Scaling coding agents, part 2: one setup on every machine

In part 1 my agents spread across machines, but their setup was all manual and time consuming. At some point it started to drift on every machine. Good thing is that it’s fixable with one prompt, which I’m going to share below. Five machines now share one setup: a MacBook Air, three Linux boxes and a Windows PC.

The stack

• chezmoi applies a private dotfiles repo, templated per OS and machine.
• mise installs every CLI, the agents included.
• fnox loads secrets from a self-hosted Infisical. Each machine gets its own read-only identity.
• One apply script writes the same instructions, skills, plugins, hooks and MCP servers into Codex and every Claude profile, twice a day. I run two Claude accounts per machine through CLAUDE_CONFIG_DIR.
• One enroll command sets up a new machine over SSH.

I dropped skillpouch: heavy to self-host, and silent on several Claude profiles per machine.

Logins stay manual, one per profile per machine. I don’t use CLI proxies that share a provider login; a ban isn’t worth the saved minute.

The prompt

Paste this into Claude Code or Codex on your main machine:

Help me keep my coding-agent setup identical across my machines.

First interview me: which machines and OSes, which agents (Claude Code,
Codex, others), how many accounts or config folders each agent has per
machine, where I host git, where secrets should live, and what must stay
local to one machine. Then read my current configs and show me what has
drifted, before you change anything.

Build it from:
- a private dotfiles repo applied by chezmoi, templated per OS and machine
- mise for every CLI, the agent CLIs included, with a lockfile
- fnox for secrets, backed by a store that fits my machines (a password
  manager, a cloud secret store or age-encrypted files; suggest options),
  with separate read-only access per machine and no secret values in git
- one apply script that writes the same instructions, skills, plugins, hooks
  and MCP servers into every agent config folder on the machine (for Claude
  Code: ~/.claude plus any CLAUDE_CONFIG_DIR folders such as ~/.claude-*)
- a scheduled sync (launchd, a systemd timer or Task Scheduler)
- a one-command bootstrap I can run from my main machine over SSH, and a
  doctor check

Rules:
- Back up existing config and show a dry run before the first apply.
- In app settings files, merge only the keys you manage. Never sync login or
  state files such as ~/.claude.json or ~/.codex/auth.json.
- Manage only what the repo lists. Report local-only skills and MCP servers
  instead of deleting them.
- Assume agents and scheduled jobs don't read my shell: put secrets and
  package-registry settings (npm, pip and the like) where each tool reads
  them, and give MCP servers a helper that fetches their keys when they start.
- New shells must start fast with no network: cache secrets, time out fast.
- Turn off automatic tool installs, so one tool that fails to install can't
  block every other command.
- Run a secret scan and shellcheck on every commit.
- Keep logins manual, one per account per machine. Don't use proxies or
  shared tokens to sign in to AI providers.
- On macOS, test the scheduled job as the scheduler runs it: it can't reach
  the local network or external disks.
- If a machine runs Windows: switch on its SSH server once by hand, link
  skills with directory junctions, write files with LF endings, and expect
  Git for Windows' credential helper to break clones over SSH, PowerShell 5.1
  to drop empty arguments, and Documents to be redirected to OneDrive.
- Make every step safe to re-run. Run the bootstrap twice on a fresh machine
  of each OS, then the doctor check on every machine, before you call it done.