sync-librarylisted

# Sync the central library Use when you want your agentstack central library — the skills and MCP servers you reference by name — to be the same on every machine (laptop, desktop, a fresh box). ## The idea The library lives at `~/.agentstack/lib/`. Version it as a git repo and push/pull it across machines. git is the right tool here: versioned, offline-friendly, no daemon, and it diffs cleanly. **Never fetch a skill from another machine by hand (scp/rsync/ssh).** A raw copy skips the content scan (prompt-injection gate), records no provenance, and has no checksum — an unauditable fork the lockfile can't reproduce. If a skill you need lives on another device, sync the library (below); the skill then resolves by name everywhere. ## The built-in way (preferred) agentstack ships a wrapper that does the whole flow — and refuses to push if a server definition holds a literal secret in **any** field (headers, env, url, args), can't be parsed (the gate fails closed rather than skipping it), or if one is still buried in an outgoing commit. `--allow-secrets` overrides, deliberately: ```bash # first machine — set it up and push: agentstack lib sync --init --remote <your-remote> agentstack lib sync # commit local changes, pull, push # a fresh machine — clone the library into place: agentstack lib sync --init --remote <your-remote> agentstack lib sync --status # working-tree changes + ahead/behind ``` ## What travels vs. what doesn't - **Travels:*