Object Storage MinIO

Adds MinIO, and any other S3-compatible endpoint, to the Object Storage extension.

What you can do

• Connect to a MinIO or S3-compatible server by host and port, over HTTP or HTTPS
• Browse your buckets and objects from the Object Storage panel
• Download an object into your workspace, and upload a workspace file back
• Work with on-prem deployments that have no wildcard DNS, since path-style addressing is on by default

Requirements

The Object Storage extension, installed and enabled, and the desktop app.

This is a provider: it owns the S3 client and the "Connect MinIO" form, but no panel of its own. Install extension-object-storage alongside it; the hub renders the connections tree, the object list and the transfer panel, and dispatches every operation here.

Want to try it without a server of your own? examples/docker-compose.yml starts a seeded MinIO in one command — the manual walks through it end to end.

Getting started

Open Object Storage in the activity bar → + → MinIO / S3-compatible.

Field	Notes
Endpoint	host:port, e.g. minio.corp.local:9000. A full https://… URL also works.
Access key / Secret key	Stored in the OS keychain, never in a workspace file.
Use HTTPS	Off for a plain-HTTP on-prem deployment.
Path-style addressing	On by default. Virtual-host style needs wildcard DNS, which on-prem deployments rarely have.
Region	Optional; MinIO ignores it, but the S3 protocol requires one to be sent. Defaults to us-east-1.

Editing an existing connection leaves the secret field blank — empty means "keep the stored key".

How it talks to the server

The renderer cannot reach an arbitrary origin (the desktop app's CSP pins connect-src), and the S3 object API needs PUT, HEAD and DELETE with raw binary bodies. So this extension ships a small Node helper process: it is spawned on demand via the host's managed-process bridge, listens on 127.0.0.1 behind a per-spawn token, and runs the official AWS SDK. Downloads stream to a temporary file and are renamed on completion, so an interrupted transfer never leaves a half-written file behind.

That helper is why connections are desktop-only — the browser edition has neither a process bridge nor a persistent secret store.

Two settings are available if the defaults clash with something on your machine: objectStorage.minio.sidecarPort (default 47613) and objectStorage.minio.nodePath (default node; Node 18+ required).

For agents and flows

Six capabilities go through the audited gateway: connect, listBuckets, listObjects, statObject, deleteObject (approval-gated) and disconnect.

Transfers are deliberately not exposed here — they take an absolute host path. Use the hub's object-storage.download / object-storage.upload, which resolve the path and gate the upload.

No capability accepts a credential: keys are entered in the connect form and looked up by connection id, so they never appear in a gateway payload.