claude-flow 3.27.4 → 3.29.0

package/v3/@claude-flow/cli/dist/src/commands/daemon.d.ts

@@ -31,6 +31,29 @@ export declare function daemonCommandLineBelongsToWorkspace(commandLine: string,
  * Returns null for pre-#1914 daemons that never stamped a workspace.
  */
 export declare function extractWorkspaceFromDaemonLine(commandLine: string): string | null;
+/**
+ * #2661 root-fix — one-time upgrade migration warning. A user who had
+ * `aiWorkersEnabled: true` configured BEFORE this fix landed (old config
+ * file or RUFLO_DAEMON_AI_WORKERS=1) and already has multiple worktree
+ * daemons running is exactly the P0 scenario the issue describes — surface
+ * it plainly, ONCE ever (not on every `daemon start`, which would just be
+ * noise once the user has seen and acted on it). The supervisor/lease
+ * mechanism (task #9) already makes only one of those daemons actually
+ * schedule AI workers going forward; this warning's job is purely to make
+ * a pre-existing fleet VISIBLE the first time this code runs, not to take
+ * any destructive action — nothing here stops or kills another daemon.
+ *
+ * `opts` exists for tests ONLY, mirroring the injectable-dependency pattern
+ * used elsewhere in this codebase (e.g. helper-refresh.ts's
+ * sourceDirOverride) — real callers always use the defaults.
+ */
+export declare function maybeShowMultiDaemonMigrationWarning(opts?: {
+    markerFile?: string;
+    fleetScanner?: () => Promise<Array<{
+        pid: number;
+        workspace: string | null;
+    }>>;
+}): Promise<void>;
 export declare const daemonCommand: Command;
 export default daemonCommand;
 //# sourceMappingURL=daemon.d.ts.map

package/v3/@claude-flow/cli/dist/src/commands/daemon.js

@@ -7,6 +7,7 @@ import { getDaemon, startDaemon, stopDaemon } from '../services/worker-daemon.js
 import { fork } from 'child_process';
 import { fileURLToPath } from 'url';
 import { dirname, join, resolve } from 'path';
+import { homedir } from 'os';
 import * as fs from 'fs';
 // Start daemon subcommand
 const startCommand = {
@@ -580,6 +581,11 @@ async function startBackgroundDaemon(projectRoot, quiet, forwarded = {}) {
             }
         }
         catch { /* best-effort visibility — never fail the start */ }
+        // #2661 root-fix — one-time migration warning for a pre-existing
+        // multi-daemon fleet that already had AI workers enabled before this
+        // fix landed. Separate from the always-shown notice above: this one
+        // fires at most once ever, and only for the genuinely risky shape.
+        await maybeShowMultiDaemonMigrationWarning();
     }
     return { success: true };
 }
@@ -942,6 +948,68 @@ async function scanRunningDaemons() {
         return [];
     }
 }
+function defaultMultiDaemonWarningMarker() {
+    return join(homedir(), '.claude-flow', 'multi-daemon-warning-shown.json');
+}
+/**
+ * #2661 root-fix — one-time upgrade migration warning. A user who had
+ * `aiWorkersEnabled: true` configured BEFORE this fix landed (old config
+ * file or RUFLO_DAEMON_AI_WORKERS=1) and already has multiple worktree
+ * daemons running is exactly the P0 scenario the issue describes — surface
+ * it plainly, ONCE ever (not on every `daemon start`, which would just be
+ * noise once the user has seen and acted on it). The supervisor/lease
+ * mechanism (task #9) already makes only one of those daemons actually
+ * schedule AI workers going forward; this warning's job is purely to make
+ * a pre-existing fleet VISIBLE the first time this code runs, not to take
+ * any destructive action — nothing here stops or kills another daemon.
+ *
+ * `opts` exists for tests ONLY, mirroring the injectable-dependency pattern
+ * used elsewhere in this codebase (e.g. helper-refresh.ts's
+ * sourceDirOverride) — real callers always use the defaults.
+ */
+export async function maybeShowMultiDaemonMigrationWarning(opts) {
+    const markerFile = opts?.markerFile ?? defaultMultiDaemonWarningMarker();
+    try {
+        if (fs.existsSync(markerFile))
+            return;
+        const fleet = await (opts?.fleetScanner ?? scanRunningDaemons)();
+        if (fleet.length <= 1)
+            return;
+        let anyAiEnabled = false;
+        for (const d of fleet) {
+            if (!d.workspace)
+                continue;
+            try {
+                const statePath = join(d.workspace, '.claude-flow', 'daemon-state.json');
+                if (!fs.existsSync(statePath))
+                    continue;
+                const st = JSON.parse(fs.readFileSync(statePath, 'utf-8'));
+                if (st?.config?.aiWorkersEnabled === true) {
+                    anyAiEnabled = true;
+                    break;
+                }
+            }
+            catch { /* unreadable state — skip this daemon */ }
+        }
+        // Only the genuinely risky shape (pre-existing fleet + AI workers
+        // enabled somewhere in it) warrants the migration warning. A harmless
+        // multi-daemon fleet with AI workers off everywhere already gets the
+        // lighter, always-shown fleet-size notice at daemon start.
+        if (anyAiEnabled) {
+            output.writeln();
+            output.printWarning(`Ruflo found ${fleet.length} worktree daemons. Scheduled AI workers are now supervisor-gated.`);
+            output.printInfo('Inspect:                      ruflo daemon status --all');
+            output.printInfo('Stop all:                      ruflo daemon stop --all');
+            output.printInfo('Pause autonomous launches:     ruflo daemon budget pause');
+            output.writeln();
+        }
+        const dir = dirname(markerFile);
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        fs.writeFileSync(markerFile, JSON.stringify({ shownAt: new Date().toISOString(), fleetSize: fleet.length, anyAiEnabled }), { mode: 0o600 });
+    }
+    catch { /* best-effort visibility — never fail the command */ }
+}
 /**
  * #2356: render the global `daemon status --all` view. For each running daemon
  * it reads that workspace's daemon-state.json to show age + configured TTL,
@@ -1010,6 +1078,39 @@ async function renderAllDaemonsStatus() {
     if (daemons.length > 1) {
         output.printInfo('Stop all daemons across workspaces with: ruflo daemon stop --all');
     }
+    // #2661 root-fix — repository supervisor state, one row per distinct
+    // repository among the scanned daemons' workspaces. Resolving identity
+    // per workspace is cheap (a couple of `git rev-parse` calls, cached).
+    try {
+        const { resolveGitWorkspaceIdentity } = await import('../services/git-workspace-identity.js');
+        const { getRepoSupervisorRegistry } = await import('../services/repo-supervisor.js');
+        const { getWorkspaceLeaseRegistry } = await import('../services/workspace-lease.js');
+        const seenRepos = new Map(); // repositoryId -> a representative workspace path
+        for (const d of daemons) {
+            if (!d.workspace)
+                continue;
+            const identity = resolveGitWorkspaceIdentity(d.workspace);
+            if (identity.isGit && !seenRepos.has(identity.repositoryId)) {
+                seenRepos.set(identity.repositoryId, d.workspace);
+            }
+        }
+        if (seenRepos.size > 0) {
+            const supervisorReg = getRepoSupervisorRegistry();
+            const leaseReg = getWorkspaceLeaseRegistry();
+            const lines = [];
+            for (const [repositoryId, sampleWorkspace] of seenRepos) {
+                const record = supervisorReg.getRecord(repositoryId);
+                const activeLeases = leaseReg.listActive(repositoryId).length;
+                const label = repositoryId.slice(0, 12);
+                lines.push(record
+                    ? `  ${label}…  supervisor: ${record.worktreeRoot} (pid ${record.pid})  |  active leases: ${activeLeases}`
+                    : `  ${label}…  supervisor: ${output.dim('none elected')}  |  active leases: ${activeLeases}`);
+            }
+            output.writeln();
+            output.printBox(lines.join('\n'), 'Repository Supervisors (#2661 root-fix)');
+        }
+    }
+    catch { /* supervisor registry unavailable — skip the panel */ }
     // #2661: user-global AI launch usage — the shared budget every daemon
     // draws from, independent of worktree count.
     try {
@@ -1330,33 +1431,33 @@ const installSupervisorCommand = {
             const plistDir = join(home, 'Library', 'LaunchAgents');
             const plistPath = join(plistDir, 'io.ruv.ruflo.daemon.plist');
             const logDir = join(projectRoot, '.claude-flow', 'logs');
-            const plist = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>Label</key><string>io.ruv.ruflo.daemon</string>
-    <key>ProgramArguments</key>
-    <array>
-        <string>${nodeBin}</string>
-        <string>${cliJs}</string>
-        <string>daemon</string><string>start</string><string>--foreground</string><string>--quiet</string>
-    </array>
-    <key>WorkingDirectory</key><string>${projectRoot}</string>
-    <key>RunAtLoad</key><true/>
-    <key>KeepAlive</key>
-    <dict>
-        <key>SuccessfulExit</key><false/>
-        <key>Crashed</key><true/>
-    </dict>
-    <key>ThrottleInterval</key><integer>10</integer>
-    <key>StandardOutPath</key><string>${logDir}/supervisor.out.log</string>
-    <key>StandardErrorPath</key><string>${logDir}/supervisor.err.log</string>
-    <key>EnvironmentVariables</key>
-    <dict>
-        <key>CLAUDE_FLOW_DAEMON</key><string>1</string>
-    </dict>
-</dict>
-</plist>
+            const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key><string>io.ruv.ruflo.daemon</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>${nodeBin}</string>
+        <string>${cliJs}</string>
+        <string>daemon</string><string>start</string><string>--foreground</string><string>--quiet</string>
+    </array>
+    <key>WorkingDirectory</key><string>${projectRoot}</string>
+    <key>RunAtLoad</key><true/>
+    <key>KeepAlive</key>
+    <dict>
+        <key>SuccessfulExit</key><false/>
+        <key>Crashed</key><true/>
+    </dict>
+    <key>ThrottleInterval</key><integer>10</integer>
+    <key>StandardOutPath</key><string>${logDir}/supervisor.out.log</string>
+    <key>StandardErrorPath</key><string>${logDir}/supervisor.err.log</string>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>CLAUDE_FLOW_DAEMON</key><string>1</string>
+    </dict>
+</dict>
+</plist>
 `;
             if (dryRun) {
                 output.writeln(plist);
@@ -1397,23 +1498,23 @@ const installSupervisorCommand = {
         // Linux: systemd-user
         const unitDir = join(home, '.config', 'systemd', 'user');
         const unitPath = join(unitDir, 'ruflo-daemon.service');
-        const unit = `[Unit]
-Description=RuFlo background worker daemon
-After=default.target
-
-[Service]
-Type=simple
-WorkingDirectory=${projectRoot}
-Environment=CLAUDE_FLOW_DAEMON=1
-ExecStart=${nodeBin} ${cliJs} daemon start --foreground --quiet
-Restart=on-failure
-RestartSec=10
-# Restart on Crashed (signal) too
-StartLimitIntervalSec=300
-StartLimitBurst=5
-
-[Install]
-WantedBy=default.target
+        const unit = `[Unit]
+Description=RuFlo background worker daemon
+After=default.target
+
+[Service]
+Type=simple
+WorkingDirectory=${projectRoot}
+Environment=CLAUDE_FLOW_DAEMON=1
+ExecStart=${nodeBin} ${cliJs} daemon start --foreground --quiet
+Restart=on-failure
+RestartSec=10
+# Restart on Crashed (signal) too
+StartLimitIntervalSec=300
+StartLimitBurst=5
+
+[Install]
+WantedBy=default.target
 `;
         if (dryRun) {
             output.writeln(unit);
@@ -1496,6 +1597,76 @@ const uninstallSupervisorCommand = {
         return { success: false, exitCode: 1 };
     },
 };
+// #2661 root-fix — `daemon budget show|pause|resume`. The budget state was
+// previously visible only inline in `daemon status --all`; these give it an
+// independently scriptable surface (e.g. `ruflo daemon budget pause` before
+// a long interactive session, `... resume` after).
+const budgetShowCommand = {
+    name: 'show',
+    description: 'Show the user-global AI launch budget (launches, active children, circuit-breaker state)',
+    options: [],
+    examples: [{ command: 'claude-flow daemon budget show', description: 'Show current budget usage and limits' }],
+    action: async () => {
+        const { getGlobalAiBudget } = await import('../services/global-ai-budget.js');
+        const budget = getGlobalAiBudget();
+        const usage = budget.getUsage();
+        const limits = budget.getLimits();
+        output.writeln();
+        const byWs = usage.byWorkspace.slice(0, 10).map((w) => `  ${w.launches}× ${w.workspace}`);
+        output.printBox([
+            `Launches (last hour): ${usage.lastHour}/${limits.maxLaunchesPerHour}`,
+            `Launches (last 24h):  ${usage.lastDay}/${limits.maxLaunchesPerDay}`,
+            `Active Claude children: ${usage.active}/${limits.maxConcurrentGlobal}`,
+            usage.pausedUntil
+                ? output.warning(`PAUSED until ${new Date(usage.pausedUntil).toISOString()} (${usage.pauseReason ?? 'quota error'})`)
+                : `Circuit breaker: ${output.dim('closed (normal)')}`,
+            ...(byWs.length > 0 ? ['Launches by workspace (24h):', ...byWs] : []),
+        ].join('\n'), 'Global AI Budget');
+        return { success: true, data: { usage, limits } };
+    },
+};
+const budgetPauseCommand = {
+    name: 'pause',
+    description: 'Pause ALL autonomous Claude launches across every daemon until resumed',
+    options: [
+        { name: 'reason', short: 'r', type: 'string', description: 'Optional reason recorded in the pause receipt' },
+    ],
+    examples: [{ command: 'claude-flow daemon budget pause --reason "conserving quota for a demo"', description: 'Pause autonomous launches' }],
+    action: async (ctx) => {
+        const { getGlobalAiBudget } = await import('../services/global-ai-budget.js');
+        await getGlobalAiBudget().pause(ctx.flags.reason);
+        output.printSuccess('Autonomous AI worker launches paused across all daemons. Resume with: ruflo daemon budget resume');
+        return { success: true };
+    },
+};
+const budgetResumeCommand = {
+    name: 'resume',
+    description: 'Resume autonomous Claude launches (clears a manual pause or a quota-triggered circuit-breaker pause)',
+    options: [],
+    examples: [{ command: 'claude-flow daemon budget resume', description: 'Resume autonomous launches' }],
+    action: async () => {
+        const { getGlobalAiBudget } = await import('../services/global-ai-budget.js');
+        await getGlobalAiBudget().resume();
+        output.printSuccess('Autonomous AI worker launches resumed.');
+        return { success: true };
+    },
+};
+const budgetCommand = {
+    name: 'budget',
+    description: 'Inspect and control the user-global AI launch budget (#2661)',
+    subcommands: [budgetShowCommand, budgetPauseCommand, budgetResumeCommand],
+    options: [],
+    examples: [
+        { command: 'claude-flow daemon budget show', description: 'Show current usage/limits' },
+        { command: 'claude-flow daemon budget pause', description: 'Pause all autonomous launches' },
+        { command: 'claude-flow daemon budget resume', description: 'Resume autonomous launches' },
+    ],
+    // Bare `daemon budget` (no subcommand) shows usage — same as `show`.
+    action: async (ctx) => {
+        const result = await budgetShowCommand.action(ctx);
+        return result ?? { success: true };
+    },
+};
 // Main daemon command
 export const daemonCommand = {
     name: 'daemon',
@@ -1506,6 +1677,7 @@ export const daemonCommand = {
         statusCommand,
         triggerCommand,
         enableCommand,
+        budgetCommand,
         installSupervisorCommand,
         uninstallSupervisorCommand,
     ],

package/v3/@claude-flow/cli/dist/src/commands/embeddings.js

@@ -147,13 +147,13 @@ const searchCommand = {
             // Get all entries with embeddings from database
             // Parameterized query to prevent SQL injection (CRIT-01)
             const embeddingSql = namespace !== 'all'
-                ? `SELECT id, key, namespace, content, embedding, embedding_dimensions
-           FROM memory_entries
-           WHERE status = 'active' AND embedding IS NOT NULL AND namespace = ?
+                ? `SELECT id, key, namespace, content, embedding, embedding_dimensions
+           FROM memory_entries
+           WHERE status = 'active' AND embedding IS NOT NULL AND namespace = ?
            LIMIT 1000`
-                : `SELECT id, key, namespace, content, embedding, embedding_dimensions
-           FROM memory_entries
-           WHERE status = 'active' AND embedding IS NOT NULL
+                : `SELECT id, key, namespace, content, embedding, embedding_dimensions
+           FROM memory_entries
+           WHERE status = 'active' AND embedding IS NOT NULL
            LIMIT 1000`;
             const embeddingStmt = db.prepare(embeddingSql);
             if (namespace !== 'all') {
@@ -192,16 +192,16 @@ const searchCommand = {
                 const likePattern = `%${query}%`;
                 const remainingLimit = Math.max(0, limit - results.length);
                 const keywordSql = namespace !== 'all'
-                    ? `SELECT id, key, namespace, content
-             FROM memory_entries
-             WHERE status = 'active'
-               AND (content LIKE ? OR key LIKE ?)
-               AND namespace = ?
+                    ? `SELECT id, key, namespace, content
+             FROM memory_entries
+             WHERE status = 'active'
+               AND (content LIKE ? OR key LIKE ?)
+               AND namespace = ?
              LIMIT ?`
-                    : `SELECT id, key, namespace, content
-             FROM memory_entries
-             WHERE status = 'active'
-               AND (content LIKE ? OR key LIKE ?)
+                    : `SELECT id, key, namespace, content
+             FROM memory_entries
+             WHERE status = 'active'
+               AND (content LIKE ? OR key LIKE ?)
              LIMIT ?`;
                 const keywordStmt = db.prepare(keywordSql);
                 if (namespace !== 'all') {
@@ -408,17 +408,17 @@ const collectionsCommand = {
             const fileBuffer = fs.readFileSync(fullDbPath);
             const db = new SQL.Database(fileBuffer);
             // Get collection stats from database
-            const statsQuery = db.exec(`
-        SELECT
-          namespace,
-          COUNT(*) as total_entries,
-          SUM(CASE WHEN embedding IS NOT NULL THEN 1 ELSE 0 END) as with_embeddings,
-          AVG(embedding_dimensions) as avg_dimensions,
-          SUM(LENGTH(content)) as total_content_size
-        FROM memory_entries
-        WHERE status = 'active'
-        GROUP BY namespace
-        ORDER BY total_entries DESC
+            const statsQuery = db.exec(`
+        SELECT
+          namespace,
+          COUNT(*) as total_entries,
+          SUM(CASE WHEN embedding IS NOT NULL THEN 1 ELSE 0 END) as with_embeddings,
+          AVG(embedding_dimensions) as avg_dimensions,
+          SUM(LENGTH(content)) as total_content_size
+        FROM memory_entries
+        WHERE status = 'active'
+        GROUP BY namespace
+        ORDER BY total_entries DESC
       `);
             // Get vector index info
             const indexQuery = db.exec(`SELECT name, dimensions, hnsw_m FROM vector_indexes`);

package/v3/@claude-flow/cli/dist/src/commands/funnel.d.ts

@@ -5,6 +5,8 @@
  *   funnel status    effective state and which precedence source decided it
  *   funnel disable   user-level opt-out (all surfaces) + delete funnel data
  *   funnel enable    re-enable at the user tier (cannot override env/enterprise)
+ *   funnel accept    acknowledge the disclosure so rotation starts immediately
+ *   funnel open      open the currently-shown promo URL in the default browser
  *   funnel id        print the pseudonymous funnel ID, if one exists
  */
 import type { Command } from '../types.js';

package/v3/@claude-flow/cli/dist/src/commands/funnel.js

@@ -5,10 +5,16 @@
  *   funnel status    effective state and which precedence source decided it
  *   funnel disable   user-level opt-out (all surfaces) + delete funnel data
  *   funnel enable    re-enable at the user tier (cannot override env/enterprise)
+ *   funnel accept    acknowledge the disclosure so rotation starts immediately
+ *   funnel open      open the currently-shown promo URL in the default browser
  *   funnel id        print the pseudonymous funnel ID, if one exists
  */
+import { execFile } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
 import { output } from '../output.js';
-import { deleteFunnelData, funnelStateDir, getDisclosure, getFunnelId, readConsents, recordDisclosureDeclined, recordDisclosureReenabled, resolveFunnelEnabled, } from '../funnel/index.js';
+import { deleteFunnelData, funnelStateDir, getDisclosure, getFunnelId, promoEligible, readConsents, recordDisclosureAccepted, recordDisclosureDeclined, recordDisclosureReenabled, resolveFunnelEnabled, } from '../funnel/index.js';
 import { readStateJson, writeStateJson } from '../funnel/state.js';
 function setUserConfigEnabled(enabled) {
     const cfg = readStateJson('funnel.json') ?? {};
@@ -75,6 +81,106 @@ const enableSub = {
         return { success: true, data: decision };
     },
 };
+const acceptSub = {
+    name: 'accept',
+    description: 'Acknowledge the disclosure so rotation starts immediately (skips the 24h grace window)',
+    action: async () => {
+        const decision = resolveFunnelEnabled();
+        if (!decision.enabled) {
+            output.printWarning(`Funnel is currently disabled by: ${decision.decidedBy}. Run 'ruflo funnel enable' first, then re-run accept.`);
+            return { success: false, data: decision };
+        }
+        const current = getDisclosure();
+        if (current.state === 'disclosed_disabled') {
+            output.printWarning("Disclosure is in a declined state. Run 'ruflo funnel enable' first, then re-run accept.");
+            return { success: false, data: current };
+        }
+        const rec = recordDisclosureAccepted();
+        const eligible = promoEligible();
+        output.printSuccess(`Disclosure accepted (firstShownAt backdated to ${rec.firstShownAt}). Promo rotation eligible: ${eligible}.`);
+        return { success: true, data: { record: rec, eligible } };
+    },
+};
+// Reads the memoized promo written by the statusline renderer. Same file
+// path as .claude/helpers/statusline.cjs's PROMO_MEMO_FILE — kept in sync
+// by convention. Returns null on any error so a broken memo can't crash
+// the subcommand.
+function readCurrentPromo() {
+    try {
+        const memoPath = path.join(os.homedir(), '.ruflo', 'statusline-promo.json');
+        const raw = JSON.parse(fs.readFileSync(memoPath, 'utf-8'));
+        if (raw && raw.promo && typeof raw.promo === 'object')
+            return raw.promo;
+    }
+    catch { /* memo absent or corrupt — treat as "nothing shown yet" */ }
+    return null;
+}
+// Allowlist mirrors the OSC 8 hyperlink allowlist in the statusline renderer.
+// Never open a URL whose host isn't on this list, even if a corrupted memo
+// somehow lands one there — the memo is user-writable so we must not treat
+// it as trusted. Kept in sync with .claude/helpers/statusline.cjs's
+// PROMO_LINK_HOSTS.
+const OPEN_ALLOWED_HOSTS = new Set([
+    'cognitum.one', 'www.cognitum.one', 'docs.cognitum.one',
+    'agentics.org', 'www.agentics.org',
+    'funnel.ruv.io',
+    'cognitum-analytics-63rzcdswba-uc.a.run.app',
+]);
+// Open a URL using the platform's default browser handler. execFile (not
+// exec) — no shell involved, so nothing in the URL can be interpreted as a
+// shell command even in the pathological case where allowlisting is
+// bypassed. Runs detached + hidden so no cmd window flashes on Windows.
+function openInBrowser(url) {
+    return new Promise((resolve, reject) => {
+        const platform = process.platform;
+        const [cmd, args] = platform === 'win32'
+            // "start" needs an empty title argument first, else the first quoted
+            // arg becomes the title and the URL is ignored. cmd /c is required to
+            // invoke the built-in start command.
+            ? ['cmd', ['/c', 'start', '""', url]]
+            : platform === 'darwin'
+                ? ['open', [url]]
+                : ['xdg-open', [url]];
+        execFile(cmd, args, { windowsHide: true }, (err) => (err ? reject(err) : resolve()));
+    });
+}
+const openSub = {
+    name: 'open',
+    description: 'Open the currently-shown statusline promo URL in the default browser',
+    action: async () => {
+        const promo = readCurrentPromo();
+        if (!promo) {
+            output.printWarning("No promo has been shown yet. Wait for the statusline to render one, then re-run 'ruflo funnel open'.");
+            return { success: false };
+        }
+        if (!promo.url) {
+            output.printWarning(`Current promo (kind=${promo.kind ?? 'unknown'}) has no URL. Nothing to open: "${promo.text}"`);
+            return { success: false, data: promo };
+        }
+        let parsed;
+        try {
+            parsed = new URL(promo.url);
+        }
+        catch {
+            output.printError(`Promo URL is malformed: ${promo.url}`);
+            return { success: false, data: promo };
+        }
+        if (parsed.protocol !== 'https:' || !OPEN_ALLOWED_HOSTS.has(parsed.hostname)) {
+            output.printError(`Refusing to open URL — not on the allowlist: ${parsed.protocol}//${parsed.hostname}`);
+            return { success: false, data: { url: promo.url } };
+        }
+        try {
+            await openInBrowser(parsed.href);
+            output.printSuccess(`Opened: ${parsed.href}`);
+            return { success: true, data: { url: parsed.href } };
+        }
+        catch (err) {
+            output.printError(`Failed to open URL: ${err instanceof Error ? err.message : String(err)}`);
+            output.writeln(`URL for manual copy: ${parsed.href}`);
+            return { success: false, data: { url: parsed.href } };
+        }
+    },
+};
 const idSub = {
     name: 'id',
     description: 'Print the pseudonymous funnel ID (exists only with telemetry consent)',
@@ -92,9 +198,11 @@ const idSub = {
 export const funnelCommand = {
     name: 'funnel',
     description: 'Control the Cognitum lifecycle funnel surfaces (tips, enrollment, notices)',
-    subcommands: [statusSub, disableSub, enableSub, idSub],
+    subcommands: [statusSub, disableSub, enableSub, acceptSub, openSub, idSub],
     examples: [
         { command: 'ruflo funnel status', description: 'Effective state + deciding source' },
+        { command: 'ruflo funnel accept', description: 'Skip the 24h grace so rotation starts now' },
+        { command: 'ruflo funnel open', description: 'Open the current promo URL in the browser' },
         { command: 'ruflo funnel disable', description: 'Turn off every funnel surface' },
     ],
     action: statusSub.action,