Repo surfaces: GitHub Pages site, llms.txt, security policy, templates

- docs/index.html: self-contained Pages site with an animated replay of
  a real session — the +X change flash, /compact snap-to-zero, quota
  bump, wall-clock resets — plus signal anatomy, values with honest
  numbers, and an explicit anti-pitch. No frameworks, no external
  assets, reduced-motion respected.
- llms.txt: one-fetch orientation for agents (state layout, test
  harness whitelist rule, wire-contract pointer).
- SECURITY.md: earned, not boilerplate — the script handles OAuth
  tokens; states the exact trust surface and known trade-offs.
- Minimal issue/PR templates sized for the repo's scale.
- CI: shellcheck gate at error severity (clean today; warnings
  tracked, not gated).
- README links the live demo.

Pages serves from main:/docs; homepage + 8 discovery topics set;
merged branches now auto-delete.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lroolle

.github/ISSUE_TEMPLATE/bug.md

@@ -0,0 +1,19 @@
+---
+name: Bug report
+about: Something renders wrong or breaks
+---
+
+**What you see** (paste the rendered line, or a screenshot):
+
+**What you expected:**
+
+**Environment:**
+- OS:
+- Claude Code version (`claude --version`):
+- Statusline version (CHANGELOG entry or git tag):
+
+**If it's a quota/fetch issue**, paste (redact anything private):
+```
+cat ~/.claude/statusline/usage.err
+tail -5 ~/.claude/statusline/logs/statusline.log
+```

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security issue
+    url: https://github.com/thevibeworks/claude-code-statusline/security/advisories/new
+    about: Token leaks or injection — report privately, not as an issue.

.github/pull_request_template.md

@@ -0,0 +1,5 @@
+**What & why:**
+
+**Checklist:**
+- [ ] `npm exec --yes bats -- t/` passes (new functions added to the awk whitelist in `t/helpers.bash`)
+- [ ] No real tokens, session IDs, or home paths in fixtures/docs

.github/workflows/test.yml

@@ -14,3 +14,5 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y jq
       - name: Run tests
         run: npm exec --yes bats -- t/
+      - name: Shellcheck (error severity; warnings are tracked, not gated)
+        run: shellcheck -S error statusline.sh install.sh claude-watch.sh

README.md

@@ -12,6 +12,8 @@
   <img src="assets/statusline-preview.svg" alt="Claude Code Statusline" width="100%">
 </p>
 
+<p align="center"><a href="https://thevibeworks.github.io/claude-code-statusline/"><b>Live animated demo →</b></a></p>
+
 One Bash file that plugs into the official `statusLine` command hook. Shows
 what matters: active model, context window, session cost, 5h / 7d quota with
 reset times, prompt-cache health, extra-usage spend, git activity, and subscription tier.

SECURITY.md

@@ -0,0 +1,34 @@
+# Security
+
+This script reads your Claude OAuth access token (from Claude Code's
+credentials file or the macOS Keychain) and sends it to exactly one host:
+`api.anthropic.com` (plus `platform.claude.com` for token refresh). It
+never writes the token to logs or caches, and it has no analytics,
+telemetry, or third-party endpoints. Verify that claim — it's one file:
+grep `curl` in `statusline.sh`.
+
+## What to report
+
+- Anything that could leak the OAuth token (into logs, cache files, argv,
+  error messages, or to a non-Anthropic host)
+- Command injection via statusline stdin (Claude Code feeds it JSON that
+  includes untrusted strings like branch names and paths)
+- install.sh integrity issues
+
+## How to report
+
+Open a [private security advisory](https://github.com/thevibeworks/claude-code-statusline/security/advisories/new)
+on GitHub. If that's not possible, open a regular issue saying only
+"security issue, need a private channel" — do not include details.
+
+Expect an acknowledgment within a week. This is a maintained side project,
+not a company with an on-call rotation; critical token-leak reports get
+fixed fast, everything else gets triaged honestly.
+
+## Known trade-offs (not vulnerabilities)
+
+- The token passes to curl via `-H` on argv, which is briefly visible in
+  `ps` on the local machine. An attacker with local process-listing access
+  can already read the credentials file itself.
+- `curl | bash` install is offered for convenience; the paranoid path
+  (clone, read, copy) is documented in the README and is four lines.

docs/.nojekyll

@@ -0,0 +1,38 @@
+# Claude Code Statusline
+
+> One bash file that renders live quota (5h/7d windows with reset times,
+> per-model weekly limits), context pressure, session cost, prompt-cache
+> health, and git activity in Claude Code's statusLine hook. 265 bats tests,
+> deps are jq + curl, no daemon, no telemetry.
+
+Key facts for agents:
+- Everything lives in `statusline.sh` (~2900 lines, plain bash). Install
+  copies it to `~/.claude/statusline.sh` and wires `settings.json`.
+- State lives under `~/.claude/statusline/` (account-scoped caches) and
+  `~/.claude/statusline/sessions/` (per-session state). Never commit these.
+- Quota data comes from `GET https://api.anthropic.com/api/oauth/usage`
+  with the user's OAuth token; the observed wire contract is versioned in
+  docs/api/oauth-usage.md and re-synced against CLI captures.
+- Tests extract real functions from statusline.sh via an awk whitelist in
+  t/helpers.bash — new functions MUST be added there or tests silently skip.
+- `STATUSLINE_NO_FETCH=1` renders from cache/stdin only (tests export it;
+  also for offline use).
+
+## Docs
+
+- [README](https://github.com/thevibeworks/claude-code-statusline/blob/main/README.md): signals, themes, configuration flags, install
+- [Wire contract](https://github.com/thevibeworks/claude-code-statusline/blob/main/docs/api/oauth-usage.md): observed /api/oauth/usage request/response schema, rate-limit obligations
+- [CHANGELOG](https://github.com/thevibeworks/claude-code-statusline/blob/main/CHANGELOG.md): per-release rationale, not just diffs
+- [CONTRIBUTING](https://github.com/thevibeworks/claude-code-statusline/blob/main/CONTRIBUTING.md): test harness rules, style
+
+## Source
+
+- [statusline.sh](https://github.com/thevibeworks/claude-code-statusline/blob/main/statusline.sh): the entire product
+- [install.sh](https://github.com/thevibeworks/claude-code-statusline/blob/main/install.sh): installer (curl | bash entrypoint)
+- [t/statusline.bats](https://github.com/thevibeworks/claude-code-statusline/blob/main/t/statusline.bats): 253 statusline tests
+- [t/install.bats](https://github.com/thevibeworks/claude-code-statusline/blob/main/t/install.bats): 12 installer tests
+
+## Optional
+
+- [claude-watch.sh](https://github.com/thevibeworks/claude-code-statusline/blob/main/claude-watch.sh): standalone live usage/cost watcher
+- [Site](https://thevibeworks.github.io/claude-code-statusline/): animated demo of the line