dsh-migrate-codex

Readme

# dsh-migrate-codex

A DeepSeek Harness plugin for safely migrating a Codex environment between machines.

## Capabilities

- `/migrate-codex prepare <dir>`: package the whitelisted repos and dirty snapshots;
- `/migrate-codex verify <dir>`: verify SHA256SUMS, bundle integrity, and credential exclusions;
- `/migrate-codex restore <dir>`: restore onto a new machine (aborts if the target exists);
- `/migrate-codex restore-worktree <dir> <slug>`: recreate one dirty worktree on demand;
- Skill `codex-migration`: teaches the agent the full workflow, the safety red lines, and how to align Codex configuration with DeepSeek Harness.

## Install

```sh
dsh plugin --profile <name> add <repo URL or npm package>
# restart the Profile to take effect
```

## Usage

Ask in a DSH session: "verify and restore the codex-migration bundle on my desktop", or run:

```
/migrate-codex verify ~/Desktop/codex-migration
/migrate-codex restore ~/Desktop/codex-migration
```

## Custom whitelist

The published version ships placeholder examples only (`example-primary`, ...). Put your real table in `bin/whitelist.local.tsv` (gitignored, never committed), four columns per row:

```
slug<TAB>role<TAB>source-path<TAB>required
my-main-repo	primary	~/my-main-repo	yes
```

- `CODEX_MIGRATE_TABLE`: path to a whitelist file;
- `CODEX_MIGRATE_MAIN_SLUG`: slug of the worktree-bearing main repo (default `example-primary`).

## Safety design

- Whitelisted repositories only;
- git bundles carry commits but never `.git/config` (no remote credentials leave the machine);
- SHA256SUMS integrity checks;
- credential exclusion list (auth.json / .env* / private keys / certs / SQLite);
- restore never overwrites an existing target and leaves no half-restored state on failure.

## Roadmap

- Turn hardcoded old-machine paths into runtime arguments;
- Platform detection.

## License

MIT