A transparent, signed, clickable sponsored line for Claude Code's wait-time.
Open-source, zero-dependency, reversible — the honest alternative to invasive AI monetizers.
When you prompt Claude Code, it thinks for 10–90 seconds and you watch the bar. That attention
has a buyer. LumaLine renders one clearly-labeled, signed, clickable sponsored line in
Claude Code's status bar during that wait — using only the official statusLine mechanism.
No bundle patching. No silent updates. No security trade-offs.
★ LumaLine — honest, signed ads for Claude Code · https://luma-line.lovable.app · sponsored (5s)
One labeled line, Ed25519-signed before it ever renders. The destination URL is shown inline (transparent, and copy/click-reachable in any terminal), and the whole line is also an OSC-8 hyperlink straight to the advertiser's site (the URL is signed, so it can't be tampered with). The line is colored the brand green by default. Hide the URL with
LUMALINE_SHOW_URL=0, disable color withNO_COLOR=1(orLUMALINE_COLOR=off), disable links withLUMALINE_HYPERLINKS=0.
Public beta is live now. The signed feed currently serves LumaLine's own self-promo line so you can install it and watch the whole trust loop run for real. Per-publisher earnings unlock at GA (publisher login + payouts) — join the founding-publisher waitlist. We market what's true: see it live today, not get paid today.
Monetizing AI wait-time isn't a new idea. Kickbacks.ai proved developers want it — then paid people by patching Anthropic's bundle, weakening CSP, and auto-updating silently in the background. The idea was right. The method betrayed the people who trusted it.
The danger was never the money. It was the method.
Ads in a status line aren't a threat — bundle patching is, silent updates are, unsigned code is.
Strip those out and all that's left is one labeled line. So LumaLine does exactly, and only,
that: the official statusLine hook, content that's cryptographically signed before it renders,
a local audit log of every event, and a one-command, fully-reversible install.
You never have to take our word for it — the whole client is open-source and zero-dependency.
Install the beta from GitHub (the client is zero-dependency; this pulls only LumaLine):
npm install -g github:JaamesBond/LumaLine
lumaline doctor # shows the feed URL, the bundled key fingerprint, reachability, login state
lumaline install # explicit, reversible — wires the statusLine into Claude Code
# … use Claude Code; the signed line appears during wait-time …
lumaline uninstall # restores your previous statusLine, byte-for-byteOptional — log in so your views earn (opt-in, device-code):
lumaline login # prints a code + URL; approve in the browser, and impressions attribute to you
lumaline earnings # transparent ledger: what you've accrued (USD)
lumaline logout # revoke this device; revert to the anonymous (never-billed) lineLogin is opt-in and never automatic. Before it, the line runs anonymously and is never billed. After it, earnings accrue to your account — but real payouts begin only at the production go-live; until then balances are informational. A revoked or expired device falls back to the anonymous identity and accrues nothing. The only thing that ever leaves your machine on login is a short-lived token carrying just opaque account/device IDs — never your email, code, or any content. See the Privacy Policy and Publisher Terms.
install is the only thing that touches your Claude Code settings, and only when you run
it — never automatically on npm install. It backs up ~/.claude/settings.json first and
remembers any prior statusLine for a clean restore.
Prefer to poke at it first, no config touched? Clone and run the offline demo (it spins up its own signed feed + a fake Claude Code session):
git clone https://github.com/JaamesBond/LumaLine.git && cd LumaLine
npm run demo # cinematic: looks like a real Claude Code session
npm run demo:plumbing # bare tick loop → local audit log + a backend VERIFIED impression
npm test # 34 tests: crypto, dwell protocol, anti-fraud, click trackerNote:
demois annpmscript (run from a clone), not alumalinesubcommand. The installed CLI isinstall · uninstall · login · logout · earnings · statusline · doctor · version.
LumaLine wires a command into Claude Code's official
statusLine hook. Each tick, that command:
- Sanctioned surface — runs only as the official
statusLinecommand. Nothing patched, nothing injected. - Signed content — fetches the current ad and verifies its Ed25519 signature against the bundled public key. Anything unsigned or forged is refused; the client shows your plain status instead.
- Honest billing — opens a server-verified dwell window, posts a per-second heartbeat hash-chain bound to real agent activity, and records one impression only after a full, honest dwell — never during idle.
- Transparent ledger — when earnings turn on at GA, revenue clears on a publisher-favored 60/40 double-entry ledger with a 72h clawback window and invalid-traffic scanning. (During the beta the self-promo line is
gross = 0— counted as a view, never billed.)
refreshInterval: 1 keeps the line live even through long idle, but billable impressions only
count when there's real activity, so idle time never inflates anything.
The whole pitch is that every objection is answered in code:
| Your worry | The answer |
|---|---|
| Will it touch my Claude config? | Only when you run lumaline install. Never on npm install. No postinstall, no self-update. |
| Can I undo it? | lumaline uninstall restores your old status line. A full settings backup is kept. |
| Could a forged ad get through? | Ed25519-signed; the client verifies the exact bytes against a bundled public key and refuses anything that fails. |
| What's it pulling into my machine? | Zero runtime dependencies. node: built-ins only. Nothing transitive to audit. |
| Could a link hijack my terminal? | The URL is validated (absolute http(s), no control chars) before it's ever shown inline or wrapped in an OSC-8 escape. |
| Do I have to trust your word? | Open-source client, with a local human-readable audit log of every event. Verify it yourself. |
What leaves your machine per tick is just { windowId, seq, hmac, activity-bucket, ts } — no
code, no paths, no prompts, no raw cost/token counts, no PII — and it's all mirrored to a
human-readable local audit log (~/.lumaline/audit.log). Only a coarse activity bucket
(none/low/med/high) is sent; the raw value used to detect change never leaves your machine.
LumaLine turns on a live, signed feed that your client polls once per second while Claude Code is open. Honesty means naming what that inevitably exposes to the feed server, and what it does not:
- The server necessarily sees: your IP address (any HTTP request reveals it), request timing, and the opaque per-window ids / heartbeat hashes listed above. That's the irreducible minimum to run a signed dwell protocol.
- The server never receives: your prompts, code, file paths, project names, model name, raw cost or token counts, or any PII. The client is built so those values stay local — only the coarse activity bucket is transmitted.
- Retention posture (beta): request/impression rows are kept on the project's Supabase backend
for operating and anti-fraud purposes; the beta self-promo line is never billed (
gross = 0). - You stay in control: every event is mirrored locally to
~/.lumaline/audit.log, links can be turned off (LUMALINE_HYPERLINKS=0), andlumaline uninstallstops the feed entirely.
A full Terms / Privacy / ad policy lands with GA earnings. If a live per-second beacon isn't for you, that's a fair call — uninstall is one command.
Developers: install the beta, watch the signed line run, and join the founding-publisher waitlist. When earnings turn on at GA, you'll keep 60% of gross on an auditable ledger — and founding publishers go first. (No earnings during the beta — the self-promo line is never billed.)
Advertisers: reach developers who block every other ad —
- 100% viewability — they're staring at the terminal waiting on the agent.
- Ad-blocker immune — uBlock and Pi-hole can't touch a status line.
- OSC-8 clickable — zero friction from terminal to browser.
- Priced on verified attention (CPVA) + clicks (CPC), with clawback + invalid-traffic detection so you only pay for real attention.
→ Join the waitlist (publisher or advertiser)
bin/lumaline.mjs CLI entry — install · uninstall · statusline · doctor · version
src/
statusline.mjs the per-tick trust loop (fetch → verify → dwell → report)
client/window.mjs pure window state machine (open → beat → close)
lib/crypto.mjs Ed25519 verify + HMAC (node: built-ins only)
install.mjs reversible, consent-only wiring of ~/.claude/settings.json
uninstall.mjs restores your prior statusLine from a sidecar/backup
config.mjs all paths + tunables (env-driven, cross-platform)
keys/public.pem the bundled Ed25519 PUBLIC verify key (no private key ever ships)
supabase/ live backend — Postgres + RLS + Edge Functions (lumaline-feed, click)
poc/ reference signed feed + demos (repo-only; never published to npm)
test/ node --test suite (34 tests)
docs/ design, feasibility, GTM
- Ad-surface feasibility — where an ad can live in Claude Code, and why
statusLineis the sanctioned one. - Verification & economics design — the proof-of-dwell protocol, the honest threat model, and CPVA/CPC pricing.
- Why this is honest — the one-page differentiator vs. invasive monetizers.
- Privacy Policy · Publisher Terms — what login collects (UUID-only token, salted IP hash, nothing else) and the earnings-accrual-vs-payout timing. (v1.0, in force.)
- Advertising Policy · Advertiser Terms — content standards, billing terms, clawback/refund policy, and the data-minimized impression model. (v1.0 draft — in effect upon owner sign-off.)
- ✅ Live now (public beta): the trust loop end-to-end against a hosted, signed feed — Ed25519
verify → server-verified dwell window (HMAC heartbeat chain + anti-batch) → recorded impression;
a reference signed backend; a revenue ledger with clearing/clawback/IVT scan; a 34-test suite.
The beta feed serves LumaLine's own self-promo line,
gross = 0, never billed. - 🟡 Built, gated on deploy (M1): device-code
lumaline login/logout/earnings— installs can now attribute impressions to a real publisher via a short-lived, revocable device token; earnings accrue (payouts still gated to the production go-live). Privacy Policy + Publisher Terms are approved and in force; live once the login backend is deployed (migration + theauth-devicefunction + Resend email for/activate). - 🚧 Before GA earnings: real advertiser billing (Stripe test-mode charge + ledger reconciliation), Stripe Connect payouts, a branded feed domain, and an npm registry publish (
0.1.0, superseding the0.0.1reservation stub). Ad Policy + Advertiser Terms are drafted (v1.0) and linked above. ⚠️ Clickable links are terminal-dependent (open upstream bug): the status-bar link is clickable in IDE terminals (VS Code/Cursor) but currently not in standalone terminal emulators (foot, kitty, Konsole, iTerm2, Alacritty) — an open Claude Code regression (#26356, since v2.1.3; the line's bytes are a correct OSC-8 link, but Claude Code mangles the passthrough to real terminals). Views/CPVA are unaffected and are the dependable model; clicks/CPC work in IDE terminals today and will work everywhere once the upstream bug is fixed.- Plain terminals: the destination is shown inline as a visible
https://…by default, so your terminal's own URL detection can open it — kittyctrl+click(orctrl+shift+e), footctrl+shift+u(url-mode) — or just copy/paste. Hide it withLUMALINE_SHOW_URL=0. - Re-test checklist (each Claude Code release): the last version with a working status-bar OSC-8
link was v2.1.2. After every upgrade, in a standalone terminal (foot/kitty):
lumaline install, trigger a wait-state, and click the sponsored line. If it opens the browser, #26356 is fixed → widen CPC scope to all terminals + note the fixed version here. If not, CPC stays IDE-terminals-only. Record the Claude Code version + pass/fail with each check.
- Plain terminals: the destination is shown inline as a visible
We'd rather under-promise here than oversell. Track progress / get launch access →
This is a trust product — adversarial eyes are the whole point. Read the code, open an issue, file a PR. If you can find a way the billing could be gamed or the install could surprise a user, that's exactly the bug report we want. If the idea resonates, star the repo.
MIT. See LICENSE.
LumaLine is an independent open-source project. It is not affiliated with, endorsed by, or sponsored by Anthropic. "Claude" and "Claude Code" are trademarks of Anthropic.