feat(statusline): add 5h/7d rate limit tracking

- Add fetch-rate-limits.sh script to fetch usage from Anthropic API
- Support macOS Keychain for OAuth token retrieval
- Fall back to file-based credentials on Linux
- Show "re-login needed" when OAuth scope is insufficient
- Display rate limits in compact format: "5h: X% | 7d: Y%"

Co-Authored-By: duyetbot <duyetbot@users.noreply.github.com>

Author: duyet

statusline/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "statusline",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Real-time visibility into Claude Code sessions showing context usage, active tools, and task progress in compact one-line format",
   "author": {
     "name": "duyet"

statusline/scripts/fetch-rate-limits.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# Fetch rate limits from Anthropic OAuth API
+# Outputs JSON: {"five_hour": N, "seven_day": N, "resets_at": "ISO", "error": "..."}
+
+token=""
+
+# macOS Keychain (primary on macOS)
+if [ "$(uname)" = "Darwin" ]; then
+    keychain_data=$(security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null)
+    if [ -n "$keychain_data" ]; then
+        token=$(echo "$keychain_data" | jq -r '.claudeAiOauth.accessToken // empty' 2>/dev/null)
+    fi
+fi
+
+# Fall back to file-based credentials
+if [ -z "$token" ] || [ "$token" = "null" ]; then
+    for cred_path in \
+        ~/.claude/.credentials.json \
+        ~/.config/claude/.credentials.json \
+        ~/.config/claude-code/.credentials.json
+    do
+        if [ -f "$cred_path" ]; then
+            token=$(jq -r '.claudeAiOauth.accessToken // empty' "$cred_path" 2>/dev/null)
+            if [ -n "$token" ] && [ "$token" != "null" ]; then
+                break
+            fi
+        fi
+    done
+fi
+
+if [ -z "$token" ] || [ "$token" = "null" ]; then
+    echo '{"error": "no_credentials"}'
+    exit 0
+fi
+
+# Fetch from API
+api_response=$(curl -s -m 3 \
+    -H "Authorization: Bearer $token" \
+    -H "anthropic-beta: oauth-2025-04-20" \
+    "https://api.anthropic.com/api/oauth/usage" 2>/dev/null)
+
+if [ -z "$api_response" ]; then
+    echo '{"error": "api_timeout"}'
+    exit 0
+fi
+
+# Check for error
+if echo "$api_response" | jq -e '.error' > /dev/null 2>&1; then
+    error_msg=$(echo "$api_response" | jq -r '.error.message // "unknown"')
+    if echo "$error_msg" | grep -qi "scope"; then
+        echo '{"error": "scope_required"}'
+    else
+        echo '{"error": "api_error"}'
+    fi
+    exit 0
+fi
+
+# Parse and output
+u5h=$(echo "$api_response" | jq -r '.five_hour.utilization // 0')
+u7d=$(echo "$api_response" | jq -r '.seven_day.utilization // 0')
+r5h=$(echo "$api_response" | jq -r '.five_hour.resets_at // empty')
+
+printf '{"five_hour": %s, "seven_day": %s, "resets_at": "%s"}\n' \
+    "${u5h:-0}" "${u7d:-0}" "${r5h:-}"

statusline/scripts/format-status.ts

@@ -1,8 +1,20 @@
 /**
  * Compact one-line status formatter for Claude Code sessions
  * Hides empty values, shows only relevant metrics
+ * Includes rate limit tracking (5h/7d)
  */
 
+import { execFileSync } from "child_process";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+
+interface RateLimits {
+  five_hour: number;
+  seven_day: number;
+  resets_at?: string;
+  error?: string;
+}
+
 interface SessionMetrics {
   context?: {
     used: number;
@@ -20,6 +32,7 @@ interface SessionMetrics {
   };
   duration?: string;
   systemPrompts?: string[];
+  rateLimits?: RateLimits;
 }
 
 interface FormattedStatus {
@@ -89,13 +102,52 @@ function formatDuration(duration?: string): string | null {
   return `${duration}`;
 }
 
+function formatRateLimits(rateLimits?: RateLimits): string | null {
+  if (!rateLimits) return null;
+
+  if (rateLimits.error === "scope_required") {
+    return "5h: re-login | 7d: needed";
+  }
+  if (rateLimits.error) {
+    return null; // Hide on other errors
+  }
+
+  const u5h = Math.round(rateLimits.five_hour);
+  const u7d = Math.round(rateLimits.seven_day);
+
+  return `5h: ${u5h}% | 7d: ${u7d}%`;
+}
+
+function fetchRateLimits(): RateLimits | null {
+  try {
+    const __filename = fileURLToPath(import.meta.url);
+    const __dirname = dirname(__filename);
+    const scriptPath = join(__dirname, "fetch-rate-limits.sh");
+
+    // Use execFileSync for safety (no shell injection)
+    const result = execFileSync("bash", [scriptPath], {
+      encoding: "utf-8",
+      timeout: 5000,
+    });
+
+    return JSON.parse(result.trim()) as RateLimits;
+  } catch {
+    return null;
+  }
+}
+
 export function formatStatus(metrics: SessionMetrics): FormattedStatus {
   const parts: string[] = [];
 
   // Add context health first (most important)
   const contextStr = formatContext(metrics);
   if (contextStr) parts.push(contextStr);
 
+  // Add rate limits (5h/7d usage)
+  const rateLimits = metrics.rateLimits ?? fetchRateLimits();
+  const rateLimitsStr = formatRateLimits(rateLimits);
+  if (rateLimitsStr) parts.push(rateLimitsStr);
+
   // Add model (optional)
   const modelStr = formatModel(metrics.model);
   if (modelStr) parts.push(modelStr);