
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@hanzlaa/rcode
Advanced tools
rcode — the AI team that never forgets. Persistent memory, specialist agents, and slash commands for AI IDEs. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.
A curated composition of the best AI-development practices — shipped as files. Surgical-change discipline, parallel-agent orchestration, persistent Memory Bank patterns, phase-driven planning — packaged as one workflow for Claude Code power users. No multi-agent harness. No vector DB. Your IDE keeps the methodology; the project keeps the memory.
pnpm dlx @hanzlaa/rcode install
Status: @hanzlaa/rcode v4.0.0 on npm. 339 automated tests across 58 files, 45 agents, 116 commands, 86 skills. Actively dogfooded on real projects every week.
Built by Hanzla Habib. rcode is a curated composition of the best public AI-development practices — surgical-change discipline, parallel-agent orchestration, persistent Memory Bank patterns, phase-driven planning — packaged as one workflow for Claude Code power users. Every workflow, agent, and skill in this repo was designed in dialogue with the same LLM you'll be running. The methodology shipped here is the one used to build rcode itself.
One developer (Hanzla Habib) — building rcode with Claude, not just for it. Every workflow, agent, and skill in this repo was designed in dialogue with the same LLM you'll be running. The methodology shipped here is the one I use to build rcode itself.
That means two things:
If you're a solo dev or small team using Claude Code (or Cursor, Gemini, VS Code), rcode gives you the scaffolding a 10-person engineering org would have: code review standards, sprint cadence, decision archives, onboarding context — without hiring the org.
Three layers, specialised for software delivery:
| Layer | What lives here | Example |
|---|---|---|
| Memory | .rcode/memory/ — git-tracked markdown, lossless distillates | "We chose Postgres over Mongo because of JSON-B + RLS — see ADR-007" |
| Skills | rcode/skills/ — 85 phrase-activated playbooks | rcode-sprint-checker validates file/symbol refs before execute |
| Workflows | rcode/workflows/ — orchestrated multi-step paths | /rcode-plan runs research → planner → checker → confirm |
Single agent navigates the structure. No LangChain, no AutoGen, no orchestrator process. Just folders the model can read.
I've shipped products solo for years and watched the same failure repeat in every project:
rcode is the answer I built for myself. The decision lives in .rcode/memory/decisions.md. The agent reads it. Done.
Same problem at team scale: onboarding takes 30 minutes of archaeology. Late requirements shift goalposts with no audit trail. MVPs work but can't be revamped because the original "why" is gone. rcode checks the context in, so the next person (or session) starts oriented.
What you'll feel in week one:
.rcode/memory/ — agent reads them at session start automatically (~5K tokens, fully oriented)./rcode-new-project produces a roadmap with phases → sprints → tasks. /rcode-plan produces SPRINT.md files. /rcode-execute runs them with atomic commits. No Jira required./rcode-review --karpathy. Want a council debate on a decision? /rcode-council should I rewrite auth? — 5 agents answer in parallel, round 2 they challenge each other.rcode-tools health returns JSON — milestone health, state snapshot, project status. Wire it into your dashboard.<title> or schema markup.What you won't get:
I dogfood this hard, so the honest version:
| Cursor / Windsurf | CrewAI / AutoGen | LangChain / LlamaIndex | rcode | |
|---|---|---|---|---|
| Per-project memory | Per-user, not git-tracked | Vector DB | Vector DB + chunking | Git-tracked markdown |
| Specialist agents | 1 generalist | Define in Python | Define in Python | 45 shipped |
| Install | IDE extension | pip install + config | pip install + code | pnpm dlx — one command |
| Infrastructure | Cloud API | Python server | Vector store + indexer | Zero — pure files |
| IDE lock-in | Cursor only | Framework-specific | Framework-specific | Claude / Cursor / Gemini / VS Code / Antigravity / Windsurf |
| Auditability | Chat scrollback | Tracing dashboard | Tracing dashboard | git log |
The point isn't "I beat LangChain." The point is you don't need LangChain for software delivery. You need a methodology that survives session resets, and a methodology lives in files.
# 1. Install into any project (existing codebase or empty folder)
pnpm dlx @hanzlaa/rcode install
# 2. Restart Claude Code, then:
/rcode-init
/rcode-init detects your project state (fresh / existing / returning) and routes to the right first action. For a greenfield project it auto-routes to /rcode-new-project.
/rcode-council should I rewrite auth? → 5 agents debate, 2 rounds
/rcode-plan --research build a rental app → researcher grounds, sprint-checker verifies
/rcode-execute .planning/plans/01/PLAN.md → atomic commits + post-gates
/rcode-status → phases, decisions, blockers, sessions
Full install flavors and IDE options: docs/install.md. Step-by-step first project: docs/getting-started.md.
The directions I'm building toward — open to PRs on any of these:
Near-term (next 2 releases):
/rcode-discuss-phase already captures decisions; this would distill style and constraints too.~/.rcode/pillars/) for cross-project reuse — your voice, your review style, your testing standards live once, used everywhere.Mid-term:
.rcode/memory/ without merge conflicts.Long-term direction: The bet: methodology as a product. Skills, workflows, and agents become a portable "engineering org in a folder" that travels with you across projects, IDEs, and LLM vendors. The methodology outlives any specific model.
The non-goal: building yet another agent framework. There are enough. rcode stays files.
رحّال (Rihāl) means "traveler" in Arabic — someone who carries knowledge between places. The persona names (Sadiq, Waleed, Fatima, Hussain, etc.) are Arabic placeholders. Swap them for your team in rcode/team.yaml. The methodology is the persona, not the names.
Named for the Arabic root رحال (rahhal) — the traveler. rcode walks alongside your code as a persistent companion across sessions.
| Document | What's in it |
|---|---|
DOCS.md | Complete docs — install, concepts, all commands, Memory Bank, dashboard, testing, architecture |
docs/getting-started.md | Step-by-step first project |
docs/TIERS.md | Starter / Advanced / Power-user paths |
docs/dogfeed-flows.md | Live dogfeed log — every Q&A flow, every bug found, every fix shipped |
MEMORY_BANK.md | Memory Bank specification |
BRAND.md | Naming, voice, persona glossary |
CHANGELOG.md | Release history |
Released under the MIT License. Use it, fork it, ship it.
FAQs
rcode — the AI team that never forgets. Persistent memory, specialist agents, and slash commands for AI IDEs. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.
We found that @hanzlaa/rcode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.