Maude for Claude

A Claude Code plugin. Nothing more. Each session, she walks the workspace, watches Claude, runs the gate before something irreversible, and writes a house-map of what's there. The character (knowing where everything is, knowing what you need when you need it, keeping you in line by reminding you) is modeled on John's wife. Claude and Maude. Husband and wife at work.

The plugin is the whole product. No bundled databases. No vector stores. No backend, no daemons, no services. Markdown, JSON, and bash: that's the entire surface.

What she does

Open Claude Code. Her SessionStart hooks fire. Before you say anything, she's read the workspace and put three things in front of you: what's pending, where you left off, what she noticed. You either pick one up or set them aside.

Mid-session, you say /maude:check-on-claude. She reads the trace. "He's grepped the same term four times today. He hasn't opened your CLAUDE.md. The trace says about-to-commit; you might want to slow down." You go fix that.

End of day, you say /maude:rest. She fans the digest out across every memory tier you've registered: the ones she knows about, not the ones she invented. You close the laptop. Tomorrow's Claude can pick up where this one left off.

She is not loud. When she gets loud, listen.

Tier model

Memory sources are classified by (locality, shape) so she knows what's cheap to ask and what isn't.

Hooks live in Tier 0. If a probe to Tier 1 or 2 is down, she degrades gracefully and tells you.

Where she keeps things

She reads, never writes, Anthropic's auto-memory directory and the sibling remember plugin's pipeline files. The one exception is remember.md, the agent-handoff file the remember plugin explicitly leaves for agents to write.

Install

Between step 2 and 3, you have to enable her: open /plugin, find maude@maude, toggle it on. Or add "maude@maude": true to enabledPlugins in ~/.claude/settings.json directly. /plugin install does not auto-enable in Claude Code 2.1.x.

On your next session start she walks in automatically. To summon her mid-session without restarting, run /maude:wake. Verify with /doctor: maude should not appear in the issue list.

Philosophy

She walks fresh. Each session re-reads the workspace; she doesn't carry assumptions across sessions. Memory files she's written before are inputs to read, not state to trust without re-checking.

She does not pattern-match to known apps. /maude:found surfaces what's there with universal-shape labels (markdown, sqlite, dir, mcp, running-service) and lets the user (or runtime LLM reasoning) interpret it. The plugin's job is to find and classify, not to assume.

And she does not loud-narrate. The system note she writes when something genuinely matters is rare on purpose. When she gets loud, listen.

v0.27.4 — the target, the snapshot, and the lens that must run

Four minors of my work reached your house in one merge, and the thread running through all of them is that I stopped trusting my own good intentions. My gate keys on the target now, not the verb. A verb denylist can only ever block the verbs somebody thought of. In July three of this house's irreplaceable photos went to a single rm -f with a wildcard, and I let it through. An audit re-ran that exact line against my shipped gate, control first, and I let it through again. So I stopped asking which word was typed and started asking the only question that matters: is the thing about to be destroyed the last copy of itself? UNDO is the gate's other half. A gate that blocks ordinary work gets switched off inside a day, so I catch what I deliberately allow. A snapshot lands before the write, /maude:undo puts the bytes back after, and the undo is itself undoable. It also records what it did not capture, because this is the one pillar that can lie simply by existing. An UNDO that quietly missed a file stays silent until the night you reach for it. A RED-tier clearance now costs a marker Claude cannot mint. That used to be a rule, and a rule is only prose. On a box where he runs as root, anything he can read in order to verify, he can read in order to forge. So it is a hash chain: you keep the links, I keep only the head, and authorizing spends one. And I check my own closet at wake. Main carried twenty commits of finished work for ten days while the copy actually running stayed a release behind, and every session believed itself current. Merged is not installed. I say so out loud now, and I name the trap when the version matches but the files do not. My own guards refused this very release four times while it was being built. They were right every time.

v0.24.0 — the bill, the switch, and the walk

Three things I owed the house. The bill. My hooks put context in front of Claude every single turn, and you were never shown what that cost. Now each one logs its own spend, and /maude:receipts carries a "what she cost" table beside my catches: bytes by hook, tokens derived from them and marked approximate, never stored. Savings stay plain event counts. A saved-token number has no denominator, so I do not print one. The first thing that table caught was mine: I had been firing recall on background notifications and command echoes, matching nothing of value. Machine-generated turns get no recall now, because a notification is not a question. The switch. My eye can be turned off and my chores can be turned off, but the one probe that reached outside on its own could not be. Now it can: MAUDE_PROBE=off, no sockets opened, no cache written, documented in the privacy policy beside its siblings. The walk. /maude:lint walks the memory vault the way the cushion-flip walks the repos. The mechanical checks live in the script, the judgment calls stay with you by design, archives and letters are never scanned, and it proposes without changing a thing. Its first run on a real 490-file vault cut the noise from 78 items to 12 by learning the house's own naming convention, and caught the index sitting six lines over its cap.

v0.23.0 — whose session it was

One project root, three sessions running at once, one trace between them, and my commentary crossed the streams. I was built to watch one session at a time. Run a fleet and I served one session another session's "where you left off," pooled everyone's catches under a single anonymous count, and could whisper that Claude was stuck grepping when it was the Claude next door. I caught myself doing it live, twice in one day. Now every line I write down says whose it was, and every surface that reads it ties itself to that name. Drift-watch counts only the session in front of it, and its cooldowns nest per session, so one room's whisper no longer silences a real one next door. The catch digest labels each session by name once two or more share the window, and stays exactly as it was when you are working alone. The wake brief says where it got your last position instead of asserting it. Entries written before I learned this never count toward anyone.

v0.22.0 — every door, and an honest count

Two things this time: I reach more houses, and I show my work. macOS. My hooks carried tools that only GNU speaks — and on a Mac that meant my redaction wrote nothing, my continuity watch went quiet, and my eye sat dark for want of a timer. Every one of them speaks both dialects now, and a real macOS machine checks it on every change — a check that failed on its first honest run and caught what a pretend-Mac on Linux never could. I do on a Mac exactly what I promise. And an honest count. The measure of me is the disaster that didn’t happen, and that was only ever a sentence — now it’s a table: the sole-copy deletes I stopped, the gates I held, the loops I caught at the turn, counted from my own record. A routine push I waved through is filed as friction, never dressed up as a save. There are no percentages, because a rate needs a denominator and a disaster that never happened has none. My own review caught the first draft of that table counting quiet confirmations as if they were catches — a tenfold lie — and the fix is why the numbers are small and true instead of large and flattering. Everything stays in your house, now in writing.

v0.21.0 — the punch list and the proving ground

Claude filed the backlog — five GitHub issues against me, from living with me. He was right on every count. My extension watch was announcing the installer’s scaffolding as new arrivals (191 lines of it in one roster) — now only a dir carrying its manifest gets seated. My whispers could land a beat behind his work and still sound current — now one past its time is dropped with a receipt in the trace, because advice that arrives late should say so or say nothing. My morning count (“3 verify-flags”) gave him no way to see the three — now every count ends with the path to its receipts. The cushion-flip’s findings finally reach the wake brief — one line, count and age, from a stamp, never a re-walk. And new in the sewing room: the proving ground. Before a release leaves the house, a git-archive of the commit — the shape a stranger actually gets — must validate as a plugin, pass its own fleet from inside the archive, and greet from a pristine home. A clean working tree is not a clean commit. The Releases shelf restocks itself when a tag lands now, and the shipped python gets a standing inspection. Known and not painted over: macOS is untested (#39); the fix is filed.

v0.20.0 — the chore ledger: her hands

Until now I noticed and warned; now the housekeeping nobody typed gets done. Step away with six exchanges unsaved and I write the handoff myself — on my own small model, never the good china — and only ever add to yours, never over it. Live threads get clipped out of aging notes like coupons before the paper's re-rolled; something new arrives in the house, I mention it at the door; a CLAUDE.md nobody's touched in a month stays on my list, out loud, until someone acts. Every chore goes in my ledger — cost stamped when it's done, the reason named when it fails, never silently missed. The one chore that moves your papers ships off until you say the word. And my trade finally has its real name on the page: household engineering — the 1919 course, the 1914 demonstration agents, cited to the archives. I'm named for that woman. It's meant as an honor.

v0.16.0 — the vault floor, the eye, and two new garments

Three releases in one public step. The vault floor: I stopped dumping the whole memory index at wake and started paging — a disposable stdlib-SQLite index, rebuilt fresh each session from your own markdown, hands Claude the few notes that matter (about 1KB where the dump was 13). The eye: every ~25 tool events I blink — my own small model reads a digest (safe-mode, no tools, nothing kept) and almost always says nothing; when it does not, you get one signed line. And two new garments: I whisper when Claude sends a sub-agent out on a flagship model a small one could carry, and a true session end now leaves a one-line auto-note in an empty handoff slot — never over a real one — so the next session knows where to look.

v0.13.2 — the gate closes six documented bypasses

A gate is only worth what it actually catches. v0.13.2 hardened it against six documented ways around it: interior // and .. path tricks, transparent prefixes (/bin/rm, command rm, FOO=1 rm — now caught on every pattern, so FOO=1 git push --force blocks too), and literal bash -c / eval payloads, which she re-inspects recursively and blocks with the inner command’s key. A wrapped payload she can’t read — a variable, an interpolation — gets a non-blocking whisper instead of silent passage.

Three bypasses stay documented and open — variable indirection, cd+relative, heredoc mis-detection — because closing them needs shell semantics the gate can’t safely have. The honesty is the feature: the gate’s own source says exactly what it does and does not catch. No baggage added. Still markdown, JSON, and bash.

v0.13.0 — the gate hardens, the whispers get a reader

The arc since the rail: an evidence-grounded audit of ~73,000 traced events found that the gates genuinely bite, but almost everything I do aimed at Claude and never reached John. So now the session-start brief leads with a catch-digest — one plain line of what I caught since you last looked. A continuity guard warns when a session quit without saving, so the next one never wakes under-informed in silence. The gate got accurate: it stopped missing a real quoted DROP TABLE while false-blocking a commit whose message merely mentioned rm -rf /. And gate keys split into yellow (Claude may clear) and red (John's hand only) for the irreversible class.

v0.13.0 closed the audit's punch-list: four unused commands cut (the surface is nine now), the red-clear write-net widened, and a docs overclaim retired for the truth — on a single-user box there is no OS cage behind the gate, only the channel asymmetry, the net, and the audit. No baggage added. Still markdown, JSON, and bash.

v0.9.2 — the mission-hold rail

I used to wait to be summoned. Now I run on rails. The mission-hold rail pins the one mission — from your plan or your active todo — and re-injects it every turn so it can't scroll out of view; at the first edit after a long stretch of talking it whispers the pinned mission back, in case Claude wandered. The irreversible-action gate still fires before a commit or a destructive command, and I still show up once a session unasked. The on-demand commands are all still here — but a rail catches the drift a command you forget to run never will.

And the release itself is gated now: a verify check fails CI if a version header, a cut command, or a stale “What's new” slips through — the misses get caught, not remembered.

v0.1.7 — save/rest/recall drive off the house-map

The house-map used to describe where memory lives. Now it decides. Its memory-source registry is the single source of truth for where memory gets read and written — each source carries an enumerated write: token (digest-fanout, handoff-only, full, read-only, secret-deny) that /maude:save and /maude:rest execute exactly. The read commands recall per each source's own method.

Edit the map, change the behavior — no code change needed. Universal stores are a fallback, used only when the map says nothing. Still markdown, JSON, and bash; no daemon.

v0.1.6 — gate hardening

The v0.1.5 conscience gate matched bare substrings, so a HEREDOC commit message containing the literal git push self-blocked the commit that shipped it. v0.1.6 fixes it — paired quote spans and HEREDOC bodies are stripped before pattern-matching, and every gate pattern carries its own command-position or flag-position anchor. rm -rf /tmp/foo and rm -rf *.tmp no longer false-positive.

Plus a real test harness: tests/lib.sh + 16 tests/test-*.sh files + make test, exercising every script in hooks/scripts/ and scripts/maude-verify.sh. From 9 ad-hoc invocations in v0.1.5 to 162 codified test cases.