInsight | null;
+//# sourceMappingURL=insights.d.ts.map

package/dist/src/funnel/insights.js

@@ -0,0 +1,120 @@
+/**
+ * Local insight ticker — environment/task-aware suggestions sharing the
+ * promo row's screen real estate, but a deliberately SEPARATE data path
+ * from it.
+ *
+ * Why separate: the promo row is "zero local content, fully remote-served,
+ * fail-closed" (an explicit earlier design call — nothing about WHAT shows
+ * ships in the package). Insights are the opposite by nature — CVE counts,
+ * uncommitted changes, sponsored-mode state — none of that is knowable
+ * server-side. Conflating the two would mean either routing local logic
+ * through the remote-content validation pipeline (messages.ts's
+ * isValidMessage(), built for untrusted REMOTE content) or quietly giving
+ * the promo row a second, unrelated job. So: same rendered slot, same
+ * PromoRow shape, but a totally separate module, never touching
+ * message-transport.ts or the remote message cache.
+ *
+ * Cheapness discipline (learned the hard way — see the funnel-cache fix):
+ * every insight source here MUST be either (a) synchronous local file/state
+ * reads, already-computed data the caller passes in, or (b) a read of a
+ * cache some OTHER, separately-scheduled process populates. NEVER a network
+ * call from here — that would reintroduce the exact bug where a statusline
+ * render silently ate a multi-second fetch it could never actually finish.
+ */
+import { hasConsent } from './consent.js';
+import { readQuotaLowStatus } from './power-saver-notifier.js';
+import { readStateJson } from './state.js';
+import { readAdvisorTip } from './advisor-tip.js';
+const GIT_UNCOMMITTED_THRESHOLD = 20;
+const FLYWHEEL_STATUS_TTL_MS = 24 * 60 * 60 * 1000;
+function flywheelInsight(now) {
+    const cache = readStateJson('flywheel-status.json');
+    // `!cache._ts` would wrongly treat a legitimate epoch-zero timestamp as
+    // absent (0 is falsy) — check the type explicitly instead (ADR-316 found
+    // this exact defect pattern live via a test using new Date(0)).
+    if (!cache || !cache.headline || typeof cache._ts !== 'number')
+        return null;
+    if (now.getTime() - cache._ts >= FLYWHEEL_STATUS_TTL_MS)
+        return null;
+    return { id: 'insight-flywheel-status', text: `🧬 ${cache.headline}`, priority: 40 };
+}
+function securityInsight(ctx) {
+    const s = ctx.security;
+    if (!s)
+        return null;
+    const pending = s.totalCves - s.cvesFixed;
+    if (pending > 0) {
+        return {
+            id: 'insight-cves-pending',
+            text: `⚠ ${pending} CVE${pending === 1 ? '' : 's'} pending — Run ruflo security scan --depth full`,
+            priority: 90,
+        };
+    }
+    if (s.status === 'PENDING') {
+        return { id: 'insight-scan-pending', text: '🛡 Security scan pending — Run ruflo security scan --depth full', priority: 70 };
+    }
+    return null;
+}
+function gitInsight(ctx) {
+    const n = ctx.gitUncommittedCount;
+    if (n === undefined || n <= GIT_UNCOMMITTED_THRESHOLD)
+        return null;
+    return {
+        id: 'insight-uncommitted',
+        text: `📝 ${n} uncommitted changes — commit or stash before continuing`,
+        priority: 50,
+    };
+}
+/**
+ * Power-saver mode state — genuinely local (consent + a self-reported flag
+ * file, same pattern the rest of this module uses). Sponsored/rate-limited
+ * state is deliberately NOT duplicated here — promo.ts's own
+ * getSponsoredDowntimeOverride() already preempts rotation entirely for
+ * that case (ADR-313), with higher precedence than this slot-based ticker.
+ * Two insight sources for the same fact would mean picking which one wins;
+ * simpler to just not have two.
+ */
+function proxyModeInsight(now) {
+    if (hasConsent('power-saver') && readQuotaLowStatus(now).low) {
+        return { id: 'insight-power-saver-active', text: '🔋 Power saver mode active — routing via cognitum-auto', priority: 55 };
+    }
+    return null;
+}
+/**
+ * ADR-316 — a co-pilot tip from ruflo's Fable Advisor Harness
+ * (services/fable-harness.ts, ADR-172). Consent-gated (never surfaces a
+ * stale cached tip after the user disables it, even though the cache file
+ * itself isn't deleted on disable — this check is what actually enforces
+ * "off means off"). Purely a cache read here — no network call, no spend;
+ * the real `claude -p` call happens in advisor-tip.ts's
+ * refreshAdvisorTipIfStale(), invoked from a detached background process,
+ * never from this hot path.
+ */
+function advisorTipInsight(now) {
+    if (!hasConsent('advisor-tips'))
+        return null;
+    const tip = readAdvisorTip(now);
+    if (!tip)
+        return null;
+    return { id: 'insight-advisor-tip', text: `🧭 ${tip.headline}`, priority: 45 };
+}
+/** All candidate insights for this render, unsorted. */
+export function computeLocalInsights(ctx) {
+    const now = ctx.now ?? new Date();
+    const candidates = [
+        securityInsight(ctx),
+        gitInsight(ctx),
+        proxyModeInsight(now),
+        advisorTipInsight(now),
+        flywheelInsight(now),
+    ];
+    return candidates.filter((i) => i !== null);
+}
+/** Highest-priority insight this render, or null if nothing is actionable. */
+export function selectLocalInsight(ctx) {
+    const candidates = computeLocalInsights(ctx);
+    if (candidates.length === 0)
+        return null;
+    return candidates.reduce((best, c) => (c.priority > best.priority ? c : best));
+}
+//# sourceMappingURL=insights.js.map

package/dist/src/funnel/local-signals.d.ts

@@ -0,0 +1,15 @@
+export interface SecurityStatus {
+    status: 'CLEAN' | 'IN_PROGRESS' | 'PENDING';
+    cvesFixed: number;
+    totalCves: number;
+}
+export declare function getSecurityStatus(cwd?: string): SecurityStatus;
+export interface SwarmStatus {
+    activeAgents: number;
+    maxAgents: number;
+    coordinationActive: boolean;
+}
+export declare function getSwarmStatus(): SwarmStatus;
+/** Count of uncommitted-changed files (git status --short line count). */
+export declare function getGitUncommittedCount(): number | undefined;
+//# sourceMappingURL=local-signals.d.ts.map