claude-flow 3.32.8 → 3.32.10

package/.claude/helpers/standard-checkpoint-hooks.sh

@@ -1,189 +1,189 @@
-#!/bin/bash
-# Standard checkpoint hook functions for Claude settings.json (without GitHub features)
-
-# Function to handle pre-edit checkpoints
-pre_edit_checkpoint() {
-    local tool_input="$1"
-    # Handle both JSON input and plain file path
-    if echo "$tool_input" | jq -e . >/dev/null 2>&1; then
-        local file=$(echo "$tool_input" | jq -r '.file_path // empty')
-    else
-        local file="$tool_input"
-    fi
-    
-    if [ -n "$file" ]; then
-        local checkpoint_branch="checkpoint/pre-edit-$(date +%Y%m%d-%H%M%S)"
-        local current_branch=$(git branch --show-current)
-        
-        # Create checkpoint
-        git add -A
-        git stash push -m "Pre-edit checkpoint for $file" >/dev/null 2>&1
-        git branch "$checkpoint_branch"
-        
-        # Store metadata
-        mkdir -p .claude/checkpoints
-        cat > ".claude/checkpoints/$(date +%s).json" <<EOF
-{
-  "branch": "$checkpoint_branch",
-  "file": "$file",
-  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
-  "type": "pre-edit",
-  "original_branch": "$current_branch"
-}
-EOF
-        
-        # Restore working directory
-        git stash pop --quiet >/dev/null 2>&1 || true
-        
-        echo "✅ Created checkpoint: $checkpoint_branch for $file"
-    fi
-}
-
-# Function to handle post-edit checkpoints
-post_edit_checkpoint() {
-    local tool_input="$1"
-    # Handle both JSON input and plain file path
-    if echo "$tool_input" | jq -e . >/dev/null 2>&1; then
-        local file=$(echo "$tool_input" | jq -r '.file_path // empty')
-    else
-        local file="$tool_input"
-    fi
-    
-    if [ -n "$file" ] && [ -f "$file" ]; then
-        # Check if file was modified - first check if file is tracked
-        if ! git ls-files --error-unmatch "$file" >/dev/null 2>&1; then
-            # File is not tracked, add it first
-            git add "$file"
-        fi
-        
-        # Now check if there are changes
-        if git diff --cached --quiet "$file" 2>/dev/null && git diff --quiet "$file" 2>/dev/null; then
-            echo "ℹ️  No changes to checkpoint for $file"
-        else
-            local tag_name="checkpoint-$(date +%Y%m%d-%H%M%S)"
-            local current_branch=$(git branch --show-current)
-            
-            # Create commit
-            git add "$file"
-            if git commit -m "🔖 Checkpoint: Edit $file
-
-Automatic checkpoint created by Claude
-- File: $file
-- Branch: $current_branch
-- Timestamp: $(date -u +%Y-%m-%dT%H:%M:%SZ)
-
-[Auto-checkpoint]" --quiet; then
-                # Create tag only if commit succeeded
-                git tag -a "$tag_name" -m "Checkpoint after editing $file"
-                
-                # Store metadata
-                mkdir -p .claude/checkpoints
-                local diff_stats=$(git diff HEAD~1 --stat | tr '\n' ' ' | sed 's/"/\"/g')
-                cat > ".claude/checkpoints/$(date +%s).json" <<EOF
-{
-  "tag": "$tag_name",
-  "file": "$file",
-  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
-  "type": "post-edit",
-  "branch": "$current_branch",
-  "diff_summary": "$diff_stats"
-}
-EOF
-                
-                echo "✅ Created checkpoint: $tag_name for $file"
-            else
-                echo "ℹ️  No commit created (no changes or commit failed)"
-            fi
-        fi
-    fi
-}
-
-# Function to handle task checkpoints
-task_checkpoint() {
-    local user_prompt="$1"
-    local task=$(echo "$user_prompt" | head -c 100 | tr '\n' ' ')
-    
-    if [ -n "$task" ]; then
-        local checkpoint_name="task-$(date +%Y%m%d-%H%M%S)"
-        
-        # Commit current state
-        git add -A
-        git commit -m "🔖 Task checkpoint: $task..." --quiet || true
-        
-        # Store metadata
-        mkdir -p .claude/checkpoints
-        cat > ".claude/checkpoints/task-$(date +%s).json" <<EOF
-{
-  "checkpoint": "$checkpoint_name",
-  "task": "$task",
-  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
-  "commit": "$(git rev-parse HEAD)"
-}
-EOF
-        
-        echo "✅ Created task checkpoint: $checkpoint_name"
-    fi
-}
-
-# Function to handle session end
-session_end_checkpoint() {
-    local session_id="session-$(date +%Y%m%d-%H%M%S)"
-    local summary_file=".claude/checkpoints/summary-$session_id.md"
-    
-    mkdir -p .claude/checkpoints
-    
-    # Create summary
-    cat > "$summary_file" <<EOF
-# Session Summary - $(date +'%Y-%m-%d %H:%M:%S')
-
-## Checkpoints Created
-$(find .claude/checkpoints -name '*.json' -mtime -1 -exec basename {} \; | sort)
-
-## Files Modified
-$(git diff --name-only $(git log --format=%H -n 1 --before="1 hour ago" 2>/dev/null) 2>/dev/null || echo "No files tracked")
-
-## Recent Commits
-$(git log --oneline -10 --grep="Checkpoint" || echo "No checkpoint commits")
-
-## Rollback Instructions
-To rollback to a specific checkpoint:
-\`\`\`bash
-# List all checkpoints
-git tag -l 'checkpoint-*' | sort -r
-
-# Rollback to a checkpoint
-git checkout checkpoint-YYYYMMDD-HHMMSS
-
-# Or reset to a checkpoint (destructive)
-git reset --hard checkpoint-YYYYMMDD-HHMMSS
-\`\`\`
-EOF
-    
-    # Create final checkpoint
-    git add -A
-    git commit -m "🏁 Session end checkpoint: $session_id" --quiet || true
-    git tag -a "session-end-$session_id" -m "End of Claude session"
-    
-    echo "✅ Session summary saved to: $summary_file"
-    echo "📌 Final checkpoint: session-end-$session_id"
-}
-
-# Main entry point
-case "$1" in
-    pre-edit)
-        pre_edit_checkpoint "$2"
-        ;;
-    post-edit)
-        post_edit_checkpoint "$2"
-        ;;
-    task)
-        task_checkpoint "$2"
-        ;;
-    session-end)
-        session_end_checkpoint
-        ;;
-    *)
-        echo "Usage: $0 {pre-edit|post-edit|task|session-end} [input]"
-        exit 1
-        ;;
-esac
+#!/bin/bash
+# Standard checkpoint hook functions for Claude settings.json (without GitHub features)
+
+# Function to handle pre-edit checkpoints
+pre_edit_checkpoint() {
+    local tool_input="$1"
+    # Handle both JSON input and plain file path
+    if echo "$tool_input" | jq -e . >/dev/null 2>&1; then
+        local file=$(echo "$tool_input" | jq -r '.file_path // empty')
+    else
+        local file="$tool_input"
+    fi
+    
+    if [ -n "$file" ]; then
+        local checkpoint_branch="checkpoint/pre-edit-$(date +%Y%m%d-%H%M%S)"
+        local current_branch=$(git branch --show-current)
+        
+        # Create checkpoint
+        git add -A
+        git stash push -m "Pre-edit checkpoint for $file" >/dev/null 2>&1
+        git branch "$checkpoint_branch"
+        
+        # Store metadata
+        mkdir -p .claude/checkpoints
+        cat > ".claude/checkpoints/$(date +%s).json" <<EOF
+{
+  "branch": "$checkpoint_branch",
+  "file": "$file",
+  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+  "type": "pre-edit",
+  "original_branch": "$current_branch"
+}
+EOF
+        
+        # Restore working directory
+        git stash pop --quiet >/dev/null 2>&1 || true
+        
+        echo "✅ Created checkpoint: $checkpoint_branch for $file"
+    fi
+}
+
+# Function to handle post-edit checkpoints
+post_edit_checkpoint() {
+    local tool_input="$1"
+    # Handle both JSON input and plain file path
+    if echo "$tool_input" | jq -e . >/dev/null 2>&1; then
+        local file=$(echo "$tool_input" | jq -r '.file_path // empty')
+    else
+        local file="$tool_input"
+    fi
+    
+    if [ -n "$file" ] && [ -f "$file" ]; then
+        # Check if file was modified - first check if file is tracked
+        if ! git ls-files --error-unmatch "$file" >/dev/null 2>&1; then
+            # File is not tracked, add it first
+            git add "$file"
+        fi
+        
+        # Now check if there are changes
+        if git diff --cached --quiet "$file" 2>/dev/null && git diff --quiet "$file" 2>/dev/null; then
+            echo "ℹ️  No changes to checkpoint for $file"
+        else
+            local tag_name="checkpoint-$(date +%Y%m%d-%H%M%S)"
+            local current_branch=$(git branch --show-current)
+            
+            # Create commit
+            git add "$file"
+            if git commit -m "🔖 Checkpoint: Edit $file
+
+Automatic checkpoint created by Claude
+- File: $file
+- Branch: $current_branch
+- Timestamp: $(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+[Auto-checkpoint]" --quiet; then
+                # Create tag only if commit succeeded
+                git tag -a "$tag_name" -m "Checkpoint after editing $file"
+                
+                # Store metadata
+                mkdir -p .claude/checkpoints
+                local diff_stats=$(git diff HEAD~1 --stat | tr '\n' ' ' | sed 's/"/\"/g')
+                cat > ".claude/checkpoints/$(date +%s).json" <<EOF
+{
+  "tag": "$tag_name",
+  "file": "$file",
+  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+  "type": "post-edit",
+  "branch": "$current_branch",
+  "diff_summary": "$diff_stats"
+}
+EOF
+                
+                echo "✅ Created checkpoint: $tag_name for $file"
+            else
+                echo "ℹ️  No commit created (no changes or commit failed)"
+            fi
+        fi
+    fi
+}
+
+# Function to handle task checkpoints
+task_checkpoint() {
+    local user_prompt="$1"
+    local task=$(echo "$user_prompt" | head -c 100 | tr '\n' ' ')
+    
+    if [ -n "$task" ]; then
+        local checkpoint_name="task-$(date +%Y%m%d-%H%M%S)"
+        
+        # Commit current state
+        git add -A
+        git commit -m "🔖 Task checkpoint: $task..." --quiet || true
+        
+        # Store metadata
+        mkdir -p .claude/checkpoints
+        cat > ".claude/checkpoints/task-$(date +%s).json" <<EOF
+{
+  "checkpoint": "$checkpoint_name",
+  "task": "$task",
+  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+  "commit": "$(git rev-parse HEAD)"
+}
+EOF
+        
+        echo "✅ Created task checkpoint: $checkpoint_name"
+    fi
+}
+
+# Function to handle session end
+session_end_checkpoint() {
+    local session_id="session-$(date +%Y%m%d-%H%M%S)"
+    local summary_file=".claude/checkpoints/summary-$session_id.md"
+    
+    mkdir -p .claude/checkpoints
+    
+    # Create summary
+    cat > "$summary_file" <<EOF
+# Session Summary - $(date +'%Y-%m-%d %H:%M:%S')
+
+## Checkpoints Created
+$(find .claude/checkpoints -name '*.json' -mtime -1 -exec basename {} \; | sort)
+
+## Files Modified
+$(git diff --name-only $(git log --format=%H -n 1 --before="1 hour ago" 2>/dev/null) 2>/dev/null || echo "No files tracked")
+
+## Recent Commits
+$(git log --oneline -10 --grep="Checkpoint" || echo "No checkpoint commits")
+
+## Rollback Instructions
+To rollback to a specific checkpoint:
+\`\`\`bash
+# List all checkpoints
+git tag -l 'checkpoint-*' | sort -r
+
+# Rollback to a checkpoint
+git checkout checkpoint-YYYYMMDD-HHMMSS
+
+# Or reset to a checkpoint (destructive)
+git reset --hard checkpoint-YYYYMMDD-HHMMSS
+\`\`\`
+EOF
+    
+    # Create final checkpoint
+    git add -A
+    git commit -m "🏁 Session end checkpoint: $session_id" --quiet || true
+    git tag -a "session-end-$session_id" -m "End of Claude session"
+    
+    echo "✅ Session summary saved to: $summary_file"
+    echo "📌 Final checkpoint: session-end-$session_id"
+}
+
+# Main entry point
+case "$1" in
+    pre-edit)
+        pre_edit_checkpoint "$2"
+        ;;
+    post-edit)
+        post_edit_checkpoint "$2"
+        ;;
+    task)
+        task_checkpoint "$2"
+        ;;
+    session-end)
+        session_end_checkpoint
+        ;;
+    *)
+        echo "Usage: $0 {pre-edit|post-edit|task|session-end} [input]"
+        exit 1
+        ;;
+esac

package/.claude/helpers/statusline.cjs

@@ -404,6 +404,154 @@ function getLocalIntegration() {
   return integration;
 }
 
+// ─── Security freshness overlay (ruvnet/ruflo#2776) ──────────────
+// The shipped CLI producer (dist/src/funnel/local-signals.js getSecurityStatus)
+// only ever emits PENDING / CLEAN / ISSUES — it captures `scannedAt` but never
+// inspects it, so a year-old scan renders 🛡 ✓ forever and the renderer's
+// STALE / IN_PROGRESS branches are unreachable. Worse, when CLI delegation
+// fails, the stale-while-revalidate cache (readCache() below) keeps serving
+// the pre-scan PENDING pill indefinitely, so a user who runs the advertised
+// `ruflo security scan` sees no change — the pill freezes at "scan pending".
+//
+// This overlay recomputes the security block from disk on EVERY render (same
+// pattern as adrs/agentdb/tests/hooks above), which:
+//   1) Makes STALE reachable — when the newest scan is older than
+//      RUFLO_SCAN_STALE_HOURS (default 24h — matches the CVE feed refresh
+//      cadence), report STALE regardless of what the cached CLI JSON says.
+//   2) Makes IN_PROGRESS reachable — when a `scan-in-progress` marker file
+//      exists and is younger than SECURITY_IN_PROGRESS_MAX_MIN (guards against
+//      a crashed scan leaving the marker behind).
+//   3) Caps the "scan pending" display window — if PENDING has been shown for
+//      >RUFLO_SCAN_PENDING_CAP_MIN (default 30) without a completion write,
+//      switch to STALE and stop rendering the yellow indicator. The tracker
+//      lives in ~/.ruflo/statusline-scan-pending-since.json, keyed by CWD
+//      hash so multiple project checkouts don't collide.
+//   4) Since this runs AFTER readCache() serves stale data, it bypasses the
+//      "pill freezes at PENDING" freeze in defect 2 — the overlay reads
+//      fresh disk state even when the CLI delegation is broken.
+const SECURITY_STALE_HOURS = Math.max(1, parseInt(process.env.RUFLO_SCAN_STALE_HOURS || '24', 10) || 24);
+const SECURITY_PENDING_CAP_MIN = Math.max(1, parseInt(process.env.RUFLO_SCAN_PENDING_CAP_MIN || '30', 10) || 30);
+const SECURITY_IN_PROGRESS_MAX_MIN = 30; // marker older than this = crashed scan; treat as absent
+const PENDING_TRACK_FILE = path.join(os.homedir(), '.ruflo', 'statusline-scan-pending-since.json');
+const CWD_KEY = require('crypto').createHash('md5').update(CWD).digest('hex').slice(0, 12);
+
+function readPendingSince() {
+  try {
+    if (!fs.existsSync(PENDING_TRACK_FILE)) return null;
+    const raw = JSON.parse(fs.readFileSync(PENDING_TRACK_FILE, 'utf-8'));
+    if (raw && typeof raw === 'object' && typeof raw[CWD_KEY] === 'number') return raw[CWD_KEY];
+  } catch { /* ignore */ }
+  return null;
+}
+
+function writePendingSince(ts) {
+  try {
+    let obj = {};
+    if (fs.existsSync(PENDING_TRACK_FILE)) {
+      try { obj = JSON.parse(fs.readFileSync(PENDING_TRACK_FILE, 'utf-8')) || {}; } catch { obj = {}; }
+    }
+    if (ts === null) { delete obj[CWD_KEY]; } else { obj[CWD_KEY] = ts; }
+    fs.mkdirSync(path.dirname(PENDING_TRACK_FILE), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(PENDING_TRACK_FILE, JSON.stringify(obj), { encoding: 'utf-8', mode: 0o600 });
+  } catch { /* ignore */ }
+}
+
+function getLocalSecurity(cliSecurity) {
+  const base = (cliSecurity && typeof cliSecurity === 'object')
+    ? Object.assign({}, cliSecurity)
+    : { status: 'NONE', findings: 0, cvesFixed: 0, totalCves: 0 };
+  base.findings = Math.max(0, base.findings || 0);
+
+  const scanDir = path.join(CWD, '.claude', 'security-scans');
+
+  // Detect a live in-progress marker (writer opts-in by writing this file).
+  let inProgress = false;
+  try {
+    const marker = path.join(scanDir, 'scan-in-progress');
+    if (fs.existsSync(marker)) {
+      const ageMin = (Date.now() - fs.statSync(marker).mtimeMs) / 60000;
+      if (ageMin < SECURITY_IN_PROGRESS_MAX_MIN) inProgress = true;
+    }
+  } catch { /* ignore */ }
+
+  // Find newest scan-*.json by mtime and read its findings/timestamp.
+  let newestPath = null;
+  let newestMtime = 0;
+  try {
+    if (fs.existsSync(scanDir)) {
+      for (const name of fs.readdirSync(scanDir)) {
+        if (!name.startsWith('scan-') || !name.endsWith('.json')) continue;
+        try {
+          const st = fs.statSync(path.join(scanDir, name));
+          if (st.mtimeMs > newestMtime) { newestMtime = st.mtimeMs; newestPath = path.join(scanDir, name); }
+        } catch { /* ignore */ }
+      }
+    }
+  } catch { /* ignore */ }
+
+  if (newestPath) {
+    // We have a scan on disk — the never-scanned pending tracker is no longer
+    // relevant. Clear it so a re-created directory can start a fresh window.
+    writePendingSince(null);
+
+    let scannedAtMs = newestMtime;
+    let findings = base.findings;
+    try {
+      const j = JSON.parse(fs.readFileSync(newestPath, 'utf-8'));
+      // scannedAt (CLI producer's field name) OR timestamp (writer's field name).
+      const isoStr = (j && (j.scannedAt || j.timestamp)) || null;
+      if (isoStr) {
+        const t = Date.parse(isoStr);
+        if (!isNaN(t)) scannedAtMs = t;
+      }
+      // findings may be a number, an array, or nested in summary.total.
+      if (j) {
+        if (typeof j.findings === 'number') findings = j.findings;
+        else if (Array.isArray(j.findings)) findings = j.findings.length;
+        else if (j.summary && typeof j.summary.total === 'number') findings = j.summary.total;
+      }
+    } catch { /* ignore parse — fall back to mtime + cached findings */ }
+
+    base.findings = Math.max(0, findings || 0);
+    base.scannedAt = new Date(scannedAtMs).toISOString();
+
+    const ageHours = (Date.now() - scannedAtMs) / 3600000;
+    if (ageHours >= SECURITY_STALE_HOURS) {
+      // Stale but findings still render red (a year-old ISSUES scan is still bad).
+      base.status = 'STALE';
+    } else if (inProgress) {
+      base.status = 'IN_PROGRESS';
+    } else if (base.findings > 0) {
+      base.status = 'ISSUES';
+    } else {
+      base.status = 'CLEAN';
+    }
+    return base;
+  }
+
+  // No scan file. If a live marker exists, we're mid-scan.
+  if (inProgress) {
+    base.status = 'IN_PROGRESS';
+    // Reset the pending tracker so, if the scan crashes mid-flight, the next
+    // render starts a fresh N-minute pending window instead of an already-expired one.
+    writePendingSince(null);
+    return base;
+  }
+
+  // Truly never-scanned: track how long we've shown PENDING. After the cap,
+  // escalate to STALE with the dim/gray glyph so the pill visibly stops
+  // shouting for attention — the user has either ignored it for 30 min or
+  // the scan is silently failing to write.
+  let pendingSince = readPendingSince();
+  if (pendingSince === null || typeof pendingSince !== 'number') {
+    pendingSince = Date.now();
+    writePendingSince(pendingSince);
+  }
+  const pendingAgeMin = (Date.now() - pendingSince) / 60000;
+  base.status = (pendingAgeMin >= SECURITY_PENDING_CAP_MIN) ? 'STALE' : 'PENDING';
+  return base;
+}
+
 // Overlay every locally-derived block onto the CLI data (mutates in place).
 function applyLocalOverlays(data) {
   data.adrs = getLocalADRCount();
@@ -411,6 +559,9 @@ function applyLocalOverlays(data) {
   data.tests = getLocalTests();
   data.hooks = getLocalHooks();
   data.integration = getLocalIntegration();
+  // Security overlay: recompute freshness from disk on every render so cached
+  // CLI JSON can never freeze the pill at PENDING. See getLocalSecurity() above.
+  data.security = getLocalSecurity(data.security);
   return data;
 }
 
@@ -633,12 +784,55 @@ function compareVersions(a, b) {
   return 0;
 }
 
+// #2742: when CWD is a linked git worktree, it has no node_modules of its
+// own (worktrees don't get their own `npm install`), so every CWD-relative
+// probe in getPkgVersion() misses and the version silently falls back to
+// the baked-in default — even though the main repo's install a few
+// directories away is perfectly resolvable. A linked worktree's `.git` is
+// a plain FILE (not a directory) containing `gitdir: <main>/.git/worktrees/
+// <name>`; walk up from CWD to find it, parse the pointer, and strip the
+// trailing `.git/worktrees/<name>` segment to recover the main repo root.
+// Pure fs — no `git rev-parse` spawn (statusline renders are latency-
+// sensitive; this doc comment's neighbors are explicit about avoiding
+// spawns in the render path).
+function resolveWorktreeMainRoot() {
+  try {
+    let dir = CWD;
+    for (;;) {
+      const dotGit = path.join(dir, '.git');
+      if (fs.existsSync(dotGit)) {
+        if (fs.statSync(dotGit).isFile()) {
+          const contents = fs.readFileSync(dotGit, 'utf-8');
+          const m = contents.match(/^gitdir:\s*(.+)$/m);
+          const wtGitDir = m && m[1].trim();
+          if (wtGitDir) {
+            // Git writes this pointer with forward slashes even on Windows
+            // (a git-for-windows convention for its own internal files) —
+            // path.sep (backslash on win32) never matches, so normalize
+            // before searching rather than building an OS-specific marker.
+            const normalized = wtGitDir.replace(/\\/g, '/');
+            const marker = '/.git/worktrees/';
+            const idx = normalized.lastIndexOf(marker);
+            if (idx > 0) return normalized.slice(0, idx);
+          }
+        }
+        return null; // a real (non-worktree) .git dir — nothing to resolve
+      }
+      const parent = path.dirname(dir);
+      if (parent === dir) return null; // reached filesystem root
+      dir = parent;
+    }
+  } catch {
+    return null;
+  }
+}
+
 function getPkgVersion() {
   // Baked in at generation time from the real running CLI's own resolved
   // version (see generateStatuslineScript()'s doc comment) — correct even
   // when this renders via a pure npx invocation with no local install for
   // the candidate scan below to find.
-  let ver = "3.28.0";
+  let ver = "3.32.8";
   try {
     const home = os.homedir();
     const pkgPaths = [
@@ -647,6 +841,17 @@ function getPkgVersion() {
       path.join(CWD, 'node_modules', 'ruflo', 'package.json'),
       path.join(CWD, 'v3', '@claude-flow', 'cli', 'package.json'),
     ];
+    // #2742: CWD is a linked git worktree with no node_modules of its own —
+    // probe the main repo's install too, so a worktree session shows the
+    // same version a main-repo session would.
+    const worktreeMainRoot = resolveWorktreeMainRoot();
+    if (worktreeMainRoot) {
+      pkgPaths.push(
+        path.join(worktreeMainRoot, 'node_modules', '@claude-flow', 'cli', 'package.json'),
+        path.join(worktreeMainRoot, 'node_modules', 'ruflo', 'package.json'),
+        path.join(worktreeMainRoot, 'v3', '@claude-flow', 'cli', 'package.json'),
+      );
+    }
     // #2221: global installs (npm i -g ruflo) live outside CWD/node_modules, so the
     // probes above all miss and the version falls back to the hard-coded default.
     // Derive the global node_modules dir from the running node binary (no npm spawn —
@@ -797,10 +1002,14 @@ function generateStatusline() {
   if (healthAllGreen) {
     opsParts.push(c.brightGreen + '🛡 ✓' + c.reset);
   } else {
+    // #2776: STALE gets dim/gray (distinct from the actionable yellow of
+    // PENDING/IN_PROGRESS) so a stale pill visibly stops shouting for
+    // attention — the user can act on the "run ruflo security scan" prompt or
+    // ignore it without a permanently-yellow indicator.
     if (secStatus === 'PENDING') opsParts.push(c.brightYellow + '🛡 scan pending' + c.reset);
     else if (secStatus === 'IN_PROGRESS') opsParts.push(c.brightYellow + '🛡 scanning…' + c.reset);
     else if (secStatus === 'ISSUES') opsParts.push(c.brightRed + '🛡 findings' + c.reset);
-    else if (secStatus === 'STALE') opsParts.push(c.brightYellow + '🛡 scan stale' + c.reset);
+    else if (secStatus === 'STALE') opsParts.push(c.dim + '🛡 scan stale' + c.reset);
     else if (secStatus !== 'NONE' && secStatus !== 'CLEAN') opsParts.push(c.brightRed + '🛡 ' + secStatus.toLowerCase() + c.reset);
     if (findings > 0) {
       opsParts.push(c.brightRed + '⚠ ' + findings + ' finding' + (findings === 1 ? '' : 's') + c.reset);