omdsh-plugins/omdsh-codemode

Install

A deployment whose runtime was **not** started by `dsh` — a packaged shell, a test — sets `command` (and `args`) instead; without either, the socket refuses with a message saying so rather than guessing at a binary.

Those four knobs — `profile`, `command`, `args`, `reconnectGraceMs` — are a plain TypeScript interface on the host half, not a [settings namespace](https://omdsh-plugins.github.io/conventions/?lang=en#rule-1). So they are edited where the sample above puts them, in the profile's own `cordis.patch.yml`, and this plugin's card in the plugin hub carries no form. They are composition facts rather than a person's preferences — which launcher a deployment re-executes is decided once, by whoever assembled the profile.

Whichever launcher is resolved, it is invoked with **`--session-id <id>`** appended, because Code mode names the conversation it starts. The profile it boots must understand that flag: [omdsh-tui](https://github.com/omdsh-plugins/omdsh-tui) takes it as create-or-continue for exactly that session, which is what makes a Code conversation something the sidebar can hold and a click can reopen.

## Security

The socket hands out a live agent process, so it is fenced exactly like `/api`: a `Host` header naming us (loopback, or an authority the deployment was told to serve) plus same-origin browser markers. This is a DNS-rebinding and cross-site defence, not authentication — a deployment that publishes `/api` to a network publishes this with it.

## Install

Requires a `dsh` on your PATH, and the web profile that carries the mode switch.

Add omdsh-plugins/omdsh-codemode to your DSH config (web profile) to enable.