Claude Code statusline that checks package publish readiness from package.json, optional npm login visibility, package privacy, and dirty package metadata files.
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
0
78
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as source-backed.
Metadata reviewed
Registry metadata indicates a reviewed listing.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
No package verification flag provided.
Checksum metadata
No checksum provided for downloaded artifact.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 16/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
Listing has review metadata.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
No package verification/checksum metadata.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Required evidence gates are covered (5/6 signals complete).
Source repository/provenance is listed.
Required in this preset
Review metadata is present.
Required in this preset
Safety notes are present.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is missing.
Optional in this preset
Install payload is available.
Required in this preset
Required evidence gates are covered for this preset.
Decision timeline
5/6 steps complete with no blocking gaps for this preset.
triage
Source/provenance metadata is available.
triage
Review metadata is available.
verify
Safety notes are available.
verify
Privacy notes are available.
verify
Package integrity metadata is missing.
rollout
Install payload is available.
No required blockers for this timeline preset.
Prerequisite readiness
3 prerequisites to line up before setup. Have accounts and credentials ready first.
Safety & privacy surface
5 safety and 3 privacy notes across 5 risk areas. Review closely: credentials & tokens.
#!/usr/bin/env bash
set -u
main() {
if [ ! -f package.json ]; then
echo "npm: no package.json"
exit 0
fi
if ! command -v jq >/dev/null 2>&1; then
echo "npm: jq missing"
exit 0
fi
name=$(jq -r '.name // "unnamed"' package.json)
version=$(jq -r '.version // "0.0.0"' package.json)
private=$(jq -r '.private // false' package.json)
dirty=$(git status --porcelain=v1 -- package.json package-lock.json npm-shrinkwrap.json pnpm-lock.yaml yarn.lock 2>/dev/null | wc -l | tr -d ' ')
login="auth-unchecked"
if [ "${NPM_STATUSLINE_CHECK_WHOAMI:-}" = "1" ] && command -v npm >/dev/null 2>&1; then
if command -v timeout >/dev/null 2>&1; then
if timeout 3s npm whoami >/dev/null 2>&1; then
login="logged-in"
else
login="login-missing"
fi
else
login="whoami-timeout-missing"
fi
fi
if [ "$private" = "true" ]; then
state="blocked"
elif [ "$dirty" -gt 0 ]; then
state="review"
elif [ "$login" = "login-missing" ]; then
state="auth"
elif [ "$login" != "logged-in" ]; then
state="review"
else
state="ready"
fi
cleanliness="clean"
if [ "$dirty" -gt 0 ]; then
cleanliness="dirty"
fi
printf 'npm: %s@%s | %s | %s | %s\n' "$name" "$version" "$cleanliness" "$login" "$state"
}
case $- in
*n*) ;;
*) main "$@" ;;
esac{
"statusLine": {
"type": "command",
"command": "$CLAUDE_PROJECT_DIR/.claude/statuslines/npm-publish-readiness-statusline.sh"
}
}npm publish behavior and package metadata that affects publication.npm pack --dry-run; this statusline intentionally avoids publishing and leaves dry-run verification to a separate release command.Checked existing statuslines, live HeyClaude statuslines, open pull requests, and repository content for npm-publish-readiness-statusline, package publish readiness, npm publish, release readiness, and package statuslines. No statusline entry or open PR with this slug or npm publish-readiness focus was found.
Editorial statusline recipe. No paid placement or affiliate link is used.
Show that npm Publish Readiness Statusline is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/statuslines/npm-publish-readiness-statusline)npm Publish Readiness Statusline side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
| Field | Claude Code statusline that checks package publish readiness from package.json, optional npm login visibility, package privacy, and dirty package metadata files. Open dossier | Claude Code statusline that reads Istanbul JSON summary output and compares current line coverage with a local baseline percentage. Open dossier | Claude Code statusline that reads Anthropic Claude Code Analytics Admin API data and shows daily estimated cost, hourly pace, sessions, and budget pressure. Open dossier | Claude Code statusline that estimates context pressure from local session token counts and a configurable context limit, then prints a compact risk tier. Open dossier |
|---|---|---|---|---|
| Next steps | ||||
| Trust | ||||
| Review status | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed |
| Package trust | Package not verified | Package not verified | Package not verified | Package not verified |
| Source provenance | Source-backed | Source-backed | Source-backed | Source-backed |
| Submitter | MkDev11 | MkDev11 | MkDev11 | MkDev11 |
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — | — |
| Category | statuslines | statuslines | statuslines | statuslines |
| Source | Source-backed | Source-backed | Source-backed | Source-backed |
| Author | MkDev11 | MkDev11 | MkDev11 | MkDev11 |
| Added | 2026-06-04 | 2026-06-04 | 2026-06-04 | 2026-06-04 |
| Platforms | ||||
| Harness | ||||
| Source repo | — | — | — | — |
| Safety notes | ✓The script does not run `npm publish`; by default it only reads local package metadata and git status. npm login visibility is disabled by default because `npm whoami` can contact the configured registry; set `NPM_STATUSLINE_CHECK_WHOAMI=1` only for trusted projects. Optional `npm whoami` checks require the `timeout` command and are capped at 3 seconds to avoid stalled statusline rendering. Readiness is a checklist signal, not approval to publish; run `npm pack --dry-run` and project release checks separately. Dirty lockfiles or package metadata should be reviewed before release tagging. | ✓Coverage percentage is a testing signal, not proof that behavior is correct or edge cases are covered. Do not run coverage generation inside a fast-refreshing statusline; read an existing summary file instead. Use project-specific thresholds so generated files and intentionally excluded code do not create misleading pressure. | ✓Claude Code Analytics data is daily aggregated and can lag recent activity, so the burn-rate display is a pacing signal rather than real-time billing control. Keep the refresh interval moderate because the statusline calls an authenticated Admin API endpoint. Treat budget thresholds as operational prompts; reconcile invoices and Console reports before making spending decisions. | ✓Context percentage is only as accurate as the configured limit and the usage fields available in the statusline input. Use the warning as a cue to summarize or checkpoint work before context pressure affects reasoning quality. Do not treat a low percentage as proof that all relevant files, instructions, or tool results are still in scope. |
| Privacy notes | ✓The output prints package name and version, which can reveal unreleased package plans in screenshots. With `NPM_STATUSLINE_CHECK_WHOAMI=1`, npm login visibility follows local npm configuration and can send credentials to the configured registry. package.json can contain private package names; avoid sharing terminal output when those names are sensitive. | ✓The script reads a local coverage summary and prints only aggregate line coverage. Coverage paths inside the JSON file can contain repository structure; avoid printing raw summaries in shared logs. Team baselines can reveal internal quality gates if screenshots are shared externally. | ✓The script sends an Admin API request to Anthropic and receives organization-level Claude Code analytics. It prints aggregate cost, session, and budget numbers, not email addresses, model names, prompts, file paths, or code. Admin API keys can expose organization analytics; store them in a scoped local secret manager or shell environment with restricted access. The script feeds the API key to curl through a config file descriptor instead of command-line arguments and unsets the exported key before launching curl, reducing process-list exposure on shared machines. | ✓The script reads local session counters and does not inspect prompt text, files, or transcript contents. Token counts and configured limits can still reveal workload size in screenshots or shared terminal logs. Teams should avoid placing customer names or project identifiers in shell variables that appear in debugging output. |
| Prerequisites |
|
|
|
|
| Install | — | — | — | — |
| Config | | | | |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Source-backed guides for putting this to work.
Write a claude-code-hint tag to stderr under CLAUDECODE, and Claude Code prompts users once to install your official-marketplace plugin.
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.