Limits
stele makes your rules hard to miss. It doesn’t make them impossible to break. Here’s where it stops, so nothing surprises you.
The short version
| Limit | What covers it |
|---|---|
| A missing, crashed or timed-out hook lets writes through | stele check in CI |
| Bash, NotebookEdit and PowerShell writes aren’t checked | stele check in CI |
| The agent can ignore the rules | Blocks after a write, then CI |
| A regex sees text, not code | Precise patterns, review |
| Rules are chosen by path, not by task | Few unscoped rules |
If you remember one thing, run stele check in CI. It covers most of this list.
The agent can still say no
stele shows the agent your rules and tells it about violations. It can’t force the agent to obey. A block is a strong message, but it’s still a message.
Only Write, Edit and MultiEdit are checked
The agent is told to write files with those tools. If it uses a shell command instead, the hook usually can’t check what it wrote.
stele does spot simple cases, like > or sed -i. It stops those once and tells the agent to use Write or Edit. If the agent runs the same command again, it goes through unchecked.
A regex only sees text
A pattern can match inside a comment or a string, and it can’t understand your code. Patterns can’t use lookaround or backreferences either.
After an Edit, only the new lines are checked
Older violations in the same file are left for stele check.
Rules are chosen by path
stele picks rules by the file being written, not by what the task is about. That’s why rules with no scope should stay few: they show up for every file.
Some files are skipped
Binary files and files over 32 MiB aren’t checked. stele tells you when it skips one.
Folders with their own rules are separate projects
A folder with its own stele.md or stele.json gets only its own rules. The same goes for a git submodule or worktree. Run stele check in each of them.
What stays on your machine
stele makes no network calls, except stele publish when you run it.
The rules and violations it shows the agent become part of the conversation, and Claude Code sends that to the model as usual.
Upgrading from an older stele
Older versions don’t understand --remind and --check. If your hooks use those switches, upgrade stele before you run stele init again, or you’ll end up with a second set of hooks.