
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@jknauber/telltale
Advanced tools
Local memory loop for Claude Code: stages and promotes durable preferences across sessions.
Telltale is a quiet memory loop for Claude Code. After each session ends, it reads the transcript, picks up the small signals that reveal how you actually work (corrections, repeated requests, things you push back on), and stages them as candidate preferences. When the pattern firms up, Claude raises it with you in your next session. You say yes or no. Approved entries land in ~/.telltale/learnings.md, which is imported into every future Claude Code session.
Want to see what's been picked up? Run telltale review any time to open a local UI showing confirmed learnings, pending candidates, recent runs, and commit history.
[!NOTE] Runs locally. Analysis goes through your own
claude -p. Nothing else leaves your machine.
npm i -g @jknauber/telltale
telltale setup
telltale setup will:
~/.telltale/, a small git-tracked memory dir for your learnings@import line to your global ~/.claude/CLAUDE.md so confirmed preferences load into every sessionSessionEnd and PreCompact hooks in ~/.claude/settings.json so future sessions feed telltale on their ownTo open the UI any time after that:
telltale review
From there, you mostly forget about it. The hooks do the watching. Claude prompts you when a finding is ready to confirm. The rest stays out of the way.
telltale setup [--no-scan] [--limit <n>]
Initialize the memory dir, git repo, CLAUDE.md import, and hooks. Optionally analyze the <n> most recent transcripts (default 5).
telltale review
Launch the telltale UI on http://localhost:5235 to browse confirmed learnings, potential candidates, recent runs, and commit history. The server runs in the foreground; press Ctrl-C to stop.
telltale promote "<instructions>"
Apply a free-text promote/reject instruction. Usually invoked by in-session Claude when it surfaces a pending learning. You rarely call this by hand.
Internal subcommands (__hook, __analyze, __promote) are entry points for the Claude Code hook and child processes. You don't invoke them yourself.
git clone https://github.com/joshuaKnauber/telltale.git
cd telltale
npm install
npm run dev:link
dev:link builds and symlinks the global telltale command to this clone. Edit, then npm run build to pick changes up. npm run dev:unlink removes the link when you're done.
Other scripts:
npm run dev -- setup runs the CLI through tsx without buildingnpm run build builds the UI (vite build → dist/ui/) then bundles the CLI to dist/cli.js with Rolldownnpm --prefix ui run dev runs the UI dev server (Vite on 5234, API on 5235) for working on the UInpm run typecheck runs tsc --noEmitReleases use Changesets:
npx changeset to describe what changednpm run version to bump and update the changelognpm run release to build and publishMIT
FAQs
Local memory loop for Claude Code: stages and promotes durable preferences across sessions.
The npm package @jknauber/telltale receives a total of 1 weekly downloads. As such, @jknauber/telltale popularity was classified as not popular.
We found that @jknauber/telltale demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.