Set up an AI agent to run your Cockpit

AI Cockpit is local-first — it lives on your machine. You can teach any AI assistant (Claude, ChatGPT, Gemini, or a local agent like Aider/Goose/opencode) a short, reusable brief so it understands your setup and can help you run, update, and deploy your Cockpit — including transferring files for you — without ever handling your passwords or credentials.

Download the template: AI_AGENT_GLOBAL_TEMPLATE.md — fill in the blanks, then paste it into your agent's persistent memory. It ships blank; no personal data.

The idea

Give the agent one small, standing "working agreement" it reads every session. Keep that global note short — store bulky details as files in a single shared folder and let the agent load them only when a task needs them. One folder, referenced by pointer, works across every chat and every agent you use.

Where to paste it

Claude / Claude Code — ~/.claude/CLAUDE.md (user scope).
ChatGPT — Settings → Personalization → Custom Instructions (or Memory).
Gemini — Saved Info.
Local agents (Aider / Goose / opencode) — their rules or system-prompt file.

Note — this is your terminal agent. Agents the cockpit itself starts do not read ~/.claude/CLAUDE.md, your hooks or your plugins by default: they run against a cockpit-owned config holding only your login, so what they produce is shaped by the cockpit's own Mode and Style. That is deliberate — a terminal style hook would otherwise rewrite every answer the cockpit gives, invisibly. If you want your agents inside the cockpit to inherit your personal setup too, switch on the Use my global CLI config capability.

Safe deploys — the terminal handshake

For anything that needs your explicit permission (uploading files, running a script, installing software, sudo), the agent prepares a script, shows it to you first, then opens it in a terminal on your desktop. You supply any password there — the agent never sees it. Right before each step it prints a highlighted banner telling you what is happening, where (from → to), and why, so you always know what you are approving:

banner(){ printf '\n\033[1;30;43m  %s  \033[0m\n' "$*"; }
banner "UPLOAD index.html -> your-site/  (why: ship the latest fixes)"

The boundary never moves: the agent must never read your credential files to log in, and never type your passwords — even if you ask. Transfer tools load their own saved credentials, and sudo prompts you directly. Secrets never pass through the AI.

File transfers

The template includes an optional section for your transfer tool (FTP/SFTP/rsync). You point the agent at the tool and tell it the config lives in a file you control; the agent guides the setup while you enter the host and credentials. Per-project config keeps one tool serving many sites.

After a reinstall

Keep your shared folder on a partition that survives reinstalls. If it does, everything above keeps working — just hand the agent your filled-in brief again. If not, recreate the folder, reinstall your tooling, and re-paste the brief.