Agent Compiler
Agent Compiler is the migration path for teams that already invested in custom agents. It discovers provider-specific files, comprehends them into a typed neutral model, reports fidelity and security risks, deduplicates against maintained packages, and waits for human blessing before rendering.
Why compile instead of copy
A copied prompt remains tied to one provider and has no review boundary. A compiled agent gains a canonical model, an orchestration graph, a fidelity report, catalog dedupe, security scanning, cross-provider rendering, and an auditable governance state.
- Preserve the agents your team already trusts
- See lossy mappings and dangling handoffs before publishing
- Avoid maintaining a duplicate of an existing catalog agent
- Quarantine secrets or unsafe instructions before review
- Render one blessed model to every configured supported provider
1. Preview the import locally
Run the dry mode from a repository root. It scans .claude/agents/*.md and .github/agents/*.agent.md, assembles related agents into bundles, redacts detected secrets, and prints the batch and fidelity plan. It does not require authentication and sends nothing.
2. Send candidates to review
Connect the machine, ensure the repository resolves to the intended workspace, then import. Clean agents enter Pending; agents with unresolved security threats enter Quarantined.
Imported-agent governance is currently available on the Team plan and above.
3. Review the compiled result
Open Agent Compiler in the dashboard. Review provenance, provider origin, orchestration role, dedupe matches, fidelity notes, canonical instructions, and any security findings before making a decision.
- Bless only when the canonical behavior matches the source intent
- Prefer the maintained catalog package when dedupe finds a strong match
- Reject stale or redundant agents
- Resolve quarantined findings at the source and import again
4. Bless and republish
Blessing persists the governed bundle and sends the neutral representation through the same production renderer used by first-party agents. Provider-native Claude Code and GitHub Copilot files are emitted from that one source.
5. Enforce local safety policy
Rendered Claude Code configuration includes the local nepopsx guard PreToolUse hook. The guard evaluates tool calls against built-in safety rules and .nepopsx/policy.json without a network request on the hot path. Explicit matches are denied; guard failures soft-fail so the session is never crashed by the policy engine itself.
- Block edits to sensitive environment files
- Block destructive or force-push commands
- Extend built-in rules with repository-local policy