Glovebox

Keeps the notes that matter in the glovebox, and hands them back to Claude after it compacts its memory.

Text notes only. Never video, never the screen, never your location. Glovebox reads files on your own machine, writes three small files in your project, and sends nothing to any network.

What it is for

A long session fills Claude's memory, and Claude Code compacts it: the conversation is replaced by a summary. A decision you made an hour ago, a rule you found the hard way, or the task you are halfway through can be lost in that summary.

Put those things in the glovebox. After every compaction, Glovebox hands them straight back to Claude, word for word, with the list of files that had changed.

Your CLAUDE.md already loads every session. The glovebox is for what this session has learned since then.

Use it

/glovebox add the build command is make quux     keep a note
/glovebox add-file docs/RULES.md                 keep a file: a pointer, read fresh each time
/glovebox                                        show what is in it, level by level
/glovebox drop 2                                 take entry 2 out
/glovebox clear                                  empty it
/glovebox receipts                               the last 10 receipts (see below)

Add --every-turn to make an entry reach Claude on every turn, not just after a compaction.

A file is kept as a pointer, never a copy, so Glovebox always reads what is on disk now. If the file is missing, Claude is told so in one line.

The files it writes

Glovebox writes exactly three files, all inside the project folder Claude Code runs in:

• .claude/GLOVEBOX.md: an instructions file. It is the list you build with /glovebox, and its entries are given to Claude as described below. It is plain text: you can read it and edit it by hand, and lines that are not entries are left alone.
• .claude/glovebox/last-compact.md: the list of changed files at the last compaction.
• .claude/glovebox/receipts.log: the receipts (see below).

It changes no build, start-up or settings file, and nothing outside the project.

The programs it runs

One: git status --short, in the project folder, once just before each compaction. It lists the files that had changed, so Claude gets that list back afterwards. It waits at most 5 seconds; if git is missing or the folder is not a repository, the list is simply left out.

What it sends, and where

Only text, and only to Claude, inside your own conversation. Nothing goes to any network, server or other service.

• Every turn: the entries marked --every-turn are added to Claude's system prompt, the standing instructions of your session, as one section.
• After a compaction: the other entries, and the changed-file list, are added as one message at the end of the compacted conversation.

It reads no password, key, token or other credential, and no environment variable.

What it reads

The GLOVEBOX.md files of the levels below, the files you point it at with add-file, and the output of git status --short.

Levels: as high up the tree as it goes

Like CLAUDE.md, Glovebox reads more than one glovebox. Outer levels reach Claude first, and each entry says where it came from:

1. managed: GLOVEBOX.md in Claude Code's managed-policy folder, C:\Program Files\ClaudeCode\, /Library/Application Support/ClaudeCode/ or /etc/claude-code/.
2. parent: .claude/GLOVEBOX.md in each folder above the project, outermost first.
3. project: .claude/GLOVEBOX.md in the folder Claude Code started in.

/glovebox changes only the project's own glovebox. The others are read only: edit them by hand.

The band and the budget

A band above the prompt shows how full the glovebox is: 🧤 Glovebox 12/200 lines. It turns red over the budget. Entries marked every turn are shown separately with their size in tokens, because they are paid on every message.

The budget is 200 lines across every level. A note counts as one line, and a file counts its own lines at that moment. A 196-line rules file fits on its own. Glovebox warns when you go over and never blocks: a long glovebox works, but Claude may skim it.

Every turn

--every-turn puts an entry into Claude's system prompt on every turn. It is read fresh from disk each time. While the text does not change, the prompt cache keeps it cheap.

🔴 This guarantees the rules are put in front of Claude every turn. It does not guarantee Claude obeys them. For a rule that must never be broken, pair it with a hook that blocks the action, like the Hands-Off mod in this repo, or a PreToolUse hook.

Receipts

Each time an entry reaches Claude, Glovebox adds one line to .claude/glovebox/receipts.log. That line is the evidence that the rule was in front of Claude at that moment. Each turn is logged once per entry, however many requests the turn makes, and again if the text changes within the turn.

/glovebox receipts shows the newest ten and checks the chain.

A receipt that cannot be written never stops the rules from reaching Claude.

It only grows. The log is one file, never trimmed and never rotated. Each receipt is about 245 bytes, so one every-turn entry over 1,000 turns adds about 245 KB. Delete or move the file yourself when you no longer need it; Glovebox starts a new chain.

Receipt format v1

One JSON object per line (JSON Lines), with exactly these keys, in this order:

{"v":1,"t":"2026-10-04T15:29:51.478Z","trigger":"turn","level":"project","entry":"note:1","sha256":"…","prev":"…"}

• v: the format version, 1.
• t: when, as an ISO 8601 time.
• trigger: turn (in the system prompt for a turn) or compact (handed back after a compaction).
• level: managed, ancestor or project (user is reserved).
• entry: a file's path as written in the glovebox, or note:<n> for the n-th note of its level.
• sha256: the hex SHA-256 of the exact text given to Claude for that entry.
• prev: the hex SHA-256 of the previous line as written, or 64 zeros for the first line.

The prev chain makes the log tamper-evident: changing or deleting any line breaks the chain from there on.

For an organisation: compliance

What is known, from Claude Code's own docs (read 4 Oct 2026):

• KNOWN. The managed-policy folders above are where Claude Code reads an organisation's managed-settings.json and its managed CLAUDE.md, and a managed CLAUDE.md cannot be excluded by users. (managed settings, memory)
• Glovebox's own choice. It reads a GLOVEBOX.md in that same folder as its top level. Claude Code does not read this file itself. It works only while Glovebox is installed and enabled.
• KNOWN. Managed settings outrank every other settings level. enabledPlugins turns a plugin on per scope, and strictKnownMarketplaces (managed only) limits which marketplaces users can install from. (settings, settings reference)
• UNKNOWN. Whether a user can turn off a plugin that managed settings turned on. The docs do not say.
• UNKNOWN. Whether allowManagedHooksOnly (managed only, "Run only the hooks your organization deploys") also stops plugin hooks like Glovebox's. If it does, Glovebox will not run under it.
• KNOWN. For instructions that must load whatever the user does, Claude Code's managed CLAUDE.md is the documented route. Glovebox adds what that file does not do: fresh reads of pointed-to files, the hand-back after compaction, and receipts.

Changes

0.1.1

• The plugin's id is now rostech-glovebox, because the name glovebox already belongs to someone else in the directory. The title and the /glovebox command are unchanged.
• The user-level glovebox (~/.claude/GLOVEBOX.md) and --user are gone: finding them meant reading the home folder from the environment. Parent folders and the managed level are still read.
• The receipt log is one file that only grows, with no rotation.
• A glovebox that cannot be saved (Claude Code started in a folder it may not write to) now says where and why, instead of the command failing with an engine error.

Next, not in 0.1.1

• A setting for the budget.
• A user-level glovebox for every project, found without reading the environment.

Tested with Claude Code 2.1.289.