dsh-codex

If you already have Codex CLI installed locally but still end up opening a new terminal and stitching together flags for every one-off task, code review, or session resume, dsh-codex removes that friction. It wraps the four core codex exec scenarios into four native dsh tools—codex_status, codex_exec, codex_review, and codex_resume—so your agent can query provider state, fire a self-contained prompt against a given directory, review a repo diff or commit, and pick up a previous session by id, all without leaving the dsh conversation. The plugin reads the provider you already set in ~/.codex/config.toml (for example a DeepSeek base_url) and does not require an OpenAI login, meaning it shares the same token quota as your current session.

Security is the default, not an add-on. The sandbox starts in read-only mode: Codex can inspect files but cannot write unless you explicitly escalate to workspace-write or danger-full-access. Sessions persist to ~/.codex/sessions by design, enabling codex_resume by session id or last=true; flip ephemeral to true when you do not want anything on disk. codex_status masks credential fields so secrets never leak into conversation output. Over a dozen Schemastery knobs (model, sandbox, cd, profile, timeoutMs, json, approveForMe, color, and more) plus a cordis.patch.yml bundle patch layer let you drop the entire capability set into any dsh profile in a single step, while the bundled SKILL.md teaches the agent when each tool is the right call.

This plugin is for dsh users who already have a working Codex CLI provider setup—a self-hosted DeepSeek endpoint, for instance—and want their agent to handle repo-level code reviews, multi-turn coding sessions, or one-off scripting tasks without memorizing a separate CLI invocation pattern. dsh-codex does not modify the Codex CLI binary; it only bridges codex exec into the dsh tool and skill system using the same adaptation approach as dsh-skillopt (Schemastery + defineTool + shell executor + SKILL.md + bundle patch).