Getting Started

Who this is for

• Individual developers who want a coding assistant that runs on their own laptop and drives their existing claude CLI. No API keys plumbed through rousseau's config, no cloud broker in the middle.
• Platform operators running a shared coding agent for a team behind a corporate perimeter. Rousseau is a single static Go binary in a rootless Podman container with dropped capabilities — deployable next to any other systemd service.
• Security reviewers vetting an agent before rollout. SLSA-3 provenance, cosign-signed release checksums, CycloneDX SBOM, reproducible builds, and every trust boundary is documented in Security.

The fastest path

1. If you already have the claude CLI installed and authenticated, the fastest start is rousseau chat with the default claudecli provider — auth is inherited, no keys to plumb. Continue with First run below.
2. If you want a direct API path with your own key, set ANTHROPIC_API_KEY and switch provider: anthropic in ~/.config/rousseau/config.yaml. See Anthropic provider.
3. If you're in an enterprise with AWS Bedrock or Google Vertex, pick the matching provider — Bedrock uses the standard AWS credential chain; Vertex reads a service-account JSON. No secrets sit in rousseau's config file.
4. If you're air-gapped or want fully self-hosted inference, point rousseau at an OpenAI-compatible endpoint — Ollama, vLLM, LM Studio, or any shim. See OpenAI-compatible provider.

What you'll have at the end

• A rousseau binary on $PATH verified against a cosign signature (release path) or built from source (make check runs the same 18-linter + race + govulncheck gate CI enforces).
• A working rousseau chat TUI backed by whichever provider you picked.
• A SQLite session store at ~/.local/share/rousseau/sessions.db — every turn is persisted, cross-session recall via FTS5 is available.
• Optionally: one live chat transport (WhatsApp, Slack, Signal, ...) reachable from your phone.

Prefer to watch?

A short screencast of the flow below is on the roadmap. Until then, the whole ceremony fits on this page — most operators finish in under ten minutes.

System requirements

Install

From source

git clone https://github.com/sebastienrousseau/rousseau-agent
cd rousseau-agent
make build          # produces ./bin/rousseau
./bin/rousseau version

make check runs vet, golangci-lint, go test -race, and govulncheck — the same gates CI enforces.

Via go install

go install github.com/sebastienrousseau/rousseau-agent/cmd/rousseau@latest

The binary embeds modernc.org/sqlite, so there is no libc or CGo dependency at runtime.

From a signed release

Every tagged release publishes a checksummed archive, a CycloneDX SBOM, a SLSA-3 provenance attestation, and a cosign signature of the checksum file. Always verify before running:

cosign verify-blob \
  --certificate-identity-regexp 'sebastienrousseau/rousseau-agent' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --signature rousseau_<version>_checksums.txt.sig \
  rousseau_<version>_checksums.txt

sha256sum -c rousseau_<version>_checksums.txt

The certificate-identity regex is what pins the signer identity; do not weaken it.

First run

Terminal chat

rousseau chat

Bubble Tea TUI. Enter to send, Ctrl+C to quit. The default provider is claudecli, which inherits authentication from your local Claude Code install; no API keys are plumbed through rousseau's config.

Session history persists to ~/.local/share/rousseau/sessions.db (SQLite with WAL journaling and FTS5 for cross-session recall).

First chat transport

WhatsApp is the reference transport (pairing UX is the most stringent). Pair on first launch by scanning the QR from your phone:

rousseau whatsapp --allow 447900123456@s.whatsapp.net

The E.164 JID (<digits>@s.whatsapp.net) restricts inbound handling; every other sender is silently dropped. Pairing state is stored in whatsapp.db alongside the session store.

Other transports follow the same shape:

rousseau slack   --app-token xapp-... --bot-token xoxb-...
rousseau discord --token bot-token
rousseau telegram --token 12345:ABC
rousseau matrix  --homeserver-url https://matrix.org --access-token ... --user-id @bot:matrix.org

Every rousseau <transport> --help lists its flags. Defaults come from ~/.config/rousseau/config.yaml.

Where state is stored

Path	Purpose
~/.config/rousseau/config.yaml	User-level configuration file (Viper).
~/.local/share/rousseau/sessions.db	Sessions, cron jobs, JID map, FTS5 recall index.
~/.local/share/rousseau/whatsapp.db	Whatsmeow device credentials (kept separate so a device relink does not touch conversations).
~/.claude/	claude CLI OAuth tokens, only when using the claudecli provider.

Next steps

• Concepts — the agent loop, session store, MCP, cron, skills.
• Configuration — every knob.
• Deployment — how to run the daemon under systemd.