codex-dsh

Codex to DSH collaboration

This skill operates the standalone Codex-side MCP bridge. The repository may be discovered under the broad dsh-plugin ecosystem topic, but it is not a DSH Cordis bundle and must not be installed with dsh plugin --profile ... add ....

Use the dsh_* MCP tools only with the user's already managed official DSH Web Host. The bridge is connect-only: never start, daemonize, stop, or reconfigure dsh web, and never modify DSH model settings during normal delegation.

Workflow

1. Call dsh_host_status when Host availability is unknown. If unreachable, report the doctor/start command; do not start the Host yourself.
2. Call dsh_delegate with a complete prompt and an existing absolute cwd. Omit model and normally omit agentPreset; the bridge's installation-time default owns that choice. agentPreset chooses DSH agent composition, not workspace ownership or verified sandbox policy. The shipped code preset keeps the standard capability set through DSH Code Mode and is the preferred default for implementation or multi-step tool work. Use the default exclusive-write workspace claim for edits, preferably on a dedicated git worktree; use read-only only as a bridge-local cooperative claim for tasks that should not mutate files. It does not make DSH run in a read-only filesystem sandbox. Keep the returned BridgeTask id and root session id.
3. Treat BridgeTask, root session, and turn as distinct. A completed turn can be followed by another turn in the same root session.
4. Use dsh_wait for at most 30 seconds, then dsh_tail with nextCursor. Do not poll raw per-session seq values or assume mux since resumes history.
5. Before a write, retain the latest task cursor and connection revision, then pass them as sinceCursor and expectedRevision. Inspect stale_view changes instead of blindly retrying. Use dsh_followup(mode="queue") for a later turn and mode="steer" only when guidance must enter the active turn's next step.
6. Inspect dsh_status.pendingInteractions. dsh_followup is not an answer channel.
7. Answer questions only with dsh_answer_question and the exact pending request id/typed answers. Never infer sensitive credentials, publishing, or release answers.
8. Treat every approval as sandbox escalation. Never auto-allow. Never auto-approve. Use dsh_resolve_approval(..., outcome="allow_once") only after the supervising user/Codex approval boundary; reject is the fail-closed response.
9. Use dsh_cancel(scope="turn") to cancel only the active turn while preserving queue. Use scope="queue" only with a current queue snapshot and expect a non-atomic per-item result.
10. Independently inspect DSH-produced files and test evidence before accepting the work. When collaboration is over, call dsh_release_workspace; this does not close the DSH session.