cc-context-stats 1.5.1 → 1.6.0

package/tests/python/test_data_pipeline.py

@@ -0,0 +1,446 @@
+"""Tests for core data pipeline: CSV state parsing, statistics, and zone thresholds."""
+
+import pytest
+
+from claude_statusline.core.colors import ColorManager
+from claude_statusline.core.state import StateEntry
+from claude_statusline.graphs.renderer import GraphDimensions, GraphRenderer
+from claude_statusline.graphs.statistics import (
+    Stats,
+    calculate_deltas,
+    calculate_stats,
+    detect_spike,
+)
+
+
+def _make_entry(**kwargs) -> StateEntry:
+    """Factory for StateEntry with sensible defaults."""
+    defaults = dict(
+        timestamp=1710288000,
+        total_input_tokens=75000,
+        total_output_tokens=8500,
+        current_input_tokens=50000,
+        current_output_tokens=5000,
+        cache_creation=10000,
+        cache_read=20000,
+        cost_usd=0.05234,
+        lines_added=250,
+        lines_removed=45,
+        session_id="abc-123-def",
+        model_id="claude-opus-4-5",
+        workspace_project_dir="/home/user/my-project",
+        context_window_size=200000,
+    )
+    defaults.update(kwargs)
+    return StateEntry(**defaults)
+
+
+def _render_summary_output(entries, deltas=None):
+    """Render summary and return buffered output as string."""
+    renderer = GraphRenderer(
+        colors=ColorManager(enabled=False),
+        dimensions=GraphDimensions(
+            term_width=120,
+            term_height=40,
+            graph_width=105,
+            graph_height=13,
+        ),
+    )
+    renderer.begin_buffering()
+    renderer.render_summary(entries, deltas if deltas is not None else [])
+    return renderer.get_buffer()
+
+
+# ---------------------------------------------------------------------------
+# Class 1: CSV Round-Trip
+# ---------------------------------------------------------------------------
+
+
+class TestStateEntryRoundTrip:
+    """Tests for StateEntry.from_csv_line and to_csv_line."""
+
+    def test_full_14_field_round_trip(self):
+        original = _make_entry()
+        csv_line = original.to_csv_line()
+        parsed = StateEntry.from_csv_line(csv_line)
+        assert parsed is not None
+        assert parsed.timestamp == original.timestamp
+        assert parsed.total_input_tokens == original.total_input_tokens
+        assert parsed.total_output_tokens == original.total_output_tokens
+        assert parsed.current_input_tokens == original.current_input_tokens
+        assert parsed.current_output_tokens == original.current_output_tokens
+        assert parsed.cache_creation == original.cache_creation
+        assert parsed.cache_read == original.cache_read
+        assert parsed.cost_usd == pytest.approx(original.cost_usd)
+        assert parsed.lines_added == original.lines_added
+        assert parsed.lines_removed == original.lines_removed
+        assert parsed.session_id == original.session_id
+        assert parsed.model_id == original.model_id
+        assert parsed.workspace_project_dir == original.workspace_project_dir
+        assert parsed.context_window_size == original.context_window_size
+
+    def test_old_format_two_fields(self):
+        entry = StateEntry.from_csv_line("1710288000,50000")
+        assert entry is not None
+        assert entry.timestamp == 1710288000
+        assert entry.total_input_tokens == 50000
+        assert entry.total_output_tokens == 0
+        assert entry.current_input_tokens == 0
+        assert entry.session_id == ""
+        assert entry.context_window_size == 0
+
+    def test_old_format_round_trip_expands(self):
+        """Old 2-field format expands to 14 fields on serialize."""
+        entry = StateEntry.from_csv_line("1710288000,50000")
+        assert entry is not None
+        csv_line = entry.to_csv_line()
+        parts = csv_line.split(",")
+        assert len(parts) == 14
+
+    def test_empty_string_returns_none(self):
+        assert StateEntry.from_csv_line("") is None
+
+    def test_single_field_returns_none(self):
+        assert StateEntry.from_csv_line("1710288000") is None
+
+    def test_non_numeric_timestamp_returns_none(self):
+        assert StateEntry.from_csv_line("abc,50000") is None
+
+    def test_missing_fields_default_to_zero(self):
+        """Line with only 5 fields: fields 5-13 default to 0/empty."""
+        entry = StateEntry.from_csv_line("1710288000,100,200,300,400")
+        assert entry is not None
+        assert entry.timestamp == 1710288000
+        assert entry.total_input_tokens == 100
+        assert entry.total_output_tokens == 200
+        assert entry.current_input_tokens == 300
+        assert entry.current_output_tokens == 400
+        assert entry.cache_creation == 0
+        assert entry.cache_read == 0
+        assert entry.cost_usd == pytest.approx(0.0)
+        assert entry.lines_added == 0
+        assert entry.lines_removed == 0
+        assert entry.session_id == ""
+        assert entry.model_id == ""
+        assert entry.workspace_project_dir == ""
+        assert entry.context_window_size == 0
+
+    def test_non_numeric_fields_default_safely(self):
+        """safe_int returns 0 for non-numeric values."""
+        line = "1710288000,abc,200,xyz,400,0,0,0.0,0,0,sess,model,/tmp,0"
+        entry = StateEntry.from_csv_line(line)
+        assert entry is not None
+        assert entry.total_input_tokens == 0  # "abc" -> 0
+        assert entry.current_input_tokens == 0  # "xyz" -> 0
+        assert entry.total_output_tokens == 200
+
+    def test_comma_in_workspace_path_sanitized(self):
+        """Commas in workspace_project_dir become underscores on serialize."""
+        entry = _make_entry(workspace_project_dir="/home/user/path,with,commas")
+        csv_line = entry.to_csv_line()
+        assert "/home/user/path_with_commas" in csv_line
+        assert "/home/user/path,with,commas" not in csv_line
+
+    def test_comma_in_path_round_trip_lossy(self):
+        """Round-trip is intentionally lossy for paths with commas."""
+        entry = _make_entry(workspace_project_dir="/home/user/path,with,commas")
+        csv_line = entry.to_csv_line()
+        parsed = StateEntry.from_csv_line(csv_line)
+        assert parsed is not None
+        assert parsed.workspace_project_dir == "/home/user/path_with_commas"
+
+    def test_float_cost_preserved(self):
+        entry = _make_entry(cost_usd=0.05234)
+        csv_line = entry.to_csv_line()
+        parsed = StateEntry.from_csv_line(csv_line)
+        assert parsed is not None
+        assert parsed.cost_usd == pytest.approx(0.05234)
+
+    def test_zero_values_round_trip(self):
+        entry = _make_entry(
+            total_input_tokens=0,
+            total_output_tokens=0,
+            current_input_tokens=0,
+            current_output_tokens=0,
+            cache_creation=0,
+            cache_read=0,
+            cost_usd=0.0,
+            lines_added=0,
+            lines_removed=0,
+            session_id="",
+            model_id="",
+            workspace_project_dir="",
+            context_window_size=0,
+        )
+        csv_line = entry.to_csv_line()
+        parsed = StateEntry.from_csv_line(csv_line)
+        assert parsed is not None
+        assert parsed.total_input_tokens == 0
+        assert parsed.session_id == ""
+        assert parsed.workspace_project_dir == ""
+
+    def test_whitespace_line_stripped(self):
+        entry = StateEntry.from_csv_line("  1710288000,50000  \n")
+        assert entry is not None
+        assert entry.timestamp == 1710288000
+
+    def test_to_csv_line_no_trailing_newline(self):
+        entry = _make_entry()
+        csv_line = entry.to_csv_line()
+        assert "\n" not in csv_line
+
+
+# ---------------------------------------------------------------------------
+# Class 2: StateEntry Properties
+# ---------------------------------------------------------------------------
+
+
+class TestStateEntryProperties:
+    """Tests for StateEntry computed properties."""
+
+    def test_total_tokens(self):
+        entry = _make_entry(total_input_tokens=75000, total_output_tokens=8500)
+        assert entry.total_tokens == 83500
+
+    def test_current_used_tokens(self):
+        entry = _make_entry(
+            current_input_tokens=50000, cache_creation=10000, cache_read=20000
+        )
+        assert entry.current_used_tokens == 80000
+
+    def test_current_used_tokens_all_zero(self):
+        entry = _make_entry(
+            current_input_tokens=0, cache_creation=0, cache_read=0
+        )
+        assert entry.current_used_tokens == 0
+
+
+# ---------------------------------------------------------------------------
+# Class 3: calculate_deltas
+# ---------------------------------------------------------------------------
+
+
+class TestCalculateDeltas:
+    """Tests for calculate_deltas."""
+
+    def test_empty_list(self):
+        assert calculate_deltas([]) == []
+
+    def test_single_value(self):
+        assert calculate_deltas([100]) == []
+
+    def test_two_values(self):
+        assert calculate_deltas([100, 250]) == [150]
+
+    def test_increasing_sequence(self):
+        assert calculate_deltas([100, 200, 350, 600]) == [100, 150, 250]
+
+    def test_negative_delta_clamped_to_zero(self):
+        """Session reset: value decreases, delta clamped to 0."""
+        assert calculate_deltas([500, 300]) == [0]
+
+    def test_mixed_positive_and_negative(self):
+        assert calculate_deltas([100, 300, 200, 400]) == [200, 0, 200]
+
+    def test_constant_values(self):
+        assert calculate_deltas([100, 100, 100]) == [0, 0]
+
+    def test_large_negative_delta(self):
+        """Full session reset from 1M to 0."""
+        assert calculate_deltas([1000000, 0]) == [0]
+
+
+# ---------------------------------------------------------------------------
+# Class 4: calculate_stats
+# ---------------------------------------------------------------------------
+
+
+class TestCalculateStats:
+    """Tests for calculate_stats."""
+
+    def test_empty_data(self):
+        result = calculate_stats([])
+        assert result == Stats(min_val=0, max_val=0, avg_val=0, total=0, count=0)
+
+    def test_single_value(self):
+        result = calculate_stats([42])
+        assert result == Stats(min_val=42, max_val=42, avg_val=42, total=42, count=1)
+
+    def test_normal_data(self):
+        result = calculate_stats([10, 20, 30, 40, 50])
+        assert result.min_val == 10
+        assert result.max_val == 50
+        assert result.avg_val == 30
+        assert result.total == 150
+        assert result.count == 5
+
+    def test_avg_uses_integer_division(self):
+        result = calculate_stats([10, 20])
+        assert result.avg_val == 15  # 30 // 2
+
+    def test_all_same_values(self):
+        result = calculate_stats([100, 100, 100])
+        assert result.min_val == 100
+        assert result.max_val == 100
+        assert result.avg_val == 100
+
+    def test_includes_zeros(self):
+        result = calculate_stats([0, 0, 100])
+        assert result.min_val == 0
+        assert result.max_val == 100
+        assert result.avg_val == 33  # 100 // 3
+
+
+# ---------------------------------------------------------------------------
+# Class 5: detect_spike (boundary-focused, complements test_icons.py)
+# ---------------------------------------------------------------------------
+
+
+class TestDetectSpike:
+    """Boundary and edge-case tests for detect_spike."""
+
+    def test_empty_deltas(self):
+        assert detect_spike([], 200000) is False
+
+    def test_at_exactly_15_percent_not_spike(self):
+        """30000 = exactly 15% of 200000. Strict > means not a spike."""
+        assert detect_spike([30000], 200000) is False
+
+    def test_just_above_15_percent_is_spike(self):
+        assert detect_spike([30001], 200000) is True
+
+    def test_relative_at_exactly_3x_not_spike(self):
+        """300 = exactly 3x avg(100). Strict > means not a spike."""
+        # Previous deltas avg = 100, latest = 300 = 3.0x (not > 3x)
+        assert detect_spike([100, 100, 100, 100, 300], 200000) is False
+
+    def test_relative_just_above_3x_is_spike(self):
+        assert detect_spike([100, 100, 100, 100, 301], 200000) is True
+
+    def test_zero_avg_no_relative_spike(self):
+        """avg=0 skips relative check. 100 < 30000 so no absolute spike."""
+        assert detect_spike([0, 0, 0, 0, 100], 200000) is False
+
+    def test_zero_context_window_only_relative(self):
+        """Absolute check skipped (ctx=0), but 500 > 3*100 triggers relative."""
+        assert detect_spike([100, 100, 100, 100, 500], 0) is True
+
+    def test_window_parameter_limits_lookback(self):
+        """With window=2, only last 2 previous deltas used for average."""
+        # Previous 2 deltas: [100, 100], avg=100, latest=500 > 300
+        assert detect_spike([1000, 100, 100, 500], 200000, window=2) is True
+
+    def test_single_delta_below_absolute(self):
+        """Single delta with no previous for relative; below 15% threshold."""
+        assert detect_spike([1000], 200000) is False
+
+    def test_single_delta_above_absolute(self):
+        assert detect_spike([35000], 200000) is True
+
+
+# ---------------------------------------------------------------------------
+# Class 6: Zone Thresholds (via render_summary)
+# ---------------------------------------------------------------------------
+
+
+class TestZoneThresholds:
+    """Tests for zone classification in render_summary.
+
+    Zone boundaries (usage_percentage):
+        < 40%  → Smart Zone
+        < 80%  → Dumb Zone
+        >= 80% → Wrap Up Zone
+
+    Math for context_window_size=200000:
+        usage% = 100 - (remaining * 100 // 200000)
+        remaining = max(0, 200000 - current_used_tokens)
+    """
+
+    def test_zero_usage_smart_zone(self):
+        entries = [_make_entry(
+            current_input_tokens=0, cache_creation=0, cache_read=0,
+            context_window_size=200000,
+        )]
+        output = _render_summary_output(entries)
+        assert "SMART ZONE" in output
+        assert "DUMB ZONE" not in output
+        assert "WRAP UP ZONE" not in output
+
+    def test_usage_39_pct_smart_zone(self):
+        # current_used=78000, remaining=122000, remaining%=61, usage%=39
+        entries = [_make_entry(
+            current_input_tokens=78000, cache_creation=0, cache_read=0,
+            context_window_size=200000,
+        )]
+        output = _render_summary_output(entries)
+        assert "SMART ZONE" in output
+        assert "DUMB ZONE" not in output
+
+    def test_usage_40_pct_dumb_zone(self):
+        # current_used=78001, remaining=121999, remaining%=60, usage%=40
+        entries = [_make_entry(
+            current_input_tokens=78001, cache_creation=0, cache_read=0,
+            context_window_size=200000,
+        )]
+        output = _render_summary_output(entries)
+        assert "DUMB ZONE" in output
+        assert "SMART ZONE" not in output
+        assert "WRAP UP ZONE" not in output
+
+    def test_usage_79_pct_dumb_zone(self):
+        # current_used=158000, remaining=42000, remaining%=21, usage%=79
+        entries = [_make_entry(
+            current_input_tokens=158000, cache_creation=0, cache_read=0,
+            context_window_size=200000,
+        )]
+        output = _render_summary_output(entries)
+        assert "DUMB ZONE" in output
+        assert "WRAP UP ZONE" not in output
+
+    def test_usage_80_pct_wrap_up_zone(self):
+        # current_used=158001, remaining=41999, remaining%=20, usage%=80
+        entries = [_make_entry(
+            current_input_tokens=158001, cache_creation=0, cache_read=0,
+            context_window_size=200000,
+        )]
+        output = _render_summary_output(entries)
+        assert "WRAP UP ZONE" in output
+        assert "DUMB ZONE" not in output
+
+    def test_usage_100_pct_wrap_up_zone(self):
+        entries = [_make_entry(
+            current_input_tokens=200000, cache_creation=0, cache_read=0,
+            context_window_size=200000,
+        )]
+        output = _render_summary_output(entries)
+        assert "WRAP UP ZONE" in output
+
+    def test_usage_exceeds_context_window(self):
+        """Remaining clamped to 0 when usage exceeds window."""
+        entries = [_make_entry(
+            current_input_tokens=250000, cache_creation=0, cache_read=0,
+            context_window_size=200000,
+        )]
+        output = _render_summary_output(entries)
+        assert "WRAP UP ZONE" in output
+
+    def test_cache_tokens_contribute_to_usage(self):
+        """cache_creation + cache_read push usage past 40% boundary."""
+        # current_used = 40000 + 20000 + 18001 = 78001 → usage=40% → Dumb Zone
+        entries = [_make_entry(
+            current_input_tokens=40000, cache_creation=20000, cache_read=18001,
+            context_window_size=200000,
+        )]
+        output = _render_summary_output(entries)
+        assert "DUMB ZONE" in output
+        assert "SMART ZONE" not in output
+
+    def test_zero_context_window_no_zone_output(self):
+        """No zone displayed when context_window_size is 0."""
+        entries = [_make_entry(context_window_size=0)]
+        output = _render_summary_output(entries)
+        assert "ZONE" not in output
+
+    def test_empty_entries_no_output(self):
+        output = _render_summary_output([])
+        assert output == ""

package/tests/python/test_state_rotation_validation.py

@@ -0,0 +1,232 @@
+"""Tests for state file rotation and session ID validation."""
+
+import re
+import subprocess
+import sys
+
+import pytest
+
+from claude_statusline.core.state import StateFile, _validate_session_id
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+def _make_csv_line(index: int) -> str:
+    """Generate a deterministic CSV state line for a given index."""
+    return (
+        f"{1710288000 + index},100,200,300,400,500,600,0.01,"
+        f"10,5,sess-{index},model,/tmp/proj,200000"
+    )
+
+
+# ---------------------------------------------------------------------------
+# State File Rotation
+# ---------------------------------------------------------------------------
+
+
+class TestStateFileRotation:
+    """Tests for _maybe_rotate() in StateFile."""
+
+    def test_below_threshold_no_rotation(self, tmp_path, monkeypatch):
+        """File with fewer than 10,000 lines is not rotated."""
+        monkeypatch.setattr(StateFile, "STATE_DIR", tmp_path)
+        monkeypatch.setattr(StateFile, "OLD_STATE_DIR", tmp_path / "old")
+        (tmp_path / "old").mkdir()
+
+        sf = StateFile("test-session")
+        # Write 9,999 lines
+        lines = [_make_csv_line(i) + "\n" for i in range(9_999)]
+        sf.file_path.write_text("".join(lines))
+
+        sf._maybe_rotate()
+
+        result_lines = sf.file_path.read_text().splitlines()
+        assert len(result_lines) == 9_999
+
+    def test_at_threshold_no_rotation(self, tmp_path, monkeypatch):
+        """File with exactly 10,000 lines is not rotated."""
+        monkeypatch.setattr(StateFile, "STATE_DIR", tmp_path)
+        monkeypatch.setattr(StateFile, "OLD_STATE_DIR", tmp_path / "old")
+        (tmp_path / "old").mkdir()
+
+        sf = StateFile("test-session")
+        lines = [_make_csv_line(i) + "\n" for i in range(10_000)]
+        sf.file_path.write_text("".join(lines))
+
+        sf._maybe_rotate()
+
+        result_lines = sf.file_path.read_text().splitlines()
+        assert len(result_lines) == 10_000
+
+    def test_exceeds_threshold_truncates_to_5000(self, tmp_path, monkeypatch):
+        """File with 10,001 lines is truncated to 5,000."""
+        monkeypatch.setattr(StateFile, "STATE_DIR", tmp_path)
+        monkeypatch.setattr(StateFile, "OLD_STATE_DIR", tmp_path / "old")
+        (tmp_path / "old").mkdir()
+
+        sf = StateFile("test-session")
+        lines = [_make_csv_line(i) + "\n" for i in range(10_001)]
+        sf.file_path.write_text("".join(lines))
+
+        sf._maybe_rotate()
+
+        result_lines = sf.file_path.read_text().splitlines()
+        assert len(result_lines) == 5_000
+
+    def test_retained_lines_are_most_recent(self, tmp_path, monkeypatch):
+        """After rotation, the retained lines are the last 5,000 of the original."""
+        monkeypatch.setattr(StateFile, "STATE_DIR", tmp_path)
+        monkeypatch.setattr(StateFile, "OLD_STATE_DIR", tmp_path / "old")
+        (tmp_path / "old").mkdir()
+
+        sf = StateFile("test-session")
+        total = 10_001
+        lines = [_make_csv_line(i) + "\n" for i in range(total)]
+        sf.file_path.write_text("".join(lines))
+
+        sf._maybe_rotate()
+
+        result_lines = sf.file_path.read_text().splitlines()
+        # First retained line should be the one at index (total - 5000) = 5001
+        assert f"sess-{total - 5000}" in result_lines[0]
+        # Last retained line should be the last original line
+        assert f"sess-{total - 1}" in result_lines[-1]
+
+    def test_rotation_via_append_entry(self, tmp_path, monkeypatch):
+        """append_entry triggers rotation when threshold is exceeded."""
+        monkeypatch.setattr(StateFile, "STATE_DIR", tmp_path)
+        monkeypatch.setattr(StateFile, "OLD_STATE_DIR", tmp_path / "old")
+        (tmp_path / "old").mkdir()
+
+        sf = StateFile("test-session")
+        # Write exactly 10,000 lines (at threshold, no rotation yet)
+        lines = [_make_csv_line(i) + "\n" for i in range(10_000)]
+        sf.file_path.write_text("".join(lines))
+
+        # Import StateEntry to create a valid entry
+        from claude_statusline.core.state import StateEntry
+
+        entry = StateEntry(
+            timestamp=1710298000,
+            total_input_tokens=100,
+            total_output_tokens=200,
+            current_input_tokens=300,
+            current_output_tokens=400,
+            cache_creation=500,
+            cache_read=600,
+            cost_usd=0.01,
+            lines_added=10,
+            lines_removed=5,
+            session_id="test-session",
+            model_id="model",
+            workspace_project_dir="/tmp/proj",
+            context_window_size=200000,
+        )
+        sf.append_entry(entry)
+
+        # Now file had 10,001 lines -> should have been rotated to 5,000
+        result_lines = sf.file_path.read_text().splitlines()
+        assert len(result_lines) == 5_000
+
+    def test_no_temp_files_left_after_rotation(self, tmp_path, monkeypatch):
+        """No .tmp files remain after successful rotation."""
+        monkeypatch.setattr(StateFile, "STATE_DIR", tmp_path)
+        monkeypatch.setattr(StateFile, "OLD_STATE_DIR", tmp_path / "old")
+        (tmp_path / "old").mkdir()
+
+        sf = StateFile("test-session")
+        lines = [_make_csv_line(i) + "\n" for i in range(10_001)]
+        sf.file_path.write_text("".join(lines))
+
+        sf._maybe_rotate()
+
+        tmp_files = list(tmp_path.glob("*.tmp"))
+        assert tmp_files == []
+
+
+# ---------------------------------------------------------------------------
+# Session ID Validation
+# ---------------------------------------------------------------------------
+
+
+class TestSessionIdValidation:
+    """Tests for _validate_session_id and StateFile constructor validation."""
+
+    def test_reject_forward_slash(self):
+        with pytest.raises(ValueError, match="/"):
+            _validate_session_id("../../etc/passwd")
+
+    def test_reject_backslash(self):
+        with pytest.raises(ValueError, match=re.escape("\\")):
+            _validate_session_id("..\\..\\etc\\passwd")
+
+    def test_reject_dot_dot(self):
+        with pytest.raises(ValueError, match=r"\.\."):
+            _validate_session_id("..hidden")
+
+    def test_reject_null_byte(self):
+        with pytest.raises(ValueError):
+            _validate_session_id("session\0id")
+
+    def test_accept_valid_uuid(self):
+        _validate_session_id("abc-123-def-456")  # Should not raise
+
+    def test_accept_hyphens_underscores(self):
+        _validate_session_id("my_session-id_123")  # Should not raise
+
+    def test_accept_alphanumeric(self):
+        _validate_session_id("abcdef1234567890")  # Should not raise
+
+    def test_statefile_rejects_invalid_session(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(StateFile, "STATE_DIR", tmp_path)
+        monkeypatch.setattr(StateFile, "OLD_STATE_DIR", tmp_path / "old")
+        (tmp_path / "old").mkdir()
+
+        with pytest.raises(ValueError):
+            StateFile("../../etc/passwd")
+
+    def test_statefile_accepts_none_session(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(StateFile, "STATE_DIR", tmp_path)
+        monkeypatch.setattr(StateFile, "OLD_STATE_DIR", tmp_path / "old")
+        (tmp_path / "old").mkdir()
+
+        sf = StateFile(None)  # Should not raise
+        assert sf.session_id is None
+
+    def test_statefile_accepts_valid_session(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(StateFile, "STATE_DIR", tmp_path)
+        monkeypatch.setattr(StateFile, "OLD_STATE_DIR", tmp_path / "old")
+        (tmp_path / "old").mkdir()
+
+        sf = StateFile("valid-session-123")  # Should not raise
+        assert sf.session_id == "valid-session-123"
+
+
+# ---------------------------------------------------------------------------
+# CLI Session ID Rejection (subprocess test)
+# ---------------------------------------------------------------------------
+
+
+class TestCliSessionIdRejection:
+    """Test that context-stats CLI rejects invalid session IDs."""
+
+    def test_cli_rejects_path_traversal(self):
+        result = subprocess.run(
+            [sys.executable, "-m", "claude_statusline.cli.context_stats", "../../etc/passwd"],
+            capture_output=True,
+            text=True,
+        )
+        assert result.returncode != 0
+        assert "Invalid session_id" in result.stderr
+
+    def test_cli_rejects_backslash(self):
+        result = subprocess.run(
+            [sys.executable, "-m", "claude_statusline.cli.context_stats", "test\\bad"],
+            capture_output=True,
+            text=True,
+        )
+        assert result.returncode != 0
+        assert "Invalid session_id" in result.stderr

package/.claude/commands/context-stats.md

@@ -1,17 +0,0 @@
----
-description: Display ASCII graph of token usage for current session
-argument-hint: [session_id] [--type cumulative|delta|both] [--no-color]
-allowed-tools: Bash(*)
----
-
-# Context Stats
-
-Display the token consumption history as ASCII graphs.
-
-**IMPORTANT**: This command executes a bash script and displays its output directly. Do NOT analyze or interpret the results - simply show them to the user.
-
-Execute the token graph script:
-
-!`bash /Users/montimage/buildspace/luongnv89/claude-statusline/scripts/context-stats.sh $ARGUMENTS`
-
-The output above shows the token usage visualization. No further analysis is needed.