@sparkelf/dsh-dataops-integration

配置

Bundle默认使用DataOps本地origin http://127.0.0.1:3000、MCP namespace dataops、access credential DATAOPS_MCP_TOKEN和target credential DATAOPS_DSH_TARGET。生产或其他内网部署在profile patch中替换baseUrl：

- id: dataops-integration
  config:
    baseUrl: http://dataops.internal.example

可信内网HTTP是默认合同。外网部署显式使用HTTPS；DSH对外发布时还必须显式配置同协议的callbackOrigin，并在DataOps AUTH_DSH_REDIRECT_ORIGINS登记。HTTPS不回落到HTTP。DSH origin的访问控制由部署网络或入口代理拥有，plugin不以TCP peer必须是loopback来破坏已声明的非loopback部署。

DataOps托管容器不安装本package；托管模式使用DataOps-owned Unix broker，DSH进程不持有delegated token，Settings也没有独立连接控件。

Configuration

The bundle defaults to the local DataOps origin http://127.0.0.1:3000, MCP namespace dataops, access credential DATAOPS_MCP_TOKEN, and target credential DATAOPS_DSH_TARGET. Production and other trusted-LAN deployments replace baseUrl in the profile patch:

- id: dataops-integration
  config:
    baseUrl: http://dataops.internal.example

Trusted-LAN HTTP is the default contract. Internet-facing deployments explicitly use HTTPS. A published DSH origin also sets the same-scheme callbackOrigin and registers it in DataOps AUTH_DSH_REDIRECT_ORIGINS. HTTPS never falls back to HTTP. Deployment networking or the ingress proxy owns access to the DSH origin; the plugin does not break declared non-loopback deployments by requiring the TCP peer itself to be loopback.

A DataOps-managed container does not install this package. Managed mode uses the DataOps-owned Unix broker, keeps delegated credentials out of the DSH process, and exposes no standalone connection controls.