agentic-qe 3.13.10 → 3.13.11

package/.claude/helpers/statusline.cjs

@@ -1,4 +1,570 @@
 #!/usr/bin/env node
+/* ruflo-seg:BEGIN */
+function rufloActivationSegments(cwd){
+  try {
+    var fs = require("fs"), path = require("path"), cp = require("child_process");
+    var RED = "\x1b[1;31m";   // alarm-only segments (aidefence OFF) — matches ruflo's own brightRed
+    var DIM = "", G = "", Y = "", C = "", R = "";
+    // execFileSync (no shell) — db path / sql are passed as argv, never interpolated into a command line.
+    function q(db, sql){ try { return cp.execFileSync("sqlite3", [db, sql], {stdio:["ignore","pipe","ignore"], timeout:1500}).toString().trim(); } catch(e){ return ""; } }
+    function bar(n, max){ n = Math.max(0, Math.min(max, n)); return "[" + "●".repeat(n) + "○".repeat(max - n) + "]"; }
+    // ── self-learning (SONA): own line with a volume bar (patterns/traj/HNSW) plus a
+    // LIVE micro-LoRA adaptation field (Δ‖W‖, appended further below). The Δ‖W‖ tracker
+    // is maintained inline in this same function — see the "micro-LoRA LIVE adaptation"
+    // block after the route-Q segment.
+    var learn = "";
+    try {
+      var sp = path.join(cwd, ".claude-flow", "neural", "stats.json");
+      if (fs.existsSync(sp)) {
+        var s = JSON.parse(fs.readFileSync(sp, "utf8"));
+        var pn = s.patternsLearned || 0, tj = s.trajectoriesRecorded || 0, parts = [];
+        if (pn > 0 || tj > 0) {
+          if (pn > 0) parts.push(pn + " patterns");
+          if (tj > 0) parts.push(tj + " traj");
+          if (fs.existsSync(path.join(cwd, ".swarm", "hnsw.index"))) parts.push(G + "⚡ HNSW" + R);
+          var dots = Math.max(0, Math.min(5, Math.round(pn / 10)));   // volume gauge: ~10 patterns per dot
+          learn = C + "🧠 SONA" + R + "  " + DIM + bar(dots, 5) + R + "  " + parts.join(DIM + " · " + R);
+        }
+      }
+    } catch(e){}
+    // ── micro-LoRA LIVE adaptation: Δ‖W‖<cum> +<session> <trend> n<count> ──
+    // Shows the model ACTUALLY ADAPTING FROM YOUR WORK, live. ruflo's own micro-LoRA is
+    // per-process scratch ("resets per process", intelligence.js) — every hook reinits it
+    // (random A, B=0), applies that call's signals, then DISCARDS the weights; only
+    // patterns.json / stats.json persist. So the kit persists what ruflo throws away: a
+    // single cumulative micro-LoRA in lora-live.json, advanced HERE (inline, mtime+TTL
+    // gated) by feeding each NEW distilled pattern ruflo has learned from your work
+    // (.claude-flow/neural/patterns.json) through the genuine @ruvector/ruvllm 2.5.6
+    // gradient path (real since F4 fixed), weighted by ruflo's OWN per-pattern confidence
+    // (no fabricated reward). The init RNG is seeded and weights are restored each tick, so
+    // the result is DETERMINISTIC (no 41%-CV random-init noise) and cumulative.
+    //   Δ‖W‖ = ‖scaling·(A·B)‖_F  (federated-LoRA's standard adaptation-magnitude monitor)
+    //   +<session> = growth since this session began (the live "from your work" signal)
+    //   n = distinct patterns fed (REINFORCE updates).  Gate: cum norm > 0.
+    // Honest scope: a kit-persisted MIRROR of ruflo's discarded adapter, fed ruflo's real
+    // confidence-weighted patterns. NOT shown: amplification factor (no frozen base W) and
+    // a live reward curve (neural-train's WASM path records trajectories, not signals → 0).
+    try {
+      var nd = path.join(cwd, ".claude-flow", "neural");
+      var pPath = path.join(nd, "patterns.json"), sPath = path.join(nd, "lora-live.json");
+      if (fs.existsSync(pPath)) {
+        var st = null; try { st = JSON.parse(fs.readFileSync(sPath, "utf8")); } catch(e){}
+        var nowS = Math.floor(Date.now() / 1000);
+        var pMtimeMs = fs.statSync(pPath).mtimeMs;   // ms precision: same-second writes still detected
+        var TTL = Number(process.env.RUFLO_LORA_TTL_S || 60);
+        // Session boundary: prefer Claude Code's real session_id (piped on stdin) so the
+        // +<session> delta resets exactly when YOU start a new session — not on a clock.
+        // getStdinData() is the host statusline's cached single-read of that JSON; guard the
+        // call so the segment still works on a template that lacks it, or run standalone.
+        var sid = "";
+        try { if (typeof getStdinData === "function") { var _sd = getStdinData(); sid = (_sd && (_sd.session_id || _sd.sessionId)) || ""; } } catch(e){}
+        // Refresh when: no state yet, the session changed (reset the +session baseline even
+        // with no new patterns), or patterns changed and the TTL has elapsed.
+        var sidChanged = !!(sid && st && (st.sessionId || "") !== sid);
+        var stale = !st || sidChanged || (pMtimeMs > (st.pms || 0) && (nowS - (st.ts || 0)) >= TTL);
+        if (stale) {
+          // Resolve the installed ruvllm SonaCoordinator (same global layout as the version probe).
+          var SC = null;
+          try {
+            var sj = path.join(path.dirname(process.execPath), "..", "lib", "node_modules", "ruflo",
+                               "node_modules", "@ruvector", "ruvllm", "dist", "cjs", "sona.js");
+            if (fs.existsSync(sj)) SC = require(sj).SonaCoordinator;
+          } catch(e){}
+          if (SC) {
+            var pats = JSON.parse(fs.readFileSync(pPath, "utf8"));
+            // Seed Math.random so the first-ever loraA init is deterministic; restore after ctor.
+            var seed = 0x9e3779b9, orig = Math.random;
+            Math.random = function(){ seed = (seed * 1103515245 + 12345) & 0x7fffffff; return seed / 0x7fffffff; };
+            var coord = new SC({ backgroundLoopEnabled: false });
+            Math.random = orig;
+            var applied = new Set((st && st.appliedIds) || []);
+            var n = (st && st.n) || 0;
+            if (st && st.loraA) { try { coord.microLora.setWeights({ loraA: st.loraA, loraB: st.loraB, scaling: st.scaling }); } catch(e){} }
+            var prevSid = st ? (st.sessionId || "") : "";
+            var newSession;
+            if (sid) {
+              newSession = !st || prevSid !== sid;          // real per-session boundary
+            } else {
+              newSession = !st || (nowS - (st.ts || 0) > 1800);  // no id (manual run): idle fallback
+              sid = prevSid;                                // preserve the session we're in
+            }
+            var sessionBase = newSession ? (st ? (st.deltaNorm || 0) : 0) : (st.sessionBase || 0);
+            var sessionTs = newSession ? nowS : (st.sessionTs || nowS);
+            for (var i = 0; i < (Array.isArray(pats) ? pats.length : 0); i++) {
+              var p = pats[i], id = String(p.id || i);
+              if (applied.has(id)) continue;
+              var conf = (typeof p.confidence === "number") ? p.confidence : Number(p.confidence);
+              coord.recordSignal({ requestId: id, type: p.type || "pattern",
+                                   quality: (conf >= 0 && conf <= 1) ? conf : 0.7, correction: String(p.content || id) });
+              applied.add(id); n++;
+            }
+            var w = coord.microLora.getWeights(), nm = coord.stats().microLora.deltaNorm;
+            var rec = { loraA: w.loraA, loraB: w.loraB, scaling: w.scaling, appliedIds: Array.from(applied),
+                        n: n, deltaNorm: nm, sessionBase: sessionBase, sessionTs: sessionTs, sessionId: sid,
+                        pms: pMtimeMs, ts: nowS };
+            try { var tmp = sPath + ".tmp"; fs.writeFileSync(tmp, JSON.stringify(rec)); fs.renameSync(tmp, sPath); } catch(e){}
+            st = rec;
+          }
+        }
+        if (st && typeof st.deltaNorm === "number" && st.deltaNorm > 0) {
+          var sess = st.deltaNorm - (st.sessionBase || 0);
+          var trend = "";
+          if (Math.abs(sess) / st.deltaNorm < 0.005) trend = DIM + "→" + R;
+          else trend = sess > 0 ? (G + "▲" + R) : (Y + "▼" + R);
+          var sessStr = (Math.abs(sess) / st.deltaNorm >= 0.005)
+            ? (" " + (sess > 0 ? G : Y) + (sess > 0 ? "+" : "") + sess.toFixed(4) + R) : "";
+          var dseg = C + "Δ‖W‖" + st.deltaNorm.toFixed(4) + R + sessStr + trend + DIM + " n" + st.n + R;
+          if (learn) { learn += DIM + " · " + R + dseg; }
+          else { learn = C + "🧠 Δ LoRA" + R + "  " + dseg; }
+        }
+      }
+    } catch(e){}
+    // ── route Q-learner (📈 RL): live agent-routing metrics, fs-only, honesty-gated ──
+    // F3 (ruvnet/ruflo#2239) is fixed in ruflo 3.10.11 (FNV-1a lossless fold) — the
+    // state encoder no longer collapses keyword-distinct tasks, so |Q| is a
+    // real task-diversity count. Source the persisted Q-model directly; never the broken
+    // `route stats` CLI. Gate hard: render ONLY when the learner has actually run
+    // (updateCount>0), else emit nothing — no zero-state noise.
+    var route = "";
+    try {
+      var qp = path.join(cwd, ".swarm", "q-learning-model.json");
+      if (fs.existsSync(qp)) {
+        var qm = JSON.parse(fs.readFileSync(qp, "utf8"));
+        var st = qm.stats || {};
+        var upd = st.updateCount || 0;
+        if (upd > 0) {
+          var eps = typeof st.epsilon === "number" ? st.epsilon : null;
+          var td = typeof st.avgTDError === "number" ? st.avgTDError : null;
+          var qn = qm.qTable && typeof qm.qTable === "object" ? Object.keys(qm.qTable).length : 0;
+          var rp = [];
+          if (eps !== null) rp.push("ε" + eps.toFixed(2) + DIM + "↓" + R);
+          if (td !== null) rp.push("δ̄" + td.toFixed(3) + DIM + "↓" + R);
+          if (qn > 0) rp.push("|Q|" + qn);
+          rp.push("upd" + upd);
+          route = C + "📈 RL" + R + "  " + rp.join(DIM + " · " + R);
+        }
+      } else {
+        // Fallback: ruflo's metrics surface (no broken route-stats CLI). Only when it
+        // reflects real routing decisions.
+        var lp = path.join(cwd, ".claude-flow", "metrics", "learning.json");
+        if (fs.existsSync(lp)) {
+          var lj = JSON.parse(fs.readFileSync(lp, "utf8"));
+          var rt = lj.routing || {};
+          if ((rt.decisions || 0) > 0) {
+            var rp2 = [];
+            if (typeof rt.accuracy === "number") rp2.push("acc" + Math.round(rt.accuracy * 100) + "%");
+            rp2.push("dec" + rt.decisions);
+            route = C + "📈 RL" + R + "  " + rp2.join(DIM + " · " + R);
+          }
+        }
+      }
+    } catch(e){}
+    // ── proof verdict (self-improvement eval): ALARM-ONLY, fs-only ──
+    // Sources the most recent ruflo-improvement-eval run (.claude-flow/improvement.json):
+    // a pre-registered causal test (one-sided permutation p + Cohen's d + above-chance)
+    // that the route Q-learner self-improves vs a no-learning ablation. It is a SYNTHETIC
+    // proof-of-mechanism (its own reward env), NOT a live measure of real routing — that
+    // is what the 📈 RL line above is. So PASS is the expected state and is rendered
+    // SILENTLY; only a FAIL (a real regression worth a look) surfaces, as ◷ proof FAIL.
+    // The run age (im.ts) is appended so a stale FAIL reads honestly. Never a fabricated
+    // source. Fields per #8: Δpp · CI · p · d · age. (#8 — alarm-only per user decision.)
+    var proof = "";
+    try {
+      var ip = path.join(cwd, ".claude-flow", "improvement.json");
+      if (fs.existsSync(ip)) {
+        var im = JSON.parse(fs.readFileSync(ip, "utf8"));
+        if (im && im.verdict === "FAIL") {
+          var pp = [];
+          if (typeof im.deltaPP === "number") pp.push("Δ" + (im.deltaPP >= 0 ? "+" : "") + im.deltaPP + "pp");
+          if (typeof im.ci95 === "number") pp.push("CI±" + im.ci95);
+          if (typeof im.pValue === "number") pp.push("p" + (im.pValue < 0.001 ? "<.001" : "=" + im.pValue.toFixed(3)));
+          if (typeof im.cohensD === "number") pp.push("d" + (im.cohensD >= 999 ? "∞" : im.cohensD));
+          if (typeof im.ts === "number") {
+            var ageSec = Math.floor(Date.now() / 1000) - im.ts;
+            if (ageSec >= 86400) pp.push(Math.floor(ageSec / 86400) + "d ago");
+            else if (ageSec >= 3600) pp.push(Math.floor(ageSec / 3600) + "h ago");
+          }
+          proof = Y + "◷ proof FAIL" + R + (pp.length ? "  " + DIM + pp.join(" · ") + R : "");
+        }
+      }
+    } catch(e){}
+    // ── AI defense (AIMDS) — ALARM-ONLY: renders only when it is MISSING ────────
+    // Was a permanent green "🛡 aidefence on". Two reasons it inverted:
+    //   1. Issue #8's rule, already law for the proof segment below: the expected state
+    //      is rendered SILENTLY, only a regression surfaces, no static green badge. A
+    //      constant "on" carries no information after the first glance — unlike SONA/QE,
+    //      whose counts move — so it was the one pure binary badge in this footer.
+    //   2. Glyph collision: ruflo's line 2 uses 🛡 for the SCAN state, a different
+    //      concern entirely (`security scan` audits your SOURCE; this is `security
+    //      defend` / AIMDS screening PROMPTS for injection, jailbreak and PII). Two
+    //      shields meaning different things read as one duplicated thing. The alarm
+    //      carries no 🛡 at all, so it can never be confused with the scan shield.
+    //
+    // Still load-bearing, not decoration: @claude-flow/aidefence is NOT a declared
+    // dependency of ruflo or @claude-flow/cli (verified still true on 3.32.0) while
+    // `security defend` imports it (ruvnet/ruflo#2670). It is present ONLY because the
+    // kit's healAidefence npm-installs it into rufloRoot(). A plain `npm i -g ruflo`
+    // can therefore silently remove your injection defense — and under the old polarity
+    // that catastrophe was signalled by a line quietly VANISHING, which is ambiguous
+    // (off? probe threw? forgot to look?). Now the dangerous state is the loud one.
+    //
+    // FAIL-SAFE POLARITY (the reason for the two-step probe): alarm only on POSITIVE
+    // evidence of absence — we located a ruflo install AND aidefence is not inside it.
+    // If ruflo itself cannot be found (custom npm prefix, or the statusline running
+    // under a different node than the one that installed it), we cannot know, so we say
+    // NOTHING. Inverting a signal also inverts its failure mode: a probe miss used to
+    // fail silent, and would now fail LOUD and WRONG. Claiming "your defense is off"
+    // when it is on is the same crime as the fabricated CVE counter overlaid above.
+    // Probe + verdict live in rufloAidefenceState/rufloFindRufloRoot (below) so the
+    // three-state logic is unit-testable against fixture trees — it cannot be exercised
+    // from here, where it depends on the real process.execPath.
+    var sec = "";
+    try {
+      if (rufloAidefenceState(rufloFindRufloRoot()) === "off") {
+        sec = RED + "⚠ aidefence OFF" + R + DIM + " — no prompt-injection defense · ak sync restores it" + R;
+      }
+    } catch(e){}
+    // ── daemon visibility (⚙): GLOBAL count of running ruflo daemons, so no daemon
+    // is ever invisible (token-burn incident lesson). Machine-global, not per-project,
+    // so it is cached in tmpdir and shared across every project's statusline — one
+    // pgrep per TTL window, not per render. Daemons are default-on (local-only
+    // workers, budget-governed AI workers) since the 3.28 baseline, so one per active
+    // project is the EXPECTED steady state: dim up to 3, YELLOW at >=4 (more daemons
+    // than you're plausibly working projects — ruflo-daemon-gc to inspect; upstream
+    // TTL + kit auto-reap will also converge it). Opt out: RUFLO_DAEMON_STATUSLINE=0.
+    var daemon = "";
+    try {
+      if (process.env.RUFLO_DAEMON_STATUSLINE !== "0") {
+        var os = require("os");
+        var dCache = path.join(os.tmpdir(), "ruflo-daemon-count.json");
+        var dTtl = Number(process.env.RUFLO_DAEMON_STATUSLINE_TTL_MS || 30000);
+        var dCount = null;
+        try { var dc = JSON.parse(fs.readFileSync(dCache, "utf8")); if (dc && typeof dc.n === "number" && dTtl > 0 && (Date.now() - dc.ts) < dTtl) dCount = dc.n; } catch(e){}
+        if (dCount === null) {
+          try {
+            var pg = cp.execFileSync("pgrep", ["-f", "cli.js daemon start"], {stdio:["ignore","pipe","ignore"], timeout:1500}).toString().trim();
+            dCount = pg ? pg.split("\n").filter(Boolean).length : 0;
+          } catch(e){ dCount = 0; }   // pgrep exits 1 (=> throws) when nothing matches
+          try { fs.writeFileSync(dCache, JSON.stringify({ts: Date.now(), n: dCount})); } catch(e){}
+        }
+        if (dCount > 0) {
+          var dCol = dCount >= 4 ? Y : DIM;
+          daemon = dCol + "⚙ " + dCount + " ruflo daemon" + (dCount === 1 ? "" : "s") + R
+                 + (dCount >= 4 ? DIM + " — ruflo-daemon-gc to inspect" + R : "");
+        }
+      }
+    } catch(e){}
+    // ── RuvNet Brain (🧿): offline rUv-stack knowledge base — honesty-gated, fs-only ──
+    // The brain is NOT an npm package — `npx github:stuinfla/ruvnet-brain` drops a
+    // ~2GB offline knowledge base at ~/.cache/ruvnet-brain/kb (honors RUVNET_BRAIN_KB)
+    // and wires a user-scope Claude Code plugin. Presence probe MIRRORS
+    // src/lib/ruvnet-brain.mjs exactly: existence of the KB's forge-mcp-all.mjs
+    // entrypoint. Render NOTHING when absent — never a fabricated row. The KB is a flat
+    // dir of data files, so the true size is a shallow sum of its top-level files
+    // (the __MACOSX zip-artifact dir is a directory, so isFile() correctly excludes it);
+    // that sum is TTL-cached machine-globally in tmpdir (like the ⚙ daemon / 🎓 QE
+    // chips) so ~600 stat() calls run at most once per window, not per render. The 💾
+    // chip reuses the QE size formatting. The plugin semver (marketplace manifest,
+    // best-effort) rides next to the label like "RuFlo V<x>" / "Agentic QE V<x>".
+    var brain = "";
+    try {
+      var os2 = require("os");
+      var kbDir = process.env.RUVNET_BRAIN_KB || path.join(os2.homedir(), ".cache", "ruvnet-brain", "kb");
+      if (fs.existsSync(path.join(kbDir, "forge-mcp-all.mjs"))) {
+        // Version — best-effort, empty on any failure (never blocks the row).
+        // RELEASE-tag namespace (what `ak status` shows, e.g. 3.3.1), never the
+        // plugin.json SEMVER (e.g. 0.5.0-dev) — different namespaces for the same
+        // install; showing the semver here confused users (it disagreed with
+        // `ak status`). Three-namespace gotcha; see MAINTAINER.md. Resolution
+        // order MIRRORS drift() in src/lib/ruvnet-brain.mjs so this row and
+        // `ak status` can never disagree:
+        //   1) the bundle's own on-disk stamp (SOURCE.json.releaseTag) — ground
+        //      truth, current even when the KB changed outside ak (e.g. a manual
+        //      forge-update.mjs run);
+        //   2) ak's kit.json record of the release it last installed;
+        //   3) plugin semver — last resort for manual/pre-stamping installs.
+        var bver = "";
+        try {
+          var relTag = null;
+          try {
+            var srcJ = JSON.parse(fs.readFileSync(path.join(kbDir, "SOURCE.json"), "utf8"));
+            var rawTag = String(srcJ.releaseTag || "");
+            if (/^[A-Za-z0-9._-]{1,32}$/.test(rawTag)) relTag = rawTag;
+          } catch(e){}
+          if (!relTag) try {
+            var kitCfg = path.join(os2.homedir(), ".config", "agentic-kit", "kit.json");
+            var kj = JSON.parse(fs.readFileSync(kitCfg, "utf8"));
+            if (kj && kj.versionCheck && kj.versionCheck.ruvnetBrain) relTag = kj.versionCheck.ruvnetBrain.installedRelease;
+          } catch(e){}
+          if (relTag) {
+            bver = " V" + String(relTag).replace(/^v/, "");
+          } else {
+            var bpkg = path.join(os2.homedir(), ".claude", "plugins", "marketplaces",
+                                 "ruvnet-brain", "plugin", ".claude-plugin", "plugin.json");
+            var bv = JSON.parse(fs.readFileSync(bpkg, "utf8")).version;
+            if (bv) bver = " V" + String(bv).replace(/^v/, "");
+          }
+        } catch(e){}
+        // KB size — TTL-cached shallow sum of top-level files, keyed on kbDir so an
+        // env-overridden path (or a moved KB) never serves a stale foreign size.
+        var bBytes = null;
+        try {
+          var bCache = path.join(os2.tmpdir(), "ruvnet-brain-kb-size.json");
+          var bTtl = Number(process.env.RUVNET_BRAIN_KB_TTL_MS || 300000);
+          try {
+            var bc = JSON.parse(fs.readFileSync(bCache, "utf8"));
+            if (bc && bc.dir === kbDir && typeof bc.bytes === "number" && bTtl > 0 && (Date.now() - bc.ts) < bTtl) bBytes = bc.bytes;
+          } catch(e){}
+          if (bBytes === null) {
+            var sum = 0;
+            fs.readdirSync(kbDir).forEach(function(f){
+              try { var s = fs.statSync(path.join(kbDir, f)); if (s.isFile()) sum += s.size; } catch(e){}
+            });
+            bBytes = sum;
+            try { fs.writeFileSync(bCache, JSON.stringify({ts: Date.now(), dir: kbDir, bytes: sum})); } catch(e){}
+          }
+        } catch(e){}
+        var bp = [];
+        if (bBytes && bBytes > 0) {
+          var bkb = Math.round(bBytes / 1024);
+          bp.push("💾 " + (bkb >= 1024 ? (bkb/1024).toFixed(1) + "MB" : bkb + "KB"));
+        }
+        brain = C + "🧿 RuvNet Brain" + bver + R + "  " + (bp.length ? bp.join(DIM + " · " + R) : G + "✓" + R);
+      }
+    } catch(e){}
+    // ── agentic-qe — TTL-cached; one sqlite3 spawn only on a cache miss (issue #3) ──
+    var qe = "";
+    try {
+      var db = path.join(cwd, ".agentic-qe", "memory.db");
+      if (fs.existsSync(db)) {
+        var cacheDir = path.join(cwd, ".claude-flow", "cache");
+        var cacheFile = path.join(cacheDir, "qe-statusline.json");
+        var ttl = Number(process.env.RUFLO_QE_STATUSLINE_TTL_MS || 60000);
+        var cachedLine = null;
+        try {
+          var cc = JSON.parse(fs.readFileSync(cacheFile, "utf8"));
+          if (cc && typeof cc.line === "string" && ttl > 0 && (Date.now() - cc.ts) < ttl) cachedLine = cc.line;
+        } catch(e){}
+        if (cachedLine !== null) {
+          qe = cachedLine;                   // hit: zero sqlite3 spawns
+        } else {
+          // miss: ONE sqlite3 call. SQL on stdin + ".bail off" so a missing vector
+          // table (name varies by aqe version) doesn't abort the batch. sqlite3 still
+          // exits non-zero on the error, so execFileSync throws — recover e.stdout.
+          var sql = ".bail off\n"
+            + "SELECT 'pat',COUNT(*) FROM qe_patterns;\n"
+            + "SELECT 'vec',COUNT(*) FROM qe_pattern_embeddings;\n"
+            + "SELECT 'vec',COUNT(*) FROM vectors;\n"
+            + "SELECT 'vec',COUNT(*) FROM embeddings;\n"
+            + "SELECT 'traj',COUNT(*) FROM qe_trajectories;\n";
+          var raw = "";
+          try { raw = cp.execFileSync("sqlite3", [db], {input: sql, stdio:["pipe","pipe","ignore"], timeout:1500}).toString(); }
+          catch(e){ raw = (e && e.stdout) ? e.stdout.toString() : ""; }
+          var pat = 0, qtj = 0, qv = 0;
+          raw.split("\n").forEach(function(ln){
+            var i = ln.indexOf("|"); if (i < 0) return;
+            var k = ln.slice(0, i), v = Number(ln.slice(i + 1)) || 0;
+            if (k === "pat") pat = v; else if (k === "traj") qtj = v; else if (k === "vec" && qv === 0) qv = v;
+          });
+          var qp = [];
+          if (pat > 0) qp.push("🎓 " + pat + " patterns");
+          if (qtj > 0) qp.push("🧭 " + qtj + " traj");
+          if (qv > 0) qp.push("🧬 " + qv + " vec" + G + "⚡" + R);
+          try { var kb = Math.round(fs.statSync(db).size / 1024); qp.push("💾 " + (kb >= 1024 ? (kb/1024).toFixed(1) + "MB" : kb + "KB")); } catch(e){}
+          // Installed agentic-qe version — shown next to the label, mirroring "RuFlo V<x>"
+          // in ruflo's native header. Prefer the global install (matches the aidefence
+          // probe above); fall back to a project-local node_modules copy.
+          var qver = "";
+          try {
+            var qpkg = path.join(path.dirname(process.execPath), "..", "lib", "node_modules", "agentic-qe", "package.json");
+            if (!fs.existsSync(qpkg)) qpkg = path.join(cwd, "node_modules", "agentic-qe", "package.json");
+            var qv2 = JSON.parse(fs.readFileSync(qpkg, "utf8")).version;
+            if (qv2) qver = " V" + qv2;
+          } catch(e){}
+          qe = Y + "🎓 Agentic QE" + qver + R + "  " + (qp.length ? qp.join(DIM + " · " + R) : "on");
+          try { fs.mkdirSync(cacheDir, {recursive:true}); fs.writeFileSync(cacheFile, JSON.stringify({ts: Date.now(), line: qe})); } catch(e){}
+        }
+      }
+    } catch(e){}
+    // ── assemble: one ruflo feature per line (SONA, 📈 RL, ◷ proof FAIL alarm,
+    // ⚠ aidefence OFF alarm), then a divider, then the agentic-qe line. The two alarms
+    // are silent in the healthy case, so a well-configured machine shows only the live
+    // metrics. Each segment renders on its
+    // OWN line so the live route metrics and the security state are individually scannable
+    // and don't wrap. No rule above the SONA line — these are ruflo features and sit flush
+    // under ruflo's native lines. The divider matches ruflo's native header width
+    // ('─'.repeat(53) in statusline.cjs) so the two rules line up.
+    var out = [];
+    if (learn) out.push(learn);
+    if (route) out.push(route);
+    if (proof) out.push(proof);
+    if (sec) out.push(sec);
+    if (daemon) out.push(daemon);
+    if (brain) out.push(brain);
+    if (out.length && qe) out.push(DIM + "─".repeat(53) + R);
+    if (qe) out.push(qe);
+    if (!out.length) return "";
+    return "\n" + out.join("\n");
+  } catch(e){ return ""; }
+}
+// ── AI-defense probe (companion to the alarm-only segment above) ─────────────
+// Locates the global ruflo install WITHOUT spawning npm (this runs on every render).
+// Returns "" when no candidate resolves — the caller must treat that as "unknown",
+// never as "off".
+function rufloFindRufloRoot(){
+  try {
+    var fs = require("fs"), path = require("path"), os = require("os");
+    var binDir = path.dirname(process.execPath);
+    var cands = [
+      path.join(binDir, "..", "lib", "node_modules", "ruflo"),   // nvm / mise layout
+      path.join(binDir, "node_modules", "ruflo"),                // Windows layout
+    ];
+    // A custom npm prefix (~/.npm-global, npm_config_prefix) is decoupled from the node
+    // binary, so the execPath-derived probes above all miss it — same gap as upstream #2221.
+    var prefixes = [process.env.npm_config_prefix, process.env.PREFIX, path.join(os.homedir(), ".npm-global")];
+    for (var pi = 0; pi < prefixes.length; pi++) {
+      if (prefixes[pi]) cands.push(path.join(prefixes[pi], "lib", "node_modules", "ruflo"));
+    }
+    for (var ci = 0; ci < cands.length; ci++) {
+      if (fs.existsSync(path.join(cands[ci], "package.json"))) return cands[ci];
+    }
+    return "";
+  } catch(e){ return ""; }
+}
+// ── real CLI bins (companion to the ruflo-bin wrapper) ──────────────────────
+// Upstream's resolveCliBinCandidates looks for `ruflo/bin/cli.js`, but the ruflo
+// package ships `bin/ruflo.js` (package.json bin: {"ruflo": "bin/ruflo.js"}) —
+// a filename that never exists. @claude-flow/cli DOES ship bin/cli.js, but it is
+// ruflo's nested dependency, not a global top-level install, so that candidate
+// misses too. Every candidate therefore fails and the statusline silently falls
+// through to `npx --prefer-offline @claude-flow/cli`, which serves whatever stale
+// version happens to sit in the npx cache — that is how a machine running a fixed
+// ruflo 3.32.2 still rendered the FABRICATED "⚠ 1 CVE" from a cached 3.28.0.
+// Returns only paths that exist; [] means "nothing found", never a guess.
+function rufloRealCliBins(cwd){
+  try {
+    var fs = require("fs"), path = require("path");
+    var roots = [], out = [];
+    var g = rufloFindRufloRoot();
+    if (g) roots.push(g);
+    if (cwd) roots.push(path.join(cwd, "node_modules", "ruflo"));
+    for (var i = 0; i < roots.length; i++) {
+      out.push(path.join(roots[i], "bin", "ruflo.js"));
+      out.push(path.join(roots[i], "node_modules", "@claude-flow", "cli", "bin", "cli.js"));
+    }
+    return out.filter(function(p){ try { return fs.existsSync(p); } catch(e){ return false; } });
+  } catch(e){ return []; }
+}
+// Three states, not two — the distinction IS the fail-safe. "off" is asserted only on
+// positive evidence: a real ruflo install that does not contain aidefence. Anything we
+// cannot verify is "unknown" and stays silent, because a false "your injection defense
+// is off" would be exactly the fabricated-alarm bug this footer exists to correct.
+// @claude-flow/security is auth/validation primitives, not detection — probing it
+// instead would overstate, so only aidefence counts.
+function rufloAidefenceState(rufloRoot){
+  try {
+    var fs = require("fs"), path = require("path");
+    if (!rufloRoot || !fs.existsSync(path.join(rufloRoot, "package.json"))) return "unknown";
+    var ad = path.join(rufloRoot, "node_modules", "@claude-flow", "aidefence", "package.json");
+    return fs.existsSync(ad) ? "on" : "off";
+  } catch(e){ return "unknown"; }
+}
+// ── security overlay: replaces ruflo's FABRICATED CVE counter with the real scan ──
+// Upstream (@claude-flow/cli dist/src/funnel/local-signals.js, getSecurityStatus) does:
+//     let cvesFixed = 0; const totalCves = 3;
+//     cvesFixed = Math.min(totalCves, scans.length);   // counts FILES, not findings
+// Two independent defects. (1) `totalCves = 3` is a hardcoded constant referring to
+// ruflo's OWN v3 remediation roadmap — CVE-1/2/3 in .claude/agents/v3/v3-security-architect.md
+// are an outdated @anthropic-ai/claude-code dep + SHA-256 hashing + hardcoded creds in
+// THEIR api/auth-service.ts. They are not public CVE IDs and have nothing to do with the
+// project being rendered, so every clean repo is told it has 3 CVEs. (2) `cvesFixed`
+// counts .json files in .claude/security-scans/, so running the very scan the warning
+// tells you to run "fixes" a CVE by writing a file. The counter converges to CLEAN
+// without anything being scanned, let alone fixed. Upstream: ruvnet/ruflo#2694.
+//
+// This overlay reports what the newest scan ACTUALLY found, and never invents a CVE:
+// totalCves/cvesFixed are pinned to 0 so the "⚠ N CVEs" branch can never fire again;
+// real state is carried in `status`, which ruflo's own renderer prints verbatim.
+//   no scan yet        → PENDING    → "🛡 scan pending"  (honest unknown, not green)
+//   findings > 0       → "N ISSUES" → red "🛡 n issues"   (real count from the scan)
+//   clean + fresh      → CLEAN      → "🛡 ✓"
+//   clean + stale >7d  → STALE      → "🛡 scan stale"
+// Returns `upstream` untouched on any unexpected error — a wrong overlay would be worse
+// than the bug, so the failure mode is "no worse than ruflo".
+function rufloLocalSecurity(cwd, upstream){
+  try {
+    var fs = require("fs"), path = require("path");
+    var dir = path.join(cwd, ".claude", "security-scans");
+    var newest = null;
+    try {
+      fs.readdirSync(dir).forEach(function(f){
+        if (f.slice(-5) !== ".json") return;
+        try {
+          var j = JSON.parse(fs.readFileSync(path.join(dir, f), "utf8"));
+          // Prefer the scan's own timestamp; fall back to mtime so a hand-written or
+          // older-format scan file still orders correctly instead of sorting to epoch 0.
+          var t = Date.parse(j && j.timestamp);
+          if (!t) { try { t = fs.statSync(path.join(dir, f)).mtimeMs; } catch(e){ t = 0; } }
+          if (!newest || t > newest.t) newest = { t: t, j: j };
+        } catch(e){}   // unreadable/!JSON scan file: ignore, never let it break the render
+      });
+    } catch(e){}       // no directory => never scanned
+    if (!newest) return { status: "PENDING", cvesFixed: 0, totalCves: 0 };
+    var s = newest.j.summary || {};
+    var n = typeof s.total === "number" ? s.total
+          : (Array.isArray(newest.j.findings) ? newest.j.findings.length : 0);
+    if (n > 0) return { status: n + " ISSUE" + (n === 1 ? "" : "S"), cvesFixed: 0, totalCves: 0 };
+    var staleMs = Number(process.env.RUFLO_SCAN_STALE_MS || 7 * 24 * 3600 * 1000);
+    if (staleMs > 0 && newest.t && (Date.now() - newest.t) > staleMs) {
+      return { status: "STALE", cvesFixed: 0, totalCves: 0 };
+    }
+    return { status: "CLEAN", cvesFixed: 0, totalCves: 0 };
+  } catch(e){ return upstream; }
+}
+// ── insight-row companion to rufloLocalSecurity ──────────────────────────────
+// The fabricated count reaches the render through a SECOND, independent path: the
+// CLI builds the line-3 insight itself (funnel/insights.js securityInsight →
+// `pending = s.totalCves - s.cvesFixed`) and ships it as pre-rendered promo TEXT.
+// Overlaying data.security cannot fix that — the sentence is already baked, so a
+// repo with a clean scan still gets "⚠ 1 CVE pending". This rebuilds that one
+// sentence from the real scan, or drops it when there is nothing to say.
+// Matched on TEXT, not id: promo.js reduces the insight to {text, kind} and throws
+// the id away, so `insight-cves-pending` is not observable by the time we see it.
+// Only ever touches a CVE-worded insight — every other insight/tip/promo passes
+// through untouched, so the funnel rotation is preserved.
+function rufloHonestInsight(promo, sec){
+  try {
+    if (!promo || promo.kind !== "insight" || typeof promo.text !== "string") return promo;
+    if (!/\bCVEs?\b/.test(promo.text)) return promo;   // a different insight — not ours to touch
+    if (!sec) return null;
+    if (sec.status === "PENDING") return { text: "🛡 Security scan pending — Run ruflo security scan --depth full", kind: "insight" };
+    if (sec.status === "STALE") return { text: "🛡 Security scan stale — Run ruflo security scan --depth full", kind: "insight" };
+    var m = /^(\d+) ISSUE/.exec(sec.status || "");
+    if (m) {
+      var n = Number(m[1]);
+      return { text: "⚠ " + n + " security issue" + (n === 1 ? "" : "s") + " found — see .claude/security-scans", kind: "insight" };
+    }
+    return null;   // CLEAN: say nothing. The slot falls blank rather than nagging about a lie.
+  } catch(e){ return promo; }
+}
+/* ruflo-seg:END */
+/* ruflo-bin:BEGIN */
+try {
+  if (typeof resolveCliBinCandidates === "function") {
+    var _rufloOrigResolveCliBins = resolveCliBinCandidates;
+    resolveCliBinCandidates = function(){
+      var orig = [];
+      try { orig = _rufloOrigResolveCliBins.apply(this, arguments) || []; } catch(e){}
+      try {
+        var cwd = process.cwd();
+        try { if (typeof CWD === "string" && CWD) cwd = CWD; } catch(e){}
+        var real = (typeof rufloRealCliBins === "function") ? rufloRealCliBins(cwd) : [];
+        return real.concat(orig.filter(function(p){ return real.indexOf(p) === -1; }));
+      } catch(e){ return orig; }
+    };
+  }
+} catch(e){}
+/* ruflo-bin:END */
 /**
  * RuFlo V3 Statusline — delegation build (#2195)
  *
@@ -42,7 +608,11 @@ const CONFIG = {
   hideCost: /^(1|true|yes|on)$/i.test(process.env.RUFLO_STATUSLINE_HIDE_COST || ''),
 };
 
-const CWD = process.cwd();
+const CWD = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+// Replaced by statusline-generator with the package root of the CLI that
+// installed this helper. This survives custom npm prefixes and bundled Node
+// runtimes whose process.execPath belongs to a different tree (#2811).
+const BAKED_INSTALL_ROOT = "";
 
 // ─── Delegation cache ───────────────────────────────────────────
 // Cache the CLI JSON result so rapid prompt re-renders (Claude Code
@@ -404,6 +974,154 @@ function getLocalIntegration() {
   return integration;
 }
 
+// ─── Security freshness overlay (ruvnet/ruflo#2776) ──────────────
+// The shipped CLI producer (dist/src/funnel/local-signals.js getSecurityStatus)
+// only ever emits PENDING / CLEAN / ISSUES — it captures `scannedAt` but never
+// inspects it, so a year-old scan renders 🛡 ✓ forever and the renderer's
+// STALE / IN_PROGRESS branches are unreachable. Worse, when CLI delegation
+// fails, the stale-while-revalidate cache (readCache() below) keeps serving
+// the pre-scan PENDING pill indefinitely, so a user who runs the advertised
+// `ruflo security scan` sees no change — the pill freezes at "scan pending".
+//
+// This overlay recomputes the security block from disk on EVERY render (same
+// pattern as adrs/agentdb/tests/hooks above), which:
+//   1) Makes STALE reachable — when the newest scan is older than
+//      RUFLO_SCAN_STALE_HOURS (default 24h — matches the CVE feed refresh
+//      cadence), report STALE regardless of what the cached CLI JSON says.
+//   2) Makes IN_PROGRESS reachable — when a `scan-in-progress` marker file
+//      exists and is younger than SECURITY_IN_PROGRESS_MAX_MIN (guards against
+//      a crashed scan leaving the marker behind).
+//   3) Caps the "scan pending" display window — if PENDING has been shown for
+//      >RUFLO_SCAN_PENDING_CAP_MIN (default 30) without a completion write,
+//      switch to STALE and stop rendering the yellow indicator. The tracker
+//      lives in ~/.ruflo/statusline-scan-pending-since.json, keyed by CWD
+//      hash so multiple project checkouts don't collide.
+//   4) Since this runs AFTER readCache() serves stale data, it bypasses the
+//      "pill freezes at PENDING" freeze in defect 2 — the overlay reads
+//      fresh disk state even when the CLI delegation is broken.
+const SECURITY_STALE_HOURS = Math.max(1, parseInt(process.env.RUFLO_SCAN_STALE_HOURS || '24', 10) || 24);
+const SECURITY_PENDING_CAP_MIN = Math.max(1, parseInt(process.env.RUFLO_SCAN_PENDING_CAP_MIN || '30', 10) || 30);
+const SECURITY_IN_PROGRESS_MAX_MIN = 30; // marker older than this = crashed scan; treat as absent
+const PENDING_TRACK_FILE = path.join(os.homedir(), '.ruflo', 'statusline-scan-pending-since.json');
+const CWD_KEY = require('crypto').createHash('md5').update(CWD).digest('hex').slice(0, 12);
+
+function readPendingSince() {
+  try {
+    if (!fs.existsSync(PENDING_TRACK_FILE)) return null;
+    const raw = JSON.parse(fs.readFileSync(PENDING_TRACK_FILE, 'utf-8'));
+    if (raw && typeof raw === 'object' && typeof raw[CWD_KEY] === 'number') return raw[CWD_KEY];
+  } catch { /* ignore */ }
+  return null;
+}
+
+function writePendingSince(ts) {
+  try {
+    let obj = {};
+    if (fs.existsSync(PENDING_TRACK_FILE)) {
+      try { obj = JSON.parse(fs.readFileSync(PENDING_TRACK_FILE, 'utf-8')) || {}; } catch { obj = {}; }
+    }
+    if (ts === null) { delete obj[CWD_KEY]; } else { obj[CWD_KEY] = ts; }
+    fs.mkdirSync(path.dirname(PENDING_TRACK_FILE), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(PENDING_TRACK_FILE, JSON.stringify(obj), { encoding: 'utf-8', mode: 0o600 });
+  } catch { /* ignore */ }
+}
+
+function getLocalSecurity(cliSecurity) {
+  const base = (cliSecurity && typeof cliSecurity === 'object')
+    ? Object.assign({}, cliSecurity)
+    : { status: 'NONE', findings: 0, cvesFixed: 0, totalCves: 0 };
+  base.findings = Math.max(0, base.findings || 0);
+
+  const scanDir = path.join(CWD, '.claude', 'security-scans');
+
+  // Detect a live in-progress marker (writer opts-in by writing this file).
+  let inProgress = false;
+  try {
+    const marker = path.join(scanDir, 'scan-in-progress');
+    if (fs.existsSync(marker)) {
+      const ageMin = (Date.now() - fs.statSync(marker).mtimeMs) / 60000;
+      if (ageMin < SECURITY_IN_PROGRESS_MAX_MIN) inProgress = true;
+    }
+  } catch { /* ignore */ }
+
+  // Find newest scan-*.json by mtime and read its findings/timestamp.
+  let newestPath = null;
+  let newestMtime = 0;
+  try {
+    if (fs.existsSync(scanDir)) {
+      for (const name of fs.readdirSync(scanDir)) {
+        if (!name.startsWith('scan-') || !name.endsWith('.json')) continue;
+        try {
+          const st = fs.statSync(path.join(scanDir, name));
+          if (st.mtimeMs > newestMtime) { newestMtime = st.mtimeMs; newestPath = path.join(scanDir, name); }
+        } catch { /* ignore */ }
+      }
+    }
+  } catch { /* ignore */ }
+
+  if (newestPath) {
+    // We have a scan on disk — the never-scanned pending tracker is no longer
+    // relevant. Clear it so a re-created directory can start a fresh window.
+    writePendingSince(null);
+
+    let scannedAtMs = newestMtime;
+    let findings = base.findings;
+    try {
+      const j = JSON.parse(fs.readFileSync(newestPath, 'utf-8'));
+      // scannedAt (CLI producer's field name) OR timestamp (writer's field name).
+      const isoStr = (j && (j.scannedAt || j.timestamp)) || null;
+      if (isoStr) {
+        const t = Date.parse(isoStr);
+        if (!isNaN(t)) scannedAtMs = t;
+      }
+      // findings may be a number, an array, or nested in summary.total.
+      if (j) {
+        if (typeof j.findings === 'number') findings = j.findings;
+        else if (Array.isArray(j.findings)) findings = j.findings.length;
+        else if (j.summary && typeof j.summary.total === 'number') findings = j.summary.total;
+      }
+    } catch { /* ignore parse — fall back to mtime + cached findings */ }
+
+    base.findings = Math.max(0, findings || 0);
+    base.scannedAt = new Date(scannedAtMs).toISOString();
+
+    const ageHours = (Date.now() - scannedAtMs) / 3600000;
+    if (ageHours >= SECURITY_STALE_HOURS) {
+      // Stale but findings still render red (a year-old ISSUES scan is still bad).
+      base.status = 'STALE';
+    } else if (inProgress) {
+      base.status = 'IN_PROGRESS';
+    } else if (base.findings > 0) {
+      base.status = 'ISSUES';
+    } else {
+      base.status = 'CLEAN';
+    }
+    return base;
+  }
+
+  // No scan file. If a live marker exists, we're mid-scan.
+  if (inProgress) {
+    base.status = 'IN_PROGRESS';
+    // Reset the pending tracker so, if the scan crashes mid-flight, the next
+    // render starts a fresh N-minute pending window instead of an already-expired one.
+    writePendingSince(null);
+    return base;
+  }
+
+  // Truly never-scanned: track how long we've shown PENDING. After the cap,
+  // escalate to STALE with the dim/gray glyph so the pill visibly stops
+  // shouting for attention — the user has either ignored it for 30 min or
+  // the scan is silently failing to write.
+  let pendingSince = readPendingSince();
+  if (pendingSince === null || typeof pendingSince !== 'number') {
+    pendingSince = Date.now();
+    writePendingSince(pendingSince);
+  }
+  const pendingAgeMin = (Date.now() - pendingSince) / 60000;
+  base.status = (pendingAgeMin >= SECURITY_PENDING_CAP_MIN) ? 'STALE' : 'PENDING';
+  return base;
+}
+
 // Overlay every locally-derived block onto the CLI data (mutates in place).
 function applyLocalOverlays(data) {
   data.adrs = getLocalADRCount();
@@ -411,6 +1129,9 @@ function applyLocalOverlays(data) {
   data.tests = getLocalTests();
   data.hooks = getLocalHooks();
   data.integration = getLocalIntegration();
+  // Security overlay: recompute freshness from disk on every render so cached
+  // CLI JSON can never freeze the pill at PENDING. See getLocalSecurity() above.
+  data.security = getLocalSecurity(data.security);
   return data;
 }
 
@@ -681,10 +1402,11 @@ function getPkgVersion() {
   // version (see generateStatuslineScript()'s doc comment) — correct even
   // when this renders via a pure npx invocation with no local install for
   // the candidate scan below to find.
-  let ver = "3.32.8";
+  let ver = "3.38.8";
   try {
     const home = os.homedir();
     const pkgPaths = [
+      ...(BAKED_INSTALL_ROOT ? [path.join(BAKED_INSTALL_ROOT, 'package.json')] : []),
       path.join(home, '.claude', 'plugins', 'marketplaces', 'ruflo', 'package.json'),
       path.join(CWD, 'node_modules', '@claude-flow', 'cli', 'package.json'),
       path.join(CWD, 'node_modules', 'ruflo', 'package.json'),
@@ -712,7 +1434,12 @@ function getPkgVersion() {
       // #2221 follow-up: a custom npm prefix (e.g. ~/.npm-global) is decoupled from
       // the node binary location, so the binDir-derived probes above all miss. Also
       // probe the npm prefix from the environment and the common ~/.npm-global default.
-      for (const prefix of [process.env.npm_config_prefix, process.env.PREFIX, path.join(home, '.npm-global')]) {
+      for (const prefix of [
+        process.env.npm_config_prefix,
+        process.env.PREFIX,
+        path.join(home, '.local'),
+        path.join(home, '.npm-global'),
+      ]) {
         if (prefix) globalModuleDirs.push(path.join(prefix, 'lib', 'node_modules'));
       }
       for (const gm of globalModuleDirs) {
@@ -731,14 +1458,12 @@ function getPkgVersion() {
     // right after a publish). Taking the first EXISTING candidate meant the
     // header could show a stale version even when a newer install (e.g.
     // node_modules/@claude-flow/cli from a plain npm install) was sitting right there.
-    let found = false;
     for (const p of pkgPaths) {
       if (!fs.existsSync(p)) continue;
       try {
         const pkg = JSON.parse(fs.readFileSync(p, 'utf-8'));
         if (pkg && typeof pkg.version === 'string' && pkg.version.length > 0) {
-          if (!found || compareVersions(pkg.version, ver) > 0) ver = pkg.version;
-          found = true;
+          if (compareVersions(pkg.version, ver) > 0) ver = pkg.version;
         }
       } catch { /* ignore */ }
     }
@@ -851,10 +1576,14 @@ function generateStatusline() {
   if (healthAllGreen) {
     opsParts.push(c.brightGreen + '🛡 ✓' + c.reset);
   } else {
+    // #2776: STALE gets dim/gray (distinct from the actionable yellow of
+    // PENDING/IN_PROGRESS) so a stale pill visibly stops shouting for
+    // attention — the user can act on the "run ruflo security scan" prompt or
+    // ignore it without a permanently-yellow indicator.
     if (secStatus === 'PENDING') opsParts.push(c.brightYellow + '🛡 scan pending' + c.reset);
     else if (secStatus === 'IN_PROGRESS') opsParts.push(c.brightYellow + '🛡 scanning…' + c.reset);
     else if (secStatus === 'ISSUES') opsParts.push(c.brightRed + '🛡 findings' + c.reset);
-    else if (secStatus === 'STALE') opsParts.push(c.brightYellow + '🛡 scan stale' + c.reset);
+    else if (secStatus === 'STALE') opsParts.push(c.dim + '🛡 scan stale' + c.reset);
     else if (secStatus !== 'NONE' && secStatus !== 'CLEAN') opsParts.push(c.brightRed + '🛡 ' + secStatus.toLowerCase() + c.reset);
     if (findings > 0) {
       opsParts.push(c.brightRed + '⚠ ' + findings + ' finding' + (findings === 1 ? '' : 's') + c.reset);
@@ -1056,5 +1785,5 @@ if (process.argv.includes('--json')) {
 } else if (process.argv.includes('--compact')) {
   console.log(JSON.stringify(generateJSON()));
 } else {
-  console.log(generateStatusline());
+  console.log(generateStatusline() + rufloActivationSegments(process.cwd()));
 }