@aiwayds/dsh-vault
dsh-plugin：通过私有 GitHub 仓库对 dsh home 配置进行加密备份 / 恢复 / 迁移
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:fan56/dsh-vault#e05bbff7f2ddd7009567db1a05dced1786cc50dbVault 以 @aiwayds/dsh-vault 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 中文
A dsh plugin that backs up your dsh home config — encrypted — to your own private GitHub repo, and pulls it flat onto a new machine with one command: restore the config, reinstall plugins from the manifest. Cross-machine restore doubles as migration.
Zero npm dependencies: encryption uses only Node's built-in crypto (scrypt + AES-256-GCM); GitHub transfer goes through the REST API.
/vault backup [passphrase] Back up and push (creates the private repo if missing)
/vault list Table of every machine's backup in the vault
(machine / description / snapshot time / file count / size, ← this machine)
/vault restore [machine] [--yes] [passphrase]
No machine name = list snapshots
Picking another machine = migration; --yes actually executes
/vault config Show current settings
/vault set repo <owner/name> Override the default vault repo name
/vault set machine-desc <desc> Machine description (recorded in the snapshot manifest,
for identification when picking across machines)
/vault set remember-passphrase on|off
When on, the next backup with a passphrase stores it in
the macOS keychain for automatic reuse
In: settings.yaml, .credentials.yaml (API keys), APPEND_SYSTEM.md, agents/, each profile's manifest four-pack (package.json / pnpm-lock.yaml / pnpm-workspace.yaml / cordis.patch.yml), the home-level cordis.patch.yml, and models-store.json.
Out: sessions/, storages/, every node_modules (reinstalled from the manifest), cordis.yml (unconditionally rewritten by the host at startup), .anonymous-user-id, usage stats.
recordInput: false, never lands in session logs) → the $DSH_VAULT_PASSPHRASE env var → the macOS keychain (stored automatically when remember-passphrase on).~/.dsh/vault/stash/ (last 3 kept).$GITHUB_TOKEN or a logged-in gh CLI; login is not this plugin's job.dsh-backup-<github username>/ ← private; override with /vault set repo
└── machines/<hostname>/
├── snapshot.enc ← encrypted snapshot (latest only, overwrite by design)
└── manifest.json ← plaintext metadata (machine / description / time / file
list — no key material)
file: absolute-path deps in a profile manifest (locally linked plugins) are invalid on another machine; restore warns about them and you handle those manually..env and storages/ (machine-absolute paths) don't migrate; session history doesn't migrate.dsh CLI and pnpm on PATH.pnpm install && pnpm build && pnpm test # unit tests (24)
node scripts/smoke-boot.mjs # real-host boot smoke (scratch profile)
node scripts/e2e-host.mjs # real GitHub round-trip (sandbox home + scratch repo)
./e2e/run-e2e.sh # podman container e2e (isolated ~/.dsh)
Design docs: CONTEXT.md (glossary) and docs/adr/ (backup-set boundary, encryption scheme, overwrite snapshots, single-repo multi-machine layout).