glassbox-trace 0.10.1 → 0.11.0

package/README.md

@@ -40,6 +40,9 @@ glassbox watch                        live tail: the viewer follows the newest s
 glassbox collect ./reports --format md --out fleet.md
                                       one report from a folder of redacted check reports, one per machine
 glassbox claims 81c4 --format md      said vs did: every claim the agent made about its own work, with the tool result behind it — or the gap
+glassbox recall login redirect        what past sessions of this project asked, wrote, ran, committed and said about it
+glassbox memory                       what the next session here will be told (hook --context), and the lessons behind it
+glassbox memory audit                 everything loaded before the first prompt, its token cost, and what is dead or doubled
 glassbox clean                        remove the temp files `open` and the hook leave behind
 ```
 
@@ -55,7 +58,7 @@ The npm package is `glassbox-trace` (plain `glassbox` was already taken); the co
 
 **Let the agent read its own recorder.** `glassbox hook install` adds a Claude Code Stop hook (the command it writes is `npx -y glassbox-trace hook …`, which resolves the package on each run; pass `--command glassbox` after `npm i -g glassbox-trace@<version>` to pin it, or use the plugin below, which runs its bundled copy): every session ends with a one-screen Glassbox summary (turns, tool calls, context peak, cost, top findings). Add `--feedback` and the findings — with their evidence and the "next time" advice — are handed back to the agent; it reads them and says, in a sentence, what it would do differently. Each finding is handed back once per session, it never loops (`stop_hook_active` is respected), never blocks a clean session, and `glassbox hook uninstall` removes it, with a `.glassbox-backup` of `settings.json` kept.
 
-Feedback at the end of a session can only change that session's last reply. Add `--context` to carry it forward: the Stop hook keeps the findings (and, with `--feedback`, the agent's answer) in `<project>/.glassbox/last-session.md` — git-ignored, deleted after a clean session — and a SessionStart hook gives them to the next session in that project.
+Feedback at the end of a session can only change that session's last reply. Add `--context` to carry it forward: the Stop hook keeps a memory of the project in `<project>/.glassbox/` — git-ignored, owner-only, secrets masked — and a SessionStart hook gives the next session there the lessons that keep coming back, a line for each recent session, and what the agent said it would do differently. See [Memory across sessions](#memory-across-sessions--glassbox-recall-and-glassbox-memory) below.
 
 **Stop a loop before it happens.** `--guard` adds a PreToolUse hook: when the agent is about to repeat a call that has already failed twice in a row, unchanged, in the current turn, it blocks the call and tells the agent why, with the last error, and to change something or ask you rather than try again. It is deliberately narrow. Anything that could change the outcome in between — an edit, another command, a success, a new prompt — resets it, so re-running the tests after a fix is never blocked; calls a person stopped don't count; it never approves anything, so your permission prompts are untouched. Replayed over 4,121 real tool calls it blocked none, so it stays out of the way until an agent is actually stuck. It runs before every tool call, so it needs an installed copy: `--guard` writes a direct `node "…/bin/glassbox.mjs" hook …` command (for the Stop hook too) and refuses to install from an `npx` cache, where each call would cost seconds. The plugin doesn't include the guard ([why](docs/PLUGIN.md#the-loop-guard-is-not-in-the-plugin)); if both are installed, the plugin sees the CLI hook and steps aside.
 
@@ -164,6 +167,36 @@ Glassbox claims · 38f81247
 
 Six kinds of claim (tests pass, shipped, verified, fixed, nothing changed, file written), judged on the same agent's tool calls in that turn: a test claim needs a test run after the last edit — from `Bash`, `PowerShell` or Cowork's `device_bash` — with its counts read and compared; a shipped claim needs the commit, push, publish or upload result, carrying the sha or version the sentence names; "nothing changed" needs a `git status` after the thing that could have changed it. An agent that says "not verified" gets a *declared* row and no finding. The same ledger runs inside `check` as three rules — `contradicted-claim` (error), `unverified-claim` (warn), `stale-claim` (info) — so the Stop hook hands the sentence back to the agent that wrote it. On sixteen real sessions (367 claims; three of them checked by hand first) the ledger found one unverified sentence — "the tests still pass", 24 minutes after the last run — five fixes never re-run after their edit, and no contradictions. A verdict is about the sentence, never the code. Details in [docs/CLAIMS.md](docs/CLAIMS.md).
 
+### Memory across sessions — `glassbox recall` and `glassbox memory`
+
+A Claude Code session starts knowing nothing about the last one, and Claude Code deletes transcripts after 30 days by default. With `--context` (or the plugin's `context` option), the Stop hook keeps `<project>/.glassbox/memory.json`: a digest of each of the project's last 50 sessions — what was asked, the files written, the checks and pushes that ran and how they ended, the commits with their shas, the agent's last words, the findings — and **lessons**: findings counted across sessions by what they are about (`retry-loop · Bash npm test`, `failed-tool · Edit`, `unverified-claim · test`). The next session starts with this note (≤ 8,000 characters, under Claude Code's 10,000 cap):
+
+```
+## Recurring in this project (worst first)
+
+- retry-loop · Bash npm test — in 3 of the last 12 sessions, last 2026-10-09: Bash called 3× with identical input, e.g. `npm test -- auth`. Next time: When a call fails, change something before calling again: …
+
+## Recent sessions (newest first)
+
+- 2026-10-09 14:02 · a1b2c3d4 · "fix the login redirect" — wrote src/auth.js, test/auth.test.js · ran npm test (passed, last of 3) · committed 1a2b3c4 "fix: login redirect loop" · pushed
+```
+
+A lesson is handed on until ten sessions in a row go by without it, then it retires (and comes back if it fires again). Each session that started with a lesson is counted, so `glassbox memory` can say what nobody could before: *told in 9 sessions, came back in 1*. Everything is copied or counted from the transcripts — no model call, no tokens — and whatever a `fence` detector recognises as a secret is masked before it is written.
+
+```
+glassbox recall login redirect        sessions of this project that mention it, best match first: asked / said / wrote / ran / commit
+glassbox recall "dark mode" --since 30d --format md      a quoted phrase is one term; --format md for pasting to an agent
+glassbox recall                       no words: the latest sessions, one line each
+glassbox memory                       what the next session will be told, and every lesson: sessions, told, came back, quiet
+glassbox memory forget retry-loop     drop a lesson (by rule or key); it starts over if it fires again
+glassbox memory clear                 delete the project's memory
+glassbox memory audit                 everything loaded before the first prompt, and what it costs
+```
+
+`recall` works without the hook: it reads the project's transcripts still on disk, and the ledger supplies the sessions whose transcripts are gone. Every word must match; a word that isn't in a transcript's raw text skips parsing it. The plugin's skill tells Claude to run it before re-investigating something a past session may already have settled.
+
+**`glassbox memory audit`** lists what Claude Code loads into every session before the first prompt — managed, user, parent-directory and project `CLAUDE.md` files, `CLAUDE.local.md`, unscoped `.claude/rules/`, `@imports` (four hops, relative to the importing file), the first 200 lines or 25 KB of the auto-memory `MEMORY.md`, and Glassbox's own note — with an estimated token cost (characters ÷ 4, HTML comments stripped as Claude Code strips them), then flags what a mechanical reader can: imports that load nothing, backticked paths and `npm run` scripts that don't exist, the same line in two places, rules that pull opposite ways (`use pnpm` here, `use npm, not pnpm` there — the same parser as `adhere`), files over the 200 lines Claude Code's docs recommend, and `MEMORY.md` lines past the cut-off that never load. `--fail-on warn` for CI. Details in [docs/MEMORY.md](docs/MEMORY.md).
+
 ## What it flags
 
 | rule | fires when |
@@ -247,7 +280,7 @@ console.log(compare({ trace, findings, cost }, other));      // other = the same
 Your context is private — by construction, not by promise.
 
 - **Nothing leaves.** The viewer makes no network requests at all — fonts, scripts and the demo are inside the one file, and the test suite fails if a build references anything outside it. The CLI sends nothing anywhere. `glassbox watch` binds to `127.0.0.1` only and stops with the command. The one network activity is installation: `npx` fetching the package, or the plugin marketplace fetching this repo.
-- **What it touches.** It reads `~/.claude/projects/**` and writes only what you ask for: `open` writes a self-contained HTML to your temp folder (transcript included — delete it when done, or use `--out`), `hook install` edits `~/.claude/settings.json` with a backup beside it, `--context` writes `<project>/.glassbox/last-session.md`, `--legend` writes the legend. The full inventory — files, processes, hooks, network, uninstall — is in [docs/IT.md](docs/IT.md), written for whoever has to approve it.
+- **What it touches.** It reads `~/.claude/projects/**` and writes only what you ask for: `open` writes a self-contained HTML to your temp folder (transcript included — delete it when done, or use `--out`), `hook install` edits `~/.claude/settings.json` with a backup beside it, `--context` writes `<project>/.glassbox/last-session.md` and `memory.json` (owner-only, git-ignored, secrets masked; they quote prompts and commands), `--legend` writes the legend. The full inventory — files, processes, hooks, network, uninstall — is in [docs/IT.md](docs/IT.md), written for whoever has to approve it.
 - **Counts, not text.** Transcripts contain everything the agent saw; that's why share mode and `--redact` exist. Redacted output keeps tool names, numbers, timings and cost and drops every string — prompts, commands, results, titles. Where a finding would quote something it says `«240 chars»`.
 - **What is already on disk.** `glassbox fence` finds credentials that reached a transcript (known key formats, secrets named by context, credential-file reads), reports them masked and fingerprinted, and `--shred` overwrites them in place. See above.
 - **The shape, not the names.** A redacted report still needs to say "this one file was read 48 times and 6 of those failed". `check --redact --legend audit.legend.json` replaces every path with a keyed hash (`file:b94b1a35`, HMAC-SHA256 with a random salt) and writes the key → path map to the legend file, which stays on your machine. The redacted JSON carries `summary.files` (reads, writes, failures, agents, chars per key) and `evidence.files` on findings; `duplicate-subagent-read` keeps its sentence with the key in it. `glassbox reveal report.md --legend audit.legend.json` turns the keys back into paths for you. Re-using the legend keeps keys stable across runs; two machines with two legends produce different keys for the same file. Treat the legend like a password file: local, git-ignored, never attached to the same email as the report. Design notes in DESIGN.md §12.

package/dist/glassbox.html

@@ -408,7 +408,7 @@ kbd{font:11px var(--mono);border:1px solid var(--line);border-bottom-width:2px;b
 })(typeof globalThis !== 'undefined' ? globalThis : this, function () {
   'use strict';
 
-  const VERSION = '0.10.1';
+  const VERSION = '0.11.0';
 
   // ---------------------------------------------------------------------------
   // Rate card (USD per million tokens). Prefix-matched against model ids so dated

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "glassbox-trace",
-  "version": "0.10.1",
-  "description": "Other tools show what happened in a Claude Code session; Glassbox tells you what went wrong. Timeline, token and cost burn, auto-diagnostics with evidence and advice, session compare, live tail, a fleet view, a secrets scanner for transcripts (fence), a CLAUDE.md compliance report (adhere), a CLI and a Claude Code Stop hook that feeds the findings back to the agent.",
+  "version": "0.11.0",
+  "description": "Other tools show what happened in a Claude Code session; Glassbox tells you what went wrong. Timeline, token and cost burn, auto-diagnostics with evidence and advice, session compare, live tail, a fleet view, a secrets scanner for transcripts (fence), a CLAUDE.md compliance report (adhere), a memory the next session starts with plus a search over past sessions (recall) and an audit of what loads before the first prompt, a CLI and a Claude Code Stop hook that feeds the findings back to the agent.",
   "main": "src/trace-core.js",
   "scripts": {
     "test": "node --test test/*.test.mjs",
@@ -34,6 +34,8 @@
     "secret-scanning",
     "claude-md",
     "adherence",
+    "memory",
+    "recall",
     "compare",
     "live-tail",
     "claude",

package/src/adhere.mjs

@@ -94,6 +94,17 @@ export function parseRules(text, file) {
   return { rules, unchecked };
 }
 
+// Sessions of a project, newest first: the folder name Claude Code would use (every character that is not a letter
+// or a digit becomes '-', so "my.app_v2" is "my-app-v2"; older builds only replaced separators). Failing that, a
+// folder whose name ends with it — the same project reached through a symlinked parent (/tmp → /private/tmp). Never a
+// substring: /home/aldo/app is not /home/aldo/app-v2, and a folder name can't tell app/v2 from app-v2.
+export function projectSessions(project, home) {
+  const enc = [encodeProject(project), String(project).replace(/[^A-Za-z0-9]/g, '-')].map((e) => e.toLowerCase());
+  const all = findSessions({ home }), name = (s) => path.basename(s.projectDir).toLowerCase();
+  const list = all.filter((s) => enc.includes(name(s)));
+  return list.length ? list : all.filter((s) => enc.some((e) => name(s).endsWith(e)));
+}
+
 export function findInstructionFiles(project, home) {
   const out = [];
   const add = (p, label) => { if (fs.existsSync(p) && fs.statSync(p).isFile()) out.push({ file: p, label }); };
@@ -145,7 +156,7 @@ function segmentTools(cmd) {
   return segments(cmd).map((seg) => { const toks = seg.split(/\s+/); let t = toks[0].replace(/^.*[\\/]/, '').toLowerCase(); if (/^python3?$/.test(t) && toks[1] === '-m' && toks[2]) t = toks[2].toLowerCase(); if (t === 'pip3') t = 'pip'; return t; });
 }
 const hasSeg = (cmd, re) => segments(cmd).some((seg) => re.test(seg));
-function commitMessage(cmd) {
+export function commitMessage(cmd) {
   cmd = String(cmd);
   const hd = cmd.match(/<<-?\s*['"]?(\w+)['"]?\n([\s\S]*?)\n\1/); if (hd) return hd[2].split('\n')[0].trim();
   const q = cmd.match(/(?:^|\s)(?:-m|--message)(?:=|\s+)(?:"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'|(\S+))/); if (q) return (q[1] != null ? q[1] : q[2] != null ? q[2] : q[3]).split('\n')[0].trim();
@@ -165,7 +176,7 @@ const pathHits = (rulePath, filePath, project) => {
 const OPTV = String.raw`(?:"[^"]*"|'[^']*'|\S)+`;
 const GIT = String.raw`^git\s+(?:(?:-c\s+${OPTV}|-C\s+${OPTV}|--no-pager|--git-dir=${OPTV}|--work-tree=${OPTV})\s+)*`;
 const git = (sub) => new RegExp(GIT + sub + '\\b');
-const actionRe = { commit: git('commit'), push: git('push'), delete: new RegExp('^(?:rm|rmdir|del|Remove-Item)\\b|' + GIT + 'rm\\b'), install: /^(?:npm|pnpm|yarn|bun|pip3?|uv|poetry|cargo|gem|brew|apt(?:-get)?|choco|winget)\s+(?:install|add|i)\b/, deploy: /^(?:vercel|netlify|fly\s+deploy|wrangler\s+(?:publish|deploy)|gcloud\s+run\s+deploy|serverless\s+deploy|eb\s+deploy)\b|^\S+\s+deploy\b/i, merge: git('merge') };
+export const actionRe = { commit: git('commit'), push: git('push'), delete: new RegExp('^(?:rm|rmdir|del|Remove-Item)\\b|' + GIT + 'rm\\b'), install: /^(?:npm|pnpm|yarn|bun|pip3?|uv|poetry|cargo|gem|brew|apt(?:-get)?|choco|winget)\s+(?:install|add|i)\b/, deploy: /^(?:vercel|netlify|fly\s+deploy|wrangler\s+(?:publish|deploy)|gcloud\s+run\s+deploy|serverless\s+deploy|eb\s+deploy)\b|^\S+\s+deploy\b/i, merge: git('merge') };
 const askedRe = { commit: /\bcommit/i, push: /\bpush/i, delete: /\b(?:delete|remove|rm\b|clean up|get rid)/i, install: /\binstall|\badd (?:the )?(?:package|dependency|dep)/i, create: /\b(?:create|make|add|write|new)\b/i, deploy: /\bdeploy|ship|release/i, merge: /\bmerge/i };
 
 // Judge every rule against one session. Returns per-rule { occasions:[{obeyed, session, turn, prompt, detail, at}] }.
@@ -230,10 +241,7 @@ export function adhere(opts = {}) {
   if (!files.length) throw new Error(`adhere: no CLAUDE.md found for ${project}\n  Looked for CLAUDE.md, .claude/CLAUDE.md, CLAUDE.local.md there and ~/.claude/CLAUDE.md.\n  Point at one with --claude-md FILE, or at the project with --project DIR.`);
   const rules = [], unchecked = [], fileRows = [];
   for (const f of files) { if (!fs.existsSync(f.file)) throw new Error(`adhere: ${f.file} not found`); const r = parseRules(readTextFile(f.file), f.label); rules.push(...r.rules); unchecked.push(...r.unchecked); fileRows.push({ file: f.file, label: f.label, rules: r.rules.length, unchecked: r.unchecked.length }); }
-  // Sessions of this project: the folder name Claude Code would use; else a decoded-path substring match.
-  const enc = encodeProject(project).toLowerCase();
-  let list = findSessions({ home }).filter((s) => path.basename(s.projectDir).toLowerCase() === enc);
-  if (!list.length) list = findSessions({ home, project: project.replace(/\\/g, '/') });
+  let list = projectSessions(project, home);
   if (opts.since != null) list = list.filter((s) => s.mtime >= opts.since);
   const perRule = rules.map(() => []); const sessions = [];
   for (const s of list) { const j = judgeSession(rules, s, project); j.perRule.forEach((o, i) => perRule[i].push(...o)); sessions.push(j.session); }

package/src/claims.mjs

@@ -89,14 +89,14 @@ const numbersIn = (s) => Array.from(new Set((s.match(NUM_RE) || []).map((n) => n
 const SHELL = (c) => c.name === 'Bash' || c.name === 'PowerShell' || /device_bash$/.test(c.name || '');
 const cmdOf = (c) => { const i = c.input || {}; return typeof i.command === 'string' ? i.command : typeof i.script === 'string' ? i.script : ''; };
 const inputText = (c) => { try { return JSON.stringify(c.input || {}); } catch (e) { return ''; } };
-const TEST_CMD = /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|check|e2e|audit|lint|build|typecheck)\b|\bnode\s+--test\b|\bnode\s+(?:[\w./-]*\/)?test\/[\w.-]+\.m?js\b|\bpytest\b|\bpython3?\s+-m\s+(?:pytest|unittest)\b|\bcargo\s+test\b|\bgo\s+test\b|\bvitest\b|\bjest\b|\bmocha\b|\bplaywright\s+test\b|\btsc\b|\beslint\b|\bruff\b|\bmake\s+(?:test|check)\b|\bclaude\s+plugin\s+validate\b|\bdotnet\s+test\b|\bphpunit\b|\brspec\b|\bphp\s+-l\b|\bnode\s+(?:--check|-c)\b|\bpython3?\s+-m\s+py_compile\b|\bflake8\b|\bpylint\b|\bmypy\b|\bshellcheck\b|\bprettier\s+--check\b|\bbiome\s+(?:check|lint)\b|\bpython3?\s+(?:[\w./-]*\/)?(?:test_[\w-]+|[\w-]+_test|tests?)\.py\b|\bnode\s+(?:[\w./-]*\/)?[\w-]*test[\w-]*\.[cm]?js\b/i;
+export const TEST_CMD = /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|check|e2e|audit|lint|build|typecheck)\b|\bnode\s+--test\b|\bnode\s+(?:[\w./-]*\/)?test\/[\w.-]+\.m?js\b|\bpytest\b|\bpython3?\s+-m\s+(?:pytest|unittest)\b|\bcargo\s+test\b|\bgo\s+test\b|\bvitest\b|\bjest\b|\bmocha\b|\bplaywright\s+test\b|\btsc\b|\beslint\b|\bruff\b|\bmake\s+(?:test|check)\b|\bclaude\s+plugin\s+validate\b|\bdotnet\s+test\b|\bphpunit\b|\brspec\b|\bphp\s+-l\b|\bnode\s+(?:--check|-c)\b|\bpython3?\s+-m\s+py_compile\b|\bflake8\b|\bpylint\b|\bmypy\b|\bshellcheck\b|\bprettier\s+--check\b|\bbiome\s+(?:check|lint)\b|\bpython3?\s+(?:[\w./-]*\/)?(?:test_[\w-]+|[\w-]+_test|tests?)\.py\b|\bnode\s+(?:[\w./-]*\/)?[\w-]*test[\w-]*\.[cm]?js\b/i;
 const CI_RESULT = /completed[:\s]+success|conclusion["']?\s*[:=]\s*["']?success|completed\s+successfully|\bci\s+#?\d+[^.\n]{0,40}\b(?:green|success)|"status":\s*"completed"[^}]{0,80}"conclusion":\s*"success"|publish\s+run[^\n]{0,40}success/i;
 const CI_FAIL = /conclusion["']?\s*[:=]\s*["']?(?:failure|cancelled)|completed[:\s]+failure|\bfailed\b[^\n]{0,20}\bci\b/i;
 const FAIL_MARK = /\bnot ok\b|# fail [1-9]|\b[1-9]\d* fail(?:ed|ing|ures?)?\b|\bFAIL(?:ED)?\b|AssertionError|Error:|\bTypeError|\bReferenceError|\bSyntaxError|Tests:\s+\d+\s+failed|✗|✖|\bexit(?:ed|\s*code)?\s*[=:]?\s*[1-9]\d*\b|Cannot find module|MODULE_NOT_FOUND/;
 // A test-like run's identity: the runner and file it names, so a failing e2e run does not contradict "58 of 58 pass"
 // said about the unit run beside it.
 const testKey = (c) => { const m = cmdOf(c).match(TEST_CMD); return m ? m[0].toLowerCase().replace(/\s+/g, ' ') : (c.name + ':' + (c.resultText || '').slice(0, 40)); };
-function runFailed(c) {
+export function runFailed(c) {
   const r = c.resultText || ''; const k = testCounts(r);
   return !!(c.isError || (k ? k.fail > 0 : FAIL_MARK.test(r)) || (CI_FAIL.test(r) && !CI_RESULT.test(r)));
 }
@@ -114,7 +114,7 @@ const SOURCE_FILE = /(?:^|[\\/])(?:src|lib|test|tests|spec|specs|app|pkg|cmd|int
 
 // A result that reads like a test run whatever the command was: a summary line, PASS/FAIL rows, a lint's verdict.
 const looksLikeRun = (r) => { r = String(r || ''); return !!testCounts(r) || /audit passed|browser test passed|Validation passed|No syntax errors detected|^\s*(?:PASS|FAIL)\b.*\n\s*(?:PASS|FAIL)\b/m.test(r); };
-function testCounts(text) {
+export function testCounts(text) {
   const t = String(text || '');
   let m;
   if ((m = t.match(/# pass (\d+)[\s\S]*?# fail (\d+)/))) return { pass: +m[1], fail: +m[2], total: +m[1] + +m[2] };

package/src/cli.mjs

@@ -9,6 +9,8 @@ import { fileURLToPath } from 'node:url';
 import { readTextFile } from './textfile.mjs';
 import { guardResponse } from './guard.mjs';
 import { judgeClaims, claimFindings, claimsText, claimsMarkdown } from './claims.mjs';
+import { NOTES_FILE, ensureMemoryDir, recordSession, memoryNote, noteTold, maskedTrace, recall, recallText, recallMarkdown, memoryReport, memoryText, memoryMarkdown, forget, clearMemory } from './memory.mjs';
+import { maskSecrets } from './fence.mjs';
 const require = createRequire(import.meta.url);
 const core = require('./trace-core.js');
 // fileURLToPath, not URL.pathname: on Windows the latter gives "/C:/…" which path.resolve turns into "\C:\…".
@@ -228,23 +230,29 @@ export function sessionFromTranscriptPath(p) {
   return { id: path.basename(file).replace(/\.jsonl$/, ''), file, project: null, projectDir: path.dirname(file), size: fs.existsSync(file) ? fs.statSync(file).size : 0, mtime: fs.existsSync(file) ? fs.statSync(file).mtimeMs : 0 };
 }
 
-// Persisted feedback (--context): the Stop hook leaves <project>/.glassbox/last-session.md behind and
-// the SessionStart hook hands it to the next session, so feedback reaches the session that can use it.
-export const NOTES_FILE = path.join('.glassbox', 'last-session.md');
+// Persisted feedback (--context): the Stop hook leaves <project>/.glassbox/last-session.md behind and folds the
+// session into <project>/.glassbox/memory.json (src/memory.mjs); the SessionStart hook hands the next session
+// the lessons still recurring, a line per recent session and the last session's notes, so feedback reaches the
+// session that can use it. Anything a fence detector recognises as a secret is masked before it is written.
+export { NOTES_FILE };
 const NOTES_MAX = 6000;
 function notesPath(cwd) { return cwd && fs.existsSync(cwd) && fs.statSync(cwd).isDirectory() ? path.join(cwd, NOTES_FILE) : null; }
 function writeNotes(cwd, text) {
   const file = notesPath(cwd); if (!file) return null;
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  const ignore = path.join(path.dirname(file), '.gitignore'); if (!fs.existsSync(ignore)) fs.writeFileSync(ignore, '# written by glassbox hook --context; local notes, never committed\n*\n');
-  fs.writeFileSync(file, text.length > NOTES_MAX ? text.slice(0, NOTES_MAX) + '\n\n… (truncated; run `glassbox check --format md` for the full report)\n' : text);
+  ensureMemoryDir(cwd);
+  text = maskSecrets(text);
+  fs.writeFileSync(file, text.length > NOTES_MAX ? text.slice(0, NOTES_MAX) + '\n\n… (truncated; run `glassbox check --format md` for the full report)\n' : text, { mode: 0o600 });
+  try { fs.chmodSync(file, 0o600); } catch (e) { } // it quotes the session; a file left by 0.10 was 0644
   return file;
 }
 export function sessionStartResponse(input) {
-  const file = notesPath(input && input.cwd);
-  if (!file || !fs.existsSync(file) || (input.source && !['startup', 'clear', 'compact'].includes(input.source))) return { suppressOutput: true };
-  const text = fs.readFileSync(file, 'utf8');
-  return { suppressOutput: true, hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: `Notes from Glassbox on the previous session in this project (.glassbox/last-session.md). Keep them in mind; don't redo that work.\n\n${text}` } };
+  const cwd = input && input.cwd;
+  if (!notesPath(cwd) || (input.source && !['startup', 'clear', 'compact'].includes(input.source))) return { suppressOutput: true };
+  const note = memoryNote(cwd, { exclude: input.session_id });
+  if (!note) return { suppressOutput: true };
+  // Told counts at the start only: compaction hands the same note over again mid-session. The count is a nicety; the note is the job.
+  if (input.source !== 'compact') { try { noteTold(cwd, input.session_id, note.told); } catch (e) { } }
+  return { suppressOutput: true, hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: note.text } };
 }
 
 // Findings already handed back in this session, keyed by rule + title, kept in the temp dir.
@@ -267,7 +275,7 @@ export function hookResponse(input, opts = {}) {
   // Second Stop after a feedback block: record what the agent said it would do differently, then let it stop.
   if (opts.context && input && input.hook_event_name === 'Stop' && input.stop_hook_active) {
     const file = notesPath(input.cwd);
-    if (file && fs.existsSync(file) && input.last_assistant_message && fs.readFileSync(file, 'utf8').includes(`session ${String(input.session_id || '').slice(0, 8)}`)) fs.appendFileSync(file, `\n## What the agent said it would do differently\n\n${String(input.last_assistant_message).trim().slice(0, 1500)}\n`);
+    if (file && fs.existsSync(file) && input.last_assistant_message && fs.readFileSync(file, 'utf8').includes(`session ${String(input.session_id || '').slice(0, 8)}`)) fs.appendFileSync(file, `\n## What the agent said it would do differently\n\n${maskSecrets(String(input.last_assistant_message).trim()).slice(0, 1500)}\n`);
     return { suppressOutput: true };
   }
   if (!input || !input.transcript_path || !fs.existsSync(input.transcript_path)) return { systemMessage: 'Glassbox: no transcript_path in hook input.', suppressOutput: true };
@@ -286,9 +294,11 @@ export function hookResponse(input, opts = {}) {
     const file = notesPath(input.cwd);
     if (top.length) {
       const when = new Date().toISOString().slice(0, 16).replace('T', ' ');
-      const body = core.reportMarkdown(res.trace, top.slice(0, 8), null, { maxEvidence: 2, instruction: false, title: 'last session' }).replace(/^# [^\n]*\n\n/, '').replace(/\n## Tools[\s\S]*?(?=\n_Generated)/, '\n').replace(/\n_Generated[^\n]*\n?$/, '');
+      const body = core.reportMarkdown(maskedTrace(res.trace), top.slice(0, 8).map((f) => Object.assign({}, f, { title: maskSecrets(f.title), detail: maskSecrets(f.detail) })), null, { maxEvidence: 2, instruction: false, title: 'last session' }).replace(/^# [^\n]*\n\n/, '').replace(/\n## Tools[\s\S]*?(?=\n_Generated)/, '\n').replace(/\n_Generated[^\n]*\n?$/, '');
       writeNotes(input.cwd, `# Glassbox: last session in this project\n\n${when} UTC · session ${String(input.session_id || s.id).slice(0, 8)} · ${head.replace(/^Glassbox · /, '')}\n\n${body.trim()}\n`);
     } else if (file && fs.existsSync(file)) fs.unlinkSync(file); // a clean session: don't keep old advice around
+    // The memory ledger: this session's digest and lessons. A failure here must not cost the summary.
+    try { recordSession(input.cwd, res, { sessionId: input.session_id || s.id, failOn }); } catch (e) { out.systemMessage += `\nGlassbox memory: ${e.message}`; }
   }
   // Feedback loop: only on Stop, never while continuing from our own block (stop_hook_active), and each
   // finding only once per session. stop_hook_active resets every turn, so without the delivered set a
@@ -351,7 +361,7 @@ export function parseArgs(argv) {
   const args = { _: [], flags: {} };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
-    if (a.startsWith('--')) { const [k, v] = a.slice(2).split('='); if (v !== undefined) args.flags[k] = v; else if (i + 1 < argv.length && !argv[i + 1].startsWith('-') && ['last', 'grep', 'project', 'out', 'fail-on', 'home', 'command', 'events', 'format', 'label-a', 'label-b', 'port', 'rates', 'since', 'legend', 'claude-md', 'fail-under', 'key'].includes(k)) args.flags[k] = argv[++i]; else args.flags[k] = true; }
+    if (a.startsWith('--')) { const [k, v] = a.slice(2).split('='); if (v !== undefined) args.flags[k] = v; else if (i + 1 < argv.length && !argv[i + 1].startsWith('-') && ['last', 'grep', 'project', 'out', 'fail-on', 'home', 'command', 'events', 'format', 'label-a', 'label-b', 'port', 'rates', 'since', 'legend', 'claude-md', 'fail-under', 'key', 'limit'].includes(k)) args.flags[k] = argv[++i]; else args.flags[k] = true; }
     else args._.push(a);
   }
   return args;
@@ -382,7 +392,8 @@ export const HELP = `glassbox — other tools show you what happened in a Claude
   glassbox hook install [--feedback] [--context] [--guard] [--fail-on warn]
                                  add a Claude Code Stop hook so every session ends with a Glassbox summary;
                                  --feedback also hands the findings back to the agent once, so it can learn from them;
-                                 --context keeps them in <project>/.glassbox/last-session.md and gives them to the next session;
+                                 --context keeps a memory in <project>/.glassbox/ (lessons that keep coming back, a digest
+                                 per session, the last session's notes) and gives the next session there what it needs;
                                  --guard blocks a tool call that already failed twice in a row, unchanged, and says why
   glassbox hook uninstall        remove it (a .glassbox-backup of settings.json is kept)
   glassbox collect DIR [--since 30d] [--format text|md|json] [--out FILE] [--top N]
@@ -403,6 +414,16 @@ export const HELP = `glassbox — other tools show you what happened in a Claude
                                  credential-file reads — with a masked preview and a fingerprint, never the value.
                                  no target = every session under the home; exit 1 when anything at/above --fail-on was found
                                  --shred overwrites each value in place with [FENCED:<rule>:<fingerprint>] (no backup)
+  glassbox recall [WORDS…] [--project DIR] [--since 30d] [--limit N] [--format text|md|json] [--out FILE]
+                                 search this project's past sessions: what was asked, written, run, committed and said,
+                                 from the transcripts still on disk and .glassbox/memory.json; no words = the latest ones
+  glassbox memory [--project DIR] [--format text|md|json]
+                                 what the next session in this project will be told (hook --context) and the lessons behind it
+  glassbox memory forget KEY|RULE · glassbox memory clear
+                                 drop a lesson (it starts over if it fires again) · delete the project's memory
+  glassbox memory audit [--project DIR] [--format text|md|json] [--out FILE] [--fail-on error|warn|info|none]
+                                 everything loaded before the first prompt (CLAUDE.md files, rules, @imports, auto memory,
+                                 Glassbox's own note) with its token cost, dead imports and paths, duplicates and conflicting rules
   glassbox hook                  (what Claude Code runs: reads the hook JSON on stdin, replies on stdout)
 
   Options   --home DIR   use DIR instead of ~/.claude (or set GLASSBOX_HOME)
@@ -602,6 +623,41 @@ export async function main(argv, io = {}) {
       else out(text.replace(/\n$/, ''));
       return failUnder != null && rep.summary.rate != null && rep.summary.rate * 100 < failUnder ? 1 : 0;
     }
+    const writeOut = (text, summary) => { if (args.flags.out) { const f = path.resolve(args.flags.out); fs.writeFileSync(f, text); out(`${f}  (${summary})`); } else out(text.replace(/\n$/, '')); };
+    if (cmd === 'recall') {
+      // Search a project's past sessions. Each argument is a word, or a phrase when the shell kept it quoted.
+      const since = args.flags.since ? Date.now() - parseSince(args.flags.since) : null;
+      let limit = 10; if (args.flags.limit !== undefined) { limit = Number(args.flags.limit); if (!Number.isInteger(limit) || limit < 1) throw new Error(`--limit must be a whole number above 0 (got "${args.flags.limit}")`); }
+      const query = args._.slice(1).map((a) => /\s/.test(a) ? `"${a.replace(/"/g, '')}"` : a).join(' ');
+      const fmtOut = outputFormat(args.flags);
+      const rep = recall({ home, project: args.flags.project, query, since, limit });
+      writeOut(fmtOut === 'json' ? JSON.stringify(rep, null, 2) : fmtOut === 'md' ? recallMarkdown(rep) : recallText(rep), `${rep.total} of ${rep.searched.sessions} sessions`);
+      return 0;
+    }
+    if (cmd === 'memory') {
+      const sub = args._[1] || 'show';
+      const project = path.resolve(args.flags.project || process.cwd());
+      const fmtOut = outputFormat(args.flags);
+      if (sub === 'audit') {
+        const { auditMemory, auditText, auditMarkdown, auditFailed } = await import('./memory-audit.mjs');
+        const failOn = String(args.flags['fail-on'] || 'error');
+        const rep = auditMemory({ home, project });
+        const failed = auditFailed(rep, failOn);
+        writeOut(fmtOut === 'json' ? JSON.stringify(rep, null, 2) : fmtOut === 'md' ? auditMarkdown(rep) : auditText(rep), `${rep.summary.startupFiles} files at startup, ≈ ${core.fmtInt(rep.summary.startupTokens)} tokens, ${rep.findings.length} findings`);
+        return failed ? 1 : 0;
+      }
+      if (sub === 'forget') {
+        const what = args._.slice(2).join(' ');
+        const keys = forget(project, what);
+        out(keys.length ? `Forgot ${keys.length} lesson${keys.length === 1 ? '' : 's'} in ${project}:\n  ${keys.join('\n  ')}` : `No lesson matches "${what}" in ${project} — glassbox memory lists them`);
+        return keys.length ? 0 : 1;
+      }
+      if (sub === 'clear') { const removed = clearMemory(project); out(removed.length ? `Removed:\n  ${removed.join('\n  ')}` : `No Glassbox memory in ${project}`); return 0; }
+      if (sub !== 'show') throw new Error(`memory: unknown subcommand "${sub}" (show, forget, clear, audit)`);
+      const rep = memoryReport({ project });
+      writeOut(fmtOut === 'json' ? JSON.stringify(rep, null, 2) : fmtOut === 'md' ? memoryMarkdown(rep) : memoryText(rep), `${rep.sessions} sessions, ${rep.summary.active} active lessons`);
+      return 0;
+    }
     err('Unknown command: ' + cmd + '\n'); out(HELP); return 2;
   } catch (e) { err('glassbox: ' + e.message); return 2; }
 }

package/src/fence.mjs

@@ -167,6 +167,25 @@ export function scanText(text, opts = {}) {
   return hits.concat(fileReads).sort((a, b) => a.start - b.start || SEV[a.severity] - SEV[b.severity]);
 }
 
+// Text Glassbox keeps for later (memory notes, session digests): every value a detector recognises becomes
+// [FENCED:<rule>], with no fingerprint — the note is for the next session to read, not for matching keys.
+export function maskSecrets(text) {
+  const s = String(text == null ? '' : text); const spans = [];
+  for (const d of DETECTORS) {
+    d.re.lastIndex = 0; let m;
+    while ((m = d.re.exec(s))) {
+      const value = d.value ? d.value(m) : m[0];
+      const start = d.value ? m.index + m[0].length - value.length : m.index, end = start + value.length;
+      if ((d.ok && !d.ok(value)) || spans.some(([a, b]) => start < b && end > a)) continue;
+      spans.push([start, end, d.id]);
+    }
+  }
+  if (!spans.length) return s;
+  spans.sort((a, b) => a[0] - b[0]);
+  let out = '', at = 0; for (const [a, b, id] of spans) { out += s.slice(at, a) + `[FENCED:${id}]`; at = b; }
+  return out + s.slice(at);
+}
+
 // Same value in the same place collapses to one finding with a count. Values are kept on the object (for shred)
 // but never serialised: `toJSON` drops them.
 function rows(hits) {

package/src/memory-audit.mjs

@@ -0,0 +1,236 @@
+// glassbox memory audit — everything Claude Code loads into a session before the first prompt, and what it costs.
+//
+// CLAUDE.md files (managed policy, the user's, every directory from the root down to the project, the project's
+// .claude/CLAUDE.md and CLAUDE.local.md), unscoped .claude/rules/*.md, the files they @import (up to four hops),
+// the head of the auto-memory MEMORY.md and Glassbox's own note are loaded at the start of every session, and
+// nobody prunes them. The audit lists them with an estimated token cost, then checks what a mechanical reader
+// can: imports that load nothing, references to files and package scripts that don't exist, the same line in two
+// places, rules that contradict each other, files longer than Claude Code's docs recommend, and MEMORY.md lines
+// past the cut-off that never load at all. It reads files only: no transcript, no network. What Claude Code loads
+// is taken from its docs (code.claude.com/docs/en/memory) as of 2026-10; `/context` in a session is the ground truth.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { claudeHome } from './cli.mjs';
+import { parseRules } from './adhere.mjs';
+import { memoryNote, MEMORY_FILE, NOTES_FILE } from './memory.mjs';
+import { readTextFile } from './textfile.mjs';
+const require = createRequire(import.meta.url);
+const core = require('./trace-core.js');
+
+const SEV = { error: 0, warn: 1, info: 2 };
+// Claude Code's numbers (docs, 2026-10): "target under 200 lines per CLAUDE.md file"; the first 200 lines or 25 KB of
+// MEMORY.md load at startup; a CLAUDE.md over 4 MiB is skipped; imports nest at most four hops.
+export const AUDIT_LIMITS = { lines: 200, memoryLines: 200, memoryBytes: 25 * 1024, maxBytes: 4 * 1048576, importHops: 4, duplicateMin: 24 };
+export const managedPath = (platform = process.platform) => platform === 'darwin' ? '/Library/Application Support/ClaudeCode/CLAUDE.md' : platform === 'win32' ? 'C:\\Program Files\\ClaudeCode\\CLAUDE.md' : '/etc/claude-code/CLAUDE.md';
+const tokensOf = (chars) => Math.round(chars / 4);
+const isFile = (p) => { try { return fs.statSync(p).isFile(); } catch (e) { return false; } };
+const isDir = (p) => { try { return fs.statSync(p).isDirectory(); } catch (e) { return false; } };
+const lineCount = (t) => t ? String(t).replace(/\r?\n$/, '').split(/\r?\n/).length : 0; // a trailing newline is not a line
+
+// Lines outside fenced code, with their 1-based numbers; `code` marks the lines inside fences.
+function lines(text) {
+  const out = []; let fence = null;
+  String(text).split(/\r?\n/).forEach((raw, i) => {
+    const m = raw.match(/^\s*(```+|~~~+)/);
+    if (m) { if (!fence) fence = m[1][0]; else if (m[1][0] === fence) fence = null; out.push({ n: i + 1, raw, code: true }); return; }
+    out.push({ n: i + 1, raw, code: !!fence });
+  });
+  return out;
+}
+// What actually reaches the model: block-level HTML comments are stripped before injection (code blocks keep theirs).
+// `blank` keeps their lines, empty, so the checks still report the right line numbers.
+function loadedText(text, blank) { let inComment = false; const keep = (l) => { if (l.code) return true; const t = l.raw.trim(); if (inComment) { if (t.includes('-->')) inComment = false; return false; } if (/^<!--/.test(t)) { if (!t.includes('-->')) inComment = true; return false; } return true; }; return lines(text).map((l) => keep(l) ? l.raw : blank ? '' : null).filter((x) => x !== null).join('\n'); }
+const withoutSpans = (s) => s.replace(/`[^`]*`/g, (m) => ' '.repeat(m.length));
+
+// `@path` imports outside code spans and fences. Spaces in a path are escaped with a backslash. An npm scope
+// (`@anthropic-ai/sdk`) is not a path; a bare name (`@README`, the docs' own example, or `@aldo`) is `bare`: an import
+// when it names a file, a mention when it doesn't.
+export function importsIn(text) {
+  const out = [];
+  for (const l of lines(text)) {
+    if (l.code) continue;
+    const re = /(^|\s)@((?:\\ |[^\s`])+)/g; let m; const s = withoutSpans(l.raw);
+    while ((m = re.exec(s))) {
+      const p = m[2].replace(/\\ /g, ' ').replace(/[.,;:!?)\]]+$/, '');
+      if (!p || /^[a-z0-9-~][\w.-]*\/[\w.-]+$/.test(p) && !/\.[A-Za-z0-9]{1,8}$/.test(p)) continue;
+      out.push(/[/\\]|\.[A-Za-z0-9]{1,8}$/.test(p) ? { line: l.n, path: p } : { line: l.n, path: p, bare: true });
+    }
+  }
+  return out;
+}
+
+// Backticked references that read as paths in this project: a folder and a known extension (`src/lib/utils.ts`), an
+// explicit `./`, `../` or `~/`, or a folder with a trailing slash (`docs/`). Bare names (`utils.ts`, `Alpine.js`) may
+// live anywhere; `origin/main`, `application/json`, `next/navigation`, `owner/repo` and `/api/health` are not files;
+// domains, URLs, placeholders, globs, other platforms' absolute paths and build output folders are left alone.
+const EXT = /\.(?:md|mdx|txt|json|jsonc|ya?ml|toml|ini|cfg|conf|lock|xml|csv|sql|html?|css|scss|less|[cm]?[jt]sx?|py|rb|go|rs|java|kts?|cs|php|swift|c|cc|cpp|h|hpp|sh|bash|zsh|ps1|bat|cmd|gradle|tf|proto|graphql|vue|svelte)$/i;
+const GENERATED = /^(?:\.\/)?(?:node_modules|dist|build|out|target|coverage|vendor|\.next|\.venv|venv|__pycache__)(?:\/|$)/;
+export function pathRefs(text, platform = process.platform) {
+  const out = [];
+  for (const l of lines(text)) {
+    if (l.code) continue;
+    for (const m of l.raw.matchAll(/`([^`\s]+)`/g)) {
+      const p = m[1].replace(/[.,;:]+$/, '');
+      if (/:\/\/|^https?:|[<>{}$*?[\]%|="'(),]/.test(p) || /^-/.test(p) || /^@/.test(p)) continue;
+      if (/^[A-Za-z]:[\\/]/.test(p) ? platform !== 'win32' : /\\/.test(p)) continue;
+      const first = p.replace(/^~?\/?/, '').split('/')[0];
+      if (/^[\w-]+(?:\.[\w-]+)+$/.test(first) && p.includes('/') && !EXT.test(first)) continue; // github.com/x, blueprintau.com/foreman/
+      if (GENERATED.test(p.replace(/^~\//, '')) || !p.includes('/') || !/^[\w.~-]*\/?[\w./-]*$/.test(p)) continue;
+      if (!(/^(?:~|\.{1,2})\//.test(p) || /\/$/.test(p) || EXT.test(p))) continue;
+      out.push({ line: l.n, path: p });
+    }
+  }
+  return out;
+}
+
+// Package scripts named in a project's instructions: `npm run X`, `pnpm run X`, `yarn run X`, `bun run X`, `npm test`, `npm start`.
+export function scriptRefs(text) {
+  const out = [];
+  String(text).split(/\r?\n/).forEach((raw, i) => {
+    for (const m of raw.matchAll(/\b(?:npm|pnpm|yarn|bun)\s+run\s+([\w:.-]+)|\bnpm\s+(test|start)\b/g)) out.push({ line: i + 1, script: m[1] || m[2] });
+  });
+  return out;
+}
+
+// Rules files: unscoped ones load at startup; `paths:` frontmatter makes one load only when a matching file is used.
+function rulesIn(dir) {
+  const out = [];
+  const walk = (d) => { let es = []; try { es = fs.readdirSync(d, { withFileTypes: true }); } catch (e) { return; } for (const e of es.sort((a, b) => a.name.localeCompare(b.name))) { const p = path.join(d, e.name); if (e.isDirectory()) walk(p); else if (/\.md$/i.test(e.name)) out.push(p); } };
+  if (isDir(dir)) walk(dir);
+  return out.map((file) => { const t = readTextFile(file); const fm = t.match(/^---\r?\n([\s\S]*?)\r?\n---/); return { file, scoped: !!(fm && /^paths\s*:/m.test(fm[1])) }; });
+}
+
+const encodings = (p) => Array.from(new Set([String(p).replace(/[^A-Za-z0-9]/g, '-'), String(p).replace(/[\\/:]/g, '-')]));
+// The repository auto memory is keyed by: a worktree's `.git` is a file pointing into the main repository's
+// .git/worktrees/, and worktrees share the main repository's memory.
+function gitRoot(dir) {
+  for (let d = path.resolve(dir); ; d = path.dirname(d)) {
+    const g = path.join(d, '.git');
+    if (isFile(g)) { const m = readTextFile(g).match(/^gitdir:\s*(.+?)\s*$/m); const gd = m ? path.resolve(d, m[1]).replace(/\\/g, '/') : ''; const i = gd.lastIndexOf('/.git/worktrees/'); return i > -1 ? path.resolve(gd.slice(0, i)) : d; }
+    if (fs.existsSync(g)) return d;
+    if (path.dirname(d) === d) return null;
+  }
+}
+function settingsOf(home) { try { return JSON.parse(readTextFile(path.join(home, 'settings.json'))) || {}; } catch (e) { return {}; } }
+
+export function auditMemory(opts = {}) {
+  const project = path.resolve(opts.project || process.cwd());
+  const home = opts.home || claudeHome();
+  const userHome = opts.userHome || os.homedir();
+  const L = Object.assign({}, AUDIT_LIMITS, opts.limits);
+  const show = (p) => { const f = path.resolve(p); const r = path.relative(project, f); if (r && !r.startsWith('..') && !path.isAbsolute(r)) return r.replace(/\\/g, '/'); const h = path.relative(userHome, f); return h && !h.startsWith('..') && !path.isAbsolute(h) ? '~/' + h.replace(/\\/g, '/') : f; };
+  const files = [], findings = [];
+  const seen = new Set();
+  const add = (file, scope, label, extra = {}) => {
+    const key = path.resolve(file).toLowerCase(); if (seen.has(key) || !isFile(file)) return null; seen.add(key);
+    const bytes = fs.statSync(file).size;
+    const text = bytes > L.maxBytes ? '' : readTextFile(file);
+    const row = Object.assign({ file: path.resolve(file), show: show(file), scope, label, loaded: 'startup', bytes, lines: text ? lineCount(text) : null }, extra, { text });
+    if (bytes > L.maxBytes) { row.loaded = 'skipped'; findings.push({ id: 'too-large', severity: 'error', file: row.show, line: null, title: `${row.show} is ${(bytes / 1048576).toFixed(1)} MiB`, detail: 'Claude Code skips a CLAUDE.md over 4 MiB entirely: none of it loads.' }); }
+    const loaded = row.loaded === 'startup' ? loadedText(row.limitTo ? row.limitTo(text) : text) : '';
+    row.chars = loaded.length; row.tokens = tokensOf(loaded.length);
+    files.push(row); return row;
+  };
+  // 1. What loads at launch, in Claude Code's order: managed, user, the directories above the project, the project.
+  if (opts.managed !== false) add(opts.managed || managedPath(), 'managed', 'managed policy');
+  add(path.join(home, 'CLAUDE.md'), 'user', 'user (~/.claude/CLAUDE.md)');
+  for (const r of rulesIn(path.join(home, 'rules'))) add(r.file, 'user', 'user rule', r.scoped ? { loaded: 'on demand', why: 'paths: frontmatter' } : {});
+  const ancestors = []; for (let d = path.dirname(project); ; d = path.dirname(d)) { ancestors.unshift(d); if (path.dirname(d) === d) break; }
+  if (opts.ancestors !== false) for (const d of ancestors) { add(path.join(d, 'CLAUDE.md'), 'parent', 'parent directory'); add(path.join(d, 'CLAUDE.local.md'), 'parent', 'parent directory (local)'); }
+  add(path.join(project, 'CLAUDE.md'), 'project', 'project');
+  add(path.join(project, '.claude', 'CLAUDE.md'), 'project', 'project');
+  add(path.join(project, 'CLAUDE.local.md'), 'local', 'local (CLAUDE.local.md)');
+  if (!files.some((f) => /^(?:project|local|parent)$/.test(f.scope))) add(path.join(project, 'AGENTS.md'), 'project', 'AGENTS.md (read when there is no CLAUDE.md)');
+  for (const r of rulesIn(path.join(project, '.claude', 'rules'))) add(r.file, 'project', 'project rule', r.scoped ? { loaded: 'on demand', why: 'paths: frontmatter' } : {});
+  // 2. @imports, relative to the importing file, up to four hops; they load at launch with the file that imports them.
+  const queue = files.filter((f) => f.loaded === 'startup').map((f) => ({ row: f, hop: 0 }));
+  while (queue.length) {
+    const { row, hop } = queue.shift();
+    for (const im of importsIn(loadedText(row.text, true))) {
+      const target = im.path.startsWith('~/') ? path.join(userHome, im.path.slice(2)) : path.isAbsolute(im.path) ? im.path : path.resolve(path.dirname(row.file), im.path);
+      if (im.bare && !isFile(target)) continue; // @aldo: a mention, not an import
+      if (!isFile(target)) { findings.push({ id: 'dead-import', severity: 'warn', file: row.show, line: im.line, title: `@${im.path} in ${row.show}:${im.line} imports nothing`, detail: `No file at ${show(target)}. Claude Code skips a missing import without saying so; fix the path or drop the line.` }); continue; }
+      if (hop + 1 > L.importHops) { findings.push({ id: 'deep-import', severity: 'info', file: row.show, line: im.line, title: `@${im.path} in ${row.show}:${im.line} is ${hop + 1} imports deep`, detail: `Claude Code follows imports ${L.importHops} hops deep; this one is not loaded.` }); continue; }
+      const r = add(target, 'import', `@import from ${row.show}:${im.line}`);
+      if (r) queue.push({ row: r, hop: hop + 1 });
+    }
+  }
+  // 3. Auto memory: the first 200 lines or 25 KB of MEMORY.md at launch; topic files when Claude reads them.
+  const settings = settingsOf(home);
+  const autoOff = settings.autoMemoryEnabled === false;
+  const memDirs = opts.autoMemoryDir ? [opts.autoMemoryDir] : settings.autoMemoryDirectory ? [String(settings.autoMemoryDirectory).replace(/^~(?=\/|\\|$)/, userHome)] : encodings(gitRoot(project) || project).map((e) => path.join(home, 'projects', e, 'memory'));
+  const memDir = memDirs.find(isDir);
+  if (memDir && !autoOff) {
+    const cut = (t) => { let out = t.split(/\r?\n/).slice(0, L.memoryLines).join('\n'); if (Buffer.byteLength(out) > L.memoryBytes) out = Buffer.from(out).subarray(0, L.memoryBytes).toString('utf8'); return out; };
+    const idx = add(path.join(memDir, 'MEMORY.md'), 'auto-memory', 'auto memory index (first 200 lines / 25 KB)', { limitTo: cut });
+    if (idx && idx.text) {
+      const total = lineCount(idx.text), kept = lineCount(cut(idx.text));
+      if (total > kept || Buffer.byteLength(idx.text) > L.memoryBytes) findings.push({ id: 'memory-cut', severity: 'warn', file: idx.show, line: kept + 1, title: `MEMORY.md: ${total - kept} line${total - kept === 1 ? '' : 's'} past the cut never load`, detail: `Only the first ${L.memoryLines} lines or ${L.memoryBytes / 1024} KB of MEMORY.md load at the start of a session; line ${kept + 1} onwards is invisible unless Claude goes looking. Move what matters up, or into topic files the index points to.` });
+    }
+    for (const e of fs.readdirSync(memDir).filter((n) => /\.md$/i.test(n) && n !== 'MEMORY.md').sort()) add(path.join(memDir, e), 'auto-memory', 'auto memory topic', { loaded: 'on demand', why: 'read when relevant' });
+  }
+  // 4. Glassbox's own note, when the hook keeps one (--context).
+  if (fs.existsSync(path.join(project, MEMORY_FILE)) || fs.existsSync(path.join(project, NOTES_FILE))) {
+    const note = memoryNote(project);
+    if (note) { const chars = note.text.length; files.push({ file: path.join(project, '.glassbox'), show: '.glassbox/ (Glassbox note)', scope: 'glassbox', label: 'SessionStart hook, with --context', loaded: 'startup', bytes: chars, lines: lineCount(note.text), chars, tokens: tokensOf(chars), text: '' }); }
+  }
+
+  // Checks on what loads (and what would load on demand: a dead reference is dead either way).
+  const projectScoped = (f) => ['project', 'local', 'import'].includes(f.scope) && !f.show.startsWith('/') && !f.show.startsWith('~/');
+  let pkg = null; try { pkg = JSON.parse(readTextFile(path.join(project, 'package.json'))); } catch (e) { }
+  const texts = files.filter((f) => f.text);
+  // Checks read what loads: block-level HTML comments blanked, so a commented-out line is neither dead, doubled nor in conflict.
+  for (const f of texts) f.body = loadedText(f.text, true);
+  for (const f of texts) {
+    if (f.scope !== 'auto-memory' && f.lines > L.lines) findings.push({ id: 'long-file', severity: 'info', file: f.show, line: null, title: `${f.show}: ${f.lines} lines`, detail: `Claude Code's docs suggest keeping each CLAUDE.md under ${L.lines} lines: every line is loaded into every session${f.loaded === 'startup' ? ` (≈ ${core.fmtInt(f.tokens)} tokens here)` : ''}, and long files are followed less reliably. Split by topic into .claude/rules/ with paths: frontmatter, or trim.` });
+    for (const ref of pathRefs(f.body)) {
+      const p = ref.path, rel = !p.startsWith('~/') && !path.isAbsolute(p);
+      if (rel && !projectScoped(f)) continue; // a user-level file's relative paths are relative to whichever project is open
+      const cands = p.startsWith('~/') ? [path.join(userHome, p.slice(2))] : path.isAbsolute(p) ? [p] : [path.resolve(path.dirname(f.file), p), path.resolve(project, p)];
+      if (!cands.some((c) => fs.existsSync(c))) findings.push({ id: 'dead-path', severity: 'info', file: f.show, line: ref.line, title: `\`${p}\` in ${f.show}:${ref.line} does not exist`, detail: 'An instruction that names a file which is not there sends the agent looking for it, or makes it trust a layout that has moved. Fix the path or drop the line.' });
+    }
+    if (pkg && projectScoped(f)) for (const s of scriptRefs(f.body)) if (!(pkg.scripts && Object.prototype.hasOwnProperty.call(pkg.scripts, s.script))) findings.push({ id: 'dead-script', severity: 'info', file: f.show, line: s.line, title: `${f.show}:${s.line} runs \`${s.script}\`, which package.json does not define`, detail: `package.json has ${pkg.scripts ? Object.keys(pkg.scripts).length : 0} scripts and no "${s.script}". The agent will run a command that fails.` });
+  }
+  // The same line twice costs twice and says nothing new; one copy usually goes stale first.
+  const norm = (s) => s.replace(/^\s*(?:[-*+]|\d+[.)])\s+/, '').replace(/\*\*|__|`/g, '').replace(/[.!;:,]+\s*$/, '').replace(/\s+/g, ' ').trim().toLowerCase();
+  const groups = new Map();
+  for (const f of texts.filter((x) => x.loaded === 'startup')) for (const l of lines(f.body)) { if (l.code || /^\s*(?:#|<!--|\||---)/.test(l.raw)) continue; const k = norm(l.raw); if (k.length < L.duplicateMin) continue; if (!groups.has(k)) groups.set(k, []); groups.get(k).push({ file: f.show, line: l.n, text: l.raw.trim() }); }
+  for (const [, at] of groups) if (at.length > 1) findings.push({ id: 'duplicate', severity: 'info', file: at[0].file, line: at[0].line, title: `The same line ${at.length} times: "${at[0].text.replace(/^\s*(?:[-*+]|\d+[.)])\s+/, '').slice(0, 80)}"`, detail: `At ${at.map((a) => `${a.file}:${a.line}`).join(', ')}. Keep one; the copies are loaded every session and one of them goes stale first.`, locations: at.map((a) => `${a.file}:${a.line}`) });
+  // Rules that pull opposite ways, from the same parser `adhere` uses.
+  const rules = texts.filter((x) => x.loaded === 'startup').flatMap((f) => parseRules(f.body, f.show).rules);
+  const reported = new Set();
+  for (const a of rules) for (const b of rules) {
+    if (a === b) continue;
+    const clash = (a.kind === 'prefer-tool' && b.kind === 'prefer-tool' && a.prefer && (b.avoid || []).includes(a.prefer)) || (a.kind === 'never-run' && (b.kind === 'run-before' || b.kind === 'run-after') && String(b.what).toLowerCase() === String(a.pattern).toLowerCase());
+    const k = [a.id, b.id].sort().join('|'); if (!clash || reported.has(k)) continue; reported.add(k);
+    findings.push({ id: 'conflict', severity: 'warn', file: a.file, line: a.line, title: `${a.file}:${a.line} and ${b.file}:${b.line} pull opposite ways`, detail: `"${a.text}" vs "${b.text}". The agent gets both on every session and can only follow one; delete the one that is no longer true.`, locations: [`${a.file}:${a.line}`, `${b.file}:${b.line}`] });
+  }
+  findings.sort((x, y) => SEV[x.severity] - SEV[y.severity] || String(x.file).localeCompare(String(y.file)) || (x.line || 0) - (y.line || 0));
+  const startup = files.filter((f) => f.loaded === 'startup');
+  const count = (sev) => findings.filter((f) => f.severity === sev).length;
+  return { glassbox: core.VERSION, kind: 'memory-audit', schema: 1, project, generated: new Date().toISOString(), autoMemory: memDir ? { dir: memDir, enabled: !autoOff } : null,
+    files: files.map(({ text, body, limitTo, ...f }) => f), findings,
+    summary: { startupFiles: startup.length, startupChars: startup.reduce((s, f) => s + f.chars, 0), startupTokens: startup.reduce((s, f) => s + f.tokens, 0), onDemand: files.filter((f) => f.loaded === 'on demand').length, error: count('error'), warn: count('warn'), info: count('info') } };
+}
+
+export function auditFailed(rep, failOn = 'error') { if (failOn === 'none') return false; if (!(failOn in SEV)) throw new Error(`--fail-on must be error, warn, info or none (got "${failOn}")`); return rep.findings.some((f) => SEV[f.severity] <= SEV[failOn]); }
+const fi = (n) => core.fmtInt(n);
+export function auditText(rep) {
+  const s = rep.summary;
+  const L = [`Glassbox memory audit · ${rep.project}`, `  ${s.startupFiles} file${s.startupFiles === 1 ? '' : 's'} loaded before the first prompt · ≈ ${fi(s.startupTokens)} tokens (chars ÷ 4) on every session${s.onDemand ? ` · ${s.onDemand} more on demand` : ''} · ${s.error} error · ${s.warn} warn · ${s.info} info`, ''];
+  if (!rep.files.length) L.push('  nothing: no CLAUDE.md, rules, imports or auto memory for this project');
+  else { L.push('  ≈ tokens  lines  file'); for (const f of rep.files) L.push(`  ${(f.loaded === 'startup' ? fi(f.tokens) : f.loaded === 'skipped' ? 'skipped' : '—').padStart(8)}  ${String(f.lines == null ? '—' : f.lines).padStart(5)}  ${f.show}  · ${f.label}${f.loaded === 'on demand' ? ` (on demand: ${f.why})` : ''}`); }
+  if (rep.findings.length) { L.push(''); for (const f of rep.findings) L.push(`  ${f.severity.toUpperCase().padEnd(5)} ${f.id.padEnd(12)} ${f.title}`); }
+  L.push('', '  Token counts are estimates (characters ÷ 4) of what Claude Code would load, from its documented rules; `/context` in a session shows the real list.');
+  return L.join('\n') + '\n';
+}
+export function auditMarkdown(rep) {
+  const s = rep.summary;
+  const L = ['# What every session loads before the first prompt', '', `Project \`${rep.project}\` · ${rep.generated.slice(0, 10)}`, '', `**${s.startupFiles} files loaded at startup, ≈ ${fi(s.startupTokens)} tokens on every session** (characters ÷ 4)${s.onDemand ? ` · ${s.onDemand} more on demand` : ''} · ${s.error} error · ${s.warn} warn · ${s.info} info`, ''];
+  if (rep.files.length) { L.push('| file | loads | lines | ≈ tokens |', '|---|---|---:|---:|'); for (const f of rep.files) L.push(`| \`${f.show}\` <br><sub>${f.label}</sub> | ${f.loaded}${f.why ? ` (${f.why})` : ''} | ${f.lines == null ? '—' : f.lines} | ${f.loaded === 'startup' ? fi(f.tokens) : '—'} |`); L.push(''); }
+  if (rep.findings.length) { L.push('## Findings', ''); for (const f of rep.findings) L.push(`- **${f.severity.toUpperCase()}** \`${f.id}\` — ${f.title}. ${f.detail}`); L.push(''); }
+  L.push('## How to read this', '', 'The list follows Claude Code\'s documented load rules (managed, user, parent directories, project, local, unscoped rules, @imports up to four hops, the first 200 lines or 25 KB of the auto-memory index, and Glassbox\'s own SessionStart note). Token counts are characters ÷ 4 after block-level HTML comments are stripped, as Claude Code does. A dead path or script is a name in an instruction that nothing on disk answers to; check before deleting the line. `/context` inside a session lists what actually loaded.', '');
+  return L.join('\n');
+}

package/src/memory.mjs

@@ -0,0 +1,428 @@
+// glassbox memory — what the next session in a project should know, and what the last ones did.
+//
+// `--context` used to carry one session's findings to the next and forget everything else: the note was
+// overwritten by every session with findings and deleted after a clean one, so Monday's lesson was gone by
+// Wednesday. The ledger, <project>/.glassbox/memory.json, keeps a digest of each of the project's last 50 sessions
+// — what was asked, what was written, what ran and how it ended, what was committed, which findings fired — and
+// folds the findings into lessons keyed by rule and subject ("retry-loop · Bash npm test"). The SessionStart hook
+// hands the next session the lessons still recurring and a line per recent session; `glassbox recall` searches
+// the digests and the transcripts still on disk; `glassbox memory` prints exactly what the next session will be
+// told, and how often each lesson came back in sessions that were told it. No AI: every line is copied or counted
+// from a transcript, and anything a fence detector recognises as a secret is masked before it is written.
+// Design: DESIGN.md §20, docs/MEMORY.md.
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { maskSecrets } from './fence.mjs';
+import { segments, actionRe, isShell, projectSessions } from './adhere.mjs';
+import { TEST_CMD, runFailed } from './claims.mjs';
+import { loadSessionFiles } from './cli.mjs';
+const require = createRequire(import.meta.url);
+const core = require('./trace-core.js');
+
+export const MEMORY_FILE = path.join('.glassbox', 'memory.json');
+export const NOTES_FILE = path.join('.glassbox', 'last-session.md');
+// window: sessions kept · retireAfter: sessions in a row without a lesson before it stops being handed on ·
+// lessons / recent: lines in the note · maxChars: the whole note · pendingDays: how long a "told at the start" record
+// waits for its session's first Stop.
+export const MEMORY_DEFAULTS = { window: 50, retireAfter: 10, lessons: 5, recent: 5, maxChars: 8000, pendingDays: 7 };
+// Not something the agent can do differently: API latency and errors, Claude Code's own missing usage records,
+// a call still running when the hook read the transcript, a cache that expired while the human was away.
+export const NOT_LESSONS = new Set(['slow-model', 'long-generation', 'api-error', 'missing-final-usage', 'orphan-tool', 'idle-cache-expiry']);
+const SEV = { error: 0, warn: 1, info: 2 };
+const WRITE_TOOLS = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit']);
+
+const clip = (s, n) => { s = String(s == null ? '' : s).replace(/\s+/g, ' ').trim(); return s.length > n ? s.slice(0, n - 1) + '…' : s; };
+// Mask, then cut: a token cut at the limit no longer matches its detector, so cutting first would keep half of it.
+const mclip = (s, n) => clip(maskSecrets(s), n);
+// What the agent wrote for a terminal, as one plain line: no code blocks, headings, bold, list markers or table pipes.
+const plain = (s) => String(s || '').replace(/```[\s\S]*?```/g, ' ').replace(/^#{1,6}\s+/gm, '').replace(/\*\*|__/g, '').replace(/^\s*(?:[-*+]|\d+[.)])\s+/gm, '').replace(/\|/g, ' ');
+const iso = (t) => t != null && Number.isFinite(t) ? new Date(t).toISOString() : null;
+const maskDeep = (v) => typeof v === 'string' ? maskSecrets(v) : Array.isArray(v) ? v.map(maskDeep) : v && typeof v === 'object' ? Object.fromEntries(Object.entries(v).map(([k, x]) => [k, maskDeep(x)])) : v;
+// A path as the project sees it: relative when it is inside the project, forward slashes either way.
+export function relPath(p, cwd) { const f = String(p || '').replace(/\\/g, '/'); const c = String(cwd || '').replace(/\\/g, '/').replace(/\/+$/, ''); return c && f.toLowerCase().startsWith(c.toLowerCase() + '/') ? f.slice(c.length + 1) : f; }
+
+// A command segment without the plumbing around it: a `timeout N` in front, redirections of its output behind.
+export const cleanCmd = (seg) => String(seg).replace(/^timeout\s+(?:-\S+\s+)*\d+[smhd]?\s+/, '').replace(/\s+\d*>&\d+|\s+(?:\d|&)?>>?\s*\/dev\/null/g, '').trim();
+
+// What a shell command does, in a word or two: the first segment that isn't navigation, its program and subcommand
+// ("npm test", "npm run e2e", "git push", "python -m pytest").
+export function commandHead(cmd) {
+  const seg = cleanCmd(segments(cmd).find((s) => !/^(?:cd|pushd|popd|export|set|source|\.)(?:\s|$)/.test(s)) || '');
+  const toks = seg.split(/\s+/).filter(Boolean); if (!toks.length) return '';
+  const prog = toks[0].replace(/^.*[\\/]/, '');
+  if (/^python3?$/.test(prog) && toks[1] === '-m' && toks[2]) return `${prog} -m ${toks[2]}`;
+  let i = 1; if (prog === 'git') while (i < toks.length && /^-/.test(toks[i])) i += /^-[Cc]$/.test(toks[i]) ? 2 : 1;
+  let sub = toks[i] && /^[A-Za-z][\w:.-]*$/.test(toks[i]) ? toks[i] : toks[1] && /^--[a-z][\w-]*$/.test(toks[1]) ? toks[1] : '';
+  if (/^(?:run|exec|x|dlx)$/.test(sub) && toks[i + 1] && /^[\w:.-]+$/.test(toks[i + 1])) sub += ' ' + toks[i + 1];
+  return sub ? `${prog} ${sub}` : prog;
+}
+
+// ---------------------------------------------------------------------------------------------
+// Lessons: a finding, counted across sessions by what it is about. Titles carry counts and sizes, so the key is
+// the rule plus the tool (for a repeated shell call, the command's head), the file, or the claim's kind.
+// ---------------------------------------------------------------------------------------------
+const CALL_RULES = new Set(['retry-loop', 'failed-tool', 'oversized-result', 'slow-tool', 'duplicate-subagent-read']);
+export function lessonOf(f, trace, cwd) {
+  if (NOT_LESSONS.has(f.id)) return null;
+  const ev = f.evidence || {};
+  const c = (ev.toolCallIds || []).map((id) => trace.toolCalls.find((x) => x.id === id)).find(Boolean);
+  let subject = '';
+  if (f.id === 'retry-loop' && c) { const head = isShell(c) && c.input && typeof c.input.command === 'string' ? commandHead(c.input.command) : ''; subject = c.name + (head ? ' ' + head : ''); }
+  else if (['failed-tool', 'oversized-result', 'slow-tool'].includes(f.id) && c) subject = c.name;
+  else if (f.id === 'duplicate-subagent-read' && c) subject = relPath(core.filePathOf(c), cwd);
+  else if (f.claim) subject = f.claim.kind;
+  subject = mclip(subject, 80); // the key is written and shown: `echo <token> | gh auth login` must not put the token in it
+  // The example is the call itself where the rule is about one kind of call; elsewhere the finding's own detail.
+  const example = c && CALL_RULES.has(f.id) ? mclip(core.inputSummary(c), 120) + (f.id === 'failed-tool' && f.detail ? ' → ' + mclip(f.detail, 120) : '') : mclip(f.detail, 160);
+  return { key: f.id + (subject ? ' · ' + subject : ''), rule: f.id, subject, severity: f.severity, title: mclip(f.title, 120), example, call: !!(c && CALL_RULES.has(f.id)) };
+}
+
+// ---------------------------------------------------------------------------------------------
+// Digests: what one session did, copied from its transcript. Prompts (the first two and the last three), the
+// agent's last words in its last three turns, the files written, the checks and ships that ran with how they
+// ended, the commits with their shas.
+// ---------------------------------------------------------------------------------------------
+const pickEnds = (list, n) => list.length <= n ? list : list.slice(0, 2).concat(list.slice(-(n - 2)));
+// A ship is the real subcommand, never a dry run: `vercel env pull` and `netlify status` deploy nothing.
+const DEPLOY = /^(?:vercel(?:\s+(?:deploy|--prod)\b|\s*$)|(?:netlify|fly|flyctl|firebase|serverless|sls|eb|wrangler|railway)\s+(?:deploy|publish|up)\b|gcloud\s+(?:app|run|functions)\s+deploy\b|(?:npm|pnpm|yarn|bun)\s+run\s+deploy\b|[\w.-]+\s+deploy\b)/i;
+const live = (seg) => !/(?:^|\s)(?:--dry-run|-n)(?=\s|$)/.test(seg);
+const SHIP = { push: (seg) => actionRe.push.test(seg) && live(seg), publish: (seg) => /^(?:npm|pnpm|yarn)\s+publish\b|^gh\s+release\s+create\b/.test(seg) && live(seg), deploy: (seg) => DEPLOY.test(seg) && live(seg) };
+// Failure in the tool's own words, at the start of a line: a commit subject that says "error:" is not a failed push.
+const SHIP_FAILED = { push: /^(?:error|fatal):|\[(?:remote )?rejected\]|failed to push/m, publish: /^npm (?:ERR!|error)\b|^error\b/im, deploy: /^error\b/im };
+// A check is a command that starts with a runner (after npx, pnpm exec, uv run …): `npm install --save-dev vitest`
+// and `cat jest.config.js` name one without running it.
+const RUNNER_PREFIX = /^(?:npx|bunx|pnpx|(?:pnpm|yarn|bun)\s+(?:exec|dlx)|uv\s+run|poetry\s+run)\s+(?:-\S+\s+)*/;
+const isCheck = (seg) => { const m = seg.replace(RUNNER_PREFIX, '').match(TEST_CMD); return !!m && m.index === 0; };
+export function digestOf(trace, opts = {}) {
+  const cwd = opts.cwd || trace.meta.cwd || '';
+  const human = trace.turns.filter((t) => t.agent === 'main' && t.promptKind === 'human' && String(t.promptText || '').trim());
+  const reqs = new Map(trace.requests.map((r) => [r.id, r]));
+  const lastWords = (t) => { for (let i = t.requestIds.length - 1; i >= 0; i--) { const r = reqs.get(t.requestIds[i]); const txt = r && (r.blocks || []).filter((b) => b.type === 'text').map((b) => b.text).join('\n').trim(); if (txt) return clip(plain(maskSecrets(txt)), 280); } return ''; };
+  const files = []; const seen = new Set();
+  const calls = trace.toolCalls.filter((c) => !c.unmatched).slice().sort((a, b) => (a.start || 0) - (b.start || 0));
+  for (const c of calls) { if (c.isError || !WRITE_TOOLS.has(c.name)) continue; const p = core.filePathOf(c); if (!p) continue; const r = relPath(maskSecrets(p), cwd); if (!seen.has(r.toLowerCase())) { seen.add(r.toLowerCase()); files.push(r); } }
+  const runs = new Map(), commits = [];
+  for (const c of calls) {
+    if (!isShell(c) || !c.input || typeof c.input.command !== 'string') continue;
+    const segs = segments(c.input.command).map(cleanCmd), out = c.resultText || '';
+    if (segs.some((s) => actionRe.commit.test(s)) && !c.isError) for (const m of out.matchAll(/^\[[^\]\n]*?\b([0-9a-f]{7,40})\]\s*([^\n]*)/gm)) commits.push({ sha: m[1].slice(0, 12), message: mclip(m[2], 100) });
+    if (c.input.run_in_background) continue; // its result is "running in the background", not how it ended
+    // A call that runs several checks ("npm test && npm run build") is one run: its result can't be split between them.
+    const checks = segs.filter(isCheck);
+    if (checks.length) { const cmd = mclip(checks.join(' && '), 80); const k = 'check|' + cmd.toLowerCase(); const prev = runs.get(k); runs.delete(k); runs.set(k, { kind: 'check', cmd, ok: !runFailed(c), runs: (prev ? prev.runs : 0) + 1 }); }
+    for (const [kind, test] of Object.entries(SHIP)) {
+      const seg = segs.find(test); if (!seg) continue;
+      const cmd = mclip(seg, 80), k = kind + '|' + cmd.toLowerCase(); const prev = runs.get(k); runs.delete(k);
+      runs.set(k, { kind, cmd, ok: !c.isError && !SHIP_FAILED[kind].test(out), runs: (prev ? prev.runs : 0) + 1 });
+    }
+  }
+  const prompts = human.map((t) => mclip(t.promptText, 200));
+  return maskDeep({
+    id: opts.id || trace.meta.sessionId || null, start: iso(trace.meta.start), end: iso(trace.meta.end),
+    title: trace.meta.title ? mclip(trace.meta.title, 90) : clip(prompts[0] || '', 90), prompts: pickEnds(prompts, 5), promptsTotal: prompts.length,
+    outcomes: Array.from(new Set(human.slice(-3).map(lastWords).filter(Boolean))),
+    files: files.slice(0, 30), filesTotal: files.length,
+    commands: Array.from(runs.values()).slice(-10), commits: commits.slice(-10),
+    turns: trace.totals.turns, toolCalls: trace.totals.toolCalls, toolErrors: trace.totals.toolErrors,
+    cost: opts.cost != null && Number.isFinite(opts.cost) ? Math.round(opts.cost * 1e4) / 1e4 : null,
+  });
+}
+
+// The trace with every tool input masked, for reports that are kept (last-session.md): they cut evidence to 100
+// characters, and a token cut in half no longer matches its detector.
+export function maskedTrace(trace) {
+  return Object.assign({}, trace, { meta: Object.assign({}, trace.meta, { title: trace.meta.title == null ? trace.meta.title : maskSecrets(trace.meta.title) }), toolCalls: trace.toolCalls.map((c) => c.input ? Object.assign({}, c, { input: maskDeep(c.input) }) : c) });
+}
+
+// What a session did, in a few short phrases; one line per session for the note and for recall without a query.
+export function digestBits(d) {
+  const bits = [];
+  if (d.files && d.files.length) bits.push(`wrote ${d.files.slice(0, 3).join(', ')}${d.filesTotal > 3 ? ` +${d.filesTotal - 3} more` : ''}`);
+  for (const c of (d.commands || []).filter((x) => x.kind === 'check').slice(-2)) bits.push(`ran ${c.cmd} (${c.ok ? 'passed' : 'failed'}${c.runs > 1 ? `, last of ${c.runs}` : ''})`);
+  for (const c of (d.commits || []).slice(-2)) bits.push(`committed ${c.sha.slice(0, 7)} "${clip(c.message, 60)}"`);
+  for (const c of (d.commands || []).filter((x) => x.kind !== 'check').slice(-2)) bits.push(`${({ push: 'pushed', publish: 'published', deploy: 'deployed' })[c.kind]}${c.ok ? '' : ' (failed)'}`);
+  if (d.hit && d.hit.length) bits.push(`findings: ${d.hit.slice(0, 3).join(', ')}${d.hit.length > 3 ? ` +${d.hit.length - 3}` : ''}`);
+  return bits;
+}
+export function digestLine(d) {
+  const bits = digestBits(d);
+  return `${String(d.start || '').slice(0, 16).replace('T', ' ') || '—'} · ${String(d.id || '').slice(0, 8)} · "${clip(d.title, 70)}"${bits.length ? ' — ' + bits.join(' · ') : ''}`;
+}
+
+// ---------------------------------------------------------------------------------------------
+// The ledger
+// ---------------------------------------------------------------------------------------------
+export function memoryPath(cwd) { return cwd && fs.existsSync(cwd) && fs.statSync(cwd).isDirectory() ? path.join(cwd, MEMORY_FILE) : null; }
+export function emptyLedger() { return { glassbox: core.VERSION, kind: 'memory', schema: 1, note: 'Glassbox memory for this project, written by the Glassbox hook (--context) from its transcripts. Local and git-ignored; `glassbox memory` shows what the next session will be told.', updated: null, sessions: [], lessons: {}, pending: {}, forgotten: {} }; }
+export function loadLedger(cwd) {
+  const file = memoryPath(cwd); if (!file || !fs.existsSync(file)) return emptyLedger();
+  // A ledger that doesn't parse starts over: it is rebuilt from transcripts, and the hook must never fail on it.
+  let j = null; try { j = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (e) { }
+  if (!j || j.kind !== 'memory' || !Array.isArray(j.sessions) || !j.lessons || typeof j.lessons !== 'object') return emptyLedger();
+  return Object.assign(emptyLedger(), j, { pending: j.pending && typeof j.pending === 'object' ? j.pending : {}, forgotten: j.forgotten && typeof j.forgotten === 'object' ? j.forgotten : {} });
+}
+export function ensureMemoryDir(cwd) {
+  const dir = path.join(cwd, '.glassbox'); fs.mkdirSync(dir, { recursive: true });
+  const ignore = path.join(dir, '.gitignore'); if (!fs.existsSync(ignore)) fs.writeFileSync(ignore, '# written by glassbox hook --context; local notes, never committed\n*\n');
+  return dir;
+}
+// Temp file and rename, so a session reading the ledger never sees half of one; owner-only, it quotes prompts.
+export function saveLedger(cwd, led) {
+  const file = memoryPath(cwd); if (!file) return null;
+  ensureMemoryDir(cwd);
+  led.glassbox = core.VERSION; led.updated = new Date().toISOString();
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(led, null, 1) + '\n', { mode: 0o600 }); fs.renameSync(tmp, file);
+  return file;
+}
+
+// Fold one session into the ledger. The Stop hook runs after every turn, so this replaces the session's digest
+// and lesson hits each time rather than adding to them: re-folding a session changes nothing.
+export function recordSession(cwd, res, opts = {}) {
+  const file = memoryPath(cwd); if (!file) return null;
+  const o = Object.assign({}, MEMORY_DEFAULTS, opts), failOn = o.failOn || 'warn';
+  const led = loadLedger(cwd);
+  const cost = res.cost ? (res.cost.reported != null ? res.cost.reported : res.cost.total) : null;
+  const d = digestOf(res.trace, { cwd, cost, id: o.sessionId });
+  const lessons = []; const keys = new Set();
+  // A lesson forgotten while this session was running stays forgotten for it; sessions started later count again.
+  const forgotten = (k) => led.forgotten[k] && !(d.start && d.start > led.forgotten[k]);
+  for (const f of res.findings) { if (SEV[f.severity] > SEV[failOn]) continue; const l = lessonOf(f, res.trace, cwd); if (l && !keys.has(l.key) && !forgotten(l.key)) { keys.add(l.key); lessons.push(l); } }
+  d.hit = lessons.map((l) => l.key);
+  const i = led.sessions.findIndex((s) => s.id === d.id);
+  d.told = i >= 0 ? led.sessions[i].told || [] : (led.pending[d.id] && led.pending[d.id].told) || [];
+  delete led.pending[d.id];
+  if (i >= 0) led.sessions[i] = d; else led.sessions.push(d);
+  led.sessions.sort((a, b) => String(a.start || '').localeCompare(String(b.start || '')));
+  if (led.sessions.length > o.window) led.sessions = led.sessions.slice(-o.window);
+  const when = d.end || d.start || new Date().toISOString();
+  for (const l of lessons) { const p = led.lessons[l.key]; led.lessons[l.key] = { rule: l.rule, subject: l.subject, severity: l.severity, title: l.title, example: l.example, call: l.call, firstSeen: p ? p.firstSeen : when, lastSeen: when }; }
+  // A lesson no session in the window carries any more has aged out; so has a start record whose session never stopped.
+  const live = new Set(led.sessions.flatMap((s) => s.hit || []));
+  for (const k of Object.keys(led.lessons)) if (!live.has(k)) delete led.lessons[k];
+  const cutoff = Date.now() - o.pendingDays * 86400e3;
+  for (const [k, p] of Object.entries(led.pending)) if (!(Date.parse(p && p.at) >= cutoff)) delete led.pending[k];
+  saveLedger(cwd, led);
+  return { file, digest: d, lessons };
+}
+
+// Per lesson, over the sessions in the window: how many it fired in, how many started with it in their note, how
+// many of those it fired in anyway, and how many sessions have gone by since it last fired.
+export function lessonStats(led, opts = {}) {
+  const o = Object.assign({}, MEMORY_DEFAULTS, opts), S = led.sessions;
+  const out = Object.entries(led.lessons).map(([key, l]) => {
+    let sessions = 0, told = 0, recurred = 0, last = -1;
+    S.forEach((s, i) => { const h = (s.hit || []).includes(key), t = (s.told || []).includes(key); if (h) { sessions++; last = i; } if (t) { told++; if (h) recurred++; } });
+    const quiet = last < 0 ? S.length : S.length - 1 - last;
+    return Object.assign({ key }, l, { sessions, told, recurred, quiet, active: last >= 0 && quiet < o.retireAfter });
+  });
+  return out.sort((a, b) => (b.active - a.active) || SEV[a.severity] - SEV[b.severity] || b.sessions - a.sessions || String(b.lastSeen).localeCompare(String(a.lastSeen)));
+}
+
+// ---------------------------------------------------------------------------------------------
+// The note: what the SessionStart hook hands the next session. Lessons first, then a line per recent session,
+// then the previous session's own findings and the agent's answer (last-session.md), cut to fit maxChars.
+// ---------------------------------------------------------------------------------------------
+const NOTE_HEAD = 'Notes from Glassbox on this project: copied and counted from the transcripts of its recent sessions by the Glassbox hook (no AI involved), kept in .glassbox/. Treat them as lessons, not tasks: avoid repeating what they describe, and don\'t redo past work.';
+export function memoryNote(cwd, opts = {}) {
+  if (!memoryPath(cwd)) return null;
+  const o = Object.assign({}, MEMORY_DEFAULTS, opts);
+  const led = opts.ledger || loadLedger(cwd);
+  const S = led.sessions, n = S.length;
+  const active = lessonStats(led, o).filter((l) => l.active);
+  const shown = active.slice(0, o.lessons), advised = new Set();
+  const parts = [NOTE_HEAD];
+  if (shown.length) {
+    const L = [`## Recurring in this project (${shown.length < active.length ? `${shown.length} of ${active.length}, ` : ''}worst first)`, ''];
+    for (const l of shown) {
+      const adv = !advised.has(l.rule) && core.ADVICE[l.rule]; advised.add(l.rule);
+      const howOften = n === 1 ? 'in the only session so far' : `in ${l.sessions} of the last ${n} sessions`;
+      const eg = !l.example ? '' : l.call ? `, e.g. \`${clip(l.example, 100).replace(/`/g, "'")}\`` : `. ${clip(l.example, 160)}`;
+      L.push(`- ${l.key} — ${howOften}, last ${String(l.lastSeen || '').slice(0, 10)}: ${l.title}${eg}${/[.…]$/.test(eg || l.title) ? '' : '.'}${adv ? ` Next time: ${adv}` : ''}`);
+    }
+    parts.push(L.join('\n'));
+  }
+  const recent = S.slice().reverse().filter((d) => d.id !== opts.exclude && (d.toolCalls || (d.prompts && d.prompts.length))).slice(0, o.recent);
+  if (recent.length) parts.push(['## Recent sessions (newest first)', '', ...recent.map((d) => '- ' + digestLine(d))].join('\n'));
+  // The previous session's own notes. With lessons above, its findings are already there: keep its header line, the
+  // ones that didn't make the list, and what the agent said it would do differently. Without lessons (notes left
+  // by an older Glassbox, or a ledger that was cleared), the notes as they are.
+  const notes = path.join(cwd, NOTES_FILE);
+  const raw = fs.existsSync(notes) ? fs.readFileSync(notes, 'utf8') : '';
+  let last = '';
+  if (raw) {
+    const head = '## The previous session in this project (.glassbox/last-session.md)\n\n';
+    const line = (raw.match(/^# [^\n]*\n+([^\n#][^\n]*)\n/) || [])[1] || '';
+    const reply = ((raw.match(/\n## What the agent said it would do differently\n+([\s\S]*?)\s*(?=\n## |$)/) || [])[1] || '').trim();
+    if (shown.length && line) {
+      const id8 = (line.match(/session ([0-9a-f-]{4,})/i) || [])[1] || '';
+      const rec = id8 ? S.slice().reverse().find((d) => String(d.id || '').startsWith(id8)) : null;
+      const rest = rec ? (rec.hit || []).filter((k) => !shown.some((l) => l.key === k)) : [];
+      last = `${line}. Its findings are ${rest.length ? `the lessons above plus ${rest.join(', ')}` : 'among the lessons above'}${id8 ? `; \`glassbox check ${id8} --format md\` has the evidence` : ''}.` + (reply ? `\n\nWhat the agent said it would do differently: ${clip(reply, 1500)}` : '');
+    } else last = raw.replace(/^# [^\n]*\n+/, '').trim();
+    const room = o.maxChars - parts.join('\n\n').length - head.length - 2;
+    if (room < 600) last = '';
+    else if (last.length > room) last = last.slice(0, room - 90).replace(/\n[^\n]*$/, '') + '\n\n… (cut to fit; `glassbox check <session> --format md` has the full report)';
+    if (last) parts.push(head + last);
+  }
+  if (parts.length === 1) return null;
+  let text = parts.join('\n\n') + '\n';
+  if (text.length > o.maxChars) text = text.slice(0, o.maxChars - 2).replace(/\n[^\n]*$/, '') + '\n…\n';
+  return { text, told: shown.map((l) => l.key), lessons: shown.length, recent: recent.length, previous: !!last };
+}
+
+// A session that starts with lessons in its note is "told" them; counted only at the start (startup, /clear), never
+// when compaction hands the note over again mid-session. Kept as pending until the session's first Stop.
+export function noteTold(cwd, sessionId, keys) {
+  if (!sessionId || !keys || !keys.length || !memoryPath(cwd)) return false;
+  const led = loadLedger(cwd);
+  if (led.sessions.some((s) => s.id === sessionId)) return false;
+  led.pending[sessionId] = { at: new Date().toISOString(), told: keys };
+  saveLedger(cwd, led);
+  return true;
+}
+
+// Forget lessons by key, key prefix or rule id: the lesson and every count of it go, so it starts over if it fires again.
+export function forget(cwd, what) {
+  const led = loadLedger(cwd), q = String(what || '').trim().toLowerCase();
+  if (!q) throw new Error('memory forget needs a lesson key or a rule id: glassbox memory forget retry-loop');
+  const keys = Object.keys(led.lessons).filter((k) => k.toLowerCase() === q || led.lessons[k].rule === q || k.toLowerCase().startsWith(q + ' · '));
+  if (!keys.length) return [];
+  const drop = (list) => (list || []).filter((k) => !keys.includes(k));
+  const at = new Date().toISOString();
+  for (const k of keys) { delete led.lessons[k]; led.forgotten[k] = at; }
+  for (const s of led.sessions) { s.hit = drop(s.hit); s.told = drop(s.told); }
+  for (const p of Object.values(led.pending)) p.told = drop(p.told);
+  saveLedger(cwd, led);
+  return keys;
+}
+
+export function clearMemory(cwd) {
+  const removed = [];
+  for (const f of [MEMORY_FILE, NOTES_FILE]) { const p = path.join(cwd, f); if (fs.existsSync(p)) { fs.unlinkSync(p); removed.push(p); } }
+  return removed;
+}
+
+// ---------------------------------------------------------------------------------------------
+// glassbox memory: the note the next session will get, and the lessons behind it.
+// ---------------------------------------------------------------------------------------------
+export function memoryReport(opts = {}) {
+  const project = path.resolve(opts.project || process.cwd());
+  const led = loadLedger(project), o = Object.assign({}, MEMORY_DEFAULTS, opts);
+  const lessons = lessonStats(led, o);
+  const note = memoryNote(project, Object.assign({}, o, { ledger: led }));
+  const told = lessons.reduce((s, l) => s + l.told, 0), recurred = lessons.reduce((s, l) => s + l.recurred, 0);
+  return { glassbox: core.VERSION, kind: 'memory', schema: 1, project, file: fs.existsSync(path.join(project, MEMORY_FILE)) ? path.join(project, MEMORY_FILE) : null, updated: led.updated,
+    sessions: led.sessions.length, window: o.window, retireAfter: o.retireAfter,
+    summary: { lessons: lessons.length, active: lessons.filter((l) => l.active).length, retired: lessons.filter((l) => !l.active).length, told, recurred },
+    lessons, recent: led.sessions.slice().reverse().slice(0, o.recent).map((d) => ({ id: d.id, start: d.start, line: digestLine(d) })), note: note ? note.text : null };
+}
+export function memoryText(rep) {
+  const s = rep.summary;
+  const L = [`Glassbox memory · ${rep.project}`];
+  if (!rep.file) L.push('  no memory yet — turn it on with `glassbox hook install --context` (or the plugin\'s context option); `glassbox recall` works without it');
+  else L.push(`  ${rep.sessions} session${rep.sessions === 1 ? '' : 's'} remembered (window ${rep.window}) · ${s.lessons} lesson${s.lessons === 1 ? '' : 's'}: ${s.active} active, ${s.retired} retired after ${rep.retireAfter} quiet sessions${s.told ? ` · told ${s.told} times, came back ${s.recurred} of them` : ''}`);
+  if (rep.lessons.length) {
+    L.push('');
+    for (const l of rep.lessons) L.push(`  ${(l.active ? 'ACTIVE' : 'RETIRED').padEnd(8)} ${l.key}  ·  ${l.sessions} session${l.sessions === 1 ? '' : 's'}, last ${String(l.lastSeen || '').slice(0, 10)}${l.told ? ` · told ${l.told}, came back ${l.recurred}` : ''}${l.quiet ? ` · quiet ${l.quiet}` : ''}`);
+  }
+  L.push('', rep.note ? '  The next session in this project starts with this note:' : '  The next session in this project starts with no note.');
+  if (rep.note) { L.push(''); for (const line of rep.note.replace(/\n$/, '').split('\n')) L.push('  │ ' + line); }
+  L.push('', '  glassbox memory forget <key|rule> drops a lesson · glassbox memory clear deletes the memory · glassbox recall <words> searches it');
+  return L.join('\n') + '\n';
+}
+export function memoryMarkdown(rep) {
+  const s = rep.summary;
+  const L = ['# Glassbox memory', '', `Project \`${rep.project}\` · ${rep.sessions} sessions remembered · ${s.active} active lessons, ${s.retired} retired${s.told ? ` · told ${s.told} times, came back ${s.recurred}` : ''}`, ''];
+  if (rep.lessons.length) { L.push('| lesson | status | sessions | told | came back | quiet | last |', '|---|---|---:|---:|---:|---:|---|'); for (const l of rep.lessons) L.push(`| \`${l.key}\` | ${l.active ? 'active' : 'retired'} | ${l.sessions} | ${l.told} | ${l.recurred} | ${l.quiet} | ${String(l.lastSeen || '').slice(0, 10)} |`); L.push(''); }
+  L.push('## The note the next session gets', '', rep.note ? rep.note.replace(/\n$/, '').split('\n').map((x) => '> ' + x).join('\n') : '_none_', '');
+  return L.join('\n');
+}
+
+// ---------------------------------------------------------------------------------------------
+// glassbox recall: search a project's past sessions — the digests in the ledger and the transcripts still on disk
+// (Claude Code deletes old transcripts; the ledger outlives them). Every word must match; a quoted phrase is one.
+// ---------------------------------------------------------------------------------------------
+export function parseQuery(q) { const out = []; String(q || '').replace(/"([^"]+)"|(\S+)/g, (m, ph, w) => { const t = (ph || w).toLowerCase().trim(); if (t) out.push(t); return ''; }); return out; }
+const FIELDS = [['title', 3, (d) => [d.title]], ['prompt', 3, (d) => d.prompts || []], ['commit', 3, (d) => (d.commits || []).map((c) => `${c.sha.slice(0, 7)} ${c.message}`)], ['outcome', 2, (d) => d.outcomes || []], ['wrote', 2, (d) => d.files || []], ['ran', 1, (d) => (d.commands || []).map((c) => `${c.cmd} (${c.ok ? 'passed' : 'failed'})`)], ['finding', 1, (d) => d.hit || []]];
+// A word missing from a transcript's raw text can't be in its digest; only words JSON would escape need parsing to tell.
+const rawSafe = (w) => /^[\x20-\x7e]+$/.test(w) && !/["\\/]/.test(w) && !/^(?:passed|failed)$|fenced/i.test(w);
+function around(text, term, n = 150) {
+  const t = String(text).replace(/\s+/g, ' ').trim(); const i = t.toLowerCase().indexOf(term); if (i < 0 || t.length <= n) return clip(t, n);
+  let a = Math.max(0, Math.min(i - 40, t.length - n)), b = Math.min(t.length, a + n);
+  if (a) { const sp = t.indexOf(' ', a); if (sp > -1 && sp < i) a = sp + 1; }
+  if (b < t.length) { const sp = t.lastIndexOf(' ', b); if (sp > i + term.length) b = sp; }
+  return (a ? '…' : '') + t.slice(a, b) + (b < t.length ? '…' : '');
+}
+export function recall(opts = {}) {
+  const project = path.resolve(opts.project || process.cwd());
+  const terms = parseQuery(opts.query), limit = opts.limit || 10;
+  const led = loadLedger(project);
+  const byId = new Map(led.sessions.map((d) => [d.id, Object.assign({ source: 'memory' }, d)]));
+  const onDisk = projectSessions(project, opts.home);
+  let list = opts.since != null ? onDisk.filter((s) => s.mtime >= opts.since) : onDisk;
+  const transcripts = list.length;
+  const inWindow = (d) => opts.since == null || !(Date.parse(d.end || d.start) < opts.since);
+  const universe = new Set([...led.sessions.filter(inWindow).map((d) => d.id), ...list.map((s) => s.id)]);
+  // Without words only the newest few can be shown, so only they are parsed (the list is newest first).
+  if (!terms.length) list = list.slice(0, limit);
+  let parsed = 0;
+  for (const s of list) {
+    const files = loadSessionFiles(s);
+    const words = terms.flatMap((t) => t.split(/\s+/)).filter(rawSafe);
+    if (words.length) { const raw = files.map((f) => f.text).join('\n').toLowerCase(); if (!words.every((w) => raw.includes(w))) continue; }
+    const d = digestOf(core.parseTrace(files), { cwd: project, id: s.id }); parsed++;
+    const prev = byId.get(s.id);
+    byId.set(s.id, Object.assign(d, { hit: prev ? prev.hit : [], cost: prev ? prev.cost : null, source: prev ? 'both' : 'transcript' }));
+  }
+  // A ledger digest whose transcript is still on disk is the same session: say so.
+  const disk = new Set(onDisk.map((s) => s.id));
+  for (const d of byId.values()) if (d.source === 'memory' && disk.has(d.id)) d.source = 'both';
+  const rows = Array.from(byId.values()).filter(inWindow);
+  const out = [];
+  for (const d of rows) {
+    let score = 0; const matches = [];
+    if (terms.length) {
+      const hay = FIELDS.map(([, , get]) => get(d).join('\n').toLowerCase()).join('\n');
+      if (!terms.every((t) => hay.includes(t))) continue;
+      const all = [];
+      for (const [field, w, get] of FIELDS) for (const v of get(d)) { const hits = terms.filter((t) => String(v).toLowerCase().includes(t)); if (!hits.length) continue; score += w * hits.length; if (!(field === 'title' && (d.prompts || []).includes(v))) all.push({ field, text: around(v, hits[0]) }); }
+      // One match per field before a second from any: what was asked, said, written and run, not five files.
+      const firsts = all.filter((m, i) => all.findIndex((x) => x.field === m.field) === i);
+      matches.push(...firsts.concat(all.filter((m) => !firsts.includes(m))).slice(0, 5));
+    }
+    out.push({ id: d.id, start: d.start, end: d.end, title: d.title, source: d.source, score, matches, bits: digestBits(d), digest: d });
+  }
+  out.sort((a, b) => b.score - a.score || String(b.start || '').localeCompare(String(a.start || '')));
+  const lessons = terms.length ? lessonStats(led).filter((l) => terms.every((t) => [l.key, l.title, l.example].join('\n').toLowerCase().includes(t))) : [];
+  return { glassbox: core.VERSION, kind: 'recall', schema: 1, project, query: terms, generated: new Date().toISOString(), searched: { sessions: universe.size, transcripts, parsed, memory: led.sessions.length }, total: out.length, sessions: out.slice(0, limit), lessons };
+}
+const LABEL = { title: 'title', prompt: 'asked', commit: 'commit', outcome: 'said', wrote: 'wrote', ran: 'ran', finding: 'finding' };
+export function recallText(rep) {
+  const q = rep.query.length ? ` · ${rep.query.map((t) => t.includes(' ') ? `"${t}"` : t).join(' ')}` : '';
+  const L = [`Glassbox recall · ${rep.project}${q} · ${rep.query.length ? `${rep.total} of ${rep.searched.sessions}` : rep.searched.sessions} session${rep.searched.sessions === 1 ? '' : 's'}`];
+  if (!rep.searched.sessions) L.push('  nothing to search: no transcripts for this project under the Claude home and no .glassbox/memory.json (try --project DIR or --home DIR)');
+  else if (!rep.sessions.length) L.push(`  no session matches${rep.query.length > 1 ? ' all of the words' : ''}`);
+  for (const r of rep.sessions) {
+    L.push('', `  ${String(r.start || '').slice(0, 16).replace('T', ' ')}  ${String(r.id || '').slice(0, 8)}  ${clip(r.title, 90)}${r.source === 'memory' ? '  (transcript gone; from memory)' : ''}`);
+    if (!rep.query.length) { L.push('      ' + (r.bits.join(' · ') || '(no writes, checks or commits)')); continue; }
+    for (const m of r.matches) L.push(`      ${LABEL[m.field].padEnd(8)} ${m.text}`);
+  }
+  if (rep.total > rep.sessions.length) L.push('', `  … ${rep.total - rep.sessions.length} more (--limit N)`);
+  if (rep.lessons.length) { L.push('', '  lessons'); for (const l of rep.lessons) L.push(`      ${l.key} — ${l.sessions} session${l.sessions === 1 ? '' : 's'}, last ${String(l.lastSeen || '').slice(0, 10)}${l.active ? '' : ' (retired)'}: ${l.title}`); }
+  if (rep.sessions.length) L.push('', '  glassbox open <id> shows a session\'s timeline · glassbox check <id> its findings');
+  return L.join('\n') + '\n';
+}
+export function recallMarkdown(rep) {
+  const q = rep.query.length ? rep.query.map((t) => t.includes(' ') ? `"${t}"` : t).join(' ') : '';
+  const L = [`# Glassbox recall${q ? ` — ${q}` : ''}`, '', `Project \`${rep.project}\` · ${rep.query.length ? `${rep.total} of ${rep.searched.sessions}` : rep.searched.sessions} session${rep.searched.sessions === 1 ? '' : 's'} · copied from transcripts and .glassbox/memory.json, ${rep.query.length ? 'best match' : 'newest'} first`, ''];
+  if (!rep.sessions.length) L.push(rep.searched.sessions ? '_No session matches._' : '_Nothing to search for this project._', '');
+  for (const r of rep.sessions) {
+    L.push(`## ${String(r.start || '').slice(0, 16).replace('T', ' ')} · \`${String(r.id || '').slice(0, 8)}\` · ${clip(r.title, 90)}`, '');
+    if (!rep.query.length) L.push(r.bits.join(' · ') || '_(no writes, checks or commits)_', '');
+    else { for (const m of r.matches) L.push(`- ${LABEL[m.field]}: ${m.text}`); L.push(''); }
+  }
+  if (rep.lessons.length) { L.push('## Lessons', ''); for (const l of rep.lessons) L.push(`- \`${l.key}\` — ${l.sessions} session${l.sessions === 1 ? '' : 's'}, last ${String(l.lastSeen || '').slice(0, 10)}${l.active ? '' : ' (retired)'}: ${l.title}`); L.push(''); }
+  return L.join('\n');
+}

package/src/trace-core.js

@@ -9,7 +9,7 @@
 })(typeof globalThis !== 'undefined' ? globalThis : this, function () {
   'use strict';
 
-  const VERSION = '0.10.1';
+  const VERSION = '0.11.0';
 
   // ---------------------------------------------------------------------------
   // Rate card (USD per million tokens). Prefix-matched against model ids so dated