dsh-vault

Switching laptops or reinstalling your OS means your dsh settings, API credentials, agents, and plugin manifests disappear with the old disk. dsh-vault encrypts your entire home config and pushes it to your own private GitHub repo; on a fresh machine a single command pulls the snapshot, decrypts it, restores everything, and reinstalls every plugin from the manifest. Restore and migration collapse into one step.

Encryption relies solely on Node’s built-in crypto (scrypt key derivation plus AES-256-GCM over the whole snapshot) with zero npm dependencies. The passphrase can be supplied inline, via an environment variable, or stored in the macOS Keychain. An encrypt-then-decrypt self-check runs before every backup so a corrupt snapshot never overwrites a good one, and the current config is stashed locally before any restore, keeping up to three recent stashes. The backup boundary is explicit: settings, credentials, agents, the manifest four-pack, and the model store are bundled in; sessions, node_modules, and usage stats are deliberately left out.

Built for developers who run dsh across multiple machines, treat API keys and credentials as first-class secrets, and want a one-command config-and-plugin move when a new box arrives. It does not manage GitHub login, does not preserve session history, and does not maintain a snapshot version chain. It does one thing: encrypt your dsh home, carry it to a new machine, and put it all back where it was.