claude-flow 3.25.6 → 3.26.1

package/.claude/helpers/statusline.cjs

@@ -49,6 +49,28 @@ const CWD = process.cwd();
 const CACHE_FILE = path.join(os.tmpdir(), 'ruflo-statusline-cache-' + require('crypto').createHash('md5').update(CWD).digest('hex').slice(0, 8) + '.json');
 const CACHE_TTL_MS = 60000;
 
+// The promo/insight row is designed to rotate on a 20s cadence (funnel/
+// rotation.ts's ROTATION_SLOT_MS / funnel/promo.ts's insight-slot check —
+// duplicated here as a bare number since this generated script has no
+// runtime import of the funnel module; keep in sync if that constant ever
+// changes). The rotation slot is only ever (re)computed SERVER-SIDE inside
+// the CLI subprocess this file shells out to — so a general 60s data cache
+// (correct and necessary for #2337) silently made that 20s design
+// unreachable: cache.fresh stayed true across 2-3 whole rotation slots,
+// so the row visibly "didn't rotate" (user report). Fix: track promo
+// freshness on its OWN, tighter clock — when it lags behind the current
+// slot, fall through to a real CLI call even though the REST of the
+// cached data (security/swarm/system) is still within CACHE_TTL_MS. This
+// does not touch or regress #2337's fix; it only adds a narrower check.
+const PROMO_ROTATION_SLOT_MS = 20000;
+
+// Persistent last-known-good promo record. Lives outside the /tmp cache so it
+// survives a full cache wipe / cache write race / CLI failure combo. Written
+// every time we successfully render a promo; read as a last resort so the row
+// never blinks out mid-session (was: 'promo shows then hides' bug report).
+const PROMO_MEMO_FILE = path.join(os.homedir(), '.ruflo', 'statusline-promo.json');
+const PROMO_MEMO_TTL_MS = 6 * 60 * 60 * 1000; // 6h — long enough to bridge any hiccup, short enough that a real disable takes effect fast.
+
 // #2337: resolve an already-installed @claude-flow/cli (or ruflo) bin so we
 // can invoke it directly via `node`. The previous version called
 // `npx --yes @claude-flow/cli@latest` on every uncached render, which forces
@@ -56,18 +78,30 @@ const CACHE_TTL_MS = 60000;
 // multiple concurrent Claude Code sessions this storms the host (reporter
 // saw load average 40-65 on a 12-core box).
 //
-// Returns the absolute path to bin/cli.js or null. Mirrors getPkgVersion()'s
-// path probing (project, monorepo, plugin marketplace, global node_modules
-// including custom-prefix layouts like ~/.npm-global).
-function resolveCliBin() {
+// Returns EVERY existing bin/cli.js candidate, in preference order (project,
+// monorepo, plugin marketplace, global node_modules including custom-prefix
+// layouts like ~/.npm-global) — mirrors getPkgVersion()'s own path probing.
+//
+// Returns a list, not a single winner: `fs.existsSync` only proves a file is
+// present, not that it actually runs. A marketplace/npx-cached install can
+// exist on disk but be broken (observed in practice: a stale marketplace
+// checkout whose dist/ imports a workspace package, '@claude-flow/cli-core',
+// that isn't bundled there — every invocation throws ERR_MODULE_NOT_FOUND).
+// Picking the first EXISTING path and never falling through meant a single
+// broken install silently killed the promo row for the entire session (the
+// CLI call always failed, so the memo could never refresh and eventually
+// expired). getStatuslineData() now walks this whole list and tries the next
+// candidate on failure, so one broken install can't permanently wedge it.
+function resolveCliBinCandidates() {
+  const candidates = [];
   try {
     const home = os.homedir();
-    const candidates = [
+    candidates.push(
       path.join(home, '.claude', 'plugins', 'marketplaces', 'ruflo', 'bin', 'cli.js'),
       path.join(CWD, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js'),
       path.join(CWD, 'node_modules', 'ruflo', 'bin', 'cli.js'),
       path.join(CWD, 'v3', '@claude-flow', 'cli', 'bin', 'cli.js'),
-    ];
+    );
     try {
       const binDir = path.dirname(process.execPath);
       const globalModuleDirs = [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules')];
@@ -81,27 +115,54 @@ function resolveCliBin() {
         );
       }
     } catch { /* ignore */ }
-    for (const p of candidates) {
-      if (fs.existsSync(p)) return p;
-    }
   } catch { /* ignore */ }
-  return null;
+  return candidates.filter((p) => { try { return fs.existsSync(p); } catch { return false; } });
 }
 
+// Return { fresh, promoFresh, data }. 'fresh' is true only if within the TTL
+// — but data is returned regardless (stale-while-revalidate). This lets us
+// serve last known state (specifically the promo row) when the CLI is
+// slow/unavailable, so users don't see the funnel row flicker in and out on
+// cache expiry. 'promoFresh' is a SEPARATE, tighter check on the same clock
+// as PROMO_ROTATION_SLOT_MS — see that constant's comment for why the promo
+// row needs its own freshness bound distinct from the general 60s TTL.
 function readCache() {
   try {
     if (fs.existsSync(CACHE_FILE)) {
       const raw = JSON.parse(fs.readFileSync(CACHE_FILE, 'utf-8'));
-      if (raw && raw._ts && (Date.now() - raw._ts) < CACHE_TTL_MS) {
-        return raw.data;
+      if (raw && raw._ts && raw.data) {
+        const age = Date.now() - raw._ts;
+        return { fresh: age < CACHE_TTL_MS, promoFresh: age < PROMO_ROTATION_SLOT_MS, data: raw.data };
       }
     }
   } catch { /* ignore */ }
-  return null;
+  return { fresh: false, promoFresh: false, data: null };
 }
 
 function writeCache(data) {
   try { fs.writeFileSync(CACHE_FILE, JSON.stringify({ _ts: Date.now(), data }), 'utf-8'); } catch { /* ignore */ }
+  // Also memoize any promo we saw so the row can survive future CLI hiccups.
+  try {
+    if (data && data.promo && typeof data.promo === 'object') {
+      fs.mkdirSync(path.dirname(PROMO_MEMO_FILE), { recursive: true, mode: 0o700 });
+      fs.writeFileSync(PROMO_MEMO_FILE, JSON.stringify({ _ts: Date.now(), promo: data.promo }), { encoding: 'utf-8', mode: 0o600 });
+    }
+  } catch { /* ignore */ }
+}
+
+// Last resort: read a memoized promo (up to 6h old). Used when no cache and
+// no CLI response is available — the row still renders, so users don't see
+// the disclosure blink out. Returns null when the memo is absent, expired,
+// or malformed. Never throws.
+function readPromoMemo() {
+  try {
+    if (!fs.existsSync(PROMO_MEMO_FILE)) return null;
+    const raw = JSON.parse(fs.readFileSync(PROMO_MEMO_FILE, 'utf-8'));
+    if (raw && raw._ts && (Date.now() - raw._ts) < PROMO_MEMO_TTL_MS && raw.promo) {
+      return raw.promo;
+    }
+  } catch { /* ignore */ }
+  return null;
 }
 
 /**
@@ -112,37 +173,75 @@ function writeCache(data) {
  * (missed the .swarm/memory.db → AgentDB path), computed dddProgress wrong,
  * and only counted ADRs in v3/implementation/adrs/ (missed v3/docs/adr/).
  */
+// Overlay the memoized promo onto any data object that's missing one. This is
+// the safety net that keeps the funnel row rendered when an OLDER cached CLI
+// version is picked up by npx — that older CLI succeeds but omits promo, so
+// the JSON round-trips clean but without our row. We patch it back here.
+function overlayMemoPromo(data) {
+  if (data && !data.promo) {
+    const memoPromo = readPromoMemo();
+    if (memoPromo) data.promo = memoPromo;
+  }
+  return data;
+}
+
 function getStatuslineData() {
-  const cached = readCache();
-  if (cached) return cached;
+  const cache = readCache();
+  // Both clocks must be satisfied to skip the CLI call entirely: the general
+  // 60s TTL (#2337 — don't re-spawn the CLI on every rapid re-render) AND the
+  // tighter promo-rotation clock (this fix — don't let a still-fresh 60s
+  // cache silently freeze the promo/insight row across multiple 20s slots).
+  if (cache.fresh && cache.promoFresh) return overlayMemoPromo(cache.data);
+
+  // #2337: prefer an already-installed CLI bin via direct `node` invocation —
+  // no npx, no registry round-trip, no @latest re-resolve per render. Try
+  // every candidate that actually EXISTS (not just the first) before falling
+  // back to `npx --prefer-offline @claude-flow/cli` (no @latest); an existing
+  // but broken install (e.g. a stale marketplace checkout missing a bundled
+  // workspace dep) must not block trying the next one.
+  //
+  // No `2>/dev/null` here (deliberately) — the execSync call below already
+  // sets stdio: ['pipe','pipe','pipe'], which captures/discards stderr at the
+  // Node level regardless of shell. The redirect was redundant on POSIX and
+  // actively broke every candidate on Windows: cmd.exe (execSync's default
+  // shell there) doesn't understand /dev/null, so the CLI delegation always
+  // failed, silently degrading every render to buildLocalFallback() — 0%
+  // intelligence and an empty promo row (the memo cache that keeps the row
+  // populated across CLI hiccups is only ever written from a SUCCESSFUL
+  // delegation, so it could never get seeded on Windows either).
+  const cmds = resolveCliBinCandidates()
+    .map((bin) => '"' + process.execPath + '" "' + bin + '" hooks statusline --json')
+    .concat(['npx --prefer-offline @claude-flow/cli hooks statusline --json']);
+  for (const cmd of cmds) {
+    try {
+      const raw = execSync(
+        cmd,
+        { encoding: 'utf-8', timeout: 8000, stdio: ['pipe', 'pipe', 'pipe'], cwd: CWD }
+      ).trim();
+      // The CLI may emit preamble lines before the JSON — find the first '{'.
+      const jsonStart = raw.indexOf('{');
+      if (jsonStart === -1) throw new Error('no JSON in CLI output');
+      const data = JSON.parse(raw.slice(jsonStart));
+      // Overlay every block the CLI JSON omits (adrs/agentdb/tests/hooks/integration)
+      // with real local reads, so those segments reflect actual state instead of 0.
+      applyLocalOverlays(data);
+      overlayMemoPromo(data);
+      writeCache(data);
+      return data;
+    } catch { /* this candidate unavailable, broken, or timed out — try the next */ }
+  }
 
-  try {
-    // #2337: prefer an already-installed CLI bin via direct `node` invocation
-    // — no npx, no registry round-trip, no @latest re-resolve per render.
-    // Fall back to `npx --prefer-offline @claude-flow/cli` (no @latest) only
-    // when nothing is installed locally, so a cold environment still works.
-    const cliBin = resolveCliBin();
-    const cmd = cliBin
-      ? '"' + process.execPath + '" "' + cliBin + '" hooks statusline --json 2>/dev/null'
-      : 'npx --prefer-offline @claude-flow/cli hooks statusline --json 2>/dev/null';
-    const raw = execSync(
-      cmd,
-      { encoding: 'utf-8', timeout: 8000, stdio: ['pipe', 'pipe', 'pipe'], cwd: CWD }
-    ).trim();
-    // The CLI may emit preamble lines before the JSON — find the first '{'.
-    const jsonStart = raw.indexOf('{');
-    if (jsonStart === -1) throw new Error('no JSON in CLI output');
-    const data = JSON.parse(raw.slice(jsonStart));
-    // Overlay every block the CLI JSON omits (adrs/agentdb/tests/hooks/integration)
-    // with real local reads, so those segments reflect actual state instead of 0.
-    applyLocalOverlays(data);
-    writeCache(data);
-    return data;
-  } catch { /* CLI unavailable or timed out */ }
-
-  // Fallback: use local file probes only (will be less accurate, but non-zero
-  // when CLI is available and accurate when it's not).
-  return buildLocalFallback();
+  // Stale-while-revalidate: if we have any cached data, keep serving it so the
+  // funnel row doesn't flicker on CLI hiccups. Overlay fresh local reads for
+  // the segments the CLI JSON doesn't populate; the promo row survives.
+  if (cache.data) {
+    applyLocalOverlays(cache.data);
+    overlayMemoPromo(cache.data);
+    return cache.data;
+  }
+
+  // Last resort: local probes + memo. Users still see the funnel row.
+  return overlayMemoPromo(buildLocalFallback());
 }
 
 // Count ADRs from BOTH known directories (fix for ruflo#2195: old code missed
@@ -188,13 +287,24 @@ function getLocalAgentDB() {
     const memDb = path.join(CWD, '.swarm', 'memory.db');
     if (fs.existsSync(memDb)) {
       const Q = String.fromCharCode(34);
-      const sql = Q + 'SELECT (SELECT COUNT(*) FROM memory_entries WHERE embedding IS NOT NULL)||' + "'|'" + '||(SELECT COUNT(*) FROM vector_indexes);' + Q;
-      const out = safeExec("sqlite3 'file:" + memDb + "?mode=ro' " + sql, 1500);
-      if (out && out.indexOf('|') !== -1) {
-        const parts = out.split('|');
-        result.vectorCount = parseInt(parts[0], 10) || 0;
-        result.hasHnsw = (parseInt(parts[1], 10) || 0) > 0;
-      }
+      // Two INDEPENDENT statements -- do NOT combine into one. Coupling the
+      // vector count with the vector_indexes row count in a single statement
+      // meant that on a DB missing the vector_indexes table (older/agentdb-
+      // written DBs), the whole statement failed at PREPARE time (SQLite
+      // compiles the full SQL before running), so the valid memory_entries
+      // count was discarded too and the statusline showed Vectors 0 despite
+      // thousands of real vectors. Split so a missing table can only zero the
+      // HNSW flag, never the count. The init self-heal provisions the table so
+      // the flag recovers on the next ruflo init / MCP start.
+      const countSql = Q + 'SELECT COUNT(*) FROM memory_entries WHERE embedding IS NOT NULL;' + Q;
+      const vc = safeExec("sqlite3 'file:" + memDb + "?mode=ro' " + countSql, 1500);
+      if (vc) result.vectorCount = parseInt(vc, 10) || 0;
+      // HNSW flag: separate statement. If vector_indexes is absent, sqlite3
+      // exits non-zero and safeExec returns empty -- hasHnsw stays false (exact
+      // original semantics: at least one index-config row present).
+      const hnswSql = Q + 'SELECT COUNT(*) FROM vector_indexes;' + Q;
+      const hn = safeExec("sqlite3 'file:" + memDb + "?mode=ro' " + hnswSql, 1500);
+      if (hn) result.hasHnsw = (parseInt(hn, 10) || 0) > 0;
     }
   } catch { /* ignore */ }
   return result;
@@ -531,7 +641,11 @@ function generateStatusline() {
   const modelName = getModelFromStdin() || (d.user && d.user.modelName) || 'Claude Code';
   const ctxInfo = getContextFromStdin();
   const costInfo = getCostFromStdin();
-  const pkgVersion = getPkgVersion();
+  // Named RUFLO_VERSION (not pkgVersion) so the #1951 regression guard
+  // (scripts/audit-fix-invariants.mjs) can pin its presence in the emitted
+  // .cjs artifact — without it the header silently reverts to a hard-coded
+  // "RuFlo V3.5" for anyone whose install doesn't match the first probe path.
+  const RUFLO_VERSION = getPkgVersion();
 
   const progress = d.v3Progress || {};
   const security = d.security || {};
@@ -567,8 +681,14 @@ function generateStatusline() {
 
   const lines = [];
 
-  // Header
-  let header = c.bold + c.brightPurple + '▊ RuFlo V' + pkgVersion + ' ' + c.reset;
+  // 3-line design (fits Claude Code's visible statusline area — line 4+ gets
+  // replaced by the system guidance / input prompt line):
+  //   Line 1 — Header (RuFlo version · git · model · timing · context · cost)
+  //   Line 2 — Compressed ops (Swarm · Hooks · 🧠 · 💾 · Health)
+  //   Line 3 — Promo / disclosure row (funnel surface, ADR-301)
+
+  // ─── Line 1: header ────────────────────────────────────────────
+  let header = c.bold + c.brightPurple + '▊ RuFlo V' + RUFLO_VERSION + ' ' + c.reset;
   header += (coordinationActive ? c.brightCyan : c.dim) + '● ' + c.brightCyan + git.name + c.reset;
   if (git.gitBranch) {
     header += '  ' + c.dim + '│' + c.reset + '  ' + c.brightBlue + '⏇ ' + git.gitBranch + c.reset;
@@ -595,81 +715,148 @@ function generateStatusline() {
   }
   lines.push(header);
 
-  // Separator
-  lines.push(c.dim + '─'.repeat(53) + c.reset);
-
-  // Line 1: DDD Domains
-  const domainsColor = domainsCompleted >= 3 ? c.brightGreen : domainsCompleted > 0 ? c.yellow : c.red;
-  let perfIndicator;
-  if (hasHnsw && vectorCount > 0) {
-    const speedup = vectorCount > 10000 ? '12500x' : vectorCount > 1000 ? '150x' : '10x';
-    perfIndicator = c.brightGreen + '⚡ HNSW ' + speedup + c.reset;
-  } else if (patternsLearned > 0) {
-    const pk = patternsLearned >= 1000 ? (patternsLearned / 1000).toFixed(1) + 'k' : String(patternsLearned);
-    perfIndicator = c.brightYellow + '📚 ' + pk + ' patterns' + c.reset;
-  } else {
-    perfIndicator = c.dim + '⚡ target: 150x-12500x' + c.reset;
-  }
-  lines.push(
-    c.brightCyan + '🏗️  DDD Domains' + c.reset + '    ' + progressBar(domainsCompleted, totalDomains) + '  ' +
-    domainsColor + domainsCompleted + c.reset + '/' + c.brightWhite + totalDomains + c.reset + '    ' + perfIndicator
-  );
-
-  // Line 2: Swarm + Hooks + CVE + Memory + Intelligence
-  const swarmInd = coordinationActive ? c.brightGreen + '◉' + c.reset : c.dim + '○' + c.reset;
-  const agentsColor = activeAgents > 0 ? c.brightGreen : c.red;
-  const secIcon = secStatus === 'CLEAN' ? '🟢' : (secStatus === 'IN_PROGRESS' || secStatus === 'STALE') ? '🟡' : (secStatus === 'NONE' ? '⚪' : '🔴');
-  const secColor = secStatus === 'CLEAN' ? c.brightGreen : (secStatus === 'IN_PROGRESS' || secStatus === 'STALE') ? c.brightYellow : (secStatus === 'NONE' ? c.dim : c.brightRed);
+  // ─── Line 2: compressed ops ────────────────────────────────────
+  // Everything actionable in one dense row. Show only what changes what you
+  // do next; diagnostic detail moves to `ruflo status --verbose`.
+  const agentsColor = activeAgents > 0 ? c.brightGreen : c.dim;
   const hooksColor = hooksEnabled > 0 ? c.brightGreen : c.dim;
   const intellColor = intelligencePct >= 80 ? c.brightGreen : intelligencePct >= 40 ? c.brightYellow : c.dim;
+  const swarmInd = coordinationActive ? c.brightGreen + '◉' + c.reset + ' ' : c.dim + '○' + c.reset + ' ';
+  const cvesClean = totalCves === 0 || cvesFixed === totalCves;
+  const healthAllGreen = (secStatus === 'CLEAN' || secStatus === 'NONE') && cvesClean;
+  const opsParts = [];
+  opsParts.push(c.cyan + 'Swarm ' + swarmInd + agentsColor + activeAgents + c.reset + '/' + c.brightWhite + maxAgents + c.reset);
+  if (subAgents > 0) opsParts.push(c.brightPurple + '👥 ' + subAgents + c.reset);
+  opsParts.push(c.cyan + 'Hooks ' + hooksColor + hooksEnabled + c.reset + '/' + c.brightWhite + hooksTotal + c.reset);
+  opsParts.push(intellColor + '🧠 ' + intelligencePct + '%' + c.reset);
+  opsParts.push(c.brightCyan + '💾 ' + memoryMB + 'MB' + c.reset);
+  // Health: one glyph when green, terse copy when there's something to act on.
+  if (healthAllGreen) {
+    opsParts.push(c.brightGreen + '🛡 ✓' + c.reset);
+  } else {
+    if (secStatus === 'PENDING') opsParts.push(c.brightYellow + '🛡 scan pending' + c.reset);
+    else if (secStatus === 'IN_PROGRESS') opsParts.push(c.brightYellow + '🛡 scanning…' + c.reset);
+    else if (secStatus === 'STALE') opsParts.push(c.brightYellow + '🛡 scan stale' + c.reset);
+    else if (secStatus !== 'NONE' && secStatus !== 'CLEAN') opsParts.push(c.brightRed + '🛡 ' + secStatus.toLowerCase() + c.reset);
+    if (totalCves > 0 && cvesFixed < totalCves) {
+      const unfixed = totalCves - cvesFixed;
+      opsParts.push(c.brightRed + '⚠ ' + unfixed + ' CVE' + (unfixed === 1 ? '' : 's') + c.reset);
+    }
+  }
+  lines.push(opsParts.join('  ' + c.dim + '·' + c.reset + '  '));
+
+  // ─── Line 3: promo / disclosure / insight ───────────────────────
+  // Colored by content kind so it reads as *what it is*, not as noise:
+  //   disclosure  → brightCyan   (announcement / capability link)
+  //   promotional → brightPurple (Cognitum sponsor spot)
+  //   educational → yellow       (a tip)
+  //   insight     → brightRed    (environment/task-aware, local, actionable —
+  //                               distinct from remote content on purpose)
+  const promoRow = getPromoRow(d);
+  if (promoRow) {
+    const kind = (d && d.promo && d.promo.kind) || 'disclosure';
+    const promoColor = kind === 'promotional' ? c.brightPurple
+                     : kind === 'educational' ? c.yellow
+                     : kind === 'insight' ? c.brightRed
+                     : c.brightCyan;
+    lines.push(promoColor + promoRow + c.reset);
+  }
+
+  // Trailing blank line so Claude Code's input prompt gets breathing room
+  // instead of butting directly against the last statusline row.
+  return lines.join('\n') + '\n';
+}
+
+// ─── Funnel promo row (ADR-301) ─────────────────────────────────
+// Allowlist for OSC 8 hyperlink targets. Ships in code (not in payload) so
+// no message can smuggle a link to an unapproved host.
+//
+// The final destination hosts (cognitum.one / agentics.org) AND the
+// click-redirect host are both allowlisted here: promo.ts routes every
+// clickable message through the server-side click-redirect (ADR-311 §7)
+// so promo_open + geo are captured before the 302 to the real target —
+// so the OSC 8 link the renderer emits points at the redirect host, not
+// the final destination directly.
+const PROMO_LINK_HOSTS = new Set([
+  'cognitum.one', 'www.cognitum.one', 'docs.cognitum.one',
+  // agentics.org — OSS foundation, distinct sponsor domain. Kept in sync
+  // with messages.ts ALLOWED_URL_HOSTS.
+  'agentics.org', 'www.agentics.org',
+  // Click-redirect host (funnel.ruv.io once its TLS cert is live; the raw
+  // Cloud Run hostname is allowlisted too since event-transport.ts /
+  // message-transport.ts / attribution.ts currently point at it as a TEMP
+  // fallback while the domain mapping's cert provisions).
+  'funnel.ruv.io',
+  'cognitum-analytics-63rzcdswba-uc.a.run.app',
+]);
+
+// Emit OSC 8 hyperlinks unless the environment is known-broken. tmux mangles
+// raw OSC 8 (see anthropics/claude-code#27047) — opt in via env if wrapped.
+function terminalSupportsHyperlinks() {
+  if (process.env.CI || process.env.GITHUB_ACTIONS) return false;
+  if (process.env.TERM === 'dumb') return false;
+  if (/^(0|false|off|no)$/i.test(String(process.env.RUFLO_STATUSLINE_HYPERLINKS || ''))) return false;
+  if (process.env.TMUX && !process.env.RUFLO_STATUSLINE_HYPERLINKS_TMUX) return false;
+  return true;
+}
 
-  lines.push(
-    c.brightYellow + '🤖 Swarm' + c.reset + '  ' + swarmInd + ' [' + agentsColor + String(activeAgents).padStart(2) + c.reset + '/' + c.brightWhite + maxAgents + c.reset + ']  ' +
-    c.brightPurple + '👥 ' + subAgents + c.reset + '    ' +
-    c.brightBlue + '🪝 ' + hooksColor + hooksEnabled + c.reset + '/' + c.brightWhite + hooksTotal + c.reset + '    ' +
-    secIcon + ' ' + secColor + 'CVE ' + cvesFixed + c.reset + '/' + c.brightWhite + totalCves + c.reset + '    ' +
-    c.brightCyan + '💾 ' + memoryMB + 'MB' + c.reset + '    ' +
-    intellColor + '🧠 ' + String(intelligencePct).padStart(3) + '%' + c.reset
-  );
-
-  // Line 3: Architecture
-  const dddColor = dddProgress >= 50 ? c.brightGreen : dddProgress > 0 ? c.yellow : c.red;
-  const adrColor = adrCount > 0 ? (adrImpl === adrCount ? c.brightGreen : c.yellow) : c.dim;
-  const adrDisplay = adrColor + '●' + adrImpl + '/' + adrCount + c.reset;
-
-  lines.push(
-    c.brightPurple + '🔧 Architecture' + c.reset + '    ' +
-    c.cyan + 'ADRs' + c.reset + ' ' + adrDisplay + '  ' + c.dim + '│' + c.reset + '  ' +
-    c.cyan + 'DDD' + c.reset + ' ' + dddColor + '●' + String(dddProgress).padStart(3) + '%' + c.reset + '  ' + c.dim + '│' + c.reset + '  ' +
-    c.cyan + 'Security' + c.reset + ' ' + secColor + '●' + secStatus + c.reset
-  );
-
-  // Line 4: AgentDB, Tests, Integration
-  const hnswInd = hasHnsw ? c.brightGreen + '⚡' + c.reset : '';
-  const sizeDisp = dbSizeKB >= 1024 ? (dbSizeKB / 1024).toFixed(1) + 'MB' : dbSizeKB + 'KB';
-  const vectorColor = vectorCount > 0 ? c.brightGreen : c.dim;
-  const testColor = testFiles > 0 ? c.brightGreen : c.dim;
-
-  // MCP / DB integration from data
-  const integration = d.integration || {};
-  const mcpServers = (integration.mcpServers) || {};
-  let integStr = '';
-  if (mcpServers.total > 0) {
-    const mcpCol = mcpServers.enabled === mcpServers.total ? c.brightGreen : mcpServers.enabled > 0 ? c.brightYellow : c.red;
-    integStr += c.cyan + 'MCP' + c.reset + ' ' + mcpCol + '●' + mcpServers.enabled + '/' + mcpServers.total + c.reset;
+// Wrap a label in an OSC 8 hyperlink escape sequence. Falls back to the raw
+// label whenever the URL is not an allowlisted https target, when the terminal
+// can't render hyperlinks, or when parsing fails — a broken link must never
+// leave a raw URL or stray escape in the statusline output.
+function safeTerminalLink(label, url) {
+  if (!terminalSupportsHyperlinks()) return label;
+  if (typeof url !== 'string' || url.length === 0) return label;
+  let parsed;
+  try { parsed = new URL(url); } catch { return label; }
+  if (parsed.protocol !== 'https:') return label;
+  if (!PROMO_LINK_HOSTS.has(parsed.hostname)) return label;
+  const cleanLabel = String(label).replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g, '');
+  if (cleanLabel.length === 0) return label;
+  const ESC = '\u001b';
+  return ESC + ']8;;' + parsed.href + ESC + '\\' + cleanLabel + ESC + ']8;;' + ESC + '\\';
+}
+
+function getPromoRow(d) {
+  try {
+    if (process.env.CI || process.env.GITHUB_ACTIONS) return null;
+    if (/^(0|false|off|no)$/i.test(String(process.env.RUFLO_FUNNEL || ''))) return null;
+    const promo = d && d.promo;
+    if (!promo || typeof promo.text !== 'string') return null;
+    // Strip control chars / ANSI / bidi overrides and hard-cap length —
+    // promo copy is data and must never emit its own terminal sequences.
+    const text = promo.text
+      .replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g, '')
+      .slice(0, 100)
+      .trim();
+    if (text.length === 0) return null;
+    // Split the label from the trailing "· manage: ruflo settings" instruction
+    // so each part gets styling that matches what it actually IS:
+    //   1. label   — OSC 8 hyperlink + underline. A real clickable link.
+    //   2. "manage:" — dim. Just a connector word, no action implied.
+    //   3. "ruflo settings" — bold/bright, NOT underlined. This is a shell
+    //      command the user TYPES, not a link they CLICK — a terminal can
+    //      never safely execute a command from a click (that would let any
+    //      server-served message run arbitrary commands), so we deliberately
+    //      avoid the underline/OSC8 cues that imply "clickable". Bold+bright
+    //      instead signals "this is the important bit — copy/type it".
+    // Educational tips have no manage tail and no URL — plain text through.
+    const manageIdx = text.indexOf(' · manage: ');
+    const label = manageIdx > 0 ? text.slice(0, manageIdx) : text;
+    const manageWord = manageIdx > 0 ? ' · manage: ' : '';
+    const command = manageIdx > 0 ? text.slice(manageIdx + manageWord.length) : '';
+    const UL_ON = '\u001b[4m';
+    const UL_OFF = '\u001b[24m';
+    const DIM_ON = '\u001b[2m';
+    const DIM_OFF = '\u001b[22m';
+    const BOLD_ON = '\u001b[1m';
+    const BOLD_OFF = '\u001b[22m';
+    const linked = promo.url ? UL_ON + safeTerminalLink(label, promo.url) + UL_OFF : label;
+    if (!command) return linked;
+    return linked + DIM_ON + manageWord + DIM_OFF + BOLD_ON + command + BOLD_OFF;
+  } catch (e) {
+    return null; // the promo row must never break the statusline
   }
-  if (integration.hasDatabase) integStr += (integStr ? '  ' : '') + c.brightGreen + '◆' + c.reset + 'DB';
-  if (!integStr) integStr = c.dim + '● none' + c.reset;
-
-  lines.push(
-    c.brightCyan + '📊 AgentDB' + c.reset + '    ' +
-    c.cyan + 'Vectors' + c.reset + ' ' + vectorColor + '●' + vectorCount + hnswInd + c.reset + '  ' + c.dim + '│' + c.reset + '  ' +
-    c.cyan + 'Size' + c.reset + ' ' + c.brightWhite + sizeDisp + c.reset + '  ' + c.dim + '│' + c.reset + '  ' +
-    c.cyan + 'Tests' + c.reset + ' ' + testColor + '●' + testFiles + c.reset + ' ' + c.dim + '(~' + testCases + ' cases)' + c.reset + '  ' + c.dim + '│' + c.reset + '  ' +
-    integStr
-  );
-
-  return lines.join('\n');
 }
 
 // JSON output — delegates to CLI for accuracy; caller can use --json flag

package/.claude/proven-config.json

@@ -1,5 +1,5 @@
 {
-  "adoptedAt": 1783265769778,
+  "adoptedAt": 1783689629580,
   "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
   "manifest": {
     "schema": "ruflo.proven-config/v1",