dsh-sync

Policy-driven DeepSeek Harness config sync. This is not a thin git pull of $DSH_HOME.

A dual-face DSH plugin:

• Host — sidecar Git under $DSH_HOME/.dsh-sync/, namespace-projected settings, secret scan, journaled apply, /sync command, fenced HTTP/SSE API
• Web — theme-independent settings.section ("Git Sync") plus a /sync popupSelect decoration

Pinned to DSH 0.1.0-rc.6.

Install

dsh plugin --profile web add dsh-sync
# optional, if /sync should exist in headless too:
dsh plugin --profile headless add dsh-sync

Then restart dsh web. Open Settings → Git Sync.

From a checkout:

dsh plugin --profile web add /absolute/path/to/dsh-sync

The package declares dsh.bundle.patch so the CLI appends it to dsh.profile.bundles. The client bundle is exports["./client"] (lib/client.js) in the ModuleLoader factory format.

What v1 syncs

Class	Items	Apply
Safe / live	Selected settings namespaces as payload/settings.namespaces.yaml (user layer, secrets and local-only paths stripped)	ctx.settings.mutate with expectedRevision
Restart	profiles/{web,headless}/package.json	Explicit only; shows install/restart follow-up. Does not run pnpm.
Executable	profile/home cordis.patch.yml, user .agent-presets/*/{preset.yml,agent.cordis.yml,tool-bootstrap.mjs}	Explicit risk confirmation naming files + remote

Never: .credentials.yaml, sessions, storages, node_modules, generated cordis.yml, .dsh-sync itself, .env*, shipped/system presets, symlinks, gitlinks.

baseURL is not treated as machine-local unless you add it under local-only paths. Tailscale CPA endpoints are portable on purpose.

A checkout that still looks like (files at repo root) can set to “repository root”.