dsh-migrate-codex
A DeepSeek Harness plugin for safely migrating a Codex environment between machines.
Capabilities
/migrate-codex prepare <dir>: package the whitelisted repos and dirty snapshots;/migrate-codex verify <dir>: verify SHA256SUMS, bundle integrity, and credential exclusions;/migrate-codex restore <dir>: restore onto a new machine (aborts if the target exists);/migrate-codex restore-worktree <dir> <slug>: recreate one dirty worktree on demand;- Skill
codex-migration: teaches the agent the full workflow, the safety red lines, and how to align Codex configuration with DeepSeek Harness.
Install
dsh plugin --profile <name> add <repo URL or npm package>
# restart the Profile to take effect
Usage
Ask in a DSH session: "verify and restore the codex-migration bundle on my desktop", or run:
/migrate-codex verify ~/Desktop/codex-migration
/migrate-codex restore ~/Desktop/codex-migration
Custom whitelist
The published version ships placeholder examples only (example-primary, ...). Put your real table in bin/whitelist.local.tsv (gitignored, never committed), four columns per row:
slug<TAB>role<TAB>source-path<TAB>required
my-main-repo primary ~/my-main-repo yes
CODEX_MIGRATE_TABLE: path to a whitelist file;CODEX_MIGRATE_MAIN_SLUG: slug of the worktree-bearing main repo (default example-primary).
Safety design
- Whitelisted repositories only;
- git bundles carry commits but never
.git/config (no remote credentials leave the machine);
- SHA256SUMS integrity checks;
- credential exclusion list (auth.json / .env* / private keys / certs / SQLite);
- restore never overwrites an existing target and leaves no half-restored state on failure.
Roadmap
- Turn hardcoded old-machine paths into runtime arguments;
- Platform detection.
License
MIT
