Skip to content

v3.29.0 — Statusline promo UX + security key rotation

Choose a tag to compare

View all tags
@ruvnet ruvnet released this 14 Jul 16:58
v3.29.0
0052b1b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

Two new user-facing CLI subcommands to control the statusline promo row:

  • ruflo funnel accept — skip the 24h disclosure grace so promo rotation starts immediately on the next render (instead of waiting a full day after first-render).
  • ruflo funnel open — open the currently-shown promo URL in your default browser. Terminal-independent, so it works on hosts that don't route clicks to the terminal's link handler (VS Code integrated terminal, some Windows configs, etc.).

Statusline row 3 (promo) improvements:

  • Whole row wrapped in one OSC 8 hyperlink — click anywhere on the row opens the URL.
  • Visible (domain) suffix so the destination is readable and copyable even where OSC 8 doesn't render.
  • Bright-white bold styling on the "manage: " tail so it visually reads as "shell command to type".
  • Ellipsis on truncation instead of silent mid-word chop.

Windows console-flash mitigations (partial — the primary cause is upstream at anthropics/claude-code#70200; we mitigate what our own subprocess calls contribute):

  • windowsHide: true on 3 subprocess spawn sites: statusline CLI delegation, statusline safeExec helper, hook-handler detached background refresh.
  • Statusline cache TTL bumped 60s → 300s, so the outer wrapper spawn (Claude Code's, not ours) fires ~5× less often. Promo/insight rotation still runs on its own tighter 20s clock.
  • New ruflo tracking issue: #2669 (mirrors upstream #70200, #14828, #66540).

Security

Helpers-signing key rotated (RUFLO_HELPERS_PUBKEY v2). The previous private key was accidentally captured in a Claude Code session transcript today. Mitigation done at rotation time:

  • New Ed25519 keypair generated.
  • Old GCP Secret Manager version destroyed (not just disabled).
  • New pubkey baked into src/init/helper-signing.ts and scripts/verify-helpers.mjs.
  • Helpers manifest re-signed with the new key before publish.

Upgrade urgency: Users on ruflo ≤ 3.28.0 still trust the OLD (now-leaked) pubkey. An attacker with the leaked key could forge a helpers manifest that verifies on those old installs. Upgrade to v3.29.0 as soon as possible — new installs pick up the new pubkey and validate only manifests signed with the new key.

Compatibility

  • Semver MINOR (3.28.0 → 3.29.0) — additive CLI subcommands, no breaking changes.
  • Key rotation is atomic per-version — no dual-pubkey transition needed. Each CLI version's baked pubkey validates the manifest shipped with that same version.

PRs merged

  • #2671 — feat(funnel,statusline): accept + open subcommands, whole-row-clickable promo, Windows flash mitigations
  • #2673 — security: rotate helpers-signing key (RUFLO_HELPERS_PUBKEY v2)

Tracking issues

Install

npx ruflo@latest init
# or
npm install -g @claude-flow/cli@3.29.0
Assets 2
Loading