dsh-codex-peer

Configuration

Configuration lives in the profile's cordis.patch.yml. The tools have no hardcoded paths, models, or policies. A patch row replaces the whole config block of that id, so state it completely:

- insert:
    - id: codex-peer
      name: 'dsh-codex-peer'
      config:
        defaultMode: implement
        requireApproval: mutating
        model: ''                 # empty = Codex's own default from config.toml
        runTimeoutMs: 3600000

Field	Default	Meaning
codexPath	''	Explicit Codex executable. Highest-priority discovery candidate.
codexHome	''	CODEX_HOME for the child (Codex's own state root, including auth.json). Empty = inherit.
stateDir	''	Where runs and the ledger live. Empty = $DSH_HOME/codex-peer.
model	''	codex exec -m override. Empty = Codex's configured default.
defaultMode	ask	Mode for codex_ask calls that omit mode.
defaultSandbox	''	Sandbox for calls that omit sandbox; empty derives it from the mode (implement → workspace-write, otherwise read-only).
requireApproval	mutating	mutating: ask before a run that may write. always: ask before every peer call. never: no gate. A codex_plan call is always asked for once unless never.
callTimeoutMs	600000	How long a foreground call waits before it is promoted to a background job.
runTimeoutMs	1800000	Hard ceiling for one Codex run; the process tree is terminated when it is hit.
maxAnswerBytes	120000	Answer budget returned to the model; the full message stays in answer.md.
progressKeepLines	400	Progress lines kept in memory for job_output and failure notes.
terminateGraceMs	5000	Termination grace (managed seam SIGTERM→SIGKILL window; tree-kill window for a direct launch).
extraArgs	[]	Extra arguments appended to every codex exec invocation.
promptPreamble	''	Replaces the built-in peer-contract preamble that is prepended to every prompt.
planFile	''	Optional repository-relative path for a markdown mirror of the work list, for example .codex-peer/PLAN.md. Empty writes no file, because tasks.json in the state directory stays the single source of truth.
routingRules	the shipped routing table	Array of {when, owner, reason}; when is a lower-case word or phrase matched against a task's title, tags and scope, first match wins.
defaultOwner	dsh	Owner when no routing rule matches.
maxCodexRunsPerTask	5	How many Codex runs one task may spend before a task-scoped run is refused. Raise it per task with codex_task action:set-budget.
maxCodexTokensPerTask	2000000	How many Codex tokens one task may spend before a task-scoped run is refused; 0 disables the token ceiling.
approvePerTask	true	With true, approving a plan covers that task's mutating Codex runs, so they are not asked one by one. false restores per-run asking.
workspaceDir (new)	.codex-peer	Path, relative to the run's working directory, where the readable mirror is written (see Where everything is written). An empty string disables the workspace mirror entirely.

The routing table is plain data (routingRules): each {when, owner, reason} matches a lower-case word or phrase against a task's title, tags and scope, first match wins. The shipped rules send bulk/rename/migrate/review/audit/second-opinion/survey/summarize/draft to codex, and debug/interactive/plugin/install/verify/integration/decision to dsh, each with a one-line reason. defaultOwner (default dsh) takes whatever no rule matches.