Skip to content
schmidbauer.dev rcllr

Agent setup

Inside the brain. rcllr init writes AGENTS.md with the rules and a CLAUDE.md that imports it. Codex reads AGENTS.md directly. rcllr install adds:

  • .git/hooks/pre-commit: regenerates .sensitive-paths, completes frontmatter of staged notes, rebuilds INDEX.md and the README tables. With stale or incomplete notes it prints one summary line, but only when the counts changed since the last commit ([hooks] report); rcllr meta report lists them. It keeps the last counts in .git/rcllr-report, never in the working tree, and never blocks a commit.
  • .claude/settings.json: a PostToolUse hook on Write|Edit|MultiEdit|Bash and a SessionEnd hook. Both run rcllr hook agent, which commits note changes and, in a synced brain, pushes them.
  • .codex/hooks.json (with extras.codex_sync): the same hook for Codex tools. Check that your Codex version has hooks enabled.
  • permissions in .claude/settings.json: allow rules for Bash(rcllr *) and the old names dummkopf and dk, and ask rules for any call with --allow-sensitive. See Headless agents.

Existing settings stay; install only adds its own entries and can run again safely. Moving from an older sync setup? rcllr install --replace-command old_sync.py removes hook commands containing that text first, so two sync paths never run side by side.

From other projects. Point your global agent instructions at the brain, for example in ~/.claude/CLAUDE.md or ~/.codex/AGENTS.md:

Long-term memory lives in ~/brain. Before answering questions about earlier decisions or known topics, run
`rcllr --root ~/brain context "<the question>"`. Follow ~/brain/AGENTS.md for scope, sensitivity and writing.

RCLLR_ROOT=~/brain in your shell profile saves the --root. The hooks ignore it: they always get --root from the hook command, so they never act on a brain you did not install them into.

Headless agents

claude -p and the Claude Code GitHub Action never ask before a Bash command. They deny every command that needs approval and no rule allows, and report the denial only in their result. Without a rule, an agent there cannot call rcllr at all. Claude Code on the web applies the rules from the repository's .claude/settings.json, too.

Inside the brain, rcllr install writes the rules. From other projects, add them yourself, for example to ~/.claude/settings.json:

{
  "permissions": {
    "allow": ["Bash(rcllr *)"],
    "ask": ["Bash(rcllr *--allow-sensitive*)"]
  }
}

ask wins over allow. In a terminal, Claude Code asks you before it opens a sensitive note. Headless, nobody can confirm, so the call fails. That matches the rule in AGENTS.md: only the user opens a sensitive topic. These rules match the command as the agent writes it. They are not a security boundary: an agent can still read the files directly with cat. For the GitHub Action, pass the same rules through its settings input or claude_args: --allowedTools.