@aiwayds/dsh-vault
dsh-plugin：通过私有 GitHub 仓库对 dsh home 配置进行加密备份 / 恢复 / 迁移
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add @aiwayds/dsh-vault@0.7.0Vault 以 @aiwayds/dsh-vault 发布，当前版本为 0.7.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 中文
A dsh plugin that backs up your dsh home config — encrypted — to your own private GitHub repo, and pulls it flat onto a new machine with one command: restore the config, reinstall plugins from the manifest. Cross-machine restore doubles as migration.
Requires dsh >= 0.2.0-rc.2 — this plugin targets the dsh RC/stable line only (CI and releases resolve the newest of the latest/next dist-tags at runtime). The alpha line is no longer supported.
Zero npm dependencies: encryption uses only Node's built-in crypto (scrypt + AES-256-GCM); GitHub transfer goes through the REST API.
/vault backup [passphrase] Back up and push (creates the private repo if missing)
/vault list Table of every machine's backup in the vault
(machine / description / snapshot time / file count / size, ← this machine)
/vault restore [machine] [--yes] [passphrase]
No machine name = list snapshots
Picking another machine = migration; --yes actually executes
/vault config Show current settings
/vault set repo <owner/name> Override the default vault repo name
/vault set machine-desc <desc> Machine description (recorded in the snapshot manifest,
for identification when picking across machines)
/vault set remember-passphrase on|off
When on, the next backup with a passphrase stores it in
the macOS keychain for automatic reuse
Since dsh 0.1.7 a legacy settings.yaml is imported once at boot and renamed
settings.yaml.imported; plugin settings live in the profile patch instead.
The config entry is dsh-vault in ~/.dsh/profiles/<profile>/cordis.patch.yml — the same entry /vault set writes back to (hot, no restart):
- id: dsh-vault
name: '@aiwayds/dsh-vault'
config:
repo: "" # owner/name override; empty = default dsh-backup-<login>
machineDescription: "" # human label recorded in the snapshot manifest
rememberPassphrase: false # store the passphrase in the macOS keychain on backup
A pre-upgrade top-level vault: section in settings.yaml does not migrate
automatically (the entry id is dsh-vault, the old section was vault) — the
original lines survive in settings.yaml.imported; re-enter them with
/vault set.
Passphrase sources, in order: inline command argument (never logged) →
$DSH_VAULT_PASSPHRASE → the macOS keychain (when rememberPassphrase is
on). GitHub credentials come from $GITHUB_TOKEN or a logged-in gh CLI.
The plugin ships a bundled skill (dsh-vault-config): ask the agent to configure
backups or run a first backup and the guide loads automatically — it walks
the choices interactively (repo, machine description, passphrase memory) and
writes the dsh-vault config entry for you.
dsh plugin --profile tui remove @aiwayds/dsh-vault
The host cleans up the profile automatically: the dsh.profile.bundles entry is spliced and the plugin's patch layer drops. This is a secrets/backup plugin, so be explicit about what outlives the removal — none of it is touched by remove:
dsh-vault) holding a remembered passphrase. Turn it off before uninstalling with /vault set remember-passphrase off, or delete the item afterwards in Keychain Access.dsh-backup-<login> holding your encrypted snapshots (auto-created on first backup) — delete it on GitHub if unwanted.~/.dsh/vault/stash/ — up to 3 pre-restore stashes of the full config, including .credentials.yaml (mode 0600). Purge with rm -r ~/.dsh/vault.dsh-vault config entry in the profile patch (cordis.patch.yml) and the archived vault: section inside ~/.dsh/settings.yaml.imported — remove the lines by hand.In: settings.yaml, settings.yaml.imported (the archived pre-0.1.7 settings; backed up when present), .credentials.yaml (API keys), APPEND_SYSTEM.md, agents/, each profile's manifest four-pack (package.json / pnpm-lock.yaml / pnpm-workspace.yaml / cordis.patch.yml — the patch is where 0.1.7+ plugin settings live), the home-level cordis.patch.yml, and models-store.json.
Out: sessions/, storages/, every node_modules (reinstalled from the manifest), cordis.yml (unconditionally rewritten by the host at startup), .anonymous-user-id, usage stats.
recordInput: false, never lands in session logs) → the $DSH_VAULT_PASSPHRASE env var → the macOS keychain (stored automatically when remember-passphrase on).~/.dsh/vault/stash/ (last 3 kept).$GITHUB_TOKEN or a logged-in gh CLI; login is not this plugin's job.dsh-backup-<github username>/ ← private; override with /vault set repo
└── machines/<hostname>/
├── snapshot.enc ← encrypted snapshot (latest only, overwrite by design)
└── manifest.json ← plaintext metadata (machine / description / time / file
list — no key material)
file: absolute-path deps in a profile manifest (locally linked plugins) are invalid on another machine; restore warns about them and you handle those manually..env and storages/ (machine-absolute paths) don't migrate; session history doesn't migrate.dsh CLI and pnpm on PATH.pnpm install && pnpm build && pnpm test # unit tests (24)
node scripts/smoke-boot.mjs # real-host boot smoke (scratch profile)
node scripts/e2e-host.mjs # real GitHub round-trip (sandbox home + scratch repo)
./e2e/run-e2e.sh # podman container e2e (isolated ~/.dsh)
Design docs: CONTEXT.md (glossary) and docs/adr/ (backup-set boundary, encryption scheme, overwrite snapshots, single-repo multi-machine layout).