Meanwhile — useful waits

Turns AI/agent wait time into useful, context-aware micro-content in your Claude Code status line. Editorial, not ads. Privacy-first, local-only.

Tools like kickbacks.ai and WaitingIsMoney fill the Claude Code spinner with a sponsored ad line and pay you a cut. Meanwhile fills the status line with something worth knowing — a tip, a TIL, a security gotcha, an ecosystem changelog — chosen to match the project you have open. The wait becomes useful, not an ad.

Why this surface

Claude Code exposes two hookable slots. The spinner (spinnerVerbs) is undocumented, flaky, and only fits short ad words — that's where the rev-share tools fight. The statusLine is officially documented, stable, supports color + clickable links, refreshes on a timer, and runs locally with zero API tokens. It's the right home for editorial content, and nobody in this niche uses it.

Composes, doesn't clobber

statusLine is single-occupancy, and many devs already run one (ccstatusline, custom scripts). On install Meanwhile captures any existing statusline command and re-pipes the same session JSON to it, printing its output above the Meanwhile line. Uninstall restores it exactly. Your context bar and the editorial line coexist.

Install

npm install
npm run build
node out/cli.js install      # composes with any existing status line; backs up settings

Reload Claude Code. Remove anytime with node out/cli.js uninstall.

Try it without installing

node out/cli.js preview 6    # sample lines chosen for the current directory

How it works

Claude Code → pipes session JSON to:  meanwhile render
  ├─ runs your wrapped statusline (if any), prints its output
  ├─ detects stack from the open project (ephemeral, local)
  ├─ picks a relevant, non-repeating content item
  └─ prints one line: dim badge + text + clickable OSC-8 link, sized to $COLUMNS
refreshInterval re-runs it every N seconds → content rotates

Privacy

Meanwhile reads a few manifest files (package.json, requirements.txt, go.mod, Cargo.toml, …) from your open project locally to infer the stack, holds it in memory, and never persists or transmits anything. The only state on disk is rotation bookkeeping in ~/.claude/meanwhile/. Zero network calls — seed content ships in the package.

Commands

| Command | What it does | |---|---| | meanwhile render | Status line entrypoint (reads session JSON on stdin) | | meanwhile preview [n] | Print n sample lines for the current dir | | meanwhile install | Install as status line, composing with any existing one | | meanwhile uninstall | Remove and restore the previous status line | | meanwhile status | Show current config |

Live feed

Beyond the generic seed, Meanwhile reads your project's actual dependencies and runtime versions (locally, ephemerally) and matches them against a bundled knowledge base to serve project-specific content the seed can't:

• Security — [email protected] has a known advisory (CVE-2021-23337). Fixed in 4.17.21. ↗
• Security — This project targets Node 18 (EOL April 2025) — no more security patches. ↗
• Changelog — You're on react@18; 19 is out — ref is a regular prop now. ↗
• Tip — Node 18+ ships global fetch — axios may be droppable. ↗
• Pattern — No lockfile committed — installs aren't reproducible. ↗

These are version-gated (only shown when your installed version is actually affected) and ranked above generic content. Your dependency list never leaves the machine — the knowledge base ships with the package; matching is local. The feed stays silent when it has nothing accurate to say.

Networked feed (opt-in)

Beyond local content, Meanwhile can show fresh, targeted content — news, sports scores — by topic and locale. This is off by default (the local-only default keeps the privacy wedge). Enable it explicitly:

meanwhile config remote on
meanwhile config topics cricket,football,tech
meanwhile config locale IN
meanwhile daemon            # background poll → local cache (run with & or via your supervisor)

Architecture (Method 2 — poll + cache, no push): a background daemon polls a feed endpoint on a timer and writes ~/.claude/meanwhile/cache.json; the status line only ever reads the cache, so it stays instant and does zero network itself. Today the feed is a built-in stub; set meanwhile config url <endpoint> to point at a real server (swaps the source, nothing else changes).

Privacy: when enabled, only topics + locale are sent to the feed — never your code, prompts, or project. Disable anytime with meanwhile config remote off.

Dependency advisory scanning (opt-in)

Meanwhile can flag known CVEs and EOL risk in the project you're in — ambient, zero-config, and private. It reads your lockfile-resolved versions (package-lock.json / yarn.lock / pnpm-lock.yaml) and matches them against an OSV-derived advisory index. Off by default:

meanwhile config kb on
meanwhile daemon --once      # download the slim advisory index into the local cache

How the privacy holds: the index is a slim, gzipped, public dataset built server-side and served whole; your machine downloads it and matches locally. Your dependency list never leaves the machine — the database comes to your deps, not the other way around. The client stays zero runtime dependencies (native zlib, no ZIP parsing). Advisories are version-gated on the installed version, so a patched install produces no false positive.

Agent install guard (opt-in)

Autonomous agents frequently reach for vulnerable or outdated dependency versions — research puts ~80% of AI-suggested dependencies at some risk, driven by training-data staleness. Meanwhile can vet what your agent installs before it happens, via a Claude Code PreToolUse hook that matches the install against the same local OSV index.

meanwhile config guard shadow   # observe: log risky installs, block nothing (default)
meanwhile config guard warn     # allow, but feed the agent the fixed version to use
meanwhile config guard block    # deny the install; the agent gets the reason and reroutes
meanwhile guard-log             # see what it flagged

Three modes, one idea — correct the agent, don't interrupt the human:

• shadow — pure measurement. See how often your agent tries to install something risky.
• warn — the install proceeds, but Meanwhile hands the agent an additionalContext note ("[email protected]: 6 advisories, upgrade to ≥4.17.21") so it self-corrects. No human interruption.
• block — denies the install; the reason is shown to the agent, which picks a safe version.

Matching is local (the OSV index you already downloaded) and version-gated, so a safe install passes silently. The hook is fail-open: any error falls through to allow — a guard bug can never break your agent's flow.

Roadmap

• [x] Live dependency/version/CVE feed (local knowledge-base matching).
• [x] Opt-in networked feed (news/scores) via background daemon + local cache.
• [ ] Real feed backend (replace stub) + sponsored-content slot with local impression tracking.
• [x] Grow KB coverage + opt-in updater — OSV-derived index, built server-side, matched locally (deps never uploaded).
• [ ] Codex / other-agent adapters (same statusline-style hook where available).
• [ ] "Learning streak" opt-in.
• [ ] Sponsored editorial (clearly labelled) → Pro tier → white-label SDK.