Require CLAUDE_HUD_ALLOW_EXTRA_CMD before executing --extra-cmd, tighten cache file permissions, and document the local command trust boundary. Maintainer follow-up removed generated dist artifacts from the PR and added extra opt-in parsing coverage. Verified locally with npm ci, npm test, and node --test tests/extra-cmd.test.js. Fixes#618.
Narrow suspicious zero-frame fallback so cached context is only restored when current usage is empty, and align tests with the stale-cache and reset edge cases this protects.
Restore cached context when Claude reports used_percentage as 0 despite nonzero input/output totals, and add regression tests for the new suspicious-zero branches.
Use Claude Code compact_boundary transcript metadata to distinguish a real post-/compact zero frame from the suspicious-zero context glitch covered by the cache fallback. When compactMetadata.postTokens is available, synthesize the transition percent so the context bar drops immediately after compaction.
Security review found no new network, dependency, script, generated artifact, persistence, shell, env/token, path, link, or terminal escape risk. Added maintainer regression coverage for main() compact metadata wiring and repeated post-compact cache refresh.
Tested locally on the updated PR branch with npm test: 504 pass, 1 skipped. GitHub reported no checks for the fork branch.
Claude Code occasionally reports context window usage as 0 despite
accumulated tokens, causing the statusline to display incorrect data.
Cache the last known-good context snapshot per session and restore it
when a suspicious zero frame is detected, with TTL-throttled writes
and periodic stale-entry cleanup.
jorgelaranjo