ericboehs

Claude Code Session Tools

Two shell scripts for inspecting active Claude Code sessions.

Installation

# Download both scripts
curl -sL https://gist.github.com/ericboehs/8586c0e7449015fb7a6ea374d4ae5018/raw/claude-active -o ~/.local/bin/claude-active
curl -sL https://gist.github.com/ericboehs/8586c0e7449015fb7a6ea374d4ae5018/raw/claude-tail -o ~/.local/bin/claude-tail

ericboehs

Shai-Hulud Detector - PowerShell Edition

A PowerShell-based security scanner that detects indicators of compromise (IOCs) from the Shai-Hulud npm supply chain attacks that occurred in September 2025 and November 2025. This tool specifically targets the "Shai-Hulud: The Second Coming" attack that used fake Bun runtime installations to harvest credentials.

📋 Table of Contents

• Overview
• Scripts
• Requirements
• Installation

ericboehs

#!/usr/bin/env bash
set -euo pipefail

VERSION="2.11.0"
SCRIPT_NAME="slack"

# XDG Base Directory support
CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/slack-cli"
CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/slack-cli"
TOKENS_FILE="$CONFIG_DIR/tokens.json"

ericboehs

#!/usr/bin/env bash
set -euo pipefail

VERSION="1.1.0"
SCRIPT_NAME="slack-status"

# XDG Base Directory support
CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/slack-status"
TOKENS_FILE="$CONFIG_DIR/tokens.json"
TOKENS_FILE_ENCRYPTED="$CONFIG_DIR/tokens.age"

ericboehs

#!/usr/bin/env node

const WebSocket = require('ws');
const http = require('http');

// Default ports to try for device discovery
const DEVICE_LIST_PORTS = [9221, 9100];

// Parse CLI arguments
const args = process.argv.slice(2);

ericboehs

#!/usr/bin/env bash
set -euo pipefail

# pbcopy-decrypt - Decrypt age-encrypted clipboard contents

usage() {
    cat >&2 <<EOF
Usage: pbcopy-decrypt [OPTIONS]

Decrypt age-encrypted clipboard contents using an SSH private key.

ericboehs

#!/bin/bash
#
# Shai-Hulud 2.0 Full Machine Scanner
# ====================================
#
# Scans your machine for signs of the Shai-Hulud npm supply chain attack
# (November 2025). This attack compromised 796+ npm packages affecting
# 20+ million weekly downloads.
#
# WHAT THIS SCRIPT DOES:

ericboehs

#! /usr/bin/env bash

set -e
set -u
set -o pipefail

export CACHE_FILE="${XDG_CACHE_HOME:-$HOME/.cache}/gh-pm-list.txt"
mkdir -p "$(dirname "$CACHE_FILE")"

# Only refresh if cache is older than 5 minutes, missing, or empty

ericboehs

#!/bin/bash
# claude-notify - Notification handler for Claude Code hooks

# Parse command line arguments
sender=""
while [[ $# -gt 0 ]]; do
    case $1 in
        --sender)
            sender="$2"
            shift 2

ericboehs

#!/usr/bin/env ruby
# frozen_string_literal: true

# Parser for GitHub CODEOWNERS files that supports pattern matching and owner lookup
class CodeownersParser
  def initialize(codeowners_file_path = '.github/CODEOWNERS')
    @codeowners_file_path = codeowners_file_path
    @rules = parse_codeowners_file
  end