fix(statusline): overlay ruflo's fabricated CVE counter with the real scan (#26)

The statusline told every clean repo it had 3 CVEs. Upstream's
getSecurityStatus (@claude-flow/cli funnel/local-signals.js) hardcodes
`const totalCves = 3` — ruflo's OWN v3 roadmap items (CVE-1/2/3 in their
v3-security-architect.md: an outdated dep + SHA-256 hashing + hardcoded
creds in THEIR api/auth-service.ts), not the rendered project's risk — and
derives cvesFixed from scans.length, a FILE count. The alarm therefore
cleared itself: run the suggested scan, it writes a JSON file, the counter
drops. Three files reach CLEAN with nothing scanned, let alone fixed, while
a real finding never registers. Reported upstream: ruvnet/ruflo#2694.

The overlay reports what the newest scan actually found and never invents a
CVE: totalCves/cvesFixed are pinned to 0 so the "N CVEs" branch cannot fire,
and real state rides in `status`, which ruflo's renderer prints verbatim —
PENDING when never scanned (an honest unknown, not a false green), "N
ISSUES" when the scan found things, CLEAN, or STALE past 7 days.

Wired by wrapping getStatuslineData rather than patching applyLocalOverlays:
the fresh-cache early return (`if (cache.fresh && cache.promoFresh) return
overlayMemoPromo(cache.data)`) bypasses applyLocalOverlays entirely, so a
patch there is never called during the 60s TTL and the fabricated count
renders anyway. Wrapping the one entry point covers all four return paths.
The count also reaches the screen a second way — funnel/insights.js computes
`pending = totalCves - cvesFixed` CLI-side and ships a finished sentence —
so rufloHonestInsight rebuilds that one line from the real scan, matching on
text because promo.js discards the insight id.

Gated on positively detecting the defect in the installed CLI rather than a
pinned version, mirroring improvement-eval's --cli-check stopgap: the patch
retires itself on the first sync after upstream fixes this. Covered by a
test.

Also in this change:

- status: detect statusline CONTENT drift, not just marker presence. Drift
  is now "would a sync change this file?", which fixStatusline's dry run
  already answers. A marker test reported 'ok' on a stale injected block, and
  since sync builds its plan from rows carrying a `fix`, re-injection never
  ran. This bit us live: an updated overlay silently failed to land. It also
  means any kit upgrade revising the footer would not have re-injected.

- statusline: make the aidefence segment alarm-only. It was a permanent green
  "aidefence on" — the one pure binary badge in the footer (SONA/QE counts
  move; a constant "on" says nothing after the first glance) — and its shield
  glyph collided with ruflo's line-2 scan shield, a different concern
  entirely: `security scan` audits your source, `security defend`/AIMDS
  screens prompts for injection, jailbreak and PII. Per issue #8's rule,
  already law for the proof segment, the expected state is now silent and
  only the failure surfaces, with no shield glyph in the alarm.

  Kept rather than deleted because it is load-bearing: @claude-flow/aidefence
  is still not a declared dependency of ruflo or @claude-flow/cli on 3.32.0
  while `security defend` imports it (ruvnet/ruflo#2670), so it is present
  only because healAidefence installs it. A plain `npm i -g ruflo` can
  silently remove injection defense.

  The probe is three-state, not boolean: inverting a signal inverts its
  failure mode, and a probe miss (custom npm prefix, statusline running under
  a different node) would otherwise fail loud and WRONG. "off" requires
  positive evidence — a located ruflo install lacking aidefence; anything
  unverifiable stays "unknown" and silent.

Author: pacphi

src/commands/status.mjs

@@ -12,6 +12,7 @@ import { scanRvf } from '../lib/rvf.mjs';
 import { registry, syncBlocks } from '../lib/blocks.mjs';
 import { loadKitConfig } from '../lib/config.mjs';
 import { driftReport, selfDrift } from '../lib/versions.mjs';
+import { upstreamCveCounterFabricated, fixStatusline } from '../lib/statusline.mjs';
 import { drift as ruvnetBrainDrift } from '../lib/ruvnet-brain.mjs';
 import { readJson } from '../lib/settings.mjs';
 import { have } from '../lib/exec.mjs';
@@ -261,10 +262,35 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
   // statusline footer (project scope)
   const sl = paths.projectStatusline(cwd);
   if (fs.existsSync(sl)) {
-    const hasFooter = fs.readFileSync(sl, 'utf8').includes('ruflo-seg:BEGIN');
-    rows.push(row('statusline', hasFooter ? 'ok' : 'warn',
-      hasFooter ? 'activation footer present' : 'statusline present but footer missing',
-      hasFooter ? null : 'sync re-injects the footer'));
+    const slSrc = fs.readFileSync(sl, 'utf8');
+    const hasFooter = slSrc.includes('ruflo-seg:BEGIN');
+    // Drift is "would a sync CHANGE this file?", which fixStatusline's dry run answers
+    // exactly. A marker-presence test alone cannot see CONTENT drift: after a kit upgrade
+    // revises the footer or the security overlay, the marker is still there, this row
+    // reports 'ok', and — because sync builds its plan from rows carrying a `fix` — the
+    // re-injection never runs and the stale block survives indefinitely. Observed live:
+    // an updated overlay silently failed to land for exactly this reason.
+    let wouldChange = !hasFooter;
+    try { wouldChange = fixStatusline(cwd, { dryRun: true }).applied; } catch { /* keep marker fallback */ }
+    rows.push(row('statusline', wouldChange ? 'warn' : 'ok',
+      wouldChange
+        ? (hasFooter ? 'injected blocks are out of date' : 'statusline present but footer missing')
+        : 'activation footer present and current',
+      wouldChange ? 'sync re-injects the footer' : null));
+    // The CVE-counter overlay is tracked SEPARATELY from the footer: a footer-only
+    // check reports 'ok' while the statusline still renders ruflo's fabricated
+    // "⚠ 3 CVEs" (hardcoded totalCves, cvesFixed from a file count). Only warn while
+    // the upstream defect is actually present — once ruflo fixes getSecurityStatus
+    // the overlay is intentionally absent, and this row must go quiet on its own
+    // rather than nag for a patch that is no longer wanted.
+    if (upstreamCveCounterFabricated()) {
+      const patched = slSrc.includes('ruflo-sec:BEGIN');
+      rows.push(row('statusline/cve', patched ? 'ok' : 'warn',
+        patched
+          ? 'CVE counter overlaid with real scan results'
+          : 'statusline shows ruflo\'s fabricated CVE count (upstream defect)',
+        patched ? null : 'sync injects the security overlay'));
+    }
   } else {
     rows.push(row('statusline', 'info', 'no project statusline here (created by setup)'));
   }

src/lib/statusline.mjs

@@ -9,7 +9,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
-import { projectStatusline, projectSettings } from './paths.mjs';
+import { projectStatusline, projectSettings, rufloCliDist } from './paths.mjs';
 import { installedVersion } from './versions.mjs';
 import { readJson, writeJsonWithBackup } from './settings.mjs';
 
@@ -18,6 +18,61 @@ const FOOTER_TEMPLATE = path.join(
 
 const eol = (s) => (s.includes('\r\n') ? '\r\n' : '\n');
 
+// Security overlay wrapper. Wraps getStatuslineData() rather than patching
+// applyLocalOverlays(), because applyLocalOverlays is NOT on every path: the
+// fresh-cache early return (`if (cache.fresh && cache.promoFresh) return
+// overlayMemoPromo(cache.data)`) bypasses it, so for the 60s TTL a patched
+// applyLocalOverlays is simply never called and the fabricated count renders
+// anyway (verified empirically — the overlay had no effect until this wrapper).
+// Wrapping the single entry point covers all four return paths (CLI delegation,
+// fresh cache, stale-while-revalidate, local fallback) with one injection.
+//
+// Relies on function-declaration hoisting: `function getStatuslineData()` is
+// initialized before any top-level code runs, so this block — injected near the
+// top of the file — can reassign the binding, and the later declaration does not
+// re-execute and clobber it. The typeof guard keeps it inert on any template that
+// lacks the function (e.g. the minimal statusline-v3.cjs).
+const SEC_WRAP = [
+  '/* ruflo-sec:BEGIN */',
+  'try {',
+  '  if (typeof getStatuslineData === "function") {',
+  '    var _rufloOrigGetStatuslineData = getStatuslineData;',
+  '    getStatuslineData = function(){',
+  '      var d = _rufloOrigGetStatuslineData.apply(this, arguments);',
+  '      try {',
+  '        if (d) {',
+  '          d.security = rufloLocalSecurity(process.cwd(), d.security);',
+  '          d.promo = rufloHonestInsight(d.promo, d.security);',
+  '        }',
+  '      } catch(e){}',
+  '      return d;',
+  '    };',
+  '  }',
+  '} catch(e){}',
+  '/* ruflo-sec:END */',
+].join('\n');
+const SEC_WRAP_STRIP = /\/\* ruflo-sec:BEGIN \*\/[\s\S]*?\/\* ruflo-sec:END \*\/\n?/g;
+
+/** Upstream defect: ruvnet/ruflo#2694.
+ *  True while ruflo's getSecurityStatus() still FABRICATES the CVE count — i.e. the
+ *  installed CLI still has `const totalCves = 3` (a hardcoded constant naming ruflo's
+ *  own v3 roadmap items, not the rendered project's risk) with cvesFixed derived from
+ *  scans.length (a FILE count, not findings). Read-only probe of the installed CLI.
+ *
+ *  This is the stopgap's self-retirement gate, mirroring improvement-eval's --cli-check
+ *  (#2222): detect the defect in shipped code rather than pinning a version number, so
+ *  the kit stops patching the moment upstream fixes it — no release-tracking required.
+ *  Unreadable/absent/changed => false (fail safe: never patch what we cannot verify is
+ *  broken; the worst case is ruflo's own unmodified behavior). */
+export function upstreamCveCounterFabricated() {
+  try {
+    const f = path.join(rufloCliDist(), 'funnel', 'local-signals.js');
+    if (!fs.existsSync(f)) return false;
+    const src = fs.readFileSync(f, 'utf8');
+    return /const totalCves = 3\b/.test(src) && /scans\.length/.test(src);
+  } catch { return false; }
+}
+
 export function fixStatusline(root = process.cwd(), { dryRun = false } = {}) {
   const file = projectStatusline(root);
   if (!fs.existsSync(file)) return { file, applied: false, reason: 'no statusline.cjs (created by ruflo init)' };
@@ -35,9 +90,13 @@ export function fixStatusline(root = process.cwd(), { dryRun = false } = {}) {
   const footer = fs.readFileSync(FOOTER_TEMPLATE, 'utf8').replace(/\r\n/g, '\n').trim();
   s = s.replace(/\/\* ruflo-seg:BEGIN \*\/[\s\S]*?\/\* ruflo-seg:END \*\/\n?/, '');
   s = s.replace(/ \+ rufloActivationSegments\(process\.cwd\(\)\)/g, '');
+  // (d) security overlay: stripped unconditionally BEFORE the gate is consulted, so the
+  //     stopgap retires itself on the first sync after upstream fixes getSecurityStatus.
+  s = s.replace(SEC_WRAP_STRIP, '');
+  const securityOverlay = upstreamCveCounterFabricated();
   const lines = s.split('\n');
   const at = lines[0]?.startsWith('#!') ? 1 : 0;
-  lines.splice(at, 0, footer);
+  lines.splice(at, 0, securityOverlay ? footer + '\n' + SEC_WRAP : footer);
   s = lines.join('\n');
   s = s.replace(/console\.log\(generateStatusline\(\)\)/, 'console.log(generateStatusline() + rufloActivationSegments(process.cwd()))');
 
@@ -71,5 +130,5 @@ export function fixStatusline(root = process.cwd(), { dryRun = false } = {}) {
     repointed = true;
   }
 
-  return { file, applied: out !== raw, repointed, version: ver };
+  return { file, applied: out !== raw, repointed, version: ver, securityOverlay };
 }