feat: add global memory (OKF) instructions and uv sandbox path - #876
Conversation
Adds AGENTS.md guidance for a cross-project, cross-agent memory bundle under ~/.memory/ (Open Knowledge Format), maintained and re-indexed via memsearch. Also allowlists ~/.local/share/uv for sandboxed writes since uvx needs it for temp files. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 54 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a "Global Memory" documentation section to AGENTS.md describing storage location, structure, and rules for reading, writing, and re-indexing cross-project memory. Separately, extends the sandbox filesystem allowWrite allowlist in claude-settings.json to include an additional path. ChangesDocumentation and configuration updates
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ BASH | shfmt | 3 | 0 | 0 | 0 | 0.02s |
| prettier | 9 | 0 | 1 | 0 | 0.36s | |
| markdownlint | 6 | 0 | 2 | 0 | 0.6s | |
| ✅ MARKDOWN | markdown-table-formatter | 6 | 0 | 0 | 0 | 0.16s |
| ✅ YAML | prettier | 10 | 0 | 0 | 0 | 0.46s |
Detailed Issues
⚠️ MARKDOWN / markdownlint - 2 errors
chezmoi/private_dot_claude/modify_CLAUDE.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "{{- /*chezmoi:modify-template*..."]
chezmoi/private_dot_config/opencode/modify_AGENTS.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "{{- /*chezmoi:modify-template*..."]
⚠️ JSON / prettier - 1 error
chezmoi/.chezmoitemplates/claude-settings.json 62ms (unchanged)
chezmoi/.chezmoitemplates/mcp_servers.json 4ms (unchanged)
chezmoi/.chezmoitemplates/opencode-tui.json 2ms (unchanged)
chezmoi/.chezmoitemplates/opencode.json 3ms (unchanged)
[error] chezmoi/private_dot_claude/modify_settings.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/mcp/modify_mcp_servers.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/opencode/modify_opencode.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/opencode/modify_tui.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
renovate.json 6ms (unchanged)
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters BASH_SHFMT,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,YAML_PRETTIER
Show us your support by starring ⭐ the repository
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a "Global Memory" section in AGENTS.md to guide agents on managing durable, cross-project knowledge under ~/.memory/ and indexing it with memsearch. It also adds ~/.local/share/uv to claude-settings.json. The reviewer suggested adding ~/.memory and ~/.memsearch to the write permissions list in claude-settings.json to prevent sandbox write permission errors when agents attempt to update global memory or run indexing.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| "~/.cargo/registry", | ||
| "~/.gradle", | ||
| "~/.local/lib", | ||
| "~/.local/share/uv", |
There was a problem hiding this comment.
Since the agent is instructed to write to ~/.memory/ and memsearch maintains its local database under ~/.memsearch/, these directories must be added to the sandbox's allowWrite list. Otherwise, the agent will encounter sandbox write permission errors when attempting to update global memory or run the indexing command.
| "~/.local/share/uv", | |
| "~/.local/share/uv", | |
| "~/.memory", | |
| "~/.memsearch", |
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ BASH | bash-exec | 3 | 0 | 0 | 0.02s | |
| ✅ BASH | shellcheck | 3 | 0 | 0 | 0.13s | |
| ✅ REPOSITORY | checkov | yes | no | no | 25.93s | |
| ✅ REPOSITORY | devskim | yes | no | no | 1.69s | |
| ✅ REPOSITORY | dustilock | yes | no | no | 0.02s | |
| ✅ REPOSITORY | gitleaks | yes | no | no | 1.02s | |
| ✅ REPOSITORY | grype | yes | no | no | 50.6s | |
| ✅ REPOSITORY | kingfisher | yes | no | no | 9.72s | |
| osv-scanner | yes | 1 | no | 0.15s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.63s | |
| ✅ REPOSITORY | syft | yes | no | no | 1.83s | |
| ✅ REPOSITORY | trivy | yes | no | no | 13.82s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.13s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 3.69s |
Detailed Issues
⚠️ REPOSITORY / osv-scanner - 1 error
Scanning dir .
Starting filesystem walk for root: /
End status: 41 dirs visited, 144 inodes visited, 0 Extract calls, 3.034069ms elapsed, 3.034255ms wall time
No package sources found, --help for usage information.
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters BASH_EXEC,BASH_SHELLCHECK,REPOSITORY_CHECKOV,REPOSITORY_DEVSKIM,REPOSITORY_DUSTILOCK,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER
Show us your support by starring ⭐ the repository
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 5 | 0 | 0 | 0.2s | |
| ✅ ACTION | zizmor | 5 | 0 | 0 | 0 | 0.75s |
| ✅ BASH | bash-exec | 3 | 0 | 0 | 0.01s | |
| ✅ BASH | shellcheck | 3 | 0 | 0 | 0.08s | |
| ✅ BASH | shfmt | 3 | 0 | 0 | 0 | 0.01s |
| ✅ COPYPASTE | jscpd | yes | no | no | 0.55s | |
| ✅ EDITORCONFIG | editorconfig-checker | 72 | 0 | 0 | 0.04s | |
| prettier | 9 | 0 | 1 | 0 | 0.38s | |
| ✅ JSON | v8r | 9 | 0 | 0 | 2.54s | |
| markdownlint | 6 | 0 | 2 | 0 | 0.44s | |
| ✅ MARKDOWN | markdown-table-formatter | 6 | 0 | 0 | 0 | 0.15s |
| ✅ REPOSITORY | checkov | yes | no | no | 27.0s | |
| ✅ REPOSITORY | gitleaks | yes | no | no | 0.68s | |
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | |
| ✅ REPOSITORY | grype | yes | no | no | 35.08s | |
| osv-scanner | yes | 1 | no | 0.12s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.0s | |
| ✅ REPOSITORY | syft | yes | no | no | 1.14s | |
| ✅ REPOSITORY | trivy | yes | no | no | 9.35s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.11s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 1.89s | |
| lychee | 25 | 2 | 0 | 2.85s | ||
| ✅ YAML | prettier | 10 | 0 | 0 | 0 | 0.45s |
| ✅ YAML | v8r | 10 | 0 | 0 | 4.54s | |
| ✅ YAML | yamllint | 10 | 0 | 0 | 0.29s |
Detailed Issues
⚠️ SPELL / lychee - 2 errors
📝 Summary
---------------------
🔍 Total...........22
🔗 Unique..........17
✅ Successful......20
⏳ Timeouts.........0
🔀 Redirected.......4
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........2
⛔ Unsupported......2
Errors in chezmoi/.chezmoitemplates/mcp_servers.json
[406] https://mcp.deepwiki.com/mcp (at 11:15) | Rejected status code: 406 Not Acceptable
Errors in chezmoi/.chezmoitemplates/opencode.json
[406] https://mcp.deepwiki.com/mcp (at 24:15) | Rejected status code: 406 Not Acceptable
Hint: Followed 4 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdownlint - 2 errors
chezmoi/private_dot_claude/modify_CLAUDE.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "{{- /*chezmoi:modify-template*..."]
chezmoi/private_dot_config/opencode/modify_AGENTS.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "{{- /*chezmoi:modify-template*..."]
⚠️ REPOSITORY / osv-scanner - 1 error
Scanning dir .
Starting filesystem walk for root: /
End status: 41 dirs visited, 144 inodes visited, 0 Extract calls, 1.758146ms elapsed, 1.758296ms wall time
No package sources found, --help for usage information.
⚠️ JSON / prettier - 1 error
chezmoi/.chezmoitemplates/claude-settings.json 49ms (unchanged)
chezmoi/.chezmoitemplates/mcp_servers.json 3ms (unchanged)
chezmoi/.chezmoitemplates/opencode-tui.json 2ms (unchanged)
chezmoi/.chezmoitemplates/opencode.json 3ms (unchanged)
[error] chezmoi/private_dot_claude/modify_settings.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/mcp/modify_mcp_servers.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/opencode/modify_opencode.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/opencode/modify_tui.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
renovate.json 9ms (unchanged)
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,COPYPASTE_JSCPD,EDITORCONFIG_EDITORCONFIG_CHECKER,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
memsearch's hooks only index each project's own .memsearch/memory dir; nothing queries a manually-created ~/.memory collection, so the re-index step was dead instruction. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@chezmoi/.chezmoitemplates/claude-settings.json`:
- Line 64: The allowWrite list in the Claude settings template is missing the
~/.memsearch directory, so memsearch_config.toml cannot write its USER.md
profile file in the sandbox. Update the allowWrite entries in the settings
template to include ~/.memsearch/ (or the specific USER.md path) alongside the
existing allowed directories, keeping the change localized to the template that
defines sandbox write access.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 5f285e4f-3b9c-42f7-ace6-125339f6c38a
📒 Files selected for processing (2)
chezmoi/.chezmoitemplates/AGENTS.mdchezmoi/.chezmoitemplates/claude-settings.json
| "~/.cargo/registry", | ||
| "~/.gradle", | ||
| "~/.local/lib", | ||
| "~/.local/share/uv", |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Search the repository for any memsearch config or path references
rg -n '\.memsearch' --type=markdown
rg -n '\.memsearch' --type=json
# Check memsearch PyPI metadata for clues about storage paths
curl -s https://pypi.org/pypi/memsearch/json | jq '{home_page: .info.home_page, project_urls: .info.project_urls, description: .info.description}' | head -40Repository: yxtay/dotfiles
Length of output: 186
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate the relevant files and search for memsearch/allowWrite references.
git ls-files | rg '(^|/)(AGENTS\.md|claude-settings\.json|.*memsearch.*|.*settings.*)$' || true
printf '\n--- rg .memsearch across repo ---\n'
rg -n '\.memsearch' .
printf '\n--- rg memsearch across repo ---\n'
rg -n 'memsearch' .
printf '\n--- inspect chezmoi/.chezmoitemplates/claude-settings.json around allowWrite ---\n'
if [ -f 'chezmoi/.chezmoitemplates/claude-settings.json' ]; then
nl -ba chezmoi/.chezmoitemplates/claude-settings.json | sed -n '1,140p'
fi
printf '\n--- inspect AGENTS.md if present ---\n'
if [ -f 'AGENTS.md' ]; then
nl -ba AGENTS.md | sed -n '1,120p'
fiRepository: yxtay/dotfiles
Length of output: 825
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- chezmoi/.chezmoitemplates/claude-settings.json ---'
sed -n '1,180p' chezmoi/.chezmoitemplates/claude-settings.json
printf '\n%s\n' '--- chezmoi/.chezmoitemplates/AGENTS.md ---'
sed -n '1,120p' chezmoi/.chezmoitemplates/AGENTS.md
printf '\n%s\n' '--- chezmoi/.chezmoitemplates/memsearch_config.toml ---'
sed -n '1,220p' chezmoi/.chezmoitemplates/memsearch_config.toml
printf '\n%s\n' '--- chezmoi/private_dot_memsearch/modify_config.toml ---'
sed -n '1,120p' chezmoi/private_dot_memsearch/modify_config.tomlRepository: yxtay/dotfiles
Length of output: 7054
Add ~/.memsearch/ to allowWrite. memsearch_config.toml writes user profile data to ~/.memsearch/USER.md, so the sandbox still blocks that write path unless the directory (or at least that file) is allowed.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@chezmoi/.chezmoitemplates/claude-settings.json` at line 64, The allowWrite
list in the Claude settings template is missing the ~/.memsearch directory, so
memsearch_config.toml cannot write its USER.md profile file in the sandbox.
Update the allowWrite entries in the settings template to include ~/.memsearch/
(or the specific USER.md path) alongside the existing allowed directories,
keeping the change localized to the template that defines sandbox write access.
1 participant
Summary
~/.memory/, structured per the Open Knowledge Format spec, with rules for maintaining and re-indexing it via memsearch.~/.local/share/uvfor sandboxed writes sinceuvxneeds it to create temp files during tool invocation.Test plan
chezmoi applyrenders both files without diff driftuvx --from 'memsearch[onnx]' memsearch index ~/.memory --collection global-memoryruns without sandbox permission errorsSummary by CodeRabbit