
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
Sober: a shared rules-and-tools harness for Claude Code Pro and Codex Plus that cuts wasted AI quota.
Stop your AI coding agent from wasting tokens and making blind guesses.
Sober is not another AI. It is a small rules-and-tools package you install once on top of Claude Code or Codex CLI — the AI coding tools you already use.
After installing, you keep running claude or codex exactly as before. Sober quietly gives them better working habits:
Don't like it? Run sober uninstall to remove Sober-owned links, hooks, and ~/.sober while leaving your own config in place.
AI coding agents are powerful, but they waste quota in predictable ways:
| Without Sober | With Sober |
|---|---|
| Reads entire files to find one line | Finds file:line first |
| Guesses where code lives | Uses search tools before opening files |
| Rewrites more than necessary | Makes the smallest safe patch |
| Says "done" without proof | Runs the right verification |
| Repeats failed attempts | Stops, explains, and re-plans |
| Produces long summaries | Reports result, changed files, and test output |
The goal: spend model thinking on judgment, not on grep.
What survives even as models improve:
HANDOFF.md) instead of opaque DBs.This layered approach explains why we apply tools in a specific sequence:
| head) → Probe (structural) → mgrep (concept/semantic, last resort)--rewrite (mechanical) + Serena replace_symbol (type-aware)AGENTS.md / CLAUDE.md (static rules) + .serena/memories (architecture facts) + HANDOFF.md (session state)/context, /cost, /status and KPI logsAsk one scoped task
→ locate exact lines
→ change with the smallest safe edit
→ verify with build/tests
→ write a short handoff
→ measure before adding anything
The loop lives in AGENTS.md, the one rules file both runtimes read. Claude Code reads it through CLAUDE.md; Codex reads AGENTS.md directly.
npm install -g getsober@latest
sober setup
sober doctor
cd your-project
sober template . # Generates AGENTS.md, HANDOFF.md, etc. in your project.
claude # or: codex
To avoid confusion, files are installed in two distinct scopes:
~/): Created by sober setup.
~/.sober: The canonical source of truth for policies, hooks, and skills.~/.claude & ~/.codex: Configuration and rules injected by Sober../): Created by sober template.
your-repo/AGENTS.md: The project-specific policy spine.your-repo/HANDOFF.md: The session continuity memory for this specific project.Prompt with scoped tasks:
Fix the login timeout bug. Find the right lines first, make the smallest safe change, and verify with tests.
That's it. Sober runs in the background. Your daily commands are still just claude or codex.
Broad prompts without a stop condition waste the most quota. Always include what "done" looks like.
The single most important habit: tell the agent what to do, what not to touch, and how to verify.
Good prompt:
Change the payment retry timeout from 3s to 5s.
Keep behavior unchanged otherwise.
Verify with the existing payment tests.
Bad prompt:
Clean up this repo.
Skills are not terminal commands. They are small instruction packs that shape how the agent works. You rarely need to name them directly — just describe the behavior you want.
| Skill | When it helps | Example prompt |
|---|---|---|
karpathy | Every task | "Do only the requested change. Don't clean unrelated files." |
search-ladder | Finding code | "Find the relevant file:line first. Don't read whole files." |
edit-deterministic | Repeated changes | "Use a repeatable rewrite for all similar call sites." |
caveman | Long responses | "Report only result, changed files, tests, and risks." |
observe | Adding tools/rules | "Measure before and after. Keep it only if the metric improves." |
sober-review | Before commit | "Run the sober-review checklist. Report issues only. Don't edit." |
structure-graph | Large unfamiliar repos | "Map with structure-graph; before ANY edit, confirm the target exists with rg/Serena (one shot). Static graph misses runtime wiring." |
Don't push harder — redirect.
/analyze-failures in Claude Code to see patterns.Long conversations get noisy. Before stopping:
Summarize only: verified facts, remaining risks, and the next command to run.
Sober's handoff hook automatically writes a small HANDOFF.md with the current branch, last commit, and uncommitted changes when a session ends in a git project.
When you start a new session, ask the agent to read HANDOFF.md first to pick up where you left off.
For non-trivial changes, run a read-only review:
Run the sober-review checklist on this diff.
Report PASS or ISSUES only. Do not edit files.
This checks correctness, scope, complexity, style, verification coverage, and basic security — without touching any code.
Before adding any new tool, skill, or rule, run a before/after check. In Claude Code you can use Sober's /measure command; in Codex, use the same wording as a normal prompt:
/measure baseline
# make exactly one change to your setup
/measure after
Key metrics to watch: files read per task, output tokens, peak context fill, retry rate. If any metric gets worse, roll back.
sober install # apply / refresh policy files globally
sober setup # install + offer Context7 / search-edit toolkit
sober doctor # check install, deps, hooks, optional tools
sober template [dir] # add project-specific rules and HANDOFF.md
sober uninstall # remove Sober symlinks and ~/.sober (clean exit)
Sober works without these. They make the agent's work cheaper when installed.
| Tool | Why it helps | Boundaries (What not to do) |
|---|---|---|
ripgrep | Fast exact text search | Don't use for semantic/concept queries |
ast-grep | Mechanical code-shape rewrites | Use for previewed rewrites; use Probe for structural repo search |
| Probe | Index-free structural repo search | Read-only; cannot rewrite code |
| Serena | Symbol-aware navigation and edits through LSP | Fails to map runtime DI/AOP wiring |
Context7 / ctx7 | Current library docs instead of stale API memory | Not for project-specific business logic |
mgrep | Semantic search for concept queries (last resort) | Avoid for keyword/exact match (CoREB limit) |
sober setup # offers to install these interactively
sober doctor # shows what's present and what's missing
For Context7 directly:
npm install -g ctx7
ctx7 setup --cli --claude
ctx7 setup --cli --universal
For Codex MCP mode, enable Context7 explicitly:
codex mcp add context7 -- npx -y @upstash/context7-mcp --api-key YOUR_API_KEY
git commitHANDOFF.md file you can read and edit| Symptom | Fix |
|---|---|
| Agent says a hook is missing | sober doctor, then sober install |
| Search tool not found | Keep working, or run sober setup to install it |
| Verification runs wrong stack | ~/.sober/scripts/verify.sh --path <subdir> |
| Tool failures repeat | /analyze-failures in Claude Code, then re-plan |
| Output too long | Ask: "Show only result, diff, and file:line" |
your-repo/
├─ AGENTS.md # project-specific header + shared Sober spine
├─ CLAUDE.md # symlink to AGENTS.md (single source)
├─ HANDOFF.md # bounded, reviewed session state
└─ sgconfig.yml # optional, only with --with-sgconfig
┌──────────────────────────────────────────────────────────────┐
│ Sober │
│ shared home: ~/.sober │
│ │
│ ┌──────────────┬──────────────┬────────────────────────┐ │
│ │ AGENTS.md │ skills/ │ scripts/ │ │
│ │ shared rules │ tool habits │ safety + handoff hooks │ │
│ └──────────────┴──────────────┴────────────────────────┘ │
│ ↓ ↓ ↓ │
│ Claude Code Codex CLI project template │
│ ~/.claude ~/.codex AGENTS/HANDOFF │
│ ↓ ↓ ↓ │
│ merged settings hooks + rules local overrides │
└──────────────────────────────────────────────────────────────┘
~/.sober/AGENTS.md # shared policy source
~/.sober/commands/*.md # Sober-owned Claude slash commands
~/.sober/rules/*.md # Sober-owned Claude rules
~/.sober/skills/<skill>/SKILL.md # one copy of each skill
~/.sober/scripts/ # local hook and verification scripts
~/.sober/codex-rules/*.rules # installed copy of .sober/codex/rules
# Claude Code
~/.claude/CLAUDE.md # symlink to ~/.sober/AGENTS.md, or a managed @import block
~/.claude/AGENTS.md # symlink to ~/.sober/AGENTS.md, or a managed @import block
~/.claude/commands/<cmd>.md → ~/.sober/commands/<cmd>.md
~/.claude/rules/<rule>.md → ~/.sober/rules/<rule>.md
~/.claude/skills/<skill> → ~/.sober/skills/<skill>
~/.claude/settings.json # Sober hooks additively merged
# Codex CLI
~/.codex/AGENTS.md # contains/refreshes the Sober spine inline
~/.agents/skills/<skill> → ~/.sober/skills/<skill>
~/.codex/hooks.json # Sober hooks additively merged
~/.codex/rules/*.rules → ~/.sober/codex-rules/*.rules
| Hook | What it does |
|---|---|
critical-action-check | Blocks dangerous shell commands |
verify-gate | Warns before commit/push if changes are unverified (advisory-only) |
handoff-write | Writes HANDOFF.md on session stop |
session-start | Loads safe env vars and shows budget reminder |
compact-suggest | Suggests compaction when context gets long |
post-edit-format | Auto-formats edited files if a formatter exists |
tool-failure-log | Logs tool failures locally with secret redaction |
Codex runs the same hooks via ~/.codex/hooks.json. The sober-critical-actions.rules file adds an extra Starlark check for dangerous commands.
Sober ships a review checklist, not a fixed reviewer pipeline.
Use a separate helper only when it pays for itself: reviewing non-trivial changes with fresh eyes, exploring large unfamiliar repos, or running truly independent tasks in parallel.
Avoid fixed multi-agent chains for everyday work. The checklist is in .sober/skills/sober-review; the actual helper can be Claude Code's native subagent, a Codex helper, or a reviewer you already trust.
git clone https://github.com/move-hoon/sober.git
cd sober
npm test
npm pack --dry-run
Design decisions: docs/adr/ · Contributing: CONTRIBUTING.md
MIT — see LICENSE.
FAQs
Sober: a shared rules-and-tools harness for Claude Code Pro and Codex Plus that cuts wasted AI quota.
The npm package getsober receives a total of 54 weekly downloads. As such, getsober popularity was classified as not popular.
We found that getsober demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.