v0.9.5: status-line ribbon + Windows install-service fix

Status ribbon
- New `burnwall statusline`: renders the Burnwall ribbon for Claude Code's
  customizable status line from its per-turn stdin JSON, enriched with
  cross-tool spend and security-block counts from the proxy DB. One-line
  settings.json wiring; fail-open on bad input.
- Canonical ribbon renderer (src/ribbon.rs) with an honest context gauge:
  exact when the tool reports it, ~marked when estimated, — when untrusted,
  omitted when the tool shows its own. Reused by upcoming surfaces.
- Proxy touches <data dir>/watch.signal after each recorded turn (off the
  response path) — groundwork for event-driven refresh.

Fix
- Windows install-service no longer needs admin: default to a per-user
  HKCU\...\Run entry launching `burnwall start --daemon` at logon; `--task`
  opts into the elevated Scheduled-Task variant (crash-restart).
  uninstall-service removes whichever was installed.

Author: codehippie1

CHANGELOG.md

@@ -2,6 +2,39 @@
 
 All notable changes to Burnwall.
 
+## [0.9.5] — 2026-06-07
+
+### Added
+
+- **`burnwall statusline`** — renders the Burnwall ribbon for Claude Code's
+  customizable status line. Reads Claude Code's per-turn JSON on stdin and prints
+  one line: `🔥 sonnet-4.6 · ↑13k ↓615 · $0.05 msg $0.16 sess · $2.40 today · ctx
+  [▓▓░░░░░░] 22%`. Per-message cost is derived from the cumulative session total;
+  today's spend and security-block count are enriched from the proxy database, so
+  the line reflects spend **across all your tools**, not just the current one.
+  Wire it up with one line in `~/.claude/settings.json`:
+  `{ "statusLine": { "type": "command", "command": "burnwall statusline" } }`.
+  Fail-open: malformed input or an unreadable database still yields a best-effort
+  line rather than breaking the editor.
+- **Context gauge is honest by construction** — the ribbon shows a context-window
+  percentage only when it's *exact* (reported by the tool, e.g. Claude Code).
+  Where a value is estimated it's flagged with `~`; where the window can't be
+  trusted it renders `—`; where the tool already shows its own gauge it's omitted
+  rather than duplicated.
+- **Activity marker** — the proxy touches `<data dir>/watch.signal` after each
+  recorded turn (off the response path, so no added latency), laying the
+  groundwork for event-driven refresh of upcoming status surfaces.
+
+### Fixed
+
+- **`burnwall install-service` on Windows no longer needs admin.** It previously
+  created a Scheduled Task at the Task Scheduler library root, which requires
+  elevation and failed with "Access is denied" for a normal shell. The default is
+  now a per-user `HKCU\…\Run` registry entry that launches `burnwall start
+  --daemon` at logon — no UAC. `--task` opts back into the Scheduled-Task variant
+  (which adds crash-restart) for users who run an elevated terminal.
+  `uninstall-service` removes whichever was installed.
+
 ## [0.9.4] — 2026-06-07
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "burnwall"
-version = "0.9.4"
+version = "0.9.5"
 edition = "2024"
 rust-version = "1.87"
 description = "Local proxy for AI coding tools (Claude Code, Codex CLI, Aider): cache-aware cost tracking, path/command security checks, daily budget enforcement. Zero telemetry."

Cargo.toml

@@ -2,7 +2,7 @@
   "name": "burnwall",
   "displayName": "Burnwall",
   "description": "Cost + security for your AI coding agents, at a glance — reads your local Burnwall CLI.",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "publisher": "intbot",
   "license": "FSL-1.1-MIT",
   "repository": { "type": "git", "url": "https://github.com/intbot/burnwall" },

editor/vscode/package.json

@@ -6,7 +6,7 @@
     "url": "https://github.com/intbot/burnwall",
     "source": "github"
   },
-  "version": "0.9.4",
+  "version": "0.9.5",
   "packages": [
     {
       "registryType": "oci",

packaging/mcp/server.json

@@ -289,8 +289,11 @@ pub fn run_cmd(args: InitArgs) -> anyhow::Result<()> {
             let exe = std::env::current_exe().context("locating burnwall executable")?;
             // Call platform install path directly — same code the
             // install-service command runs.
-            super::service::install_cmd(super::service::InstallServiceArgs { no_start: false })
-                .with_context(|| format!("installing service for {}", exe.display()))?;
+            super::service::install_cmd(super::service::InstallServiceArgs {
+                no_start: false,
+                task: false,
+            })
+            .with_context(|| format!("installing service for {}", exe.display()))?;
         } else {
             writeln!(out, "   {action_label}: register login-time service")?;
         }

src/cli/init.rs

@@ -33,6 +33,7 @@ pub mod self_rollback;
 pub mod service;
 pub mod start;
 pub mod status;
+pub mod statusline;
 pub mod stop;
 #[cfg(feature = "waste")]
 pub mod waste;
@@ -103,6 +104,8 @@ pub enum Command {
     SelfRollback(self_rollback::SelfRollbackArgs),
     /// Inspect and manage the pricing rate card (local + signed remote cards).
     Pricing(pricing::PricingArgs),
+    /// Render the Burnwall ribbon for Claude Code's status line (reads stdin JSON).
+    Statusline(statusline::StatuslineArgs),
 }
 
 impl Cli {
@@ -141,6 +144,7 @@ impl Cli {
             Command::UninstallService(args) => service::uninstall_cmd(args),
             Command::SelfRollback(args) => self_rollback::run_cmd(args),
             Command::Pricing(args) => pricing::run_cmd(args),
+            Command::Statusline(args) => statusline::run_cmd(args),
         }
     }
 }

src/cli/mod.rs

@@ -11,15 +11,20 @@
 //!   `~/.config/systemd/user/burnwall.service`. `Restart=on-failure` with
 //!   `StartLimitBurst=5` + `StartLimitIntervalSec=60` is the same crash-loop
 //!   circuit breaker shape.
-//! - **Windows** — a per-user Scheduled Task triggered at logon, registered
-//!   via `schtasks.exe`. Task Scheduler restarts on failure (5 attempts at
-//!   1-min intervals) — same shape, different incantation.
+//! - **Windows** — by default, a per-user `HKCU\…\CurrentVersion\Run` registry
+//!   entry that launches `burnwall start --daemon` at logon. This needs **no
+//!   admin / UAC** (the earlier Scheduled-Task default failed with "Access is
+//!   denied" because creating a task at the library root requires elevation).
+//!   `--task` opts into the Scheduled-Task variant instead — it adds
+//!   crash-restart (5 attempts at 1-min intervals) but must be run from an
+//!   elevated terminal.
 //!
-//! ## No admin required
+//! ## No admin required (by default)
 //!
-//! All three install user-scoped services that need no admin / sudo / UAC.
-//! Per-user is the right scope because the proxy serves one user's traffic
-//! through env vars in their shell.
+//! Every default path installs a user-scoped service that needs no admin /
+//! sudo / UAC. Per-user is the right scope because the proxy serves one user's
+//! traffic through env vars in their shell. (Windows `--task` is the one opt-in
+//! that needs elevation, in exchange for crash-restart.)
 
 use std::path::PathBuf;
 
@@ -36,14 +41,19 @@ pub struct InstallServiceArgs {
     /// Skip the start step (just register the service, don't launch it).
     #[arg(long)]
     pub no_start: bool,
+    /// Windows only: register a Scheduled Task (adds crash-restart) instead of
+    /// the default per-user Run-key entry. Must be run from an elevated
+    /// terminal. Ignored on macOS/Linux.
+    #[arg(long)]
+    pub task: bool,
 }
 
 #[derive(Args, Debug)]
 pub struct UninstallServiceArgs {}
 
 pub fn install_cmd(args: InstallServiceArgs) -> Result<()> {
     let exe = std::env::current_exe().context("locating burnwall executable")?;
-    install(&exe, !args.no_start)
+    install(&exe, !args.no_start, args.task)
 }
 
 pub fn uninstall_cmd(_args: UninstallServiceArgs) -> Result<()> {
@@ -93,7 +103,7 @@ fn plist_contents(exe: &std::path::Path) -> String {
 }
 
 #[cfg(target_os = "macos")]
-fn install(exe: &std::path::Path, start: bool) -> Result<()> {
+fn install(exe: &std::path::Path, start: bool, _task: bool) -> Result<()> {
     let path = plist_path()?;
     if let Some(parent) = path.parent() {
         std::fs::create_dir_all(parent)
@@ -170,7 +180,7 @@ WantedBy=default.target
 }
 
 #[cfg(target_os = "linux")]
-fn install(exe: &std::path::Path, start: bool) -> Result<()> {
+fn install(exe: &std::path::Path, start: bool, _task: bool) -> Result<()> {
     let path = unit_path()?;
     if let Some(parent) = path.parent() {
         std::fs::create_dir_all(parent)
@@ -292,8 +302,56 @@ fn task_xml(exe: &std::path::Path) -> String {
     )
 }
 
+/// HKCU autostart key — writable by a standard user, no admin needed.
+#[cfg(target_os = "windows")]
+const RUN_KEY: &str = r"HKCU\Software\Microsoft\Windows\CurrentVersion\Run";
+
+#[cfg(target_os = "windows")]
+fn install(exe: &std::path::Path, start: bool, use_task: bool) -> Result<()> {
+    if use_task {
+        install_scheduled_task(exe, start)
+    } else {
+        install_run_key(exe, start)
+    }
+}
+
+/// Default Windows autostart: a per-user `HKCU\…\Run` value that launches
+/// `burnwall start --daemon` at logon. No admin required. Written via `reg.exe`
+/// so we don't pull in a registry crate.
+#[cfg(target_os = "windows")]
+fn install_run_key(exe: &std::path::Path, start: bool) -> Result<()> {
+    // The exe path is quoted so a profile path with spaces still parses at logon.
+    let command = format!("\"{}\" start --daemon", exe.display());
+    let status = std::process::Command::new("reg")
+        .args([
+            "add", RUN_KEY, "/v", TASK_NAME, "/t", "REG_SZ", "/d", &command, "/f",
+        ])
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .context("running reg add")?;
+    if !status.success() {
+        anyhow::bail!(
+            "reg add failed (status {status}). You can still run `burnwall start --daemon` \
+             manually, or try `burnwall install-service --task` from an elevated terminal."
+        );
+    }
+    println!("🛡  Registered login auto-start (HKCU Run): {TASK_NAME}");
+    println!("   Launches `burnwall start --daemon` at logon — no admin required.");
+    if start {
+        start_daemon_now(exe);
+    } else {
+        println!("   (not started — will start at next logon)");
+    }
+    println!("   Tip: `--task` installs a Scheduled Task with crash-restart (needs an elevated terminal).");
+    Ok(())
+}
+
+/// Opt-in Windows autostart: a per-user Scheduled Task at logon. Adds
+/// crash-restart, but creating the task at the library root requires
+/// elevation — so this must be run from an Administrator terminal.
 #[cfg(target_os = "windows")]
-fn install(exe: &std::path::Path, start: bool) -> Result<()> {
+fn install_scheduled_task(exe: &std::path::Path, start: bool) -> Result<()> {
     let xml_path = task_xml_path()?;
     if let Some(parent) = xml_path.parent() {
         std::fs::create_dir_all(parent)
@@ -320,15 +378,23 @@ fn install(exe: &std::path::Path, start: bool) -> Result<()> {
             "/XML",
             xml_path.to_str().unwrap_or(""),
         ])
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
         .status()
         .context("running schtasks /Create")?;
     if !status.success() {
-        anyhow::bail!("schtasks /Create failed (status {})", status);
+        anyhow::bail!(
+            "schtasks /Create failed (status {status}) — this usually means it wasn't run \
+             elevated. Run from an Administrator terminal, or drop `--task` to use the \
+             no-admin Run-key install instead."
+        );
     }
     println!("🛡  Installed Scheduled Task: \\{TASK_NAME}");
     if start {
         let s = std::process::Command::new("schtasks.exe")
             .args(["/Run", "/TN", TASK_NAME])
+            .stdout(std::process::Stdio::null())
+            .stderr(std::process::Stdio::null())
             .status()
             .context("running schtasks /Run")?;
         if !s.success() {
@@ -344,17 +410,48 @@ fn install(exe: &std::path::Path, start: bool) -> Result<()> {
 }
 
 #[cfg(target_os = "windows")]
-fn uninstall() -> Result<()> {
-    let status = std::process::Command::new("schtasks.exe")
-        .args(["/Delete", "/F", "/TN", TASK_NAME])
+fn start_daemon_now(exe: &std::path::Path) {
+    match std::process::Command::new(exe)
+        .args(["start", "--daemon"])
         .status()
-        .context("running schtasks /Delete")?;
-    if status.success() {
+    {
+        Ok(s) if s.success() => println!("   Started."),
+        _ => println!("   (could not start now — will start at next logon)"),
+    }
+}
+
+#[cfg(target_os = "windows")]
+fn uninstall() -> Result<()> {
+    let mut removed = false;
+    // Default install: the HKCU Run-key value. Probes are best-effort — silence
+    // child stdout/stderr so a missing entry doesn't print a scary "ERROR".
+    if matches!(
+        std::process::Command::new("reg")
+            .args(["delete", RUN_KEY, "/v", TASK_NAME, "/f"])
+            .stdout(std::process::Stdio::null())
+            .stderr(std::process::Stdio::null())
+            .status(),
+        Ok(s) if s.success()
+    ) {
+        println!("🛡  Removed login auto-start (HKCU Run): {TASK_NAME}");
+        removed = true;
+    }
+    // Opt-in install: the Scheduled Task.
+    if matches!(
+        std::process::Command::new("schtasks.exe")
+            .args(["/Delete", "/F", "/TN", TASK_NAME])
+            .stdout(std::process::Stdio::null())
+            .stderr(std::process::Stdio::null())
+            .status(),
+        Ok(s) if s.success()
+    ) {
         println!("🛡  Removed Scheduled Task: \\{TASK_NAME}");
-    } else {
-        println!("🛡  No Scheduled Task to remove (or removal failed).");
+        removed = true;
+    }
+    if !removed {
+        println!("🛡  No Burnwall login service found to remove.");
     }
-    // Best-effort cleanup of the staged XML.
+    // Best-effort cleanup of any staged task XML.
     if let Ok(xml_path) = task_xml_path() {
         let _ = std::fs::remove_file(&xml_path);
     }
@@ -364,7 +461,7 @@ fn uninstall() -> Result<()> {
 // ─────────────────────────── unsupported ───────────────────────────
 
 #[cfg(not(any(target_os = "macos", target_os = "linux", target_os = "windows")))]
-fn install(_exe: &std::path::Path, _start: bool) -> Result<()> {
+fn install(_exe: &std::path::Path, _start: bool, _task: bool) -> Result<()> {
     anyhow::bail!("install-service is not supported on this OS");
 }