Object Storage Google Cloud

Adds Google Cloud Storage to the Object Storage extension, so your buckets show up alongside every other backend you have connected.

What you can do

• Connect with a service-account JSON key, validated in the form so a truncated paste fails immediately instead of as a connect timeout
• Browse your buckets and objects from the Object Storage panel
• Download an object into your workspace, and upload a workspace file back
• Work with a bucket-scoped service account, which is treated as a supported setup rather than an error
• Point at the storage emulator or a private access point through a custom endpoint

Requirements

The Object Storage extension, installed and enabled, and the desktop app.

This is a provider: it owns the GCS client and the "Connect Google Cloud Storage" form, but no panel of its own. Install extension-object-storage alongside it; the hub renders the connections tree, the object list and the transfer panel, and dispatches every operation here.

Getting started

Open Object Storage in the activity bar → + → Google Cloud Storage.

Field	Notes
Service-account JSON key	Paste the whole downloaded file. Validated as JSON in the form, so a truncated paste fails immediately rather than as a connect timeout.
Project id	Filled from the key's own project_id when left blank.
Default bucket	Used when the service account is bucket-scoped and cannot list the project.
Custom endpoint	Optional — for the storage emulator or a private access point.

A bucket-scoped service account is a supported setup: when the project cannot be listed, the extension probes the named bucket instead and shows just that one.

Editing an existing connection leaves the key field blank — empty means "keep the stored key".

Sign-in is key-based. Application Default Credentials and Workload Identity are not supported yet.

How it talks to GCS

The renderer cannot reach an arbitrary origin (the desktop app's CSP pins connect-src), and the object API needs resumable uploads with binary bodies. So this extension ships a small Node helper process: it is spawned on demand via the host's managed-process bridge, listens on 127.0.0.1 behind a per-spawn token, and runs the official Google SDK — OAuth signing, resumable uploads and retries are the vendor's implementation, not ours. Downloads stream to a temporary file and are renamed on completion, so an interrupted transfer never leaves a half-written file behind.

Listing always runs with autoPaginate: false. The SDK's default walks an entire bucket, which is unbounded in time and billed per request.

That helper is why connections are desktop-only — the browser edition has neither a process bridge nor a persistent secret store.

Two settings are available if the defaults clash with something on your machine: objectStorage.gcs.sidecarPort (default 47612) and objectStorage.gcs.nodePath (default node; Node 18+ required).

For agents and flows

Six capabilities go through the audited gateway: connect, listBuckets, listObjects, statObject, deleteObject (approval-gated) and disconnect.

Transfers are deliberately not exposed here — they take an absolute host path. Use the hub's object-storage.download / object-storage.upload, which resolve the path and gate the upload.

No capability accepts a credential: the key is entered in the connect form and looked up by connection id, so the private key never appears in a gateway payload.