This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
Summary
AI summaryUpdates Related, Fixes bundled, and https://github.com/ruvnet/ruflo/pull/2676 across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Adds three new placement surfaces: spinner verbs, startup announcements, and developer revenue-share scaffold. Adds three new placement surfaces: spinner verbs, startup announcements, and developer revenue-share scaffold. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Enables spinner verbs by default; opt-out via RUFLO_NO_AUTO_ENABLE or ruflo spinner disable. Enables spinner verbs by default; opt-out via RUFLO_NO_AUTO_ENABLE or ruflo spinner disable. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Introduces startup announcements mechanism; opt-in via RUFLO_AUTO_ENABLE_ANNOUNCEMENTS or ruflo announcements enable. Introduces startup announcements mechanism; opt-in via RUFLO_AUTO_ENABLE_ANNOUNCEMENTS or ruflo announcements enable. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Adds developer revenue-share CLI subcommands (enroll/earnings/unenroll) as Phase 0 scaffold. Adds developer revenue-share CLI subcommands (enroll/earnings/unenroll) as Phase 0 scaffold. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Implements first‑run auto‑enable mechanism that writes ~/.ruflo/first-run-enabled.json and notifies via stderr. Implements first‑run auto‑enable mechanism that writes ~/.ruflo/first-run-enabled.json and notifies via stderr. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Adds upgrade behavior: automatically inserts spinner verbs into ~/.claude/settings.json on first post‑v3.29.x session, with backup and undo command. Adds upgrade behavior: automatically inserts spinner verbs into ~/.claude/settings.json on first post‑v3.29.x session, with backup and undo command. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixes concurrent‑session helper clobber by adding .claude/helpers/.LOCKED marker and RUFLO_HELPERS_LOCKED env opt‑out. Fixes concurrent‑session helper clobber by adding .claude/helpers/.LOCKED marker and RUFLO_HELPERS_LOCKED env opt‑out. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Restores correct emission of statusline URL suffix after corruption bug. Restores correct emission of statusline URL suffix after corruption bug. Source: llm_adapter@2026-07-15 Confidence: high |
— |
Full changelog
Highlights — ADR-317, ADR-318, ADR-319
Three new placement surfaces for ruflo, sibling to the existing statusline promo row:
1. Spinner verbs (ruflo spinner …) — DEFAULT ON
Ruflo appends its own curated "present-participle" verbs to Claude Code's spinnerVerbs.verbs[] in ~/.claude/settings.json, so the ✽ Channeling… rotation mixes ruflo verbs with Claude Code's built-ins. 37 verbs across memory, optimization, learning, security, agents, workflow + Cognitum-tagged categories. Default posture: ON for new installs and upgrades (opt-out via RUFLO_NO_AUTO_ENABLE=1 or ruflo spinner disable).
Sample additions: Consulting the memory graph, Warming the HNSW index, Auditing for CVEs, Consulting Cognitum.
2. Startup announcements (ruflo announcements …) — OPT-IN
Similar mechanism for Claude Code's companyAnnouncements — 12 curated entries shown at Claude Code startup, one per session. Higher intrusion profile than spinner (prominent line vs. per-spin flash), so opt-in via RUFLO_AUTO_ENABLE_ANNOUNCEMENTS=1 or ruflo announcements enable --yes.
3. Developer revenue-share (ruflo funnel enroll/earnings/unenroll) — Phase 0 scaffold
Client-side skeleton for the 50/50 Cognitum-sponsor rev-share. Response to "can we do something similar to kickbacks.ai?" — yes, and 60-70% of the plumbing (attribution, consent, rotation) already existed. This ships the CLI subcommands + consent domain + attribution token wiring. Backend enrollment + Stripe Connect are Phase 1 (blocks on legal).
First-run auto-enable mechanism (session-restore hook)
Fires once per install (marker at ~/.ruflo/first-run-enabled.json), then never again. Multiple env-var escape hatches: RUFLO_NO_AUTO_ENABLE, RUFLO_NO_AUTO_ENABLE_SPINNER, RUFLO_AUTO_ENABLE_ANNOUNCEMENTS. Skips in CI + non-TTY. Detached spawn — session-restore latency unchanged. One-line stderr notification names exactly what got enabled and how to disable.
Fixes bundled
- Concurrent-session helper clobber (documented in CLAUDE.md): new
.claude/helpers/.LOCKEDmarker +RUFLO_HELPERS_LOCKED=1env opt-out. Users editing helpers directly can now protect their dev tree from being overwritten by sibling Claude Code sessions running stale cached@claude-flow/cli. - Statusline URL suffix correctly emits again (bug where concurrent-session corruption had wiped it earlier).
Upgrade notes
Every existing user upgrading past v3.29.x will see spinner verbs added to their ~/.claude/settings.json on their next Claude Code session (with backup + notification + one-command undo). Set RUFLO_NO_AUTO_ENABLE=1 before upgrading if you don't want this.
Related
- PR #2676 — everything above
- Tech-debt: #2679 — sync
statusline-generator.tswith the committed helper's #2195 delegation build - Related issue: #2677 — @stuinfla's excellent report on
doctor --component memorybeing existence-only
Install
```bash
npx ruflo@latest init
or
npm install -g @claude-flow/[email protected]
```
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]