dsh-plugin-commandcode-provider

Configuration

Load the named plugin llm-commandcode in a DSH composition. The provider route is commandcode; select a model as commandcode/ (for example, commandcode/gpt-5.6-luna).

- id: llm-commandcode
  name: dsh-plugin-commandcode-provider
  config:
    apiKeyEnv: COMMANDCODE_API_KEY # DSH credential reference
    baseURL: https://api.commandcode.ai
    maxTokens: 64000
    defaultContextWindow: 1000000
    streamIdleTimeoutMs: 300000
    retryPolicy:
      mode: default

The current configuration field is named apiKeyEnv for compatibility with DSH credential references; use it to select a reference other than the default COMMANDCODE_API_KEY when needed:

config:
  apiKeyEnv: COMMANDCODE_API_KEY
  baseURL: https://api.commandcode.ai
  maxTokens: 64000
  defaultContextWindow: 1000000
  streamIdleTimeoutMs: 300000

Configure COMMANDCODE_API_KEY through DSH's credentials service. If that service is not installed, the plugin reads the same reference from DSH's launch environment. A mounted credentials service is authoritative: a miss does not fall back to the environment. Blank, whitespace-only, or HTTP-header-invalid keys are rejected before a request is sent.

Get an API key with the OAuth button

The settings page (Command Code section, right after Models) offers a Command Code OAuth button. Clicking it starts a browser-assisted key retrieval flow:

1. The plugin's host half launches a one-shot local callback server on 127.0.0.1 (port 5959 by default, with a small fallback range).
2. A Command Code Studio authorization page opens in your default browser. After you sign in, Studio POSTs your API key back to http://localhost: /callback.
3. The host validates the CSRF state token, stores the key under COMMANDCODE_API_KEY through the credentials service, and closes the local server automatically.
4. The settings page polls the host and confirms once the key is stored.

The flow needs DSH's web server (Web profiles). If the automatic transfer fails or times out, the manual API-key input below the button remains available as a fallback. A second attempt while one is pending is refused.

The same-origin routes the browser half calls are /commandcode-oauth/start and /commandcode-oauth/status; Studio POSTs to the local /callback.

baseURL changes the API origin. maxTokens is capped at 64,000; defaultContextWindow, streamIdleTimeoutMs, and retryPolicy tune model metadata, idle streaming behavior, and DSH-managed retries. temperature is accepted as a compatibility setting; each request's explicit temperature wins, and the wire default is 0.3. Static models entries can supply display, context-window, and maximum-token overrides; this does not discover models.