@claude-flow/cli 3.25.6 → 3.26.1

package/dist/src/init/statusline-generator.js

@@ -72,6 +72,28 @@ const CWD = process.cwd();
 const CACHE_FILE = path.join(os.tmpdir(), 'ruflo-statusline-cache-' + require('crypto').createHash('md5').update(CWD).digest('hex').slice(0, 8) + '.json');
 const CACHE_TTL_MS = 60000;
 
+// The promo/insight row is designed to rotate on a 20s cadence (funnel/
+// rotation.ts's ROTATION_SLOT_MS / funnel/promo.ts's insight-slot check —
+// duplicated here as a bare number since this generated script has no
+// runtime import of the funnel module; keep in sync if that constant ever
+// changes). The rotation slot is only ever (re)computed SERVER-SIDE inside
+// the CLI subprocess this file shells out to — so a general 60s data cache
+// (correct and necessary for #2337) silently made that 20s design
+// unreachable: cache.fresh stayed true across 2-3 whole rotation slots,
+// so the row visibly "didn't rotate" (user report). Fix: track promo
+// freshness on its OWN, tighter clock — when it lags behind the current
+// slot, fall through to a real CLI call even though the REST of the
+// cached data (security/swarm/system) is still within CACHE_TTL_MS. This
+// does not touch or regress #2337's fix; it only adds a narrower check.
+const PROMO_ROTATION_SLOT_MS = 20000;
+
+// Persistent last-known-good promo record. Lives outside the /tmp cache so it
+// survives a full cache wipe / cache write race / CLI failure combo. Written
+// every time we successfully render a promo; read as a last resort so the row
+// never blinks out mid-session (was: 'promo shows then hides' bug report).
+const PROMO_MEMO_FILE = path.join(os.homedir(), '.ruflo', 'statusline-promo.json');
+const PROMO_MEMO_TTL_MS = 6 * 60 * 60 * 1000; // 6h — long enough to bridge any hiccup, short enough that a real disable takes effect fast.
+
 // #2337: resolve an already-installed @claude-flow/cli (or ruflo) bin so we
 // can invoke it directly via \`node\`. The previous version called
 // \`npx --yes @claude-flow/cli@latest\` on every uncached render, which forces
@@ -79,18 +101,30 @@ const CACHE_TTL_MS = 60000;
 // multiple concurrent Claude Code sessions this storms the host (reporter
 // saw load average 40-65 on a 12-core box).
 //
-// Returns the absolute path to bin/cli.js or null. Mirrors getPkgVersion()'s
-// path probing (project, monorepo, plugin marketplace, global node_modules
-// including custom-prefix layouts like ~/.npm-global).
-function resolveCliBin() {
+// Returns EVERY existing bin/cli.js candidate, in preference order (project,
+// monorepo, plugin marketplace, global node_modules including custom-prefix
+// layouts like ~/.npm-global) — mirrors getPkgVersion()'s own path probing.
+//
+// Returns a list, not a single winner: \`fs.existsSync\` only proves a file is
+// present, not that it actually runs. A marketplace/npx-cached install can
+// exist on disk but be broken (observed in practice: a stale marketplace
+// checkout whose dist/ imports a workspace package, '@claude-flow/cli-core',
+// that isn't bundled there — every invocation throws ERR_MODULE_NOT_FOUND).
+// Picking the first EXISTING path and never falling through meant a single
+// broken install silently killed the promo row for the entire session (the
+// CLI call always failed, so the memo could never refresh and eventually
+// expired). getStatuslineData() now walks this whole list and tries the next
+// candidate on failure, so one broken install can't permanently wedge it.
+function resolveCliBinCandidates() {
+  const candidates = [];
   try {
     const home = os.homedir();
-    const candidates = [
+    candidates.push(
       path.join(home, '.claude', 'plugins', 'marketplaces', 'ruflo', 'bin', 'cli.js'),
       path.join(CWD, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js'),
       path.join(CWD, 'node_modules', 'ruflo', 'bin', 'cli.js'),
       path.join(CWD, 'v3', '@claude-flow', 'cli', 'bin', 'cli.js'),
-    ];
+    );
     try {
       const binDir = path.dirname(process.execPath);
       const globalModuleDirs = [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules')];
@@ -104,27 +138,54 @@ function resolveCliBin() {
         );
       }
     } catch { /* ignore */ }
-    for (const p of candidates) {
-      if (fs.existsSync(p)) return p;
-    }
   } catch { /* ignore */ }
-  return null;
+  return candidates.filter((p) => { try { return fs.existsSync(p); } catch { return false; } });
 }
 
+// Return { fresh, promoFresh, data }. 'fresh' is true only if within the TTL
+// — but data is returned regardless (stale-while-revalidate). This lets us
+// serve last known state (specifically the promo row) when the CLI is
+// slow/unavailable, so users don't see the funnel row flicker in and out on
+// cache expiry. 'promoFresh' is a SEPARATE, tighter check on the same clock
+// as PROMO_ROTATION_SLOT_MS — see that constant's comment for why the promo
+// row needs its own freshness bound distinct from the general 60s TTL.
 function readCache() {
   try {
     if (fs.existsSync(CACHE_FILE)) {
       const raw = JSON.parse(fs.readFileSync(CACHE_FILE, 'utf-8'));
-      if (raw && raw._ts && (Date.now() - raw._ts) < CACHE_TTL_MS) {
-        return raw.data;
+      if (raw && raw._ts && raw.data) {
+        const age = Date.now() - raw._ts;
+        return { fresh: age < CACHE_TTL_MS, promoFresh: age < PROMO_ROTATION_SLOT_MS, data: raw.data };
       }
     }
   } catch { /* ignore */ }
-  return null;
+  return { fresh: false, promoFresh: false, data: null };
 }
 
 function writeCache(data) {
   try { fs.writeFileSync(CACHE_FILE, JSON.stringify({ _ts: Date.now(), data }), 'utf-8'); } catch { /* ignore */ }
+  // Also memoize any promo we saw so the row can survive future CLI hiccups.
+  try {
+    if (data && data.promo && typeof data.promo === 'object') {
+      fs.mkdirSync(path.dirname(PROMO_MEMO_FILE), { recursive: true, mode: 0o700 });
+      fs.writeFileSync(PROMO_MEMO_FILE, JSON.stringify({ _ts: Date.now(), promo: data.promo }), { encoding: 'utf-8', mode: 0o600 });
+    }
+  } catch { /* ignore */ }
+}
+
+// Last resort: read a memoized promo (up to 6h old). Used when no cache and
+// no CLI response is available — the row still renders, so users don't see
+// the disclosure blink out. Returns null when the memo is absent, expired,
+// or malformed. Never throws.
+function readPromoMemo() {
+  try {
+    if (!fs.existsSync(PROMO_MEMO_FILE)) return null;
+    const raw = JSON.parse(fs.readFileSync(PROMO_MEMO_FILE, 'utf-8'));
+    if (raw && raw._ts && (Date.now() - raw._ts) < PROMO_MEMO_TTL_MS && raw.promo) {
+      return raw.promo;
+    }
+  } catch { /* ignore */ }
+  return null;
 }
 
 /**
@@ -135,37 +196,75 @@ function writeCache(data) {
  * (missed the .swarm/memory.db → AgentDB path), computed dddProgress wrong,
  * and only counted ADRs in v3/implementation/adrs/ (missed v3/docs/adr/).
  */
+// Overlay the memoized promo onto any data object that's missing one. This is
+// the safety net that keeps the funnel row rendered when an OLDER cached CLI
+// version is picked up by npx — that older CLI succeeds but omits promo, so
+// the JSON round-trips clean but without our row. We patch it back here.
+function overlayMemoPromo(data) {
+  if (data && !data.promo) {
+    const memoPromo = readPromoMemo();
+    if (memoPromo) data.promo = memoPromo;
+  }
+  return data;
+}
+
 function getStatuslineData() {
-  const cached = readCache();
-  if (cached) return cached;
+  const cache = readCache();
+  // Both clocks must be satisfied to skip the CLI call entirely: the general
+  // 60s TTL (#2337 — don't re-spawn the CLI on every rapid re-render) AND the
+  // tighter promo-rotation clock (this fix — don't let a still-fresh 60s
+  // cache silently freeze the promo/insight row across multiple 20s slots).
+  if (cache.fresh && cache.promoFresh) return overlayMemoPromo(cache.data);
+
+  // #2337: prefer an already-installed CLI bin via direct \`node\` invocation —
+  // no npx, no registry round-trip, no @latest re-resolve per render. Try
+  // every candidate that actually EXISTS (not just the first) before falling
+  // back to \`npx --prefer-offline @claude-flow/cli\` (no @latest); an existing
+  // but broken install (e.g. a stale marketplace checkout missing a bundled
+  // workspace dep) must not block trying the next one.
+  //
+  // No \`2>/dev/null\` here (deliberately) — the execSync call below already
+  // sets stdio: ['pipe','pipe','pipe'], which captures/discards stderr at the
+  // Node level regardless of shell. The redirect was redundant on POSIX and
+  // actively broke every candidate on Windows: cmd.exe (execSync's default
+  // shell there) doesn't understand /dev/null, so the CLI delegation always
+  // failed, silently degrading every render to buildLocalFallback() — 0%
+  // intelligence and an empty promo row (the memo cache that keeps the row
+  // populated across CLI hiccups is only ever written from a SUCCESSFUL
+  // delegation, so it could never get seeded on Windows either).
+  const cmds = resolveCliBinCandidates()
+    .map((bin) => '"' + process.execPath + '" "' + bin + '" hooks statusline --json')
+    .concat(['npx --prefer-offline @claude-flow/cli hooks statusline --json']);
+  for (const cmd of cmds) {
+    try {
+      const raw = execSync(
+        cmd,
+        { encoding: 'utf-8', timeout: 8000, stdio: ['pipe', 'pipe', 'pipe'], cwd: CWD }
+      ).trim();
+      // The CLI may emit preamble lines before the JSON — find the first '{'.
+      const jsonStart = raw.indexOf('{');
+      if (jsonStart === -1) throw new Error('no JSON in CLI output');
+      const data = JSON.parse(raw.slice(jsonStart));
+      // Overlay every block the CLI JSON omits (adrs/agentdb/tests/hooks/integration)
+      // with real local reads, so those segments reflect actual state instead of 0.
+      applyLocalOverlays(data);
+      overlayMemoPromo(data);
+      writeCache(data);
+      return data;
+    } catch { /* this candidate unavailable, broken, or timed out — try the next */ }
+  }
 
-  try {
-    // #2337: prefer an already-installed CLI bin via direct \`node\` invocation
-    // — no npx, no registry round-trip, no @latest re-resolve per render.
-    // Fall back to \`npx --prefer-offline @claude-flow/cli\` (no @latest) only
-    // when nothing is installed locally, so a cold environment still works.
-    const cliBin = resolveCliBin();
-    const cmd = cliBin
-      ? '"' + process.execPath + '" "' + cliBin + '" hooks statusline --json 2>/dev/null'
-      : 'npx --prefer-offline @claude-flow/cli hooks statusline --json 2>/dev/null';
-    const raw = execSync(
-      cmd,
-      { encoding: 'utf-8', timeout: 8000, stdio: ['pipe', 'pipe', 'pipe'], cwd: CWD }
-    ).trim();
-    // The CLI may emit preamble lines before the JSON — find the first '{'.
-    const jsonStart = raw.indexOf('{');
-    if (jsonStart === -1) throw new Error('no JSON in CLI output');
-    const data = JSON.parse(raw.slice(jsonStart));
-    // Overlay every block the CLI JSON omits (adrs/agentdb/tests/hooks/integration)
-    // with real local reads, so those segments reflect actual state instead of 0.
-    applyLocalOverlays(data);
-    writeCache(data);
-    return data;
-  } catch { /* CLI unavailable or timed out */ }
-
-  // Fallback: use local file probes only (will be less accurate, but non-zero
-  // when CLI is available and accurate when it's not).
-  return buildLocalFallback();
+  // Stale-while-revalidate: if we have any cached data, keep serving it so the
+  // funnel row doesn't flicker on CLI hiccups. Overlay fresh local reads for
+  // the segments the CLI JSON doesn't populate; the promo row survives.
+  if (cache.data) {
+    applyLocalOverlays(cache.data);
+    overlayMemoPromo(cache.data);
+    return cache.data;
+  }
+
+  // Last resort: local probes + memo. Users still see the funnel row.
+  return overlayMemoPromo(buildLocalFallback());
 }
 
 // Count ADRs from BOTH known directories (fix for ruflo#2195: old code missed
@@ -565,7 +664,11 @@ function generateStatusline() {
   const modelName = getModelFromStdin() || (d.user && d.user.modelName) || 'Claude Code';
   const ctxInfo = getContextFromStdin();
   const costInfo = getCostFromStdin();
-  const pkgVersion = getPkgVersion();
+  // Named RUFLO_VERSION (not pkgVersion) so the #1951 regression guard
+  // (scripts/audit-fix-invariants.mjs) can pin its presence in the emitted
+  // .cjs artifact — without it the header silently reverts to a hard-coded
+  // "RuFlo V3.5" for anyone whose install doesn't match the first probe path.
+  const RUFLO_VERSION = getPkgVersion();
 
   const progress = d.v3Progress || {};
   const security = d.security || {};
@@ -601,8 +704,14 @@ function generateStatusline() {
 
   const lines = [];
 
-  // Header
-  let header = c.bold + c.brightPurple + '▊ RuFlo V' + pkgVersion + ' ' + c.reset;
+  // 3-line design (fits Claude Code's visible statusline area — line 4+ gets
+  // replaced by the system guidance / input prompt line):
+  //   Line 1 — Header (RuFlo version · git · model · timing · context · cost)
+  //   Line 2 — Compressed ops (Swarm · Hooks · 🧠 · 💾 · Health)
+  //   Line 3 — Promo / disclosure row (funnel surface, ADR-301)
+
+  // ─── Line 1: header ────────────────────────────────────────────
+  let header = c.bold + c.brightPurple + '▊ RuFlo V' + RUFLO_VERSION + ' ' + c.reset;
   header += (coordinationActive ? c.brightCyan : c.dim) + '● ' + c.brightCyan + git.name + c.reset;
   if (git.gitBranch) {
     header += '  ' + c.dim + '│' + c.reset + '  ' + c.brightBlue + '⏇ ' + git.gitBranch + c.reset;
@@ -629,81 +738,148 @@ function generateStatusline() {
   }
   lines.push(header);
 
-  // Separator
-  lines.push(c.dim + '─'.repeat(53) + c.reset);
-
-  // Line 1: DDD Domains
-  const domainsColor = domainsCompleted >= 3 ? c.brightGreen : domainsCompleted > 0 ? c.yellow : c.red;
-  let perfIndicator;
-  if (hasHnsw && vectorCount > 0) {
-    const speedup = vectorCount > 10000 ? '12500x' : vectorCount > 1000 ? '150x' : '10x';
-    perfIndicator = c.brightGreen + '⚡ HNSW ' + speedup + c.reset;
-  } else if (patternsLearned > 0) {
-    const pk = patternsLearned >= 1000 ? (patternsLearned / 1000).toFixed(1) + 'k' : String(patternsLearned);
-    perfIndicator = c.brightYellow + '📚 ' + pk + ' patterns' + c.reset;
-  } else {
-    perfIndicator = c.dim + '⚡ target: 150x-12500x' + c.reset;
-  }
-  lines.push(
-    c.brightCyan + '🏗️  DDD Domains' + c.reset + '    ' + progressBar(domainsCompleted, totalDomains) + '  ' +
-    domainsColor + domainsCompleted + c.reset + '/' + c.brightWhite + totalDomains + c.reset + '    ' + perfIndicator
-  );
-
-  // Line 2: Swarm + Hooks + CVE + Memory + Intelligence
-  const swarmInd = coordinationActive ? c.brightGreen + '◉' + c.reset : c.dim + '○' + c.reset;
-  const agentsColor = activeAgents > 0 ? c.brightGreen : c.red;
-  const secIcon = secStatus === 'CLEAN' ? '🟢' : (secStatus === 'IN_PROGRESS' || secStatus === 'STALE') ? '🟡' : (secStatus === 'NONE' ? '⚪' : '🔴');
-  const secColor = secStatus === 'CLEAN' ? c.brightGreen : (secStatus === 'IN_PROGRESS' || secStatus === 'STALE') ? c.brightYellow : (secStatus === 'NONE' ? c.dim : c.brightRed);
+  // ─── Line 2: compressed ops ────────────────────────────────────
+  // Everything actionable in one dense row. Show only what changes what you
+  // do next; diagnostic detail moves to \`ruflo status --verbose\`.
+  const agentsColor = activeAgents > 0 ? c.brightGreen : c.dim;
   const hooksColor = hooksEnabled > 0 ? c.brightGreen : c.dim;
   const intellColor = intelligencePct >= 80 ? c.brightGreen : intelligencePct >= 40 ? c.brightYellow : c.dim;
+  const swarmInd = coordinationActive ? c.brightGreen + '◉' + c.reset + ' ' : c.dim + '○' + c.reset + ' ';
+  const cvesClean = totalCves === 0 || cvesFixed === totalCves;
+  const healthAllGreen = (secStatus === 'CLEAN' || secStatus === 'NONE') && cvesClean;
+  const opsParts = [];
+  opsParts.push(c.cyan + 'Swarm ' + swarmInd + agentsColor + activeAgents + c.reset + '/' + c.brightWhite + maxAgents + c.reset);
+  if (subAgents > 0) opsParts.push(c.brightPurple + '👥 ' + subAgents + c.reset);
+  opsParts.push(c.cyan + 'Hooks ' + hooksColor + hooksEnabled + c.reset + '/' + c.brightWhite + hooksTotal + c.reset);
+  opsParts.push(intellColor + '🧠 ' + intelligencePct + '%' + c.reset);
+  opsParts.push(c.brightCyan + '💾 ' + memoryMB + 'MB' + c.reset);
+  // Health: one glyph when green, terse copy when there's something to act on.
+  if (healthAllGreen) {
+    opsParts.push(c.brightGreen + '🛡 ✓' + c.reset);
+  } else {
+    if (secStatus === 'PENDING') opsParts.push(c.brightYellow + '🛡 scan pending' + c.reset);
+    else if (secStatus === 'IN_PROGRESS') opsParts.push(c.brightYellow + '🛡 scanning…' + c.reset);
+    else if (secStatus === 'STALE') opsParts.push(c.brightYellow + '🛡 scan stale' + c.reset);
+    else if (secStatus !== 'NONE' && secStatus !== 'CLEAN') opsParts.push(c.brightRed + '🛡 ' + secStatus.toLowerCase() + c.reset);
+    if (totalCves > 0 && cvesFixed < totalCves) {
+      const unfixed = totalCves - cvesFixed;
+      opsParts.push(c.brightRed + '⚠ ' + unfixed + ' CVE' + (unfixed === 1 ? '' : 's') + c.reset);
+    }
+  }
+  lines.push(opsParts.join('  ' + c.dim + '·' + c.reset + '  '));
+
+  // ─── Line 3: promo / disclosure / insight ───────────────────────
+  // Colored by content kind so it reads as *what it is*, not as noise:
+  //   disclosure  → brightCyan   (announcement / capability link)
+  //   promotional → brightPurple (Cognitum sponsor spot)
+  //   educational → yellow       (a tip)
+  //   insight     → brightRed    (environment/task-aware, local, actionable —
+  //                               distinct from remote content on purpose)
+  const promoRow = getPromoRow(d);
+  if (promoRow) {
+    const kind = (d && d.promo && d.promo.kind) || 'disclosure';
+    const promoColor = kind === 'promotional' ? c.brightPurple
+                     : kind === 'educational' ? c.yellow
+                     : kind === 'insight' ? c.brightRed
+                     : c.brightCyan;
+    lines.push(promoColor + promoRow + c.reset);
+  }
+
+  // Trailing blank line so Claude Code's input prompt gets breathing room
+  // instead of butting directly against the last statusline row.
+  return lines.join('\\n') + '\\n';
+}
 
-  lines.push(
-    c.brightYellow + '🤖 Swarm' + c.reset + '  ' + swarmInd + ' [' + agentsColor + String(activeAgents).padStart(2) + c.reset + '/' + c.brightWhite + maxAgents + c.reset + ']  ' +
-    c.brightPurple + '👥 ' + subAgents + c.reset + '    ' +
-    c.brightBlue + '🪝 ' + hooksColor + hooksEnabled + c.reset + '/' + c.brightWhite + hooksTotal + c.reset + '    ' +
-    secIcon + ' ' + secColor + 'CVE ' + cvesFixed + c.reset + '/' + c.brightWhite + totalCves + c.reset + '    ' +
-    c.brightCyan + '💾 ' + memoryMB + 'MB' + c.reset + '    ' +
-    intellColor + '🧠 ' + String(intelligencePct).padStart(3) + '%' + c.reset
-  );
-
-  // Line 3: Architecture
-  const dddColor = dddProgress >= 50 ? c.brightGreen : dddProgress > 0 ? c.yellow : c.red;
-  const adrColor = adrCount > 0 ? (adrImpl === adrCount ? c.brightGreen : c.yellow) : c.dim;
-  const adrDisplay = adrColor + '●' + adrImpl + '/' + adrCount + c.reset;
-
-  lines.push(
-    c.brightPurple + '🔧 Architecture' + c.reset + '    ' +
-    c.cyan + 'ADRs' + c.reset + ' ' + adrDisplay + '  ' + c.dim + '│' + c.reset + '  ' +
-    c.cyan + 'DDD' + c.reset + ' ' + dddColor + '●' + String(dddProgress).padStart(3) + '%' + c.reset + '  ' + c.dim + '│' + c.reset + '  ' +
-    c.cyan + 'Security' + c.reset + ' ' + secColor + '●' + secStatus + c.reset
-  );
-
-  // Line 4: AgentDB, Tests, Integration
-  const hnswInd = hasHnsw ? c.brightGreen + '⚡' + c.reset : '';
-  const sizeDisp = dbSizeKB >= 1024 ? (dbSizeKB / 1024).toFixed(1) + 'MB' : dbSizeKB + 'KB';
-  const vectorColor = vectorCount > 0 ? c.brightGreen : c.dim;
-  const testColor = testFiles > 0 ? c.brightGreen : c.dim;
-
-  // MCP / DB integration from data
-  const integration = d.integration || {};
-  const mcpServers = (integration.mcpServers) || {};
-  let integStr = '';
-  if (mcpServers.total > 0) {
-    const mcpCol = mcpServers.enabled === mcpServers.total ? c.brightGreen : mcpServers.enabled > 0 ? c.brightYellow : c.red;
-    integStr += c.cyan + 'MCP' + c.reset + ' ' + mcpCol + '●' + mcpServers.enabled + '/' + mcpServers.total + c.reset;
+// ─── Funnel promo row (ADR-301) ─────────────────────────────────
+// Allowlist for OSC 8 hyperlink targets. Ships in code (not in payload) so
+// no message can smuggle a link to an unapproved host.
+//
+// The final destination hosts (cognitum.one / agentics.org) AND the
+// click-redirect host are both allowlisted here: promo.ts routes every
+// clickable message through the server-side click-redirect (ADR-311 §7)
+// so promo_open + geo are captured before the 302 to the real target —
+// so the OSC 8 link the renderer emits points at the redirect host, not
+// the final destination directly.
+const PROMO_LINK_HOSTS = new Set([
+  'cognitum.one', 'www.cognitum.one', 'docs.cognitum.one',
+  // agentics.org — OSS foundation, distinct sponsor domain. Kept in sync
+  // with messages.ts ALLOWED_URL_HOSTS.
+  'agentics.org', 'www.agentics.org',
+  // Click-redirect host (funnel.ruv.io once its TLS cert is live; the raw
+  // Cloud Run hostname is allowlisted too since event-transport.ts /
+  // message-transport.ts / attribution.ts currently point at it as a TEMP
+  // fallback while the domain mapping's cert provisions).
+  'funnel.ruv.io',
+  'cognitum-analytics-63rzcdswba-uc.a.run.app',
+]);
+
+// Emit OSC 8 hyperlinks unless the environment is known-broken. tmux mangles
+// raw OSC 8 (see anthropics/claude-code#27047) — opt in via env if wrapped.
+function terminalSupportsHyperlinks() {
+  if (process.env.CI || process.env.GITHUB_ACTIONS) return false;
+  if (process.env.TERM === 'dumb') return false;
+  if (/^(0|false|off|no)$/i.test(String(process.env.RUFLO_STATUSLINE_HYPERLINKS || ''))) return false;
+  if (process.env.TMUX && !process.env.RUFLO_STATUSLINE_HYPERLINKS_TMUX) return false;
+  return true;
+}
+
+// Wrap a label in an OSC 8 hyperlink escape sequence. Falls back to the raw
+// label whenever the URL is not an allowlisted https target, when the terminal
+// can't render hyperlinks, or when parsing fails — a broken link must never
+// leave a raw URL or stray escape in the statusline output.
+function safeTerminalLink(label, url) {
+  if (!terminalSupportsHyperlinks()) return label;
+  if (typeof url !== 'string' || url.length === 0) return label;
+  let parsed;
+  try { parsed = new URL(url); } catch { return label; }
+  if (parsed.protocol !== 'https:') return label;
+  if (!PROMO_LINK_HOSTS.has(parsed.hostname)) return label;
+  const cleanLabel = String(label).replace(/[\\u0000-\\u001f\\u007f-\\u009f\\u202a-\\u202e\\u2066-\\u2069]/g, '');
+  if (cleanLabel.length === 0) return label;
+  const ESC = '\\u001b';
+  return ESC + ']8;;' + parsed.href + ESC + '\\\\' + cleanLabel + ESC + ']8;;' + ESC + '\\\\';
+}
+
+function getPromoRow(d) {
+  try {
+    if (process.env.CI || process.env.GITHUB_ACTIONS) return null;
+    if (/^(0|false|off|no)$/i.test(String(process.env.RUFLO_FUNNEL || ''))) return null;
+    const promo = d && d.promo;
+    if (!promo || typeof promo.text !== 'string') return null;
+    // Strip control chars / ANSI / bidi overrides and hard-cap length —
+    // promo copy is data and must never emit its own terminal sequences.
+    const text = promo.text
+      .replace(/[\\u0000-\\u001f\\u007f-\\u009f\\u202a-\\u202e\\u2066-\\u2069]/g, '')
+      .slice(0, 100)
+      .trim();
+    if (text.length === 0) return null;
+    // Split the label from the trailing "· manage: ruflo settings" instruction
+    // so each part gets styling that matches what it actually IS:
+    //   1. label   — OSC 8 hyperlink + underline. A real clickable link.
+    //   2. "manage:" — dim. Just a connector word, no action implied.
+    //   3. "ruflo settings" — bold/bright, NOT underlined. This is a shell
+    //      command the user TYPES, not a link they CLICK — a terminal can
+    //      never safely execute a command from a click (that would let any
+    //      server-served message run arbitrary commands), so we deliberately
+    //      avoid the underline/OSC8 cues that imply "clickable". Bold+bright
+    //      instead signals "this is the important bit — copy/type it".
+    // Educational tips have no manage tail and no URL — plain text through.
+    const manageIdx = text.indexOf(' · manage: ');
+    const label = manageIdx > 0 ? text.slice(0, manageIdx) : text;
+    const manageWord = manageIdx > 0 ? ' · manage: ' : '';
+    const command = manageIdx > 0 ? text.slice(manageIdx + manageWord.length) : '';
+    const UL_ON = '\\u001b[4m';
+    const UL_OFF = '\\u001b[24m';
+    const DIM_ON = '\\u001b[2m';
+    const DIM_OFF = '\\u001b[22m';
+    const BOLD_ON = '\\u001b[1m';
+    const BOLD_OFF = '\\u001b[22m';
+    const linked = promo.url ? UL_ON + safeTerminalLink(label, promo.url) + UL_OFF : label;
+    if (!command) return linked;
+    return linked + DIM_ON + manageWord + DIM_OFF + BOLD_ON + command + BOLD_OFF;
+  } catch (e) {
+    return null; // the promo row must never break the statusline
   }
-  if (integration.hasDatabase) integStr += (integStr ? '  ' : '') + c.brightGreen + '◆' + c.reset + 'DB';
-  if (!integStr) integStr = c.dim + '● none' + c.reset;
-
-  lines.push(
-    c.brightCyan + '📊 AgentDB' + c.reset + '    ' +
-    c.cyan + 'Vectors' + c.reset + ' ' + vectorColor + '●' + vectorCount + hnswInd + c.reset + '  ' + c.dim + '│' + c.reset + '  ' +
-    c.cyan + 'Size' + c.reset + ' ' + c.brightWhite + sizeDisp + c.reset + '  ' + c.dim + '│' + c.reset + '  ' +
-    c.cyan + 'Tests' + c.reset + ' ' + testColor + '●' + testFiles + c.reset + ' ' + c.dim + '(~' + testCases + ' cases)' + c.reset + '  ' + c.dim + '│' + c.reset + '  ' +
-    integStr
-  );
-
-  return lines.join('\\n');
 }
 
 // JSON output — delegates to CLI for accuracy; caller can use --json flag

package/dist/src/services/daemon-autostart.js

@@ -10,7 +10,17 @@
  *     own lock + checkExistingDaemon() — so a race spawns at most one survivor,
  *   - bounded lifetime: the daemon self-terminates on TTL/idle (12h default,
  *     RUFLO_DAEMON_TTL_SECS) — auto-start never means "runs forever",
- *   - opt-out: RUFLO_DAEMON_AUTOSTART=0|false|no disables it entirely,
+ *   - opt-out: RUFLO_DAEMON_AUTOSTART=0|false|no disables it entirely, OR a
+ *     project-local `daemon.autostart: false` in claude-flow.config.json —
+ *     the file-based opt-out exists because the env var only reaches a
+ *     process that inherited it. A non-interactive shell (cron, CI, many
+ *     tool-invoked shells — bash skips ~/.bashrc entirely for these; see
+ *     its own `case $- in *i*) ;; *) return;; esac` guard) never re-sources
+ *     a shell rc file per invocation, so `export RUFLO_DAEMON_AUTOSTART=0`
+ *     in one such shell does NOT persist to the next one. A project config
+ *     field has no such gap — it's read fresh from disk every time,
+ *     independent of which shell (or whether any shell at all) launched
+ *     the command,
  *   - cheap: a pidfile read + a signal-0 liveness check on the fast path,
  *   - best-effort + silent: never blocks or fails a command.
  *
@@ -41,8 +51,21 @@ export function isDaemonAlive(projectRoot) {
         return false;
     }
 }
-function autostartDisabled() {
-    return /^(0|false|no|off)$/i.test(process.env.RUFLO_DAEMON_AUTOSTART ?? '');
+/** Project-local opt-out: `{ "daemon": { "autostart": false } }` in claude-flow.config.json. */
+function autostartDisabledByProjectConfig(projectRoot) {
+    try {
+        const raw = fs.readFileSync(path.join(projectRoot, 'claude-flow.config.json'), 'utf-8');
+        const cfg = JSON.parse(raw);
+        return cfg?.daemon?.autostart === false;
+    }
+    catch {
+        return false; // absent/malformed config = not disabled
+    }
+}
+function autostartDisabled(projectRoot) {
+    if (/^(0|false|no|off)$/i.test(process.env.RUFLO_DAEMON_AUTOSTART ?? ''))
+        return true;
+    return autostartDisabledByProjectConfig(projectRoot);
 }
 const defaultSpawn = (projectRoot) => {
     const cliBin = process.argv[1]; // the running bin/cli.js
@@ -60,8 +83,8 @@ const defaultSpawn = (projectRoot) => {
  */
 export function ensureDaemonRunning(projectRoot, opts = {}) {
     try {
-        if (autostartDisabled())
-            return { started: false, reason: 'disabled (RUFLO_DAEMON_AUTOSTART=0)' };
+        if (autostartDisabled(projectRoot))
+            return { started: false, reason: 'disabled (RUFLO_DAEMON_AUTOSTART=0 or project config)' };
         // Only in an initialized project (avoid scaffolding a daemon in a random dir).
         if (!fs.existsSync(path.join(projectRoot, '.claude-flow')) && !fs.existsSync(path.join(projectRoot, '.claude'))) {
             return { started: false, reason: 'not a ruflo project' };

package/dist/src/services/fable-harness.d.ts

@@ -79,6 +79,36 @@ export interface ReflectResult {
     diagnosis: string;
     mutationHint: string;
 }
+/**
+ * ADR-316 — a compact, STRUCTURAL-ONLY snapshot of the current coding
+ * session for the statusline's co-pilot advisor tip. Every field here
+ * mirrors funnel/insights.ts's LocalInsightContext — no raw prompt/command/
+ * file content, ever (same bar as ADR-309, applied to a different, opt-in
+ * data flow). The model sees only what's already surfaced structurally
+ * elsewhere in the statusline.
+ */
+export interface CoPilotSnapshot {
+    security?: {
+        status: string;
+        cvesFixed: number;
+        totalCves: number;
+    };
+    swarm?: {
+        activeAgents: number;
+        maxAgents: number;
+        coordinationActive: boolean;
+    };
+    gitUncommittedCount?: number;
+    contextPctUsed?: number;
+}
+/** A single proactive suggestion for the insight ticker. */
+export interface CoPilotTip {
+    /** Short enough for a single statusline row (caller truncates further). */
+    headline: string;
+    /** One actionable sentence of extra detail. */
+    detail: string;
+    confidence: number;
+}
 /** Result of a raw claude spawn. */
 export interface ClaudeSpawnResult {
     stdout: string;
@@ -147,6 +177,15 @@ export declare class FableHarness {
      * discipline as judgeBatch. Returns [] when no budget cap is configured.
      */
     reflectFailures(items: ReflectItem[]): Promise<ReflectResult[]>;
+    /**
+     * ADR-316 — one proactive co-pilot tip from a structural session snapshot
+     * (no raw prompt/command/file content). A single-item "batch" — same
+     * budget/cwd/parsing discipline as judgeBatch/reflectFailures, just with
+     * exactly one call instead of a loop. Returns null when disabled, over
+     * budget, or the model found nothing worth surfacing (an empty verdict
+     * array is a valid, non-error answer here, not a parse failure).
+     */
+    adviseCoPilotTip(snapshot: CoPilotSnapshot): Promise<CoPilotTip | null>;
     /** Build the argv for a `claude -p` call. Exposed shape for testability. */
     buildArgv(systemPrompt: string): string[];
     /**