Csift

csift

Pronounced "c-sift" (see-sift)

The missing tool for Claude Code session transcripts.

<strong>search</strong>, <strong>recover</strong>, <strong>monitor</strong>, and <strong>audit</strong> any Claude Code session straight from the <code>.jsonl</code> logs.

──────────────────────────────────────────────────────────────────────────────
 ❯ what that session decide about rate limiting and wheres the code?
──────────────────────────────────────────────────────────────────────────────

⏺ Bash(csift search "rate limit" @1a2b3c4d -t agent --since 1d)
  matches  1 exchange · 1 session · oldest first

  1a2b3c4d·t42  2026-06-20 22:14:07.811 AEST(UTC+10)
    ▸ agent.message  L8821  Added a sliding-window limiter (10 req/min/IP); the 429 path now
                    returns Retry-After and logs the offending IP — gateway/src/rate_limit.rs:88.
  matched 1 exchange · 1 session · label=agent

That is one regex. The hit comes back as the complete round-trip it belongs to, in output short enough for an agent to read cheaply. No embeddings, database or daemon sit behind it.

Why csift

Claude Code's sessions are plain text in JSONL, so why csift, not grep?

They are plain text. The log holds every prompt, thought, tool call, file edit and pasted image, and every subagent the session spawned. Reading it back is where an agent goes wrong.

• "It deleted my project files, then apologized."

  It was running with --dangerously-skip-permissions. It wiped the files it had built, said sorry and stopped dead. Asked to dig them back out of its own session, it fumbled around, because the edits spanned subagents and every restore came back partial. Then it quietly started rewriting them from memory, having decided in its panic that this was "easier".

• "It lost my design images after a compaction, then asked me to re-send them."

  The images were right there in the conversation. One compaction later the agent acted as if they had never existed. The compaction had handed it lossy text fragments in their place, and it believed them.

• "Which session does jazzy-twilight-sparkle.md belong to?"

  The plan file carries the architecture that matters. Its invented name says nothing about which session wrote it. The only record of that is a plan_mode attachment the session wrote when it entered Plan Mode, one line among many in its transcript.

• "The machine crashed with three sessions open. Which was which?"

  One was frontend, one backend, one debugging, and claude --resume gives you a lineup with no faces.

• "I literally just said that."

  A few compactions into a long run, the agent still knows its task. Everything you actually said and read is gone. Claude Code does not carry the last few turns across a compaction word for word, the way the coding agents Codex and pi do.

• "I DID tell you. In the question dialog."

  It searched its own session by user roles, found nothing, and concluded you never said it. You had said it in AskUserQuestion.

• "You're the orchestrator. Why can't you see which session is stuck?"

  Because, it explains, an unanswered AskUserQuestion is never written to disk at all, "so there's nothing I can watch." Or worse, it offers to "interpret it from the thinking."