Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/walvez/dsh-codex-sync/codex-syncnpx skills add Walvez/dsh-codex-sync --skill codex-syncgit clone --depth 1 https://github.com/Walvez/dsh-codex-syncWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00040 | $0.00936 |
| Opus 5 | $0.00020 | $0.00468 |
| Sonnet 5 | $0.00008 | $0.00187 |
| Haiku 4.5 | $0.00004 | $0.00094 |
Grade B, and why
codex-sync scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- `mcpMirror` — auto-mirror `[mcp_servers.*]` from `~/.codex/config.toml` (takes effect after DSH restart). How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codex sync (this plugin)
You can drive dsh-codex-sync with slash commands. Prefer a dry-run before writing sessions.
Import Codex conversations
/import-codex --dry-run
/import-codex
/import-codex --include-subagents
/import-codex --ids codex-abc,codex-def
/import-codex --limit 20 --project my-app --since 2026-08-01
/import-all
/attach-workspaces
The composer Import from Codex button opens a picker: projects → chats, sub-agents nested under the parent thread, already-imported rows greyed out. Prefer that UI when the user is in the web app.
--dry-runprints[would-import]lines and writes nothing.- Default import skips Codex sub-agent threads (
parent_thread_id). Add--include-subagentsonly if the user wants those too. - Already-imported ids are skipped (idempotent). Huge rollouts above
maxSessionBytesare skipped.
Composer Sync ▾ → Import from Codex opens the picker. After a successful import the page reloads in ~2.5s so new chats appear.
Export DSH chats to Codex
Writes new Codex rollouts (new uuid, text only — not a resume of the original thread; every export creates a new copy and never overwrites original):
/export-codex --dry-run
/export-codex --ids sess-1,sess-2
Composer Sync ▾ → Export to Codex opens the picker over DSH sessions:
- Filters: "From Codex" (
showCodex, default off) and "Hide sub-agents" (hideSub, default on) filter toggles. - Codex-origin sessions: Only DSH-updated chats (
dshUpdated=true, tagged "Updated in DSH" / "DSH 已续聊") are selectable. Unchanged or source-missing chats remain locked. - Sub-agents: Hidden by default and nested under parent sessions for organization. Selecting a child sub-agent exports it as a separate independent thread (not merged with parent).
- Export copies: Exporting creates brand-new Codex rollouts and thread entries; original Codex conversations are never overwritten.
Settings (persisted in ~/.dsh/codex-sync.json)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 83 lines · 40 tokens per session scan B bd67a61033a2
codex-sync is a skill published in the GitHub repository Walvez/dsh-codex-sync (25 stars, last pushed 6d ago), licensed MIT. It adds 40 tokens to every session and 936 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dsh-plugin-guide
Use when developing, reviewing, packaging, debugging, or answering questions about DeepSeek Harness (DSH) plugins — the plugin-based agent harness on vendored Cordis. Applies the official plugin-development constraints (plugin contract, cordis.yml layers, services/events/effects, tool DSL, bundles/profiles) backed by…
dsh-plugin-development
Use when designing, creating, modifying, packaging, installing, reviewing, auditing, or diagnosing a DeepSeek Harness plugin: a live dynamic Cordis plugin driven by cordisdefine, a source-backed workspace plugin under packages, or an out-of-tree installable bundle using dsh.bundle and cordis.patch.yml. Also use for…
development-cdp
Inspect and automate the DeepSeek Harness Web UI through Chrome DevTools Protocol (CDP). Use when verifying dsh-pihuo plugins in the browser, checking startup, composer, or tool cards, taking screenshots, or running scripts/cdp-check.mjs. Triggers: CDP, Chrome remote debugging, pageinfo, "网页调试", /development-cdp.
dsh-plugin-author
Scaffold and implement DeepSeek Harness (dsh) out-of-tree plugins — tools, services, adapters, hooks, bundles. Use when writing a new plugin, adding a model tool, creating apply()/inject/Config, scaffolding a dsh.bundle package, or the user says /dsh-plugin-author, "写插件", "做个插件", "scaffold plugin", "加一个工具".
dsh-plugin-client
DeepSeek Harness browser-half plugins — dsh.client, client-modules, slots, settings cards, Conversation Nodes. Use when adding Web UI, slots.register, a settings tab, a chat node, or the user says /dsh-plugin-client, "浏览器插件", "写 UI 插件", "slot", "设置页卡片".
dsh-plugin-compose
Compose, install, and publish DeepSeek Harness plugin bundles — profile layers, cordis.patch.yml, dsh plugin add, --patch overlays, dump-config. Use when installing a plugin, writing a bundle patch, publishing to a profile, debugging layer order, or the user says /dsh-plugin-compose, "安装插件", "dsh plugin add"…