Introduction

In the DeepSeek Harness (DSH) environment, developers’ configurations (such as the plugin list, settings files, and API keys in .credentials.yaml) are usually stored locally. Local backups can be lost or leak sensitive information, while uploading directly to a public cloud lacks security. dsh-vault is designed to resolve this contradiction: it encrypts DSH home configurations, pushes them to your own private GitHub repository, and restores them on a new machine with a single command, enabling safe cross-machine migration.

Plugin Overview

dsh-vault is a DSH plugin whose main features are:
* Encrypted storage: Encrypts configuration files using scrypt + AES-256-GCM.
* Private repository sync: Pushes encrypted snapshots to a private GitHub repository via the REST API.
* Zero dependencies: Depends on no external npm packages; uses only the Node.js built-in crypto module.
* Interactive configuration: Provides the dsh-vault-config skill to assist with initialization.

Installation and Enablement

The documentation does not provide specific installation commands.
* Prerequisites: DSH version must be >= 0.2.0-rc.2. The plugin currently supports only the latest and next branches; the Alpha line is no longer supported.
* How to obtain: Install by GitHub repository address (the exact command depends on the DSH plugin system’s installation flow; see the GitHub page).

Configuration

Plugin configuration is not written directly to settings.yaml; it is written to DSH’s Profile Patch. The configuration file path is:
~/.dsh/profiles/<profile>/cordis.patch.yml

Configuration options include:
* repo: Private repository address (in owner/name format). If empty, defaults to dsh-backup-<login>.
* machineDescription: Machine description, used to identify the machine during cross-machine restoration.
* rememberPassphrase: Whether to remember the passphrase in the macOS Keychain.

You can also complete setup interactively using the /vault config skill or dsh-vault-config.

Common Commands

The following are typical uses of the /vault command:

  1. List backups:
    View information about all machine snapshots in the current Vault.
    /vault list
  1. Create a backup:
    Encrypt the current configuration and push it to the private repository.
    /vault backup [passphrase]

*Note: The first backup automatically creates the private repository.*
  1. Restore configuration:
    Pull and restore the configuration for a specified machine from the repository.
    /vault restore [machine] [--yes] [passphrase]

*If `machine` is not specified, only available snapshots are listed.*
  1. Manage settings:
    Change the repository address, machine description, or toggle passphrase remembering.
    /vault set repo <owner/name>
    /vault set machine-desc <desc>
    /vault set remember-passphrase on|off

Backup Scope and Limitations

Backup Contents

The plugin packages the following into a snapshot:
* settings.yaml and its import records.
* The four required Manifest files for each Profile (package.json, pnpm-lock.yaml, pnpm-workspace.yaml, and cordis.patch.yml).
* .credentials.yaml (API keys).
* models-store.json, and so on.

Restoration Requirements

Before performing a restoration, ensure that the target machine:
1. Has DSH CLI installed.
2. Has pnpm installed and available in PATH.

Known Limitations

  • Single-snapshot policy: Only the latest snapshot is retained for each machine (older snapshots are overwritten).
  • Absolute-path dependencies: Dependencies referenced with absolute file: paths in a Profile manifest are invalid on another machine; a warning is issued during restoration.
  • Non-migrated items: .env files, the storages/ directory (machine-specific absolute paths), and session history are not migrated.
  • Irreversibility: If the passphrase is lost, the encrypted snapshot cannot be recovered.

Ecosystem Context

DSH’s design philosophy is “everything is a plugin.” This plugin is maintained by community developer fan56 and uses the MIT license. It does not depend on DeepSeek’s official app store; instead, it manages the local environment directly through the plugin system.