dsh-plugin-openai-api

Configuration

The configuration is one openai-api row in your profile's patch layer (~/.dsh/profiles/web/cordis.patch.yml, append to your existing file):

- id: openai-api
  disabled: false
  config:
    model: default
    apiKey: local-key

Two things to know about the row:

• the config block replaces the plugin's defaults wholesale — list every key you want; nothing is required, and unknown keys are a load error;
• to switch the endpoint off again, set disabled: true on the row (or remove it) and restart.

The configuration keys

All four are optional.

key	default	what it does
model	default	The model id the endpoint advertises at /v1/models and echoes in completions. It is the wire identity — what SDKs see — not a DSH model selector: a request that omits model (or names the wire id) runs the host's effective default model selection — the same selection GUI sessions get, from the agent-default-model service, which honors the user's stored model choice. Any other value in a request is a real model id, passed through to the session. (The deployment persona renders {{model}} from the session's model, so every session always carries one.)
provider	host default	The provider route the created sessions use (the AgentOptions.provider meaning — the host's provider routing). Omitting it is a no-op on single-provider setups.
apiKey	unset (no auth)	When set, every request must carry Authorization: Bearer — missing or wrong key is a 401. When unset the endpoint is unauthenticated: anyone who can reach the port can prompt the agent (which has the same tool access as the GUI). Keep the web server on its loopback bind (host: 127.0.0.1) unless you set this — and consider a reverse proxy — before exposing the port.
cwd	the dsh web process's own working directory	Absolute working directory for the sessions the plugin creates (they run real file and shell tools, so they have a working directory — and the deployment persona in the system prompt renders it, so every session always carries one). Must start with /.

The configuration keys

All four are optional.

key	default	what it does
model	default	The model id the endpoint advertises at /v1/models and echoes in completions. It is the wire identity — what SDKs see — not a DSH model selector: a request that omits model (or names the wire id) runs the host's effective default model selection — the same selection GUI sessions get, from the agent-default-model service, which honors the user's stored model choice. Any other value in a request is a real model id, passed through to the session. (The deployment persona renders {{model}} from the session's model, so every session always carries one.)
provider	host default	The provider route the created sessions use (the AgentOptions.provider meaning — the host's provider routing). Omitting it is a no-op on single-provider setups.
apiKey	unset (no auth)	When set, every request must carry Authorization: Bearer — missing or wrong key is a 401. When unset the endpoint is unauthenticated: anyone who can reach the port can prompt the agent (which has the same tool access as the GUI). Keep the web server on its loopback bind (host: 127.0.0.1) unless you set this — and consider a reverse proxy — before exposing the port.
cwd	the dsh web process's own working directory	Absolute working directory for the sessions the plugin creates (they run real file and shell tools, so they have a working directory — and the deployment persona in the system prompt renders it, so every session always carries one). Must start with /.