Changes

• Explain official DSH host dependency and native-binding startup failures in doctor --live without mislabeling them as migration failures.
• Preserve an early error classification after long output leaves the bounded log tail, while retaining redaction and unchanged failure/cleanup gates.
• Document the dependency-ownership issue tracked in DSH discussion #3250 and a separate local-install comparison.

Validation

• Full CLI, migration, live-doctor, UI, and permission-plugin tests; build and package checks.
• Windows and macOS CI, plus install/boot/HTTP/removal checks on DSH 0.1.0-rc.8, 0.1.1-rc.1, and 0.1.1-rc.2.
• Actual macOS arm64 / Node 22.23.2 reproduction: the pnpm isolated native-loader path fails with a host-dependency explanation; a local hoisted DSH 0.1.1-rc.2 baseline passes HTTP/JavaScript readiness, process/port cleanup, and profile-preservation checks.

This patch improves diagnostics. It does not repair the upstream native loader, activate migrated configuration, install dependencies automatically, or relax the existing acceptance gates.

Install

dsh plugin --profile web add dsh-movein@0.13.6

An unversioned install may select an older release while pnpm's minimum-release-age policy applies. The exact version above is for explicitly installing this patch; there is no need to disable the global policy.

Changes: #43.

Published artifact

Source commit: 2d5437d9c41365696f8014608405b2cdad01179a.

The installed npm package's 23 files byte-match the packed artifacts from that commit. The rebuilt tarball also matches the published integrity:

sha512-KxWMsL6V1EuYM3s5tAEizDjEpDoqHfvQeEQJRZPl3VRjIihW3aI0jgqZvUsfVf7LMnXnkgleah6ET/1Ruse1oA==

Changes

• Record global instructions and generated configuration in the migration manifest, including instructions-plus-MCP-only moves.
• Recover provenance on a repeated apply only when existing instructions still byte-match the source.
• Recognize Windows copy-fallback assets during reverse migration only when the source remains under the expected Claude root and the complete copied tree still matches.
• Preserve the existing no-overwrite behavior for conflicting destinations.

Validation

• Full migration, reverse migration, live-doctor, UI, and permission-plugin tests passed.
• Windows and macOS CI passed.
• Plugin install, boot, HTTP, and removal checks passed on DSH 0.1.0-rc.8, 0.1.1-rc.1, and 0.1.1-rc.2.

Changes: #41 and #42.

Install this patch immediately

dsh plugin --profile web add dsh-movein@0.13.5

During release validation with pnpm 11.24.0, a fresh unversioned dsh plugin --profile web add dsh-movein selected 0.13.4 under its minimum-release-age policy. Choose the exact version above when explicitly testing this new patch, or wait for that protection window to expire. No global cooldown setting needs to change.

Additional published-package checks

• On macOS arm64 / Node 22.23.2, the published 0.13.5 package passed migration and provenance checks. With DSH 0.1.1-rc.2 installed in a local hoisted dependency layout, plugin installation, active-profile HTTP and JavaScript responses, process/port cleanup, profile preservation, and plugin removal also passed.
• A separate pnpm 11.24.0 dlx runtime failed before web startup: node-addon-require-builtin could not load a usable native binding, followed by ERR_MODULE_NOT_FOUND for official DSH plugins. This also reproduced with Movein 0.13.4. This patch does not fix that host-runtime/native-binding issue, and the successful checks above do not establish compatibility with every installation layout.

• Declare root-plugin compatibility for DSH 0.1.0-rc.8 through 0.1.1-rc.2.
• Add cross-version install, boot, HTTP, and removal validation to CI.
• Document the supported DSH versions and profiles.

This patch replaces the previous silent post-apply action with explicit user consent.

• Human terminals ask once with [Y/n]; pressing Enter means Yes, with the authenticated GitHub account effect disclosed before confirmation.
• Detected agents and all non-TTY runs return USER_CONFIRMATION_REQUIRED and require an explicit Yes/No follow-up command.
• CI performs no prompt, marker write, or GitHub API call.
• DSH Settings and model tools retain a user-clicked repository link and never call that API.

Verified on Windows, macOS, Linux, OpenCode, a live DSH boot, security checks, and CodeQL.

Security patch release.

• Replaces permission-rule regexes with single-pass parsers to prevent catastrophic backtracking on malformed input.
• Preserves the existing Claude Code permission-rule grammar and DSH behavior.
• Adds 150k-character adversarial regression tests.
• Publishes dsh-movein-permissions@0.2.4 with the same fix.

Verified on Node 20, Windows, macOS, OpenCode 1.18.23, a live DSH boot, npm audits, and CodeQL (0 open alerts).

Makes hook migration diagnostics honest about current DSH enforcement boundaries.

• Statically checks all three Claude settings layers without executing user hooks
• Detects unsupported events, malformed handlers, uppercase matcher alternatives, missing per-file bridge rows, continue:false, and Windows exit-code risks
• Adds a disposable deny-canary procedure before treating hooks as a policy boundary
• Verifies migrated OpenCode config, skills, commands, agents, and hook plugin with OpenCode 1.18.23
• Adds Windows/macOS coverage, real DSH boot smoke, audits, CodeQL, Dependabot, and a stable CI gate
• Publishes claude-to-opencode@0.3.2 with dsh-movein ^0.13.0 compatibility

The automatic setup-star behavior is unchanged.

Adds an isolated live doctor for installed DSH profiles. It validates official dump support, active migration composition, base and web boot behavior, cleanup, and loopback port release without activating or rewriting the user's profile. CI now runs the live doctor against the current official DSH host.

Successful move-in now handles the repository Star step automatically when an authenticated GitHub CLI is available.

• Attempts the Star only after at least one action succeeds with no errors
• Keeps the existing Star link as the fallback when authentication is unavailable
• Records the one-time marker so later apply runs do not retry
• Adds coverage for successful automatic Star handling

Claude Code import is now available inside DSH settings.

• Preview instructions, skills, commands, agents, hooks, permission rules, and MCP before writing
• Apply selected categories without overwriting existing destinations
• Use the same migration engine from the CLI, model tools, and settings UI
• Keep Codex and OpenCode as optional secondary origins
• Install required DSH plugins through the running DSH CLI when available

Install with npx dsh-movein or add the plugin with dsh plugin add dsh-movein.

This release restores dsh-movein as the primary product without removing the newer migration routes.

• Restores the DSH migration README and repository identity
• Keeps Claude Code, Codex, and OpenCode as supported DSH origins
• Moves the standalone OpenCode hook bridge to opencode-claude-code-hooks
• Keeps the existing Claude Code to OpenCode compatibility command available