I went the other direction on this and made the runner something you host instead of making the agent portable. That’s a project I’m working on, TaskHandoff (https://docs.thandoff.com/), so flagging it as self-promo up front.
The reasoning: with a portable folder the environment moves, but the machine you’re sitting at still has to trust whatever the agent does there. With a self-hosted workbench you register your machines as workspaces once, then dispatch a task from the web UI and the session runs on the box you picked - local or remote. Sessions, credentials and task history stay on your side, and “moving between machines” becomes opening the UI from any of them rather than carrying the folder.
It doesn’t replace the offline USB-stick case, that one still has no good answer. But for “same agent environment on three machines” the registered-workspace model is what actually stuck for me.
Out of curiosity - did you hit provider key sync issues when moving between machines? That was our other pain point, and it’s part of why we kept credentials in one place.
The llms.txt angle here is a good illustration of how quickly an agent turns text into execution. The structural issue is that the agent runs as a trusted local user, with whatever file and network permissions the developer’s machine happens to have.
Two things that helped in our case (I build a self-hosted agent workbench, TaskHandoff - docs at https://docs.thandoff.com/, so this is self-promo):
Neither of these solves prompt injection and I don’t want to pretend otherwise. It changes the failure mode from “a repo file executed on a laptop holding cloud credentials” to “a sandboxed workspace got weird and a human rejected the diff”.
Genuinely curious whether anyone has seen tooling that flags instruction-file-sourced commands explicitly, instead of leaning on diff review after the fact.