dsh-migrate-codex

dsh-migrate-codex

A DeepSeek Harness plugin for safely migrating a Codex environment between machines.

Capabilities

• /migrate-codex prepare <dir>: package the whitelisted repos and dirty snapshots;
• /migrate-codex verify <dir>: verify SHA256SUMS, bundle integrity, and credential exclusions;
• /migrate-codex restore <dir>: restore onto a new machine (aborts if the target exists);
• /migrate-codex restore-worktree <dir> <slug>: recreate one dirty worktree on demand;
• Skill codex-migration: teaches the agent the full workflow, the safety red lines, and how to align Codex configuration with DeepSeek Harness.

Install

dsh plugin --profile <name> add <repo URL or npm package>
# restart the Profile to take effect

Usage

Ask in a DSH session: "verify and restore the codex-migration bundle on my desktop", or run:

/migrate-codex verify ~/Desktop/codex-migration
/migrate-codex restore ~/Desktop/codex-migration

Custom whitelist

The published version ships placeholder examples only (example-primary, ...). Put your real table in bin/whitelist.local.tsv (gitignored, never committed), four columns per row:

slug<TAB>role<TAB>source-path<TAB>required
my-main-repo	primary	~/my-main-repo	yes

• CODEX_MIGRATE_TABLE: path to a whitelist file;
• CODEX_MIGRATE_MAIN_SLUG: slug of the worktree-bearing main repo (default example-primary).

Safety design

• Whitelisted repositories only;
• git bundles carry commits but never .git/config (no remote credentials leave the machine);
• SHA256SUMS integrity checks;
• credential exclusion list (auth.json / .env* / private keys / certs / SQLite);
• restore never overwrites an existing target and leaves no half-restored state on failure.

Roadmap

• Turn hardcoded old-machine paths into runtime arguments;
• Platform detection.

License

MIT