nemonix-cli 1.0.0

package/src/config/claude-code-config/scripts/command-validator/src/cli.ts

@@ -0,0 +1,121 @@
+#!/usr/bin/env bun
+
+import { join } from "node:path";
+import type { HookInput, HookOutput } from "./lib/types";
+import { CommandValidator } from "./lib/validator";
+
+const LOG_FILE = join(import.meta.dir, "../data/security.log");
+
+async function logSecurityEvent(
+	command: string,
+	toolName: string,
+	result: { isValid: boolean; severity: string; violations: string[] },
+	sessionId: string | null,
+) {
+	const timestamp = new Date().toISOString();
+	const logEntry = {
+		timestamp,
+		sessionId,
+		toolName,
+		command: command.substring(0, 500),
+		blocked: !result.isValid,
+		severity: result.severity,
+		violations: result.violations,
+		source: "claude-code-hook",
+	};
+
+	try {
+		const logLine = `${JSON.stringify(logEntry)}\n`;
+		const file = Bun.file(LOG_FILE);
+		const exists = await file.exists();
+
+		if (exists) {
+			const existingContent = await file.text();
+			await Bun.write(LOG_FILE, existingContent + logLine);
+		} else {
+			await Bun.write(LOG_FILE, logLine);
+		}
+
+		console.error(
+			`[SECURITY] ${result.isValid ? "ALLOWED" : "BLOCKED"}: ${command.substring(0, 100)}`,
+		);
+	} catch (error) {
+		console.error("Failed to write security log:", error);
+	}
+}
+
+async function main() {
+	const validator = new CommandValidator();
+
+	try {
+		const stdin = process.stdin;
+		const chunks: Buffer[] = [];
+
+		for await (const chunk of stdin) {
+			chunks.push(chunk);
+		}
+
+		const input = Buffer.concat(chunks).toString();
+
+		if (!input.trim()) {
+			console.error("No input received from stdin");
+			process.exit(1);
+		}
+
+		let hookData: HookInput;
+		try {
+			hookData = JSON.parse(input);
+		} catch (error) {
+			console.error("Invalid JSON input:", (error as Error).message);
+			process.exit(1);
+		}
+
+		const toolName = hookData.tool_name || "Unknown";
+		const toolInput = hookData.tool_input || {};
+		const sessionId = hookData.session_id || null;
+
+		if (toolName !== "Bash") {
+			console.log(`Skipping validation for tool: ${toolName}`);
+			process.exit(0);
+		}
+
+		const command = toolInput.command;
+		if (!command) {
+			console.error("No command found in tool input");
+			process.exit(1);
+		}
+
+		const result = validator.validate(command, toolName);
+
+		await logSecurityEvent(command, toolName, result, sessionId);
+
+		if (result.isValid) {
+			console.log("Command validation passed");
+			process.exit(0);
+		}
+
+		const message =
+			result.action === "deny"
+				? `Command blocked!\n\nCommand: ${command}\nReason: ${result.violations.join(", ")}\nSeverity: ${result.severity}`
+				: `⚠️ Potentially dangerous command\n\nCommand: ${command}\nReason: ${result.violations.join(", ")}\nSeverity: ${result.severity}\n\nDo you want to proceed?`;
+
+		const hookOutput: HookOutput = {
+			hookSpecificOutput: {
+				hookEventName: "PreToolUse",
+				permissionDecision: result.action === "deny" ? "deny" : "ask",
+				permissionDecisionReason: message,
+			},
+		};
+
+		console.log(JSON.stringify(hookOutput));
+		process.exit(0);
+	} catch (error) {
+		console.error("Validation script error:", error);
+		process.exit(2);
+	}
+}
+
+main().catch((error) => {
+	console.error("Fatal error:", error);
+	process.exit(2);
+});

package/src/config/claude-code-config/scripts/command-validator/src/lib/security-rules.ts

@@ -0,0 +1,174 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import type { SecurityRules } from "./types";
+
+export const SECURITY_RULES: SecurityRules = {
+	CRITICAL_COMMANDS: [
+		"del",
+		"format",
+		"mkfs",
+		"shred",
+		"dd",
+		"fdisk",
+		"parted",
+		"gparted",
+		"cfdisk",
+	],
+
+	PRIVILEGE_COMMANDS: [
+		"sudo",
+		"su",
+		"passwd",
+		"chpasswd",
+		"usermod",
+		"chmod",
+		"chown",
+		"chgrp",
+		"setuid",
+		"setgid",
+	],
+
+	NETWORK_COMMANDS: [
+		"nc",
+		"netcat",
+		"nmap",
+		"telnet",
+		"ssh-keygen",
+		"iptables",
+		"ufw",
+		"firewall-cmd",
+		"ipfw",
+	],
+
+	SYSTEM_COMMANDS: [
+		"systemctl",
+		"service",
+		"kill",
+		"killall",
+		"pkill",
+		"mount",
+		"umount",
+		"swapon",
+		"swapoff",
+	],
+
+	DANGEROUS_PATTERNS: [
+		/rm\s+.*-rf\s*\/\s*$/i,
+		/rm\s+.*-rf\s*\/etc/i,
+		/rm\s+.*-rf\s*\/usr/i,
+		/rm\s+.*-rf\s*\/bin/i,
+		/rm\s+.*-rf\s*\/sys/i,
+		/rm\s+.*-rf\s*\/proc/i,
+		/rm\s+.*-rf\s*\/boot/i,
+		/rm\s+.*-rf\s*\/home\/[^/]*\s*$/i,
+		/rm\s+.*-rf\s*\.\.+\//i,
+		/rm\s+.*-rf\s*\*.*\*/i,
+		/rm\s+.*-rf\s*\$\w+/i,
+		/>\s*\/dev\/(sda|hda|nvme)/i,
+		/dd\s+.*of=\/dev\//i,
+		/shred\s+.*\/dev\//i,
+		/mkfs\.\w+\s+\/dev\//i,
+		/:\(\)\{\s*:\|:&\s*\};:/,
+		/while\s+true\s*;\s*do.*done/i,
+		/for\s*\(\(\s*;\s*;\s*\)\)/i,
+		/\|\s*(sh|bash|zsh|fish)$/i,
+		/(wget|curl)\s+.*\|\s*(sh|bash)/i,
+		/(wget|curl)\s+.*-O-.*\|\s*(sh|bash)/i,
+		/`.*rm.*`/i,
+		/\$\(.*rm.*\)/i,
+		/`.*dd.*`/i,
+		/\$\(.*dd.*\)/i,
+		/cat\s+\/etc\/(passwd|shadow|sudoers)/i,
+		/>\s*\/etc\/(passwd|shadow|sudoers)/i,
+		/echo\s+.*>>\s*\/etc\/(passwd|shadow|sudoers)/i,
+		/\|\s*nc\s+\S+\s+\d+/i,
+		/curl\s+.*-d.*\$\(/i,
+		/wget\s+.*--post-data.*\$\(/i,
+		/>\s*\/var\/log\//i,
+		/rm\s+\/var\/log\//i,
+		/echo\s+.*>\s*~?\/?\.bash_history/i,
+		/nc\s+.*-l.*-e/i,
+		/nc\s+.*-e.*-l/i,
+		/ncat\s+.*--exec/i,
+		/ssh-keygen.*authorized_keys/i,
+		/(wget|curl).*\.(sh|py|pl|exe|bin).*\|\s*(sh|bash|python)/i,
+		/(xmrig|ccminer|cgminer|bfgminer)/i,
+		/cat\s+\/dev\/(mem|kmem)/i,
+		/echo\s+.*>\s*\/dev\/(mem|kmem)/i,
+		/(insmod|rmmod|modprobe)\s+/i,
+		/crontab\s+-e/i,
+		/echo\s+.*>>\s*\/var\/spool\/cron/i,
+		/env\s*\|\s*grep.*PASSWORD/i,
+		/printenv.*PASSWORD/i,
+		/docker\s+(rm|rmi|kill|stop)\s+.*\$\(/i,
+		/docker\s+system\s+prune.*-a/i,
+		/docker\s+container\s+prune.*-f/i,
+		/docker\s+volume\s+rm.*\$\(/i,
+		/docker\s+network\s+rm.*\$\(/i,
+		/prisma\s+(migrate\s+reset|db\s+push\s+--force-reset)/i,
+	],
+
+	PROTECTED_PATHS: [
+		"/etc/",
+		"/usr/",
+		"/sbin/",
+		"/boot/",
+		"/sys/",
+		"/proc/",
+		"/dev/",
+		"/root/",
+	],
+
+	SAFE_EXECUTABLE_PATHS: [
+		"/Applications/",
+		"/usr/local/bin/",
+		"/usr/bin/",
+		"/bin/",
+		"/opt/",
+	],
+
+	SAFE_RM_PATHS: [
+		join(homedir(), "Developer/"),
+		"/tmp/",
+		"/var/tmp/",
+		`${process.cwd()}/`,
+	],
+};
+
+export const SAFE_COMMANDS = [
+	"ls",
+	"dir",
+	"pwd",
+	"whoami",
+	"date",
+	"echo",
+	"cat",
+	"head",
+	"tail",
+	"grep",
+	"find",
+	"wc",
+	"sort",
+	"uniq",
+	"cut",
+	"awk",
+	"sed",
+	"git",
+	"npm",
+	"pnpm",
+	"node",
+	"bun",
+	"python",
+	"pip",
+	"source",
+	"cd",
+	"cp",
+	"mv",
+	"mkdir",
+	"touch",
+	"ln",
+	"psql",
+	"mysql",
+	"sqlite3",
+	"mongo",
+];

package/src/config/claude-code-config/scripts/command-validator/src/lib/types.ts

@@ -0,0 +1,34 @@
+export interface HookInput {
+	tool_name: string;
+	tool_input: {
+		command?: string;
+	};
+	session_id?: string;
+}
+
+export interface ValidationResult {
+	isValid: boolean;
+	severity: "LOW" | "MEDIUM" | "HIGH" | "CRITICAL";
+	violations: string[];
+	sanitizedCommand: string;
+	action: "allow" | "deny" | "ask";
+}
+
+export interface SecurityRules {
+	CRITICAL_COMMANDS: string[];
+	PRIVILEGE_COMMANDS: string[];
+	NETWORK_COMMANDS: string[];
+	SYSTEM_COMMANDS: string[];
+	DANGEROUS_PATTERNS: RegExp[];
+	PROTECTED_PATHS: string[];
+	SAFE_EXECUTABLE_PATHS: string[];
+	SAFE_RM_PATHS: string[];
+}
+
+export interface HookOutput {
+	hookSpecificOutput: {
+		hookEventName: string;
+		permissionDecision: "allow" | "block" | "ask";
+		permissionDecisionReason: string;
+	};
+}

package/src/config/claude-code-config/scripts/command-validator/src/lib/validator.ts

@@ -0,0 +1,90 @@
+import type { ValidationResult } from "./types";
+
+const DANGEROUS_COMMANDS = [
+	"sudo",
+	"su",
+	"chmod",
+	"chown",
+	"dd",
+	"mkfs",
+	"fdisk",
+	"kill",
+	"killall",
+];
+
+export class CommandValidator {
+	validate(command: string, _toolName = "Unknown"): ValidationResult {
+		const result: ValidationResult = {
+			isValid: true,
+			severity: "LOW",
+			violations: [],
+			sanitizedCommand: command,
+			action: "allow",
+		};
+
+		if (!command || typeof command !== "string") {
+			result.isValid = false;
+			result.violations.push("Invalid command format");
+			result.action = "deny";
+			return result;
+		}
+
+		// rm -rf → DENY (blocked completely)
+		if (this.containsRmRf(command)) {
+			result.isValid = false;
+			result.severity = "CRITICAL";
+			result.violations.push("rm -rf is forbidden - use trash instead");
+			result.action = "deny";
+			return result;
+		}
+
+		// Other dangerous commands → ASK (ask for permission)
+		const dangerousCmd = this.containsDangerousCommand(command);
+		if (dangerousCmd) {
+			result.isValid = false;
+			result.severity = "HIGH";
+			result.violations.push(`Potentially dangerous command: ${dangerousCmd}`);
+			result.action = "ask";
+			return result;
+		}
+
+		return result;
+	}
+
+	containsRmRf(command: string): boolean {
+		// Check for rm -rf in any form (rm -rf, rm -fr, rm -r -f, etc.)
+		const rmRfPatterns = [
+			/\brm\s+(-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*r[a-zA-Z]*)\s/i,
+			/\brm\s+-r\s+-f\s/i,
+			/\brm\s+-f\s+-r\s/i,
+		];
+
+		for (const pattern of rmRfPatterns) {
+			if (pattern.test(command)) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	containsDangerousCommand(command: string): string | null {
+		const normalizedCmd = command.trim().toLowerCase();
+		const parts = normalizedCmd.split(/\s+/);
+		const mainCommand = parts[0].split("/").pop() || "";
+
+		if (DANGEROUS_COMMANDS.includes(mainCommand)) {
+			return mainCommand;
+		}
+
+		// Check in chained commands
+		for (const dangerous of DANGEROUS_COMMANDS) {
+			const pattern = new RegExp(`\\b${dangerous}\\b`, "i");
+			if (pattern.test(command)) {
+				return dangerous;
+			}
+		}
+
+		return null;
+	}
+}

package/src/config/claude-code-config/scripts/package.json

@@ -0,0 +1,43 @@
+{
+	"name": "scripts",
+	"type": "module",
+	"scripts": {
+		"test": "bun test auto-rename-session claude-code-ai statusline command-validator",
+		"auto-rename:start": "bun auto-rename-session/src/index.ts",
+		"auto-rename:rename-all": "bun auto-rename-session/src/rename-all.ts",
+		"auto-rename:test": "bun test auto-rename-session",
+		"validator:cli": "bun command-validator/src/cli.ts",
+		"validator:test": "bun test command-validator",
+		"validator:lint": "biome check --write command-validator",
+		"ai:test": "bun test claude-code-ai",
+		"statusline:start": "bun statusline/src/index.ts",
+		"statusline:test": "bun test statusline",
+		"statusline:test-fixtures": "bun statusline/test-with-fixtures.ts",
+		"statusline:spend:day": "bun statusline/src/lib/features/spend/commands/spend-day.ts",
+		"statusline:spend:month": "bun statusline/src/lib/features/spend/commands/spend-month.ts",
+		"statusline:spend:project": "bun statusline/src/lib/features/spend/commands/spend-project.ts",
+		"statusline:stats": "bun statusline/src/stats.ts",
+		"statusline:config": "bun statusline/src/commands/interactive-config.ts",
+		"statusline:migrate": "bun statusline/src/lib/features/spend/commands/migrate-to-sqlite.ts",
+		"statusline:weekly": "bun statusline/src/lib/features/limits/commands/weekly-analysis.ts",
+		"statusline:debug": "bun statusline/src/debug-payloads.ts",
+		"statusline:usage": "bun statusline/src/analyze-daily-usage.ts",
+		"statusline:lint": "biome check --write statusline",
+		"lint": "biome check --write .",
+		"format": "biome format --write ."
+	},
+	"dependencies": {
+		"@ai-sdk/anthropic": "^3.0.6",
+		"ai": "^6.0.11",
+		"picocolors": "^1.1.1",
+		"table": "^6.9.0",
+		"zod": "^4.3.5"
+	},
+	"devDependencies": {
+		"@biomejs/biome": "^2.3.2",
+		"@types/bun": "latest"
+	},
+	"peerDependencies": {
+		"typescript": "^5.0.0"
+	}
+}

package/src/config/claude-code-config/scripts/statusline/CLAUDE.md

@@ -0,0 +1,205 @@
+# Claude Code Statusline - Project Memory
+
+## Overview
+
+Clean, type-safe statusline implementation for Claude Code using Bun + TypeScript. Displays real-time session information, git status, context usage, and Claude API rate limits.
+
+## Project Setup & Configuration
+
+### Dependencies
+
+- **Bun**: Runtime (uses `$` for shell commands)
+- **@biomejs/biome**: Linting & formatting
+- **TypeScript**: Type safety
+
+No external npm packages required - pure Bun APIs.
+
+### Configuration in Claude Code
+
+Add to `~/.claude/settings.json`:
+
+```json
+{
+  "statusLine": {
+    "type": "command",
+    "command": "bun /Users/melvynx/.claude/scripts/statusline/src/index.ts",
+    "padding": 0
+  }
+}
+```
+
+### Authentication
+
+OAuth token stored in macOS Keychain:
+
+- **Service**: `Claude Code-credentials`
+- **Format**: JSON with `claudeAiOauth.accessToken`
+- **Token type**: `sk-ant-oat01-...` (OAuth token, not API key)
+- **Access**: `security find-generic-password -s "Claude Code-credentials" -w`
+
+## Architecture
+
+### Modular Design
+
+The project follows a clean architecture with separated concerns:
+
+```
+src/
+├── index.ts              # Main entry - orchestrates all components
+└── lib/
+    ├── types.ts          # TypeScript interfaces (HookInput)
+    ├── git.ts            # Git operations (branch, changes)
+    ├── context.ts        # Transcript parsing & context calculation
+    ├── usage-limits.ts   # Claude OAuth API integration
+    └── formatters.ts     # Display utilities & colors
+```
+
+### Data Flow
+
+```
+Claude Code Hook → stdin JSON → index.ts
+                                    ↓
+                    ┌───────────────┴───────────────┐
+                    ↓                               ↓
+            [Get Git Status]            [Get Context Data]
+                    ↓                               ↓
+            [Format Branch]             [Get Usage Limits]
+                    ↓                               ↓
+                    └───────────────┬───────────────┘
+                                    ↓
+                            [Build Output Lines]
+                                    ↓
+                            stdout (2 lines)
+```
+
+## Component Specifications
+
+### Context Calculation (`lib/context.ts`)
+
+- **Purpose**: Calculate token usage from Claude Code transcript files
+- **Algorithm**: Parses `.jsonl` transcript, finds most recent main-chain entry
+- **Tokens counted**: `input_tokens + cache_read_input_tokens + cache_creation_input_tokens`
+- **Excludes**: Sidechain entries (agent calls), API error messages
+- **Output**: `{ tokens: number, percentage: number }` (0-100% of 200k context)
+
+### Usage Limits (`lib/usage-limits.ts`)
+
+- **Purpose**: Fetch Claude API rate limits from OAuth endpoint
+- **Auth**: Retrieves OAuth token from macOS Keychain (`Claude Code-credentials`)
+- **API**: `https://api.anthropic.com/api/oauth/usage`
+- **Data**: Five-hour window utilization + reset time
+- **Error handling**: Fails silently, returns null on errors
+
+### Git Status (`lib/git.ts`)
+
+- **Purpose**: Show current branch and uncommitted changes
+- **Detection**: Checks both staged and unstaged changes
+- **Output**: Branch name + line additions/deletions
+- **Display**: `main* (+123 -45)` with color coding
+
+### Formatters (`lib/formatters.ts`)
+
+- **Colors**: ANSI color codes for terminal output
+- **Token display**: `62.5K`, `1.2M` format
+- **Time formatting**: `3h21m`, `45m` for countdowns
+- **Reset time**: Calculates difference between API reset time and now
+
+## Output Specification
+
+### Line 1: Session Info
+
+```
+main* (+123 -45) | ~/.claude | Sonnet 4.5
+```
+
+### Line 2: Metrics
+
+```
+$0.17 (6m) | 62.5K tokens | 31% | 15% (3h27m)
+```
+
+**Components:**
+
+- `$0.17` - Session cost (USD)
+- `(6m)` - Session duration
+- `62.5K tokens` - Context tokens used (from transcript)
+- `31%` - Context percentage (tokens / 200k)
+- `15%` - Five-hour usage (from Claude API)
+- `(3h27m)` - Time until rate limit resets
+
+## Development
+
+### Testing
+
+```bash
+# Run test with fixture
+bun run test
+
+# Use custom fixture
+bun run test fixtures/custom.json
+
+# Manual test
+echo '{ ... }' | bun run start
+```
+
+### Code Conventions
+
+- **ALWAYS** use camelCase for variables and functions
+- Use TypeScript strict mode
+- Follow Biome formatting rules
+
+### Error Handling & Performance
+
+**Error Handling** - All components fail silently:
+
+- Missing transcript → 0 tokens, 0%
+- API failure → No usage limits shown
+- Git errors → "no-git" branch
+- Keychain access denied → No usage limits
+
+This ensures statusline never crashes Claude Code.
+
+**Performance Benchmarks:**
+
+- Context calculation: ~10-50ms (depends on transcript size)
+- API call: ~100-300ms (cached by Claude API)
+- Git operations: ~20-50ms
+- Total: < 500ms typical
+
+## Maintenance Guide
+
+### Adding New Metrics
+
+1. Add interface to `lib/types.ts`
+2. Create fetcher in `lib/*.ts`
+3. Import in `index.ts`
+4. Add to `buildSecondLine()`
+
+### Modifying Display
+
+- Colors: Edit `lib/formatters.ts` colors constant
+- Layout: Modify `buildFirstLine()` / `buildSecondLine()`
+- Formatting: Add functions to `lib/formatters.ts`
+
+## Known Limitations
+
+- macOS only (uses Keychain)
+- Requires `git` CLI for git status
+- Requires Claude Code OAuth (not API key)
+- Transcript must be accessible (permissions)
+
+## Critical Requirements
+
+### Configuration Updates
+
+- **CRITICAL**: When updating `statusline.config.json` or `statusline.config.ts`, you **MUST** update the interactive demo in `src/commands/interactive-config.ts`
+- **ALWAYS** run `bun run config` after config changes to verify the interactive demo works correctly
+- **REQUIRED**: Keep config file structure in sync with interactive prompts
+
+### Runtime & Dependencies
+
+- **ALWAYS** use Bun for all commands and runtime operations
+- Use `bun run <script>` instead of `npm run` or `pnpm run`
+- Use `bun install` for dependency management
+- **AUTHORIZED LIBRARIES**: `@biomejs/biome` for linting/formatting, third-party libraries like `tiers` are permitted if needed
+- **NEVER** add external npm packages without verification - prefer Bun APIs first