{ "source_file": "0930", "source_platform": "Dev.to", "author": "Edward Izgorodin", "title_listed": "Why does my AI coding assistant ignore my CLAUDE.md, AGENTS.md and Cursor rules?", "keywords": "", "domain": "大模型算法", "content_type": "深度技术解析", "is_paid_flag": "否", "url": "https://dev.to/izgorodin/why-does-my-ai-coding-assistant-ignore-my-claudemd-agentsmd-and-cursor-rules-1h3o", "publish_date": "2026-09-21", "corpus_stage": "", "notes": "", "id": "9112d2e985d0", "collected_at": "2026-10-02T14:03:02", "title": "Why does my code editor AI keep overriding custom repository guidelines every session? - DEV Community", "body_markdown": "You put one line in\nCLAUDE.md\n: never push directly to main. You ask the assistant what the project rules are, and it reads that line back to you word for word. Twenty minutes into a refactor it runs\ngit push origin main\n. So you write the rule in capitals, add IMPORTANT in front of it, copy it into\nAGENTS.md\nfor good measure, and a week later it happens again.\nThe question people type after that is some version of how to stop an AI coding assistant from forgetting project rules across sessions. It did not forget. The rule arrived, the model read it, and nothing in a rules file was ever going to stop the push. That is not my reading of the situation. All three vendors say it on their own pages, and one of them tells you what to use instead.\nOne line to carry: a rules file asks, a permission rule or a hook refuses, and even the refusing layer has a form it does not catch and a way to fail open, so the rule that must hold every time belongs in the last layer, the one that never reads your prose at all.\nThree files, three vendors, the same sentence\nCLAUDE.md\n, from Anthropic's\nmemory documentation\n:\nClaude treats them as context, not enforced configuration. To block an action regardless of what Claude decides, use a PreToolUse hook instead.\nAGENTS.md\n, from\nits own page\n:\nA simple, open format for guiding coding agents\nand a line below that:\nThink of AGENTS.md as a README for agents: a dedicated, predictable place to provide the context and instructions to help AI coding agents work on your project.\nCursor rules, from\nCursor's documentation\n, which is the most mechanical of the three:\nLarge language models don't retain memory between completions. Rules provide persistent, reusable context at the prompt level. When applied, rule contents are included at the start of the model context.\nThe same Cursor page treats the formats as interchangeable: \"If you prefer plain markdown, use AGENTS.md instead.\"\nContext. Guiding. A README. Included at the start of the model context. None of the three claims the file binds anything, and none of them is hiding it. The idea that a rules file enforces a rule is something readers bring to it, because the file is called rules.\nHow the rule actually reaches the model\nAnthropic's memory page answers this directly:\nCLAUDE.md content is delivered as a user message after the system prompt, not as part of the system prompt itself. Claude reads it and tries to follow it, but there's no guarantee of strict compliance\nA user message. Not a configuration value, not a system instruction. Your rule sits in the conversation next to your actual task, next to whatever the last tool call returned, next to the file somebody else committed, and it competes with all of it on the same terms.\nOne person who put mitmproxy between the client and the model, while trying to understand why adherence to their\nCLAUDE.md\nhad slipped,\nreported on Hacker News\nwhat the file was wrapped in at the time:\nIMPORTANT: this context may or may not be relevant to your tasks. You should not respond to this context unless it is highly relevant to your task.\nThe comment is from July 2026 and describes what they saw about six months earlier, so it is their observation at that time, not a claim about today's build. It does not need to be current to make the point, because the vendor's own sentence above already says the same thing in plainer words: the model reads the file and tries.\nThe people who meet this in practice describe it the same way. From\nclaude-code#87825\n, open at the time of writing:\nThe rule was in memory. Claude had read it. Claude pushed directly to main three times.\nAnd from\nclaude-code#75334\n, a different person: \"Memories are written but not acted on.\"\nReading and obeying are two different failures\nBefore changing anything, find out which one you have, because they have unrelated fixes.\nFirst, ask the assistant to state your rule back. If it cannot, the rule is not arriving, and the fix is about delivery: wrong file name, wrong directory, wrong scope, a setting that excludes it. Nothing further matters until this passes.\nSecond, only if the first passed, put the assistant in the situation the rule governs and watch. If it states the rule correctly and then does the thing anyway, delivery works and nothing is enforcing. That outcome is not a malfunction. There is no obedience layer to malfunction, only a sentence in a context window and a model deciding.\nIf the decision has to go your way every time, the decision cannot be the mechanism.\nWhat refuses, in the vendors' own words\nAnthropic's\npermissions page\ndraws the line in one note:\nPermission rules are enforced by Claude Code, not by the model. Instructions in your prompt or\nCLAUDE.md\nshape what Claude tries to do, but they don't change what Claude Code allows.\nThe rule that stops the push in the opening scene is a deny rule in\n.claude/settings.json\n. This is the shape the same page uses for its own example:\n{\n\"permissions\"\n:\n{\n\"deny\"\n:\n[\n\"Bash(git push *)\"\n]\n}\n}\nEnter fullscreen mode\nExit fullscreen mode\nTwo details on that page change how you should write these. A deny rule wins over everything else: \"An allow rule can't carve an exception out of a deny rule.\" And a deny rule behaves differently depending on its shape. A bare tool name \"removes the tool from Claude's context entirely, so Claude never sees it\", while a scoped one like\nBash(rm *)\n\"leaves the tool available and blocks matching calls when Claude attempts them\". The first is not a refusal at all. The model is never shown the tool, so there is nothing to refuse.\nThe refusing layer has its own gaps\nThis is the part most advice stops before, and the vendors document it themselves.\nA Bash deny rule matches the command text, not the program. The permissions page says a deny or ask rule \"covers the invocation Claude usually produces and isn't a security boundary around the program\", and its own table lists what\nBash(git push *)\ndoes not stop:\ngit -C . push origin main\n,\ngit -c push.default=current push origin main\n,\ngit 'push' origin main\n. For enforcement that does not depend on the command text, the page points elsewhere: \"For filesystem and network enforcement that doesn't depend on the command text, use sandboxing.\"\nA hook sees the full command and runs your own logic on it. In Claude Code that is a\nPreToolUse\nhook, written as the\nhooks guide\nshows, and the permissions page states its precedence: \"A hook that exits with code 2 stops the tool call before permission rules are evaluated\". In Cursor it is a\nbeforeShellExecution\nhook in\nhooks.json\n, and\nCursor's hooks page\nlists exit code 2 as \"Block the action\".\nAnd a hook can fail open. Cursor states it plainly: \"Crashes, timeouts, and non-zero exit codes other than 2 fail open by default: Cursor logs the failure and allows the action through.\" It offers\nfailClosed: true\nto change that. Claude Code's guide describes the same default in more steps: for any exit code other than 0 and 2, with plain text or nothing on stdout, \"the action proceeds as a non-blocking error.\" The quietest failure does not even reach that branch. The guide's example scripts read the command with\njq\n. On a machine where\njq\nis not installed that line yields an empty string, nothing matches, the script reaches\nexit 0\n, and the command goes on as if the hook were not there.\nNone of this makes hooks or deny rules weak. It means each layer has a known gap, and it is worth knowing which gap you are standing in.\nlayer\nwhat it does\nwhat gets past it\nrules file:\nCLAUDE.md\n,\nAGENTS.md\n, Cursor rules\nputs your sentence in the context window\nthe model deciding otherwise\npermission deny rule\nrefuses the command text it matches\nthe same program invoked another way\nhook:\nPreToolUse\n,\nbeforeShellExecution\nruns your code on the full command first\na hook that crashes or times out, by default\nthe system the action lands on: a protected branch, file permissions, a sandbox\nrefuses whatever sent the request\nnothing the assistant writes\nFor never push to main, the last row is the one that holds every time: a protected branch on the hosting side, set so that nobody can bypass it, refuses the push whether it came from the assistant, from a teammate, or from you at two in the morning. The rules file is still worth keeping, because it makes the assistant try the right thing first and saves you the refused attempt. It just cannot be the thing you rely on.\nWhen a rules file is exactly the right tool\nIf what you need is the same instructions in front of the model every session, a file in your repository does that. It costs nothing, you can read it, your team reviews it in a pull request, and it is already installed. For style, conventions, which test command to run and where things live, that is the whole answer and there is nothing to buy.\nIf what you need is for something to not happen, no rules file and no memory layer will do it, whoever sells it. Storage is not enforcement. Use the layer that runs outside the model.\nA memory layer is for a narrower job than either: facts that accumulate over time, that nobody wrote down by hand, and that need to be present in a session you have not started yet, sometimes in a tool you were not using when they were learned. That is a real problem, and it is a different one from the push in the opening scene.\nWhich rule in your\nCLAUDE.md\nor\nAGENTS.md\nhave you watched get read back correctly and broken anyway, and which of the four layers finally stopped it?\nDisclosure: I work on\nMnemoverse\n, a memory layer for AI agents that connects over MCP. Nothing of ours appears in this article, and its conclusion is partly an argument against buying a memory layer for this problem. The longer version with every source is on our library, and the MCP server is open source (MIT):\ngithub.com/mnemoverse/mcp-memory-server\n.", "metadata": { "title": "Why does my code editor AI keep overriding custom repository guidelines every session? - DEV Community", "description": "You put one line in CLAUDE.md: never push directly to main. You ask the assistant what the project... Tagged with ai, programming, cloud, agents.", "keywords": "ai, programming, cloud, agents, software, coding, development, engineering, inclusive, community", "author": null, "og:type": "article", "og:url": "https://dev.to/izgorodin/why-does-my-ai-coding-assistant-ignore-my-claudemd-agentsmd-and-cursor-rules-1h3o", "og:title": "Why does my code editor AI keep overriding custom repository guidelines every session?", "og:description": "You put one line in CLAUDE.md: never push directly to main. You ask the assistant what the project...", "og:site_name": "DEV Community", "og:image": "https://media2.dev.to/dynamic/image/width=1200,height=627,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fh7op64rpoik9k58f5pnx.png", "twitter:site": "@thepracticaldev", "twitter:creator": "@", "twitter:title": "Why does my code editor AI keep overriding custom repository guidelines every session?", "twitter:description": "You put one line in CLAUDE.md: never push directly to main. You ask the assistant what the project...", "twitter:card": "summary_large_image", "twitter:widgets:new-embed-design": "on", "twitter:image:src": "https://media2.dev.to/dynamic/image/width=1200,height=627,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fh7op64rpoik9k58f5pnx.png" }, "paywall": { "listed_paid": false, "detected": false, "marker": "", "public_only": false, "policy": "付费/会员内容只保留页面公开可见部分，不绕过付费墙" }, "crawl": { "success": true, "status_code": 200, "error": "" }, "code_blocks": [ { "file": "attachments/9112d2e985d0/code/body-000.txt", "chars": 72, "language": "text" } ], "images": [], "audio": [], "videos": [], "links": [ { "href": "https://code.claude.com/docs/en/memory", "label": "memory documentation", "type": "a" }, { "href": "https://agents.md/", "label": "its own page", "type": "a" }, { "href": "https://cursor.com/docs/context/rules", "label": "Cursor's documentation", "type": "a" }, { "href": "https://news.ycombinator.com/item?id=49055504", "label": "reported on Hacker News", "type": "a" }, { "href": "https://github.com/anthropics/claude-code/issues/87825", "label": "claude-code#87825", "type": "a" }, { "href": "https://github.com/anthropics/claude-code/issues/75334", "label": "claude-code#75334", "type": "a" }, { "href": "https://code.claude.com/docs/en/permissions", "label": "permissions page", "type": "a" }, { "href": "https://code.claude.com/docs/en/hooks-guide", "label": "hooks guide", "type": "a" }, { "href": "https://cursor.com/docs/agent/hooks", "label": "Cursor's hooks page", "type": "a" }, { "href": "https://mnemoverse.com/", "label": "Mnemoverse", "type": "a" }, { "href": "https://github.com/mnemoverse/mcp-memory-server", "label": "github.com/mnemoverse/mcp-memory-server", "type": "a" } ], "repair_version": 2, "repaired_at": "2026-10-14T10:49:25Z", "source_url": "https://dev.to/izgorodin/why-does-my-ai-coding-assistant-ignore-my-claudemd-agentsmd-and-cursor-rules-1h3o", "papers": [], "actual_video_files": [], "body_chars": 9835, "expected_body_images": 0, "discovery_status": "ok", "delivery_status": "ok", "missing_reason": "", "raw_html": "attachments/9112d2e985d0/pages/source.html", "local_html": "attachments/9112d2e985d0/pages/article.html", "body_base_path": "attachments/9112d2e985d0/pages/", "body_markdown_path": "attachments/9112d2e985d0/pages/article.md" }