@claude-flow/cli 3.32.9 → 3.32.10

package/dist/src/commands/ruvector/status.js

@@ -177,8 +177,8 @@ export const statusCommand = {
                 spinner.setText('Checking vector extension...');
             spinner.start();
             // Check for ruvector first
-            const ruvectorResult = await client.query(`
-        SELECT extname, extversion FROM pg_extension WHERE extname = 'ruvector'
+            const ruvectorResult = await client.query(`
+        SELECT extname, extversion FROM pg_extension WHERE extname = 'ruvector'
       `);
             if (ruvectorResult.rows.length > 0) {
                 statusData.pgvector = {
@@ -192,8 +192,8 @@ export const statusCommand = {
             }
             else {
                 // Fall back to pgvector
-                const pgvectorResult = await client.query(`
-          SELECT extname, extversion FROM pg_extension WHERE extname = 'vector'
+                const pgvectorResult = await client.query(`
+          SELECT extname, extversion FROM pg_extension WHERE extname = 'vector'
         `);
                 if (pgvectorResult.rows.length > 0) {
                     statusData.pgvector = {
@@ -216,8 +216,8 @@ export const statusCommand = {
             if (!jsonOutput)
                 spinner.setText(`Checking schema "${config.schema}"...`);
             spinner.start();
-            const schemaResult = await client.query(`
-        SELECT schema_name FROM information_schema.schemata WHERE schema_name = $1
+            const schemaResult = await client.query(`
+        SELECT schema_name FROM information_schema.schemata WHERE schema_name = $1
       `, [config.schema]);
             if (schemaResult.rows.length === 0) {
                 statusData.ruvector = { initialized: false };
@@ -238,8 +238,8 @@ export const statusCommand = {
                 spinner.setText('Loading RuVector metadata...');
             spinner.start();
             try {
-                const metadataResult = await client.query(`
-          SELECT key, value FROM ${config.schema}.metadata
+                const metadataResult = await client.query(`
+          SELECT key, value FROM ${config.schema}.metadata
         `);
                 const metadata = {};
                 for (const row of metadataResult.rows) {
@@ -263,23 +263,23 @@ export const statusCommand = {
             if (!jsonOutput)
                 spinner.setText('Gathering table statistics...');
             spinner.start();
-            const tablesResult = await client.query(`
-        SELECT
-          t.table_name,
-          pg_relation_size(quote_ident(t.table_schema) || '.' || quote_ident(t.table_name)) as table_size,
-          pg_total_relation_size(quote_ident(t.table_schema) || '.' || quote_ident(t.table_name)) as total_size,
-          (SELECT count(*) FROM ${config.schema}.embeddings) as row_count
-        FROM information_schema.tables t
-        WHERE t.table_schema = $1
-        ORDER BY t.table_name
+            const tablesResult = await client.query(`
+        SELECT
+          t.table_name,
+          pg_relation_size(quote_ident(t.table_schema) || '.' || quote_ident(t.table_name)) as table_size,
+          pg_total_relation_size(quote_ident(t.table_schema) || '.' || quote_ident(t.table_name)) as total_size,
+          (SELECT count(*) FROM ${config.schema}.embeddings) as row_count
+        FROM information_schema.tables t
+        WHERE t.table_schema = $1
+        ORDER BY t.table_name
       `, [config.schema]);
             const tableStats = [];
             for (const row of tablesResult.rows) {
                 // Get row count for each table
                 let rowCount = 0;
                 try {
-                    const countResult = await client.query(`
-            SELECT count(*) as cnt FROM ${config.schema}.${row.table_name}
+                    const countResult = await client.query(`
+            SELECT count(*) as cnt FROM ${config.schema}.${row.table_name}
           `);
                     rowCount = parseInt(countResult.rows[0].cnt, 10);
                 }
@@ -301,21 +301,21 @@ export const statusCommand = {
                 if (!jsonOutput)
                     spinner.setText('Gathering index information...');
                 spinner.start();
-                const indexResult = await client.query(`
-          SELECT
-            i.relname as index_name,
-            t.relname as table_name,
-            am.amname as index_type,
-            pg_relation_size(i.oid) as index_size,
-            idx.indisvalid as is_valid,
-            idx.indisunique as is_unique
-          FROM pg_index idx
-          JOIN pg_class i ON i.oid = idx.indexrelid
-          JOIN pg_class t ON t.oid = idx.indrelid
-          JOIN pg_namespace n ON n.oid = t.relnamespace
-          JOIN pg_am am ON am.oid = i.relam
-          WHERE n.nspname = $1
-          ORDER BY t.relname, i.relname
+                const indexResult = await client.query(`
+          SELECT
+            i.relname as index_name,
+            t.relname as table_name,
+            am.amname as index_type,
+            pg_relation_size(i.oid) as index_size,
+            idx.indisvalid as is_valid,
+            idx.indisunique as is_unique
+          FROM pg_index idx
+          JOIN pg_class i ON i.oid = idx.indexrelid
+          JOIN pg_class t ON t.oid = idx.indrelid
+          JOIN pg_namespace n ON n.oid = t.relnamespace
+          JOIN pg_am am ON am.oid = i.relam
+          WHERE n.nspname = $1
+          ORDER BY t.relname, i.relname
         `, [config.schema]);
                 statusData.indexes = indexResult.rows.map(row => ({
                     name: row.index_name,
@@ -333,10 +333,10 @@ export const statusCommand = {
                 spinner.setText('Checking migration status...');
             spinner.start();
             try {
-                const migrationsResult = await client.query(`
-          SELECT version, name, applied_at
-          FROM ${config.schema}.migrations
-          ORDER BY version ASC
+                const migrationsResult = await client.query(`
+          SELECT version, name, applied_at
+          FROM ${config.schema}.migrations
+          ORDER BY version ASC
         `);
                 statusData.migrations = migrationsResult.rows.map(row => ({
                     version: row.version,

package/dist/src/config/proven-config.js

@@ -20,8 +20,8 @@
  */
 import { createHash, verify as edVerify, sign as edSign } from 'crypto';
 /** Ruflo config-signing PUBLIC key (safe to commit). Private half in GCP Secret Manager (ruflo-config-signing-key). */
-export const RUFLO_CONFIG_PUBKEY = `-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEA3zr3BLCFKyrjvjZg9BXxchXIuGYwYwq21FYCjTpQO6A=
+export const RUFLO_CONFIG_PUBKEY = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEA3zr3BLCFKyrjvjZg9BXxchXIuGYwYwq21FYCjTpQO6A=
 -----END PUBLIC KEY-----`;
 export function sha256Hex(content) {
     return createHash('sha256').update(content).digest('hex');

package/dist/src/funnel/disclosure.js

@@ -21,6 +21,7 @@
  */
 import { readStateJson, writeStateJson } from './state.js';
 import { getRemoteMessages } from './message-transport.js';
+import { MESSAGES, eligibleMessagesFromPools } from './messages.js';
 const DISCLOSURE_FILE = 'funnel-disclosure.json';
 /** How long the disclosure text keeps the row before promo becomes eligible. */
 export const DISCLOSURE_GRACE_MS = 24 * 60 * 60 * 1000; // 24h
@@ -29,9 +30,19 @@ export const DISCLOSURE_GRACE_MS = 24 * 60 * 60 * 1000; // 24h
 // same variant long enough to read it, but short enough that a fresh
 // session gets a different one than the previous one did.
 export const DISCLOSURE_ROTATION_SLOT_MS = 5 * 60 * 1000;
-/** Remote-cached messages tagged class==='disclosure' — the only source. */
+/**
+ * Disclosure pool: remote-cached messages tagged class==='disclosure',
+ * MERGED with the local seed pool by id (remote wins on collision).
+ *
+ * The remote pool is authoritative when populated. The local seed exists
+ * so cold-start renders (before the first remote fetch lands) can still
+ * unlock the disclosure gate — otherwise every new install sees a blank
+ * promo row until the first fetch succeeds. Same merge semantics as
+ * rotation.ts's `eligibleMessagesFromPools` (issue #2787 / 2026-07-26 sweep).
+ */
 function getDisclosureMessagePool() {
-    return getRemoteMessages().filter((m) => m.class === 'disclosure');
+    return eligibleMessagesFromPools(MESSAGES, getRemoteMessages())
+        .filter((m) => m.class === 'disclosure');
 }
 /**
  * Deterministic slot-based selection over the remote disclosure pool — no

package/dist/src/funnel/messages.d.ts

@@ -28,18 +28,20 @@ export declare function isAllowedUrl(url: string): boolean;
  */
 export declare function isValidMessage(msg: unknown, now?: Date): msg is FunnelMessage;
 /**
- * Local promo/message content: INTENTIONALLY EMPTY (ADR-311 amendment).
+ * Local promo/message content: cold-start seed (ADR-311 amendment
+ * revisited, issue #2787).
  *
- * All rotation content (educational tips, promotional messages, and the
- * disclosure notice) is served exclusively from the remote message feed
- * (GET /v1/messages -> message-transport.ts -> Firestore). Zero message
- * text or URLs ship in the CLI package.
+ * The remote pool is authoritative — `eligibleMessagesFromPools` in
+ * `rotation.ts` merges by id with remote winning — but on new installs
+ * the remote fetch races the very first render and the promo row shows
+ * NOTHING until the pool has been fetched at least once. The disclosure
+ * gate can't unlock either, so several 20-second slots go by blank.
  *
- * Fail-closed by design: if the remote feed is unreachable (network down,
- * cert issue, server outage) and no prior successful fetch has populated
- * the local cache, the rotation has nothing to show and the promo row
- * simply does not render that cycle. There is no local content to fall
- * back to -- this is a deliberate choice, not an oversight.
+ * The fix is a small local seed of educational tips, one bootstrap
+ * disclosure, and a single sponsor promo, all validating cleanly through
+ * `isValidMessage` and using only URLs on the exact-host allowlist. Each
+ * carries a stable id so the remote pool can override or retire any of
+ * them without a CLI release.
  */
 export declare const MESSAGES: FunnelMessage[];
 /** Messages that survive every content boundary right now. */

package/dist/src/funnel/messages.js

@@ -111,20 +111,92 @@ export function isValidMessage(msg, now = new Date()) {
     return true;
 }
 /**
- * Local promo/message content: INTENTIONALLY EMPTY (ADR-311 amendment).
+ * Local promo/message content: cold-start seed (ADR-311 amendment
+ * revisited, issue #2787).
  *
- * All rotation content (educational tips, promotional messages, and the
- * disclosure notice) is served exclusively from the remote message feed
- * (GET /v1/messages -> message-transport.ts -> Firestore). Zero message
- * text or URLs ship in the CLI package.
+ * The remote pool is authoritative — `eligibleMessagesFromPools` in
+ * `rotation.ts` merges by id with remote winning — but on new installs
+ * the remote fetch races the very first render and the promo row shows
+ * NOTHING until the pool has been fetched at least once. The disclosure
+ * gate can't unlock either, so several 20-second slots go by blank.
  *
- * Fail-closed by design: if the remote feed is unreachable (network down,
- * cert issue, server outage) and no prior successful fetch has populated
- * the local cache, the rotation has nothing to show and the promo row
- * simply does not render that cycle. There is no local content to fall
- * back to -- this is a deliberate choice, not an oversight.
+ * The fix is a small local seed of educational tips, one bootstrap
+ * disclosure, and a single sponsor promo, all validating cleanly through
+ * `isValidMessage` and using only URLs on the exact-host allowlist. Each
+ * carries a stable id so the remote pool can override or retire any of
+ * them without a CLI release.
  */
-export const MESSAGES = [];
+export const MESSAGES = [
+    {
+        schemaVersion: 1,
+        id: 'local.disclosure.v1',
+        class: 'disclosure',
+        text: 'Ruflo shows occasional tips and sponsor notes here · manage: ruflo settings',
+    },
+    {
+        schemaVersion: 1,
+        id: 'local.edu.status-watch',
+        class: 'educational',
+        text: '📊 ruflo status watch — real-time system + swarm health dashboard',
+        url: 'https://cognitum.one/docs/statusline',
+    },
+    {
+        schemaVersion: 1,
+        id: 'local.edu.memory-search',
+        class: 'educational',
+        text: '🧠 ruflo memory search — semantic search over your project decisions',
+        url: 'https://cognitum.one/docs/memory',
+    },
+    {
+        schemaVersion: 1,
+        id: 'local.edu.swarm-init',
+        class: 'educational',
+        text: '🐝 ruflo swarm init — hierarchical anti-drift multi-agent coordination',
+        url: 'https://cognitum.one/docs/swarm',
+    },
+    {
+        schemaVersion: 1,
+        id: 'local.edu.security-scan',
+        class: 'educational',
+        text: '🔒 ruflo security scan --depth full — audits dependencies and config',
+        url: 'https://cognitum.one/docs/security',
+    },
+    {
+        schemaVersion: 1,
+        id: 'local.edu.doctor',
+        class: 'educational',
+        text: '🩺 ruflo doctor --fix — diagnose and auto-repair install issues',
+        url: 'https://cognitum.one/docs/doctor',
+    },
+    {
+        schemaVersion: 1,
+        id: 'local.edu.hooks-route',
+        class: 'educational',
+        text: '🪝 ruflo hooks route — 3-tier model routing cuts token cost 30–75%',
+        url: 'https://cognitum.one/docs/hooks',
+    },
+    {
+        schemaVersion: 1,
+        id: 'local.edu.adr-index',
+        class: 'educational',
+        text: '📚 ruflo adr index — every architecture decision indexed and searchable',
+        url: 'https://github.com/ruvnet/ruflo/tree/main/docs/adr',
+    },
+    {
+        schemaVersion: 1,
+        id: 'local.edu.agent-spawn',
+        class: 'educational',
+        text: '⚡ ruflo agent spawn -t coder — background agents with anti-drift topology',
+        url: 'https://cognitum.one/docs/agents',
+    },
+    {
+        schemaVersion: 1,
+        id: 'local.promo.cognitum',
+        class: 'promotional',
+        text: '✨ Cognitum • sponsored capacity for community jobs · manage: ruflo settings',
+        url: 'https://cognitum.one',
+    },
+];
 /** Messages that survive every content boundary right now. */
 export function eligibleMessages(now = new Date()) {
     return MESSAGES.filter((m) => isValidMessage(m, now));