Sync Agent Policy

Sync Agent Policy

One local policy file is the source of truth. This skill maps it onto each harness — it does not copy one agent's config onto another.

Hard Rules

• Policy file is SSOT. User paths live in ~/.config/agent-policy/policy.toml, never in this skill. Why: the skill is public; the deny list is personal.
• Status first; write only on explicit apply. apply is dry-run unless --write. Why: these files also hold allow-lists and unrelated hooks.
• Merge deny, keep everything else. Union missing tokens into deny. Do not replace allow, ask, MCP, or permission_mode.
• Emit native tokens. ~/ and // are not portable. Mapping is in references/adapters.md.
• Do not replace an existing regular guideline file. Only create missing files or retarget our own symlinks.

Dispatch

SCRIPT="$HOME/.claude/skills/sync-agent-policy/scripts/sync.py"
# fallback: $HOME/.agents/skills/sync-agent-policy/scripts/sync.py
python3 "$SCRIPT" status

-h documents init, status, map, apply.

Phases

1. Policy

   • ~/.config/agent-policy/policy.toml exists; else init (or init --from-claude)
   • Edit the file with the user if the starter deny list is wrong. guidelines lists markdown to project.

2. Diff

   • status (exit 1 = gaps). Show the table as-is.
   • map only when they ask how a path is spelled per agent.

3. Apply (only if they asked to apply, after they saw the table)

   • apply --write (add --hooks only when asked)
   • status again — remaining gaps are the report

Installed-but-disabled agents ([agents] grok = false) are skipped. Not-installed agents are reported, not created from scratch except for the specific config file apply must write.

Anti-patterns

• WRONG: copy ~/.claude/settings.json into Grok or Cursor. RIGHT: render tokens per adapters.md.
• WRONG: overwrite permissions / [permission]. RIGHT: union deny only.

Boundaries

Occasional check/apply, not a daemon. Codex and Windsurf are out of v1. Allow-lists, MCP, always-approve, sandbox.toml, and Orca/Herdr hooks stay untouched.